Hidden Buyer Identification in Darknet Markets via Dirichlet Hawkes Process
Hidden Buyer Identification in Darknet Markets via Dirichlet Hawkes Process
复制标题
DOI：
10.1109/bigdata52589.2021.9671406
复制
发表时间：
2021-12
期刊：
影响因子：
--
通讯作者：
Panpan Zheng;Shuhan Yuan;Xintao Wu;Yubao Wu
中科院分区：
文献类型：
--
作者：
Panpan Zheng;Shuhan Yuan;Xintao Wu;Yubao Wu
暗网市场是各种非法交易的地下市场，包括销售或代理毒品，武器和被盗信用卡。为了打击网络空间中的这些非法活动，了解暗网市场参与者的活动行为至关重要。目前，许多研究集中在研究供应商的活动。然而，对买家的分析工作并不多。关键的挑战是，买家在暗网市场中是匿名的。为了确保交易的匿名性，我们只观察买家ID的第一个和最后一个数字，例如“a**B”，在大多数暗网市场上。为了解决这一挑战，我们提出了一个隐藏的买家识别模型，被称为CRAMX，它可以从一个隐藏的买家到一个集群的交易序列从一个匿名的ID。CRAMX是能够建模的时间动态信息，以及产品，评论和供应商信息与每个交易相关联。然后，在时间和内容方面具有相似模式的交易被分组为来自一个隐藏买家的子序列。对从三个真实世界的暗网市场和一个DBLP出版物数据集收集的数据进行的实验证明了我们的方法通过各种聚类指标测量的有效性。对真实的事务序列的案例研究表明，我们的方法可以将具有相似模式的事务分组到相同的聚类中。
Darknet markets are underground markets for various illicit transactions, including selling or brokering drugs, weapons, and stolen credit cards. To combat these illicit activities in cyberspace, it is critical to understand the activity behaviors of participants in the darknet markets. Currently, many studies focus on studying the activities of vendors. However, there is no much work on analyzing buyers. The key challenge is that the buyers are anonymized in darknet markets. To ensure the anonymity of transactions, we only observe the first a nd last digits of a buyer’s ID, such as "a**b", on most of the darknet markets. To tackle this challenge, we propose a hidden buyer identification model, called UNMIX, which can group transactions from one hidden buyer into one cluster given a transaction sequence from an anonymized ID. UNMIX is able to model the temporal dynamics information as well as the product, comment, and vendor information associated with each transaction. Then, the transactions with similar patterns in terms of time and content are grouped as a subsequence from one hidden buyer. Experiments on the data collected from three real-world darknet markets and one DBLP publication dataset demonstrate the effectiveness of our approach measured by various clustering metrics. Case studies on real transaction sequences explicitly show that our approach can group transactions with similar patterns into the same clusters.