Early warning signals for predicting cryptomarket vendor success using dark net forum networks

In this work we focus on identifying key players in dark net cryptomarkets that facilitate online trade of illegal goods. Law enforcement aims to disrupt criminal activity conducted through these markets by targeting key players vital to the market’s existence and success. We particularly focus on detecting successful vendors responsible for the majority of illegal trade. Our methodology aims to uncover whether the task of key player identification should center around plainly measuring user and forum activity, or that it requires leveraging specific patterns of user communication. We focus on a large-scale dataset from the Evolution cryptomarket, which we model as an evolving communication network. Results indicate that user and forum activity, measured through topic engagement, is best able to identify successful vendors. Interestingly, considering users with higher betweenness centrality in the communication network further improves performance, also identifying successful vendors with moderate activity on the forum. But more importantly, analyzing the forum data over time, we find evidence that attaining a high betweenness score comes before vendor success. This suggests that the proposed network-driven approach of modelling user communication might prove useful as an early warning signal for key player identification.


Introduction
The dark net, a part of the internet that requires specific software or authorization to access 1 , hosts a myriad of online fora that are increasingly a hotbed for criminal behavior and radicalisation 2,3 .Dark net fora can, both theoretically and empirically, be split in those functioning as meeting places for the exchange of criminal information and those where criminal goods and services are traded, i.e., criminal marketplaces.These fora and marketplaces can serve up to hundreds of thousands of users.They are often moderated and organized in a professional manner, with cryptocurrencies, such as Bitcoin, serving as currency and are therefore referred to as cryptomarkets 4,5 .To efficiently coordinate its activities disrupting these cryptomarkets, law enforcement aims to target key players that are vital to these market's existence and success 5,6 .
Key players include the administrators and moderators responsible for the existence and proper functioning of the cryptomarket.But also the more successful vendors that are responsible for the majority of the trade conducted on the cryptomarket.Identifying which users function as administrators can often be as easy as looking at the titles assigned to them on the cryptomarkets' forums.Similarly, if sales statistics were shared on the cryptomarket, currently successful vendors would be easily identifiable.However, many cryptomarkets do not record sales information and at best provide a label to vendors independent of their success.Furthermore, it is nearly impossible to identify those vendors whose success is yet to come.Yet, if law enforcement wishes to disrupt future sales, it is exactly these future successful vendors that they would need to identify.Therefore, in this paper we focus on identifying key players in the form of both current and future successful vendors.We do so by studying a cryptomarket at points in time, i.e., we look at at various snapshots.By doing so we simulate law enforcement investigating the state of the cryptomarket at those specific points in time, while subsequent, i.e., future, data shows how the cryptomarket would progress without intervention.Consequently, we propose a methodology with the potential to serve as an early warning signal for future vendor success on cryptomarkets.
Existing research studying the workings of cryptomarkets and aimed at assisting law enforcement in identifying key players, often uses methods such as topic modelling or sentiment analysis [7][8][9][10][11] .These methods rely on (combinations of) commonly used words and sentence structures in the forum message contents.However, the rise of the use of message encryption in criminal communication, calls for the development of methods not reliant on knowledge of message content.In this work, we aim to develop a method to identify key players based on the temporal structure of their communication network alone; thus, ignoring message content entirely.
Communication networks model the interaction between entities within communication systems, such as mobile phone [12][13][14] , arXiv:2306.16568v1 [cs.SI] 28 Jun 2023 face-to-face 15 , and social media communication 16,17 ; but also communication through online fora 6,18 .Online fora, including those associated with cryptomarkets, usually consist of topics, which may be grouped by subject.Each topic is started by one user with a first message, also called a post, and allows the set of users with access to respond by placing their own posts.This activity can be considered a form of indirect communication from the posters to those users who placed posts on the same topic before them.We can model this indirect communication using what we call a user-to-user communication network that directly connects users that posted in the same topic.At the very least, a link in such a network represents a shared interest in the same topic as well as a level of familiarity with one another due to the likelihood of having seen each others' posts.At best, a link can signify direct communication between two users that are, by means of forum posts, responding to one another.Thus, links represent potential social ties formed on a dark net forum.In this work, we leverage the structure of these communication networks without relying on knowledge of message content, with the goal of identifying and predicting successful vendors.
To find important users in a (criminal) network, one of the most commonly used approaches is to apply network centrality measures, which rank users based on their position in the network 6,[13][14][15][16]19 . Diffrent network centrality measures often imply different roles a given user plays within a network.In this paper, we explore four different measures: degree, harmonic closeness centrality, betweenness centrality and PageRank.This allows us to get a better grasp of what type of role may be more suited to the task of identifying key players in cryptomarkets.The nuances of the interpretation of centrality measures can vary depending on whether we account for edge weights, i.e., the strength of social ties, and edge directions, i.e., who responds to whom.Therefore, we consider for each measure whether the direction and strength of social ties matters, for identifying (successful) vendors for law enforcement applications.
Beside network measures, several intuitive straightforward measures can be obtained directly from the forum data.We consider three such measures: post activity, topics started, and (started) topic engagement.We henceforth refer to these measures as forum activity indicators.The rationale behind these three activity indicators, rely on vendors' tendency to start topics to promote their listings 11,20 and the concept of name recognition.Name recognition, also called brand awareness in a market context, has been linked to improved trust 21 and market outcomes 22 (e.g., more sales).Furthermore, Duxbury & Haynie 23 concluded that trustworthiness is a better predictor of vendor selection than product diversity or affordability.
To wrap up, in this paper, we investigate to what level employing network measures computed on user-to-user communication networks are useful in identifying both current and future successful vendors on cryptomarkets.We look at three law enforcement applications, each increasingly more useful to law enforcement practitioners.We investigate whether (1) network measures can be used to distinguish vendors and their level of success; if (2) rankings induced by network measures can narrow down the user base to a significantly smaller set of potentially relevant users for law enforcement to investigate; and, to what extent (3) the top ranked users include successful vendors and other key players.
The Evolution cryptomarket, is the main dataset studied in this paper and features over 500 thousand posts and over four thousand vendors.Applying our methods, we find that both the activity indicators and network centrality measures assign higher values to (successful) vendors on average, distinguishing them from non-vendors and less successful vendors alike.Additionally, betweenness centrality and topic engagement provide the best starting points for identifying (future) successful vendors, with betweenness centrality including the largest share of successful vendors not included by any activity indicator.Finally, betweenness centrality and topic engagement perform reliably for future success and have the potential to provide law enforcement with early warning signals for vendor success.
The remainder of this paper is structured as follows.In the Results section we shortly describe the dataset and measures used before reporting on our results.The results and their implications for law enforcement are discussed in the Discussion section.Finally, the Methods section provides more in-depth descriptions on the dataset and network extraction as well as the activity indicators and network measures used in this work.

