Can We Unmask the Underground? Detecting and Predicting Hidden Forum Interactions
For cybersecurity analysts, HADES improves detection of hidden cybercriminal communities and enables early threat prediction, addressing a key bottleneck in current graph-based approaches.
HADES, an unsupervised framework using BERT embeddings, detects both dominant and hidden threat communities in underground forums, identifying specialized subgroups (<100 users) and predicting community formation up to a year before graph-based methods.
Cybercriminal underground forums enable anonymous collaboration, allowing users to trade illicit tools, discuss vulnerabilities, and distribute stolen data. Driven by shared interests and specialized skills, users on these platforms organize into distinct threat communities. However, identifying these communities is challenging due to their dynamic and opaque structures; traditional graph-based methods typically isolate dominant groups while overlooking smaller, hidden subgroups. This paper introduces HADES, an unsupervised framework designed to detect both dominant and hidden communities in underground forums. The framework models users based on their textual interactions and leverages pretrained language models to generate semantic embeddings that encode latent behavioral and thematic patterns. By clustering users based on semantic similarity and assigning topic labels to the resulting clusters, HADES identifies specific threat communities to support Cyber Threat Intelligence (CTI). The framework was evaluated on three major underground forums: HackForums, Cracked, and BreachForums. Results demonstrate that BERT embeddings consistently outperform alternative baselines, improving cluster coherence and achieving higher silhouette scores. Across these platforms, HADES identified dozens of distinct communities, effectively isolating small, specialized subgroups (fewer than 100 users) that evade traditional detection. Furthermore, because shared thematic interests frequently precede explicit structural connections, tracking these semantic patterns enables the framework to anticipate the formation of threat communities up to a year before they become detectable by traditional graph-based methods.