Carolina Capello

Federico J Hernández

Michel Broquier

Claude Dedonder-Lardeux

Christophe Jouvet

Gustavo Ariel Pino
email: gpino@fcq.unc.edu.ar

M C Capello

Hydrogen bonds vs. π-stacking interactions in the p-aminophenolp-cresol dimer: an experimental and theoretical study

come   L'archive ouverte pluridisciplinaire

INTRODUCTION

Non-covalent interactions are very important in different areas of chemistry and molecular biology. 1,2 Particularly, π-π interactions and hydrogen-bonds (conventional and unconventional H-bond) between aromatics rings are associated with supramolecular structure and stability of biomolecules, such as proteins 3,4 and nucleic acids, 5,6 as well as important biorecognition processes. 7- 8 9 These non-covalent interactions, in aromatic dimers, can lead to different arrangements such as sandwich (S), parallel displaced (PD), tilted parallel-displaced (T-PD), T-shaped (T), tilted T-shaped (T-T), V-shaped (V) or hydrogen bond (HB) configurations, depending on the orientation of each ring. 10 Recent theoretical results on benzene dimer, a benchmark system to understand π-π interactions, have shown that both, S and T structures are almost isoenergetic, 11 12 -13 14 but only the T configuration has been observed experimentally. 15 16 -17 The most recent theoretical results on aromatics dimers are focusing on analyzing the substituent effects in the π-π interactions, studying complexes of benzene and substituted benzenes. 10,18 19 -2021 22 These studies revealed that all the dimers of substituted benzenes, in the S configuration, bind stronger than the benzene dimer, irrespective of the nature of the substituents, i.e., electron donating or withdrawing. 18,20 This result contradicts the Hunter-Sanders rules proposed to explain the substituent effects on the π-π interactions, 23 and therefore, the electrostatic term is not the sole factor governing the binding energy in this kind of interactions.

Many investigations focus on the competition between the different interactions that can occur in complexes of substituted aromatic molecules, especially to characterize the stabilization driving forces of -stacked and HB dimers.

In some cases, the -stacked structures have been characterized experimentally and assumed to be the most stable ones in the ground state of the dimer. Some of these -stacked dimers involve N-heterocyclic aromatic rings 24 2526 -27 28 while there are a few cases in which πstacking structures are formed by substituted benzene rings such as the aniline dimer 29 , the 1,2difluorobenzene dimer 30 , the heterodimers aniline-benzene 31 and anisole-benzene 32 and more recently the homodimers of phenylacetylene 33 and anisole 34 have also been characterized as stacked structures.

In other cases, T, V and HB structures of (phenol) 2 35 and (p-cresol) 2 36 homodimers, and of 7-azaindole…fluoropyridines, 37 indole…pyridine, 38 indole…imidazole, 39 anisole…phenol, 40 and 7-azaindole…phenol 41 heterodimers have been experimentally observed. These structures are believed to be observed because of their remarkable stability in the ground state, as compared to other possible isomers.

In this work, we present an experimental and theoretical study of the p-aminophenol…pcresol (p-AmPhOH…p-CreOH) heterodimer that offers the possibility of competition between many kinds of H-bond interactions between the different substituents (OH…OH, NH…OH, OH…NH) of both molecules as well as -stacking interaction between the rings.

EXPERIMENTAL

The experimental set-up used in Córdoba for LIF and REMPI spectroscopy with nanosecond lasers has been described previously. 42 Briefly, the carrier gas He at 1. The ions were extracted perpendicularly to the molecular beam and laser directions, and detected by a microchannel plate (Jordan MCP). For the LIF experiments, excitation (LE) and dispersion (DF), the jet was intercepted at right angle, by the laser beam, at 1.5 -2.0 cm from the nozzle.

The fluorescence was collected by a telescope collinear to the jet and detected by a photomultiplier tube (PMT) (Hammamatsu R636) without any filter, or dispersed by a monochromator (FWHM = 1 nm). The signals from PMT and MCP were averaged and digitized by a Tektronic (TDS-3034B) oscilloscope and integrated with a PC. The rise time of the complete detection system was 1 ns.

The experimental conditions used in Orsay were the same as in Córdoba. In this case, pump-probe experiments with picosecond laser pulses were performed. The molecular beam was crossed perpendicularly by the laser beams, 10 cm downstream from the nozzle, in the center of the extraction zone of a TOF-MS and the ions were accelerated toward a MCP detector located at the end of a 1.5 m field-free flight tube perpendicular to the jet and laser beams axis.

For the pump-probe experiments, the third harmonic (355 nm) output of a mode-locked picoseconds Nd:YAG laser (EKSPLA-SL300) was split in two parts to pump two OPA and SHG systems (EKSPLA-PG411) for obtaining tunable UV light. One of the systems was used as excitation laser tuned at several frequencies ( 1 ) while the other system was tuned to 325 nm and used as ionization laser ( 2 ), keeping its energy at 100 J/pulse approximately, while the energy of the  1 laser was attenuated to preclude one-color two-photon ionization. The temporal shapes of both pulses were determined in the fitting procedure as Gaussian functions of (15 ± 2) ps FWHM, 43 while the spectral line width was 5 cm -1 . The laser pulses were optically delayed between -300 and 800 ps by a motorized stage.

THEORETICAL CALCULATIONS

Ab-initio calculations were performed with the TURBOMOLE program package, 44 making use of the resolution-of-the-identity (RI) approximation for the evaluation of the electron-repulsion integrals. 45 The equilibrium geometry of the clusters in their ground electronic state (S 0 ) was determined at MP2 level. The equilibrium geometry of the lowest excited singlet state (S 1 ) and the excitation energies were determined at the RI-CC2 level. 46 These calculations were performed with the correlation-consistent polarized valence double-zeta basis set (cc-pVDZ). 47 The Franck-Condon simulation was performed with the PGOPHER software 48 using the vibrational frequencies calculated for the ground and excited electronic states. Additionally, some faster DFT and TD-DFT calculations were performed with the GAUSSIAN 09 program package, [START_REF] Frisch | Revision D.01[END_REF] using the ωB97X-D functional [START_REF] Chai | [END_REF] and the 6-311G++(d,p) basis set.

RESULTS

Spectroscopy and excited state lifetime of p-AmPhOH…p-CreOH

Figure 1 shows the one-color REMPI spectra, recorded with nanoseconds pulses, of p-AmPhOH, p-CreOH, (p-CreOH) 2 and p-AmPhOH…p-CreOH by integrating the intensity of the ions at m/z = 109, 108, 216 and 217 a.m.u., respectively. The spectra of the monomers show narrow and well defined transitions with the bands origin ( ) for the S 1 S 0 transitions centered at 31395 cm -1 for p-AmPhOH and 35336 cm -1 for p-CreOH. The lowest energy part of the REMPI spectrum of (p-CreOH) 2 is also shown in the inset of Figure 1. The transition for this complex is red-shifted by -324 cm -1 from the transition of the free p-CreOH monomer as previously reported. 36 Under the present experimental conditions, well-defined progressions of low-energy vibronic modes are observed for this homodimer. The REMPI spectrum of the p-AmPhOH…p-CreOH complex, recorded with nanosecond pulses (green) and corrected by the dye laser power, is an unstructured broad band extending over 3000 cm -1 (31000 and 34000 cm - 1 ), with the maximum at approximately 33000 cm -1 and the apparent structure above 33500 cm -1 is due to fluctuations of the laser power. The band origin ( ) for the S 1 S 0 electronic transition cannot be determined in this case. The same broadband spectrum was obtained with picosecond pulses (orange trace).

