KADetector: Automatic Identification of Key Actors in Online Hack Forums Based on Structured Heterogeneous Information Network

Zhang, Yiming; Fan, Yujie; Ye, Yanfang; Zhao, Liang; Wang, Jia-Bin; Xiong, Qi; Shao, Fudong

doi:10.1109/icbk.2018.00028

Cited by 9 publications

(8 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Pete et al 26 utilized network centrality analysis to highlight the structural patterns of each network to identify important nodes and key hackers. Zhang et al 10 proposed a new heterogeneous information network (HIN) embedding model named ActorHin2Vec to learn the low-dimensional representations for the nodes in HIN, and then a classifier was built for key actor identification. Grisham et al 11 used a state-of-the-art neural network architecture model to identify mobile malware attachments and then social network-based analysis techniques to determine key hackers disseminating mobile malware.…”

Section: Related Workmentioning

confidence: 99%

“…In existing research, two main methods have been used to identify key hackers in underground forums: content-based analysis 7–9 and social network-based analysis. 10–12 Content-based approaches analyze user data based on selected evaluation metrics, such as activity and content quality. Social network-based approaches build a social network on an underground forum in which key hackers have a high degree of network centrality, with common approaches including degree centrality, eigenvector centrality, and PageRank.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

HackerRank: Identifying key hackers in underground forums

Huang

Guo

et al. 2021

International Journal of Distributed Sensor Networks

View full text Add to dashboard Cite

With the rapid development of the Internet, cybersecurity situation is becoming more and more complex. At present, surface web and dark web contain numerous underground forums or markets, which play an important role in cybercrime ecosystem. Therefore, cybersecurity researchers usually focus on hacker-centered research on cybercrime, trying to find key hackers and extract credible cyber threat intelligence from them. The data scale of underground forums is tremendous and key hackers only represent a small fraction of underground forum users. It takes a lot of time as well as expertise to manually analyze key hackers. Therefore, it is necessary to propose a method or tool to automatically analyze underground forums and identify key hackers involved. In this work, we present HackerRank, an automatic method for identifying key hackers. HackerRank combines the advantages of content analysis and social network analysis. First, comprehensive evaluations and topic preferences are extracted separately using content analysis. Then, it uses an improved Topic-specific PageRank to combine the results of content analysis with social network analysis. Finally, HackerRank obtains users’ ranking, with higher-ranked users being considered as key hackers. To demonstrate the validity of proposed method, we applied HackerRank to five different underground forums separately. Compared to using social network analysis and content analysis alone, HackerRank increases the coverage rate of five underground forums by 3.14% and 16.19% on average. In addition, we performed a manual analysis of identified key hackers. The results prove that the method is effective in identifying key hackers in underground forums.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

HackerRank: Identifying key hackers in underground forums

Huang

Guo

et al. 2021

International Journal of Distributed Sensor Networks

View full text Add to dashboard Cite

show abstract

“…This can support intervention and prevention campaigns [49]. Unsurprisingly, there is considerable interest [49], [27], [76], [77], [25], [31] in key actors and this is a core theme of underground forum analysis. 2) Analysing underground economies: Underground forums are not only a platform to exchange ideas and information, but also serve as marketplaces for trading.…”

Section: A Areas Of Focusmentioning

confidence: 98%

“…Datasets have been obtained by researchers in a number of ways. Some collect data themselves [75], [77], [25], for example by scraping underground forums. Others request data from other sources, or work with publicly available datasets, such as databases that have been breached and publicly leaked.…”

Section: B Data Sources and Volumementioning

confidence: 99%

PostCog: A tool for interdisciplinary research into underground forums at scale

Pete

Hughes

Caines

et al. 2022

2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)

View full text Add to dashboard Cite

Underground forums provide useful insights into cybercrime, where researchers analyse underlying economies, key actors, their discussions and interactions, as well as different types of cybercrime. This interdisciplinary topic of study incorporates expertise from diverse areas, including computer science, criminology, economics, psychology, and other social sciences. Historically, there were significant challenges around access to data, but there are now research datasets of millions of messages scraped from underground forums. The problems now stem from the size of these datasets and the technical nature of methods and tools available for data sampling and analysis at scale, which make data exploration difficult for non-technical users. POSTCOG has been developed to solve this problem. We first provide a survey of prior work into underground forums; this was used to understand the requirements and functionalities valued by researchers, and to inform the design of a data exploration tool. We then describe POSTCOG, a web application developed to support users from both technical and non-technical backgrounds in forum analyses, such as search, information extraction and cross-forum comparison. The prototype's usability is then evaluated through two user studies with expert users of the CRIMEBB dataset. POSTCOG is made available for academic research upon signing an agreement with the Cambridge Cybercrime Centre.

show abstract

“…SNA is extensively used to identify key actors in underground forums [17], [31], [32]. Our centrality metric approach is similar to Pete et al [33], who constructed undirected graphs of six underground forums based on 6 months of observation, computed network statistics, and analyzed the network structure.…”

Section: B Social Network Analysis Of Underground Forumsmentioning

confidence: 99%

A Graph-Based Stratified Sampling Methodology for the Analysis of (Underground) Forums

Tizio

Siu

Hutchings

et al. 2023

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Researchers analyze underground forums to study abuse and cybercrime activities. Due to the size of the forums and the domain expertise required to identify criminal discussions, most approaches employ supervised machine learning techniques to automatically classify the posts of interest.[Goal] Human annotation is costly. How to select samples to annotate that account for the structure of the forum? [Method] We present a methodology to generate stratified samples based on information about the centrality properties of the population and evaluate classifier performance. [Result] We observe that by employing a sample obtained from a uniform distribution of the post degree centrality metric, we maintain the same level of precision but significantly increase the recall (+30%) compared to a sample whose distribution is respecting the population stratification. We find that classifiers trained with similar samples disagree on the classification of criminal activities up to 33% of the time when deployed on the entire forum.

show abstract

KADetector: Automatic Identification of Key Actors in Online Hack Forums Based on Structured Heterogeneous Information Network

Cited by 9 publications

References 25 publications

HackerRank: Identifying key hackers in underground forums

HackerRank: Identifying key hackers in underground forums

PostCog: A tool for interdisciplinary research into underground forums at scale

A Graph-Based Stratified Sampling Methodology for the Analysis of (Underground) Forums

Contact Info

Product

Resources

About