{"title":"Now You See Me: Identifying Duplicate Network Personas","authors":"Sean Suehr, Chrysafis Vogiatzis","doi":"10.1109/EISIC.2018.00012","DOIUrl":"https://doi.org/10.1109/EISIC.2018.00012","url":null,"abstract":"This work provides a decision-making framework at the intersection of social network analysis and law enforcement intelligence with the goal of identifying persons of interest in a social network. Criminal social networks are complex due to the limited and imperfect information available. Moreover, the participating entities tend to misrepresent themselves in order to stay hidden and covert. In this work, we propose a new integer programming formulation to assist in the identification of entities who are prone to misrepresent themselves in a social network. Our insight is that such personas will form large subgraphs of restricted diameter that are connected to other entities who do not communicate directly or within a short number of intermediates. We formally define the problem and derive its computational complexity. Additionally, we provide an integer programming formulation to solve it exactly with the use of a commercial solver. We then show how our framework behaves on the Krebs 9/11 network. Our approach is able to identify what are believed to be two distinct clusters of criminals participating in two separate subplots: the multiple flight hijacking on September 11; as well as a plot against the U.S. embassy in Paris in the year 2001.","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128589703","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Proceedings 2018 European Intelligence and Security Informatics Conference","authors":"","doi":"10.1109/eisic.2018.00002","DOIUrl":"https://doi.org/10.1109/eisic.2018.00002","url":null,"abstract":"","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125639989","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
I. Martín, José Alberto Hernández, Sergio de los Santos, Antonio Guzmán
{"title":"Analysis and Evaluation of Antivirus Engines in Detecting Android Malware: A Data Analytics Approach","authors":"I. Martín, José Alberto Hernández, Sergio de los Santos, Antonio Guzmán","doi":"10.1109/EISIC.2018.00010","DOIUrl":"https://doi.org/10.1109/EISIC.2018.00010","url":null,"abstract":"Given the high popularity of Android devices, the amount of malware applications in Android markets has been growing at a fast pace in the past few years. However, the concept of malware is something vague since it often occurs that AntiVirus engines flag an application as malware while others do not, having no real consensus between different engines. With the help of data analytics applied to more than 80 thousand malware applications, this work further investigates on the relationships between different AntiVirus engines, showing that some of them are highly correlated while others behave totally uncorrelated from others. Finally, we propose a new metric based on Latent Variable Models to identify which engines are more powerful in identifying true malware applications","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131374119","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Online Monitoring of Large Events","authors":"Johan Fernquist, Lisa Kaati","doi":"10.1109/EISIC.2018.00015","DOIUrl":"https://doi.org/10.1109/EISIC.2018.00015","url":null,"abstract":"In this paper, we describe an approach that can be used to monitor activity online that concerns large events. We propose six different tasks that can be used separately or in combination. The different tasks include analyzing messages from various actors, understanding the impact of messages to receivers, studying online discussions, analyzing hate and threats directed towards people and threats towards the execution of the large event and finally if there are any ongoing influential operations directed towards the general public. To illustrate how the approach can be used, we provide some examples of the different steps when monitoring online environments a few months before the Swedish general election in 2018.","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"28 3","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114135551","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Multi-Expert Estimations of Burglars' Risk Exposure and Level of Pre-Crime Preparation Using Coded Crime Scene Data: Work in Progress","authors":"Martin Boldt, V. Boeva, Anton Borg","doi":"10.1109/EISIC.2018.00021","DOIUrl":"https://doi.org/10.1109/EISIC.2018.00021","url":null,"abstract":"Law enforcement agencies strive to link crimes perpetrated by the same offenders into crime series in order to improve investigation efficiency. Such crime linkage can be done using both physical traces (e.g., DNA or fingerprints) or “soft evidence” in the form of offenders' modus operandi (MO), i.e. their behaviors during crimes. However, physical traces are only present for a fraction of crimes, unlike behavioral evidence. This work-in-progress paper presents a method for aggregating multiple criminal profilers' ratings of offenders' behavioral characteristics based on feature-rich crime scene descriptions. The method calculates consensus ratings from individual experts' ratings, which then are used as a basis for classification algorithms. The classification algorithms can automatically generalize offenders' behavioral characteristics from cues in the crime scene data. Models trained on the consensus rating are evaluated against models trained on individual profiler's ratings. Thus, whether the consensus model shows improved performance over individual models.","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126059684","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Matthew Price-Williams, Melissa J. M. Turcotte, N. Heard