The broad continuum spectrum may be due to a strong geometry change between the S 0 and S 1 states or to an ultra-short excited state lifetime of the complex or to hot complexes in the ground state that produce a congested spectrum.

The last possibility can be ruled out since we observed a structured spectrum for the (p-CreOH) 2 , which indicates that the clusters formed in the jet are confined in low ro-vibrational levels of the electronic ground state. The results show that the average excited state lifetime of the complex, determined by both techniques is (2.5 ± 0.5) ns, without any clear dependence on the excitation energy. Similar excited state lifetimes were reported for the p-AmPhOH (2.20 ns) 51 and p-CreOH (4.1 ns) 52 monomers, showing well resolved structured spectra. This result suggests that the lack of structure in the excitation spectrum of the heterodimer is not due to short excited state lifetime.

In addition, structured spectra has been observed for short excited state lifetime species such as phenol…7-Azaindole dimer (30 ± 10 ps) 41 and o-aminophenol (35±5 ps). 53 Therefore, the broad unstructured excitation spectrum of the p-AmPhOH…p-CreOH complex is most likely due to a large geometry change between ground and excited states.

Finally, the dispersed fluorescence (DF) spectrum of the p-AmPhOH…p-CreOH complex, determined under the same experimental conditions as the REMPI spectrum, is shown in Figure 2. The DF spectrum (black), is a broad band extending over 8000 cm -1 (32000 -24000) cm -1 with the threshold at about 24000 cm -1 and the maximum of the band at about 29000 cm -1 .

Geometry optimization and excitation spectrum simulation

As mentioned above, the broad unstructured excitation spectrum of the p-AmPhOH…p-CreOH complex may be associated with a marked geometry change between ground and excited state structures of the dimer. Thus, the geometry of the dimer was optimized in both electronic states. The calculations were performed at the DFT-ωB97X-D and MP2 levels of theory for the S 0 state and TD-DFT-ωB97X-D and RI-CC2 levels for the S 1 state. The ωB97X-D functional is currently recommended to evaluate non-covalent complexes and a comparison of the results obtained from the MP2 and DFT methods (see below) supports this recommendation. 54 A targeted exploration of the potential energy surface was carried out, and multiple trial structures with various bonding motifs, either HB or -stacked, between both moieties were considered for the geometry optimization in the S 0 and S 1 state. The complete set of results is shown in Table S1 (supplementary information).

Overall, those structures in which the OH group from p-CreOH acts as H-donor and NH 2 group of p-AmPhOH as H-acceptor, leading to a HB and a -stacked isomers, are the most stable at both theory level. Hereafter, we will work only on these two isomers since the others are not expected to be present in the molecular beam under the experimental conditions of this work (see Table S1 in S.I.).

The S 0 state relative energy and the vertical and adiabatic transition energies as well as the optimized structures in the S 0 and S 1 state for the HB and -stacked isomers, calculated at both theory levels are shown in Table II. A good agreement between the results obtained from both theory levels, is observed from Table II, except for the relative stability of the HB and stacked isomers in the S 0 state. However, the energy difference is within the calculations error and therefore it is only an indication that both isomers are almost isoenergetic.

Quite remarkably, geometry optimization in the S 1 state, starting from HB or -stacked ground state isomers, leads to the same -stacked (S 1 ) structure.

For the HB isomer, a large geometry change between the HB(S 0 ) and -stacked(S 1 ) is clearly observed (Table II) and negligible Franck-Condon factors are expected for its S 1  S 0 transition, so it might not be observed by optical excitation. For the -stacked isomer, the geometry change between -stacked(S 0 ) and -stacked(S 1 ) is not as large as in the former case.

Therefore, although both isomers could be present in the molecular beam, only the -stacked can be observed.

A close inspection of the S 0 and S 1 state structures of the -stacked isomer (Figure 3)

shows that while both aromatic rings are displaced in the S 0 state, they are found quite aligned in the S 1 state. In addition, the inter-plane distance is shortened from 3.475 Å in the S 0 state to 2.932 Å in the S 1 state. Finally, the angle between the planes of the rings of both molecules decreases from ~7° to ~ 4.5 °. These geometry changes will induce a large activity of low frequency vibrations in the excitation spectrum and low Franck-Condon factors in the adiabatic excitation region.

The HOMO calculated at the geometry of the S 0 state is a  orbital whose electronic density is distributed almost equally on each ring in a way that allows the electrostatic interaction between them, while the LUMO calculated at the S 1 geometry is a bonding orbital with most of the electronic density between the rings (Figure 4).

Assuming that the -stacked isomers is the only one that is optically active in the spectral region explored in this work, the excitation spectrum for the dimer was simulated using the calculated frequencies in the ground and excited states and the Franck-Condon factors computed by the Pgopher program 46 from the optimized geometries of the -stacked(S 0 ) and -stacked(S 1 ) at the RI-CC2 level. Figure 5 shows the simulated (red line) and experimental one-color REMPI ns (black line) spectra of the complex, together with the three most active vibrational modes, which are related to the more important geometry changes between the S 0 and S 1 states.

A good agreement between the experimental and the simulated spectrum of the -stacked isomer is presented in Figure 5. The first band observed in the simulation does not correspond to the transition but to a higher vibrational level. The transition is not observed experimentally and according to the simulation it is expected to be at 3.76 eV (30328 cm -1 ), redshifted by 1067 cm -1 from the transition of bare p-AmPhOH.

DISCUSSION

The unstructured spectrum observed for the p-AmPhOH…p-CreOH complex is not due to spectral congestion associated with a bad cooling because the excitation spectrum of the related (p-CreOH) 2 complex, recorded under the same experimental conditions, is structured.

Band broadening associated to a short excited state lifetime was also dismissed as responsible for the lack of structure since for this complex the measured lifetime is (2.5 ± 0.5) ns.

The experimental and theoretical evidence points to a -stacked isomer that undergoes geometry changes upon electronic excitation. These geometry changes lead lo low Franck-Condon factors in the adiabatic excitation energy and then vibrationally excited states are reached in the S 1 state producing the unstructured spectrum with negligible intensity in the vicinity of the transition.

It is clear that the most important changes in geometry between S 0 and S 1 states are associated with the distance between the aromatic rings and their relative displacement, allowing a better overlap between the  clouds of both molecules in the S 1 state than in the S 0 state. Comparison between p-AmPhOH…p-Cresol and (p-Cresol) 2

While this work shows that the -stacked isomer of the p-AmPhOH…p-Cresol complex is preferentially observed, the HB isomer was reported to be responsible for the structured excitation spectrum of the homodimer (p-Cresol) 2 , 36 which is in line with the different character of the excitation spectra of these two complexes. These differences may be attributed to different relative stabilization energies of the isomers in each dimer. However, Table III shows that stacked and HB isomers are isoenergetic at the DFT-ωB97X-D and MP2 levels, in each complex, within the calculation error. Thus, it is expected that the HB as well as the -stacked isomers of both dimers are present in the molecular beam and at similar concentrations.

Therefore, this ground state property should not be the reason for which different isomers are observed in each complex.

