{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,9]],"date-time":"2026-05-09T00:09:20Z","timestamp":1778285360242,"version":"3.51.4"},"reference-count":39,"publisher":"Public Library of Science (PLoS)","issue":"5","license":[{"start":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T00:00:00Z","timestamp":1778198400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100002608","name":"Daegu University","doi-asserted-by":"publisher","award":["2022"],"award-info":[{"award-number":["2022"]}],"id":[{"id":"10.13039\/501100002608","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["www.plosone.org"],"crossmark-restriction":false},"short-container-title":["PLoS One"],"abstract":"<jats:p>The distribution of child sexual abuse materials (CSAM) via the dark web continues to hinder digital investigations due to the network\u2019s inherent anonymity and fragmentation. This work presents a comparative analysis of text mining techniques for extracting investigative keywords from CSAM-related content on the dark web and aims to establish a foundation for scalable, expandable keyword-based detection. Using a custom crawler, we collected data from 2,414 dark web pages indexed by the Torch search engine. Based on this dataset, three methods\u2014TF-IDF, Eigenvector Centrality, and Word2Vec\u2014were applied to extract CSAM-related keywords, and their effectiveness was evaluated through dark web search experiments measuring the retrieval performance of CSAM-related sites. Among the individual techniques, Eigenvector Centrality\u2014a graph-based keyword ranking algorithm\u2014showed the highest precision and contextual relevance by identifying structurally central terms within co-occurrence networks. Building on this, we developed hybrid models that combined Eigenvector Centrality with either TF-IDF or Word2Vec. In particular, the model integrating Eigenvector Centrality with Word2Vec-based semantic similarity proved most effective in expanding investigative clues and retrieving highly relevant keywords. Based on empirically collected and domain-specific dark web data, this work differs from prior studies by empirically demonstrating a multi-method approach that not only improves keyword accuracy but also enables the dynamic expansion of early-stage crime indicators. The proposed methodology offers practical value for automating the detection of illicit content and improving the operational efficiency of cyber investigations.<\/jats:p>","DOI":"10.1371\/journal.pone.0344470","type":"journal-article","created":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T23:09:57Z","timestamp":1778281797000},"page":"e0344470","update-policy":"https:\/\/doi.org\/10.1371\/journal.pone.corrections_policy","source":"Crossref","is-referenced-by-count":0,"title":["Hybrid text mining models for investigative keyword expansion on child sexual abuse in the dark web"],"prefix":"10.1371","volume":"21","author":[{"given":"Jin Gyeong","family":"Kim","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-4697-8058","authenticated-orcid":true,"given":"Jiyeon","family":"Kim","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"340","published-online":{"date-parts":[[2026,5,8]]},"reference":[{"key":"pone.0344470.ref001","first-page":"1","article-title":"The dark web as a platform for crime: an exploration of illicit drug, firearm, CSAM, and cybercrime markets","author":"R Liggett","year":"2019","journal-title":"The Palgrave Handbook of International Cybercrime and Cyberdeviance. Cham: Springer International Publishing"},{"issue":"03","key":"pone.0344470.ref002","doi-asserted-by":"crossref","first-page":"30","DOI":"10.4236\/jcc.2019.73004","article-title":"Dark web and its impact in online anonymity and privacy: a critical analysis and review","volume":"07","author":"AS Beshiri","year":"2019","journal-title":"J Comput Commun"},{"issue":"2","key":"pone.0344470.ref003","doi-asserted-by":"crossref","first-page":"160","DOI":"10.1177\/10439862231159774","article-title":"The dark web: what is it, how to access it, and why we need to study it","volume":"39","author":"FT Ngo","year":"2023","journal-title":"J Contemp Crim Justice"},{"key":"pone.0344470.ref004","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1145\/3590777.3590812","article-title":"Investigating the availability of child sexual abuse materials in dark web markets: Evidence gathered and lessons learned.","author":"Y Wang","year":"2023","journal-title":"Proceedings of the 2023 European Interdisciplinary Cybersecurity Conference"},{"key":"pone.0344470.ref005","doi-asserted-by":"crossref","first-page":"4794","DOI":"10.1109\/ACCESS.2023.3235409","article-title":"Quantifying dark web shops\u2019 illicit revenue","volume":"11","author":"K Oosthoek","year":"2023","journal-title":"IEEE Access"},{"key":"pone.0344470.ref006","first-page":"1","article-title":"Cyber strategies used to combat child sexual abuse material","volume":"636","author":"G Edwards","year":"2021","journal-title":"Trends Issues Crime Criminal