Pith. sign in

REVIEW 4 major objections 6 minor 55 references

Identifying Key Expert Actors in Cybercrime Forums Based on their Technical Expertise

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that matching the CVE vulnerabilities mentioned in cybercrime forum posts to the CAPEC attack patterns they map to reveals coherent communities of actors with shared technical interests, and that the high-skill…

desk verdict A cleanly written, exploratory pipeline for finding technically specialized forum actors; plausible but the expertise proxy is unvalidated and the 4% headline is fragile to one discretionary cluster reclassification. read the letter →

arxiv 2506.01848 v2 pith:HEBPN2WS submitted 2025-06-02 cs.CR cs.CY

Estelle Ruellan , Francois Labreche , Masarah Paquet-Clouston This is my paper
classification cs.CRcs.CY
keywords cybercrimeforumskeyhackeridentificationtechnicalexpertiseCAPECCVEmentionsbimodalnetworkcommunitydetectionk-meansclustering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that technical expertise in cybercrime forums can be measured from the vulnerabilities actors mention in their posts, and that this measurement splits a large forum population into a small group of expert actors worth monitoring. By mapping each mentioned CVE to the corresponding attack pattern in the CAPEC taxonomy, the authors build a two-mode network connecting actors to attack patterns and run community detection. The communities that emerge group actors interested in similar attack techniques, such as privilege escalation, cross-site scripting, reconnaissance, and impersonation. Within those communities, actors are scored on skill, commitment, and activity, and clustered into the categories of a criminological framework. The central result is that high-skill, high-commitment experts make up about 4% of the studied population, while about half are amateurs.

What carries the argument

The central object is the bimodal actor-CAPEC network, in which each forum actor is linked to the attack patterns (CAPECs) corresponding to the CVEs they mention, with the CVE-to-CAPEC mapping performed through shared CWE weakness identifiers. Community detection on this network reveals groups of actors interested in similar attack patterns. Expertise is then operationalized with two facets from a criminological framework: skill level, taken from the 70th percentile of the CAPEC skill-level values associated with an actor, and commitment, the share of an actor's posts that reference their community's attack patterns; a third variable, activity rate, measures posting frequency over the actor's active period. K-means clustering on these three variables partitions the sample into eight clusters interpreted through the professional, pro-amateur, average career criminal, and amateur categories.

What would settle it

The central claim would be falsified if qualitative review of the identified expert actors showed that they mostly repost CVE announcements or are security researchers and law enforcement rather than technically engaged attackers, or if the community structure and the 4% expert share disappeared when an alternative CVE-to-CAPEC mapping or a different community-detection method was used.

Watch

Extended reading notes

Core claim

The author's central claim is that the actor-CAPEC bimodal network displays a genuine community structure that groups actors by shared interest in attack patterns, and that key expert actors—those with high skill and high commitment in their community—represent about 4% of the study population. This is established by linking 2,321 actors to 263 attack patterns through CVE mentions, detecting eight communities of interest, and then clustering the 359 actors with enough posts on skill level, commitment, and activity rate. The result is that the four categories of the criminological framework are present, with professionals (the experts) at 3.90%, pro-amateurs at 31.20%, average career criminals at 10.02%, and amateurs at 54.87%. The paper therefore claims that a CVE/CAPEC-based measurement can reduce a large forum population to a small set of technically specialized actors for cyber threat intelligence.

Load-bearing premise

The load-bearing premise is that an actor mentioning a CVE, and the CAPEC attack pattern mapped to that CVE through CWE identifiers, is a valid proxy for the actor's interest in and technical skill at that attack pattern; if this proxy fails, the communities and expert labels are artifacts of keyword matching.

