With the rapid development of the Internet, cybersecurity situation is becoming more and more complex. At present, surface web and dark web contain numerous underground forums or markets, which play an important role in cybercrime ecosystem. Therefore, cybersecurity researchers usually focus on hacker-centered research on cybercrime, trying to find key hackers and extract credible cyber threat intelligence from them. The data scale of underground forums is tremendous and key hackers only represent a small fraction of underground forum users. It takes a lot of time as well as expertise to manually analyze key hackers. Therefore, it is necessary to propose a method or tool to automatically analyze underground forums and identify key hackers involved. In this work, we present HackerRank, an automatic method for identifying key hackers. HackerRank combines the advantages of content analysis and social network analysis. First, comprehensive evaluations and topic preferences are extracted separately using content analysis. Then, it uses an improved Topic-specific PageRank to combine the results of content analysis with social network analysis. Finally, HackerRank obtains users’ ranking, with higher-ranked users being considered as key hackers. To demonstrate the validity of proposed method, we applied HackerRank to five different underground forums separately. Compared to using social network analysis and content analysis alone, HackerRank increases the coverage rate of five underground forums by 3.14% and 16.19% on average. In addition, we performed a manual analysis of identified key hackers. The results prove that the method is effective in identifying key hackers in underground forums.

随着互联网的飞速发展，网络安全形势越来越复杂。目前，表面网络和黑暗网络包含许多地下论坛或市场，它们在网络犯罪生态系统中发挥着重要作用。因此，网络安全研究人员通常将重点放在以黑客为中心的网络犯罪研究上，试图找到关键的黑客并从中提取可信的网络威胁情报。地下论坛的数据规模巨大，主要黑客仅占地下论坛用户的一小部分。手动分析关键黑客需要大量时间和专业知识。因此，有必要提出一种方法或工具来自动分析地下论坛并识别涉及的主要黑客。在这项工作中，我们介绍了HackerRank，这是一种用于识别关键黑客的自动方法。HackerRank结合了内容分析和社交网络分析的优势。首先，使用内容分析分别提取综合评估和主题偏好。然后，它使用改进的特定于主题的PageRank将内容分析的结果与社交网络分析相结合。最后，HackerRank获得用户的排名，排名较高的用户被视为关键黑客。为了证明所提出方法的有效性，我们将HackerRank分别应用于五个不同的地下论坛。与仅使用社交网络分析和内容分析相比，HackerRank将五个地下论坛的覆盖率平均提高了3.14％和16.19％。此外，我们对发现的主要黑客进行了手动分析。