Computational Intelligence - February 2014 - 34

online financial news articles.Two different types of business relationships such as cooperative and competitive relationships were
identified according to a set of pre-defined relationship indicators
captured in a relationship lexicon. Since the CoNet system
mainly relied on a limited set of seeding relationship indicators
to identify business relationships, the recall of such a system may
be low. Our research differs from the aforementioned studies in
that we examine the mining of cybercriminal networks instead
of business networks.
3. A Methodology of Collaborative
Cybercriminal Network Discovery

The basic intuition behind the proposed cybercriminal network
discovery method is that latent concepts describing specific types
of cybercriminal relationships (e.g., transacting cyber-attack tools)
are extracted by a probabilistic generative model to bootstrap the
performance of cybercriminal relationship identification. Figure 3
illustrates the main steps of the proposed cybercriminal network
mining methodology. First, conversational messages US i that refer
to at least two users are extracted from a collection of unlabeled

documents (e.g., online messages posted by hackers). In addition,
generic seeding relationship indicators are applied to label a set of
messages LS i describing transactional activities, or collaborative
cyber-attack activities among cybercriminals.
The entities (i.e., individuals or groups of cybercriminals)
being referred to within the conversational messages are identified using an extended named entity recognition (NER) module of GATE (Maynard et al., 2001). An initial list of wellknown cybercriminals is provided by cyber-security experts to
enrich the ordinary entity dictionary of GATE. In addition, the
user identities associated with these messages are extracted
based on the publicly available user profiles on online social
media. The extracted messages are then fed into an LDA-based
(Blei et al., 2003; Rosen-Zvi et al., 2010; Steyvers et al., 2004)
topic modeling module to extract relevant concepts (i.e., the
topics describing various cybercriminal relationships) to alleviate the low-recall problem of a purely lexicon-based relationship identification approach. In particular, we developed a novel
context-sensitive (CS) Gibbs sampling algorithm to implement
the LDA-based probabilistic generative model.

Message Extraction
d1

US1

US2

...

USn

Training Set

Topic1

Latent Topic Modeling

Topic2

CS Gibbs
Sampling

...
Topick
Latent Concepts

Unlabeled Message
LS1

Online Social
Media

Seeding
Relationship
Indicators

LS2
...

Message
Labeling

Laplacian
Semantic
Inference

LSn
Labeled Message

TS1

TS2

...

...
TSm

ILM-Based
Relationship
Inference

Test Message

Message Extraction

TS1

Tran

TS2

Coll

...

TSm
Coll
Labeled Cybercriminal
Relationships
Figure 3 A probabilistic generative model for collaborative cybercriminal network mining.

IEEE ComputatIonal IntEllIgEnCE magazInE | FEbruary 2014

TopicTran1

TopicCol1

TopicTran2

TopicCol2

...

TopicTranN

TopicColM

Selected Concepts

Test Set

Transactional
and
Collaborative
Concept
Labeling

Table of Contents for the Digital Edition of Computational Intelligence - February 2014