Results
In this section we first discuss our dataset and the (network) measures for identifying key players that we consider in this work.Next, we report and interpret results for the task of distinguishing vendors from non-vendors and predicting the levels of success.Then, we explore to what extent the rankings induced by (network) measures can reduce the set of users for law enforcement to investigate, while still including the greatest share of successful vendors.Finally, we look at the set of top ranked users for the most promising network centrality measure and activity indicator at a specific point in time.We do so to establish how well represented key players are among these top ranked users.

Data
In this study we focus on the cryptomarket Evolution.Evolution was active from January 2014 until March 2015, when it closed due to an exit scam.At the time, it was one of the most popular cryptomarkets 5 .It formed a combination of a carding forum, where card information (e.g., credit/debit/ID/etc.) is traded and an underground drug market 24 .
We obtained raw data of the Evolution marketplace and forum from the dark net market archives 25 .From this, we extracted a structured dataset, established a method of linking the market and forum data, and subsequently extracted communication network(s).The extraction process, the resulting dataset, and various statistics on the dataset and its completeness, are presented in Boekhout et al. 26 .The same extraction procedure and parameters (δ o = 10, δ t = 1 month, ω lower = 0.2, t lim = 7 days, and ω f irst = 0.5) were used for the communication network(s) studied in this work.The parameters control respectively the bounds on when two posts constitute a social tie (δ o and δ t ) and the strength of the social tie (ω lower , t lim , and ω f irst ).We demonstrate the robustness of our findings for each of these parameters in the Supplementary Material.
The cryptomarket Evolution observed two notable changes in user and post activity.In the initial months up to May 2014, the cryptomarket underwent steady growth in terms of both post activity and the number of active users.However, monthly post activity stabilised from May until October (see Figure 3).Notably, May saw a change in the vendor ranking system, which assigns textual labels to vendors that are visible on the marketplace to potential customers and imply a level of success and trustworthiness.Obtaining a label representing greater success and trustworthiness as a vendor now required sufficient positive feedback, but most important for us, the new ranking system also reported on the exact total number of sales a vendor had made up to that point.The second major change to the cryptomarket came in early November 2014, as a by-product of the closure of six cryptomarkets following the joint international law enforcement operation dubbed "Onymous" 5 .After this disruption, Evolution showed a significant spike in overall activity until its closure.
Both the communication networks and current & future sales counts were extracted on a monthly basis using data up to the end of each month.As such, we obtained 15 network snapshots (starting from January 2014 up to March 2015).Details on the network extraction process and the computation of monthly sales statistics are provided in the Methods section.

