Extending taxonomies for P2P crypto forum classification in the dark web
An iterative methodological approach
Bibliographic Data
| ID | 22436136 |
|---|---|
| Authors | Jose-Amelio Medina-Merodio (0000-0003-3359-4952, Universidad de Alcalá, corresponding author), Mikel Ferrer-Oliva (0009-0001-0610-8210, Universidad de Alcalá), Alejandro Ruiz-Zambrano (0009-0002-2560-5885, Universidad de Alcalá), Adrián Domínguez‐Díaz (0000-0001-7632-8609, Universidad de Alcalá), José Fernández-López (0009-0002-5826-5266), Adrián Domínguez-Díaz (Universidad de Alcalá) |
| Year | 2026 |
| Volume | 57 |
| Pages | 302131 |
| Publication date | 2026-06-01 |
| Open Access | Yes |
| Type | ARTICLE |
| Venue | Forensic Science International: Digital Investigation (JOURNAL) |
| Journal identifiers | ISSN: 2666-2817 • E-ISSN: 2666-2817 |
| Publisher | Elsevier BV (PUBLISHER) |
| DOI | 10.1016/j.fsidi.2026.302131 |
| OpenAlex | W7161278607 |
| Language | EN |
| References cited | 15 |
This study presents an iterative methodological approach for the extension and evaluation of taxonomies applied to peer-to-peer (P2P) cryptocurrency forums in the dark web, a domain characterised by high semantic homogeneity and low thematic diversity. Drawing on a corpus of 23,642 posts, a rule-based deterministic pipeline was implemented to design an initial taxonomy focused on transactional intention, traded assets and payment mechanisms. Subsequently, non-classifiable cases were examined statistically using n-grams to detect empirical evidence of emerging subclasses, which led to the incorporation of new categories (primarily exchange-platform and forum ) derived from the behaviour of the corpus itself. This extension eliminated ambiguous categories (other/unclear) and substantially improved classification coverage, showing that taxonomies in P2P domains should be understood as evolutionary artefacts rather than fixed structures. Under this definition, the present taxonomy evolves through a documented cycle of deterministic classification, ambiguity diagnosis, candidate extraction from residual cases, and constrained human-in-the-loop consolidation. Finally, co-occurrence analysis and lexical clustering revealed four differentiated functional communities, confirming that these forums do not operate as broad discursive spaces but as transactional infrastructures oriented towards operational execution. The results provide a traceable framework for explainable semantic classification in crypto environments, with direct implications for cyber intelligence and digital forensic analysis.
Cybercrime and Law Enforcement Studies · Internet Traffic Analysis and Secure E-voting · Spam and Phishing Detection
| Highly cited | No |
|---|