A Tool for Analysis and Visualization of Criminal Networks

2015 17th UKSIM-AMSS International Conference on Modelling and Simulation A Tool for Analysis and Visualization of Criminal Networks Amer Rasheed The Maersk Mc-Kinney Moeller Institute University of Southern Denmark Odense, Denmark amras@mmmi.sdu.dk Abstract Analyzing complexities in criminal networks is a complex issue. They become even worse when there is involvement of external collaborative networks. Criminal nodes in different criminal sub-groups combine together to form a big network. It is difficult to explore criminal activity that is building up among the sub-groups. Data from the initial investigations reveal only partial information. Hence, there is a need to find links between the data for getting adequate information. We have introduced novel visualization features that can help trace the collaborations of the individual criminal nodes with other nodes and detect the patterns of hidden criminal activities in the sub-clusters. The current study demonstrates our proposed visualization tool by using a case study of the Chicago narcotics datasets. The PEVNET tool can support crime analysts in analyzing the intra-network criminal activities. Our novel features will not only help the crime analysts in building a rationale but also in strengthening their viewpoints using PEVNET. Keywords-information visualization; investigative analysis; clustering; sub-cluster; criminal patterns I. INTRODUCTION Criminal networks are complex networks and are based on the acts of the offenders that are in the networks [1]. Knowledge of criminal networks is vital for developing techniques to combat probable criminal attacks [2]. There has been a profound discussion over the core structure, the relationships, and the infrastructure of criminal networks. The offenders try to hide their collaborative actions to conceal relationships. Pieces of collaborative information [1, 3] are combined to perform an investigative analysis (IA) [2]. With the aid of comprehensive IA, the concealed information can be disclosed. There has been a big shift in performing a manual analysis to visualize the datasets. In this regard, there are some visualization tools [1, 4] that have been introduced. The crime analysts usually intend to perform their analysis by visualization of the criminal networks. There are a number of reasons behind the intentions of these crime analysts. Some of these reasons include the simple, easy to use, and understandable interface provided by the visualization tools since interactivity plays a brilliant role in making visualization more understandable. Due to the above reasons, the crime analysts require advanced tools in order to perform their investigations. Uffe Kock Wiil The Maersk Mc-Kinney Moeller Institute University of Southern Denmark Odense, Denmark ukwiil@mmmi.sdu.dk We have focused on certain aspects of the criminal network analysis and have found certain issues. We believe that by fixing those issues and providing the analysts with a more analytical interface, support for decision making can be enhanced to a large extent. Social network analysis (SNA) describes the relationship between the interacting units, so called criminal nodes in our case [5]. By mapping these relationships, the analyst can reveal the hidden interactions or patterns in their relations. The activities in these relationships are required to be traced over some regular intervals of time. Sometimes, there is a sequence in these activities that links these relationships. It is often the case that this linkage of activities gives a strong clue of involvement of certain nodes in some criminal activities. While undergoing the current literature review, we found a few visualization tools that really help crime analysts but none of those give a complete decision support in approaching the desired target. They have to employ certain external tools and techniques to perform a comprehensive analysis. In this paper, we examine PEVNET [6] as an IA tool by demonstrating its utilization with the perspective of visualization. We have provide a case study of how the analysts may benefit from our tool and how it can become a productive tool in IA. This is done through a comprehensive tool demonstration, which is the core motive of this paper. II. RELATED WORK We have found plenty of network visualization tools by examining the existing literature. Information seeking mantra by Schneiderman [7] is an efficient visualization technique. The tree map algorithm by Shneiderman [8] defines an algorithm for mapping a social network on a tree structure. CrimeNet [4] displays data by showing the relations as thick links in case there are strong relationships. COPLINK [9] was introduced by Chen and Byron to integrate knowledge management with IA. KeyPathwayMiner [10] proposed by Josch et al. uses the boolean matrix technique for optimizing a visual query. The CrimeFighter, a tool for counterterrorism [11], contains the CrimeFighter Investigator (CFI) [12]. CFI also contains visualization features for instance: re-structuring, drag and 978-1-4799-8713-9/15 $31.00 2015 Crown Copyright DOI 10.1109/UKSim.2015.64 97

