SaTC: CORE: Small: Cybersecurity Big Data Research for Hacker Communities: A Topic and Language Modeling Approach

据估计，网络犯罪每年给全球经济造成的损失约为4450亿美元，尤其是知识产权盗窃和利用被盗消费者数据进行金融欺诈。大规模黑客攻击和数据盗窃事件时有发生，许多网络攻击导致个人敏感信息或知识产权被盗。在可预见的未来，网络安全仍将是一个关键问题，需要对一个庞大、多样化、隐蔽和不断发展的国际黑客社区进行更多的研究。计算机科学和社会科学研究人员面临着不小的挑战，例如数据收集和分析的技术困难，数据收集的大量数据，数据元素的异质性和隐蔽性，以及理解跨地区常见黑客术语和概念的能力。为了缓解这些挑战，该项目有两个研究目标：1)提高当前国际黑客社区内容的可扩展识别、收集和分析能力；2)通过开发新的大数据技术，使研究人员能够对黑客内容和其他相关领域进行分析，为网络安全社区做出贡献。该项目的影响是通过共享和传播我们全面的黑客社区数据收集，先进的收集策略，以及在NSF安全和可信网络空间数据科学和其他社区的创新分析方法来实现的。本项目旨在为网络安全和大数据社区开发一个大型、全面和纵向的测试平台，涵盖所有重要的国际在线黑客社区内容，包括：论坛、IRCs、地下经济和其他新兴的黑客资产。分析方法主要针对大规模国际黑客社区内容分析，为主动网络威胁情报（CTI）提供支持。为了分析黑客内容，该项目开发了一个创新的、整体的、主动的CTI框架，包括跨语言知识转移，以减轻语言障碍，非参数监督主题建模，以描述关键的黑客资产，以及可扩展的动态主题建模，以通知新出现的威胁检测。UA的国家安全局指定的网络防御、研究和运营学术卓越中心，NSF服务奖学金（SFS）网络军团，以及顶级的网络安全硕士项目，将该项目定位为与教学和研究的协同作用。在这个项目中开发的技术不仅推进了CTI知识，而且还推进了深度迁移学习、深度生成建模、监督主题建模、动态主题建模、神经变分推理和许多其他重要领域。这项研究的结果将通过各种学术和网络安全行业渠道传播，如本科和研究生课程、IEEE情报和安全信息学会议、国家网络取证培训联盟（NCFTA）、网络空间监管协会（POLCYB）和美国国家科学基金会网络安全部队（SFS）。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

It is estimated that cybercrime costs the global economy around $445 billion annually, particularly due to intellectual property theft and financial fraud using stolen consumer data. Incidents of large-scale hacking and data theft occur regularly, with many cyberattacks resulting in theft of sensitive personal information or intellectual property. Cybersecurity will remain a critical problem for the foreseeable future, necessitating more research on a large, diverse, covert and evolving international hacker community. Computer science and social science researchers face non-trivial challenges, such as the technical difficulties in data collection and analytics, the massive volume of data collection, the heterogeneity and covert nature of data elements, and the ability to comprehend common hacker terms and concepts across regions. In order to alleviate these challenges, this project has two research goals: 1) advance current capabilities for scalable identification, collection, and analysis of international hacker community contents, and 2) make contributions to the cybersecurity community by developing new big data techniques that could enable researchers to conduct analyses on hacker content and other related domains. The impact of the project is made through the sharing and dissemination of our comprehensive hacker community data collection, advanced collection strategies, and innovative analytical approaches within the NSF Secure and Trustworthy Cyberspace data science and other communities.This project aims to develop a large, comprehensive and longitudinal testbed of all significant international online hacker community contents, including: forums, IRCs, underground economies, and other emerging hacker assets, for the cybersecurity and big data communities. The analytical approaches mainly aim to address the large-scale international hacker community content analysis for proactive cyber threat intelligence (CTI). In order to analyze hacker contents, the project develops an innovative, holistic, and proactive CTI framework encompassing Cross-Lingual Knowledge Transfer to alleviate the language barrier, Nonparametric Supervised Topic Modeling to profile key hacker assets, and Scalable Dynamic Topic Modeling to inform emerging threat detection. UA's National Security Agency-designated Center of Academic Excellence in Cyber Defense, Research, and Operations, NSF Scholarship-for-Service (SFS) Cyber-Corps, and top-ranked Master's in Cybersecurity programs position the project for synergy with teaching and research. Techniques developed in this project not only advance CTI knowledge, but also deep transfer learning, deep generative modeling, supervised topic modeling, dynamic topic modeling, neural variational inference, and numerous other important domains. Results from this research will be disseminated through various academic and cybersecurity industry channels such as undergraduate and graduate curricula, IEEE Intelligence and Security Informatics conference, National Cyber-Forensics Training Alliance (NCFTA), The Society for the Policing of Cyberspace (POLCYB), and NSF CyberCorps SFS.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.