Abstract Disinformation attacks that make use of social media platforms, e.g., the attacks orchestrated by the Russian “Internet Research Agency” during the 2016 U.S. Presidential election campaign and the 2016 Brexit referendum in the UK, have led to increasing demands from governmental agencies for AI tools that are capable of identifying such attacks in their earliest stages, rather than responding to them in retrospect. This research undertaken on behalf of the Canadian Armed Forces and Department of National Defence. Our ultimate objective is the development of an integrated set of machine-learning algorithms which will mobilize artificial intelligence to identify hostile disinformation activities in “near-real-time.” Employing The Dark Crawler, the Posit Toolkit, TensorFlow (Deep Neural Networks), plus the Random Forest classifier and short-text classification programs known as LibShortText and LibLinear, we have analysed a wide sample of social media posts that exemplify the “fake news” that was disseminated by Russia’s Internet Research Agency, comparing them to “real news” posts in order to develop an automated means of classification.

Online hacking forums have been used as communities where users, possibly cybercriminals, can learn and exchange knowledge, and purchase the necessary tools and information to commit various offences such as hacking, credit card/identity fraud, money laundering, and even cyberattacks on infrastructure. Monitoring these forums and identifying key players are important when investigating emergent threats and developing efficient disruption strategies. Literature shows the lack of studies regarding users' cross-forum activity. This paper presents an analysis of forum users' cross-posting in three hacking forums including user overlap among different hacking communities/forums and identify user roles based on the type of posts and their frequencies. This allows us to assess the impact of users and forums in terms of cybercrime victimization.

Hackers have established large online communities in the form of online discussion forums. These forums help hackers with their goals: to hack, commit credit card/identity fraud or theft, launder money, and carry out digital attacks on physical infrastructure. There is need from security organizations and law enforcement to monitor these activities to identify individuals of interest, emerging threats and malware, and develop effective disruption strategies. However, as studies have consistently shown that as these communities are disrupted, new ones emerge. This might lead users of these forums to not put all their eggs in a single forum but rather diversify their efforts across multiple forums, in which case the removal of a forum will not create a lot of damage to the overall larger community. This is where the literature falls short, there is a dearth of knowledge about how hackers behave across forums, whether they do diversify. This paper aims to add to this knowledge by studying hacker activity across 12 online discussion forums, and identifying users who might not be relevant in a single forum, but are key across the larger community. This would allow for the targeting of specific users and the disruption of the flow of information across the larger community.

The dark web is a concealed portion of the Internet that can only be accessed through specialized software. Although multiple dark web technologies exist, with a common trait of using encryption to enforce anonymity, the Tor network remains the most prominent dark web network. To visit websites on the network, the user must use a heavily modified Firefox browser. The use of encryption to achieve anonymity poses a significant challenge for law enforcement that wishes to monitor users and content for illicit activity. This study examines Tor by focusing on the network structures created between websites via hyperlinks. Examining hyperlinks can provide insight into how virtual communities form on a network. We explore traditional social disorganization principles as a basis to draw comparisons between these virtual communities and real-life crime-prone neighborhoods. Automated data collection techniques were used to leverage the interconnected nature of domains on Tor. Using social network analysis, website hyperlinks are examined and core sites are identified. The analysis shows that these core sites form a significant portion of all connections made on the network with a density of 0.132. This core serves a critical function and has implications for detecting how users connect on Tor.

Many corpora of intelligence interest are so large that it is impractical to read them entirely. Analysts need tools that will focus attention on significant structures and particular documents. Here we exploit singular value decomposition and word2vec as tools for this purpose, and compare them with one another in a real-world application -- a malware forum from the dark web.

The Tor Network, a hidden part of the Internet, is becoming an ideal hosting ground for illegal activities and services, including large drug markets, financial frauds, espionage, child sexual abuse. Researchers and law enforcement rely on manual investigations, which are both time-consuming and ultimately inefficient. The first part of this paper explores illicit and criminal content identified by prominent researchers in the dark web. We previously developed a web crawler that automatically searched websites on the internet based on pre-defined keywords and followed the hyperlinks in order to create a map of the network. This crawler has demonstrated previous success in locating and extracting data on child exploitation images, videos, keywords and linkages on the public internet. However, as Tor functions differently at the TCP level, and uses socket connections, further technical challenges are faced when crawling Tor. Some of the other inherent challenges for advanced Tor crawling include scalability, content selection tradeoffs, and social obligation. We discuss these challenges and the measures taken to meet them. Our modified web crawler for Tor, termed the “Dark Crawler” has been able to access Tor while simultaneously accessing the public internet. We present initial findings regarding what extremist and terrorist contents are present in Tor and how this content is connected to each other in a mapped network that facilitates dark web crimes. Our results so far indicate the most popular websites in the dark web are acting as catalysts for dark web expansion by providing necessary knowledgebase, support and services to build Tor hidden services and onion websites.