Network measures & activity indicators
Each considered network measure captures a different role a user may play within the network.To cover a wide range of user roles that may be important to vendor success, we report on four centrality measures: (1) in-degree; (2) bidirectional harmonic closeness centrality; (3) directed weighted betweenness centrality; and (4) directed weighted PageRank.The in-degree of a user indicates the number of different users that posted (shortly) after them on the same topic(s).Thus, it can serve as a proxy of how many users have seen one or more of their posts and thus to some extent their level of name recognition.The bidirectional harmonic closeness centrality 27 is a measure of a user's ability to reach the entirety of the network, following paths regardless of link direction.High harmonic closeness centrality indicates that it should be relatively easy to reach and therefore potentially be visible to the entire user base.The directed weighted betweenness centrality 28,29 computes how often a user lies on shortest paths connecting other nodes, taking into account both the direction and strength of social ties.High betweenness nodes often lie 'between' communities.As such, it may be a good measure of how well a (potential) vendor reaches different, otherwise separated, communities of customers.Finally, the directed weighted Pagerank 30 computes the probability that a random walker that infinitely traverses a network ends up at a given node, taking into account both the direction and strength of social ties.High PageRank centrality is often an indicator of being well connected to other important users.Duxbury & Haynie 23 found that buyers were more likely to continue ordering with vendors within the same community.As such, a close connection with other key players, as indicated by a high PageRank value, can be indicative of a high perceived trust, positively affecting sales.
To evaluate the network measures we compare them against three activity indicators.These activity indicators can be computed directly from the forum data, so without aforementioned communication network extraction, are intuitively meaningful in the context of cryptomarket vendor success and also do not require knowledge of message content.We consider: (1) post activity; (2) topics started; and (3) topic engagement.Post activity refers to the number of posts a user has placed on the forum.It relies on the idea that greater activity means greater visibility, which in turn leads to greater name recognition.Topics started determines the number of topics a user started and topic engagement subsequently computes the sum of all posts placed within those topics, regardless of who posted them.These measures rely on the fact that the more topics a user has started and the more engagement those topics received, the greater the likelihood that they are a (successful) vendor.Again, the increased visibility through these started topics also boosts their name recognition.
Further details on the computation and interpretation of the measures is provided in the Methods section.

Distinguishing vendors and their level of success
To predict vendor success, we must determine if it is possible to distinguish between vendors and non-vendors, as well as between various levels of success.We look at the average network centralities and activity indicators for groups of users, in an attempt to distinguish groups with greater success.To this end, we divided, for each month, all active vendors, i.e., all users that are or will become vendors with at least one post already posted at that time, into five groups of success percentiles, each including respectively the top 0-20%, 20-40%, etc. of vendors in terms of sales.We refer to these groups as vendor percentiles.Separate vendor percentiles are formed for current and future success.We refer to the most and second most successful percentiles as the top and sub-top percentile, respectively.The group of non-vendors consists of regular forum users and those vendors with no recorded sales at all.First, we computed for each month the mean normalized value for each measure for the groups of all vendors and all non-vendors.Normalization, to the range [0, 1], was performed separately for each month.We compute a relative difference score between vendors and non-vendors, as the former group's mean value subtracted and then divided by the latter group's mean value.For the absolute difference score only the subtraction is performed.Both are reported as a percentage.The monthly difference scores between vendors and non-vendors for the four network measures and three activity indicators are depicted in Figures 1a,d.In these figures, lines give a third polynomial approximation of the trend based on the monthly centralities and activity indicators.Here, the third polynomial is used to account for the two aforementioned changes in activity observed for the Evolution cryptomarket 26 .Dashed lines are used for the network measures and dotted lines for the activity indicators.
Figures 1a,d show that, for all measures, vendors have higher network centralities and activity indicators than non-vendors.Furthermore, they show that although the relative difference score for betweenness centrality of vendors over non-vendors is quite significant (600-1000%), the corresponding absolute improvement factor is the smallest of all these measures.This indicates that betweenness has relatively small values overall with some extremely high outliers.On the contrary, harmonic closeness centrality has low improvement factors but nominal absolute improvement factors.Since these effects are expected to disappear when inducing a ranking from the actual values, it is less the size of the improvement factor than the fact that they are positive that are an indicator of (useful) predictive power.After all, the ranking induced by the centralities and baselines is more useful to law enforcement practitioners than the actual values.Thus, the exclusively positive values in Figures 1a,d, indicate the potential of all network and baseline measures to distinguish vendors from non-vendors.
Next, we investigate whether these measures can also distinguish between vendors' levels of success.To assess this, we looked at the relative difference scores between the top percentile and all vendors (Figures 1b,c) and between the top and sub-top percentile (Figures 1e,f) for both current and future success.Figure 1b shows that for all measures the currently most successful vendors have on average higher network centralities and activity indicators.After the first month and with the exception of July and August 2014 for betweenness centrality, Figure 1e demonstrates this also holds when comparing the top with the sub-top percentile.Interestingly, trend changes for most measures follow cryptomarket developments.For example, up until May the difference score increases monthly, similar as to how the level of activity on the cryptomarket increased during this period.The following period, up to the "Onymous" disruption 5 , shows stable but slightly decreasing difference scores for most measures.Finally, after this disruption, we see a small increase in difference scores again.
When we consider future success, Figure 1c shows again positive difference scores between the top vendor percentile and all vendors.However, they are noticeably lower than for current success.Similarly, Figure 1f shows mostly positive difference scores when comparing with the sub-top percentile, but with lower scores.Thus, for both current and future success the network centralities and activity indicators show the potential to distinguish vendors' level of success.
Notably, betweenness centrality shows trends that differ from the all other measures.Specifically, for current success we see clearly higher difference scores in the last months.On the contrary, for future success the final months show lower difference scores than before.This behaviour is likely due to the delay between successful vendors establishing themselves in the network and reaping the benefits in terms of sales.In other words, high betweenness centrality is expected to be more a prelude to than a consequence of vendor success.Thus, these results show the potential of betweenness centrality as an early warning signal for future vendor success.
In short, for all measures under consideration (successful) vendors show positive difference scores over non-vendors and less successful vendors.Thus, the rankings induced by these measures are expected to rank successful vendors (relatively) higher.Therefore, the induced rankings have the potential to assist law enforcement by allowing them to focus on the higher ranked users.Furthermore, betweenness centrality was shown to have potential as an early warning signal, as high betweenness appears to precede vendor success.Finally, among the remaining network and baseline measure, topic engagement consistently showed the highest difference scores.This suggests that topic engagement may provide the best predictions of vendor success.

