[1]WEI Keshun,SHI Lei,SHI Tuo,et al.Analysis method of black-gray industry chat records under hierarchical multi-agent framework[J].CAAI transactions on intelligent systems,2026,21(5):1221-1236.[doi:10.11992/tis.202603037]
Copy

Analysis method of black-gray industry chat records under hierarchical multi-agent framework

CAAI transactions on intelligent systems[ISSN 1673-4785/CN 23-1538/TP] Volume: 21 Number of periods: 2026 5 Page number: 1221-1236 Column: 学术论文—机器学习 Public date: 2026-09-05
Title:
Analysis method of black-gray industry chat records under hierarchical multi-agent framework
Author(s):
WEI Keshun1;  SHI Lei2;  SHI Tuo3;  TIAN Yifan4;  CHENG Gang5
1. School of Law, University of International Business and Economics, Beijing 100029, China;
2. State Key Laboratory of Media Convergence and Communication, Communication University of China, Beijing 100024, China;
3. Department of Public Security Management, Beijing Police College, Beijing 102202, China;
4. College of Information and Cyber Security, People’s Public Security University of China, Beijing 100038, China;
5. School of Computer Science and Information Security, University of Emergency Management, Beijing 101601, China
Keywords:
cyber black market; large model; multi-agent; chat record analysis; retrieval-augmented generation; chain-of-thought; text mining; criminal intelligence analysis
CLC:
TP391.1
DOI:
10.11992/tis.202603037
Abstract:
As direct carriers of underground industry chain interactions, cyber black market chat records embed substantial implicit criminal intentions and organizational clues. The accurate identification of jargon from vast amounts of unstructured text along with the deep mining of criminal types and behavioral patterns has emerged as a critical challenge in overcoming traditional analytical bottlenecks and enabling intelligent insights into cyber black market intelligence. This study proposes a large-model-based multi-agent collaborative analysis method. The method employs a workflow-oriented orchestration and task division framework that sequentially coordinates four core processes in a predefined workflow: jargon identification, category determination, pattern mining, and report generation. It also integrates technologies such as retrieval-augmented generation (RAG), chain-of-thought (CoT), batch processing, and high-level pattern extraction. This approach overcomes the limitations of traditional single models in handling long-chain, complex logical tasks, achieving an end-to-end transformation from raw data to intelligent analysis reports and enhancing the analytical capabilities for cyber black market chat records. Experimental results demonstrate that the proposed method achieves strong performance on datasets containing cyber black market chat records. The integration of technologies such as RAG and CoT improves the performance of individual agents in their respective subtasks, indicating promising real-world applicability.
References:
[1] 皮勇. 网络黑灰产刑法规制实证研究[J]. 国家检察官学院学报, 2021, 29(1): 18-40 PI Yong. An empirical study on the criminal regulation of cyber black and grey industries[J]. Journal of National Prosecutors College, 2021, 29(1): 18-40
[2] BASHEER R, ALKHATIB B. Threats from the dark: a review over dark web investigation research for cyber threat intelligence[J]. Journal of computer networks and communications, 2021(1): 1302999
[3] CHEN Guangxuan, LIU Qiang, CHEN Guangxiao, et al. Exploring illicit personal information trading behind telecom fraud in China[J]. Humanities and social sciences communications, 2025, 12(1): 1-11
[4] 斯彬洲, 孙海春, 吴越. 基于大语言模型和事件融合的电信诈骗事件风险分析[J]. 数据分析与知识发现, 2025, 9(7): 38-51 SI Binzhou, SUN Haichun, WU Yue. Risk analysis of telecom fraud events based on large language models and event fusion[J]. Data analysis and knowledge discovery, 2025, 9(7): 38-51
