COPKIT is developing data-driven policing technologies to support Law Enforcement Agencies in preventing, investigating and mitigating crime and terrorism.
In this blog, Legind Technologies and Thales Nederland provide an overview of COPKIT’s Situation Assessment tools to analyse Darknet forum conversations and market advertisements for potential threats.
Situation assessment (SA) approaches support the determination of different characteristics such as what is the nature (or goal) of a specific criminal action, but also the risk (or threat level) associated to it, helping with prioritisation to deal with large volumes of potentially relevant material. The volume of information can rapidly render the manual assessment prohibitively time consuming and automated decision support systems can help the analyst.
Assessing a situation generally requires the combination of heterogeneous and uncertain information and advanced data analytics techniques through AI techniques.
Once data has been gathered, analysts often face a large amount of heterogeneous information from different sources, which they have to process for it to make sense given the context. This can, for example, include information and observations from a criminal case or of criminal activities in specific regions. In the COPKIT project, analysts encounter the situation assessment challenge when they want to analyse conversations from forums or social media or advertisements offering illegal goods or services posted on Dark Net Market (DNMs) places.
Situation assessment is also a critical key to create awareness that something is anomalous which leads to Knowledge discovery.
COPKIT’s Solution
The COPKIT project proposes two decision support approaches to situation assessment adapting to different challenges.
On the one hand, the COPKIT Legind Technologies (LTA) SA solution presented here focuses on the identification and analysis of threats in semi-structured data such as messages in forums, ads and emails. In a second approach, the Context Aware Threat and Situation Assessment estimators (CTSAE, developed by Thales Nederland), can help the analysts deal with the volume of possibly suspicious activities occurring on dark net markets to characterise and prioritise advertisements and present possible applications for strategic analysts for regional threat assessments.
LTA SA approach
The LTA tool focuses on conversations, as the often very short individual messages, such as posts and forum messages, are insufficient for understanding the full meaning.
The approach assumes that anomalies can be connected with suspicious activities and their analyses can reveal likely threats. Methodologically, it is a cyclic process comprising 4 steps: data gathering, anomaly detection¸ anomaly analysis, and threat analysis. The data gathering provides automated gathering of data (with meta-data) from the communication stream. The anomaly detection supports identification of time intervals including suspicious activities, while the anomaly analysis provides details about this interval in order to reveal new threats. The conversations are displayed in a table with the relevant indicators and a generated summary of the threat situation. Selected conversations are then visualized in conversation graphs. Finally, the threat analysis, assesses the threat and details provided in previous step.
Time chart showing threat indicators and an automatically generated textual summary of the threat situation in the time interval
Context Aware Threat and Situation Assessment estimators (CTSAE)
In the COPKIT project, different models are developed for the CTSAE tool serving different estimation goals. For the case investigation related to trafficking of firearms in Darknet markets (one of COPKIT’s use cases), models are developed to estimate the nature of a firearm offered in advertisements (by combining the result of the text processing, image processing and other information) or the priority associated to a set of advertisements that are thought to belong to the same case. Other models can be used by strategic analysts to assess the risk associated to a specific region for a specific type of firearm. The AI technique used (namely Probabilistic Graphical Models) combines the expert knowledge and machine learning in an efficient way, performing robust reasoning and incorporating uncertainty.
A model to characterise the nature of firearms sold in DNMs advertisements. The left side shows the combination of expert knowledge and machine learning used to construct the model
To learn more about the COPKIT Situation Assessment tools, watch the recording of our webinar.
For more information and updates, follow us on Twitter, LinkedIn and Facebook and feel free to contact our team at copkit@copkit.eu.