Table III also shows a good agreement between the experimental transition energies and the calculated adiabatic S 1  S 0 transition energies for the assigned isomers. The computed oscillator strength at the TD-DFT (RI-CC2) levels for the HB 0.006 (0.05) and the -stacked 0.006 (0.02) isomers of the p-AmPhOH…p-Cresol complex are very similar and they should be observed with the same probability by means of electronic spectroscopy. However, the extremely large change in geometry upon excitation of the HB isomers leads to negligible Franck-Condon factors for this transition and then the detection of this isomer becomes unlikely as previously observed in 7-Azaindol(H 2 O) 3 complex. 43 For 7-Azaindol(H 2 O) 3 complex, the most stable isomer was not observed due the large difference between the H-bonded network in the ground and excited state equilibrium geometries, that render very weak Franck-Condon factors, and the only isomer observed experimentally is found 0.3 eV above the most stable and unobserved one.

In the case of the (p-Cresol) 2 complex, the oscillator strength of the transition for the HB isomer 0.06 (0.04) is a factor of 200 (20) larger than the corresponding value for the -stacked isomer 0.0003 (0.002) at the TD-DFT (RI-ADC2) level, which makes unlikely its detection by electronic spectroscopy. In the -stacked homodimer, due to the exciton splitting, the first state is optically forbidden as observed from the calculations. The adiabatic transition energy for the first allowed state is found at 5.3 eV at the RI-ADC2 level with oscillator strength of 0.05 (RI-ADC2). However, this state is too high in energy to be responsible for the observed experimental transition (4.34 eV). This is assumed to be the reason for which only the HB isomer is observed for this complex.

For a long time many models were developed to explain the effect of the substitution on the preferential HB or -stacking interaction in aromatic dimers and determine the forces involved. 10,[18][19][20][21][22] We show here, that the remarkable difference observed upon substituting a CH 3 group by an NH 2 group in one of the p-Cresol molecules of the (p-Cresol) 2 dimer can be rationalized considering only the different detection probabilities for HB or -stacking isomers, without invoking the forces involved in the ground state to stabilize one or the other. In fact, in the ground state both isomers are almost isoenergetic for the homo-and heterodimer.

CONCLUSIONS

The gas phase structure of the the p-AmPhOH…p-Cresol complex has been studied by REMPI, LIF and pump-probe experiments together with ab-initio and DFT calculations. From the results it is suggested that a -stacked structure is responsible for the excitation spectrum. In the excited state this complex behaves as an exciplex-like. Almost isoenergetic with the stacked isomer, the HB isomer is not observed due to low Franck-Condon factors.

A comparison with the (p-Cresol) 2 dimer for which only the HB isomer was reported, indicates that the -stacked isomer of this complex has an oscillator strength too low to be detected by electronic spectroscopy involving this excited state, although in this case, the HB and -stacked isomers are also almost isoenergetic. This is another example in which UV and/or IR-UV spectroscopy cannot be employed for searching the most stable structure in the ground state, since the reason for observing or not a given structure depends on the optical properties (oscillator strengths and Franck-Condon factors) of the transition and not only its ground state stability.

ACKNOWLEDGMENTS

This works was supported by ECOS-MinCyT cooperation program (A11E02), FONCyT, CONICET, SeCyT-UNC and the ANR Research Grant (ANR2010BLANC040501). We acknowledge the use of the computing facility cluster GMPCS of the LUMAT federation (FRLUMAT 2764). This research has been conducted within the international CNRS/CONICET laboratory LEMIR.

  5 bar passed through two reservoirs, the first one containing p-CreOH at room temperature, and the second one containing p-AmPhOH heated up to 353-385 K. The mixture was co-expanded into a vacuum chamber through a 300 m diameter pulsed nozzle (Solenoid General Valve, Series 9). Both reactants, p-CreOH and p-AmPhOH, were purchased from Sigma-Aldrich and used without further purification. LIF and REMPI spectra were recorded using a frequency doubled Sirah dye laser (FWHM = 0.08 cm -1 ) operating with Rhodamine 590, Rhodamine 610, Rhodamine 640 and DCM, pumped by the second harmonic (532 nm) of a Nd:YAG laser (Quantel, Brilliant B, pulse duration: 6ns). For the REMPI experiments, the molecular beam was collimated by a skimmer and was crossed perpendicularly by the laser beam in the center of the extraction zone of a home-made Wiley-McLaren time-of-flight (TOF) mass spectrometer (MS) (46 cm flight length).

  information on the excited state lifetime of the p-AmPhOH…p-CreOH complex, time resolved fluorescence (TR-LIF) experiments with nanosecond lasers as well as pump-probe ionization experiments with picosecond lasers were performed pumping at different excitation wavelength and probing at 325 nm for the latter case, which is enough to ionize the complex. The different values obtained by both methods are reported in

  shown in Figure4, the better overlap in the S 1 state induces that the electrostatic/dispersive interaction observed between the  clouds in the ground state becomes a bonding orbital with most of the electronic density between the rings in the S 1 state, suggesting a stronger interaction between the two aromatic molecules in the excited state, leading to an exciplex-like excited state. These results are in agreement with previous results of other authors on related systems in which broad excitation spectrum and red-shifted fluorescence spectrum were associated to the formation of exciplexes.55- 56 57

Figure 1 .

 1 Figure 1. One-color REMPI spectra of p-AmPhOH (red trace), p-CreOH (black trace), (p-CreOH) 2 (blue trace) and p-AmPhOH...p-CreOH (green trace) recorded with nanosecond pulses. The orange trace corresponds to p-AmPhOH...p-CreOH REMPI recorded with picosecond laser. The inset shows an amplification of the (p-CreOH) 2 spectrum, where well defined transitions are observed.

Figure 2 .

 2 Figure 2. Dispersed fluorescence spectrum (DF, black trace) and excitation spectrum (red trace) of (p-AmPhOH...p-CreOH). The blue arrow indicates the excitation wavelength used to record the DF ( 32808.4 cm -1 ).

Figure 3 .Figure 4 .ExcitationFigure 5 .

 345 Figure 3. Optimized structures of p-AmPhOH...p-CreOH in the ground (S 0 ) and excited state (S 1 ), calculated at the MP2 and RI-CC2 level of theory, respectively. A change in the geometry between these states is clearly observed.

  Scheme of the most active vibrational modes in the spectrum.

  black, the experimental REMPI spectrum of the dimer recorded with nanosecond pulses. Right panel:

  Table I, together with the excited state lifetimes of the p-AmPhOH 51 and p-CreOH 52 monomers, reported previously by other authors.

TABLE I .

 I Lifetimes of p-AmPhOH...p-CreOH and p-AmPhOH measured with picoseconds pump-probe experiments and resolved time-laser induced fluorescence (TR-LIF) at different excitation energy. The probe wavelength was 325 nm. The literature lifetime of the lowest energy transition of p-CreOH is showed.

	a Ref. 51 b Ref. 52
	Complex or Molecule p-AmPhOH...p-CreOH p-AmPhOH p-CreOH	Method ps pump-probe ps pump-probe ps pump-probe TR-LIF TR-LIF --	 excitation / nm(cm -1 ) 301.7 (33145.5) 302.3 (33079) 304.7 (32818) 303.2 (32981.5)  318.5 (31395) 282.99(35337)	Lifetime / ns (2.7 ± 0.3) (2.0 ± 0.6) (2.5 ± 0.3) (2.9 ± 0.1) (2.5 ± 0.1) (2.20 ± 0.03) a 4.1 b

TABLE II .

