BEACON: A Unified Behavioral-Tactical Framework for Explainable Cybercrime Analysis with Large Language Models

2025-12-06

AI Summary

Existing cybercrime analysis frameworks emphasize technical aspects while neglecting psychological manipulation mechanisms, lacking systematic, interpretable, and scalable modeling of cognitive bias exploitation. Method: We propose the first dual-dimensional analytical framework integrating behavioral psychology and tactical lifecycle modeling. It introduces prospect theory and persuasion principles into cybercrime analysis, defines six psychological manipulation patterns, and couples them with a 14-stage tactical process for joint psychotechnical modeling. Leveraging large language models, we employ parameter-efficient fine-tuning to support multi-label classification and generation of human-readable, logically grounded explanations. Contribution/Results: Evaluated on real-world and synthetically augmented datasets, our framework achieves a 20% accuracy improvement over baselines. It also significantly outperforms state-of-the-art methods in ROUGE and BERTScore metrics, enabling effective case linkage and proactive fraud detection.

Technology Category

• Cognitive Modeling & Cognitive Systems: Simulating Human Behavior
• Natural Language Processing: Sentiment Analysis, Stylistic Analysis, and Argument Mining
• Machine Learning: Evaluation and Analysis

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods
• Security and Privacy: Cyber-crime defenses and forensics

Abstract

Cybercrime increasingly exploits human cognitive biases in addition to technical vulnerabilities, yet most existing analytical frameworks focus primarily on operational aspects and overlook psychological manipulation. This paper proposes BEACON, a unified dual-dimension framework that integrates behavioral psychology with the tactical lifecycle of cybercrime to enable structured, interpretable, and scalable analysis of cybercrime. We formalize six psychologically grounded manipulation categories derived from Prospect Theory and Cialdini's principles of persuasion, alongside a fourteen-stage cybercrime tactical lifecycle spanning reconnaissance to final impact. A single large language model is fine-tuned using parameter-efficient learning to perform joint multi-label classification across both psychological and tactical dimensions while simultaneously generating human-interpretable explanations. Experiments conducted on a curated dataset of real-world and synthetically augmented cybercrime narratives demonstrate a 20 percent improvement in overall classification accuracy over the base model, along with substantial gains in reasoning quality measured using ROUGE and BERTScore. The proposed system enables automated decomposition of unstructured victim narratives into structured behavioral and operational intelligence, supporting improved cybercrime investigation, case linkage, and proactive scam detection.

Problem

• Integrates behavioral psychology with cybercrime lifecycle for structured analysis
• Fine-tunes a large language model for multi-label classification and explanations
• Automates decomposition of victim narratives into behavioral and operational intelligence

Innovation

• Unified dual-dimension framework integrating behavioral psychology and cybercrime tactics
• Fine-tuned large language model for joint multi-label classification and explanation
• Automated decomposition of narratives into structured behavioral and operational intelligence