发表机构
Eindhoven University of Technology; University of Liechtenstein（埃因霍温理工大学; 列支敦士登大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究提出分类体系与TF-IDF流程，检测Telegram上网络犯罪IaaS广告，发现其高度集中，为监测调查提供优先级参考。
AI 中文摘要
网络犯罪活动日益依赖于可重复使用的数字基础设施——包括托管、代理和虚拟专用网络（VPN）——这些基础设施通过犯罪即服务市场租用，并在 Telegram 等平台上进行广告宣传。我们提出了一种用于识别 Telegram 上宣传网络犯罪基础设施即服务（IaaS）消息的分类体系。该分类体系涵盖计算、网络和通信基础设施的六个服务类别，以及三个信任属性：防弹、支付安全和透明度。利用 261 条人工标注的消息，我们评估了基于关键词和 TF-IDF 的分类器，并考察了基于提示的大语言模型作为探索性基线。我们选择了一个 TF-IDF 流程，并将其应用于来自 167 个与网络犯罪相关的 Telegram 社区的 1,116,071 条消息。该流程为 207,244 条消息（18.57%）分配了至少一个基础设施类别，这些消息跨越 113 个社区。分类广告高度集中：单一社区占基础设施阳性消息的 50.3%，而信任属性分类器识别出其中 37.66% 的消息包含防弹声明。这些发现刻画了 Telegram 上基础设施广告的规模、构成和集中度，并可为监测和调查的社区及行为者的优先级排序提供参考。
英文摘要
Cybercriminal operations increasingly depend on reusable digital infrastructure---including hosting, proxies, and virtual private networks (VPNs)---rented through Cybercrime-as-a-Service markets and advertised on platforms such as Telegram. We present a taxonomy for identifying Telegram messages advertising cybercriminal Infrastructure-as-a-Service (IaaS). The taxonomy comprises six service categories across compute, network, and communication infrastructure, together with three trust attributes: Bulletproof, Payment Security, and Transparency. Using 261 human-annotated messages, we evaluate keyword-based and TF--IDF classifiers and examine prompt-based large language models as exploratory baselines. We select a TF--IDF pipeline and apply it to 1,116,071 messages from 167 cybercrime-related Telegram communities. The pipeline assigns at least one infrastructure category to 207,244 messages (18.57%) spanning 113 communities. Classified advertising is highly concentrated: a single community accounts for 50.3% of infrastructure-positive messages, while the trust-attribute classifiers identify Bulletproof claims in 37.66% of those messages. These findings characterize the scale, composition, and concentration of infrastructure advertising on Telegram and can inform the prioritization of communities and actors for monitoring and investigation.
CommentsTo appear in the proceedings of the 2026 ACM CCS TAKEDOWN Workshop (Technical Analysis and Knowledge Exchange on Disrupting Online Criminal Networks)