Figure 1. Clustering using proposed novel clustering algorithm require selection of Crime Type from the list of values on the PEVNET desktop. drop, etc. CrimeFighter Explorer and Crime Fighter Assistant [13] are also other worth-quoting visualization tools. Generally, the analyst s job is putting together the pieces of information [3] by different ways; for instance, whiteboard analysis, compartmentalization [1], etc. Compartmentalization is the reduction of information and modification of information as it passes through different investigation channels, so called compartments. There are a number of IA tools available, such as sandbox analysis [13], but none of them perform a comparative study of the available systems. Moreover, there are different visualization features in the exiting tools but those features are scattered all over the various tools. Many tools support one or more aspects of IA and leave out other aspects in one way or another. Hence, we have found multiple tools that are not up to the mark in one way or another. For instance, it works well when we want to visualize network datasets in Gephi but when there is a need for the filtration of the datasets, then Gephi is not a handy tool. Keeping in consideration our findings, we have developed PEVNET [6]. PEVNET is actually a transformation of crime investigation from the traditional Link Analysis, on whiteboard, to dynamic visualization. The analyst is provided with advanced drag and drop facilities. PEVNET simplifies some of the crime investigation procedures by providing the details on demand [15] facility on the interface as shown by criminal record window in the Fig. 1. Figure 2. On selecting the crime type Hallucinogens, the sub-clusters with the selected crime types are displayed. On close observation, the original criminal network is also evident in the background. 98

Figure 3. Visualizing Similar Node feature is being shown on PEVNET desktop. Heroin (white) is shown with pink color legend on top right corner of the desktop. Similarly, the node of Heroin (white) is shown in the map of Chicago city inside the Location window. III. VISUALIZATION FEATURES PEVNET has several features, for instance, similar node feature, clustering of sub-groups, detecting collaborating sub-cluster feature, trend analysis feature etc. that provide a sound platform to the crime analysts. With the support of the PEVNET tool, the analysts can have effective decision making and they can perform their analysis easily as compared to other existing tools. Temporal visualization features and the clustering algorithm constitute a vital part of the PEVNET tool. The analyst can be able to differentiate among sub-clusters, which are difficult to perform unlike with statistical techniques. There are some features which are novel in PEVNET. But, some existing features are reexamined [15] in a unique way to enhance the interactivity. The features in PEVNET are as follows: A. Network Visualization Features The network visualization features in PEVNET address the issues related to drag and drop, details on demand, and focusing. It is easier to compare different parameters while formulating any opinion. 1) Node-link color feature: The feature helps network analysts in grouping data for visual analysis because with this feature, the colors of the nodes become thicker with the increase in the weights of the nodes. Thus the analyst can group nodes carrying different weights. 2) Locating central persons: Locating central persons is crucial for determining the structure of the criminal networks. The analysts can locate a subcluster easily since the clusters usually have one master mind. Locating and eliminating that person results in the maximum crack down of the network. One of the prime motives of the Anacapa chart [16] is to find the central person in the network. 3) Node-Link size feature: The size of the nodes increase with the increase in their weight. The weight of the node is the depiction of the crime involvement of that node. With the help of the node-link size feature, the analysts can demarcate between high weighted nodes and light weighted nodes. It is nearly the same feature as the color feature discussed above since both are affected by the increase in the weight of the node. The analysts sometimes carry out more analytical results with the node-link size feature as compared to the nodelink color feature. 