# Cream Skimming the Underground: Identifying Relevant Information Points from Online Forums

arXiv: https://arxiv.org/abs/2308.02581 · HTML: https://mlsanity.com/paper/2308.02581/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 18 references that are in the map.
- First posted on arXiv 3 Aug 2023.

## Builds on (most cited first, 8 of 8)

- [Imbalanced-learn: A Python Toolbox to Tackle the Curse of Imbalanced Datasets in Machine Learning](https://mlsanity.com/paper/1609.06570/) (2016)
- [Exploit Prediction Scoring System (EPSS)](https://mlsanity.com/paper/1908.04856/) (2019)
- [What are the attackers doing now? Automating cyber threat intelligence extraction from text on pace with the changing threat landscape: A survey](https://mlsanity.com/paper/2109.06808/) (2021)
- [Technical Report -- Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits](https://mlsanity.com/paper/2102.07869/) (2021)
- [My Software has a Vulnerability, should I worry?](https://mlsanity.com/paper/1301.1275/) (2013)
- [Economic Factors of Vulnerability Trade and Exploitation](https://mlsanity.com/paper/1708.04866/) (2017)
- [THREAT/crawl: a Trainable, Highly-Reusable, and Extensible Automated Method and Tool to Crawl Criminal Underground Forums](https://mlsanity.com/paper/2212.03641/) (2022)
- [Recognizing and Extracting Cybersecurtity-relevant Entities from Text](https://mlsanity.com/paper/2208.01693/) (2022)

## Built on by (most cited first, 2 of 2)

- [Inferring Discussion Topics about Exploitation of Vulnerabilities from Underground Hacking Forums](https://mlsanity.com/paper/2405.04561/) (2024)
- [EventHunter: Dynamic Clustering and Ranking of Security Events from Hacker Forum Discussions](https://mlsanity.com/paper/2507.09762/) (2025)

## Abstract (arXiv)

This paper proposes a machine learning-based approach for detecting the exploitation of vulnerabilities in the wild by monitoring underground hacking forums. The increasing volume of posts discussing exploitation in the wild calls for an automatic approach to process threads and posts that will eventually trigger alarms depending on their content. To illustrate the proposed system, we use the CrimeBB dataset, which contains data scraped from multiple underground forums, and develop a supervised machine learning model that can filter threads citing CVEs and label them as Proof-of-Concept, Weaponization, or Exploitation. Leveraging random forests, we indicate that accuracy, precision and recall above 0.99 are attainable for the classification task. Additionally, we provide insights into the difference in nature between weaponization and exploitation, e.g., interpreting the output of a decision tree, and analyze the profits and other aspects related to the hacking communities. Overall, our work sheds insight into the exploitation of vulnerabilities in the wild and can be used to provide additional ground truth to models such as EPSS and Expected Exploitability.