Journal article Open Access

Cybercrime threat intelligence: A systematic multi-vocal literature review

Giuseppe Cascavilla; Damian Tamburri; Willem-JanVan Den Heuvel

DataCite XML Export

<?xml version='1.0' encoding='utf-8'?>
<resource xmlns:xsi="" xmlns="" xsi:schemaLocation="">
  <identifier identifierType="URL"></identifier>
      <creatorName>Giuseppe Cascavilla</creatorName>
      <affiliation>Eindhoven University of Technology, Jheronimus Academy of Data Science</affiliation>
      <creatorName>Damian Tamburri</creatorName>
      <affiliation>Eindhoven University of Technology, Jheronimus Academy of Data Science</affiliation>
      <creatorName>Willem-JanVan Den Heuvel</creatorName>
      <affiliation>Tilburg University, Jheronimus Academy of Data Science</affiliation>
    <title>Cybercrime threat intelligence: A systematic multi-vocal literature review</title>
    <subject>Cyber threat intelligence; ; CybersecurityDark web; Deep web; Surface web; Topic modelling</subject>
    <date dateType="Issued">2021-03-12</date>
  <resourceType resourceTypeGeneral="JournalArticle"/>
    <alternateIdentifier alternateIdentifierType="url"></alternateIdentifier>
    <relatedIdentifier relatedIdentifierType="DOI" relationType="IsIdenticalTo">10.1016/j.cose.2021.102258</relatedIdentifier>
    <relatedIdentifier relatedIdentifierType="URL" relationType="IsPartOf"></relatedIdentifier>
    <rights rightsURI="">Creative Commons Attribution 4.0 International</rights>
    <rights rightsURI="info:eu-repo/semantics/openAccess">Open Access</rights>
    <description descriptionType="Abstract">&lt;p&gt;Significant cybersecurity and threat intelligence analysts agree that online criminal activity is increasing exponentially. To offer an overview of the techniques and indicators to perform cybercrime detection by means of more complex machine- and deep-learning investigations as well as similar threat intelligence and engineering activities over multiple analysis levels (i.e., surface, deep, and darknets), we systematically analyze state of the art in such techniques. First, to aid the engineering and management of such intelligence solutions. We provide&amp;nbsp;&lt;em&gt;(i)&lt;/em&gt;&amp;nbsp;a taxonomy of existing methods mapped to&amp;nbsp;&lt;em&gt;(ii)&lt;/em&gt;&amp;nbsp;an overview of detectable criminal activities as well as&amp;nbsp;&lt;em&gt;(iii)&lt;/em&gt;&amp;nbsp;an overview of the indicators and risk parameters that can be used for such detection. Second, to find the major engineering and management challenges and variables to be addressed. We apply a Topic Modelling Analysis to identify and analyze the most relevant threat concepts both in Surface and in Deep-, Dark-Web. Third, we identify gaps and challenges, defining a roadmap.&amp;nbsp;&lt;em&gt;Practitioners value and conclusions.&lt;/em&gt;&amp;nbsp;The analysis mentioned above effectively provided a photograph of the scientific and practice gaps among the Surface Web and the Deep-, Dark-Web&amp;nbsp;&lt;a href=""&gt;cybercrime&lt;/a&gt;&amp;nbsp;and threat engineering and management. More specifically, our systematic literature review shows:&amp;nbsp;&lt;em&gt;(i)&lt;/em&gt;&amp;nbsp;the dimensions of risk assessment techniques today available for the aforementioned areas&amp;mdash;addressing these is vital for Law-enforcement agencies to combat cybercrime and cyber threats effectively;&amp;nbsp;&lt;em&gt;(ii)&lt;/em&gt;&amp;nbsp;what website features should be used in order to identify a cyber threat or attack&amp;mdash;researchers and non-governmental organizations in support of Law Enforcement Agencies (LEAs) should cover these features with appropriate technologies to aid in the investigative processes;&amp;nbsp;&lt;em&gt;(iii)&lt;/em&gt;&amp;nbsp;what (limited) degree of anonymity is possible when crawling in Deep-, Dark-Web&amp;mdash;researchers should strive to fill this gap with more and more advanced degrees of anonymity to grant protection to LEAs during their investigations&lt;/p&gt;

    <description descriptionType="Other">grant "PRoTECT" under grant Nno. 815356</description>
      <funderName>European Commission</funderName>
      <funderIdentifier funderIdentifierType="Crossref Funder ID">10.13039/501100000780</funderIdentifier>
      <awardNumber awardURI="info:eu-repo/grantAgreement/EC/H2020/787061/">787061</awardNumber>
      <awardTitle>Advanced tools for fighting oNline Illegal TrAfficking</awardTitle>
Views 32
Downloads 41
Data volume 171.6 MB
Unique views 31
Unique downloads 36


Cite as