4) Node-link details on demand feature: The details on demand feature display the attribute information of the respective node or link which is accessed. When the nodes or links are selected, their relevant attributes are displayed in the criminal record windows. The attributes for instance; list of the crime, general information, image, criminal information with respect to co-offending crimes using a pie-chart, and group information 5) Network of clusters: With our proposed clustering algorithm [6], the analysts can visualize clusters of different crime types. We have proposed a unique clustering algorithm [15]. The algorithm is implemented in such a way that the selected cluster becomes distinct or visible as compared to the other objects of the network. The members of the clusters can be seen over the whole network like a unique layer. Visual filtering, by way of clustering, enhances the visibility of the data as compared to the statistical tabular data. 6) Detecting collaborating sub-cluster feature: The details of the feature are in the section 1V. B. Visualization Features Based On Temporal Data Below are the visualization features that are based on some temporal activity in the criminal networks. 99

1) Trend Analysis feature: With the trend analysis feature, the analysts can have an idea of how the different volumes or sizes of the clusters evolve over time. The authorities can take effective measures based on the trends provided by this feature. This feature has not been implemented yet. It will be implemented as part of the future work. 2) Encircle feature: With this feature, the analysts can recognize the respective cluster so that it is not mixed up with other clusters. C. Composite Features The composite features are the visualization features that are used to understand the semantics of the data sets by contracting and expanding the information under consideration. In this way, the analysts can develop a good understanding of the data. In PEVNET, we have proposed the following composite features: 1) Expand collapse feature: The expand collapse feature pertains to the composites, i.e., how the information of the groups of nodes collapse and expand. 2) Visualizing similar node feature: The visualizing similar node feature gathers the nodes in the networks that are involved in the same types of crime. The reported events of the criminal activities fall in different geographical locations and thus crime collaboration, if any, between the criminal nodes can be tracked with the aid of this unique and novel feature. Out of the thirteen above visualization features, nine have been implemented so far. IV. TOOL OVERVIEW In the PEVNET interface, there is a layout as shown in Fig. 1. The layout is usually comprised of a node and link diagram, depicting the network visualization. Two clusters are shown in Fig. 2. Chloe and William are shown as master minds or the central persons in their respective clusters. We have used a simple data set so that the readers can easily understand the functionality of the tool. Besides the PEVNET layout, several menu items in the desktop are shown. In this menu item, there is a date filter menu item is shown in Fig. 5. The nodes with the selected crime types are clustered in such a way that the cluster seems to pop up from the original network snapshot as shown in Fig. 2 [6]. The analyst can shuffle the date calendar and can easily monitor the criminal activity over time. The next menu item is the crime type filter list item, showing different crime types. In the list item, the crime type numbers, called the IUCR or Illinois Uniform Crime Reporting, and their respective color legends are shown on the left and the right hand sides of the crime types, respectively. For the user s convenience, the color legend list with the same design is displayed on the right hand side as the legend list menu item. One can also find the map showing the geographical locations of the crime sights in Fig. 3. The trend analysis feature [6] as shown in Fig. 4, is used to detect variations in criminal activity over some span of time, for instance the reported crimes of the whole year 2011. It helps the analyst in the prediction of certain criminal activity. For instance, the variation of various crime types is shown by IUCR number of the respective crime types in Fig. 4. The first column shows the month titles while the first row shows the titles of crime types along with the respective IUCRs. For instance, the first column shows the decrease in the activity of the crime type Hallucinogens during the months of September, October, November, and