{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T18:41:17Z","timestamp":1790620877736,"version":"4.1.0"},"reference-count":58,"publisher":"MIS Quarterly","issue":"2","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,6,1]]},"abstract":"<jats:p>International dark web platforms operating within multiple geopolitical regions and languages host a myriad of hacker assets such as malware, hacking tools, hacking tutorials, and malicious source code. Cybersecurity analytics organizations employ machine learning models trained on human-labeled data to automatically detect these assets and bolster their situational awareness. However, the lack of human-labeled training data is prohibitive when analyzing foreign-language dark web content. In this research note, we adopt the computational design science paradigm to develop a novel IT artifact for cross-lingual hacker asset detection (CLHAD). CLHAD automatically leverages the knowledge learned from English content to detect hacker assets in non-English dark web platforms. CLHAD encompasses a novel Adversarial deep representation learning (ADREL) method, which generates multilingual text representations using generative adversarial networks (GANs). Drawing upon the state of the art in cross-lingual knowledge transfer, ADREL is a novel approach to automatically extract transferable text representations and facilitate the analysis of multilingual content. We evaluate CLHAD on Russian, French, and Italian dark web platforms and demonstrate its practical utility in hacker asset profiling, and conduct a proof-of-concept case study. Our analysis suggests that cybersecurity managers may benefit more from focusing on Russian to identify sophisticated hacking assets. In contrast, financial hacker assets are scattered among several dominant dark web languages. Managerial insights for security managers are discussed at operational and strategic levels.<\/jats:p>","DOI":"10.25300\/misq\/2022\/16618","type":"journal-article","created":{"date-parts":[[2022,10,17]],"date-time":"2022-10-17T15:07:26Z","timestamp":1666019246000},"page":"1209-1226","source":"Crossref","is-referenced-by-count":44,"title":["Cross-Lingual Cybersecurity Analytics in the International Dark Web with Adversarial Deep Representation Learning"],"prefix":"10.25300","volume":"46","author":[{"given":"Mohammadreza","family":"Ebrahimi","sequence":"first","affiliation":[{"name":"School of Information Systems and Management, University of South Florida, Tampa, FL 33620 U.S.A."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yidong","family":"Chai","sequence":"additional","affiliation":[{"name":"School of Management, Hefei University of Technology, Hefei, Anhua 230009 China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sagar","family":"Samtani","sequence":"additional","affiliation":[{"name":"Department of Operations and Decision Technologies, Indiana University, Bloomington, IN 47405 U.S.A."}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hsinchun","family":"Chen","sequence":"additional","affiliation":[{"name":"Department of Management Information Systems, University of Arizona, Tucson, AZ 85721 U.S.A."}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"10933","published-online":{"date-parts":[[2022,6,1]]},"reference":[{"key":"2025082212265025600_b1-17_16618_rn_ebrahimi","first-page":"506","article-title":"Cross-lingual sentiment analysis without (good) translation","author":"Abdalla","year":"2017"},{"key":"2025082212265025600_b2-17_16618_rn_ebrahimi","first-page":"214","article-title":"Wasserstein generative adversarial networks","author":"Arjovsky","year":"2017"},{"issue":"8","key":"2025082212265025600_b3-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"1798","DOI":"10.1109\/TPAMI.2013.50","article-title":"Representation learning: A review and new perspectives","volume":"35","author":"Bengio","year":"2013","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"2025082212265025600_b4-17_16618_rn_ebrahimi","first-page":"79","article-title":"Developing understanding of hacker language through the use of lexical semantics","author":"Benjamin","year":"2015"},{"key":"2025082212265025600_b5-17_16618_rn_ebrahimi","first-page":"205","article-title":"Identifying language groups within multilingual cybercriminal forums","author":"Benjamin","year":"2016"},{"issue":"1","key":"2025082212265025600_b6-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"1","DOI":"10.25300\/MISQ\/2019\/13808","article-title":"DICE-E: A framework for conducting darknet identification, collection, evaluation with ethics","volume":"43","author":"Benjamin","year":"2019","journal-title":"MIS Quarterly"},{"issue":"2","key":"2025082212265025600_b7-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"482","DOI":"10.1080\/07421222.2016.1205918","article-title":"Examining hacker participation length in cybercriminal internetrelay-chat