On a recent afternoon in Maracaibo, Venezuela, Alexander Marinez, who has short-cropped black hair and three-to-four-day stubble, sat in front of his computer tracking herbiboars in the mushroom forests on Fossil Island. He pressed down on his glowing mouse, the newest addition to his otherwise timeworn gaming setup. The pixelated character on his computer screen followed the tracks of a hedgehoglike creature with triangular tusks and herbs growing out of its back. Outside Marinez's one-story house, the sun bore down on the dirt road. His home lies about six miles away from the strait that connects the Caribbean Sea with Lake Maracaibo, one of the world's richest sources of oil. The character inspected a tunnel. Suddenly, the herbiboar appeared, and the character attacked, stunning it.

Adversarial behavioral has been observed in many different contexts. In this paper we address the problem of adversarial behavior in the context of clandestine networks. We use data from a massively multiplayer online role playing game to illustrate the behavioral and structural signatures of deviant players change over time as a response to "policing" activities of the game administrators. Preliminary results show that the behavior of the deviant players and their affiliates show co-evolutionary behavior and the timespan within the game can be divided into different epochs based on their behaviors. Feature sets derived from these results can be used for better predictive machine learning models for detecting deviants in clandestine networks.

Gold farming and real money trade refer to a set of illicit practices in massively multiplayer online games (MMOGs) whereby players accumulate virtual resources to sell for “real world” money. Prior work has examined trade relationships formed by gold farmers but not the trust relationships which exist between members of these organizations. We adopt a hypergraph approach to model the multi-modal relationships of gold farmers granting other players permission to use and modify objects they own. We argue these permissions reflect underlying trust relationships which can be analyzed using network analysis methods. We compare farmers’ trust networks to the trust networks of both unidentified farmers and typical players. Our results demonstrate that gold farmers’ networks are different from trust networks of normal players whereby farmers trust highly-central non-farmer players but not each other. These findings have implications for augmenting detection methods and re-evaluating theories of clandestine behavior.