December in the years 2011. The yellow color of the small circles corresponds to the respective legend colors, shown in the top right menu. The information about the names of the crime types can be found from the crime type filter menu item. So, all the features of PEVNET complement each other in one way or another to facilitate the analysts. We use random positioning techniques in the PEVNET layout. Due to which, the nodes are seen randomly on the graph layout. The nodes are geographically distributed with respect to the crime locations as provided in the datasets of the example as shown in Fig. 3, i.e., the similar nodes feature [15]. A crime location is comprised of longitude and latitude in the crime report. A display structure is used to represent a node in the graphical user interface (GUI). This display structure is primarily based on a circle, in the case of nodes, but with extended features. With the extended features, the demarcation between the different sub-groups has been shown in some of the PEVNET features; for instance, the collaborating sub-cluster feature. In PEVNET, the detection of similar crime is of vital importance. Occasionally, it is needed during crime investigation. The analyst is required to search persons (nodes) that are dealing with some crime types. He will select any node that is involved in for instance Heroin in the network by watching the legend panel. The system will automatically make those nodes appear prominently which are linked with Heroin crime type as shown in the location window in the Fig. 3. In our previous work [15], our proposed visualizing similar node feature has been shown in Fig. 2. With the visualizing similar node feature, the analyst can study the nodes, which 100

Figure 4. Different crime types are shown with the perspective of Trend analysis feature. have the same types of crime but are located at some distance apart in some other geographical locations. A. Case Study We use a case study based on the data from the Chicago narcotics datasets used by the Chicago Police Department (CPD) to demonstrate the framework. It is available in excel file format. The format in Microsoft Excel is more understandable to the majority of users. The format helped us a lot during the system evaluation since the users could validate their findings by comparing their results from the excel sheet. B. Detecting Collaborating Sub-Clusters Feature It is difficult to find information about the sub-clusters which is hidden from the naked eye of the analyst while he is performing the analysis. There is a need for advanced techniques to navigate through the networks. Sometimes, the networks need to be inverted in some dimension in such a way that the information is revealed. In some cases, the external references, i.e., the links outside the networks, act as a vital source of information. In many of the cases, the external links are sometimes the master minds of the crimes. In PEVNET, there is a provision of a detecting collaborating sub-cluster feature, with the help of which the information is shown by selecting the crime type information from the menu and the nodes colors. The analyst can detect sub-clusters inside the network upon finding the information about certain crime types. The information is revealed if any node has got more than one colors. Since there is chance for the possible involvement of the suspects in some other co-offending crimes; such information may be disclosed upon interrogation of the suspect. It is a vital part of IA. The proposed detecting collaborating sub-cluster feature addresses this issue and extracts the hidden crimes about the co-offending criminal networks. PEVNET displays the relevant information of the collaborating crimes with the help of a variety of color combinations. Each crime type is depicted with different crime legends as shown in Fig. 5. The detecting collaborating sub-cluster feature can be understood by examining Figs. 1 and 2. In Fig. 1, the node William is shown to have been involved in Cannabis 30 gms. or less, a crime with the code 1811 and Hallucinogens 2025. The other collaborating nodes are Madison, Olivia, and Alexander. By watching the information of the node Williams from the legend information on the PEVNET desktop, it can be seen that Williams has been involved in Cannabis 30 gms. or less, a crime with the code 1811 and Hallucinogens (2025). Since 1811 and 2025 crime types are shown by bright green and dull green colors in the legend information and William is also shown to have been involved in same colors in Fig.1. So we can easily infer that William is detected to have been in 1811 and 2025 crime types. We can find the effectiveness of the detecting collaborating