Behavior Tomographer: Identifying Hidden Cybercrimes by Behavior Interior Structure Modeling

Identifying hidden cybercrimes is a challenging task, as these behaviors are often carefully planned by criminals with counter-surveillance awareness. Existing solutions for cybercrime detection struggle to uncover enough clues to identify hidden criminal behaviors. Malicious behaviors are concealed beneath benign behaviors, and the boundaries between malicious and benign behaviors in the representation space are blurred to evade mainstream deep learning-based security authentication models. We introduce a <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">b</u>ehavior <underline xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</u>omographer (BT) to reconstruct the behavior structure from three slices: agent, event, and attribute slices, enabling more granular detection of hidden cybercrimes. The core idea of BT is to reconstruct interior information about behavior structure from multiple slices, much like computed tomography in modern medicine enables the reconstruction of internal body. It enables the extraction of discriminative information from intricate interior associations between behavioral attributes rather than surface information meticulously crafted by criminals. Our experiments are conducted on two representative cybercrime datasets. Promising experimental results demonstrate that BT outperforms state-of-the-art models on key metrics, achieving around 0.99 AUC-ROC and approximately 0.9 AUC-PR. Moreover, BT notably excels at low false positive rates, showcasing its high effectiveness for real-world applications.