Key Player Identification in Underground Forums over Attributed Heterogeneous Information Network Embedding Framework
Key Player Identification in Underground Forums over Attributed Heterogeneous Information Network Embedding Framework
复制标题
DOI：
10.1145/3357384.3357876
复制
发表时间：
2019-11
期刊：
影响因子：
--
通讯作者：
Yiming Zhang;Yujie Fan;Yanfang Ye;Liang Zhao;C. Shi
中科院分区：
文献类型：
--
作者：
Yiming Zhang;Yujie Fan;Yanfang Ye;Liang Zhao;C. Shi
网络犯罪分子广泛利用在线地下论坛来交流知识和进行非法产品或服务交易，在网络犯罪生态系统中发挥了核心作用。为了打击不断发展的网络犯罪，在本文中，我们提出并开发了一种名为 iDetective 的智能系统，用于自动分析地下论坛以识别关键参与者（即在价值链中发挥重要作用的用户）。在iDetective中，我们首先引入了用于用户表示的归因异构信息网络（AHIN），并使用基于元路径的方法来合并更高级别的语义，以建立地下论坛中用户的相关性；然后我们建议 Player2Vec 有效地学习 AHIN 中的节点（即用户）表示，以识别关键玩家。在 Player2Vec 中，我们首先将构建的 AHIN 映射到多视图网络，该网络由多个单视图属性图组成，对不同设计的元路径所描述的用户的相关性进行编码；然后我们使用图卷积网络（GCN）来学习每个单视图属性图的嵌入；随后，设计了一种注意力机制来融合基于不同单视图属性图学习到的不同嵌入，以获得最终表示。对来自不同地下论坛（即 Hack Forums、Nulled）的数据收集进行了综合实验，通过与其他方法进行比较来验证 iDetective 在关键玩家识别方面的有效性。
Online underground forums have been widely used by cybercriminals to exchange knowledge and trade in illicit products or services, which have played a central role in the cybercriminal ecosystem. In order to combat the evolving cybercrimes, in this paper, we propose and develop an intelligent system named iDetective to automate the analysis of underground forums for the identification of key players (i.e., users who play the vital role in the value chain). In iDetective, we first introduce an attributed heterogeneous information network (AHIN) for user representation and use a meta-path based approach to incorporate higher-level semantics to build up relatedness over users in underground forums; then we propose Player2Vec to efficiently learn node (i.e., user) representations in AHIN for key player identification. In Player2Vec, we first map the constructed AHIN to a multi-view network which consists of multiple single-view attributed graphs encoding the relatedness over users depicted by different designed meta-paths; then we employ graph convolutional network (GCN) to learn embeddings of each single-view attributed graph; later, an attention mechanism is designed to fuse different embeddings learned based on different single-view attributed graphs for final representations. Comprehensive experiments on the data collections from different underground forums (i.e., Hack Forums, Nulled) are conducted to validate the effectiveness of iDetective in key player identification by comparisons with alternative approaches.