The Impact of Adverse Events in Darknet Markets: an Anomaly Detection Approach

In this paper, the notion of anomaly detection is introduced for the first time in the area of darknet markets (DNMs). Our hypothesis is that like popular social media platforms DNMs also exhibit anomalous behaviour. However, we propose that the meaning of anomalies in DNMs differs from social media anomalies. The social media anomalies are a cause of threat to the real world, while DNM anomalies are caused by threats from the real world. We present an unsupervised learning method developed to detect anomalies. The model is based on a weighted sum of a feature set trained through an evolutionary algorithm. Our approach successfully identifies anomalies in 35 DNMs - both at the community level and at the level of its user types. Our analysis shows that most of the anomalies found align with well-known adverse events-either as a direct consequence or as a cascading effect of the root event. Moreover, the model identified additional anomalies, which we were able to link to other events through post hoc analysis. Furthermore, we show that the adverse event of market shutdown generates a two-pronged impact on the ecosystem, i.e., it not only triggers startups of new markets but it does also inflict anomalies to current markets which may become fatal in some cases. We conclude that this two-pronged impact can be exploited by law enforcement agencies to produce maximum disruption in DNMs.