Online Social Networks (OSNs) have grown exponentially over the past decade. The initial use of social media for benign purposes (e.g., to socialize with friends, browse pictures and photographs, and communicate with family members overseas) has now transitioned to include malicious activities (e.g., cybercrime, cyberterrorism, and cyberwarfare). These nefarious uses of OSNs poses a significant threat to society, and thus requires research attention. In this exploratory work, we study activities of one deviant groups: hacker groups on social media, which we term Deviant Hacker Networks (DHN). We investigated the connection between different DHNs on Twitter: how they are connected, identified the powerful nodes, which nodes sourced information, and which nodes act as "bridges" between different network components. From this, we were able to identify and articulate specific examples of DHNs communicating with each other, with the goal of committing some form of deviant act online. In our work, we also attempted to bridge the gap between the empirical study of OSNs and cyber forensics, as the growth of OSNs is now bringing these two domains together, due to OSNs continuously generating vast amounts of evidentiary data.


Al-khateeb, S., & Agarwal, N. (2015a). Analyzing deviant cyber flash mobs of isil on twitter. In International conference on social computing, behavioral-cultural modeling, and prediction (pp. 251–257).

Al-khateeb, S., & Agarwal, N. (2015b). Examining botnet behaviors for propaganda dissemination: A case study of isil’s beheading videos-based propaganda. In 2015 ieee international conference on data mining workshop (icdmw) (pp. 51–57).

Al-khateeb, S., & Agarwal, N. (Under review). Examining the use of botnets in propaganda dissemination case studies of the 2014 crimean water crisis and the 2015 dragoon ride exercise. NATO Strategic Communication Center of Excellence (STRATCOM CoE).

Al Mutawa, N., Baggili, I., & Marrington, A. (2012). Forensic analysis of social networking applications on mobile devices. Digital Investigation, 9, S24–S33.

Baggili, I., & Breitinger, F. (2015). Data sources for advancing cyber forensics: What the social world has to offer. In 2015 AAAI Spring Symposium Series.

Blondel, V. D., Guillaume, J. L., Lambiotte, R., & Lefebvre, E. (2008). Fast unfolding of communities in large networks. Journal of statistical mechanics: theory and experiment, 2008(10), P10008.

Foundation, S. M. R. (2014). NodeXl: Network Overview, Discovery and Exploration for Excel.

Girvan, M., & Newman, M. E. (2002). Community structure in social and biological networks. Proceedings of the national academy of sciences, 99(12), 7821–7826.

Hanneman, R. A., & Riddle, M. (2005). Introduction to social network methods. In (chap. 7). University of California Riverside.

Huber, M., Mulazzani, M., Leithner, M., Schrittwieser, S., Wondracek, G., & Weippl, E. (2011). Social snapshots: Digital forensics for online social networks. In Proceedings of the 27th annual computer security applications conference (pp. 113–122).

Jaccard, P. (1912). The distribution of the flora in the alpine zone. New phytologist, 11(2), 37–50.

Mulazzani, M., Huber, M., & Weippl, E. (2012). Social network forensics: Tapping the data pool of social networks. In Eighth Annual IFIP WG (Vol. 11).

Seddon, M. (2014, May). How a british blogger became an unlikely star of the ukraine conflict and russia today. Retrieved 2015-08-19, from http://bzfd.it/1qpuL2z

Sen, F., Wigand, R., Agarwal, N., Tokdemir, S., & Kasprzyk, R. (2016). Focal structures analysis: Identifying influential sets of individuals in a social network. Social Network Analysis and Mining, 6(1), 1–22. Retrieved from http://bit.ly/1qS8Y4D doi: 10.1007/s13278-016-0319-z

Sen, F., Wigand, R. T., Agarwal, N., Mete, M., & Kasprzyk, R. (2014). Focal structure analysis in large biological networks. 3rd International Conference on Environment Energy and Biotechnology.

Walnycky, D., Baggili, I., Marrington, A., Moore, J., & Breitinger, F. (2015). Network and device forensic analysis of android social-messaging applications. Digital Investigation, 14, S77–S84.

Yuce, S., Agarwal, N., Wigand, R. T., Lim, M., & Robinson, R. S. (2014). Studying the evolution of online collective action: saudi arabian womens oct26drivingtwitter campaign. In International conference on social computing, behavioral-cultural modeling, and prediction (pp. 413–420).





To view the content in your browser, please download Adobe Reader or, alternately,
you may Download the file to your hard drive.

NOTE: The latest versions of Adobe Reader do not support viewing PDF files within Firefox on Mac OS and if you are using a modern (Intel) Mac, there is no official plugin for viewing PDF files within the browser window.