Illegal marketplaces are moving far beyond the familiar image of a hidden website reachable only through specialized software. According to a new study published in the Journal of Big Data, illicit sales activity now stretches across a shifting ecosystem that includes the deep and dark web, Telegram, Reddit, and Pastebin. These spaces can be used to advertise drugs, weapons, and stolen credentials, often behind layers of anonymity and coded language. The researchers have developed an artificial intelligence framework designed to identify and categorize this content, even when only a small fraction of available material has been manually labeled. Their system combines language-model technology with traditional machine-learning methods and structural clues embedded in online posts. In testing, the framework achieved a macro-averaged accuracy of 96.489 percent and an F1 score of 93.467 percent, suggesting that a hybrid approach may offer a powerful new tool for monitoring illicit digital markets.
The scale and complexity of the challenge are central to the research. Online criminal communities constantly alter vocabulary, spelling, formatting, and communication habits to evade detection. A drug listing may avoid explicit terms through deliberate misspellings, emojis, slang, or references understood only by a specific community. A post advertising stolen credentials may appear as an apparently ordinary technical discussion, while a weapons advertisement may be distributed through a mixture of text, metadata, and coded images. These variations make keyword-based detection unreliable. Conventional supervised-learning systems also face a major obstacle: they require large collections of accurately labeled examples, yet gathering and classifying illicit material is costly, time-consuming, and legally sensitive. The new framework attempts to overcome this data shortage by learning from both labeled and unlabeled documents.
The researchers assembled a multi-source corpus containing 21,575 samples. Only 1,575 were labeled by humans, while the remaining 20,000 were unlabeled. The collection represented content gathered from the deep and dark web as well as Telegram, Reddit, and Pastebin, allowing the system to encounter the very different styles and structures used by each platform. A discussion thread on Reddit, for example, may contain conversational language and nested replies, whereas a Telegram message can be short, promotional, and filled with symbols. Pastebin entries may resemble technical notes or data dumps, and dark-web marketplace pages often include product descriptions, prices, delivery claims, vendor reputations, and transaction instructions. By combining these sources, the study aimed to test whether an automated detector could learn patterns that remain useful when illicit content changes location or presentation.
At the heart of the system is ModernBERT, a newer transformer-based language model adapted to the domain of illicit online commerce. Transformers process language by examining relationships between words and phrases across a document rather than reading only through fixed local patterns. This allows the model to recognize that the meaning of a term can depend on its surrounding context. ModernBERT is particularly useful for this task because it can handle longer sequences than many earlier language models, making it better suited to marketplace listings, forum discussions, and pages containing extensive product or transaction details. The researchers fine-tuned the model on domain-specific material so that it could learn specialized jargon, obfuscated expressions, and long-context linguistic signals. Instead of treating a disguised phrase as random noise, the model can potentially connect it to recurring patterns associated with illicit sales.
Language, however, is only one part of the evidence. The framework also incorporates manually engineered structural features, which are measurable properties of a document or post. These include layout characteristics, recurring patterns, and metadata. A marketplace listing may contain a distinctive arrangement of headings, price fields, contact instructions, seller information, or transaction terms. A social-platform post may reveal signals through its use of links, hashtags, account details, posting frequency, or formatting conventions. Pattern-specific features can capture repeated expressions, unusual character substitutions, and other forms of obfuscation. By joining these signals with ModernBERT embeddings, the researchers created a richer representation of each document. In technical terms, the model does not rely solely on semantic vectors generated by a neural network; it combines dense language representations with explicit, human-designed indicators of online market behavior.
The classification process unfolds in two stages. First, the system determines whether a document is related to sales activity at all. It uses three different classifiers—XGBoost, Random Forest, and support vector machine models—within a semi-supervised self-training framework. XGBoost builds a sequence of decision trees that progressively correct earlier errors. Random Forest combines many independently trained trees to reduce instability, while a support vector machine searches for a boundary that separates classes in a high-dimensional feature space. Each model views the evidence differently, and their combination is intended to make the overall detector less dependent on the weaknesses of any single algorithm. The system begins with labeled examples, predicts labels for selected unlabeled samples, and then uses the most reliable predictions to expand its effective training set.