communities","volume":"33","author":"Benjamin","year":"2016","journal-title":"Journal of Management Information Systems"},{"key":"2025082212265025600_b8-17_16618_rn_ebrahimi","first-page":"3042","article-title":"Encoding gated translation memory into neural machine translation","author":"Cao","year":"2018"},{"key":"2025082212265025600_b9-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","DOI":"10.1007\/978-1-4614-1557-2","volume-title":"Dark web: Exploring and data mining the dark side of the web","author":"Chen","year":"2012"},{"issue":"4","key":"2025082212265025600_b10-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"1165","DOI":"10.2307\/41703503","article-title":"Business intelligence and analytics: From big data to big impact","volume":"36","author":"Chen","year":"2012","journal-title":"MIS Quarterly"},{"key":"2025082212265025600_b11-17_16618_rn_ebrahimi","first-page":"3648","article-title":"Extracting cyber threat intelligence from hacker forums: Support vector machines versus convolutional neural networks","author":"Deliu","year":"2017"},{"key":"2025082212265025600_b12-17_16618_rn_ebrahimi","first-page":"1045","article-title":"Leveraging large amounts of weakly supervised data for multi-language sentiment classification","author":"Deriu","year":"2017"},{"key":"2025082212265025600_b13-17_16618_rn_ebrahimi","first-page":"4171","article-title":"Bert: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2019"},{"key":"2025082212265025600_b14-17_16618_rn_ebrahimi","first-page":"277","article-title":"Platform criminalism: The \u201clast-mile\u201d geography of the darknet market supply chain","author":"Dittus","year":"2018"},{"key":"2025082212265025600_b15-17_16618_rn_ebrahimi","first-page":"5771","article-title":"Cross-lingual propagation for deep sentiment analysis","author":"Dong","year":"2018"},{"key":"2025082212265025600_b16-17_16618_rn_ebrahimi","unstructured":"Duek, S., & Markovitch, S. (2018). Automatic generation of language-independent features for cross-lingual classification. Available through arVix (https:\/\/arxiv.org\/abs\/1802.04028). Association for the Advancement of Artificial Intelligence."},{"key":"2025082212265025600_b17-17_16618_rn_ebrahimi","first-page":"1285","article-title":"Learning crosslingual word embeddings without bilingual corpora","author":"Duong","year":"2016"},{"issue":"3","key":"2025082212265025600_b18-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"694","DOI":"10.1080\/07421222.2020.1790186","article-title":"Semisupervised cyber threat identification in dark net markets: A transductive and deep learning approach","volume":"37","author":"Ebrahimi","year":"2020","journal-title":"Journal of Management Information Systems"},{"key":"2025082212265025600_b19-17_16618_rn_ebrahimi","first-page":"85","article-title":"Detecting cyber threats in non-English dark net markets: A cross-lingual transfer learning approach","author":"Ebrahimi","year":"2018"},{"issue":"1","key":"2025082212265025600_b20-17_16618_rn_ebrahimi","first-page":"2096","article-title":"Domainadversarial training of neural networks","volume":"17","author":"Ganin","year":"2016","journal-title":"The Journal of Machine Learning Research"},{"key":"2025082212265025600_b21-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-031-02165-7","volume-title":"Neural network methods for natural language processing","author":"Goldberg","year":"2017"},{"key":"2025082212265025600_b22-17_16618_rn_ebrahimi","volume-title":"Deep learning","author":"Goodfellow","year":"2016"},{"issue":"2","key":"2025082212265025600_b23-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"337","DOI":"10.25300\/MISQ\/2013\/37.2.01","article-title":"Positioning and presenting design science research for maximum impact","volume":"37","author":"Gregor","year":"2013","journal-title":"MIS Quarterly"},{"key":"2025082212265025600_b24-17_16618_rn_ebrahimi","first-page":"13","article-title":"Identifying mobile malware and key threat actors in online hacker forums for proactive cyber threat intelligence","author":"Grisham","year":"2017"},{"issue":"2","key":"2025082212265025600_b25-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"497","DOI":"10.25300\/MISQ\/2017\/41.2.08","article-title":"Cybercrime deterrence and international legislation: Evidence from distributed denial of service attacks","volume":"41","author":"Hui","year":"2017","journal-title":"MIS Quarterly"},{"issue":"2","key":"2025082212265025600_b26-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"597","DOI":"10.1080\/07421222.2017.1334499","article-title":"Training to mitigate phishing attacks using mindfulness techniques","volume":"34","author":"Jensen","year":"2017","journal-title":"Journal of Management Information Systems"},{"key":"2025082212265025600_b27-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"339","DOI":"10.1162\/tacl_a_00065","article-title":"Google\u2019s multilingual neural machine translation system: Enabling zero-shot translation","volume":"5","author":"Johnson","year":"2017","journal-title":"Transactions of the Association for Computational Linguistics"},{"key":"2025082212265025600_b28-17_16618_rn_ebrahimi","unstructured":"Johnson, R., & Zhang, T. (2016). Supervised and semi-supervised text categorization using LSTM for region embeddings. In M. F.