Editorial extensions

If this is right

  • If correct, threat intelligence teams can reduce a forum population of thousands to a small set of technically specialized actors, about 4%, worth monitoring.
  • Forums contain coherent groups of actors focused on particular attack patterns, such as privilege escalation or XSS, so intelligence can be organized by attack technique rather than by forum.
  • About half of the studied population shows little technical expertise, suggesting most forum members are not the primary threat.
  • The pro-amateur group, roughly 31%, has high skill but low commitment and may be the talent pool from which future experts emerge.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The method could be applied to other online communities or marketplaces where CVE mentions appear, with the threshold parameters likely needing re-estimation for each new sample.
  • The skill measurement is static and could be extended into a longitudinal study of how actors move between the amateur, pro-amateur, and professional categories over time.
  • Because the paper explicitly notes that cybersecurity analysts and law enforcement may be classified alongside malicious actors, the 4% figure may overstate the number of genuinely malicious experts.
  • A natural testable extension is to validate the expert labels against independent indicators, such as the sale of exploit code or detailed technical tutorials, rather than only CVE mentions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes a CVE/CAPEC-based pipeline to identify technically expert actors in cybercrime forums. It builds a bimodal actor-CAPEC network from posts mentioning CVEs, applies Leiden community detection to find communities of interest, measures each actor's skill level from MITRE's CAPEC 'Skill Level Required' metric, computes commitment as the share of in-community CVE/CAPEC posts, and then applies k-means clustering on skill, commitment, and activity rate. The clusters are interpreted with Bouchard and Nguyen's professional-criminal framework, yielding the headline results that 'professionals' (key expert actors) are about 4% of the 359-actor sample and that amateurs are about 54.87% of the sample. The paper frames this as a method to reduce the population of interest for cyber threat intelligence resource allocation.

Significance. If the method and its central numbers held, the contribution would be practically valuable: it operationalizes technical expertise in forum data at scale, extends key-hacker identification beyond centrality and reputation measures, and offers a concrete scarcity estimate for monitoring. Strengths include the use of a public standardized vulnerability/attack-pattern taxonomy, transparent reporting of many filtering thresholds and cluster centroids, and a candid limitations section. The main quantitative claims are nevertheless built on an unvalidated expertise proxy and on cluster-labeling decisions that are not fully determined by the reported criteria, so the contribution is currently more methodological than empirical. The paper is a reasonable candidate after substantial revision: the core pipeline is coherent, but the evidence supporting the 4% and 54.87% headline figures needs to be materially strengthened.

major comments (4)
  1. [III.C, III.F.1, VII] The central expertise measure is unvalidated. Any post mentioning a CVE creates an actor-CAPEC edge, and the actor's skill level is then read off MITRE's 'Skill Level Required' for the mapped CAPECs; no part of the pipeline checks whether the post demonstrates ability, intent, or understanding. A one-line CVE mention, a question, copied news, or an undercover researcher's post all receive the same edge and the same skill assignment. The limitations section (VII) explicitly concedes CVE-CAPEC information loss, the 'black box' nature of MITRE's metric, and the proxy-based, static character of the expertise measure. Since the 4% and 54.87% headline figures are direct outputs of this proxy, the paper needs at least a manual content-validation subsample and a comparison against a content-based or reputation-based skill signal before those numbers can be treated as estimates of actual expertise.
  2. [V.C, Table IX] The labeling of cluster 1 as Pro-Amateur is not consistent with the paper's stated definition of professionals. Cluster 1 has centroid [2.81; 97.62; 5.14], i.e., high skill and 97.62% commitment, and differs from cluster 2 (Professionals) essentially in activity rate and in the short active window. The paper's own framework defines professionals as high skill and high commitment, with activity rate added only as a descriptive third variable. Reclassifying cluster 1 as professionals changes the key-expert share from 14/359 = 3.90% to 35/359 = 9.75%, which is a material change to the scarcity claim. The paper needs an explicit, pre-specified decision rule for when short-lived activity overrides the two defining dimensions, or a sensitivity analysis reporting both variants.
  3. [III.C.1, III.F.2, V.C] The headline proportions are not shown to be robust to the distribution-driven thresholds. The final 359-actor sample is produced by removing CAPECs with in-degree above 500, dropping actors with fewer than four specialized posts, taking the 70th percentile of each actor's skill list, requiring at least 50% of a post's CAPECs to fall in the actor's community, and selecting eight k-means clusters; several of these choices are justified by the same data ('elbow', 'easier to work with', silhouette score). No sensitivity analysis reports how the 4% professional share or the 54.87% amateur share changes under neighboring thresholds or different values of k. Because the paper's central contribution is a scarcity estimate, a threshold-stability table is needed before the 'tiny proportion' claim is supportable.
  4. [III.F.1] Assigning each CAPEC its highest Skill Level Required scenario, and then taking the 70th percentile of the resulting list, systematically inflates skill scores. The paper acknowledges the overestimation in Section VII but does not quantify its effect on the final cluster assignments. Since the professional/amateur categories are defined by cutoffs on this inflated scale, an actor's category can change when the scenario rule or the percentile choice is varied; a sensitivity analysis over these choices is necessary to establish that the 4% figure is not an artifact of the skill-scoring rule.
minor comments (6)
  1. [V.B] The text on the Recon community says members 'sit at the top for average number of 76 CAPECs: they have a link with 61 CAPECs,' which is internally inconsistent; Table VIII reports a mean out-degree of 61, so the text should be corrected.
  2. [III.C.1] The phrase 'Using Slash in Using Slashes' with CAPEC IDs 79, 64, 78, 76 is garbled; please list the CAPEC names and IDs cleanly.
  3. [III.F.1, Table III] The column header 'Nb CAPECs' is ambiguous: the table appears to report counts of skill-level values across actors' lists, not just the number of CAPECs per skill level; please clarify the denominator in the caption or the column header.
  4. [II.C, Table I] Table I lacks a visible table number/caption in the extracted text, and the citation to Bouchard and Nguyen [5] does not include a year or publisher in the reference list; please complete the bibliographic entry.
  5. [References] Reference [8] appears incomplete ('Chi chi. Two approaches to the study of experts' characteristics'); please update it.
  6. [Throughout] There are several spacing and typographical errors, including 'known asthe key hacker identification problem' in the Introduction; a careful proofreading pass is needed.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the 4% expert figure and community findings are the output of an algorithmic pipeline built on external CVE/CAPEC data, not quantities fed back into the model's construction.

