Learning to Detect: A Semi Supervised Multi-relational Graph Convolutional Network for Uncovering Key Actors on Hackforums

Abstract

Cybercriminals who interact extensively on underground forums, often, exchange illegal commodities and indulge in discussions on unwarranted topics. To facilitate the disruption of these highly proficient criminals, we propose a deep learning based multi-relational graph convolutional network approach to analyse the underground forum and identify key actors. We first modeled the hackforum into a homogeneous graph of users, where the multiple edges between users are captured based on their involvement in private conversations, group discussions and other miscellaneous activities. In addition, we also encode the textual content shared among users’ in form of distributed feature representation generated from BERT. To obtain ground truth labels for training data, we propose a hypothesis to calculate the scores for each user based on the quality and quantity of their involvement in the underground forum. The proposed framework jointly embeds the users’ and multi relational information to learn the nodes embeddings in the graph. We demonstrate the effectiveness of the proposed model on a neonazi underground forum, Iron March. We conducted an ablation study on the model parameters to generate the best results and achieved a classification accuracy of 82% which validates the proposed hypothesis for score computation and class labelling. To establish the robustness of our model, we compare its performance against state-of-art models. Though we used an underground forum as a showcase, the proposed model can be implemented to identify influential users’ on other social media platforms.