Identifying Hidden Buyers in Darknet Markets via Dirichlet Hawkes
  Process
  The darknet markets are notorious black markets in cyberspace, which involve
selling or brokering drugs, weapons, stolen credit cards, and other illicit
goods. To combat illicit transactions in the cyberspace, it is important to
analyze the behaviors of participants in darknet markets. Currently, many
studies focus on studying the behavior of vendors. However, there is no much
work on analyzing buyers. The key challenge is that the buyers are anonymized
in darknet markets. For most of the darknet markets, We only observe the first
and last digits of a buyer's ID, such as ``a**b''. To tackle this challenge, we
propose a hidden buyer identification model, called UNMIX, which can group the
transactions from one hidden buyer into one cluster given a transaction
sequence from an anonymized ID. UNMIX is able to model the temporal dynamics
information as well as the product, comment, and vendor information associated
with each transaction. As a result, the transactions with similar patterns in
terms of time and content group together as the subsequence from one hidden
buyer. Experiments on the data collected from three real-world darknet markets
demonstrate the effectiveness of our approach measured by various clustering
metrics. Case studies on real transaction sequences explicitly show that our
approach can group transactions with similar patterns into the same clusters.
