Criminal Network Analysis Research Articles

Direct Evidence of Bitcoin Wash Trading

We use the internal trading records of a major Bitcoin exchange leaked by hackers to detect and characterize wash trading—a type of market manipulation in which a single trader clears the trader’s own limit orders to “cook” transaction records. Our finding provides direct evidence for the widely suspected “fake volume” allegation against cryptocurrency exchanges, which has so far only been backed by indirect estimation. We then use our direct evidence to evaluate various indirect techniques for detecting the presence of wash trades and find measures based on Benford’s law, trade size clustering, lognormal distributions, and structural breaks to be useful, whereas ones based on power law tail distributions to give opposite conclusions. We also provide suggestions to effectively apply various indirect estimation techniques. This paper was accepted by Professor Bruno Biais, finance. Funding: J. Li acknowledges support by the U.S. Department of Homeland Security [Grant 205187] through the Criminal Investigations and Network Analysis Center. Supplemental Material: The data files are available at https://doi.org/10.1287/mnsc.2021.01448 .

Inductive and transductive link prediction for criminal network analysis

The identification of potential offenders, who are more likely to form a new group and co-offend in a crime, plays an essential role in narrowing down law enforcement investigations and improving predictive policing. Once a crime is committed, focusing on linking it to previously reported crimes and reducing the inspections based on shreds of evidence and the behavior of offenders can also greatly help law enforcement agencies. However, classical investigative techniques are generally case-specific and rely mainly on police officers manually combining information from different sources. Therefore, automatic methods designed to support co-offender research and crime linkage would be beneficial. This paper proposes two graph-based machine learning frameworks to address these issues based on a burglary use case, the first being transductive link prediction, which seeks to predict emergent links between existing graph nodes (which represent offenders or criminal cases), and the other being inductive link prediction, where connections are found between a new case and existing nodes. Our experimental results show a prediction accuracy of 68.5% in co-offender prediction, a 75.83% predictive accuracy for transductive crime linkage, and up to 74.8% accuracy in inductive crime linkage.

Data Fusion-Link Prediction for Evolutionary Network with Deep Reinforcement Learning

The sophistication of covert activities employed by criminal networks with technology has been proven to be very challenging for criminal enforcement fraternity to cripple their activities. In view of this, law enforcement agencies need to be equipped with criminal network analysis (CNA) technology which can provide advanced and comprehensive intelligence to uncover the primary members (nodes) and associations (links) within the network. The design of tools to predict links between members mainly rely on Social Network Analysis (SNA) models and machine learning (ML) techniques to improve the precision of the model. The primary challenge of constructing classical ML models such as random forest (RF) with an acceptable level of accuracy is to obtain a large enough dataset to train the model. Obtaining a large enough dataset in the domain of criminal networks is a significant problem due to the stealthy and covert nature of their activities compared to social networks. The main objective of this research is to demonstrate that a link prediction model constructed with a relatively small dataset and dataset generated through self-simulation by leveraging on deep reinforcement learning (DRL) can contribute towards higher precision in predicting links. The training of the model was further fused with metadata (i.e. environment attributes such as criminal records, education level, age and police station proximity) in order to capture the real-life attributes of organised crimes which is expected to improve the performance of the model. Therefore, to validate the results, a baseline model designed without incorporating metadata (CNA-DRL) was compared with a model incorporating metadata (MCNA-DRL).

Situation-Aware Deep Reinforcement Learning Link Prediction Model for Evolving Criminal Networks

Evidently, criminal network activities have shown an increasing trend in terms of complexity and frequency, particularly with the advent of social media and modern telecommunication systems. In these circumstances, law enforcement agencies have to be armed with advance criminal network analysis (CNA) tools capable of uncovering with speed, probable key hidden relationships (links/edges) and players (nodes) in order to anticipate, undermine and cripple organised crime syndicates and activities. The development of link prediction models for network orientated domains is based on Social Network Analysis (SNA) methods and models. The key objective of this research is to develop a link prediction model that incorporates a fusion of metadata (i.e. environment data sources such as arrest warrants, judicial judgement, wiretap records and police station proximity) with a time-evolving criminal dataset in order to be aware of real-world situations to improve the quality of link prediction. Based on the review of related work, most of the models are constructed by leveraging on classical machine learning (ML) techniques such as support vector machine (SVM) without metadata fusion. The problem with the use of classical ML techniques is the lack of available domain dataset which is sufficiently large for training purpose. Compared to sociaI network, criminal network dataset by nature tends to relatively much smaller. In view of this, deep reinforcement learning (DRL) technique which could improve the training of models with the self-generated dataset is leveraged upon to construct the model. In this research, a purely time-evolving DRL model (TDRL-CNA) without metadata fusion is designed as a baseline for comparison with the metadata fusion model (FDRL-CNA). The experimental results show that the predictive accuracy of new and recurrent links by the FDRL-CNA model is higher than the baseline TDRL-CNA model that does not factor data fusion from different data sources.