full rationale

The derivation chain is not circular. The authors start from external inputs—Flare forum posts mentioning CVEs, MITRE's CVE-to-CAPEC mapping, and MITRE's CAPEC skill-level rubric—construct an actor-CAPEC bimodal network, run Leiden community detection and k-means clustering, and only then attach Bouchard and Nguyen's labels to the resulting clusters. The 'about 4%' professionals figure is a count of one cluster after algorithmic clustering (14/359), not a target value used to calibrate the model. No equation defines a post, a CAPEC, or a community in terms of the final expert share, and no external prediction is claimed; the resource-allocation recommendation is an interpretation of the cluster sizes, not a derived prediction from the target result. The weakest links are validity concerns rather than circularity: CVE mentions are an unvalidated proxy for demonstrated skill, the paper itself concedes that MITRE's 'Skill Level Required' metric is a 'black box', the 70th-percentile and minimum-four-posts thresholds are calibrated on the same sample, and cluster 1 (high skill and high commitment by the paper's own variables) is relabeled pro-amateur because of a short activity window. These choices affect robustness and external validity, but they do not make the 4% result equivalent to its inputs by construction. The self-citations ([35], [36], [37], [38]) support tool usage and community-detection conventions and are not load-bearing for the expertise-identification result.

Assumptions & free parameters 6 free parameters · 8 assumptions · 0 invented entities

No new physical or theoretical entities are proposed. The free parameters are all thresholds chosen from the sample distribution, and the axioms are the proxy assumptions connecting CVE mentions, CAPEC mappings, and MITRE skill ratings to the concept of technical expertise. The classification into professionals, pro-amateurs, average career criminals, and amateurs is an operational categorization built from these assumptions.

