去除主题偏差的暗网论坛作者归属分析方法

张慧妍; 霍艺璇; 赵佳鹏; 王学宾; 孙岩炜; 赵璨; 时金桥

引用本文：

张慧妍,霍艺璇,赵佳鹏,王学宾,孙岩炜,赵璨,时金桥.去除主题偏差的暗网论坛作者归属分析方法[J].信息安全学报,2026,11(3):18-33 [点击复制]
ZHANG Huiyan,HUO Yixuan,ZHAO Jiapeng,WANG Xuebin,SUN Yanwei,ZHAO Can,SHI Jinqiao.A Topic Debiasing Method for Author Attribution Analysis of Dark Web Forums[J].Journal of Cyber Security,2026,11(3):18-33 [点击复制]

本文已被：浏览 348次下载 249次	码上扫一扫！
去除主题偏差的暗网论坛作者归属分析方法
张慧妍^1,2, 霍艺璇^1,2, 赵佳鹏^1,3,2, 王学宾^4,5, 孙岩炜^1,2, 赵璨^4,5, 时金桥^1,2
字体:加大+\|默认\|缩小-
(1.北京邮电大学网络空间安全学院北京中国 102206;2.可信分布式计算与服务教育部重点实验室北京中国 102206;3.浙江大学区块链与数据安全全国重点实验室杭州中国 310058;4.信息内容安全国家工程研究中心北京中国 100093;5.中国科学院信息工程研究所北京中国 100093)

摘要:

暗网市场由于其匿名性经常被用来交易非法商品和服务。为了更好地对频繁迁移的匿名论坛用户进行作者分析和取证,可以利用用户留下的大量帖子中的文本信息来识别和分析用户,根据论坛中的帖子对匿名用户身份进行表示学习,从而链接恶意用户的不同账号,实现匿名用户的身份追踪。然而,现有的暗网论坛作者归属分析方法学到的作者身份表示会受数据集中主题分布的影响,在训练集与测试集主题分布不一致的情况下出现明显性能下降,这意味着现有的模型学习方法在训练过程中捕获到了主题分布与标签之间的虚假相关特征,使得模型在数据分布变化的场景下无法达到预期的预测结果。本文通过结构因果模型(Structural Causal Models,SCM)解释了文本主题给作者归属分析任务引入偏差的原因,并将因果推理的方法引入基于文本的暗网论坛作者归属分析工作,提出了一种因果去偏方法来缓解主题分布不一致对作者身份表示的影响。该方法通过按主题划分数据集并保持同一作者身份表示在各主题下的潜在因果效应的不变性来减少模型对主题分布信息的依赖,学习在各个主题下性能表现更稳定的作者表示。在四个不同的暗网论坛数据集上的实验结果表明,本文的方法实现了模型预测性能的有效提升并且在不同主题数据集下表现得更稳定,在MRR和Recall@10这两个评估指标上平均提升7.25%和6.33%。

关键词: 作者归属暗网论坛用户分析

DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.02

投稿时间：2024-11-16修订日期：2025-02-28

基金项目:本课题得到浙江大学区块链与数据安全国家重点实验室开放研究基金、青年科学基金项目(No.6240071954)资助。

A Topic Debiasing Method for Author Attribution Analysis of Dark Web Forums

ZHANG Huiyan^1,2, HUO Yixuan^1,2, ZHAO Jiapeng^1,3,2, WANG Xuebin^4,5, SUN Yanwei^1,2, ZHAO Can^4,5, SHI Jinqiao^1,2

(1.School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 102206, China;2.Key Laboratory of Trustworthy Distributed Computing and Service (BUPT), Ministry of Education, Beijing 102206, China;3.The State Key Laboratory of Blockchain and DataSecurity, Zhejiang University, Hangzhou 310058, China;4.National Engineering Research Center for Information Content Security, Beijing 100093, China;5.Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China)

Abstract:

Darknet marketplaces are often used to trade illegal goods and services due to their anonymity. In order to better analyze and collect authors from frequently migrated anonymous forum users, the text information in a large number of posts left by users can be used to identify and analyze users, and the anonymous users' identities can be represented and learned according to the posts in the forum, so as to link different accounts of malicious users and realize the identity tracking of anonymous users. However, the authorship representation learned by the existing dark web forum author attribution analysis method will be affected by the topic distribution in the dataset, and the performance will be significantly degraded when the topic distribution of the training set is inconsistent with the test dataset, which means that the existing model learning methods capture the spurious correlation features between the topic distribution and the labels in the training process, which makes the model unable to achieve the expected prediction results in the scenario of data distribution change. This paper uses the Structural Causal Models (SCM) to explain the reasons why the topic of texts introduces bias to the author attribution analysis task, and introduces the method of causal reasoning into the text-based author attribution analysis of dark web forums, and proposes a causal debiasing method to alleviate the influence of topic distribution inconsistency on the authorship representation. By dividing the dataset by topic and maintaining the invariance of the potential causal effects under each topic represented by the same authorship, the model reduces the dependence of the model on topic distribution information, and learns the author representation with more stable performance under each topic. Experimental results on four different dark web forum datasets show that the proposed method achieves an effective improvement in the prediction performance of the model and performs more stably under different topic datasets, with an average improvement of 7.25% and 6.33% on the two evaluation indicators of MRR and Recall@10.

Key words: authorship attribution darkweb forum user analysis