Detecting vendors in the user base
In their efforts to disrupt cryptomarkets, law enforcement has access to limited personnel and resources.One method employed by law enforcement to deal with this limitation, is to reduce the set of users to investigate based on a ranking induced by some measure.Rankings that after such a reduction still include many users of interest, are of course preferable.In the previous section, we established the predictive potential of the network measures and activity indicators for predicting (successful) vendors.Now, we want to explore how this predictive potential translates to the task of reducing the set of users to investigate.To do this, we consider what we call the vendor recall.The vendor recall computes what percentage of users among the top vendor percentile (the top 20% of vendors) is also among the top percentile of all users, i.e., among the top 20% of all users when ranked on a given network or baseline measure.Thus, for a random ranking, we would expect a vendor recall of 20%.Monthly vendor recall, including trend approximations, is plotted in Figures 2a,d for current and future success, respectively.
Figures 2a,d show that, for both current and future success, degree and closeness centrality generally have a worse vendor recall than any of our activity indicators.From May onwards, PageRank outperforms post activity and performs on par with the topics started.Meanwhile, from July onwards, betweenness centrality consistently outperforms both the post activity and topics started activity indicators and performs (nearly) on par with topic engagement.Overall, the topic engagement indicator most consistently achieves high performance in terms of vendor recall.These observations tell us two things.First, network centrality measures require the communication network to have developed and stabilised sufficiently before achieving reliable vendor recall.After all, during the initial months the communication network and its structure are still undergoing significant changes.Consequently, we also see large fluctuations in vendor recall for the network measures between these months.Second, network measures do not strictly improve on our best activity indicator(s) in terms of vendor recall.
Despite achieving the best vendor recall, topic engagement is only able to detect up to two thirds of the most successful vendors for current success and even fewer for future success.Thus, there may still be a significant number of successful vendors that are not detected by the activity indicators that may be included by network measures.Therefore, we also analyse the overlap of detected vendors between the network measures and activity indicators.Table 1 shows the average monthly overlap of each network measure with each individual activity indicator and the union of detected vendors by all activity indicators.We see that PageRank and betweenness centrality detect the greatest share of vendors also found by the activity indicators, detecting on average approximately 80% of all current vendors and 75% of all future vendors found.However, respectively nearly 99% and 97% of all vendors detected by PageRank are also found by the activity indicators.As such, PageRank is not able to identify many new vendors.On the contrary, the activity indicators find respectively only 94% and 90% of the vendors included by betweenness centrality.Notably, individual indicators find far fewer.Thus, betweenness centrality is able to detect the largest share of successful vendors not included by any of the activity indicators.Therefore, reducing the set of users for law enforcement to investigate using betweenness centrality may provide a fresh perspective.
Despite finding additional vendors, the union of all successful vendors detected by betweenness centrality and all activity indicators only finds around 75% and 65% of the top percentile for current and future success, respectively.This means there is still a significant segment of the most successful vendors that would not be found for any of these measures.One possible explanation for scoring low on any of these measures is simply low posting activity.To assess whether this holds for the 5/14  successful vendors that do not score high enough to be detected, we look at what we call the post activity recall of the top vendor percentile in Figures 2b,e.The post activity recall is the percentage of the top vendor percentile's total post activity, for a given month, that is associated with those vendors detected with vendor recall.Figures 2b,e show that for both current and future success, the vast majority of post activity is associated with the vendors with high network centrality and activity indicators.As such, low post activity can be considered the main reason for the relatively low vendor recalls we observe.After all, the over 30% of successful vendors that are not found are responsible for less than 10% of the post activity of the entire group (in most cases even less).Furthermore, vendors with low post activity are also much less likely to be found using other methodologies.Therefore, applying this methodology is unlikely to miss vendors that other methodologies might have found.Thus, the relatively low vendor recall achieved by betweenness centrality and topic engagement should not discourage law enforcement practitioners from using this methodology.Finally, we consider the sales recall, which measures what percentage of sales of the entire top percentile the detected vendors are responsible for.We plot the monthly current and future sales recall in Figures 2c,f.We see that for current success most of our observations for vendor recall hold up.Perhaps the most significant change is that the differences between PageRank and topics started and between betweenness centrality and topic engagement are more prominent.Similarly, for future success PageRank now outperforms the topics started baseline more consistently.For both current and future success, we observe that the sales recall is generally between 10-20% higher than the corresponding vendor recall.This indicates that the detected vendors are, on average, the more successful vendors among the top percentile.
To summarise, topic engagement provides the best single measure recall performance.Meanwhile, betweenness centrality identifies the greatest share of vendors that do not score high for any of the activity indicators.Additionally, betweenness centrality detects the most vendors of all network measures.As such, betweenness centrality is the network measure most likely to be of use to law enforcement for detecting vendors in the user base.Furthermore, betweenness centrality performs, relative to the activity indicators, better for future vendor success, further demonstrating its potential as an early warning signal.

