Pathways into Cybercrime

My final-year project at the University of Kent (2020–21, part of a First Class degree in Computer Science with a focus on AI and machine learning) started from one sentence in a National Crime Agency report. The NCA’s Pathways into Cyber Crime (2017) suggested that online game cheating and “modding” communities can be a first step towards more serious, criminal hacking, but offered little evidence either way. I wanted to see whether data could add some real-world context.

The research question

Do communities built around game hacking, cheating and modding show an observable shift over time towards more serious, potentially illegal forms of hacking? And can we build a tool that lets researchers ask that kind of question about any online community?

That second half matters. Early on, my supervisor pushed me away from assuming the evidence would be there. The better framing was: build a general tool for analysing online communities, then evaluate it on the cybercrime use case. If the data didn’t support the NCA’s claim, that was a valid result too. The point was to be able to look.

Why online communities

Online communities give people a sense of belonging, identity and status, often very quickly. That’s what makes them wonderful for niche interests, and it’s also why the question is plausible: if your status comes from showing what you can break, the path from a harmless game mod to something less harmless might be shorter than it looks. More on that framing in Hacking Forums as Learning Communities and Online Communities and Interaction Spaces.

Data

I chose Reddit, because it has clear, topic-focused communities (subreddits), a rich API, and a well-used research archive.

• PRAW (the Python Reddit API Wrapper) for posts, comments, flairs and timestamps.
• Pushshift, the Reddit research archive, to search historical content by date range, which the live API couldn’t do. You find post IDs in the archive, then fetch the full threads from the API.
• Target communities: game hacking, cheating and modding subreddits, compared with broader hacking communities.

How to collect it responsibly is in Mining Reddit for Research.

Methods

• Topic Modelling with LDA: unsupervised discovery of what each community talks about, and how that changes month to month. Prior work had used the same approach on dark-web forums and on a darknet-market subreddit.
• Social Network Analysis: who interacts with whom, which members are central, and which communities overlap. It sounded exotic in my first supervisor meeting; it turned out to be the most transferable thing I learnt.
• Classification: supervised models to label posts or accounts once topics were understood (Machine Learning, Natural Language Processing).
• Change-point analysis: finding the moments a time series of topic prevalence shifts significantly.

The tool

The platform I specified would let a researcher plug in a set of communities, run exploratory analysis (topic models first), specify themes to follow, and get visualisations good enough to drop straight into a paper as evidence. The audience was researchers, not necessarily computer scientists.

Two existing tools shaped the design. The ESRC COSMOS platform from Cardiff’s Social Data Science Lab showed how far drag-and-drop visual analysis could go for social scientists. The SMAT Social Media Analysis Toolkit (Bevensee et al., 2020) did much of what I’d planned, with a hosted web front end over the Pushshift archive. Finding SMAT mid-project was a wobble (“is my project already done?”) until I saw the gap: it counted and charted brilliantly, but had none of the deeper community analysis, such as topic models and network analysis. That became the contribution to aim for: extend rather than duplicate.

I evaluated React charting libraries (Recharts, react-vis, nivo) for the front end. That was my first serious look at data visualisation on the web, and it wasn’t my last.

Ethics

Research on people’s posts needs care even when the posts are public:

• All analysis in aggregate, by automated methods.
• No verbatim posts in the write-up, because quotes can be searched back to their authors.
• Any reference to an individual account pseudonymised.
• Data stored securely, on password-protected machines.

The same principles govern this page: patterns and methods only, nothing that could point at anyone in the dataset.

What I learnt

• Frame research around the tool and the question, not the answer you hope for. My first roadmap was too technical, too soon. My supervisor’s advice to define aims, structure and requirements before building was the most useful thing anyone told me that year, and it’s how I run projects now.
• Requirements are harder than code. Writing down what the platform should do, without jumping to how, was the hardest part and the most valuable.
• Read the related work like an engineer. Most papers in this space combine the same building blocks (topic models, network analysis, classifiers) in different orders. Seeing the pattern made the field far less intimidating.
• Keep a lab book. Agendas, decisions and actions for every meeting. It was the seed of the note-taking habit behind this whole garden (The Second Brain).

What I’d do differently today

• LLMs instead of bag-of-words. LDA treats text as a bag of words and needs heavy cleaning. Today I’d use embeddings to cluster posts by meaning, and an LLM to name and summarise each cluster and label posts zero-shot, keeping LDA as a fast, explainable baseline.
• Evaluate like a product. Hand-label a small gold set and measure agreement, rather than eyeballing topics.
• Track people’s trajectories, carefully. The interesting question is longitudinal: do pseudonymised accounts move between communities over time? That’s powerful and ethically sensitive, so it needs an ethics review designed in from the start.
• Data access has changed. Reddit’s API and archive access tightened after 2023, so the data plan would need rethinking.

Where it led

This project is where I first met graphs as data, interactive visualisation and pipelines that turn messy text into something you can see. A few years later I was choosing WebGL graph renderers and building an in-house network graph library (Graph Visualisation Libraries, Building a Graph Component Library). Now I build real-time data interfaces for a living. The problems are different, but the instinct (find the structure, then make it visible) started here.

Sources

• National Crime Agency (2017). Pathways into Cyber Crime.
• Blei, Ng and Jordan (2003). Latent Dirichlet Allocation. Journal of Machine Learning Research.
• Baumgartner et al. (2020). The Pushshift Reddit Dataset. ICWSM.
• Bevensee et al. (2020). SMAT: The Social Media Analysis Toolkit.
• Social Data Science Lab, Cardiff University. ESRC COSMOS open data analytics software.
• Further papers are cited in the linked notes.