{"title":"Behavioural & Tempo-Spatial Knowledge Graph for Crime Matching through Graph Theory","authors":"Nadeem Qazi, W. Wong","doi":"10.1109/EISIC.2017.29","DOIUrl":"https://doi.org/10.1109/EISIC.2017.29","url":null,"abstract":"Crime matching process usually involves the time tedious and information intensive task of eliciting plausible associations among actors of crimes to identify potential suspects. Aiming towards the assistance of this procedure, we in this paper have exhibited the utilization of associative search; a relatively new search mining instrument to evoke conceivable associations from the information. We have demonstrated the use of threedimensional, i.e. spatial, temporal, and modus operandi based similarity matching of crime pattern to establish hierarchical associations among the crime entities. Later we used these to extract plausible suspect list for an unsolved crime to facilitate the crime matching process. A knowledge graph consisting of tree structure coupled with the iconic graphic is used to visualize the plausible list. Additionally, a similarity score is calculated to rank the suspect in the plausible list. The proposed visualization aims to assist in hypothesis formulation reducing computational influence in the decision making of criminal matching process.","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130897683","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Konstantinos F. Xylogiannopoulos, P. Karampelas, R. Alhajj
{"title":"Text Mining in Unclean, Noisy or Scrambled Datasets for Digital Forensics Analytics","authors":"Konstantinos F. Xylogiannopoulos, P. Karampelas, R. Alhajj","doi":"10.1109/EISIC.2017.19","DOIUrl":"https://doi.org/10.1109/EISIC.2017.19","url":null,"abstract":"In our era, most of the communication between people is realized in the form of electronic messages and especially through smart mobile devices. As such, the written text exchanged suffers from bad use of punctuation, misspelling words, continuous chunk of several words without spaces, tables, internet addresses etc. which make traditional text analytics methods difficult or impossible to be applied without serious effort to clean the dataset. Our proposed method in this paper can work in massive noisy and scrambled texts with minimal preprocessing by removing special characters and spaces in order to create a continuous string and detect all the repeated patterns very efficiently using the Longest Expected Repeated Pattern Reduced Suffix Array (LERP-RSA) data structure and a variant of All Repeated Patterns Detection (ARPaD) algorithm. Meta-analyses of the results can further assist a digital forensics investigator to detect important information to the chunk of text analyzed.","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131270482","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Cyberbullying System Detection and Analysis","authors":"Yee Jang Foong, M. Oussalah","doi":"10.1109/EISIC.2017.43","DOIUrl":"https://doi.org/10.1109/EISIC.2017.43","url":null,"abstract":"Abstract-Cyber-bullying has recently been reported as one that causes tremendous damage to society and economy. Advances in technology related to web-document annotation and the multiplicity of the online communities renders the detection and monitoring of such cases rather difficult and very challenging. This paper describes an online system for automatic detection and monitoring of Cyber-bullying cases from online forums and online communities. The system relies on the detection of three basic natural language components corresponding to Insults, Swears and Second Person. A classification system and ontology like reasoning have been employed to detect the occurrence of such entities in the forum / web documents, which would trigger a message to security in order to take appropriate action. The system has been tested on two distinct forums and achieves reasonable detection performances","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130762819","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Adversarial Machine Learning in Malware Detection: Arms Race between Evasion Attack and Defense","authors":"Lingwei Chen, Yanfang Ye, T. Bourlai","doi":"10.1109/EISIC.2017.21","DOIUrl":"https://doi.org/10.1109/EISIC.2017.21","url":null,"abstract":"Since malware has caused serious damages and evolving threats to computer and Internet users, its detection is of great interest to both anti-malware industry and researchers. In recent years, machine learning-based systems have been successfully deployed in malware detection, in which different kinds of classifiers are built based on the training samples using different feature representations. Unfortunately, as classifiers become more widely deployed, the incentive for defeating them increases. In this paper, we explore the adversarial machine learning in malware detection. In particular, on the basis of a learning-based classifier with the input of Windows Application Programming Interface (API) calls extracted from the Portable Executable (PE) files, we present an effective evasion attack model (named EvnAttack) by considering different contributions of the features to the classification problem. To be resilient against the evasion attack, we further propose a secure-learning paradigm for malware detection (named SecDefender), which not only adopts classifier retraining technique but also introduces the security regularization term which considers the evasion cost of feature manipulations by attackers to enhance the system security. Comprehensive experimental results on the real sample collections from Comodo Cloud Security Center demonstrate the effectiveness of our proposed methods.","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"23 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114571339","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Whose Hands Are in the Finnish Cookie Jar?","authors":"Jukka Ruohonen, V. Leppänen","doi":"10.1109/EISIC.2017.25","DOIUrl":"https://doi.org/10.1109/EISIC.2017.25","url":null,"abstract":"Web cookies are ubiquitously used to track and profile the behavior of users. Although there is a solid empirical foundation for understanding the use of cookies in the global world wide web, thus far, limited attention has been devoted for country-specific and company-level analysis of cookies. To patch this limitation in the literature, this paper investigates persistent third-party cookies used in the Finnish web. The exploratory results reveal some similarities and interesting differences between the Finnish and the global web---in particular, popular Finnish web sites are mostly owned by media companies, which have established their distinct partnerships with online