ICDF2C22 - Shedding Light on Monopoly

Shedding Light on Monopoly: Temporal Analysis of Drug Trades

DOLEJŠKA Daniel, VESELÝ Vladimír, PLUSKAL Jan and KOUTENSKÝ Michal. Shedding Light on Monopoly: Temporal Analysis of Drug Trades. In: 13th EAI International Conference, ICDF2C 2022, Boston, MA, November 16-18, 2022, Proceedings. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering. Boston, MA, US: Springer Nature Switzerland AG, 2022, pp. 151-168. ISBN 978-3-031-36573-7. ISSN 1867-8211. Available from: link.springer.com

Dark marketplaces pioneered a new way to monetise illicit goods. A unique combination of technologies (such as overlay networks, end-to-end encryption, and cryptocurrencies) guarantees anonymity for dark marketplace users (including operators, vendors, and buyers).

We have developed a tool for monitoring and investigating dark marketplaces (namely, collecting and processing evidence directly from their websites), which we used for real-time detection of various illicit activities.

This paper presents a well-described and structured dataset that contains high-frequency web-scraped information from Monopoly Market (one of the most popular dark marketplaces in 2021). The evaluation demonstrates how high-resolution temporal analysis can reveal mission-critical information about the frequency of trades, vendor activities, and the drug market.

Graphs & Queries

This section presents queries used to generate graphs and analytics presented in the article.

Website Page Visits per Day

Click to show SQL

SELECT date.day,
       COALESCE(counts.count, 0) as scrape_count
FROM (
    SELECT t.day::date
    FROM generate_series(timestamp '2021-02-25', timestamp '2021-12-31', interval '1 day') AS t(day)
) date
LEFT JOIN (
    SELECT DATE(stats.created_at) AS day, COUNT(*) as count
    FROM product__stats stats
    GROUP BY 1
) counts ON date.day = counts.day;

Advertised product count by the number of advertising vendors

Click to show SQL

SELECT vi.name AS "Vendor Name",
       count(vi.id) AS "Product Count"
FROM product__items pi
INNER JOIN vendor__items vi on pi.vendor_id = vi.id
GROUP BY 1;

Registered vendor count weekly

Click to show SQL

SELECT dates.day AS "First Day of Week",
       COUNT(DISTINCT vi.id) AS "Vendor Count"
FROM (
    SELECT t.day::date
    FROM generate_series('2021-04-05', '2021-12-28', interval '1 week') AS t(day)
) dates
LEFT JOIN vendor__items vi ON vi.created_at < dates.day
GROUP BY 1
ORDER BY 1;

Origin country product sales

Click to show SQL

SELECT product_origins.value AS "Country of Origin",
       SUM(sales_delta) AS "Product Sales"
FROM product__stats s
LEFT JOIN (
    SELECT pm.product_id,
           pm.value
    FROM product__meta pm
    WHERE pm.name = 'origin'
    GROUP BY 1, 2
) product_origins ON product_origins.product_id = s.product_id
GROUP BY 1
ORDER BY 1;

Cumulative sales per category

Click to show SQL

SELECT time_bucket('12h', ps.created_at) AT TIME ZONE 'UTC' AS timeslot,
       pc2.name AS "Category Name",
       SUM(SUM(sales_delta)) OVER (PARTITION BY pc2.name ORDER BY time_bucket('12h', ps.created_at) AT TIME ZONE 'UTC') AS "Sales",
       SUM(SUM(sales_delta)) OVER (ORDER BY time_bucket('12h', ps.created_at) AT TIME ZONE 'UTC') AS "Sales Total"
FROM product__stats ps
INNER JOIN product__items pi on pi.id = ps.product_id
INNER JOIN product__categories pc on pc.id = pi.category_id
INNER JOIN product__categories pc2 ON pc2.id = pc.parent_id
WHERE ps.created_at BETWEEN '2021-03-01' AND '2021-12-28'
GROUP BY 1, 2
ORDER BY 1, 2;

Counts of detected individual product purchases over time

Click to show SQL

SELECT time_bucket('15 minutes', created_at) AT TIME ZONE 'UTC' AS timeslot,
       SUM(sales_delta) as sales
FROM product__stats
WHERE created_at >= '2021-08-12 22:12:08'
  AND created_at <= '2021-09-22 20:58:40'
GROUP BY 1
ORDER BY 1;