Justice"},{"key":"pone.0344470.ref007","doi-asserted-by":"crossref","first-page":"8393318","DOI":"10.1155\/2022\/8393318","article-title":"Dark Web data classification using neural network","volume":"2022","author":"AS Rajawat","year":"2022","journal-title":"Comput Intell Neurosci"},{"key":"pone.0344470.ref008","article-title":"Dark web activity classification using deep learning","author":"A Fayzi","year":"2023","journal-title":"arXiv"},{"key":"pone.0344470.ref009","article-title":"Deep learning algorithm for threat detection in hackers forum (deep web)","author":"V Adewopo","year":"2022","journal-title":"arXiv"},{"issue":"3","key":"pone.0344470.ref010","doi-asserted-by":"crossref","first-page":"694","DOI":"10.1080\/07421222.2020.1790186","article-title":"Semi-supervised cyber threat identification in dark net markets: a transductive and deep learning approach","volume":"37","author":"M Ebrahimi","year":"2020","journal-title":"J Manage Inform Syst"},{"key":"pone.0344470.ref011","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1145\/3309182.3309189","article-title":"Dark Web Content Analysis and Visualization.","author":"S Takaaki","year":"2019","journal-title":"Proceedings of the ACM International Workshop on Security and Privacy Analytics"},{"issue":"2","key":"pone.0344470.ref012","first-page":"354","article-title":"Graph visualization of dark web hyperlinks and their feature analysis","volume":"11","author":"T Aoki","year":"2021","journal-title":"Int J Netw Comput"},{"key":"pone.0344470.ref013","first-page":"301086","article-title":"Measuring dark web marketplaces via bitcoin transactions: from birth to independence","volume":"35","author":"N Hiramoto","year":"2020","journal-title":"Forensic Sci Int: Digit Investig"},{"issue":"1","key":"pone.0344470.ref014","doi-asserted-by":"crossref","first-page":"1","DOI":"10.3390\/bdcc4010001","article-title":"Text mining in big data analytics","volume":"4","author":"H Hassani","year":"2020","journal-title":"Big Data Cogn Comput"},{"key":"pone.0344470.ref015","doi-asserted-by":"crossref","first-page":"1940","DOI":"10.1109\/ICESC51422.2021.9532825","article-title":"Location-based modelling and analysis of threats by using text mining.","author":"S Degadwala","year":"2021","journal-title":"2021 2nd International Conference on Electronics and Sustainable Communication Systems (ICESC)"},{"key":"pone.0344470.ref016","doi-asserted-by":"crossref","first-page":"22740","DOI":"10.1109\/ACCESS.2019.2891694","article-title":"Wordnet-based criminal networks mining for cybercrime investigation","volume":"7","author":"F Iqbal","year":"2019","journal-title":"IEEE Access"},{"key":"pone.0344470.ref017","doi-asserted-by":"crossref","first-page":"1241","DOI":"10.1109\/ICAICA50127.2020.9182555","article-title":"The text classification of theft crime based on TF-IDF and XGBoost model.","author":"Z Qi","year":"2020","journal-title":"2020 IEEE International Conference on Artificial Intelligence and Computer Applications (ICAICA)"},{"issue":"10","key":"pone.0344470.ref018","doi-asserted-by":"crossref","first-page":"4087","DOI":"10.3390\/su12104087","article-title":"Computational system to classify cyber crime offenses using machine learning","volume":"12","author":"R Ch","year":"2020","journal-title":"Sustainability"},{"key":"pone.0344470.ref019","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1145\/3409289","article-title":"Proactively identifying emerging hacker threats from the dark web: a diachronic graph embedding framework (D-GEF)","volume":"23","author":"S Samtani","year":"2020","journal-title":"ACM Transactions on Privacy and Security"},{"key":"pone.0344470.ref020","first-page":"1793","article-title":"Automated Categorization of Onion Sites for Analyzing the Darkweb Ecosystem.","author":"S Ghosh","year":"2017","journal-title":"Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining"},{"key":"pone.0344470.ref021","first-page":"197","article-title":"Research on dark web monitoring crawler based on TOR.","author":"Y Xu","year":"2021","journal-title":"2021 IEEE 2nd International Conference on Information Technology, Big Data and Artificial Intelligence (ICIBA)"},{"key":"pone.0344470.ref022","doi-asserted-by":"crossref","first-page":"112871","DOI":"10.1109\/ACCESS.2021.3103319","article-title":"An unsupervised model for identifying and characterizing dark web forums","volume":"9","author":"S Nazah","year":"2021","journal-title":"IEEE Access"},{"key":"pone.0344470.ref023","first-page":"35","article-title":"Classifying illegal activities on Tor network based on web textual contents.","author":"MW Al Nabki","year":"2017","journal-title":"Proceedings of the 15th Conference of the European Chapter of the Association for Computational Linguistics"},{"key":"pone.0344470.ref024","doi-asserted-by":"crossref","first-page":"4046","DOI":"10.1109\/BigData59044.2023.10386326","article-title":"Harvesting large textual and multimedia data to detect illegal activities on dark web marketplaces","author":"G Chatzimarkaki","year":"2023","journal-title":"2023 IEEE International Conference on Big Data (BigData)"},{"key":"pone.0344470.ref025","first-page":"109","article-title":"Surfacing collaborated networks in dark web to find illicit and criminal content.","author":"AT Zulkarnine","year":"2016","journal-title":"2016 IEEE Conference on Intelligence and Security Informatics (ISI)"},{"issue":"2","key":"pone.0344470.ref026","doi-asserted-by":"crossref","first-page":"66","DOI":"10.1145\/1964897.1964917","article-title":"Topic-based social network analysis for virtual communities of interests in the dark web","volume":"12","author":"G L\u2019Huillier","year":"2011","journal-title":"SIGKDD Explor Newsl"},{"key":"pone.0344470.ref027","doi-asserted-by":"crossref","first-page":"412","DOI":"10.1109\/TechDefense59795.2023.10380929","article-title":"Target Detection of Dark web Hidden Services Network through MoniTOR and Social Network Analysis.","author":"F Borgonovo","year":"2023","journal-title":"2023 IEEE International Workshop on Technologies for Defense and Security (TechDefense)"},{"issue":"1","key":"pone.0344470.ref028","doi-asserted-by":"crossref","first-page":"16336","DOI":"10.1038\/s41598-024-67115-5","article-title":"Early warning signals for predicting cryptomarket vendor success using dark net forum networks","volume":"14","author":"HD Boekhout","year":"2024","journal-title":"Sci Rep"},{"issue":"1","key":"pone.0344470.ref029","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1016\/S0306-4573(02)00021-3","article-title":"An information-theoretic perspective of tf\u2013idf measures","volume":"39","author":"A Aizawa","year":"2003","journal-title":"Inform Process Manage"},{"issue":"5","key":"pone.0344470.ref030","doi-asserted-by":"crossref","first-page":"2780","DOI":"10.11591\/eei.v10i5.3157","article-title":"Performance comparison of TF-IDF and Word2Vec models for emotion text classification","volume":"10","author":"DE Cahyani","year":"2021","journal-title":"Bulletin EEI"},{"key":"pone.0344470.ref031","first-page":"1","article-title":"Text Classification Using Novel Term Weighting Scheme-Based Improved TF-IDF for Internet Media Reports","volume":"2021","author":"Z Jiang","year":"2021","journal-title":"Math Problem Eng"},{"key":"pone.0344470.ref032","article-title":"TF-IDF vs word embeddings for morbidity identification in clinical notes: An initial study","author":"D Dessi","year":"2021","journal-title":"arXiv"},{"issue":"4","key":"pone.0344470.ref033","doi-asserted-by":"crossref","first-page":"357","DOI":"10.1016\/S0378-8733(00)00031-9","article-title":"Eigenvector-centrality \u2014 a node-centrality?","volume":"22","author":"B Ruhnau","year":"2000","journal-title":"Soc Netw"},{"issue":"4","key":"pone.0344470.ref034","doi-asserted-by":"crossref","first-page":"648","DOI":"10.1080\/23249935.2020.1804480","article-title":"Connectivity evaluation of large road network by capacity-weighted eigenvector centrality analysis","volume":"17","author":"H Ando","year":"2020","journal-title":"Transportmetrica A: Transp Sci"},{"issue":"3","key":"pone.0344470.ref035","doi-asserted-by":"crossref","first-page":"3916","DOI":"10.1109\/JSYST.2020.2982266","article-title":"Spotting key members in networks: clustering-embedded eigenvector centrality","volume":"14","author":"E Carrizosa","year":"2020","journal-title":"IEEE Syst J"},{"key":"pone.0344470.ref036","doi-asserted-by":"crossref","first-page":"160","DOI":"10.1016\/j.procs.2019.08.153","article-title":"Word2Vec model analysis for semantic similarities in English words","volume":"157","author":"D Jatnika","year":"2019","journal-title":"Procedia Computer Science"},{"key":"pone.0344470.ref037","volume-title":"Using Word2Vec technique to determine semantic and morphologic similarity in embedded words of the Ukrainian language","author":"L Savytska","year":"2021"},{"key":"pone.0344470.ref038","first-page":"144","article-title":"Comparison of Text Sentiment Analysis based on Bert and Word2vec.","author":"Y Shen","year":"2021","journal-title":"2021 IEEE 3rd International Conference on Frontiers Technology of Information and Computer (ICFTIC)"},{"issue":"1","key":"pone.0344470.ref039","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3436751","article-title":"Malware classification based on multilayer perception and Word2Vec for IoT security","volume":"22","author":"Y Qiao","year":"2021","journal-title":"ACM Trans Internet Technol"}],"container-title":["PLOS One"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0344470","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T23:10:06Z","timestamp":1778281806000},"score":1,"resource":{"primary":{"URL":"https:\/\/dx.plos.org\/10.1371\/journal.pone.0344470"}},"subtitle":[],"editor":[{"given":"Masoud","family":"Rahmati","sequence":"first","affiliation":[],"role":[{"role":"editor","vocabulary":"crossref"}]}],"short-title":[],"issued":{"date-parts":[[2026,5,8]]},"references-count":39,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2026,5,8]]}},"URL":"https:\/\/doi.org\/10.1371\/journal.pone.0344470","relation":{},"ISSN":["1932-6203"],"issn-type":[{"value":"1932-6203","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,8]]}}}