Abstract
The deep and darkweb (d2web) refers to limited access web sites that requireregistration, authentication, or more complex encryption protocols to accessthem. These web sites serve as hubs for a variety of illicit activities: totrade drugs, stolen user credentials, hacking tools, and to coordinate attacksand manipulation campaigns. Despite its importance to cyber crime, the d2webhas not been systematically investigated. In this paper, we study a largecorpus of messages posted to 80 d2web forums over a period of more than a year.We identify topics of discussion using LDA and use a non-parametric HMM tomodel the evolution of topics across forums. Then, we examine the dynamicpatterns of discussion and identify forums with similar patterns. We show thatour approach surfaces hidden similarities across different forums and can helpidentify anomalous events in this rich, heterogeneous data.