Can We Unmask the Underground? Detecting and Predicting Hidden Forum Interactions

Presents HADES, an unsupervised framework for detecting both dominant and small/hidden threat communities in cybercrime underground forums by modeling users from their textual interactions. HADES uses pretrained language models (BERT) to generate semantic user embeddings, clusters users by semantic similarity, and assigns topic labels to clusters to produce actionable CTI. Evaluated on HackForums, Cracked, and BreachForums, BERT embeddings improved cluster coherence and silhouette scores versus baselines and enabled identification of dozens of distinct communities (including subgroups with <~0