{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,19]],"date-time":"2026-08-19T18:19:07Z","timestamp":1787163547683,"version":"build-2736575974"},"reference-count":66,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2020,8,25]],"date-time":"2020-08-25T00:00:00Z","timestamp":1598313600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"National Science Foundation","award":["DUE-1303362, SES-1314631, CNS-1850362, CNS-1917117"],"award-info":[{"award-number":["DUE-1303362, SES-1314631, CNS-1850362, CNS-1917117"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Priv. Secur."],"published-print":{"date-parts":[[2020,11,30]]},"abstract":"<jats:p>Cybersecurity experts have appraised the total global cost of malicious hacking activities to be $450 billion annually. Cyber Threat Intelligence (CTI) has emerged as a viable approach to combat this societal issue. However, existing processes are criticized as inherently reactive to known threats. To combat these concerns, CTI experts have suggested proactively examining emerging threats in the vast, international online hacker community. In this study, we aim to develop proactive CTI capabilities by exploring online hacker forums to identify emerging threats in terms of popularity and tool functionality. To achieve these goals, we create a novel Diachronic Graph Embedding Framework (D-GEF). D-GEF operates on a Graph-of-Words (GoW) representation of hacker forum text to generate word embeddings in an unsupervised manner. Semantic displacement measures adopted from diachronic linguistics literature identify how terminology evolves. A series of benchmark experiments illustrate D-GEF's ability to generate higher quality than state-of-the-art word embedding models (e.g., word2vec) in tasks pertaining to semantic analogy, clustering, and threat classification. D-GEF's practical utility is illustrated with in-depth case studies on web application and denial of service threats targeting PHP and Windows technologies, respectively. We also discuss the implications of the proposed framework for strategic, operational, and tactical CTI scenarios. All datasets and code are publicly released to facilitate scientific reproducibility and extensions of this work.<\/jats:p>","DOI":"10.1145\/3409289","type":"journal-article","created":{"date-parts":[[2020,8,26]],"date-time":"2020-08-26T00:14:17Z","timestamp":1598400857000},"page":"1-33","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":63,"title":["Proactively Identifying Emerging Hacker Threats from the Dark Web"],"prefix":"10.1145","volume":"23","author":[{"given":"Sagar","family":"Samtani","sequence":"first","affiliation":[{"name":"Department of Operations and Decision Technologies, Indiana University, Bloomington, Indiana"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6794-0230","authenticated-orcid":false,"given":"Hongyi","family":"Zhu","sequence":"additional","affiliation":[{"name":"Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, TX"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hsinchun","family":"Chen","sequence":"additional","affiliation":[{"name":"Department of Management Information Systems, University of Arizona, Tucson, AZ"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,8,25]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the 22nd International Conference on the World Wide Web (2013)","author":"Ahmed Amr","year":"2013"},{"key":"e_1_2_1_2_1","volume-title":"Diego Raphael Amancio, and Osvaldo Novais Oliveira","author":"Akimushkin Camilo","year":"2017"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2019.8823501"},{"key":"e_1_2_1_4_1","volume-title":"A survey of word embeddings evaluation methods. (January","author":"Bakarov Amir","year":"2018"},{"key":"e_1_2_1_5_1","volume-title":"Network Science","author":"Barab\u00e1si Albert-L\u00e1szl\u00f3","edition":"1"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1162\/089976603321780317"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2015.7165943"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2015.7165944"},{"key":"e_1_2_1_9_1","volume-title":"Threat Intelligence: What it is, and how to use it effectively","author":"Bromiley Matt","year":"2016"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2806416.2806512"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2018.8587327"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D17-1275"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2017.8004879"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196884"},{"key":"e_1_2_1_15_1","volume-title":"Discovering signals from Web sources to predict cyber attacks. (June","author":"Goyal Palash","year":"2018"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2017.8004867"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939754"},{"key":"e_1_2_1_18_1","volume-title":"Diachronic word embeddings reveal statistical laws of semantic change. (May","author":"Hamilton William L.","year":"2016"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D16-1229"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2018.8587380"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.2307\/2346830"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2008.2005582"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1093\/bjc\/azu106"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278121"},{"key":"e_1_2_1_25_1","volume-title":"Bayesian Deep Learning Workshop (NIPS","author":"Thomas","year":"2016"},{"key":"e_1_2_1_26_1","volume-title":"Lee","author":"Lee Rob","year":"2017"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2016.7745501"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2018.8587353"},{"key":"e_1_2_1_29_1","volume-title":"Proceedings of the 26th International Conference on Neural Information Processing Systems (NPIS\u201913)","author":"Mikolov Tomas","year":"2013"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1017\/S1351324915000340"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2016.7745435"},{"key":"e_1_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939751"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3310355"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355576"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/2623330.2623732"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3302913"},{"key":"e_1_2_1_37_1","volume-title":"Proceedings of the 2007 Joint Conference on Empirical Methods in Natural Language Processing and Computational Natural Language Learning, 410--420","author":"Rosenberg Andrew","year":"2007"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/P15-1164"},{"key":"e_1_2_1_39_1","doi-asserted-by":"crossref","unstructured":"Morteza Safaei Pour Antonio Mangino Kurt Friday Matthias Rathbun Elias Bou-Harb Farkhund Iqbal Sagar Samtani Jorge Crichigno and Nasir Ghani. 