分层多智能体框架下的黑灰产聊天记录分析方法

PDF下载HTML

Title:

Analysis method of black-gray industry chat records under hierarchical multi-agent framework

作者:

韦科顺¹, 石磊², 石拓³, 田一帆⁴, 程刚⁵

1. 对外经济贸易大学 法学院, 北京 100029;
2. 中国传媒大学 媒体融合与传播国家重点实验室, 北京 100024;
3. 北京警察学院 公安管理系, 北京 102202;
4. 中国人民公安大学 信息网络安全学院, 北京 100038;
5. 应急管理大学 计算机与信息安全学院, 北京 101601

Author(s):

WEI Keshun¹, SHI Lei², SHI Tuo³, TIAN Yifan⁴, CHENG Gang⁵

1. School of Law, University of International Business and Economics, Beijing 100029, China;
2. State Key Laboratory of Media Convergence and Communication, Communication University of China, Beijing 100024, China;
3. Department of Public Security Management, Beijing Police College, Beijing 102202, China;
4. College of Information and Cyber Security, People’s Public Security University of China, Beijing 100038, China;
5. School of Computer Science and Information Security, University of Emergency Management, Beijing 101601, China

关键词:

网络黑灰产; 大模型; 多智能体; 聊天记录分析; 检索增强生成; 思维链; 文本挖掘; 犯罪情报分析

Keywords:

cyber black market; large model; multi-agent; chat record analysis; retrieval-augmented generation; chain-of-thought; text mining; criminal intelligence analysis

分类号:

TP391.1

DOI:

10.11992/tis.202603037

摘要:

网络黑灰产聊天记录作为地下产业链交互的直接载体，蕴含了大量潜在犯罪意图与组织脉络线索。如何从海量非结构化文本中精准识别黑话术语，深度挖掘犯罪类型与行为模式，成为突破传统研判瓶颈、实现黑灰产情报智能化感知的关键课题。为此，本文提出一种基于大模型的多智能体协同分析方法。方法采用工作流式编排与任务分工机制，将黑话识别、类别判定、模式挖掘、报告生成四大核心环节按预定流程串联协同，同时引入检索生成增强(retrieval-augmented generation, RAG)、思维链(chain-of-thought, CoT)、批处理、高层次模式提取等技术，突破了传统单一模型在处理长链路复杂逻辑时的能力瓶颈，实现从原始数据到智能分析报告的端到端转化，提升了黑灰产聊天记录分析研判的智能化水平。实验结果显示，该方法在网络黑灰产聊天记录数据集上具有良好表现，检索生成增强、思维链等相关技术的引入，有效提升了各智能体在子任务中的表现，具备良好的实际应用价值。

Abstract:

As direct carriers of underground industry chain interactions, cyber black market chat records embed substantial implicit criminal intentions and organizational clues. The accurate identification of jargon from vast amounts of unstructured text along with the deep mining of criminal types and behavioral patterns has emerged as a critical challenge in overcoming traditional analytical bottlenecks and enabling intelligent insights into cyber black market intelligence. This study proposes a large-model-based multi-agent collaborative analysis method. The method employs a workflow-oriented orchestration and task division framework that sequentially coordinates four core processes in a predefined workflow: jargon identification, category determination, pattern mining, and report generation. It also integrates technologies such as retrieval-augmented generation (RAG), chain-of-thought (CoT), batch processing, and high-level pattern extraction. This approach overcomes the limitations of traditional single models in handling long-chain, complex logical tasks, achieving an end-to-end transformation from raw data to intelligent analysis reports and enhancing the analytical capabilities for cyber black market chat records. Experimental results demonstrate that the proposed method achieves strong performance on datasets containing cyber black market chat records. The integration of technologies such as RAG and CoT improves the performance of individual agents in their respective subtasks, indicating promising real-world applicability.