Computational Intelligence - February 2014 - 42

number of labeled cybercrime messages, the proposed CSLDA
method is just able to leverage unlabeled cybercrime messages to
learn latent concepts which are semantically rich representations
TransaCTional
CollaboraTive
of different types of cybercriminal relationships. Our CSLDA
Corpus
sysTem
relaTionship
relaTionship
method outperforms the classical LDA method because the proauC
sTd. err.
auC
sTd. err.
posed context-sensitive Gibbs sampling algorithm can discover
CSLDA
0.848
0.013
0.857
0.014
TwiTTer
higher quality latent concepts (as shown in Table 3) when comPLDA
0.839
0.014
0.860
0.017
pared to that produced by the standard Gibbs sampler. These
LDA
0.811
0.015
0.821
0.016
high-quality latent concepts can then be applied to bootstrap
SVM
0.703
0.017
0.754
0.018
cybercriminal relationship classification.
CrF
0.685
0.022
0.742
0.019
Figure 8 shows a sample segment of the cybercriminal netSeeD
0.541
0.022
0.552
0.020
work mined based on our cybercrime corpora. The cybercrimCSLDA
0.823
0.015
0.835
0.018
OnLine
inal network is plotted using the open source graph display
FOruMS
PLDA
0.819
0.017
0.828
0.021
program called Pajek.6 Each circle represents a cybercriminal or
LDA
0.775
0.021
0.789
0.017
cybercriminal group (e.g., the Anonymous group) and a square
SVM
0.695
0.022
0.734
0.024
box represents an attack incident (e.g., "Bank of America")
CrF
0.551
0.012
0.603
0.021
which is most likely associated with the corresponding cyberSeeD
0.531
0.013
0.511
0.018
criminal. We employed a PMI-based method to estimate the
CSLDA
0.836
0.014
0.846
0.016
AVerAge
strength of association between a cybercriminal and an attack
PLDA
0.829
0.016
0.844
0.019
mentioned in social media messages. However, the computaLDA
0.793
0.018
0.805
0.017
tional details about cybercrime forensics will not be covered in
SVM
0.699
0.020
0.744
0.021
this paper. Dash lines between cybercriminals represent collabCrF
0.618
0.017
0.673
0.020
orative cybercriminal relationships (e.g., Anonymous and
SeeD
0.536
0.018
0.532
0.019
nullcrew), whereas solid lines
between cybercriminals indicate
transactional relationships (e.g.,
ugnazi and r00tw0rm). The
Attacked Bank of America Attacked Petraeus Mistress
strength of a cybercriminal relaAttacked CitiBank
Attached FED
tionship is shown along an edge
Launched 0.182 Launched 0.174
Attacked Westboro
which is labeled with the type of
Launched 0.244
Launched 0.205
Baptist Church
relationship. This network segCollaborate 0.406
anonymous
ment was verified as a correct
teampoison
sub-network by our cyber-secuAttacked Sony
Launched 0.209
Collaborate 0.589
Collaborate 0.411
rity experts. According to our
Launched 0.221
experts' qualitative feedback, this
Collaborate 0.425
lulzsec
ugnazi
kind of automatically generated
Collaborate 0.617
Transact 0.438
cybercriminal network can conCollaborate 0.513
r00tw0rm
Attacked
siderably enhance cyber-security
NASA
nullcrew
Launched 0.155
forensics because a large amount
of intuitive and high-quality
Collaborate 0.453
antisec-operation
Launched 0.195
cyber-security intelligence can
Launched 0.217
Launched 0.107
be generated instantly with mininj3ct0r
imal human intervention.
Table 4 The comparative AUC values obtained
by various systems.

