The Impact of Adverse Events in Darknet Markets: an Anomaly Detection Approach

Research output: Contribution to conferenceConference Paperpeer-review

58 Downloads (Pure)


In this paper, the notion of anomaly detection is introduced for the first time in the area of darknet markets (DNMs). Our hypothesis is that like popular social media platforms DNMs also exhibit anomalous behaviour. However, we propose that the meaning of anomalies in DNMs differs from social media anomalies. The social media anomalies are a cause of threat to the real world, while DNM anomalies are caused by threats from the real world. We present an unsupervised learning method developed to detect anomalies. The model is based on a weighted sum of a feature set trained through an evolutionary algorithm. Our approach successfully identifies anomalies in 35 DNMs – both at the community level and at the level of its user types. Our analysis shows that most of the anomalies found align with well-known adverse events - either as a direct consequence or as a cascading effect of the root event. Moreover, the model identified additional anomalies, which we were able to link to other events through post hoc analysis. Furthermore, we show that the adverse event of market shutdown generates a two-pronged impact on the ecosystem, i.e., it not only triggers startups of new markets but it does also inflict anomalies to current markets which may become fatal in some cases. We conclude that this two-pronged impact can be exploited by law enforcement agencies to produce maximum disruption in DNMs.
Original languageEnglish
Number of pages13
Publication statusUnpublished - 7 Sep 2021
EventWorkshop on Attackers and Cyber-Crime Operations - Virtual
Duration: 7 Sep 20217 Sep 2021
Conference number: 3


WorkshopWorkshop on Attackers and Cyber-Crime Operations
Abbreviated titleWACCO
Internet address


  • Darknet Markets
  • Anomaly Detection
  • Adverse Events
  • Unsupervised Learning
  • Evolutionary Algorithms


Dive into the research topics of 'The Impact of Adverse Events in Darknet Markets: an Anomaly Detection Approach'. Together they form a unique fingerprint.

Cite this