SaTC: CORE: Medium: Collaborative: Understanding and Discovering Illicit Online Business Through Automatic Analysis of Online Text Traces

非法在线业务通常会留下人类可读的文字痕迹，以便与其目标进行互动（例如，欺骗受害者，向目标客户宣传非法产品）或在相关犯罪分子之间进行协调。这些文本内容对于检测各种类型的网络犯罪，了解它们是如何发生的，犯罪者的策略，能力和基础设施，甚至是地下业务的生态系统都很有价值。然而，自动发现和分析这些文本痕迹是具有挑战性的，因为它们的欺骗性内容很容易混入合法的通信中，而且犯罪分子广泛使用秘密语言来隐藏他们的通信，甚至在公共平台上（如社交媒体和论坛）。该项目旨在系统地研究如何自动发现这些文字痕迹，并智能地利用它们来打击网络犯罪。研究成果将有助更有效及适时地控制网上犯罪活动，而警队与业界的合作，亦有助他们获得业界的反馈，并促进新技术的实际应用。这个项目既关注罪犯与目标之间的交流，也关注歹徒之间的地下交流。为了发现和了解非法在线活动，该研究寻找文本内容与其上下文之间的任何语义不一致（例如在。edu域名上销售非法毒品的广告）以及被触发的不适当操作（例如恶意软件下载）。不一致性由针对各种安全设置定制的自然语言处理（NLP）技术捕获。此外，根据发现的与犯罪相关的内容，该项目将研究各种支持自动提取和分析威胁情报和犯罪活动的机器学习技术。使用从各种来源（公共数据集、地下论坛和其他来源）收集的数据对这些技术进行评估，并通过人工标记、与受影响方沟通以及与行业合作伙伴合作的过程验证这些技术的发现。这项工作将有助于深入了解地下生态系统，并更有效地控制这些在线业务的非法操作。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Unlawful online business often leaves behind human-readable text traces for interacting with its targets (e.g., defrauding victims, advertising illicit products to intended customers) or coordinating among the criminals involved. Such text content is valuable for detecting various types of cybercrimes and understanding how they happen, the perpetrator's strategies, capabilities and infrastructures and even the ecosystem of the underground business. Automatic discovery and analysis of such text traces, however, are challenging, due to their deceptive content that can easily blend into legitimate communication, and the criminal's extensive use of secret languages to hide their communication, even on public platforms (such as social media and forums). The project aims at systematically studying how to automatically discover such text traces and intelligently utilize them to fight against online crime. The research outcomes will contribute to more effective and timely control of online criminal activities, and the team's collaboration with industry also enables the team to get feedback and facilitate the transformation of new techniques to practical use. This project focuses on both criminals' communication with their targets and the underground communications among miscreants. To discover and understand illicit online activities, the research looks for any semantic inconsistency between text content and its context (such as advertisements for selling illegal drugs on an .edu domain) and for inappropriate operations being triggered (such as a malware download). Inconsistencies are captured by the Natural Language Processing (NLP) techniques customized to various security settings. Further, based upon crime-related content discovered, the project will study various machine learning techniques that support automatic extraction and analysis of threat intelligence and criminal activities. The techniques are evaluated using data collected from various sources (public datasets, underground forums and others), and the findings they make are validated through a process that involves manual labeling, communication with affected parties, and collaborations with industry partners. This work will help create in-depth knowledge about underground ecosystems and lead to more effective control of illicit operations of these online businesses.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.