Identification of Malicious Posts on the Dark Web Using Supervised Machine Learning

2025-11-28

AI Summary

To address the challenge of identifying malicious cyberthreat posts in Brazilian Portuguese dark web forums, this paper proposes the first systematic detection framework tailored to this language. Methodologically, we construct three original annotated datasets and design a multi-stage annotation strategy integrating threat indicators, contextual keywords, and expert validation. We employ TF-IDF representation with LightGBM for supervised classification and complement it with LDA topic modeling for unsupervised robustness verification. Our key contributions are: (1) the first structured cyberthreat identification framework for Portuguese dark web content; (2) a novel annotation paradigm and hybrid validation framework specifically designed for low-resource, minority-language dark web texts. Experimental results demonstrate high classification accuracy, while topic coherence analysis confirms strong generalization capability on unlabeled data, underscoring practical deployability.

Technology Category

• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)
• Machine Learning: Multi-class/Multi-label Learning & Extreme Classification
• Data Mining & Knowledge Management: Semantic Web

Application Category

• Web Mining and Content Analysis: Large pretrained models with web data
• Search and Retrieval-Augmented AI: Multilingual and cross-lingual Web search
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

Given the constant growth and increasing sophistication of cyberattacks, cybersecurity can no longer rely solely on traditional defense techniques and tools. Proactive detection of cyber threats has become essential to help security teams identify potential risks and implement effective mitigation measures. Cyber Threat Intelligence (CTI) plays a key role by providing security analysts with evidence-based knowledge about cyber threats. CTI information can be extracted using various techniques and data sources; however, machine learning has proven promising. As for data sources, social networks and online discussion forums are commonly explored. In this study, we apply text mining techniques and machine learning to data collected from Dark Web forums in Brazilian Portuguese to identify malicious posts. Our contributions include the creation of three original datasets, a novel multi-stage labeling process combining indicators of compromise (IoCs), contextual keywords, and manual analysis, and a comprehensive evaluation of text representations and classifiers. To our knowledge, this is the first study to focus specifically on Brazilian Portuguese content in this domain. The best-performing model, using LightGBM and TF-IDF, was able to detect relevant posts with high accuracy. We also applied topic modeling to validate the model's outputs on unlabeled data, confirming its robustness in real-world scenarios.

Problem

• Identifying malicious posts on Dark Web forums using machine learning
• Creating datasets and labeling process for Brazilian Portuguese content
• Evaluating text representations and classifiers for threat detection

Innovation

• LightGBM and TF-IDF for malicious post detection
• Multi-stage labeling with IoCs and contextual keywords
• First Brazilian Portuguese Dark Web dataset creation