Using the Spanning Tree of a Criminal Network for Identifying its Leaders

Transcription

1 Uing the Spanning Tree of a Criinal etwork for Identifying it Leader Kaal Taha, Senior Meber, IEEE and Paul D. Yoo, Senior Meber, IEEE Abtract We introduce a forenic analyi yte called that identifie the influential eber of a criinal organization a well a the iediate leader of a given lit of lower-level criinal. Criinal invetigator uually eek to identify the influential eber of criinal organization, becaue eliinating the i ot likely to hinder and dirupt the operation of thee organization and put the out of buine. Firt, contruct a network repreenting a criinal organization fro either Mobile Counication Data aociated with the organization or crie incident report that include inforation about the organization. It then contruct a Miniu Spanning Tree (MST) of the network. It identifie the influential eber of a criinal organization by deterining the iportant vertice in the network repreenting the organization, uing the concept of exitence dependency. Each vertex v i aigned a core, which i the nuber of other vertice, whoe exitence in MST i dependent on v. Vertice are ranked baed on their core. Criinal repreented by the ranked vertice are conidered the influential eber of the criinal organization repreented by the network. We evaluated the quality of by coparing it experientally with three other yte. Reult howed arked iproveent. Index Ter Forenic invetigation, digital forenic, ocial network, criinal network, obile counication data. I. ITRODUCTIO Social group and their relationhip have long been identified uing Social network analyi (SA) [2, 21, 22]. Inpired by SA, reearcher in digital forenic invetigation have been eploying iilar network analyi technique for identifying criinal counitie, their relationhip, and their influential leader [12]. A a reult, digital forenic ha eerged a an iportant tool for invetigation crie. Uually, forenic invetigator tudy and analyze counication record for the purpoe of identifying criinal counitie and their leader. Recently, forenic invetigator have hown a growing interet on uing Mobile Counication Data (MCD) that belong criinal organization to contruct network that depict the organization and analyze thee network [12]. The interet on contructing network fro MCD cae fro the fact that ot criinal involved in organized crie (uch a terrori, drug trafficking, and criinal gang) plot and conteplate their criinal activitie through obile phone counication [12]. Criinal forenic invetigator analyze K. Taha i with the Electrical and Coputer Engineering Departent, Khalifa Univerity, UAE (e-ail: kaal.taha@kutar.ac.ae). P. Yoo i with Cranfield Univerity and Defence Acadey of United Kingdo, UK (eail: paul.d.yoo@ieee.org). uch network to infer ueful inforation uch a: (1) the tructure of the criinal organization, (2) the relationhip between the criinal, (3) the influential eber of the criinal organization, and (4) the flow of counication between the criinal. Recently, criinal forenic invetigator have alo hown interet on contructing network fro Crie Incident Report that contain inforation about a criinal organization [6]. We propoe in thi paper a forenic analyi yte called (Efficient Criinal Leader Finder). can identify the ot influential eber of a criinal organization. Given a lit of lower-level criinal in a criinal organization, can alo identify the iediate leader of thee lower-level criinal. Identifying the influential eber of a criinal organization i one of the ot iportant tak that criinal invetigator undertake. Uually, eber of a criinal organization, who hold central poition in a criinal organization, are targeted by criinal invetigator for reoval or urveillance [4, 15]. Thi i becaue thee central eber uually play key and influential role in the organization by acting a coander who iue intruction to other eber or erve a gatekeeper, who receive and ditribute inforation and good to other eber. Reoving thee central eber i ot likely to dirupt the organization and put it out of buine. Shang et al. [18] tated that a coon proble in a criinal invetigation involve a criinal organization i to identify the leader of the organization. Meon [16] tated that the identification of key actor() in criinal covert network i a ajor objective for criinal invetigator and eliinating thee key actor can detabilize the criinal network. Wiil et al. [25] tated that the identification and eliination of key node in a terrorit network would decreae the ability of the network to function norally. In the fraework of, a network can be contructed fro either Mobile Counication Data (MCD) that belong to a criinal organization or fro crie incident report that contain inforation about a criinal organization. A vertex in a network repreent an individual and an edge repreent the relationhip between two individual. Firt, contruct the Miniu Spanning Tree (MST) of the network. identifie the influential eber of a criinal organization by deterining the iportant vertice in the network, uing the concept of exitence dependency. It eploy thi concept to identify for each vertex v, the et S of vertice, whoe exitence in MST i dependent on v. Thi i becaue, if the exitence of S in MST i dependent on v, v i