Key player identification
In the previous section we determined that betweenness centrality and topic engagement are the measures with the greatest vendor recall performance.That is to say, they are likely to have the most successful vendors among the top ranked users when ranked on these measures.Here we look at the top scoring users to investigate to what extent the top scoring users are indeed key players in the cryptomarket.To this end, we report the top 25 users, their member title and their current and future sales for September 2014 for these measures in Table 2.
We see that among the top 25 users in betweenness centrality and topic engagement there are ten (i.e., 40%) that occur in both rankings.Furthermore, we observe that for both measures over half of the top 25 users have current and/or future sales (56% and 64% respectively).The probabilities of this happening randomly are 3.47 × 10 −7 and 3.44 × 10 −9 , respectively.Note, not all users with sales also have the corresponding "Vendor" member title.The reason for this is twofold: first, more important titles such as "Administrator" and "Moderator" supersede the "Vendor" title; and second, the "Vendor" title did not exist before September leading to some older vendors with few future sales not to be labelled as such.This also illustrates a potential pitfall of relying too much on forum member titles for key player identification.
Of the users with sales, twelve are among the top percentile for current sales and eight are among the top percentile for future sales.Respectively three (kalashnikov, Yasuo, and Grandeur) and one (SkypeMan) of them are in fact in the top 10 current and future sales.This suggests, these two measures are suitable for predicting successful vendors.Notably, Trippyy, who is included in the top 25 for betweenness centrality, is the only user that is a member of the top percentile for future sales, but not a member of the top percentile for current sales.Note, that Trippyy's member title in September was still "Vendor".Finally, compared to topic engagement, the top 25 of betweenness centrality includes a greater proportion of vendors for whom the majority of their sales are yet to come.Thus, this is another indicator that betweenness centrality can potentially serve as early warning signal for future vendor success.
In addition to vendors, we also find users with other important positions on the forum, such as "Administrator" and "Moderator", among the top 25 for both measures.In fact, betweenness centrality and topic engagement combined include three out of the four users to have held the title "Administrator" among their top users.Furthermore, the only missing administrator became inactive within a month of the founding of the cryptomarket.Thus, we can say that all active administrators were found.Additionally, betweenness centrality identifies five out of nine users to have held the title of "Moderator" and who registered before the end of September 2014 (four out of seven if we exclude users who obtained the title after September, including d33poutside).The probability of this happening randomly is 2.07 × 10 −11 (2.27 × 10 −9 ).On the other hand, topic engagement includes two out of nine (two out of seven) with a probability of 3.10 × 10 −4 (1.82 × 10 −4 ).Thus, these measures are suited to predicting key players beyond just successful vendors.Though neither measure perfectly identifies only key players, they provide an excellent way of identifying individuals to investigate further manually.

