# Darknet and Deepnet Mining for Proactive Cybersecurity Threat Intelligence

arXiv: https://arxiv.org/abs/1607.08583 · HTML: https://mlsanity.com/paper/1607.08583/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Jul 2016.

## Built on by (most cited first, 8 of 8)

- [A Survey on Data-driven Software Vulnerability Assessment and Prioritization](https://mlsanity.com/paper/2107.08364/) (2021)
- [SoK: The Impact of Unlabelled Data in Cyberthreat Detection](https://mlsanity.com/paper/2205.08944/) (2022)
- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [On the Importance of Domain-specific Explanations in AI-based Cybersecurity Systems (Technical Report)](https://mlsanity.com/paper/2108.02006/) (2021)
- [Mitigating Data Imbalance for Software Vulnerability Assessment: Does Data Augmentation Help?](https://mlsanity.com/paper/2407.10722/) (2024)
- [Towards Automated Classification of Attackers' TTPs by combining NLP with ML Techniques](https://mlsanity.com/paper/2207.08478/) (2022)
- [EUREKHA: Enhancing User Representation for Key Hackers Identification in Underground Forums](https://mlsanity.com/paper/2411.05479/) (2024)
- [A Language Model-Driven Semi-Supervised Ensemble Framework for Illicit Market Detection Across Deep/Dark Web and Social Platforms](https://mlsanity.com/paper/2507.22912/) (2025)

## Abstract (arXiv)

In this paper, we present an operational system for cyber threat intelligence gathering from various social platforms on the Internet particularly sites on the darknet and deepnet. We focus our attention to collecting information from hacker forum discussions and marketplaces offering products and services focusing on malicious hacking. We have developed an operational system for obtaining information from these sites for the purposes of identifying emerging cyber threats. Currently, this system collects on average 305 high-quality cyber threat warnings each week. These threat warnings include information on newly developed malware and exploits that have not yet been deployed in a cyber-attack. This provides a significant service to cyber-defenders. The system is significantly augmented through the use of various data mining and machine learning techniques. With the use of machine learning models, we are able to recall 92% of products in marketplaces and 80% of discussions on forums relating to malicious hacking with high precision. We perform preliminary analysis on the data collected, demonstrating its application to aid a security expert for better threat analysis.