\u2008Balcan & K. Q.\u2008Weinberger (Eds.), Proceedings of the 33rd International Conference on Machine Learning (pp. 526\u2013534).. JMLR.org."},{"key":"2025082212265025600_b29-17_16618_rn_ebrahimi","unstructured":"Jozefowicz, R., Vinyals, O., Schuster, M., Shazeer, N., & Wu, Y. (2016). Exploring the limits of language modeling. Google Inc. (www.ai.google\/research\/pubs\/pub45446)."},{"key":"2025082212265025600_b30-17_16618_rn_ebrahimi","first-page":"3490","article-title":"Structural correspondence learning for cross-lingual sentiment classification with one-to-many mappings","author":"Li","year":"2017"},{"issue":"4","key":"2025082212265025600_b31-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"1059","DOI":"10.1080\/07421222.2016.1267528","article-title":"Identifying and profiling key sellers in cyber carding community: AZSecure text mining system","volume":"33","author":"Li","year":"2016","journal-title":"Journal of Management Information Systems"},{"key":"2025082212265025600_b32-17_16618_rn_ebrahimi","unstructured":"Lundberg, S. M., & Lee, S.-I. (2017). A unified approach to interpreting model predictions. In I.\u2008Guyon, U. V.\u2008Luxburg, S.\u2008Bengio, H.\u2008Wallach, R.\u2008Fergus, S.\u2008Vishwanathan, & R.\u2008Garnett (Eds.), Proceedings of the 21st Conference on Neural Information Processing Systems (https:\/\/proceedings.neurips.cc\/paper\/2017\/file\/8a20a8621978632d76c43dfd28b67767-Paper.pdf)."},{"key":"2025082212265025600_b33-17_16618_rn_ebrahimi","first-page":"187","article-title":"Product offerings in malicious hacker markets","author":"Marin","year":"2016"},{"key":"2025082212265025600_b34-17_16618_rn_ebrahimi","article-title":"2017 cybercrime report: Cybercrime will cost the world $6 trillion annually by 2021","volume-title":"Cybersecurity Ventures","author":"Morgan","year":"2017"},{"key":"2025082212265025600_b35-17_16618_rn_ebrahimi","first-page":"5615","article-title":"Learning cross-lingual knowledge with multilingual BLSTM for emphasis detection with limited training data","author":"Ning","year":"2017"},{"key":"2025082212265025600_b36-17_16618_rn_ebrahimi","first-page":"7","article-title":"Darknet and deepnet mining for proactive cybersecurity threat intelligence","author":"Nunes","year":"2016"},{"key":"2025082212265025600_b37-17_16618_rn_ebrahimi","first-page":"1845","article-title":"CrimeBB: Enabling cybercrime research on underground forums at scale","author":"Pastrana","year":"2018"},{"key":"2025082212265025600_b38-17_16618_rn_ebrahimi","unstructured":"Portnoff, R.\n           (2018). The dark net: De-anonymization, classification and analysis. Unpublished\u2008Ph.D. Thesis, EECS Department, University of California, Berkeley. (www.eecs.berkeley.edu\/Pubs\/TechRpts\/2018\/EECS-2018-5.html)."},{"key":"2025082212265025600_b39-17_16618_rn_ebrahimi","first-page":"116","article-title":"Detecting hacker threats: Performance of word and sentence embedding models in identifying hacker communications","author":"Queiroz","year":"2019"},{"issue":"1","key":"2025082212265025600_b40-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"iii","DOI":"10.25300\/MISQ\/2017\/41.1.E0","article-title":"Editor\u2019s comments: Diversity of design science research","volume":"41","author":"Rai","year":"2017","journal-title":"MIS Quarterly"},{"issue":"1","key":"2025082212265025600_b41-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"143","DOI":"10.1007\/s10590-017-9202-6","article-title":"Cross-lingual sentiment transfer with limited resources","volume":"32","author":"Rasooli","year":"2018","journal-title":"Machine Translation"},{"issue":"4","key":"2025082212265025600_b42-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"1023","DOI":"10.1080\/07421222.2017.1394049","article-title":"Exploring emerging hacker assets and key hackers for proactive cyber threat intelligence","volume":"34","author":"Samtani","year":"2017","journal-title":"Journal of Management Information Systems"},{"key":"2025082212265025600_b43-17_16618_rn_ebrahimi","first-page":"1","article-title":"BlackWidow: Monitoring the dark web for cyber security information","author":"Sch\u00e4fer","year":"2019"},{"issue":"3","key":"2025082212265025600_b44-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"849","DOI":"10.25300\/MISQ\/2018\/14558","article-title":"Network structure and patterns of information diversity on Twitter","volume":"42","author":"Shore","year":"2018","journal-title":"MIS Quarterly"},{"key":"2025082212265025600_b45-17_16618_rn_ebrahimi","unstructured":"Spataro, J.