DarkGram：对 Telegram 上网络犯罪活动频道的大规模分析
DarkGram: A Large-Scale Analysis of Cybercriminal Activity Channels on Telegram
AI总结：
本文提出基于 BERT 的 DarkGram 框架，以 96% 准确率识别 Telegram 网络犯罪频道恶意帖子，并通过大规模内容分析揭示其生态韧性，推动 196 个频道下架且开源数据与工具。
摘要：
我们提出了首个针对 339 个网络犯罪活动频道（CAC）的大规模分析。这些频道拥有超过 2380 万订阅者，向其订阅者分享大量恶意和不道德内容，包括被泄露的凭据、盗版软件和媒体、社交媒体操纵工具，以及黑帽黑客资源，如恶意软件、漏洞利用工具包和社会工程诈骗。为评估这些频道，我们开发了 DarkGram，这是一个基于 BERT 的框架，可自动识别 CAC 中的恶意帖子，准确率达 96%。利用 DarkGram，我们对 2024 年 2 月至 5 月期间在这些频道上分享的 53,605 条帖子进行了定量分析，揭示了内容的关键特征。尽管其中许多内容是免费分发的，但频道管理员经常采用促销和赠品等策略来吸引用户，并促进高级网络犯罪内容的销售。有趣的是，这些频道有时会给其自身订阅者带来重大风险。值得注意的是，这些频道中分享的链接有 28.1% 包含钓鱼攻击，38% 的可执行文件捆绑了恶意软件。分析订阅者如何消费并积极回应所分享内容，描绘出网络犯罪内容大规模持续传播的危险图景。我们还发现，CAC 能够通过快速迁移到新频道来逃避审查或平台下架，且订阅者损失极小，这凸显了该生态系统的韧性。为应对这一问题，我们利用 DarkGram 检测新兴频道，并向 Telegram 和受影响组织举报恶意内容。这使得三个月内有 196 个频道被下架。我们的发现强调，迫切需要协同努力，以对抗这些频道带来的日益增长的威胁。为协助这项工作，我们开源了数据集和 DarkGram 框架。
英文摘要：
We present the first large-scale analysis of 339 cybercriminal activity channels (CACs). Followed by over 23.8 million users, these channels share a wide array of malicious and unethical content with their subscribers, including compromised credentials, pirated software and media, social media manipulation tools, and blackhat hacking resources such as malware, exploit kits, and social engineering scams. To evaluate these channels, we developed DarkGram, a BERT-based framework that automatically identifies malicious posts from the CACs with an accuracy of 96%. Using DarkGram, we conducted a quantitative analysis of 53,605 posts shared on these channels between February and May 2024, revealing key characteristics of the content. While much of this content is distributed for free, channel administrators frequently employ strategies such as promotions and giveaways to engage users and boost the sales of premium cybercriminal content. Interestingly, these channels sometimes pose significant risks to their own subscribers. Notably, 28.1% of the links shared in these channels contained phishing attacks, and 38% of executable files were bundled with malware. Analyzing how subscribers consume and positively react to the shared content paints a dangerous picture of the perpetuation of cybercriminal content at scale. We also found that the CACs can evade scrutiny or platform takedowns by quickly migrating to new channels with minimal subscriber loss, highlighting the resilience of this ecosystem. To counteract this, we utilized DarkGram to detect emerging channels and reported malicious content to Telegram and affected organizations. This resulted in the takedown of 196 channels over three months. Our findings underscore the urgent need for coordinated efforts to combat the growing threats posed by these channels. To aid this effort, we open-source our dataset and the DarkGram framework.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
