사용자 정보 기반 사이버 범죄 프로파일링 LLM 모델

다국어 초록 (Multilingual Abstract)

The importance of profiling using open-source intelligence (OSINT) is increasing to counter increasingly sophisticated and intelligent cybercrime. However, existing OSINT analysis relies on manual and fragmented information collection, resulting in significant variation in outcomes depending on the analyst's capabilities. It also requires considerable time and effort to find meaningful connections within vast amounts of data. This paper proposes a novel cybercrime profiling model that overcomes these limitations by employing the inference capabilities of large language models (LLMs) as its core engine. The proposed model adopts a system architecture where an LLM-based autonomous reasoning agent collaborates with human analysts to dramatically reduce initial profiling time. This system receives seed information (e.g., user emails, IDs) to establish optimal analysis scenarios, with specialized agents then collecting and analyzing information using OSINT tools. The gathered information is fused by the LLM, and through a cyclical feedback structure, the profile is progressively refined. The model developed through this research demonstrated the ability to reconstruct the user's profile and the flow of events in a multidimensional manner through inference during the initial investigation stage, suggesting investigative directions. This significantly improves the accuracy and efficiency of profiling compared to existing methods. This research is expected to serve as the cornerstone for developing next-generation intelligent investigation systems utilizing LLMs.