2 influential to S. It then aign a core to each vertex v, which i the nuber of vertice in the et S. Vertice are ranked baed on their core. Criinal repreented by the ranked vertice are conidered the influential eber of the criinal organization. II. BACKGROUD AD OUTLIE OF THE APPROACH A. Background A nuber of ethod have been propoed for identifying the et of upiciou ource node (e.g., fake follower, botnet, etc.) on a given criinal network. The author of [1] invetigated the network tructure of Mafia yndicate by building two network repreenting Mafia gang operating in the orth of Sicily. In the network, a vertex repreent an individual and an edge connecting two vertice repreent the exitence of at leat one reciprocated phone call between the individual aociated with thee vertice. The following are the objective of the author of [1]: (1) to undertand the functional role of the eber of the Mafia yndicate, (2) to quantify the ability of a Mafia yndicate to react to police operation after the detention of oe of it eber, and (3) the reilience of Mafia yndicate to diruption caued by police operation. The author of [10] preented LogViewer, a Web-baed criinal network analyi fraework to tudy cobination of geo-ebedded and tie-varying data ource like obile phone network and ocial graph. LogViewer ai at: (1) identifying criinal behavior and uncovering illicit activitie, (2) invetigating the centrality of vertice repreenting criinal, (3) tudying the flow of inforation over tie, and (4) deterining the phyical cloene effect on network. In 2013, Catanee et al. [7] introduced an initial verion of a yte called LogAnalyi. In thi initial verion, the yte wa intended for forenic viual tatitical analyi of obile phone log. The yte help in undertanding the hierarchie within criinal organization and dicovering key and central eber inide the organization [7]. Depite the ucce of ot current ethod for identifying the vertice that are iportant to query vertice, thee ethod uffer incoplete contribution and inconitent contribution. Incoplete contribution occur, if oe query vertice do not contribute to the overall relative iportance value of a vertex. The inconitent contribution occur, if query vertice contribute unequally to the overall relative iportance value of a vertex. Let v be the current vertex under conideration. overcoe the proble of Incoplete Contribution by: (1) conidering the iportance of each query vertex to v, and (2) aigning a weight to each incoing edge to v that i outgoing fro one of the query vertice (thi weight repreent the iportance/rank of thi vertex relative to all incoing edge to v). overcoe the proble of Inconitent Contribution by: (1) conidering the iportance of each query vertex to each vertex connected to v, and (2) accounting for the degree of relativity of v to all query vertice. B. Outline of the Approach We preent below an overview of our approach in ter of the equential proceing tep taken by to identify the influential eber of a criinal organization. 1) Contructing a network: A network i contructed fro either MCD aociated with a criinal organization or crie incident report that contain inforation about the eber of a criinal organization. 2) Aigning a weight to each edge in the network: In a network contructed fro MCD, the weight of an edge repreent the nuber of phone call/eage between two criinal. In a network contructed fro crie incident report, the weight of an edge repreent the nuber of co-occurrence of the nae of upect and accoplice in the ae report. 3) Coputing the hortet-path edge betweenne: We copute the hortet-path edge betweenne [11] for each edge baed on the initial weight decribed in tep 2. We replace edge initial weight by their hortetpath betweenne. 4) Aigning a core to each edge: Edge hortet-path betweenne are replaced by their invere. Thi i becaue we will contruct the MST of the network, which pan all vertice with the inial u of weight. The invere are ued a the core of the edge. 5) Aigning a core to each vertex in the network baed on the concept of exitence dependency: We contruct the MST of the network baed on the edge core decribed in tep 4. aign a core to each vertex v in the network. The core of the vertex v i the nuber of other vertice, whoe exitence in the MST i dependent on v. The core repreent the relative rank (i.e., iportance) of the criinal repreented by the vertex v in the criinal organization. 