地下：预测地下论坛中的私人互动
Under the Underground: Predicting Private Interactions in Underground Forums
摘要：
用户在地下论坛上讨论、购买和销售非法服务和商品，有助于更好地了解网络犯罪分子的经济和组织。先前的工作表明，特别是私人互动提供了有关网络犯罪生态系统的丰富信息。然而，这些信息很少提供给分析师，除非有泄漏。为了解决这个问题，我们提出了一种基于监督机器学习的方法，能够预测哪些公共\threads将生成私人消息，在这样的消息发生部分泄漏后。据我们所知，我们是第一家开发解决方案的公司，可以克服地下论坛分析中私人活动信息有限或没有的障碍。此外，我们还提出了一种自动标记帖子的方法，大大降低了我们在真实未标记数据中的方法成本。此方法可以调整为关注用户接收私人消息或\threads触发私人交互的可能性。我们使用三个真实论坛泄漏的数据来评估我们的方法的性能。我们的研究结果表明，公共信息确实可以用来预测私人活动，虽然预测模型不能很好地转移论坛之间。我们还发现，无论是泄漏周期的长度还是泄漏和预测之间的时间对我们的技术的性能都没有显着影响，并且NLP特征主导了预测能力。
英文摘要：
Underground forums where users discuss, buy, and sell illicit services and goods facilitate a better understanding of the economy and organization of cybercriminals. Prior work has shown that in particular private interactions provide a wealth of information about the cybercriminal ecosystem. Yet, those messages are seldom available to analysts, except when there is a leak. To address this problem we propose a supervised machine learning based method able to predict which public \threads will generate private messages, after a partial leak of such messages has occurred. To the best of our knowledge, we are the first to develop a solution to overcome the barrier posed by limited to no information on private activity for underground forum analysis. Additionally, we propose an automate method for labeling posts, significantly reducing the cost of our approach in the presence of real unlabeled data. This method can be tuned to focus on the likelihood of users receiving private messages, or \threads triggering private interactions. We evaluate the performance of our methods using data from three real forum leaks. Our results show that public information can indeed be used to predict private activity, although prediction models do not transfer well between forums. We also find that neither the length of the leak period nor the time between the leak and the prediction have significant impact on our technique's performance, and that NLP features dominate the prediction power.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