This research utilizes social network analysis to determine the success of three different disruption strategies on a child exploitation network extracted from the public internet. Using a custom-written web-crawler called LECEN, data from a set of hyperlinked child-exploitation websites was collected from the Internet. From these data, two types of networks were coded: the nodes of the first network consisted of only website domains, while the nodes of the second were generated using the registrant data, where the nodes represented the legal owners of those same domains. Three attack scenarios were carried out on these two networks: two types of hub attacks (one focused on in-degree and one focused on out-degree) and a bridge attack. Using these disruption strategies, it was found that bridge attacks were more suitable for disrupting the domain networks, while both hub-attacks could be favored when disrupting the network of registrants. These findings have implications for law enforcement, as it provides real-world applications to disruption where registrants may be targeted directly.

Information threatening the security of critical infrastructures are exchanged over the Internet through communication platforms, such as online discussion forums. This information can be used by malicious hackers to attack critical computer networks and data systems. Much of the literature on the hacking of critical infrastructure has focused on developing typologies of cyber-attacks, but has not examined the communication activities of the actors involved. To address this gap in the literature, the language of hackers was analyzed to identify potential threats against critical infrastructures using automated analysis tools. First, discussion posts were collected from a selected hacker forum using a customized web-crawler. Posts were analyzed using a parts of speech tagger, which helped determine a list of keywords used to query the data. Next, a sentiment analysis tool scored these keywords, which were then analyzed to determine the effectiveness of this method.

As the data generated on the internet exponentially increases, developing guided data collection methods become more and more essential to the research process. This paper proposes an approach to building a self-guiding web-crawler to collect data specifically from extremist websites. The guidance component of the web-crawler is achieved through the use of sentiment-based classification rules which allow the crawler to make decisions on the content of the webpage it downloads. First, content from 2,500 webpages was collected for each of the four different sentiment-based classes: pro-extremist websites, anti-extremist websites, neutral news sites discussing extremism and finally sites with no discussion of extremism. Then parts of speech tagging was used to find the most frequent keywords in these pages. Utilizing sentiment software in conjunction with classification software a decision tree that could effectively discern which class a particular page would fall into was generated. The resulting tree showed an 80% success rate on differentiating between the four classes and a 92% success rate at classifying specifically extremist pages. This decision tree was then applied to a randomly selected sample of pages for each class. The results from the secondary test showed similar results to the primary test and hold promise for future studies using this framework.

The advent of the internet has unfortunately increased the scale and complexity of child exploitation material (CEM) with content increasingly moving online, forming online CEM networks through a series of websites that are hyperlinked to each other and lead consumers from one website to another. Extending on prior research focusing on examining network structure and network disruption strategies it was prudent to expand avenues to increase attack strategies. Geolocation and Whois data were utilized to map the prevalence of CEM globally. Differences in the Geolocation and Whois data were observed, suggesting both are critical pieces of information in generating accurate geo-mapping of CEM. These maps show how multi-jurisdictional attack strategies may be employed to attack these networks and remove this content.

Abstract Crime attractors are locations (e.g. shopping malls) that attract criminally motivated offenders because of the presence of known criminal opportunities. Although there have been many studies that explore the patterns of crime in and around these locations, there are still many questions that linger. In recent years, there has been a growing interest to develop mathematical models in attempts to help answer questions about various criminological phenomena. In this paper, we are interested in applying a formal methodology to model the relative attractiveness of crime attractor locations based on characteristics of offenders and the crime they committed. To accomplish this task, we adopt fuzzy logic techniques to calculate the attractiveness of crime attractors in three suburban cities in the Metro Vancouver region of British Columbia, Canada. The fuzzy logic techniques provide results comparable with our real‐life expectations that offenders do not necessarily commit significant crimes in the immediate neighbourhood of the attractors, but travel towards it, and commit crimes on the way. The results of this study could lead to a variety of crime prevention benefits and urban planning strategies.

Social network analysis refers to the study of structural aspects in networks to understand and interpret social entities and related patterns. This form of research has proven to be very useful in the study of illicit networks. To date, however, large criminal court datasets that include a comprehensive scope of cases have yet to be explored. The current work begins to explore this potential by applying social network analysis methods to CourBC-an extensive multi-year database of adult criminal court records in the Province of British Columbia, Canada. Through a variety of network analysis methods, the authors explore the topology and structure of the database. Results demonstrate that the structure of the dataset is similar to that of other large criminal justice datasets yet there are some notable differences. The potential for this type of data in illicit network research and some specific areas for continued research in the field are discussed.