6) Identifying the influential eber of the criinal organization: Vertice are ranked baed on their core decribed in tep 5. Criinal repreented by the ranked vertice are conidered the influential eber of the criinal organization. III. COSTRUCTIG A ETWORK In the fraework of, a network can be contructed fro inforation gathered fro MCD aociated with a criinal organization. A vertex in uch a network repreent a criinal caller and/or receiver. An edge repreent the flow of counication between two criinal, through phone call or eage. The weight of an edge repreent the nuber of phone call/eage between the two criinal repreented by the two vertice connected by the edge. In the fraework of, a network can alo be created fro crie incident report that contain inforation about the eber of a criinal organization. In uch a network, a vertex repreent a criinal. An edge repreent the relationhip between two criinal, deterined baed on the co-occurrence of the criinal nae in the ae crie incident report. eploy the concept of pace

3 approach [5] to contruct network autoatically fro crie incident report [6]. eploy the technique of Stanford aed Entity Recognition [17] to deterine the nae of people in report. It ue a tokenizer and teer to atch a equence of word againt peron nae. Let n be the nuber of co-occurrence of the nae of two upect (or accoplice) in the ae crie incident report. n i tranfored into iilarity weight for the edge connecting the two vertice in the network repreenting the two upect. We copute the hortet-path edge betweenne [11] for each edge baed on the initial weight decribed above. We adopt the concept of edge betweenne propoed by Girvan ewan [11]. We conider the hortet-path betweenne of an edge a the actual weight of the edge. Therefore, we replace edge initial weight by their hortet-path betweenne. Thi i becaue the hortet-path betweenne of edge reflect the relative degree of relatedne between vertice better than the nuber of phone call/eage between the vertice (or the co-occurrence of nae in report). The hortet-path edge betweenne copute the fraction of hortet path paing through an edge. It can eaure the rate at which inforation pae along each edge. Eventually, the weight of each edge i repreented by the edge hortet-path betweenne. Finally, a core i aigned to each edge. The core of an edge i the invere of the edge hortet-path betweenne weight. Therefore, a aller core repreent a tronger relationhip between the two vertice connected by the edge. That i, the aller the core of an edge the cloer the relationhip between the two vertice connected by the edge. We adopt thi approach in order to contruct the MST of the network. Thi i becaue the path of the MST pan all vertice with the inial u of weight: the MST path ha the allet u of the weight of edge connecting all vertice copared to all other path that pan all the vertice. IV. IDETIFYIG THE IFLUETIAL MEMBERS OF A CRIMIAL ORGAIZATIO A. Aigning a Score to each Vertex in the etwork baed on the Concept of Exitence Dependency We contruct the Miniu Spanning Tree (MST) of the network baed on the edge core decribed in ection III. A MST i a tree that pan all the vertice of a network and the u of the core of the edge connecting the vertice i the allet aong all other tree that pan all the vertice. We contruct the MST, becaue it path pan all cloely related vertice (i.e., it path connect the vertice that repreent the criinal, who have the highet degree of relationhip). Uually, a criinal organization i hierarchically tructured in ter of power. The MST can repreent the path of paing inforation through thi hierarchical tructure. Algorith COSTR-MST in Fig. 1 contruct an MST baed on Pri algorith. Let V be the et of vertice in the network. Let MST be a et that tore the edge of the tree. At each tep, an edge with a light core i added to the current tree MST that connect the tree to an iolated vertex. The input to the algorith are a network W, the core of the edge S (recall ection III), and the root vertex r. In line 3 of the algorith, the parent of each vertex u i aigned to IL and tored in variable π[u]. In line 5, a priority queue Q i initialized to contain all the vertice. Line 7 extract fro queue Q the vertex u whoe key i the iniu. For each vertex v adjacent to a vertex u (line 8), if the core of the edge (u, v) i le than the key of v (line 9), then edge (u, v) i added to MST (line 10) and the key of v i given the core of the edge (u, v) (line 11). Algorith COSTRUCT-MST (W, S, r) 1. for each u V [W] 2. do key [u] 3. π[u] IL 4. key [ r] 0 5. Q V [W ] 6. while Q Ø 7. do u EXTRACT MI(Q) 8. for each v Adj[u] 9. do if v Q and S ( u, v) < key [v] 10. then π[v] u 11. key [v] S(u, v) 12. MST (v, π[v]) Fig. 1: Algorith COSTR-MST We oberve that a vertex v i iportant to a et S of vertice in a network, if S i exitence dependent on v through the path of the MST that connect v and S. That i, v i iportant to S, if the exitence of S in the network i dependent on the exitence of v. An exitence dependency relation will be added between vertice u and v if, wherever v exit, it i a part of u; the preence of v iplie the preence of u [20, 23, 24]. Thu, if the relationhip between u and v repreent exitence-dependency, u