Assessing the missing data problem in criminal network analysis using forensic DNA data

Missing data is pertinent to criminal networks due to the hidden nature of crime. Generally, researchers evaluate the impact of incomplete network data by extracting or adding nodes and/or edges from a known network. Statistics on this reduced or completed network are then compared with statistics from the known network. In this study, we integrate police data on known offenders with DNA data on unknown offenders. Statistics from the integrated dataset (‘known network’) are compared with statistics from the police data (‘reduced network’). Networks with both known and unknown offenders are bigger but also have a different structure to networks with only known offenders.

Performance optimization of criminal network hidden link prediction model with deep reinforcement learning

The scale of criminal networks (e.g. drug syndicates and terrorist networks) extends globally and poses national security threat to many nations as they also tend to be technologically advance (e.g. Dark Web and Silk Road cryptocurrency). Therefore, it is critical for law enforcement agencies to be equipped with the latest tools in criminal network analysis (CNA) to obtain key hidden links (relationships) within criminal networks to preempt and disrupt criminal network structures and activities. Current hidden or missing link predictive models that are based on Social Network Analysis models rely on ML techniques to improve the performance of the models in terms of predictive accuracy and computing power. Given the improvement in the recent performance of Deep Reinforcement Learning (DRL) techniques which could train ML models through self-generated dataset, DRL can be usefully applied to domains with relatively smaller dataset such as criminal networks. The objective of this study is to assess the comparative performance of a CNA hidden link prediction model developed using DRL techniques against classical ML models such as gradient boosting machine (GBM), random forest (RF) and support vector machine (SVM). The experiment results exhibit an improvement in the performance of the DRL model of about 7.4% over the next best performing classical RF model trained within 1500 iterations. The performance of these link prediction models can be scaled up with the parallel processing capabilities of graphical processing units (GPUs), to significantly improve the speed of training the model and the prediction of hidden links.

Hidden Link Prediction in Criminal Networks Using the Deep Reinforcement Learning Technique

Criminal network activities, which are usually secret and stealthy, present certain difficulties in conducting criminal network analysis (CNA) because of the lack of complete datasets. The collection of criminal activities data in these networks tends to be incomplete and inconsistent, which is reflected structurally in the criminal network in the form of missing nodes (actors) and links (relationships). Criminal networks are commonly analyzed using social network analysis (SNA) models. Most machine learning techniques that rely on the metrics of SNA models in the development of hidden or missing link prediction models utilize supervised learning. However, supervised learning usually requires the availability of a large dataset to train the link prediction model in order to achieve an optimum performance level. Therefore, this research is conducted to explore the application of deep reinforcement learning (DRL) in developing a criminal network hidden links prediction model from the reconstruction of a corrupted criminal network dataset. The experiment conducted on the model indicates that the dataset generated by the DRL model through self-play or self-simulation can be used to train the link prediction model. The DRL link prediction model exhibits a better performance than a conventional supervised machine learning technique, such as the gradient boosting machine (GBM) trained with a relatively smaller domain dataset.

A Proof of Concept Study for Criminal Network Analysis with Interactive Strategies

The communication data are becoming increasingly important for criminal network analysis nowadays, and these data provide a digital trace which can be regarded as a hidden clue to support the crack of criminal cases. Additionally, performing a timely and effective analysis on it can predict criminal intents and take efficient actions to restrain and prevent crimes. The primary work of our research is to suggest an analytical process with interactive strategies as a solution to the problem of characterizing criminal groups constructed from the communication data. It is expected to assist law enforcement agencies in the task of discovering the potential suspects and exploring the underlying structures of criminal network hidden behind the communication data. This process allows for network analysis with commonly used metrics to identify the core members. It permits exploration and visualization of the network in the goal of improving the comprehension of interesting microstructures. Most importantly, it also allows to extract community structures in an appropriate level with the label supervision strategy. Our work concludes illustrating the application of our interactive strategies to a real-world criminal investigation with mobile call logs.