The researchers introduce an entropy-based weighted voting strategy to decide how much influence each classifier should have. In machine learning, prediction entropy measures uncertainty. When a model assigns nearly all probability to one class, its entropy is low and its decision is relatively confident. When probabilities are distributed more evenly, entropy is high and the model is less certain. The proposed mechanism dynamically adjusts classifier contributions according to this uncertainty. A confident prediction can receive greater weight, while an ambiguous output has less power to determine the final result. This is important in self-training because incorrect pseudo-labels can otherwise spread through the data and reinforce the system’s own mistakes. By filtering or weighting unlabeled examples according to confidence, the framework seeks to use large quantities of unannotated material without treating every automated prediction as equally trustworthy.
Once the first stage identifies sales-related documents, a second stage categorizes them into three major groups: drug sales, weapon sales, and stolen credential sales. Here, the researchers use three specialized semi-supervised XGBoost classifiers. The hierarchical design reflects the practical differences between detection and classification. A general detector first separates likely sales content from ordinary conversation, news, technical discussion, or unrelated material. Specialized classifiers can then focus on the distinctive signals associated with each category. Drug listings may include dosage, purity, delivery, or packaging terminology. Weapon-related material can contain model names, ammunition references, or shipping language. Credential advertisements may mention account types, login data, access levels, or verification details. Separating these tasks reduces the burden on a single model and allows the second stage to learn more targeted decision boundaries.
The reported results indicate that the combined architecture outperformed a series of baseline language models, including BERT, Longformer, ALBERT, BigBird, DarkBERT, and ModernBERT used without the full ensemble framework. The proposed method delivered accuracy improvements ranging from 3.1 to 6.7 percentage points, F1 gains of 6.4 to 15.6 points, and increases of 4.1 to 10.0 points in the reported TMCC measure. F1 is especially relevant for illicit-market detection because it balances precision and recall: a system must identify genuine threats without overwhelming investigators with false alarms, while also avoiding large numbers of missed listings. TMCC, as reported by the authors, provides an additional measure of classification quality across the categories. The framework was also evaluated on the DUTA and CoDA datasets, where the researchers say it maintained strong performance, supporting its claimed robustness across different data conditions.
The findings arrive as law-enforcement agencies, cybersecurity teams, financial institutions, and online platforms face a growing volume of fragmented and rapidly changing digital evidence. An effective system could help prioritize suspicious material for human review, connect related activity across platforms, and identify emerging terminology before it becomes widely recognized. Yet the researchers’ results should not be interpreted as proof that automated classification can replace investigators. High scores on benchmark datasets may not fully capture the difficulties of live environments, where adversaries deliberately generate misleading content, copy legitimate commercial language, or shift to new platforms. Models can also inherit biases from their training data and may behave differently across languages, communities, or types of content. Human oversight, transparent evaluation, privacy safeguards, and careful handling of sensitive data remain essential.
The study’s broader contribution is its attempt to unite several strategies that are often examined separately. Language models provide context-sensitive representations, structural features expose the design patterns of online listings, ensemble learning reduces dependence on a single classifier, and semi-supervised training makes use of large unlabeled collections. Together, these components form a flexible architecture for a problem in which the target constantly changes. The authors argue that the framework can support real-world illicit-market surveillance across heterogeneous platforms, although future research will need to examine its performance against newly emerging marketplaces, multilingual slang, multimedia content, and adversarial manipulation. As criminal commerce continues to migrate between hidden services and mainstream social networks, the ability to recognize behavior rather than merely search for forbidden words may become one of the most important directions in automated cyber intelligence.
Subject of Research: Artificial intelligence for detecting and classifying illicit marketplace content across the deep web, dark web, Telegram, Reddit, and Pastebin.
Article Title: A language model-driven semi-supervised ensemble framework for illicit market detection across deep/dark web and social platforms
Article References: Yazdanjue, N., Rakhshaninejad, M., Yazdanjouei, H. et al. “A language model-driven semi-supervised ensemble framework for illicit market detection across deep/dark web and social platforms.” Journal of Big Data (2026).
Image Credits: AI Generated
DOI: 10.1186/s40537-026-01528-z
Keywords: Language models, transformers, ModernBERT, semi-supervised learning, ensemble learning, illicit marketplace detection, dark web, deep web, Telegram, Reddit, Pastebin, cyber intelligence
Tags: accuracy metrics in dark web content classificationAI-driven online illegal activity monitoringchallenges in detecting evolving online criminal vocabulariescoded language and slang in online black marketsdark web illicit marketplace detectiondeep web and dark web illegal trade surveillancehybrid AI frameworks for cybercrime preventionillicit drug and weapons advertisement detectionlanguage models for cybercrime identificationmachine learning for encrypted online communicationssocial media and messaging app dark market analysissocial platform monitoring for illegal activities
