[论文解读] Structural Analysis of Criminal Network and Predicting Hidden Links using Machine Learning

Emrah Budur, Seungmin Lee+1 more|arXiv (Cornell University)|Jul 21, 2015

Crime Patterns and Interventions参考文献 8被引用 14

一句话总结

本文提出一种基于图特征与梯度提升机（GBM）的机器学习方法，用于预测犯罪网络中的隐藏链接，将链接预测转化为二分类任务。通过利用加权PageRank与混合攻击策略，该方法在网络破坏性能方面优于标准的节点删除技术。

ABSTRACT

Analysis of criminal networks is inherently difficult because of the nature of the topic. Criminal networks are covert and most of the information is not publicly available. This leads to small datasets available for analysis. The available criminal network datasets consists of entities, i.e. individual or organizations, which are linked to each other. The links between entities indicates that there is a connection between these entities such as involvement in the same criminal event, having commercial ties, and/or memberships in the same criminal organization. Because of incognito criminal activities, there could be many hidden links from entities to entities, which makes the publicly available criminal networks incomplete. Revealing hidden links introduces new information, e.g. affiliation of a suspected individual with a criminal organization, which may not be known with public information. What will we be able to find if we can run analysis on a larger dataset and use link prediction to reveal the implicit connections? We plan to answer this question by using a dataset that is an order of magnitude more than what is used in most criminal networks analysis. And by using machine learning techniques, we will convert a link prediction problem to a binary classification problem. We plan to reveal hidden links and potentially hidden key attributes of the criminal network. With a more complete picture of the network, we can potentially use this data to thwart criminal organizations and/or take a Pareto approach in targeting key nodes. We conclude our analysis with an effective destruction strategy to weaken criminal networks and prove the effectiveness of revealing hidden links when attacking to criminal networks.

研究动机与目标

• 解决因隐蔽活动与公开信息有限导致的犯罪网络数据不完整问题。
• 利用机器学习提高在稀疏、不完整犯罪网络中的链接预测准确性。
• 基于预测的链接结构，识别并针对高影响力节点，制定有效的网络破坏策略。
• 通过战略性节点移除评估隐藏链接发现对削弱犯罪网络韧性的效果。

提出的方法

• 使用基于图的特征（如共同邻居、Jaccard系数和最短路径距离）将链接预测问题转化为二分类任务。
• 采用梯度提升机（GBM）集成多个链接预测指标，提升模型泛化能力。
• 将预测的链接概率作为边权重，构建加权图以支持基于中心性的分析。
• 计算加权PageRank得分，识别用于网络破坏的高影响力节点，采用静态与迭代评分两种方法。
• 设计一种混合攻击策略，结合最高度节点删除与加权PageRank选择，平衡短期破坏与长期网络碎片化。
• 使用最大弱连通分量（WCC）大小与网络直径随时间的变化等指标评估攻击效果。

实验结果

研究问题

• RQ1 使用标准图特征时，机器学习模型在不完整犯罪网络中预测隐藏链接的性能如何？
• RQ2 网络结构（特别是聚类与去中心化程度）对链接预测性能有何影响？
• RQ3 哪种节点靶向策略（如度数、PageRank、加权PageRank）最能有效破坏犯罪网络结构？
• RQ4 结合度数与加权PageRank选择的混合攻击策略是否优于单一方法的网络碎片化效果？
• RQ5 将预测的链接概率用作边权重，如何提升网络破坏模拟的准确性？

主要发现

• 基于GBM的链接预测模型在聚类度较低、去中心化程度较高的网络中表现更优，表明其方差更低、泛化能力更强。
• 加权PageRank方法在所有PageRank变体中表现最佳，体现在最大WCC尺寸最小且网络直径衰减最快。
• 混合攻击策略（结合最高度节点删除与加权PageRank选择）实现了最佳整体破坏性能，达到两种方法理论最小值的匹配水平。
• 该混合方法表现出重尾且迅速下降的直径特征，表明在多个攻击阶段均实现了高效的网络碎片化。
• 研究表明，将预测的链接概率作为边权重显著提升了网络破坏策略的有效性。
• 结果表明，通过机器学习揭示隐藏链接可实现对犯罪网络关键节点更战略化、更有效的靶向打击。