\n           (2021). Tactical linguistics: Language analysis in cyber threat intelligence. SANS Institute, January\u200815 (https:\/\/www.sans.org\/reading-room\/whitepapers\/threatintelligence\/paper\/40075)."},{"issue":"4","key":"2025082212265025600_b46-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"828","DOI":"10.1287\/isre.2017.0722","article-title":"Software diversity for improved network security: Optimal distribution of softwarebased shared vulnerabilities","volume":"28","author":"Temizkan","year":"2017","journal-title":"Information Systems Research"},{"key":"2025082212265025600_b47-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"89","DOI":"10.1007\/978-3-319-76941-7_7","article-title":"An adversarial joint learning model for low-resource language semantic textual similarity","volume-title":"Advances in Information Retrieval","author":"Tian","year":"2018"},{"key":"2025082212265025600_b48-17_16618_rn_ebrahimi","unstructured":"Tolido, R., Linden, G. van der, Delabarre, L., Theisler, J., Khemka, Y., Thieullent, A.-L., Frank, A., Buvat, J., & Cherian, S. (2019). Reinventing cybersecurity with artificial intelligence: The new frontier in digital security. Capgemini Research Institute (www.capgemini.com)."},{"issue":"2","key":"2025082212265025600_b49-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"355","DOI":"10.25300\/MISQ\/2018\/14124","article-title":"Tuning out security warnings: A longitudinal examination of habituation through fMRI, eye tracking, and field experiments","volume":"42","author":"Vance","year":"2018","journal-title":"MIS Quarterly"},{"issue":"1","key":"2025082212265025600_b50-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s40537-016-0043-6","article-title":"A survey of transfer learning","volume":"3","author":"Weiss","year":"2016","journal-title":"Journal of Big Data"},{"key":"2025082212265025600_b51-17_16618_rn_ebrahimi","first-page":"229","article-title":"Tackling class imbalance in cyber security datasets","author":"Wheelus","year":"2018"},{"key":"2025082212265025600_b52-17_16618_rn_ebrahimi","first-page":"1415","article-title":"Cross-lingual distillation for text classification","author":"Xu","year":"2017"},{"issue":"3","key":"2025082212265025600_b53-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"727","DOI":"10.1080\/07421222.2017.1373006","article-title":"Enabling effective operational risk management in a financial institution: An action research study","volume":"34","author":"Yang","year":"2017","journal-title":"Journal of Management Information Systems"},{"key":"2025082212265025600_b54-17_16618_rn_ebrahimi","first-page":"341","article-title":"Transfer learning for multi-language twitter election classification","author":"Yang","year":"2017"},{"issue":"1","key":"2025082212265025600_b55-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1080\/07421222.2018.1550550","article-title":"Regulating cryptocurrencies: A supervised machine learning approach to de-anonymizing the bitcoin blockchain","volume":"36","author":"Yin","year":"2019","journal-title":"Journal of Management Information Systems"},{"key":"2025082212265025600_b56-17_16618_rn_ebrahimi","first-page":"1027","article-title":"Reading thieves\u2019 cant: Automatically identifying and understanding dark jargons from cybercrime marketplaces","author":"Yuan","year":"2018"},{"issue":"1","key":"2025082212265025600_b57-17_16618_rn_ebrahimi","doi-asserted-by":"crossref","first-page":"73","DOI":"10.25300\/MISQ\/2019\/13042","article-title":"See no evil, hear no evil? Dissecting the impact of online hacker forums","volume":"43","author":"Yue","year":"2019","journal-title":"MIS Quarterly"},{"key":"2025082212265025600_b58-17_16618_rn_ebrahimi","first-page":"1403","article-title":"Cross-lingual sentiment classification with bilingual document representation learning","author":"Zhou","year":"2016"}],"container-title":["MIS Quarterly"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/misq.umn.edu\/misq\/article-pdf\/46\/2\/1209\/7466\/17_16618_rn_ebrahimi.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/misq.umn.edu\/misq\/article-pdf\/46\/2\/1209\/7466\/17_16618_rn_ebrahimi.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T16:27:18Z","timestamp":1755880038000},"score":1,"resource":{"primary":{"URL":"https:\/\/misq.umn.edu\/misq\/article\/46\/2\/1209\/1920\/Cross-Lingual-Cybersecurity-Analytics-in-the"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,6,1]]},"references-count":58,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2022,6,1]]},"published-print":{"date-parts":[[2022,6,1]]}},"URL":"https:\/\/doi.org\/10.25300\/misq\/2022\/16618","relation":{},"ISSN":["0276-7783","2162-9730"],"issn-type":[{"value":"0276-7783","type":"print"},{"value":"2162-9730","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,6,1]]}}}