Methods of detecting and analysis criminal networks based on billing information of cellular mobile operator

Nowadays it is difficult to imagine a modern person without such means of communication as the Internet and mobile communications. Almost all modern crimes starting from preparation and to commitment are carried out by using electronic means of communication and leave heterogeneous traces in cyberspace. In accordance with the law some of these tracks are collected and accumulated by law enforcement agencies. Because of large volumes of data they can’t be processed manually. Not long ago a separate scientific direction – analysis of social networks, with analysis of criminal networks as a subdivision, appeared at the crossing of sociology and the theory of complex networks. This paper proposes the structure of expert system aimed at detection and analysis of organized criminal groups on the basis of automatic data processing of billing information of mobile operators. A method is proposed which allows identify criminal groups based on a pool of regular social contacts in telephone communication networks. The proposed method was tested in real social and criminal networks and results are given in this paper. Methods of effective destructive actions planning and implementation of active operational measures in relation to organized crime are described. In addition, the author proposes the method of disclosing internal structure of criminal networks, based on the modification of the famous search algorithm of relevant web pages.

Discovering Hidden Networks in On-line Social Networks

Rapid developments in information technology and Web 2.0 have provided a platform for the evolution of terrorist organizations, extremists from a traditional pyramidal structure to a technology enabled networked structure. Growing presence of these subversive groups on social networking sites has emerged as one of the prominent threats to the society, governments and law enforcement agencies across the world. Identifying messages relevant to the domain of security can serve as a stepping stone in criminal network analysis. In this paper, we deploy a rule based approach for classifying messages in Twitter which can also successfully reveal overlapping clusters. The approach incorporates dictionaries of enriched themes where each theme is categorized by semantically related words. The message is vectorized according to the security dictionaries and is termed as ‗Security Vector'. The documents are classified in categories on the basis of security associations. Further, the approach can also be used along the temporal dimension for classifying messages into topics and rank the most prominent topics of conversation at a particular instance of time. We further employ social network analysis techniques to visualize the hidden network at a particular time. Some of the results of our approach obtained through experiment with information network of Twitter are also discussed.

Criminal Network Analysis inside Law Enforcement Agencies: A Data-Mining System Approach under the National Intelligence Model

All police forces in the UK, and many Forces in Europe and the USA, use the National Intelligence Model as a means to provide relevant, timely and actionable intelligence. Increased awareness of the benefits that criminal network analysis provides in discovering, analysing and visualising networked criminal activity has become an integral part of the intelligence model. Despite numerous research efforts, technology has not achieved the expected improvements in the quality of criminal network analysis intelligence and the time needed to create related intelligence products. As current tools focus on the provision of structural metrics in describing networked crime activity and neglect the integration with Force prioritisation tactics, intelligence outputs from current automated tools rarely produce immediately applicable intelligence products, but leave an operational gap between intelligence analyst and police officers, and numerous manual tasks for the analyst. Using the Cross Industry Standard Process for Data Mining, a database agnostic data-mining methodology, we propose a common standard to provide a structured approach to the manifold of analytical tasks in the process of criminal network analysis and show how those tasks relate to the intelligence model. We aim to depict the specific issues at each stage of the process and show how better results can be achieved through better integration of criminal network analysis and the intelligence cycle.

Differential Effects: Are the Effects Studied by Psychologists Really Linear and Homogeneous?

Linear regression and its variants like analysis of variance are arguably the most widely used statistical techniques in psychology. By using linear regression it is merely assumed rather than empirically tested that the effects of the predictor variables are linear and homogeneous across the distribution of the dependent variable. This is problematic because it biases a scientist’s reasoning and hinders possible practical and theoretical insights. Thus an important question to ask is: Are the effects studied by psychologists really linear and homogeneous? Generalized additive models (GAMs) and quantile regression can be used to pursue this question. Benefits of complementing linear regression with these approaches include the ability to tailor actions on the specific individual in practice and the opportunity to gain more advanced scientific knowledge, for example about non-linear effects. The use of GAMs and quantile regression is furthermore empirically demonstrated in an analysis of risk-seeking and criminal peer networks as predictors of violent crime in a representative sample of German youth (N = 44.610). Practical and theoretical consequences of the results are discussed. Psychological science could immensely benefit from studying non-linear and heterogeneous effects.

Mining criminal networks from unstructured text documents

Digital data collected for forensics analysis often contain valuable information about the suspects’ social networks. However, most collected records are in the form of unstructured textual data, such as e-mails, chat messages, and text documents. An investigator often has to manually extract the useful information from the text and then enter the important pieces into a structured database for further investigation by using various criminal network analysis tools. Obviously, this information extraction process is tedious and error-prone. Moreover, the quality of the analysis varies by the experience and expertise of the investigator. In this paper, we propose a systematic method to discover criminal networks from a collection of text documents obtained from a suspect’s machine, extract useful information for investigation, and then visualize the suspect’s criminal network. Furthermore, we present a hypothesis generation approach to identify potential indirect relationships among the members in the identified networks. We evaluated the effectiveness and performance of the method on a real-life cybercrimine case and some other datasets. The proposed method, together with the implemented software tool, has received positive feedback from the digital forensics team of a law enforcement unit in Canada.

