Cybercrime pathways on underground gaming forums

网络犯罪途径是犯罪者在首次和连续犯罪之前采取的常见步骤。了解途径有助于确定潜在的干预措施，以阻止未来的罪犯。国家犯罪局的报告已经确定在线游戏是网络犯罪的一个可能的切入点。例如，地下讨论平台提供了一个集中的会议场所，玩家可以在这里与网络犯罪分子互动并受到他们的影响。很少有人研究游戏作为网络犯罪的切入点的具体作用，特别是在地下黑客论坛中。除了论坛，有迹象表明，演员正在转向其他讨论平台，包括Discord（专门针对游戏玩家）。虽然我知道Discord被用于与游戏相关的网络犯罪讨论，但尚未发表任何关于这方面的研究。我将使用CrimeBB数据集，该数据集可用于剑桥网络犯罪中心的学术研究。除了Discord数据，CrimeBB还包含了160万用户从16个地下论坛平台上收集的7000多万篇帖子，这些帖子可以追溯到2002年。不同论坛和平台类型中数据集内容的变化导致不同的功能集可用。此外，数据集的规模，数百万用户多年来的交互，产生了额外的挑战，这需要使用大数据方法来减少处理时间。这项研究涵盖了多个学科，包括应用机器学习和统计技术、自然语言处理（NLP）以及对这些平台上的犯罪活动的研究。首先，我将研究如何将现有的分析技术用于基于时间序列的分析。例如，使用自然语言处理工具来模拟网络犯罪活动随时间推移的进展，需要考虑到平台成员使用的词汇不断变化。此外，犯罪者具有适应性，根据新的机会和商业模式调整其活动。将建立一个框架，综合适用于数据分析管道每个部分的现有分析技术和工具的知识，并确定需要采取新方法的地方，特别是纵向数据建模。该框架将包括对预测和验证方法的讨论，因为需要在复杂性和可解释性之间取得平衡以理解结果。其次，除了能够对不断变化的网络犯罪环境和词汇进行建模外，我还将调整现有工具，并创建可跨平台类型推广的新工具。由于平台数据集的大小和表示形式各不相同，因此需要克服一些挑战。将使用机器学习和大数据方法优化工具，以提高处理时间和效率。创建有用的工具包是一个关键的挑战，因为分析技术的结果取决于它们的质量。第三，我将应用我开发的工具来纵向分析讨论平台上网络犯罪途径的发展，以推断群体的行为特征。将采用增量或时序机器学习模型，对论坛上主要行为体不断变化的行为和社交网络进行建模。这将有助于以后对游戏相关途径的研究，通过创建可解释的模型来识别不断升级的网络犯罪活动的发展变化趋势。由于研究涉及对人类行为的分析，因此需要由该部门的道德委员会进行审查。不可能获得所有成员的知情同意（这将被视为垃圾邮件）。然而，由于这项工作分析的是集体行为，而不是确定个人，根据英国犯罪学学会的道德声明，它福尔斯知情同意的要求。

Cybercrime pathways are the common steps taken by offenders leading up to their first and successive offences. Understanding pathways is useful for identifying potential interventions to deter future offenders. Reports by the National Crime Agency have identified online gaming to be a possible entry point into cybercrime. For example, underground discussion platforms provide a centralised meeting place where gamers can interact with, and be influenced by, cybercriminals. There has been little research into the specific role of gaming as an entry point into cybercrime, specifically in underground hacking forums. In addition to forums, there are indications that actors are moving towards other discussion platforms, including Discord (which is aimed specifically at gamers). While I am aware Discord is being used for gaming-related cybercrime discussions, there has not yet been any research published on this. I will use the CrimeBB dataset, which is available for academic research from the Cambridge Cybercrime Centre. As well as Discord data, CrimeBB contains over 70 million posts written by 1.6 million users scraped from 16 underground forums platforms, dating back as far as 2002. The variation of dataset contents in different forums and across platform types results in different feature sets being available. Additionally, the scale of the datasets, with millions of users interacting over many years, produce additional challenges, which require the use of big data approaches to reduce processing time. This research spans disciplines including applied machine learning and statistical techniques, natural language processing (NLP), and studies into criminal activity on these platforms. First, I will look at how existing techniques used for analysis can be adapted for time-series based analyses. For example, the use of NLP tools to model the progression of cybercrime activity over time will need to account for the changing lexicons used by platform members. Furthermore, offenders are adaptive, modifying their activities in response to new opportunities and business models. A framework will be created to synthesise knowledge of existing analysis techniques and tools applicable to each part of the data analysis pipeline, and identify where new approaches are required, particularly for modelling the data longitudinally. The framework will include a discussion of prediction and validation methods, as a balance between complexity and interpretability is needed to understand results.Second, in addition to being able to model the changing cybercrime landscape and lexicons, I will adapt existing tools, and create new ones that are generalisable across platform types. There will be challenges to overcome due to the varying sizes and representations of platform datasets. Tools will be optimised using machine learning and big data approaches to improve processing time and efficiency. Creating useful toolkits is a key challenge, as the results of analysis techniques depend upon their quality.Third, I will apply the tools I develop to longitudinally analyse the development of cybercrime pathways on the discussion platforms, to infer behaviour characteristics of groups. Incremental or time-series machine learning models will be applied to model the changing behaviours and social networks of key actors on the forum. This will aid later research into gaming-related pathways, by creating interpretable models for identifying changing trends for progression of escalating cybercrime activity.As the research involves the analysis of human behaviours, it will require review by the department's ethics committee. It not possible to gain informed consent from all members (this would be considered spamming). However, as this work analyses collective behaviours rather than identifying individuals, under the British Society of Criminology's Statement of Ethics, it falls outside the requirement of informed consent.