 II Comparison between the difference (in eV) between the ground and excited states, calculated at the MP2/RI pVDZ and DFT/TD-DFT-ωB97X a ZPE was estimated from the MP2/RI Comparison between the optimized structures of p-AmPhOH... difference (in eV) between the ground and excited states, calculated at the MP2/RI ωB97X-D/6-311G++(d,p) levels of theories.AmPhOH...p-CreOH and energy difference (in eV) between the ground and excited states, calculated at the MP2/RI-CC2/cc-DFT/TD-DFT-ωB97X-D

	ZPE was estimated from the MP2/RI-CC2 calculations
		MP2/RI-CC2	DFT/TD
		π-stack	HB	π-stack tack	HB
			Ground State Optimized Geometry Ground State Optimized Geometry
	Relative energy S 0 -S 1 Vertical transition (without ΔZPE) ΔZPE S 0 -S 1 Vertical transition (with ΔZPE)	0.00 4.50 0.19 4.30	0.06 4.60 --	0.02 0.02 4.64 4.64 0.19 0.19 a 4.45 4.45	0.00 4.70 0.19 a 4.51
			Excited State Optimized Geometry Excited State Optimized Geometry
	S 1	    	3.88	4.06 06	4.05
	S 0 -S 1 Adiabatic transition (with ΔZPE)	  	3.69	3.87 3.87 a	3.86 a

TABLE III .

 III Ground state relative energies, vertical and adiabatic S 1  S 0 transition energies (eV) and the corresponding oscillator strengths for the HB and -stacked isomers of the p-AmPhOH…p-Cresol and (p-Cresol) 2 complexes, calculated at the DFT/TD-DFT-ωB97X-D/6-311G++(d,p) and MP2/RI-CC2/cc-pVDZ (values in parenthesis) levels of theories.

	Isomer HB -stacked HB -stacked	S 0 0 (0.07) 0.02 (0.0) 0.03 (0.0) 0.0 (0.02)	S 1 vertical 4.70 (4.60) 4.64 (4.50) 5.01 (4.87) 4.97 (4.79)	S 1 adiabatic + ZPE a p-AmPhOH…p-Cresol Experimental 3.86 (3.69) -3.87 (3.76) ~ 3.76 (p-Cresol) 2 4.44 (4.46) 4.34 3.97 (3.92) -	Osc. Strength 0.006 (0.05) 0.006 (0.02) 0.06 (0.04) 0.0003 (0.002)

a ZPE was estimated (0.19 eV) from the MP2/RI-CC2 calculations.


Clive Blackwell

USING FRAUD TREES TO ANALYZE INTERNET CREDIT CARD FRAUD

Keywords: Credit card fraud, fraud tree, obstacles, card-not-present transactions

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

As more people make purchases online, criminals take advantage of weak authentication checks to commit credit card fraud. The amount of remote fraud, technically called "card-not-present fraud," is estimated to be about £250 million in the United Kingdom -more than all the other types of payment card fraud put together [START_REF] Bond | Chip and skim: Cloning EMV cards with the pre-play attack[END_REF].

Merchants are in a difficult position to reduce their liability in a system set up by credit card issuers that emphasizes legal protection for consumers. The fraud tree model presented in this paper is designed to assist merchants. The model uses the concept of a fraud tree, an extension of an attack tree, to comprehensively model online fraud techniques and suggest defensive obstacles for merchants to counter threats. The model can advise merchants about additional checks that can be per-formed to limit their risk in various transaction scenarios while taking into account the fact that merchants have partial and imperfect knowledge of transactions.

The fraud tree model adapts the anti-goal model provided by the KAOS requirements engineering framework. Following the KAOS requirements, possible fraudulent transactions are determined and appropriate obstacles are proposed. The approach can potentially be applied to other distributed systems where attackers exploit the partial knowledge possessed by system participants, but for which sufficient information can be collected for subsequent attribution.

Related Work

Schneier's attack trees [START_REF] Schneier | Attack trees[END_REF] provide the foundation for implementing several computer security attack assessment tools. One of the scenarios investigated by Schneier involved attacks against a payment system. However, his work focused on protocol weaknesses instead of the wider perspective taken in this paper. Attack trees have also been used to identify forensic goals [START_REF] Aziz | Towards goal-driven digital forensic investigations[END_REF] and to support investigations of document forgery [START_REF] Aziz | A framework for digital forensics and investigations: The goal-driven approach[END_REF][START_REF] Blackwell | Using a goal-driven approach in the investigation of a questioned contract[END_REF].

The original KAOS framework [START_REF] Van Lamsweerde | Requirements Engineering: From System Goals to UML Models to Software Specifications[END_REF] incorporated a goal model to help determine system requirements and obstacles for analyzing hazards to the goals. An anti-goal model was later included in KAOS to model security threats. The initial work also examined threats to online banking, but the scenario was limited to a single threat involving the compromise of account numbers and PINs [START_REF] Van Lamsweerde | Elaborating security requirements by construction of intentional anti-models[END_REF][START_REF] Van Lamsweerde | From system goals to intruder anti-goals: Attack generation and resolution for security requirements engineering[END_REF].

Attack-defense trees [START_REF] Kordy | Attackdefense trees[END_REF] are a recent parallel development to the KAOS framework. These trees extend attack trees by allowing nodes representing defensive measures to appear within a tree. Attack-defense trees are supported by a detailed theoretical model, but they do not have the tool support offered by KAOS.

Edge, al. [START_REF] Edge | The use of attack and protection trees to analyze security for an online banking system[END_REF] have employed a protection tree in an investigation of an online banking system to defeat various fraudulent methods modeled in the corresponding attack tree. The approach is extended in this paper by placing fraud methods and the corresponding protection measures in the same tree to clarify the relationship between fraud methods and fraud protection.

Goal Trees

The specification language of the KAOS framework has four domains: goal, operation, object and responsibility. This paper analyzes credit card fraud in the goal domain. However, the other domains are also relevant to fraud analysis and will be the subject of future research.

A goal is an objective that a system is designed to achieve. An ANDrefinement decomposes or refines a goal into a set of subgoals such that the satisfaction of all the elementary subgoals in the refinement is a sufficient condition for satisfying the composite goal. An OR-refinement relates a goal to an alternative set of subgoals such that that the satisfaction of one of the refined goals is a sufficient condition for satisfying the overall goal. Goal decomposition terminates when atomic goals called requirements are reached that can be directly executed (or "operationalized" in the KAOS terminology) by individual agents.

An obstacle [START_REF] Potts | Using schematic scenarios to understand user needs[END_REF] is a dual notion to a goal; it captures the possible undesirable conditions that frustrate a goal. Obstacles are a fundamental aspect of goal trees that facilitate detailed and practical analyses of how system goals may be breached. Obstacles can also be decomposed into finer and finer obstacles until they can be directly implemented at the level of anti-requirements, just like positive goal requirements. Finally, the resolution stage provides ways to counter the discovered obstacles so that the overall goals are satisfied even if undesirable issues occur.

An attack tree [START_REF] Schneier | Attack trees[END_REF], like a goal tree, is also an AND-OR tree, except that an attack tree examines a system from an adversarial perspective instead of a defensive perspective. Goal trees are more functional and systematic than attack trees because the concept of obstacle is included directly with a tree along with the explicit linkage to the object, operation and responsibility domains.

Obstacle trees are sufficient for modeling and resolving inherent and inadvertent problems, but they are too limited for modeling and resolving malicious interference. The goal-oriented framework for generating and resolving obstacles was extended to address malicious obstacles called anti-goals [START_REF] Van Lamsweerde | From system goals to intruder anti-goals: Attack generation and resolution for security requirements engineering[END_REF], which could be executed by attackers to defeat security objectives.

Credit Card Transactions

A merchant's primary goal is to receive payment for the goods that are supplied. A scenario involving a remote payment is more difficult than when a customer purchases goods in person. This is because a credit card transaction relies on other system participants such as the card issuer, cardholder and courier to act correctly, and the evidence that is relied upon is often weak and open to challenge.

