Measuring Cybercrime as a Service (CaaS) Offerings in a Cybercrime Forum

Cybercrime-as-a-Service (CaaS) enables cybercriminals to rent infrastructure, tools, and technical capabilities without constructing them independently.
An $11$ -year dataset from the Market section of Hack Forums spanning $17/11/2007$ to $04/12/2018$ contains $1,104,046$ first-posts from $1,107,372$ threads across $29$ sub-forums.
Out of $28$ recognized CaaS types, evidence exists for only $9$ categories within Hack Forums.

The cybercriminal value chain adapts Michael Porter's value chain framework to map value-adding activities across cyber attack operations.
Primary Activities: Vulnerability Discovery, Exploitation Development, Exploitation Delivery, and Attack.
Support Activities: Operations (Attack Life-cycle Management), Human Resource (Hacker Community), Marketing and Delivery, and Technology Support.

A ground truth dataset of $662$ manually annotated posts was constructed to train and evaluate classification algorithms across CaaS, product, contact, and supply/demand categories.
CaaS and Product Classification: LinearSVC achieved the highest overall performance with an F1-score of $0.76$ and an AUC-ROC value exceeding 0.95$.\n* **Supply vs. Demand Classification:** Logistic Regression combined with resampling and decision function rule-sets achieved the top performance with an F1-score of 0.86 $and an AUC-ROC of$ 0.92$.
Contact Information Extraction: XGBoost paired with decision functions produced the highest F1-scores for identifying private messages ( $0.982$ ) and general contact details ( $0.981$ ).

CaaS offerings constitute $15.6\%$ ( $172,013$ posts) of all first-posts in the Market section of Hack Forums.
Non-CaaS categories dominate total market volume: Account posts account for $39.7\%$ ( $438,267$ posts), Other posts account for $28.98\%$ ( $319,918$ posts), and Cash-out posts account for $12.62\%$ ( $139,380$ posts).
Product-type crimeware represents $3.1\%$ ( $34,321$ posts) of total market posts.
Three categories comprise over $60\%$ of all CaaS supply and demand:
- Botnet as a Service (BNaaS): $22\%$ of CaaS supply, $26\%$ of CaaS demand.
- Reputation Escalation as a Service (REaaS): $24\%$ of CaaS supply, $19\%$ of CaaS demand.
- Traffic as a Service (TAaaS): $18.5\%$ of CaaS supply, $16\%$ of CaaS demand.
Overall forum trading activity peaked between $2011$ and $2012$ with over $20,000$ posts per month before entering a sustained decline.
At least $50\%$ of supply posts across every CaaS category direct potential buyers to conduct transactions privately via private messages (PM) or instant messaging applications.