[5] XU Zequan, LI Lianyun, LI Hui, et al. Self-supervised graph representation learning for black market account detection[C]//The Sixteenth ACM International Conference on Web Search and Data Mining. Singapore: ACM, 2023: 330-338.
[6] WANG Qichao, MA Huan, WEI Wentao, et al. Attention paper: how generative AI reshapes digital shadow industry?[C]//Proceedings of the ACM Turing Award Celebration Conference-China 2023. Wuhan: ACM, 2023: 143-144.
[7] GUMPHUSIRI P, TRIYASON T. Synthetic data for scam detection: leveraging LLMs to train deep learning models[C]//2024 IEEE/WIC International Conference on Web Intelligence and Intelligent Agent Technology. Bangkok: IEEE, 2024: 868-873.
[8] 王媛媛, 范潮钦, 苏玉海. 面向聊天记录的语义分析研究[J]. 信息网络安全, 2017(9): 89-92 WANG Yuanyuan, FAN Chaoqin, SU Yuhai. Research on semantic analysis for chat records[J]. Netinfo security, 2017(9): 89-92
[9] KIM Y. Convolutional neural networks for sentence classification[C]//Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing. Doha: ACM, 2014: 1746-1751.
[10] HUANG Zhiheng, XU Wei, YU Kai. Bidirectional LSTM-CRF models for sequence tagging[EB/OL]. (2015-08-09)[2025-01-01]. https://arxiv.org/abs/1508.01991.
[11] DEVLIN J, CHANG M W, LEE K, et al. BERT: pre-training of deep bidirectional transformers for language understanding[C]//Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics. Minneapolis: ACL, 2019: 4171-4186.
[12] SUN Yu, WANG Shuohuan, LI Yukun, et al. ERNIE: enhanced representation through knowledge integration[EB/OL]. (2019-04-19)[2025-01-01]. https://arxiv.org/abs/1904.09223.
[13] 朱恩德, 王威, 高见. 融合BiLSTM与CNN的推特黑灰产分类模型[J]. 计算机工程与应用, 2025, 61(1): 186-195 ZHU Ende, WANG Wei, GAO Jian. Twitter black and grey industry classification model integrating BiLSTM and CNN[J]. Computer engineering and applications, 2025, 61(1): 186-195
[14] 张婷. 数字经济时代数据犯罪的风险挑战与理念更新——以数据威胁型网络黑灰产为观察对象[J]. 法学论坛, 2022, 37(5): 121-128 ZHANG Ting. Risk challenges and concept renewal of data crime in the digital economy era: taking data-threatening cyber black and grey industries as the observation object[J]. Legal forum, 2022, 37(5): 121-128
[15] ALDAIHAN A, ALOTAIBI F , MAFFEIS S. Clouseau: a hierarchical multi-agent approach for cyber attack investigation[C]//2025 IEEE Annual Computer Security Applications Conference. Honolulu: ACM, 2025: 516–532.
[16] FARD A M, ESTER M. Collaborative mining in multiple social networks data for criminal group discovery[C]//Proceedings of the 2009 International Conference on Computational Science and Engineering . Vancouver: IEEE, 2009: 582-587.
[17] 胡今鸣, 胡啸峰, 石磊, 等. 基于强化学习的超高层建筑非法入侵情景推演方法[J]. 智能系统学报, 2025, 20(4): 958-968 HU Jinming, HU Xiaofeng, SHI Lei, et al. Scenario deduction method for illegal intrusion into super high-rise buildings based on reinforcement learning[J]. CAAI transactions on intelligent systems, 2025, 20(4): 958-968
[18] 罗双春, 黄诚, 孙恩博. 基于目标识别与主题引导对话的黑灰产威胁情报挖掘[J]. 信息安全学报, 2025, 10(3): 35-47 LUO Shuangchun, HUANG Cheng, SUN Enbo. Threat intelligence mining for black and grey industries based on target recognition and topic-guided dialogue[J]. Journal of cyber security, 2025, 10(3): 35-47
[19] 芮兰兰, 邓淑予, 陈子轩, 等. 基于多智能体深度强化学习的智能网联汽车服务迁移优化方法[J]. 通信学报, 2026, 47(1): 141-155 RUI Lanlan, DENG Shuyu, CHEN Zixuan, et al. Service migration optimization method for intelligent connected vehicles based on multi-agent deep reinforcement learning[J]. Journal on communications, 2026, 47(1): 141-155
[20] 黄艳, 李小龙, 王权森, 等. 基于决策思维链驱动和多智能体协同的防洪大模型构建与实践[J]. 水利学报, 2026, 57(6): 918-931 HUANG Yan, LI Xiaolong, WANG Quansen, et al. Construction and practice of a flood control large model driven by decision-making chain-of-thought and multi-agent collaboration[J]. Journal of hydraulic engineering, 2026, 57(6): 918-931
