How can we identify malicious hackers participating in different online platforms using their usernames only? Disambiguating users across online platforms (e.g. security forums, GitHub, YouTube) is an essential capability for tracking malicious hackers. Although a hacker could pick arbitrary names on different platforms, they often use the same or similar usernames as this helps them establish an online "brand". We propose GeekMAN, a systematic human-inspired approach to identify similar usernames across online platforms focusing on technogeek platforms. The key novelty consists of the development and integration of three capabilities: (a) decomposing usernames into meaningful chunks, (b) de-obfuscating technical and slang conventions, and (c) considering all the different outcomes of the two previous functions exhaustively when calculating the similarity. We conduct a study using 1.2M usernames from five security forums. Our method outperforms previous methods with a Precision of 81--86%. We see our approach as a fundamental research capability, which we made publicly available on GitHub.

How can we leverage the URLs posted on online forums to connect forum users with their profiles on other platforms? Most previous studies primarily focus on analyzing textual content and user metadata, paying limited attention to URLs. In this paper, we propose RURLMAN, a modular ensemble of methods for leveraging user-posted URLs to connect online forum users with their cross-platform profiles. Our approach has two key features: (a) we focus on user-posted URLs as the key source of information, and (b) we utilize a modular stacked ensemble integrating multiple methods, including string-matching and two ChatGPT capabilities. We show that RURLMAN effectively combines the strengths of its component methods, outperforming each individual method with an F1 score of 92.6%. We apply RURLMAN in a case study comprising 1.3M URLs posted by 250K forum users across six online security forums and consider URLs to Twitter, Facebook, GitHub, and YouTube. First, we match 30% of the users who shared URLs to these platforms with the corresponding owners of the linked social media profiles. Second, we connect 8% of these users to profiles on multiple platforms. Finally, we identify and analyze "groups" of users based on their posted URLs. To facilitate further research, we will share access to RURLMAN and its datasets with the research community.

Online forums contain a substantial amount of data, but very few studies have focused on mining the URLs posted by users. How can we fully leverage these posted URLs to extract as much information as possible about forum users? We perform a systematic study for extracting as much information as possible about forum users via their URL posting behavior. Within this study we develop a series of tools to analyze the data. Given a forum, we extract the following information: (a) basic statistics and a profile of the forum, (b) a profile for each user based on their referral to accounts in other platforms, (c) identification of communities within the forum, and (d) detection of malicious behavior. Most prior works focus on analyzing the text found in user posts rather than on URLs themselves, as we do here. In our study, we analyze three online security forums and find interesting results: (a) we identify 7% of the users posting social media links on other platforms, (b) we detect 148 groups of users that engage in communities on external social media platforms, (c) we expose 139 malicious users that collectively posted 328 malicious URLs. Additionally, we identify 17 groups with membership spanning across multiple forums, and discover numerous other groups that engage in coordinated malicious behavior. Our work is a significant step towards an all-encompassing system for profiling forum users at large.

How can we detect and analyze hyperlink-driven misbehavior in online forums? Online forums contain enormous amounts of user-generated content, with threads and comments frequently supplemented by hyperlinks. These hyperlinks are often posted with malicious intention and we refer to this as 'hyperlink-driven misbehavior'. We present LinkMan, a systematic suite of capabilities, to detect and analyze hyperlink-driven misbehavior in online forums. We take a unique perspective focusing on hyperlink sharing practices of the users to spot misbehavior. LinkMan can categorize these hyperlinks as: a) phishing, b) spamming, and b) promoting malicious products. Our approach consists of three high-level phases: (a) extracting hyperlinks from the textual data, (b) identifying misbehaving hyperlinks, and (c) modeling the behavioral patterns of hyperlink sharing, where we identify key hyperlinks and analyze the collaboration dynamics of hyperlink sharing. In addition, we implement our approach as a powerful and easy-to-use open platform for practitioners. We apply LinkMan to spot misbehavior from three online security forums, where we expect the users to be more security-aware. We show that our approach works very well in terms of retrieving and classifying hyperlinks compared to previous solutions. Furthermore, we find non-trivial and often systematic misbehavior: (a) we find a total of 637 misbehaving hyperlinks, and (b) we identify 30 colluding groups of users in terms of promoting hyperlinks. Our work is a significant step towards mining online forums and detecting misbehaving users comprehensively.