{"title":"Time of Day Anomaly Detection","authors":"Matthew Price-Williams, Melissa J. M. Turcotte, N. Heard","doi":"10.1109/EISIC.2018.00009","DOIUrl":"https://doi.org/10.1109/EISIC.2018.00009","url":null,"abstract":"Anomaly detection systems have been shown to perform well in detecting compromised user credentials within an enterprise computer network. Most existing approaches have focused on modelling activities that users perform within the network but not the time at which users are active. This article presents an approach for identifying compromised user credentials based on modelling their time of day or diurnal patterns. Anomalous behaviour in this respect would correspond to a user working during hours that deviate from their normal historical behaviour. The methodology is demonstrated using authentication data from Los Alamos National Laboratory's enterprise computer network.","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127836750","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Heuristic Method for Identifying Scam Ads on Craigslist","authors":"Hamad Alsaleh, Lina Zhou","doi":"10.1109/EISIC.2018.00019","DOIUrl":"https://doi.org/10.1109/EISIC.2018.00019","url":null,"abstract":"Craigslist is a popular online customer-to-customer marketplace, which has attracted millions of consumers for trading and purchasing secondhand items. Because of the high financial return that sellers could gain from using this site and the anonymity option that the website provides to its users, Craigslist is highly subject to fraudulent activities. The primary objective of this study is to detect scam ads on Craigslist. Based on the related literature and our observations of ads collected from the platform, we develop a heuristic method for identifying scam ads. We evaluate the proposed heuristics by conducting an experiment and performing additional data analyses using real data. The results provide preliminary evidence for efficacy of the heuristics developed in this study.","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"200 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123019609","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Harmonizing Criminal Law Provisions on Money Laundering - A Litmus Test of European Integration","authors":"Tatu Hyttinen, Saila Heinikoski","doi":"10.1109/EISIC.2018.00013","DOIUrl":"https://doi.org/10.1109/EISIC.2018.00013","url":null,"abstract":"This article discusses the harmonization of penal provisions concerning money laundering in the European Union (EU), in particular, the recent Commission proposal for a Directive on tackling money laundering by criminal law (COM(2016) 826 final). The perspective is both legal and political, pointing out to the different legal solutions in the European Union and analyzing the development from a European integration perspective, particularly in terms of a socalled spill-over process, whereby integration in one field leads to integration in adjacent fields. We put forward two main arguments in this article: (1) We argue that in order for the spillover to succeed in a field crucial for national sovereignty such as criminal law, spill-over needs to be complemented with securitization and policy laundering, the latter referring to the phenomenon whereby issues are agreed at an international nonbinding arena in order to later introduce these “international standards” into binding legislation. (2) We argue that harmonization in the money laundering context provides an example of a successful spill-over enhanced by policy laundering and securitization; tackling money laundering ostensibly requires spilling over European integration also in the field of criminal law, a core issue of national sovereignty. A testament to this is the fact that European countries have even harmonized their criminalization of self-laundering, although punishable self-laundering has been previously considered contrary to the general doctrines and principles of criminal law in many countries. A case in point is Finland, the only country bound by the proposed directive where parties to the crime are not punished for money laundering, except in rare cases and there is no case law for self-laundering (Section 11 Chapter 32 of the Criminal Code of Finland).","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127422913","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
D. Schreiber, Martin Boyer, Elisabeth Broneder, Andreas Opitz, S. Veigl
{"title":"Generic Object and Motion Analytics for Accelerating Video Analysis within VICTORIA","authors":"D. Schreiber, Martin Boyer, Elisabeth Broneder, Andreas Opitz, S. Veigl","doi":"10.1109/EISIC.2018.00024","DOIUrl":"https://doi.org/10.1109/EISIC.2018.00024","url":null,"abstract":"Video recordings have become a major resource for legal investigations after crimes and terrorist acts. However, currently no mature video investigation tools are available and trusted by LEAs. The project VICTORIA (Video analysis for Investigation of Criminal and TerrORist Activities) [1] addresses this need and aims to deliver a Video Analysis Platform (VAP) that will accelerate video analysis tasks by a factor of 15 to 100. We describe concept and work in progress done by AIT GmbH within the project, focusing on the development of a state-of-the-art tool for generic object detection and tracking in videos. We develop a detection, classification and tracking tool, based on Deep Neural Networks (DNNs), trained on a large number of object classes, and optimized for the project context. Tracking is extended to the multi-class multi-target case. The generic object and motion analytics is integrated in a novel framework developed by AIT, denoted as Connected Vision.","PeriodicalId":110487,"journal":{"name":"2018 European Intelligence and Security Informatics Conference (EISIC)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127418048","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}