A merchant who accepts credit cards is committed to the rules of the card issuer such as Visa or MasterCard. If the transaction goes wrong, the customer may receive a chargeback, which leads to the reversal of the payment. This situation can result in a loss for the merchant if weak authorization is used (e.g., provision of the card details alone), especially if the merchant cannot prove who initiated the transaction. Internet credit card payments have complex security issues because the customer and merchant never meet and they rely on evidence communicated through potentially insecure channels using weak authentication measures that may be exploited by fraudsters. A remote credit card transaction over the Internet (using email or a website), or by phone, fax or regular mail is known as a "card-not-present" (CNP) transaction [START_REF] The | Cards Association, Card-not-present transactions[END_REF].

The EMV specification [START_REF][END_REF][START_REF] Radu | Implementing Electronic Card Payment Systems[END_REF] formally describes the process. The main parties to a payment card transaction are the merchant, the merchant's bank, the customer and the card issuer. There may be other participants, including a payment processor who performs transactions on behalf of the card issuer or merchant, and a courier who delivers the goods.

Figure 1 shows the EMV specification of a CNP transaction as a protocol exchange between the four main participants. The protocol involves several related flows of goods, information and money from one participant to another in a temporal order, which is modeled later in this paper using goal trees.

A crucial issue is that the merchant may act on incomplete or incorrect information, because he/she may not be notified of fraud-related events if they occur (e.g., credit card theft or forgery). However, the merchant may be able to avoid liability for fraudulent transactions even with inadequate knowledge by passing the responsibility for fraud detection to another participant such as the cardholder or card issuer. In addition, the merchant can endeavor to collect sufficient auditing information to avoid liability when the merchant is responsible in the credit card system.

Fraud Analysis

Analysis of around 150 cases of fraud targeting banking systems has revealed that defective procedural controls and implementation flaws were exploited in nearly all the cases; only two cases involved the exploitation of weaknesses in cryptographic protocols, which received the most attention during system design [START_REF] Anderson | Why cryptosystems fail[END_REF]. A pragmatic and detailed fraud model can help merchants avoid or mitigate threats by imposing adequate obstacles.

The construction of a fraud tree involves building a KAOS goal tree from the attacker's perspective as in the case of an attack tree. It is useful to incorporate the attacker's perspective because the attacker's goals, motivation and activities could be missed when the focus is only on system goals.

In KAOS, the main obstacle corresponds to the logical negation of the goal that it is intended to defeat. An attacker goal that cannot be satisfactorily overcome indicates a failure of requirements engineering and the need to restructure the goal model. However, the credit card system is already in operation, so the obstacles under the attack goal may only be partially effective. In addition, some obstacles, such as the determination of card theft by the merchant, may be impossible to implement directly. We call these abstract obstacles, and they are forwarded to the later stages of a transaction for resolution.

Obstacles may be imperfect and incomplete, and can be overcome by further adversarial counter-goals unless additional obstacles are proposed. This is still useful because the merchant can take on transactions that might otherwise be rejected (an imperfect obstacle may be effective in the particular transaction context). In another context where the customer's identity cannot be established adequately, the definitive obstacle is to abandon the transaction after all the attempted checks fail.

Transaction Modeling

Building a fraud tree analyzes the threats to CNP from the fraudster's perspective. This is easier than decomposing the merchant goals and ensures that all plausible threats are recognized and addressed. It also provides an effective counterbalance against the idealized threat models that are produced when the focus is on the merchant's goals.

The model progressively decomposes the fraudster's goals into actionable steps as in the case of an attack tree. However, a fraud tree also contains defensive goals in the form of obstacles that can potentially defeat the adversarial goals. Because the defensive obstacles possibly offer imperfect and incomplete remedies, the process iterates through the fraudster's additional counter-goals and defensive obstacles for the counter-goals.

In requirements engineering, system threats are typically analyzed from all the stakeholders' points of view in order to formulate a collective system goal model. However, the participants in a transaction have their own goals, do not have complete visibility or control of the entire transaction system and may potentially be in an adversarial situation because a legitimate participant has to bear the cost of fraud.

At this stage, the fraud tree represents both perspectives -the merchant's and fraudster's -and must be transformed into a merchant-only view before use. Transforming the fraud tree converts abstract obstacles against adversarial activities that are invisible to the merchant to realizable obstacles that obstruct fraud in a different way. For example, although the merchant cannot detect the initial card compromise, the authenticity of the transaction can be confirmed when the goods are delivered by changing the payment to a local card-present transaction or by verifying the identity of the customer.

The transformation process begins with the initial fraud tree and imposes obstacles under each adversarial goal. The obstacle is purely abstract if it cannot be implemented, partial if it can be realized successfully under certain conditions, or total if it provides effective mitigation. In Figure 2, a total obstacle is represented using a rounded white square underneath the obstacle indicating success. Forwarded abstract obstacles (gray) and partial obstacles (lighter gray) extend into later steps in the transaction together with an annotation that indicates the circumstances causing the unresolved issue. All transaction flows should ideally end with resolved obstacles (white), but some light gray obstacles remain, indicating that, although fraud is significantly reduced, it is still possible. Forwarded obstacles may be implemented directly to avoid fraud or they may be transformed to equivalent or weaker obstacles in order to avoid liability if fraud does occur. Realizable forwarded obstacles include avoiding fraud by aborting a suspicious transaction (Figure 2), reducing the probability of fraud by making additional identity checks during the delivery stage, avoiding liability by using the 3D-Secure payment mechanism (Figure 3) and collecting additional evidence to transfer accountability to the responsible party during the purchase and delivery stages.

The analysis is limited to the unauthorized use of a credit card to purchase tangible goods on the Internet as shown in the fraud tree in Figure 2. CNP fraud is the most common type of fraud. It is also the most challenging because the merchant does not see the card but, instead, uses a password for authentication. Card security codes along with PIN numbers can also be considered to be weak passwords, along with passwords used with 3D-Secure and for accessing merchant sites.

The obstacles for the first stage are negations of the fraudulent goals, which cannot be directly implemented by the merchant; thus, they are abstract obstacles that are forwarded to the second stage. A forwarded abstract or partial obstacle has an arrow between the parent and child that is annotated with the conditions for successful resolution. Because the obstacle for the first stage is abstract, there is no annotation as no limitations are imposed on the transaction.

Fraud Tree

The resulting fraud tree shown in Figure 2 has three branches from the root AND-node that represent the three essential stages of fraud: (i) acquiring the card or card details; (ii) using them to purchase goods; and (iii) accepting delivery of the goods. Figure 2 shows the first two stages and Figure 3 presents the final delivery stage with the only unobstructed fraud path from the first two stages. The child nodes representing the three stages are subdivided into branches, recursively, until the decomposition terminates at unexpanded attack steps in the leaves that can be directly executed or that are deemed outside the scope of analysis.

The two possibilities for the first branch are to obtain the card or just the card details, which are equivalent in online transactions because the card is never seen and is not directly used for authorization, except for the relatively rare case when a calculator-like device is used to compute a one-time password for each transaction. However, having the card or just the card details can be distinguished by later checks, so they can be forwarded as different obstacles to the delivery stage. It is far easier for a fraudster to discover card details than to acquire a card because the card details are provided to a merchant or proxy (e.g., payment processor) in every transaction.