2020. On data-driven curation learning and analysis for inferring evolving internet-of-Things (IoT) botnets in the wild. Comput. Secur. (2020). DOI:https:\/\/doi.org\/10.1016\/j.cose.2019.101707  Morteza Safaei Pour Antonio Mangino Kurt Friday Matthias Rathbun Elias Bou-Harb Farkhund Iqbal Sagar Samtani Jorge Crichigno and Nasir Ghani. 2020. On data-driven curation learning and analysis for inferring evolving internet-of-Things (IoT) botnets in the wild. Comput. Secur. (2020). DOI:https:\/\/doi.org\/10.1016\/j.cose.2019.101707","DOI":"10.1016\/j.cose.2019.101707"},{"key":"e_1_2_1_40_1","doi-asserted-by":"crossref","unstructured":"Sagar Samtani Maggie Abate Victor Benjamin and Weifeng Li. 2020. Cybersecurity as an industry: A cyber threat intelligence perspective. In The Palgrave Handbook of International Cybercrime and Cyberdeviance. DOI:https:\/\/doi.org\/10.1007\/978-3-319-78440-3_8  Sagar Samtani Maggie Abate Victor Benjamin and Weifeng Li. 2020. Cybersecurity as an industry: A cyber threat intelligence perspective. In The Palgrave Handbook of International Cybercrime and Cyberdeviance. DOI:https:\/\/doi.org\/10.1007\/978-3-319-78440-3_8","DOI":"10.1007\/978-3-319-78440-3_8"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2016.7745437"},{"key":"e_1_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2015.7165935"},{"key":"e_1_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1080\/07421222.2017.1394049"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2016.7745438"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2018.111145022"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW.2017.94"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D15-1036"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF02289451"},{"key":"e_1_2_1_49_1","volume-title":"2016 Security Analytics Survey","author":"Shackleford Dave","year":"2017"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133201"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/2736277.2741093"},{"key":"e_1_2_1_52_1","volume-title":"Proceedings of the 30th AAAI Conference on Innovative Applications of Artificial Intelligence (IAAI-18)","author":"Tavabi Nazgol","year":"2018"},{"key":"e_1_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/3291061"},{"key":"e_1_2_1_54_1","first-page":"12","article-title":"Evaluating word embedding models: Methods and experimental results. APSIPA","volume":"2019","author":"Wang Bin","year":"2019","journal-title":"Trans. Sig. Inf. Proc. DOI:https:\/\/doi.org\/10.1017\/ATSIP."},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939753"},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2017.8004904"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2018.8587336"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.11"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/3159652.3159703"},{"key":"e_1_2_1_60_1","volume-title":"Proceedings of the 27th USENIX Security Symposium.","author":"Yuan Kan","year":"2018"},{"key":"e_1_2_1_61_1","volume-title":"Proceedings of the 30th AAAI Conference on Artificial Intelligence","author":"Zhai Michael","year":"2016"},{"key":"e_1_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASONAM.2018.8508414"},{"key":"e_1_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2016.7745450"},{"key":"e_1_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2016.46"},{"key":"e_1_2_1_65_1","unstructured":"Hongyi Zhu Sagar Samtani Randall Brown and Hsinchun Chen. 2020. A deep learning approach for recognizing activity of daily living (ADL) for senior care: Exploiting interaction dependency and temporal patterns. Forthcom. MIS Q. (2020). Retrieved from https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=3595738.  Hongyi Zhu Sagar Samtani Randall Brown and Hsinchun Chen. 2020. A deep learning approach for recognizing activity of daily living (ADL) for senior care: Exploiting interaction dependency and temporal patterns. Forthcom. MIS Q. (2020). Retrieved from https:\/\/papers.ssrn.com\/sol3\/papers.cfm?abstract_id=3595738."},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1080\/07421222.2020.1759961"}],"container-title":["ACM Transactions on Privacy and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3409289","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3409289","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3409289","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T18:01:33Z","timestamp":1750183293000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3409289"}},"subtitle":["A Diachronic Graph Embedding Framework (D-GEF)"],"short-title":[],"issued":{"date-parts":[[2020,8,25]]},"references-count":66,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2020,11,30]]}},"alternative-id":["10.1145\/3409289"],"URL":"https:\/\/doi.org\/10.1145\/3409289","relation":{},"ISSN":["2471-2566","2471-2574"],"issn-type":[{"value":"2471-2566","type":"print"},{"value":"2471-2574","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,8,25]]},"assertion":[{"value":"2020-03-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-07-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2020-08-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}