KADetector: Automatic Identification of Key Actors in Online Hack Forums Based on Structured Heterogeneous Information Network
KADetector: Automatic Identification of Key Actors in Online Hack Forums Based on Structured Heterogeneous Information Network
复制标题
DOI：
10.1109/icbk.2018.00028
复制
发表时间：
2018-11
期刊：
影响因子：
--
通讯作者：
Yiming Zhang;Yujie Fan;Yanfang Ye;Liang Zhao;Jiabin Wang;Qi Xiong;Fudong Shao
中科院分区：
文献类型：
--
作者：
Yiming Zhang;Yujie Fan;Yanfang Ye;Liang Zhao;Jiabin Wang;Qi Xiong;Fudong Shao
地下论坛被网络犯罪分子广泛用于交流知识和非法产品或服务的交易，这些产品或服务在网络犯罪生态系统中发挥了核心作用。为了便于部署有效的对策，本文提出并开发了一个名为KADetector的智能系统，用于自动分析黑客论坛，以识别其在价值链中扮演关键角色的关键参与者。在KADetector中，为了识别给定用户是否是关键参与者，我们不仅分析了他们发布的帖子，还利用了用户、帖子、回复、评论、版块和主题之间的各种关系。为了对丰富的语义关系进行建模，我们首先引入结构化的异质信息网络(HIN)来表示，然后使用基于元路径的方法来结合高层语义来建立与黑客论坛中的用户的关联度。为了降低HIN的计算和空间开销，针对HIN构建的不同元路径，提出了一种新的HIN嵌入模型ActorHin2Vec来学习HIN中节点的低维表示。在此基础上，构建分类器进行关键角色的识别。据我们所知，这是第一个使用结构化HIN进行地下参与者分析的工作。在黑客论坛收集的数据上进行了全面的实验，通过与其他方法的比较，验证了我们开发的系统KADetector在关键行为者识别方面的有效性。
Underground forums have been widely used by cybercriminals to exchange knowledge and trade in illicit products or services, which have played a central role in the cybercriminal ecosystem. In order to facilitate the deployment of effective countermeasures, in this paper, we propose and develop an intelligent system named KADetector to automate the analysis of Hack Forums for the identification of its key actors who play the vital role in the value chain. In KADetector, to identify whether the given users are key actors, we not only analyze their posted threads, but also utilize various kinds of relations among users, threads, replies, comments, sections and topics. To model the rich semantic relationships, we first introduce a structured heterogeneous information network (HIN) for representation and then use a meta-path based approach to incorporate higher-level semantics to build up relatedness over users in Hack Forums. To reduce the high computation and space cost, given different meta-paths built from the HIN, we propose a new HIN embedding model named ActorHin2Vec to learn the low-dimensional representations for the nodes in HIN. After that, a classifier is built for key actor identification. To the best of our knowledge, this is the first work to use structured HIN for underground participant analysis. Comprehensive experiments on the data collections from Hack Forums are conducted to validate the effectiveness of our developed system KADetector in key actor identification by comparisons with alternative methods.