[21] 马晓飞, 王中钰, 王佳. “人工智能+”公共政策研究: 基于通用人工智能驱动的多智能体仿真方法(AGI+MAS)[J/OL]. 电子政务, 1-12[2026-04-01]. MA Xiaofei, WANG Zhongyu, WANG Jia. “Artificial Intelligence+” Public Policy Research: A Multi-Agent Simulation Method Driven by Artificial General Intelligence (AGI+MAS)[J/OL]. E-Government, 1-12[2026-04-01].
[22] HE Junda, TREUDE C, LO D. LLM-based multi-agent systems for software engineering: literature review, vision and the road ahead[J]. ACM transactions on software engineering and methodology, 2025, 34(5): 1-30
[23] 李衡峰, 郑榕, 邓菁, 等. 基于大模型的电信网络诈骗预警技术研究[J]. 警察技术, 2025(4): 13-18 LI Hengfeng, ZHENG Rong, DENG Jing, et al. Research on early warning technology for telecom network fraud based on large models[J]. Police technology, 2025(4): 13-18
[24] ZHU Mingjie , LI Mingcheng , CUI Mingzhang, et al. A survey on large language model-based multi-agent systems: paradigms, applications, and challenges[EB/OL]. (2026-02-20)[2026-04-01]. https://www.techrxiv.org/doi/full/10.36227/techrxiv.177160638.89229642/v1.
[25] 窦路遥, 魏凤, 邓阿妹, 等. 高价值专利的价值自动解释研究——基于多智能体技术[J/OL]. 图书情报工作, 1-20[2026-04-01]. DOU Luyao, WEI Feng, DENG Amei, et al. Research on automatic value interpretation of high-value patents based on multi-agent technology[J/OL]. Library and information service, 1-20[2026-04-01].
[26] 张益伟, 梁丽芝, 周璧. 基于LLM语义生成和GAT图结构表征的黑灰产情报检测[J]. 情报杂志, 2026, 45(4): 91-101 Zhang Yiwei, Liang Lizhi, Zhou Bi. Black and Grey Industry Intelligence Detection Based on LLM Semantic Generation and GAT Graph Structure Representation[J]. Journal of Intelligence, 2026, 45(4): 91-101
[27] ALHUZALI A. LLM-powered threat intelligence: a retrieval-augmented generation approach for cyber attack investigation[J]. Peer J computer science, 2025, 11: e3371
[28] BLEFARI F, COSENTINO C, PIRONTI F A, et al. CyberRAG: an agentic RAG cyber attack classification and reporting tool[EB/OL]. (2025-07-03)[2025-07-10]. https://arxiv.org/abs/2507.02424.
[29] 石拓, 曾昭龙, 韩娜. 融合大语言模型和语义聚类的电信网络诈骗引流话术文本分析[J]. 情报杂志, 2025, 44(10): 105-112 SHI Tuo, ZENG Zhaolong, HAN Na. Text analysis of telecom network fraud inducement scripts integrating large language models and semantic clustering[J]. Journal of intelligence, 2025, 44(10): 105-112
[30] 尚思佳, 陈晓淇, 林靖淞, 等. 基于图挖掘的黑灰产运作模式可视分析[J]. 信息安全研究, 2024, 10(1): 48-54 SHANG Sijia, CHEN Xiaoqi, LIN Jingsong, et al. Visual analysis of black and grey industry operation patterns based on graph mining[J]. Journal of information security research, 2024, 10(1): 48-54
[31] 李明锋, 李欣, 王军杰, 等. 面向情报文本的多智能体无监督事件骨架生成方法[J]. 情报杂志, 2026, 45(4): 110-120 LI Mingfeng, LI Xin, WANG Junjie, et al. A multi-agent unsupervised event skeleton generation method for intelligence text[J]. Journal of intelligence, 2026, 45(4): 110-120
[32] WEI J, WANG Xuezhi, SCHUURMANS D, et al. Chain-of-thought prompting elicits reasoning in large language models[J]. Advances in neural information processing systems, 2022, 35: 24824-24837
[33] REIMERS N, GUREVYCH I. Sentence-BERT: sentence embeddings using siamese bert-networks[EB/OL]. (2019-08-27)[2025-01-01]. https://arxiv.org/abs/1908.10084.
[34] 赵颖, 付铄雯, 赵鑫, 等. 黑灰产网络资产图谱构建与可视化[J]. 计算机辅助设计与图形学学报, 2024, 36(8): 1181-1193 ZHAO Ying, FU Shuowen, ZHAO Xin, et al. Construction and visualization of cyber asset graph for black and grey industries[J]. Journal of computer-aided design & computer graphics, 2024, 36(8): 1181-1193
[35] 许浩. 金融黑灰产的新样态与刑法规制[J]. 法律适用, 2025(5): 115-131 XU Hao. New forms of financial black and grey industries and criminal law regulation[J]. Journal of law application, 2025(5): 115-131
[36] 张新平, 肖正隆. 后互联网时代网络黑灰产的法律应对与技术治理[J/OL]. 中南民族大学学报(人文社会科学版), 1-9[2026-04-01]. ZHANG Xinping, XIAO Zhenglong. Legal response and technological governance of cyber black and grey industries in the post-internet era[J/OL]. Journal of South-Central Minzu University (Humanities and Social Sciences), 1-9[2026-04-01].
Similar References:

Memo

-

Last Update: 2026-09-05

Copyright © CAAI Transactions on Intelligent Systems