free parameters (6)
  • CAPEC in-degree filter threshold = 500 actors
    CAPECs mentioned by more than 500 actors are removed; the threshold is chosen from an apparent elbow in the in-degree distribution (Section III.C.1).
  • Skill level representative percentile = 70th percentile
    Each actor's list of Low, Medium, and High CAPEC skill values is summarized by the 70th percentile so that only actors with over 30% High values are treated as highly skilled (Section III.F.1).
  • Minimum specialized posts = 4 posts
    Actors with fewer than four posts containing a CVE with a mapped CAPEC are removed to make commitment levels meaningful, reducing the sample from 2,321 to 359 actors (Section III.F.2).
  • In-interest post threshold = 50% of referenced CAPECs in the actor's community
    A post is counted as in-interest only if at least half of its referenced CAPECs belong to the actor's community (Section III.F.2).
  • Number of k-means clusters = 8
    The silhouette score of 0.569 is used to select the eight-cluster model (Section V.C).
  • CAPEC skill scenario rule = highest scenario
    Each CAPEC is assigned the highest Skill Level Required scenario, which deliberately biases skill estimates upward (Section III.F.1).
assumptions (8)
  • standard math Leiden community detection and modularity-based evaluation recover meaningful actor groupings.
    The algorithm is standard and no formal proof is needed; the paper cites Traag et al. for the algorithm's guarantees.
  • domain assumption A CVE mention in a post is a valid proxy for the author's interest in the corresponding attack pattern.
    This is the foundation of the entire network, introduced in Section III.C when actors are linked to CAPECs through CVE mentions.
  • domain assumption MITRE's CVE-to-CAPEC mapping through CWE identifiers is accurate enough for the analysis.
    Section III.C states the mapping is done through matching CWE identifiers; the limitations section acknowledges possible information loss in the association.
  • domain assumption MITRE's Skill Level Required metric is a valid measure of the skill an actor demonstrates by mentioning a CAPEC.
    Used in Section III.F.1 to convert each actor's CAPECs into skill values; the paper itself describes the metric as a black box.
  • ad hoc to paper CAPECs mentioned by more than 500 actors are too general to identify precise attack interests and can be removed.
    Section III.C.1 applies the 500-in-degree filter based on an apparent elbow, removing 57 CAPECs and 987 actors.
  • ad hoc to paper A post belongs to an actor's community of interest if at least 50% of its CAPECs are in that community.
    Defined in Section III.F.2 to compute commitment; the 50% rule is chosen for the sample rather than derived from theory.
  • ad hoc to paper Actors with fewer than four specialized posts cannot have meaningful commitment and are excluded.
    Section III.F.2 drops 1,962 actors based on this distribution-driven rule, which directly shapes the final sample and the 4% figure.
  • ad hoc to paper Cluster 1, with high skill and 97.62% commitment, is interpreted as pro-amateur rather than professional because its activity is short-lived.
    Section V.C relabels a cluster that matches the framework's professional criteria, which lowers the reported expert share.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Identifying Key Expert Actors in Cybercrime Forums Based on their Technical Expertise." pith.science (2026). https://pith.science/paper/HEBPN2WS

@misc{pith2026250601848,
  author       = {Pith},
  title        = {Pith review of: Identifying Key Expert Actors in Cybercrime Forums Based on their Technical Expertise},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HEBPN2WS}},
  note         = {Machine review of arXiv:2506.01848}
}
read the original abstract

The advent of Big Data has made the collection and analysis of cyber threat intelligence challenging due to its volume, leading research to focus on identifying key threat actors; yet these studies have failed to consider the technical expertise of these actors. Expertise, especially towards specific attack patterns, is crucial for cybercrime intelligence, as it focuses on targeting actors with the knowledge and skills to attack enterprises. Using CVEs and CAPEC classifications to build a bimodal network, as well as community detection, k-means and a criminological framework, this study addresses the key hacker identification problem by identifying communities interested in specific attack patterns across cybercrime forums and their related key expert actors. The analyses reveal several key contributions. First, the community structure of the CAPEC-actor bimodal network shows that there exists groups of actors interested in similar attack patterns across cybercrime forums. Second, key actors identified in this study account for about 4% of the study population. Third, about half of the study population are amateurs who show little technical expertise. Finally, key actors highlighted in this study represent a promising scarcity for resources allocation in cyber threat intelligence production. Further research should look into how they develop and use their technical expertise in cybercrime forums.

Figures

Figures reproduced from arXiv: 2506.01848 by the authors.

Figure 1
Figure 1. displays the top 25 forums with the most posts. The forum with the most posts was exploit in with 1,908 posts (16.51% of total posts), followed by xss is with a little less than 13% of all posts. As shown in the figure, the distribution of posts across forums was uneven, since 99 forums had fewer than 100 posts and 43 of them had fewer than 10 posts [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Bimodal actor-CAPEC Network Colored according to Communities of [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Bimodal actor-CAPEC Network Colored Legend [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Partition of the model with k=8 clusters [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

55 extracted references · 53 canonical work pages

  1. [1]

    Descriptive analytics: Examining expert hackers in web forums

    Ahmed Abbasi, Weifeng Li, Victor Benjamin, Shiyu Hu, and Hsinchun Chen. Descriptive analytics: Examining expert hackers in web forums. In2014 IEEE Joint Intelligence and Security Informatics Conference, pages 56–63

    work page

  2. [2]