Within spatial analysis, the decision-making process of individuals involves six interconnected and fundamental elements: current location, destination, distances, and directions, time budgets and type of activity, all of which influence the movement of people in their environment. In this paper we develop a visualization technique allowing for the display of the aggregate travel paths of offenders in order to identify patterns with it. We show that the patterns in the movement for offenders follows that of the major travel routes within the area and is centered in locations of the city-hubs. Results also indicate that significant movement of offenders occur between cities, not just within cities. Consequently, it is shown that urban form and understanding place play a strong role in criminal patterns and offender movement through the city landscape.

Individuals frequently have routine daily activities that require commuting between several places, such as their home, work, shopping centres and recreational facilities. According to Crime Pattern Theory, offenders most likely commit opportunistic crimes, including serial and violent crimes, within their Activity Space, that is the space that they visit most frequently during the course of their daily routine activities, since they are aware of the opportunities and risks within these spaces. However, others within the social network of an offender can introduce the offender to new opportunities outside of his Activity Space, a phenomenon that Crime Pattern Theory does not address. This paper explores an important and interesting question about social networks: What is the relation between social and spatial distance of actors? We study this question in the context of crime and co-offending networks to better understand the impact of an offender's social network on the Activity Space of the offender. Our experiments on real-life crime data show that there is a strong correlation between social and spatial distance of offenders: offenders who are socially close are also spatially close.

Law enforcement and intelligence agencies have long realized that analysis of co-offending networks, networks of offenders who have committed crimes together, is invaluable for crime investigation, crime reduction and prevention. Investigating crime can be a challenging and difficult task, especially in cases with many potential suspects and inconsistent witness accounts or inconsistencies between witness accounts and physical evidence. We present here a novel approach to crime suspect recommendation based on partial knowledge of offenders involved in a crime incident and a known co-offending network. To solve this problem, we propose a random walk based method for recommending the top-K potential suspects. By evaluating the proposed method on a large crime dataset for the Province of British Columbia, Canada, we show experimentally that this method outperforms baseline random walk and association rule-based methods. Additionally, results obtained for public domain data from experiments for co-author recommendation on a DBLP co-authorship network are consistent with those on the crime dataset. Compared to the crime dataset, the performance of all competitors is much better on the DBLP dataset, confirming that crime suspect recommendation is an inherently harder task.

Computational criminology is an area of research that joins advanced theories in criminology with theories and methods in mathematics, computing science, geography and behavioural psychology. It is a multidisciplinary approach that takes the strengths of several disciplines and, with semantic challenges, builds new methods for the analysis of crime and crime patterns. This paper presents a developing algorithm for linking the geographic and cognitive psychology sides of criminology research with a prototype topology algorithm that joins local urban areas together using rules that define similarity between adjacent small units of analysis. The approach produces irregular shapes when mapped in a Euclidean space, but which follow expectations in a non-Euclidean topological sense. There are high local concentrations or hot spots of crime but frequently there is a sharp break on one side of the hot spot and with a gradual diffusion on the other. These shapes follow the cognitive psychological way of moving from one location to another without noticing gradual changes or conversely being aware of sharp changes from one location to the next. This article presents a pattern modeling approach that uses topology to spatially identify the concentrations of crime and their crisp breaks and gradual blending into adjacent areas using the basic components: interior, boundary and exterior. This topology algorithm is used to analyze crimes in a moderate sized city in British Columbia.

Spatial classification is the task of learning models to predict class labels based on the features of entities as well as the spatial relationships to other entities and their features. Spatial data can be represented as multi-relational data, however it presents novel challenges not present in multi-relational problems. One such problem is that spatial relationships are embedded in space, unknown a priori, and it is part of the algorithm’s task to determine which relationships are important and what properties to consider. In order to determine when two entities are spatially related in an adaptive and non-parametric way, we propose a Voronoi-based neighbourhood definition upon which spatial literals can be built. Properties of these neighbourhoods also need to be described and used for classification purposes. Non-spatial aggregation literals already exist within the multi-relational framework, but are not sufficient for comprehensive spatial classification. A formal set of additions to the multi-relational data mining framework is proposed, to be able to represent spatial aggregations as well as spatial features and literals. These additions allow for capturing more complex interactions and spatial occurrences such as spatial trends. In order to more efficiently perform the rule learning and exploit powerful multi-processor machines, a scalable parallelized method capable of reducing the runtime by several factors is presented. The method is compared against existing methods by experimental evaluation on a real world crime dataset which demonstrate the importance of the neighbourhood definition and the advantages of parallelization.

In this paper we present a more efficient record based caching model than the conventional page (disk block) based scheme. In a record caching model, individual records are stored together in a section of shared memory to form the cache. Traditional relational database systems have individual pages that are stored together in shared memory to form the cache and records are then extracted from these pages on demand. The record cache model has better memory utilization than the page model and also helps reduce overheads like page fetches/writes, page locks and code path.