advertisement companies. The results reported can be also reflected against current and future privacy regulation in the European Union.","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129730372","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Are We Really That Close Together? Tracing and Discussing Similarities and Differences between Greek Terrorist Groups Using Cluster Analysis","authors":"Ioanna K. Lekea, P. Karampelas","doi":"10.1109/EISIC.2017.33","DOIUrl":"https://doi.org/10.1109/EISIC.2017.33","url":null,"abstract":"This paper discusses the similarities and differences in both ideology expressed and practices employed by two terrorist groups that operated in Greece between the years of 1975 and 2017: Revolutionary Organization 17 November and Conspiracy of Fire Nuclei. Within this line of thought, we will briefly provide an outline of the political and ideological framework of the groups on focus in an effort to place them within the general historical and political context. We will then focus on the justification and deployment of the terrorist operations as presented in the communiqués published, as well as other announcements and notes distributed in the Social Media by the members of those two terrorist groups. In this context, we elaborate on the tactics of the terrorist groups: their targets, the weapons used and the consequences suffered as a result of their actions are analyzed, in order to evaluate their ideological and - perhaps - ethical standing. To analyze the communiqués of both organizations, two different text mining clustering techniques were applied and the outcomes enabled us to run a comparison between the two terrorist groups and also to examine the possibility of related means, ideology and people behind their different name.","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124044855","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Statistical Method for Detecting Significant Temporal Hotspots Using LISA Statistics","authors":"Martin Boldt, Anton Borg","doi":"10.1109/EISIC.2017.24","DOIUrl":"https://doi.org/10.1109/EISIC.2017.24","url":null,"abstract":"This work presents a method for detecting statistically significant temporal hotspots, i.e. the date and time of events, which is useful for improved planning of response activities. Temporal hotspots are calculated using Local Indicators of Spatial Association (LISA) statistics. The temporal data is in a 7x24 matrix that represents a temporal resolution of weekdays and hours-in-the-day. Swedish residential burglary events are used in this work for testing the temporal hotspot detection approach. Although, the presented method is also useful for other events as long as they contain temporal information, e.g. attack attempts recorded by intrusion detection systems. By using the method for detecting significant temporal hotspots it is possible for domain-experts to gain knowledge about the temporal distribution of the events, and also to learn at which times mitigating actions could be implemented.","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114491665","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Large Scale Data Collection of Tattoo-Based Biometric Data from Social-Media Websites","authors":"Michael Martin, J. Dawson, T. Bourlai","doi":"10.1109/EISIC.2017.27","DOIUrl":"https://doi.org/10.1109/EISIC.2017.27","url":null,"abstract":"The use of tattoos as a soft biometric is increasing in popularity among law enforcement communities. There is great need for large scale, publicly available tattoo datasets that can be used to standardize efforts to develop tattoo-based biometric systems. In this work, we introduce a large tattoo dataset (WVU-MediaTatt) collected from a social-media website. Additionally, we provide the source links to the images so that anyone can re-generate this dataset. Our WVU-MediaTatt database contains tattoo sample images from over 1,000 subjects, with two tattoo image samples per subject. To the best of our knowledge, this dataset is significantly bigger than any current released publicly available tattoo dataset, including the recently released NIST Tatt-C dataset. The use of social media in deep learning, data mining, and biometrics has traditionally been a controversial issue in terms of data security and protection of privacy. In this work, we first conduct a full discussion on the issues associated with data collection from social media sources for the use of biometric system development, and provide a framework for data collection. In this study, within the process of creating a new large scale tattoo dataset, we consider the issues and make attempts protect the subject's privacy and information, while ensuring that subjects remain in control of their data in this study and the use of the data adheres to the guidelines proposed by the Heath Care Compliance Association (HCCA) and the U.S. Department of Health & Human Services.","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"222 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134435115","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Matthew Price-Williams, N. Heard, Melissa J. M. Turcotte
{"title":"Detecting Periodic Subsequences in Cyber Security Data","authors":"Matthew Price-Williams, N. Heard, Melissa J. M. Turcotte","doi":"10.1109/EISIC.2017.40","DOIUrl":"https://doi.org/10.1109/EISIC.2017.40","url":null,"abstract":"Anomaly detection for cyber-security defence hasgarnered much attention in recent years providing an orthogonalapproach to traditional signature-based detection systems.Anomaly detection relies on building probability models ofnormal computer network behaviour and detecting deviationsfrom the model. Most data sets used for cyber-security havea mix of user-driven events and automated network events,which most often appears as polling behaviour. Separating theseautomated events from those caused by human activity is essentialto building good statistical models for anomaly detection. This articlepresents a changepoint detection framework for identifyingautomated network events appearing as periodic subsequences ofevent times. The opening event of each subsequence is interpretedas a human action which then generates an automated, periodicprocess. Difficulties arising from the presence of duplicate andmissing data are addressed. The methodology is demonstrated usingauthentication data from Los Alamos National Laboratory’senterprise computer network","PeriodicalId":436947,"journal":{"name":"2017 European Intelligence and Security Informatics Conference (EISIC)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-06-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122344161","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}