Discussion
The identification of key players in cryptomarkets such as successful vendors and administrators, is a vital step in law enforcement interventions.Whereas it can be easy to identify administrators due to titles given to these users, it may be harder to identify successful vendors.It is especially difficult to identify those vendors whose success is yet to come.These tasks might be further complicated when encryption is used for message contents.The results presented in this work showed that network measures computed on the communication network and three forum activity indicators, that are intuitively linked to vendor success but not reliant on knowledge of message content, are useful in predicting (future) successful vendors.
Our results showed that, on average, it is possible to distinguish between vendors and non-vendors using both network centrality and the activity indicators.Additionally, we found that more successful vendors have on average higher centralities and activity indicators than less successful vendors.This holds for both current and future success, though to a lesser degree for the latter.However, it is important to remember that these findings are about the average case; perfect delineations cannot be made.Even so, they indicate that the rankings induced by the measures have predictive potential for vendor success and may be useful to law enforcement activities.
To reduce the workload for law enforcement, it can be beneficial to reduce the set of users that need to be manually investigated.We found that the measures of betweenness centrality and topic engagement included the greatest proportion of successful vendors when applying such a reduction (up to two thirds of the successful vendors when reducing to 20% of the users).Additionally, results showed that the vast majority (up to 98%) of post activity of the most successful vendors were covered by those included and that those included were on the relatively more successful vendors.As such, most successful vendors that are not retained by these measures are simply almost inactive on the forum.We note that the network centrality measures appear to require the communication network to have sufficiently developed and stabilised for good predictive performance.We found that betweenness centrality was the only network measure that was able to detect a substantial set of successful vendors that were not found by any of the activity indicators.Thus, there are vendors that may not be the most active, start the most topics or get the most engagement on their topics, but that are able to establish themselves in the structure of the communication network such that they connect communities of customers.Therefore, betweenness centrality could be beneficial to law enforcement activities for reducing the set of users to investigate.
The results highlight that the same measures are almost as effective at recognizing those that will do well in the future.This can partly be explained by those that are already quite successful and will simply continue to do well.However, results indicate that the top ranked users by betweenness and topic engagement in fact include several vendors whose majority of sales are yet to come.Furthermore, evidence suggests that high betweenness centrality may (often) precede sales success.As such, beyond predicting current success, the proposed approach can provide early warning signals for future success.

Methods
In this section we discuss our dataset, followed by a description of how the communication networks were extracted.Next, we discuss the rationale and computation of our activity indicators and the four network measures employed, in the context of finding key players in cryptomarkets.

Dataset
As previously discussed in the Data section, we use the data presented in Boekhout et al. 26 .This dataset consists of data on the forum and the market, as well as data that links forum users to market users, i.e., vendors.For the forum data, we rely almost exclusively on the post and user data, ignoring more general information about topics and fora.For the market data, we rely exclusively on the vendors data.This vendors data includes their sales statistics at specific moments in time.However, in most cases, these moments in time are not conveniently at the end of each month.As such, the current sales of a vendor at the end of a given month were estimated based on their average daily growth in the number of sales between the most recent sales information available before and after the change of month.For the months after the last available sales information, the final sales total is used.Future sales of a vendor were then determined as the difference between their current sales, for a given month, and the last available sales information.
Figure 3 shows the total and monthly post activity and number of active users and vendors.Here, active users and vendors are those with at least one post up to and including the given month, where for the monthly active users we require at least one post that month.Throughout our results we relied on the total sets of active users and vendors for each month.

Network extraction
Along with the dataset, we also utilise the communication network extraction method proposed in Boekhout et al. 26 .This extraction method creates nodes for all active users and adds an edge connecting nodes for any posts by a pair of users that are in the same topic and adhere to certain parameters.The direction of these edges are from the user who placed the later post to the user who placed to earlier post.Additionally, edges are formed from every user who placed a post in a topic to the user who placed the first post in the topic.All edges are weighted to indicate the strength of the social tie implied by the edge.
As mentioned in the Data section, we used the following parameters for network extraction: δ o = 10, δ t = 1 month, ω lower = 0.2, t lim = 7 days, and ω f irst = 0.5.The first two parameters, i.e., δ o = 10, δ t = 1 month, set limitations on the existence of an edge.Specifically, they prohibit any edge to be formed for posts that are more than ten posts apart or that were placed more than one month apart.The parameters ω lower = 0.2, t lim = 7 days, determine the scope and decay of the exponential weighting function applied to "regular" edges, i.e., they determine the strength of the implied social tie.Specifically, ω lower sets the minimum weight at 0.2, while t lim determines that this minimum weight applies for all pairs of posts at least seven days apart.The resulting exponential weighting function is shown in Figure 4. Thus, ω lower and t lim determine the likelihood that a post was placed in response to or after having at least seen a specific earlier post, while δ o and δ t determine at what point we consider this likelihood too low to imply a social tie.The final parameter, ω f irst = 0.5, sets the weight for all other edges, i.e., edges formed from linking posts to the initial post.Robustness of our results for these parameters is investigated in the Supplementary Material.
Monthly communication networks were extracted based on all posts up to the end of the given month, thus including posts from previous months.Additionally, we simplify the networks by merging all parallel edges, i.e., all edges connecting the same two nodes in the same direction, into single edges.The weights of the resulting edges are exactly the sum of the parallel edges that were merged.In other words, the resulting weights represent the the combined likelihood of a meaningful social tie connecting two users.As a result, we obtain fifteen simplified monthly weighted directed networks G = (V, E), where each node u ∈ V represents an active user and each weighted edge (u, v) ∈ E represents the inferred weight of the social tie from user u ∈ V to user v ∈ V .It is on these monthly weighted directed networks that the network measures were computed.

Activity indicators
To evaluate the performance of predicting vendor success using network measures, we compare against some activity indicators that can be directly computed from the forum data.Similar to the rationale for our use of network measures, these activity indicators must also adhere to the requirement that we lack knowledge of message content.We considered three activity indicators in this paper: post activity, topics started and topic engagement.Below, we discuss why we believe these are appropriate indicators and how they are computed.