Card details can be compromised in multiple ways, but this analysis limits it to someone close to the cardholder or an unknown third party. Finally, the transaction could be carried out and subsequently denied by the cardholder, which is impossible to demonstrate under the current transaction system, and is a reason why additional forensic evidence should be collected to establish the identity of the customer.

The second branch is to select and pay for the goods, where the different payment methods are the different anti-goals that can be satisfied by the adversary. The obstacle for "Acquire credentials" is also the child of the "Pay for goods" node in the second branch.

3D-Secure is a good payment method when the cardholder is deemed responsible or negligent for fraud (e.g., for revealing the card details and password). The card issuer typically provides the purchaser with a popup window in which a password is entered [START_REF] Murdoch | Verified by Visa and MasterCard Se-cureCode: Or, how not to design authentication[END_REF]. The obstacle for avoiding fraud forwarded from the first stage is transformed from discovering the identity of the customer to the alternative acceptable obstacle of avoiding liability (shown by the white annotation indicating success and the ≈ symbol for transformation to an equivalent obstacle).

Another possibility is to use a calculator-like device to compute a one-time password that restricts fraud to the less common case of having access to the card. This could have been shown as a total obstacle for the compromise of card details (stops the fraud) and partial obstacle for card theft (fraud is still possible) if both classes had been forwarded separately. However, by forwarding the two fraud methods as a single class, the measure is only a partial obstacle for the entire class (shown as light gray in Figure 2). The method also avoids merchant liability because the card issuer assumes the responsibility, indicated by the satisfied obstacle under the calculator payment node (colored white).

For the situation where only the card details are supplied, a complete obstacle is to reject any weakly authorized transaction using only the card details and card security code. However, merchants often allow weak authentication to take on more business, because their goal is to increase profits instead of avoiding fraud entirely.

An additional way to resolve the obstacle is to engage a payment processor who decides on the legitimacy of transactions; this transfers merchant liability for a fee. The transformation of the forwarded obstacle "Prove misuse of card or details" to "Use payment processor" for a fixed cost is usually a good option because it also avoids administrative effort and further security issues outside the scope of the scenario (e.g., disclosure of sensitive cardholder details). Thus, the obstacle at the root of the payment branch is resolved if the merchant chooses to use a payment processor.

The outcome of the first two transaction stages leads to one unsatisfied obstacle that is forwarded to the delivery stage. Figure 3 presents the fraud tree for the delivery stage. When the merchant insists on delivery to the cardholder's address, the analysis can extend to establishing additional checks that the merchant can perform when the goods are delivered elsewhere.

Fraud in the case of home delivery is only possible when the customer is the cardholder or is in close proximity to the cardholder and can take delivery of the goods. After the partial obstacle provided by the address check, the significant issue of remote fraud is avoided and the customer's identity is narrowed down to the cardholder or someone close.

It is necessary to collect further evidence to show that the cardholder is responsible because it is not adequate to claim that, since all the other possibilities are ruled out, the cardholder or someone close to the cardholder must have executed the transaction. For example, fraud is not ruled out on the part of the merchant, the courier and their employees.

Most fraud checks are ineffective against insiders, such as cardholders who act legitimately until they claim that they did not carry out certain transactions. Alternatively, it is entirely possible for a friend, colleague or family member to carry out fraud successfully without detection, so it is imperative that the merchant can establish attribution by collecting additional evidence outside the transaction system.

We summarize the situation if the third stage is reached without establishing the identity of the customer or avoiding liability. The first point is that it is not known if the transaction is legitimate or fraudulent; therefore, it is important not to execute clumsy and ill-directed checks when the vast majority of transactions are legitimate. A reasonable assumption is that the cardholder or someone close to the cardholder executed the transaction if the goods were delivered to the cardholder's address.

The merchant needs to augment the system when weak payment authentication is used by conducting additional verification checks to limit fraud or collect additional evidence to avoid liability. Note that, when a transaction is fraudulent, it is not known if the card or card details were misused. It is sensible to assume the worst that the card was stolen, but the two cases can be distinguished and different checks can be conducted to avoid them.

If the transaction circumstances suggest that a person close to the cardholder might have misused the card details, then it is reasonable to insist on a local card transaction. However, if the cardholder is im-plicated, then it would be more reasonable to ask for stronger identity checks and to use both types of checks if the identity of the recipient is unclear. The different types of control systematically provide obstacles to each type of fraud proactively, before the fraud method is known and even before it is known that the fraud has occurred. The controls have to be lightweight enough not to discourage the vast majority of legitimate purchasers. Therefore, onerous verification checks should only be applied to high value or suspicious transactions.

The major issues with physical delivery are practical concerns such as the need to provide fallback checks if the safest methods are unavailable. These practical issues are often inadequately analyzed using attack trees and other approaches. A crucial issue, modeled by an additional adversarial goal that defeats the obstacle of requiring strong authentication, is that the customer may not be at home and a neighbor or someone else at the address accepts the goods.

The possibility of fraud cannot be eliminated easily, but liability can be avoided by specifying a contract with the courier that transfers the fraud detection responsibility to the courier. This passes the risk assessment decision to the courier who decides whether to deliver the goods to a third party or to return when the customer is at home. This transformed obstacle of avoiding liability is a sufficient obstacle for the merchant, who also avoids all the logistical and security issues regarding delivery while passing the risk assessment decision to the courier, to whom it most sensibly belongs.

Conclusions

The use of fraud trees to analyze Internet credit card fraud can systematically provide an obstacle to each type of fraud proactively before the fraud method is known. By including obstacle formation and transformation, fraud trees are more refined than attack trees and adopt a different perspective compared with goal trees. An interesting aspect is that a priori knowledge of the branches of the fraud tree occupied by a transaction is required because the tree includes countermeasures to deal with each type of fraud. Fraud trees have applications to other types of investigation where wrongdoing is discovered after the fact, as in the case of the insider threat. Many insider threat incidents cannot be stopped, but it is possible to collect sufficient evidence to hold the perpetrators responsible.

Other benefits of the fraud tree framework include completeness (all known fraud techniques can be analyzed), scope (while the focus is on the logical transaction, incorporating physical and social checks helps reduce fraud and liability), participant perspective (participants do not share the same goals and can be in an adversarial position when there is a successful fraud, so it is useful to consider what each participant knows and can control), adversarial perspective, and narrative structure (the security measures used by the merchant are incorporated in the fraud tree and help explain the fraud).

Our future research will attempt to develop a firm theoretical foundation using temporal logic and model checking. Also, the use of binary yes/no measures is less than satisfactory; incorporating probabilistic measures of fraud and the costs of countermeasures will enhance risk assessment. Another related topic is to combine probabilities and other numerical measures as in the case of KAOS goal trees [START_REF] Cailliau | Assessing requirements-related risks through probabilistic goals and obstacles[END_REF]. Other research topics involve the examination of partially satisfied obstacles that incorporate weaknesses that could be targeted by fraudsters, and the estimation of the intangible costs of performing checks.

Figure 1 .

 1 Figure 1. Card-not-present transaction.

Figure 2 .

 2 Figure 2. Fraud tree for the first two fraud stages.

Figure 3 .

