A Bulletproof Business? Towards Detecting Infrastructure-as-a-Service Offerings on Telegram

2026-09-23

AI Summary

本文通过构建分类体系并使用TF-IDF分类器，识别Telegram上宣传非法基础设施服务的信息，以帮助监测和调查网络犯罪活动。

Abstract

Cybercriminal operations increasingly depend on reusable digital infrastructure---including hosting, proxies, and virtual private networks (VPNs)---rented through Cybercrime-as-a-Service markets and advertised on platforms such as Telegram. We present a taxonomy for identifying Telegram messages advertising cybercriminal Infrastructure-as-a-Service (IaaS). The taxonomy comprises six service categories across compute, network, and communication infrastructure, together with three trust attributes: Bulletproof, Payment Security, and Transparency. Using 261 human-annotated messages, we evaluate keyword-based and TF--IDF classifiers and examine prompt-based large language models as exploratory baselines. We select a TF--IDF pipeline and apply it to 1,116,071 messages from 167 cybercrime-related Telegram communities. The pipeline assigns at least one infrastructure category to 207,244 messages (18.57%) spanning 113 communities. Classified advertising is highly concentrated: a single community accounts for 50.3% of infrastructure-positive messages, while the trust-attribute classifiers identify Bulletproof claims in 37.66% of those messages. These findings characterize the scale, composition, and concentration of infrastructure advertising on Telegram and can inform the prioritization of communities and actors for monitoring and investigation.

Problem

• Cybercrime-as-a-Service
• Infrastructure-as-a-Service
• Telegram
• cybercriminal operations
• digital infrastructure

Innovation

• Taxonomy
• Infrastructure-as-a-Service (IaaS)
• Telegram
• Cybercrime
• Trust Attributes