    Comparison between louvain and leiden algorithm for network structure: A review

    Siti Haryanti Hairol Anuar, Zuraida Abal Abas, Norhazwani Mohd Yunos, Nurul Hafizah Mohd Zaki, Nurul Akmal Hashim, Mohd Farid- dudin Mokhtar, Siti Azirah Asmai, Zaheera Zainal Abidin, and Ah- mad Fadzli Nizam. Comparison between louvain and leiden algorithm for network structure: A review. 2129(1):012028. Publisher: IOP Publishing

    work page

  3. [3]

    Bartol and Anne M

    Curt R. Bartol and Anne M. Bartol.Criminal Behavior: A Psychological Approach. Pearson, Upper Saddle River, NJ, 10th edition, 2014

    work page 2014

  4. [4]

    Securing cyberspace: Identifying key actors in hacker communities

    Victor Benjamin and Hsinchun Chen. Securing cyberspace: Identifying key actors in hacker communities. In2012 IEEE International Confer- ence on Intelligence and Security Informatics, pages 24–29

    work page

  5. [5]

    Professionals or amateurs? revisiting the notion of professional crime in the context of cannabis cultivation

    Martin Bouchard and Holly Nguyen. Professionals or amateurs? revisiting the notion of professional crime in the context of cannabis cultivation. InWorld Wide Weed. Routledge. Num Pages: 18

    work page

  6. [6]

    Helen Butler and Theresa A. Gannon. The scripts and expertise of firesetters: A preliminary conceptualization. 20:72–81

    work page

  7. [7]

    Commu- nities in criminal networks: A case study

    Francesco Calderoni, Domenico Brunetto, and Carlo Piccardi. Commu- nities in criminal networks: A case study. 48:116–125

    work page

  8. [8]

    Two approaches to the study of experts’ characteristics

    Chi chi. Two approaches to the study of experts’ characteristics

    work page

Show all 55 references
  1. [9]

    Cybercrime is (often) boring: Infrastructure and alienation in a deviant subculture.The British Journal of Criminology, 61(5):1407–1423, 2021

    Ben Collier, Richard Clayton, Alice Hutchings, and Daniel Thomas. Cybercrime is (often) boring: Infrastructure and alienation in a deviant subculture.The British Journal of Criminology, 61(5):1407–1423, 2021

    2021

  2. [10]

    The social network of hackers

    David D ´ecary-H´etu and Benoit Dupont. The social network of hackers. 13(3):160–175. Publisher: Routledge eprint: https://doi.org/10.1080/17440572.2012.702523

    2012

  3. [11]

    Eck and D

    John E. Eck and D. Kim Rossmo. The new detective. 18(3):601–

  4. [12]

    ERICSSON EXPERTISE

    ERICSSON ERICSSON. ERICSSON EXPERTISE

  5. [13]

    Anders Ericsson

    K. Anders Ericsson. The influence of experience and deliberate practice on the development of superior expert performance. InThe Cambridge handbook of expertise and expert performance, pages 683–703. Cam- bridge University Press

  6. [14]

    Exploring key hackers and cybersecurity threats in chinese hacker communities

    Zhen Fang, Xinyi Zhao, Qiang Wei, Guoqing Chen, Yong Zhang, Chunxiao Xing, Weifeng Li, and Hsinchun Chen. Exploring key hackers and cybersecurity threats in chinese hacker communities. In2016 IEEE Conference on Intelligence and Security Informatics (ISI), pages 13–18

  7. [15]

    The global risks report 2023 18th edition

    World Economic Forum. The global risks report 2023 18th edition

    2023

  8. [16]

    The challenge of cyber attack deterrence

    Kenneth Geers. The challenge of cyber attack deterrence. 26(3):298– 303

  9. [17]

    Iden- tifying mobile malware and key threat actors in online hacker forums for proactive cyber threat intelligence

    John Grisham, Sagar Samtani, Mark Patton, and Hsinchun Chen. Iden- tifying mobile malware and key threat actors in online hacker forums for proactive cyber threat intelligence. In2017 IEEE International Conference on Intelligence and Security Informatics (ISI), pages 13– 18

  10. [18]

    Professional crime: Change, continuity and the enduring myth of the underworld

    Dick Hobbs. Professional crime: Change, continuity and the enduring myth of the underworld. 31(1):57–72. Publisher: SAGE Publications Ltd