 3 Figure 3. Delivery stage fraud tree.


Aleksandar Hudic

Katharina Krombholz

Thomas Otterbein

Christian Platzer

Edgar Weippl

Automated Analysis of Underground Marketplaces

Keywords: Underground marketplaces, automated analysis, machine learning

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Cyber criminals routinely use online underground marketplaces to communicate and trade stolen or illegal goods and services. Typically, publicly-accessible chatrooms and web forums are used as marketplaces by criminals who openly hawk their goods and initiate contractual agreements. Recent research has shown that underground marketplaces are a significant security risk because they provide venues for buying and selling stolen credentials, credit card numbers and other sensitive data [START_REF] Holz | Learning more about the underground economy: A case-study of keyloggers and dropzones[END_REF]. Detecting these marketplaces and investigating the criminal activities being conducted are tedious and time-consuming tasks. Automating this process could significantly enhance the ability of forensic analysts to investigate criminal activities conducted in underground marketplaces. Unfortunately, the large number of online marketplaces and their ad hoc nature and volatility prevent naive detection approaches such as web crawling systems from being effective. Furthermore, criminals often "hijack" benign websites (e.g., websites containing classified ads and abandoned forums) instead of using dedicated underground websites.

This paper demonstrates how machine learning can be used to automatically detect underground marketplaces. An experimental evaluation is presented based on eleven months of real-world Internet Relay Chat (IRC) and web forum communications. The results show that the classification system can successfully locate and monitor communication channels used by cyber criminals, significantly reducing the manual effort and the costs involved in investigating online underground marketplaces.

Background

While any type of communication channel could be used as an underground marketplace, the two most common types of channels are IRC chatrooms and web forums. IRC chatrooms and web forums are very popular communication channels and have multitudes of legitimate users.

A large number of publicly-accessible IRC networks are accessible over the Internet (e.g., QuakeNet, IRCnet, Undernet, EFnet, Rizon, Ustream and IRC-Hispano). In most cases, they do not have user authentication mechanisms, which unfortunately means that there is no straightforward means of attribution. Cyber criminals exploit IRC networks to advertise their goods and services. While some IRC networks appear to be specifically designated for criminal activities, benign networks are abused as well. The organizers simply create channels with names that are known to insiders. For example, channel names with the prefix #cc (short for credit card) are often used by criminals involved in credit card fraud.

Cyber criminals also operate underground marketplaces on websites that contain forums and message boards. The forums organize individual messages (i.e., posts) in the form of "threads" (i.e., lists of messages belonging to the same topic). Unlike IRC networks, the contents of these forums are persistent and users can communicate in a more organized manner, e.g., by replying to specific posts or to groups of users. Forums generally have stricter admission procedures than IRC networks (e.g., users have to sign-up to receive login credentials). Also, they offer "convenience" services to their members such as escrow and private messaging.

Related Work

Research related to underground marketplaces has focused on the evaluation of message content [START_REF] Radianti | Using a mixed data collection strategy to uncover vulnerability black markets[END_REF] and the acquisition of reliable data from underground marketplaces [START_REF] Holz | Learning more about the underground economy: A case-study of keyloggers and dropzones[END_REF][START_REF] Zhuge | Studying malicious websites and the underground economy on the Chinese web[END_REF].

Franklin, et al. [START_REF] Franklin | An inquiry into the nature and causes of the wealth of Internet miscreants[END_REF] conducted a systematic study of IRC channels exploited as underground marketplaces. They evaluated the content using machine learning techniques and demonstrated that underground marketplaces have considerable security implications; they also presented approaches for disrupting underground marketplaces. A Symantec report [START_REF] Symantec | Symantec Report on the Underground Economy[END_REF] on the underground economy provides useful analysis based on a significant amount of data collected from IRC networks and web forums over a period of one year; however, detailed information is not provided about the methodologies used to collect and analyze the data. Thomas and Martin [START_REF] Thomas | The underground economy: Priceless[END_REF] have studied the structure and players of the underground economy by examining IRC-based marketplaces. They describe the infrastructure established by criminals along with their activities, alliances and advertising methods.

Zhuge, et al. [START_REF] Zhuge | Studying malicious websites and the underground economy on the Chinese web[END_REF] have presented an overview of the underground market and malicious activities on Chinese websites based on a black market bulletin board and an online business platform. Holz, et al. [START_REF] Holz | Learning more about the underground economy: A case-study of keyloggers and dropzones[END_REF] have studied "dropzones" that trade stolen digital credentials; they also evaluated a method that enables the automated analysis of impersonation attacks.

In contrast, Herley and Florencio [START_REF] Herley | Nobody sells gold for the price of silver: Dishonesty, uncertainty and the underground economy[END_REF] argue that marketplaces such as IRC channels and web forums do not have a significant impact. Instead, they describe them as standard markets for lemons where the goods are hard to monetize and the only people who derive benefits from the markets are the rippers.

Fallmann, et al. [START_REF] Fallmann | Covertly probing underground economy marketplaces[END_REF] have presented a novel system for automatically monitoring IRC channels and web forums. Furthermore, they extracted information and performed an experimental evaluation of the monitored environments.

Locating Underground Marketplaces

Finding underground marketplaces is a manual task that is complex and time-consuming. We present a novel classification system for automatically discovering and monitoring underground marketplaces, even when they are hidden in benign information channels. In the classification process, a "document" is assumed to be an IRC chatroom or a web forum (thread), and "terms" are the words in IRC messages or web forum posts. The terms are mapped from each document to a numeric vector via the bag of words (BoW) model [START_REF] Harris | Distributional structure[END_REF]. This model is agnostic to the exact ordering of terms within a document and interprets the terms as a set for each document. The resulting vector space model allows different weightings of the frequencies of individual terms.

Text Preprocessing

The raw training data contained noise and content that was not relevant to classification. The first step involved the extraction of the plaintext content. During this step, HTML elements and specific character encodings were eliminated.

Vector Space Transformation

The second step involved the generation of the vector space using tokenization [START_REF] Mcnamee | Character n-gram tokenization for European language text retrieval[END_REF]. Tokenization separates chunks of text with specific semantic values. A word-based model was employed because it has been shown to have the best performance [START_REF] Baker | Distributional clustering of words for text classification[END_REF][START_REF] Sebastiani | Machine learning in automated text categorization[END_REF]. The next step in vector space transformation was to tag semanticallymeaningful units that carry domain-relevant information. Various labels were attached to uniform resource identifiers (URIs), domain names, IP addresses, e-mail addresses, and numbers and dates to help identify the content. The tagging process helps reduce the feature space, e.g., by substituting frequently-changing values such as dates with a single date label.

The terms in the vector space model were weighted using tf -idf (term frequency -inverse document frequency) [START_REF] Salton | Term-weighting approaches in automatic text retrieval[END_REF]. The term frequency tf t,d is the frequency of term t in document d and the inverse document frequency idf t indicates the importance of term t to the document corpus. The tf -idf weighting scheme reduces the impact of common words (i.e., words that appear with high frequencies in the document). Since the documents had different lengths, the vectors were normalized using cosine normalization [START_REF] Singhal | Pivoted document length normalization[END_REF].

Document Selection

The third step involved the selection of appropriate documents according to their relevance. The document selection was based on hierarchical agglomerative clustering (HAC), a commonly-used deterministic bottom-up clustering algorithm that does not require a pre-specified number of clusters as input. HAC merges documents with the highest similarity into a cluster. The similarity of a merged cluster is called the combination similarity. Our HAC prototype implementation supports single-link and complete-link clustering. Single-link clustering defines the combination similarity in terms of the most similar members; the merge criterion is, therefore, local in nature. Complete-link clustering, on the other hand, defines the similarity of two merged clusters in terms of the similarity of the most dissimilar members and merges clusters using a non-local criterion. The algorithm merges documents into clusters until a predefined cutoff similarity value is reached.

The document selection process currently supports two methods for choosing a representative for each cluster. The first selects the document that represents the centroid based on the Euclidean distance, while the second is based on a definable score function.

