1. A computer implemented method for identifying unknown illicit networks, a computer performing steps comprising: obtaining by the computer node data and link data for a plurality of nodes, the node data comprising attributes of a node, there being one or more links, each link representing an interaction between nodes and the link data comprising attributes associated with the link; training by the computer a node-based probability model iteratively using the node data and the link data, iterating until a stop condition is satisfied, each iteration recursively using a probability of each node as input for computation of a probability of each other node; training by the computer a topology-based model using network data; and solving by the computer a maximum likelihood problem based on said node probabilities from said recursive iteration, using as constraints output of said topology-based model, and determining whether each of said nodes is illicit (bad') or not ('good').