SGCML: Detecting Hacker Community Hidden in Chat Group

Hacker communities on various platforms have similar interests in sharing malware, vulnerability knowledge, and other illegal artifacts. Therefore, it is helpful to identify hacker communities to detect potential security issues. Many researchers have concentrated on detecting hacker communities on online social networks, such as Twitter and underground forums. However, the problem of detecting hacker communities in chat groups remains unresolved. To address two main challenges in detecting hacker communities in chat groups, this paper presented a method named Self-optimizing Graph Clustering based on Multitask Learning (SGCML). On the one hand, differing from traditional social networks, there are no direct edge relationships between users in chat groups, thereby this paper defines meta-paths as edges to reveal how hackers are connected. On the other hand, this paper presents a self-optimizing graph clustering method based on multi-task learning to address the issue of labeled data scarcity. According to the experiments, SGCML outperforms baselines to a great extent and can correctly identify significant nodes and structures in the hacker community, demonstrating its effectiveness in detecting hacker communities on chat groups.