Darkweb Cyber Threat Intelligence Mining

by John Robertson, Ahmad Diab, Ericsson Marin

The important and rapidly emerging new field known as 'cyber threat intelligence' explores the paradigm that defenders of computer networks gain a better understanding of their adversaries by understanding what assets they have available for an attack. In this book, a team of experts examines a new type of cyber threat intelligence from the heart of the malicious hacking underworld - the dark web. These highly secure sites have allowed anonymous communities of malicious hackers to exchange ideas and techniques, and to buy/sell malware and exploits. Aimed at both cybersecurity practitioners and researchers, this book represents a first step toward a better understanding of malicious hacking communities on the dark web and what to do about them. The authors examine real-world darkweb data through a combination of human and automated techniques to gain insight into these communities, describing both methodology and results.

216 pages, Kindle Edition

Published April 4, 2017

About the author

There is more than one author by this name on Goodreads

See also:
John Robertson*, football
John Robertson, indie games
John Robertson*, business, investing
John Robertson*, author "the Wanderer Rises"
John Robertson, politician, 1787-1873
John Robertson, philosophy
John Robertson, music biographies
John Robertson, history

An asterisk (*) indicates that this is a Goodreads author

Reviews

[Chad · Rating 2 out of 5]

There's a small amount of useful info about accessing and understanding dark web forums, but most of the book is about data-mining techniques and algorithms.

Here's a summary from the end of the book:

after providing motivation for the use of cyber threat intelligence, we discussed online hacker community structure in detail and introduced data-mining and machine-learning techniques to digest large amounts of data from these communities. We then further analyzed this data and the structure of these hacker communities via unsupervised learning. Finally, we introduced models capable of leveraging this data to provide system-specific information with both a game theoretic host defense model and an industrial control system defense model. Through all of these applications, we hoped to illustrate the utility of cyber threat intelligence and demonstrate that systems with real-world value can be built.

Notes
Tiered layers of cyber threat intelligence (basic to advanced)
1. Situational awareness: shared info on current threats
2. Imminent threats: threats directed toward specific org
3. Understand capabilities: malware, exploits, hacking services
4. Understand communities: market dynamics, key personalities, nature of conversation

Dark web tips
• Use Tails.
• Disable JavaScript.
• Use a different username on each site, unless you want to build a reputation.

Hacker forums frequently use PGP keys as proof of identity.