Post activity
Post activity refers to the number of posts a user has posted on the forum up to a given moment in time.A straightforward link can be made between a user's visibility on a forum and their post activity.After all, the more often someone posts, the more likely it is that another user will come across one of them.This increased visibility leads to greater name recognition, which has been linked to improved trust 21 and market outcomes 22 (e.g., more sales); and trustworthiness has been shown to be a better predictor of vendor selection than product diversity or affordability 23 .Therefore, post activity can be used as in indicator of the likelihood of vendor success.Furthermore, since post activity is simply the number of posts placed by a given user, it can be determined at no computational cost and without knowledge of message content.Thus, post activity is well suited to provide baseline performance to evaluate the network centrality measures.

Topics started
Forums that accompany cryptomarkets are intended to allow vendors and their customers to interact.As such, it is common practice for vendors to promote their products listed for sale by starting a topic promoting their listings 11 .The number of topics a user has started is therefore a potential indicator of being a vendor and hence our second baseline measure.As a greater number of topics started may lead to greater visibility, greater name recognition, and simply a greater reach, it may also lead to increased success for vendors 20 .Furthermore, the number of started topics is also easy to compute and is not reliant on knowledge of message content.

Topic engagement
Topic engagement is the total number of responses to all topics started by a user combined.It can be computed with little computational cost and independent of any knowledge of message content.Topic engagement combines the fact that starting topics is a good indicator of being a vendor with the fact that when topics receive a lot of engagement they are naturally also more visible.Additionally, engagement in any topics about a specific listing is likely to be associated to that listing or the vendor.For example, a post may concern feedback on the particular listing or on the vendor themselves.Either way, engagement on these topics is also highly probable to be associated with actual sales.As such, where the topics started baseline is more likely to be a good indicator of being a vendor or not, topic engagement is more likely to be a good indicator of the success of any such vendor.

Network centrality measures
In this subsection we discuss the various network measures utilised in this paper.We discuss their computation and interpret their meaning within the context of cryptomarket communication networks.All network measures were computed using the igraph package 31 .

Degree
The degree of a node is a measure of the number of distinct neighbors connected to that node.While degree captures this regardless of edge directions, in-and out-degree count only the neighbors connected through incoming and outgoing edges, respectively.Furthermore, the weighted degree variants sum the weights of the connections with the neighbors.

10/14
The degree can be interpreted as the number of different users that a (potential) vendor responds to or receives responses from.The weighted variant also takes into account how strong the relation to these users are.Thus, a high in-degree in our networks indicates many different users responding within a relatively short time frame.Since it is likely that those that respond shortly after a post have seen that post, a high in-degree implies visibility to many different users, thereby improving the aforementioned brand awareness.As brand awareness promotes trust and sales 21,22 and trust is a good predictor of vendor selection 23 , a high in-degree might serve as a good predictor of vendor success.
Unlike incoming edges used for in-degree, outgoing edges do not imply visibility of the user to the neighbors these edges connect to, since those neighbors posted before the user.For this reason we focus on the in-degree instead of the degree or out-degree.We report results for the unweighted in-degree, as we believe the number of neighbors, i.e., the number of potential customers, to be a better predictor of vendor success than the combined strength of the social ties to these neighbors.Weighted in-degree showed similar results, but with slightly fewer detected vendors that were not found by the activity indicators.

Harmonic closeness centrality
Closeness centrality 27 is a measure of how easily a node can reach every other node in the network.Essentially, it computes the shortest distances, i.e., shortest paths, to every other node.In other words, where degree was a measure of how well someone is connected locally, closeness is a measure of how well connected a node is globally, i.e., to the entire network.Harmonic closeness centrality behaves essentially the same as standard closeness centrality and extends properly to directed and disconnected networks, i.e., networks with node pairs that are not connected by any (directed) path 32 , such as ours.
Let d G (u, v) be the shortest distance connecting nodes u, v ∈ V , where if no path exists d G (u, v) = ∞.Using 1 ∞ = 0, we can define the harmonic closeness centrality as: For bidirectional harmonic closeness centrality, the shortest paths can be determined following edges regardless of their direction.However, for incoming and outgoing harmonic closeness centrality the paths may follow edges only in one direction, either following the direction of the edges (outgoing) or going against the direction of the edges (incoming).The weighted variants of these measures use the inverse of the edge weights during shortest distance computation, such that stronger connections equate to shorter distances.We report on the unweighted bidirectional harmonic closeness centrality in the Results section as it detected the largest share of vendors not found by any of the activity indicators of all variants.The interpretation of distance more than a single edge away with respect to vendor success in cryptomarket communication networks is not straightforward.To a certain extent, one can interpret a smaller distance as being more likely for your posts to be visible to the other user.Even so, it is unknown how the topics, that are responsible for forming the edges that make up the connecting paths, are related.They may originate from the same or a highly similar topic, increasing the odds of being visible, or they may differ greatly, making it unlikely that these connections truly form a meaningful path.As such, a high closeness centrality does not intuitively imply a successful vendor.Regardless, closeness centrality has often proven to capture users at important positions in a network and is therefore included in our analyses.