A comparative study of social networking approaches in identifying the covert nodes

This paper categories and compares various works done in the field of social networking for covert networks. It uses criminal network analysis to categorize various approaches in social engineering like dynamic network analysis, destabilizing covert networks, counter terrorism, key player, subgroup detection and homeland security. The terrorist network has been takenfor study because of its network of individuals who spread from continents to continents and have an effective influence of their ideology throughout the globe. It also presents various metrics based on which thecentrality of nodes in the graphs could be identified and it’s illustrated based on a synthetic dataset for 9/11 attack. This paper will also discuss various open problems in this area.

Hiding in plain sight: criminal network analysis

The United States is faced with an increasingly complex criminal enterprise. Advances in technology, communications, transport, and economies enable a highly adaptive criminal element to hide in plain site. These advances provide criminal organizations with the same global boundaries and opportunities as legitimate organizations. As boundaries expand the data to be analyzed by law enforcement mounts at a geometrically astounding rate. In response, the nature of law enforcement intelligence analysis must evolve to cope with both the amount and complexity of the data. This requires new and adaptive methods of analysis. Researchers have found that the principles of network analysis can be applied to the analysis of terrorist and criminal organizations. This paper examines the combination of measures historically employed by intelligence analysts and network analysis software and methodologies to quantitatively and qualitatively examine criminal organizations.

Human capital and social capital in criminal networks: introduction to the special issue on the 7th Blankensee Colloquium

This essay and review on criminal network analysis provides an introduction to the special issue “Human Capital and Social Capital in Criminal Networks”. It traces the history of the application of network analysis in the study of organized crime since the early 1970s. It argues that while criminal network analysis has brought a new level of methodological rigor to the study of organized crime, a number of limitations have become apparent. These include the problem of missing data and the challenges encountered in adequately capturing latent structures, individual characteristics of network members and socio-ecological conditions.

Topological Analysis of Criminal Activity Networks: Enhancing Transportation Security

The security of border and transportation systems is a critical component of the national strategy for homeland security. The security concerns at the border are not independent of law enforcement in border-area jurisdictions because the information known by local law enforcement agencies may provide valuable leads that are useful for securing the border and transportation infrastructure. The combined analysis of law enforcement information and data generated by vehicle license plate readers at international borders can be used to identify suspicious vehicles and people at ports of entry. This not only generates better quality leads for border protection agents but may also serve to reduce wait times for commerce, vehicles, and people as they cross the border. This paper explores the use of criminal activity networks (CANs) to analyze information from law enforcement and other sources to provide value for transportation and border security. We analyze the topological characteristics of CAN of individuals and vehicles in a multiple jurisdiction scenario. The advantages of exploring the relationships of individuals and vehicles are shown. We find that large narcotic networks are small world with short average path lengths ranging from 4.5 to 8.5 and have scale-free degree distributions with power law exponents of 0.85-1.3. In addition, we find that utilizing information from multiple jurisdictions provides higher quality leads by reducing the average shortest-path lengths. The inclusion of vehicular relationships and border-crossing information generates more investigative leads that can aid in securing the border and transportation infrastructure.

Introduction to Social Network Analysis (SNA) as an investigative tool

Social behavior is brought about mainly through social ties and connections. Our contacts with other people shape our view of the world, reinforce our identity, and the interactions provide us with all kinds of opportunities and resources to get things done. The social capital associated with networks is also one of the primary ways facilitating crime. Therefore, the systematic analysis of criminal networks is considered a viable means to gain a more thorough understanding of criminal behavior. This paper is a general introduction to social network analysis (SNA) as an analytical tool for the study of adversary networks. The paper reviews some theoretical and key concepts, highlights functional applications, and presents a tentative protocol for data handling and coding. The discussion deals with some methodological issues, challenges and future developments in the field.

Personality Trait Based Simulation Model of the E-mail System

Within the area of criminal and terrorist social network analysis, there is little research being done on analysing the communication behavior of criminal and terrorist groups. In this paper, we describe the development of a conceptual simulation model of the e-mail system, which is based on the use of personality trait dimensions to model the e-mail traffic behavior of e-mail users. This conceptual simulation model is being used as a first step for further development in simulating criminal and terrorist communication behavior. We also describe the development of an e-mail traffic analyser system, which uses a decision tree to search for interesting e-mail traffic behavioral patterns, and uses social network and time-series visualisation to provide the details of the interesting traffic patterns. We demonstrate that the personality trait based e-mail system model is useful as a tool for generating e-mail traffic behavioral patterns and that decision trees are useful for finding interesting patterns in the e-mail traffic data.

Criminal network analysis and visualization

A new generation of data mining tools and applications work to unearth hidden patterns in large volumes of crime data.