Similarity. The cosine similarity measure is commonly used to compute the similarity between two documents in vector space:

sim(d 1 , d 2 ) = cos θ = ⃗ V (d 1 ) * ⃗ V (d 2 ) | ⃗ V (d 1 )|| ⃗ V (d 2 )| .
Cosine similarity measures the similarity of the relative distribution of the terms by finding the cosine of the angle between the two document vectors ⃗ V (d 1 ) and ⃗ V (d 2 ). The cosine of the angle θ between the two document vectors ranges from zero to one, where zero indicates that the documents are independent and one means that the two document vectors are identical.

Distance. The Euclidean distance is another measure for comparing two vectors. This distance is more appropriate when the lengths of the documents are considered. For example, the Euclidean distance measure can be used to compute the nearest neighbors or, in our case, to determine the centroid of the cluster during the document selection process.

Feature Selection

Feature selection involves the selection of a subset of terms from the training set that is used for the vector space model. This process decreases the cardinality of the vector space and reduces the computation time.

In our case, features that occurred less than three times in the training set of the document corpus were removed (as proposed by Joachims [START_REF] Joachims | Text categorization with support vector machines: Learning with many relevant features[END_REF]). Each term t was also ranked according to its information gain (IG) with regard to class c using the equation:

IG(c, t) = H(c) -H(c|t)
where H is the entropy. Selecting terms based on their information gain produces more accurate results. In this case, IG-based feature selection retained the top 10,000 terms from the IRC data collection.

Classification

The SVM-Light classifier [START_REF] Joachims | Text categorization with support vector machines: Learning with many relevant features[END_REF] from the Weka toolkit [START_REF] Witten | Data Mining: Practical Machine Learning Tools and Techniques[END_REF] was used as the classifier. SVM-Light with a linear kernel function was chosen as the classifier because it performed better than Naive Bayes (NB), IBk (a k-nearest neighbor classifier), SMO (which implements the sequential minimal optimization algorithm) and the J48 algorithm (which is based on a pruned C4.5 decision tree).

Figure 2 presents an overview of the classification process. The initial stage involved the preprocessing of text as in the training phase. Following this, the data was transformed to a vector space model. Finally, the corresponding features were weighted according to the feature space

Performance Evaluation

The IRC data corpus was collected over a period of eleven months using an observation framework [START_REF] Fallmann | Covertly probing underground economy marketplaces[END_REF]; the corpus contains 51.3 million IRC messages transmitted over 2,693 channels on 246 networks. The web forum data corpus was collected by crawling through more than 203,000 threads in ten forums. This section evaluates the performance of the classification system and the effectiveness of various vector space models and document selection methods.

IRC Channels

To evaluate the performance of the classification system on IRC channels, we manually labeled all 2,693 IRC channels based on their relationship to the underground economy and performed k-fold cross-validation. Figure 3 shows the cross-validation results for the various vector space models.

Figure 3(a) shows that the SVM classifier maintains a consistently high precision, which means that the predicted results do not contain many false positives. The drop in the recall rate in Figure 3(b) is mostly due to channels in which the underground-economy-related content accounts for a fraction of the exchanged messages and are mistakenly classified as false negatives. In general, removing terms with tf < 3 combined with the English stop word list and the Porter stemmer produced an average precision of 99.43% and increased the recall from the initial 85.76% to an average of 88.09%. The feature selection based on the top 10,000 terms ranked by the IG reduced the vector space to 4% of the noise-filtered space and yielded the best score with an average precision of 98.59% and recall of 89.32%. This results in an average F 1 -measure of 93.14% and an average accuracy of 97.84%. Thus, the classification system performs very well despite the noisy content of IRC channels. Additionally, we evaluated the performance of document selection for different similarity values. To this end, the IRC channels were merged into clusters determined by the combination similarity cutoff value. The document selection evaluation also analyzed the selection methods for the cluster representative and compared the centroid-based method against the score function approach, which is defined as the ratio of unique textual content to the number of messages in the channel.

A k-fold cross-validation was also performed based on the training sets generated by document selection. Figure 4 shows the average performance results. While single-link clustering reduces the number of clusters for the given values more rapidly, it produces a significant accuracy loss. In contrast, complete-link clustering can reduce the number of needed training samples to less than 40% with minimal loss of recall. As shown in Figure 4(d), the selection methods for the cluster representative, which would be added to the training set, performed equally well for the upper interval of the combination similarity. Ultimately, the deviation between the two methods is only visible for very low combination similarity, where the score function based on the content information performed slightly better.

Web Forums

To evaluate the performance of the classification system on web forums, we manually labeled 300 randomly selected threads from the web forum www.clicks.ws depending on whether or not the posts were re- lated to the underground economy. In addition, we extended the training set by another 100 randomly-selected threads from each of the other nine web forums. Table 1 shows the average performance of the classification system for the k-fold cross-validation of the web forum test set.

The classification system was very effective for the web forum threads, but unfortunately not quite as effective as for the IRC channels. The IRC channel contents involved more structured discussions and the threads were less noisy, which made it easier to extract information. The loss of accuracy is mostly caused by the dissimilarity of the selected samples, especially due to the German web forum www.carders.cc. As highlighted in Table 1, the approach with tf < 3 and English stop word filtering combined with the Porter stemmer performed best with an average F 1 -measure of 90.32%. The IG-based feature selection did not show its advantages, but it is clearly not necessary in this case because of the dimensionality of the vector space. In conclusion, the vector space models show similar behavior as in the case of the IRC channel evaluation, demonstrating that the system is effective at detecting web forums used by cyber criminals.

Conclusions

A machine-learning-based classification system can be very effective at detecting underground marketplaces that use venues such as IRC chatrooms and web forums. Indeed, automatically identifying and monitoring these marketplaces can greatly enhance investigations of online criminal activities. The classification system described in this paper detected underground marketplaces in a collection of 51.3 million IRC messages with an average accuracy of 97%. Furthermore, the system classified a subset of threads from ten web forums, ranging from underground economy discussion forums to hijacked benign web forums, with an average accuracy of 94%.

Figure 1 Figure 1 .

 11 Figure 1. Training process.

Figure 2 .

 2 Figure 2. Classification process.

  Bag of Words (BoW) BoW tf >=3 BoW tf >=3/Stemmer BoW IG top 30000 BoW IG top 10000 BoW IG top 50000 (c) Feature space size. Bag of Words (BoW) BoW tf >=3 BoW tf >=3/Stemmer BoW IG top 30000 BoW IG top 10000 BoW IG top 50000 (d) Classification F 1 -measure.

Figure 3 .

 3 Figure 3. Underground marketplace detection in IRC channels.

  Classification F 1 -measure.

Figure 4 .

 4 Figure 4. Classification performance of document selection IRC channels.

Table 1 .

 1 Average results of classification performance on web forums.

		Size	Precision Recall Accuracy F1-Measure
	BoW BoW, tf < 3 BoW, tf < 3, Stemmed ⌊11,720⌋ 97.22% 84.58% ⌊34,890⌋ 96.79% 83.55% ⌊14,391⌋ 96.95% 83.75% BoW, IG Top 5,000 5,000 95.87% 83.04%	94.02% 94.20% 94.38% 94.01%	89.40% 89.72% 90.32% 88.90%
	BoW, IG Top 3,000	3,000	94.66% 81.60%	93.38%	87.37%
	BoW, IG Top 1,000	1,000	94.81% 82.31%	93.47%	87.93%

Acknowledgement

This research was funded by the Austrian Research Promotion Agency (FFG) under COMET K1.