sub-cluster feature by making the filtration of the information. For instance, a node Chloe was involved in three crime types, i.e., Cannabis 30 gms. or less 1811, Heroin (white) denoted as 2024 and Hallucinogens 2025 as shown in Fig.1. The filtered information has revealed the information about Chloe in the case of Hallucinogens. The other collaborating nodes are Emily and Daniel as shown in Fig. 2. Also, the information of the node Chloe from the pie-chart information can be found. We take another example of detecting collaborating sub-cluster feature. Chloe is shown to have been involved in Heroin and Hallucinogens as shown by two legend colors in Fig. 5. The collaboration or involvement of Chloe with other nodes Ethan, Michael, Mia, Noah, and Jayden in the crime of Heroin is shown clearly. There were overheads of both the analyst s precious time and computation in getting such information in the past. It can now be retrieved easily by using the detecting collaborating sub-cluster feature. V. CONCLUSION This paper is a tool demonstration paper and it has demonstrated a criminal network visualization tool. With a variety of network visualization and clustering features along with features based on temporal datasets, the crime analysts is provided with enhanced support for decision making. With the use of the proposed features, criminal network analysis will become more productive as the analysts is expected to get more time to concentrate on 101

Figure 5. A person Chloe is shown to have been involved in collaboration with respect to the Heroin (white) crime type. subsequent issues rather than having to deal with the complexities and detail as in the past. REFERENCES [1] R. R. Petersen. "Criminal Network Investigation: Processes, Tools, and Techniques". Diss. SDUSDU, Det Tekniske FakultetFaculty of Engineering, Mærsk Mc-Kinney Møller Instituttet, 2012. [2] H. Ebel, J. Davidsen, and S. Bornholdt. "Dynamics of social networks." Complexity 8, no. 2 (2002): 24-27.Analysis and visualization of criminal networks. [3] J. S. Yi, Youn ah Kang, J. T. Stasko, and J. A. Jacko. 2007. "Toward a deeper understanding of the role of interaction in information visualization. Visualization and Computer Graphics, IEEE Transactions on 13.6 : 1224-1231. [4] J. J. Xu and H. Chen, CrimeNet Explorer: A Framework for Criminal Network Knowledge Discovery University of Arizona, ACM Transactions on Information Systems (TOIS), Volume 23 Issue 2, April 2005, Pages 201-226, 2005. [5] K. Ehrlich and I. Carboni, Inside Social Network Analysis, 2005. [6] A. Rasheed, and U. K. Wiil, 2014 The 2014 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM 2014). IEEE Computer Society Press, s. 876-881 6 s. [7] S. K. Card, J. D. Mackinlay, and B. Schneiderman, "Readings in information visualization: using vision to think". Morgan Kaufmann Publishers, 1999. [8] B. Shneiderman, "The Eyes Have It: A Task by Data Type Taxonomy for Information Visualizations", 1992. [9] J. Schroeder, COPLINK: Database Integration and Access for a Law Enforcement Intranet, National Criminal Justice Reference Service (NCJRS), 2001. [10] P. Josch, N. Alcaraz, A. Junge, and J. Baumbach, "KeyPathwayMiner 4.0: Condition-specific pathway analysis by combining multiple OMICs studies and networks", 2013. [11] U. K. Wiil, N. Memon, and J. Gniadek, Crimefighter: A toolbox for counterterrorism, in Knowledge Discovery, Knowlege Engineering and Knowledge Management, ser. Communications in Computer and Information Science, A. Fred, J. L. G. Dietz, K. Liu, and J. Filipe, Eds.Springer Berlin Heidelberg, 2011, vol. 128, pp. 337 350, 2011. [12] R. R. Petersen and U. K. Wiil. Crimefighter investigator: A novel tool for criminal network investigation, European Intelligence and Security Informatics Conference (EISIC), sept. 2011, pp. 197 202, 2011. [13] U. K. Wiil, J. Gniadek, and N. Memon, Crimefighter assitant: A knowledge managment tool for terrorist network analysis, in International Conference on Knowledge Management and Information Sharing (KMIS 2010). INSTICC Press, 2010, pp. 15 24, 2010. [14] W. Wright, D. Schroh, P. Proulx, A. Skaburskis, and B. Cort, The sandbox for analysis: Concepts and methods, in ACM CHI, April 2006, pp. 801 810. [15] A. Rasheed and U.K. Wiil, Novel Visualization Features of Temporal Data Using PEVNET, Multidisciplinary Social Networks Research: International Conference, MISNC 2014. Springer, s. 228 24114 s. 2014. [16] D. H. Harris, Human Factors and Ergonomics Society. Article in a journal: [17] A. Rasheed and Uffe Kock Wiil, Novel Analysis and Visualization Features in PEVNET, The Maersk Mc-Kinney Moeller Institute University of Southern Denmark Campusvej 55, 5230 Odense M, Denmark. Submitted for acceptance, unpublished. 102