Launched 0.142

Attacked Stratfor Global Intelligence

Attacked Sony Mobile

Figure 8 A sample segment of the mined cybercriminal network.

training examples is not sufficient to effectively train the CRF
classifier to learn discriminative label sequences. Since it is
extremely costly and time-consuming to label a large number of
cybercriminal relationships, it may not be practical to apply supervised machine learning classifiers to cybercriminal relationship
mining from online social media. With the absence of a large

42

IEEE ComputatIonal IntEllIgEnCE magazInE | FEbruary 2014

5. Conclusions
Attacked Exploit Hub

Latest cyber-security studies
show that there is a rapid
growth in the number of cybercrimes which cause tremendous
financial losses to click-and-mortar organizations in recent
years. The main contribution of the research work reported in
this paper is the design of a novel, weakly supervised cybercriminal network mining method that is underpinned by a

6

http://vlado.fmf.uni-lj.si/pub/networks/pajek/



Table of Contents for the Digital Edition of Computational Intelligence - February 2014

Computational Intelligence - February 2014 - Cover1
Computational Intelligence - February 2014 - Cover2
Computational Intelligence - February 2014 - 1
Computational Intelligence - February 2014 - 2
Computational Intelligence - February 2014 - 3
Computational Intelligence - February 2014 - 4
Computational Intelligence - February 2014 - 5
Computational Intelligence - February 2014 - 6
Computational Intelligence - February 2014 - 7
Computational Intelligence - February 2014 - 8
Computational Intelligence - February 2014 - 9
Computational Intelligence - February 2014 - 10
Computational Intelligence - February 2014 - 11
Computational Intelligence - February 2014 - 12
Computational Intelligence - February 2014 - 13
Computational Intelligence - February 2014 - 14
Computational Intelligence - February 2014 - 15
Computational Intelligence - February 2014 - 16
Computational Intelligence - February 2014 - 17
Computational Intelligence - February 2014 - 18
Computational Intelligence - February 2014 - 19
Computational Intelligence - February 2014 - 20
Computational Intelligence - February 2014 - 21
Computational Intelligence - February 2014 - 22
Computational Intelligence - February 2014 - 23
Computational Intelligence - February 2014 - 24
Computational Intelligence - February 2014 - 25
Computational Intelligence - February 2014 - 26
Computational Intelligence - February 2014 - 27
Computational Intelligence - February 2014 - 28
Computational Intelligence - February 2014 - 29
Computational Intelligence - February 2014 - 30
Computational Intelligence - February 2014 - 31
Computational Intelligence - February 2014 - 32
Computational Intelligence - February 2014 - 33
Computational Intelligence - February 2014 - 34
Computational Intelligence - February 2014 - 35
Computational Intelligence - February 2014 - 36
Computational Intelligence - February 2014 - 37
Computational Intelligence - February 2014 - 38
Computational Intelligence - February 2014 - 39
Computational Intelligence - February 2014 - 40
Computational Intelligence - February 2014 - 41
Computational Intelligence - February 2014 - 42
Computational Intelligence - February 2014 - 43
Computational Intelligence - February 2014 - 44
Computational Intelligence - February 2014 - 45
Computational Intelligence - February 2014 - 46
Computational Intelligence - February 2014 - 47
Computational Intelligence - February 2014 - 48
Computational Intelligence - February 2014 - 49
Computational Intelligence - February 2014 - 50
Computational Intelligence - February 2014 - 51
Computational Intelligence - February 2014 - 52
Computational Intelligence - February 2014 - 53
Computational Intelligence - February 2014 - 54
Computational Intelligence - February 2014 - 55
Computational Intelligence - February 2014 - 56
Computational Intelligence - February 2014 - 57
Computational Intelligence - February 2014 - 58
Computational Intelligence - February 2014 - 59
Computational Intelligence - February 2014 - 60
Computational Intelligence - February 2014 - 61
Computational Intelligence - February 2014 - 62
Computational Intelligence - February 2014 - 63
Computational Intelligence - February 2014 - 64
Computational Intelligence - February 2014 - Cover3
Computational Intelligence - February 2014 - Cover4
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202311
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202308
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202305
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202302
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202211
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202208
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202205
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202202
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202111
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202108
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202105
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202102
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202011
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202008
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202005
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_202002
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_201911
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_201908
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_201905
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_201902
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_201811
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_201808
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_201805
https://www.nxtbook.com/nxtbooks/ieee/computationalintelligence_201802
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_winter17
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_fall17
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_summer17
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_spring17
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_winter16
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_fall16
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_summer16
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_spring16
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_winter15
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_fall15
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_summer15
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_spring15
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_winter14
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_fall14
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_summer14
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_spring14
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_winter13
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_fall13
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_summer13
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_spring13
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_winter12
https://www.nxtbook.com/nxtbooks/ieee/computational_intelligence_fall12
https://www.nxtbookmedia.com