Betweenness centrality
Betweenness centrality 28,29 measures the extent to which a node is on shortest paths connecting pairs of nodes in the network.In other words, it measures how important a node is with respect to connecting various communities in the network.In the context of cryptomarkets, this makes it a good measure of how well a (potential) vendor reaches different communities of potential buyers.As such, a vendor with a high betweenness is more likely to have a larger pool of buyers as they may be able to draw from more communities of buyers.Additionally, betweenness centrality has been shown to perform well in identifying key players in criminal networks 13,19 .
The betweenness centrality of node u ∈ V is determined by computing the sum of the fraction of shortest paths connecting nodes v, w ∈ V that pass through u.Let σ vw indicate the number of shortest paths connecting nodes v, w ∈ V , and let σ vuw indicate the number of those shortest paths that pass through node u ∈ V .Then betweenness centrality can be defined as: For directed betweenness centrality, paths must follow the direction of the edges, while undirected betweenness can follow edges in either direction.Like for harmonic closeness centrality, the weighted variants use the inverse of the edge weights during shortest path computation, such that stronger connections equate to shorter distances.The variant taking both direction and weighting into account, showed the best performance.Therefore, its results are reported in the Results section.

PageRank
The final measure we consider is PageRank 30 .PageRank computes the probability that a random walker that infinitely traverses a network ends up at a given node.Each step of these random walks consist of either following one of the available edges or jumping to a random node with a particular probability.For the directed variant the choice of edge is restricted to following the direction of the edges and adding weights impacts the odds of following any given edge.Similar as for betweenness centrality, we report the results for the variant taking both direction and weighting into account, as it showed the best performance.High PageRank values often follow from having paths/edges incoming from many and/or other important (i.e., high value) nodes in the network.As such, we can interpret a high PageRank value as being closely connected to other key players.As previously stated, Duxbury & Haynie 23 found that buyers were more likely to continue ordering with vendors within the same community.This means that the close connection between users with high PageRank value can be indicative of a boost in their perceived trust and may stimulate their sales.Thus, a high PageRank value may be able to predict successful vendors.

5 F 5 F
Relative difference between vendors and non-vendorsJa n '1 4 F e b '1 4 M a r '1 4 A p r '1 4 M a y '1 4 Ju n '1 4 Ju l '1 4 A u g '1 4 S e p '1 4 O c t '1 4 N o v '1 4 D e c '1 4 Ja n '1 5 F e b '1 5 M a r 'Relative difference between the top percentile and all vendors, current success Ja n '1 4 F e b '1 4 M a r '1 4 A p r '1 4 M a y '1 4 Ju n '1 4 Ju l '1 4 A u g '1 4 S e p '1 4 O c t '1 4 N o v '1 4 D e c '1 4 Ja n '1 Relative difference between the top and sub-top vendor percentile, current success Ja n '1 4 F e b '1 4 M a r '1 4 A p r '1 4 M a y '1 4 Ju n '1 4 Ju l '1 4 A u g '1 4 S e p '1 4 O c t '1 4 N o v '1 4 D e c '1 4 Ja n '1 Relative difference between the top and sub-top vendor percentile, future success

Figure 1 .
Figure 1.The (relative or absolute) difference score between vendors over non-vendors and between the top percentiles and all vendors or the sub-top percentiles.The difference score computes the difference in the average normalized value of one group of users over another.In this figure, positive difference scores indicate that the more "successful" group achieves higher network centralities or activity indicators on average.

Figure 2 .
Figure 2. Vendor recall of top vendor percentile (top 0-20% vendors in terms of sales) among the top 20% of all users based on the network measures and activity indicators.Plots cover recall in terms of vendors and those recalled vendors' post activity and sales w.r.t. the entire top percentile's activity and sales for both current (top row) and future success (bottom row).Higher vendor recall indicates a greater portion of the top vendor percentile was found.Higher post activity recall indicates that the recalled vendors placed a relatively larger share of the top vendor percentiles total post activity.Higher sales recall indicates a greater portion of the top vendor percentile's total sales was attributed to the recalled vendors.

Figure 3 .
Figure 3. Post activity and active users over time.

Table 1 .
Mean (and standard deviation) of the monthly overlap between network centrality based and activity indicator based detected vendors for the top vendor percentile (top 0-20% of vendors in terms of sales) as shown in Figure2.(Abbreviations of activity indicators: pa = post activity, ts = topics started, and te = topic engagement.)

Table 2 .
Top 25weighted directed betweenness and topic engagement for September 2014.Titles are determined as their most significant observed over the entire dataset (Administrator > Market Moderator > Moderator > Public Relations > Vendor > Banned > Troll > Member).