  11. [19]

    Robert R. Hoffman. How can expertise be defined? implications of research from cognitive psychology. In Robin Williams, Wendy Faulkner, and James Fleck, editors,Exploring Expertise: Issues and Perspectives, pages 81–100. Palgrave Macmillan UK

  12. [20]

    Hoffman, Nigel R

    Robert R. Hoffman, Nigel R. Shadbolt, A. Mike Burton, and Gary Klein. Eliciting knowledge from experts: A methodological analysis. 62(2):129–158

  13. [21]

    Thomas J. Holt. subcultural evolution? examining the influence of on- and off-line experiences on deviant subcultures. 28(2):171–198. Pub- lisher: Routledge eprint: https://doi.org/10.1080/01639620601131065

    doi

  14. [22]

    Holt and Max Kilger

    Thomas J. Holt and Max Kilger. Techcrafters and makecrafters: A comparison of two populations of hackers. In2008 WOMBAT Workshop on Information Security Threats Data Collection and Sharing, pages 67– 78

  15. [23]

    Hsiu-Fang Hsieh and Sarah E. Shannon. Three approaches to qualitative content analysis. 15(9):1277–1288. Publisher: SAGE Publications Inc

  16. [24]

    HackerRank: Identifying key hackers in underground forums

    Cheng Huang, Yongyan Guo, Wenbo Guo, and Ying Li. HackerRank: Identifying key hackers in underground forums. 17(5):15501477211015145. Publisher: SAGE Publications

  17. [25]

    Digital drift and the evolution of a large cybercrime forum

    Jack Hughes and Alice Hutchings. Digital drift and the evolution of a large cybercrime forum. In2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pages 183–193. ISSN: 2768- 0657

  18. [26]

    Anil K. Jain. Data clustering: 50 years beyond k-means. 31(8):651–666

  19. [27]

    Identifying proficient cyber- criminals through text and network analysis

    Jan William Johnsen and Katrin Franke. Identifying proficient cyber- criminals through text and network analysis. In2020 IEEE International Conference on Intelligence and Security Informatics (ISI), pages 1–7

  20. [28]

    SAGE Publications

    Klaus Krippendorff.Content Analysis: An Introduction to Its Method- ology. SAGE Publications. Google-Books-ID: nE1aDwAAQBAJ

  21. [29]

    Community finding of malware and exploit vendors on darkweb marketplaces

    Ericsson Marin, Mohammed Almukaynizi, Eric Nunes, and Paulo Shakarian. Community finding of malware and exploit vendors on darkweb marketplaces. In2018 1st International Conference on Data Intelligence and Security (ICDIS), pages 81–84

  22. [30]

    Mining key- hackers on darkweb forums

    Ericsson Marin, Jana Shakarian, and Paulo Shakarian. Mining key- hackers on darkweb forums. In2018 1st International Conference on Data Intelligence and Security (ICDIS), pages 73–80

  23. [31]

    V oelker

    Marti Motoyama, Damon McCoy, Kirill Levchenko, Stefan Savage, and Geoffrey M. V oelker. An analysis of underground forums. In Proceedings of the 2011 ACM SIGCOMM conference on Internet mea- surement conference, IMC ’11, pages 71–80. Association for Computing Machinery

    2011

  24. [32]

    Understanding expertise in burglars: From pre-conscious scanning to action and beyond

    Claire Nee. Understanding expertise in burglars: From pre-conscious scanning to action and beyond. 20:53–61

  25. [33]

    Review of expertise and its general implications for correctional psychology and criminology

    Claire Nee and Tony Ward. Review of expertise and its general implications for correctional psychology and criminology. 20:1–9

  26. [34]

    M. E. J. Newman and M. Girvan. Finding and evaluating community structure in networks. 69(2):026113

  27. [35]

    A robust measure to uncover community brokerage in illicit networks

    Masarah Paquet-Clouston and Martin Bouchard. A robust measure to uncover community brokerage in illicit networks. 39(3):705–733

  28. [36]

    On the motivations and challenges of affiliates involved in cybercrime.Trends in Organized Crime, pages 1–30, 2022

    Masarah Paquet-Clouston and Sebasti ´an Garc ´ıa. On the motivations and challenges of affiliates involved in cybercrime.Trends in Organized Crime, pages 1–30, 2022

    2022

  29. [37]

    Entanglement: cybercrime connections of a public forum population

    Masarah Paquet-Clouston, Serge-Olivier Paquette, Sebastian Garcia, and Maria Jos´e Erquiaga. Entanglement: cybercrime connections of a public forum population. 8(1):tyac010

  30. [38]

    The role of informal workers in online economic crime

    Masarah-Cynthia Paquet-Clouston. The role of informal workers in online economic crime. Publisher: Simon Fraser University

  31. [39]

    Using social network analysis to identify key hackers for keylogging tools in hacker forums

    Sagar Samtani and Hsinchun Chen. Using social network analysis to identify key hackers for keylogging tools in hacker forums. In2016 IEEE Conference on Intelligence and Security Informatics (ISI), pages 319–321

  32. [40]

    Nunamaker

    Sagar Samtani, Ryan Chinn, Hsinchun Chen, and Jay F. Nunamaker. Exploring emerging hacker assets and key hackers for proactive cyber threat intelligence. 34(4):1023–1053. Publisher: Routledge eprint: https://doi.org/10.1080/07421222.2017.1394049

  33. [41]

    Schaefer, Martin Bouchard, Jacob T

    David R. Schaefer, Martin Bouchard, Jacob T. N. Young, and Derek A. Kreager. Friends in locked places: An investigation of prison inmate network structure. 51:88–103

  34. [42]

    H. G. Schmidt, G. R. Norman, and H. P. Boshuizen. A cognitive perspective on medical expertise: theory and implication [published erratum appears in acad med 1992 apr;67(4):287]. 65(10):611

    1992

  35. [43]

    Skill in chess

    Herbert Simon and William Chase. Skill in chess. In David Levy, editor, Computer Chess Compendium, pages 175–188. Springer

  36. [44]

    Sutherland

    Edwin H. Sutherland. The professional thief. 28(2):161–163. Publisher: Northwestern University School of Law

  37. [45]

    Criminal expertise and offender decision-making: An experimental analysis of how offenders and non-offenders differentially perceive social stimuli

    V olkan Topalli. Criminal expertise and offender decision-making: An experimental analysis of how offenders and non-offenders differentially perceive social stimuli. 45(3):269–295

  38. [46]

    it takes skills to take a car

    V olkan Topalli, Scott Jacques, and Richard Wright. “it takes skills to take a car”: Perceptual and procedural expertise in carjacking. 20:19–25

  39. [47]

    V . A. Traag, L. Waltman, and N. J. van Eck. From louvain to leiden: guaranteeing well-connected communities. 9(1):5233. Number: 1 Publisher: Nature Publishing Group

  40. [48]

    Expertise

    Tamara van Gog. Expertise. In Norbert M. Seel, editor,Encyclopedia of the Sciences of Learning, pages 1238–1240. Springer US

  41. [49]

    Vicente and JoAnne H

    Kim J. Vicente and JoAnne H. Wang. An ecological theory of expertise effects in memory recall. 105(1):33–57. Place: US Publisher: American Psychological Association

  42. [50]

    Vieraitis, Heith Copes, Zachary A

    Lynne M. Vieraitis, Heith Copes, Zachary A. Powell, and Ashley Pike. A little information goes a long way: Expertise and identity theft. 20:10– 18

  43. [51]

    Cambridge University Press

    Stanley Wasserman and Katherine Faust.Social Network Analysis: Methods and Applications. Cambridge University Press. Google-Books- ID: CAm2DpIqRUIC

  44. [52]

    Richard Wright and Robert H. Logie. How young house burglars choose targets. 27(2):92–104. eprint: https://onlinelibrary.wiley.com/doi/pdf/10.1111/j.1468- 2311.1988.tb00608.x

    1988

  45. [53]

    LOGIE, and SCOTT H

    RICHARD WRIGHT, ROBERT H. LOGIE, and SCOTT H. DECKER. Criminal expertise and offender decision making: An experimental study of the target selection process in residential burglary. 32(1):39–53. Publisher: SAGE Publications Inc

  46. [54]

    Yue, and Michael Chau

    Xiong Zhang, Alex Tsang, Wei T. Yue, and Michael Chau. The classification of hackers by knowledge exchange behaviors. 17(6):1239– 1251

  47. [622]

    eprint: https://onlinelibrary.wiley.com/doi/pdf/10.1111/1745- 9133.12450

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.