and v are cloely related. A vertex u i exitence dependent on a vertex v, if the reoval of v caue u to be unable to reach each other vertex in the network through the path of MST. If o, the reoval of v fro the MST will require the reoval of u. Becaue the reoval of v fro the MST caue u to becoe unable to reach each other vertex in the MST, v i influential to u. If we calculate the u of the core of the edge located in the path fro u to v in MST, we find that thi u i the lowet aong all other path located in the path fro u to v. identifie for each vertex v, the et S of vertice, whoe exitence in MST i dependent on v. The reoval of v caue each vertex u S to be unable to reach each other vertex through the path of the MST. Finally, aign a core to each vertex v in the network. The core of the vertex v i the nuber of other vertice, whoe exitence in MST i dependent on v. The core reflect the relative rank/iportance of the criinal repreented by the vertex v in the criinal organization. B. Identifying the Central Vertice Vertice are ranked baed on their core decribed in ubection IV-A. Criinal repreented by the ranked vertice are conidered the influential eber of the criinal organization. Let the core of vertice v and u be n and

4 repectively. v control the flow of inforation between n criinal, and u control the flow of inforation between criinal. Let n. Intuitively, v hould be ranked higher than u, for the following reaon: (1) v control the flow of inforation between ore criinal than u, (2) u itelf can be exitence dependent on v in the MST (i.e., the criinal repreented by v can control the flow of inforation initiated by the criinal repreented by u). Criinal invetigator ay want to know the iediate leader of a given lit of lower-level criinal in a criinal organization. Thee criinal are uually the one in the organization, who carry out crie; therefore, they are eaier to be arreted and incriinated. can alo identify the iediate leader of a given lit of lower-level criinal. We ue the ter query vertice to refer to a given lit of vertice repreenting lower-level criinal. Let q 1, q 2, q n denote a lit of query vertice. A criinal repreented by a vertex v in a network i conidered an iediate leader of the criinal repreented by q 1,, q n, if: (1) v ha the highet core aong the vertice located at the convergence of the ubtree of the MST that pa through q 1,, q n, and (2) the exitence of each of q 1,, q n in the MST i dependent on v. V. CASE STUDIES We ue a partial naphot of Friendter ocial network [28] to deontrate the technique eployed by. The network i publicly available a part of the Stanford etwork Analyi Project (SAP) [28]. Fig. 2 how the partial naphot of the network. A vertex in the network repreent a uer. An edge repreent a relationhip between two uer. The core of an edge i the invere of the hortet-path betweenne of the edge (recall ection III). The bold/thick edge how the path of the Miniu Spanning Tree (MST) of the network. Fig. 3 how the ae network in Fig. 2 after aigning a core to each vertex in the network uing the technique decribed in ubection IV-A. The core of a vertex v i the nuber of other vertice whoe exitence in MST i dependent on v. The following decribe how the core of oe elected vertice in the network in Fig. 3 are deterined: The core of vertex STEVE i 4, becaue the following four vertice are exitence dependent on STEVE in MST: THOMAS, JOH, LARRY, and JERRY. That i, the reoval of vertex STEVE will caue the four vertice to be unable to reach each of the reaining vertice connected with the root vertex through the path of the MST. Oberve that vertex JASO, for exaple, i unaffected by the reoval of vertex STEVE, ince it can till reach each other vertex connected with the root vertex through the path of the MST. The core of vertex PETER i 9. Thi i becaue the reoval of vertex PETER will caue the following 9 vertice to be unable to reach each of the reaining vertice connected with the root vertex through the path of the MST: ERIC, JEFF, SCOTT, JASO, STEVE, JOH, THOMAS, LARRY, and JERRY. Fig. 2: A partial naphot of Friendter ocial network [28]. The core of an edge i the invere of the hortet-path betweenne of the edge. The bold/thick edge are the path of the MST of the network Fig. 3: The partial ocial network preented in Fig. 2 after aigning a core to each vertex. The nuber inide each vertex repreent the vertex core. The core of a vertex v i the nuber of other vertice whoe exitence in MST i dependent on v. Edge in the figure repreent the path of the MST Table 1 how the nae of the 17 uer repreented by the 17 vertice in the partial naphot of the Friendter ocial network hown in Fig. 2. The nae in the table are ranked baed on the core of the vertice repreenting the and hown in Fig. 3 (ee vertice core in Fig. 3). The ranked uer in the table are the influential one in the ocial network.

5 TABLE 1 THE 17 USERS REPRESETED BY THE 17 VERTICES I THE PARTIAL ETWORK SHOW I FIG. 2 RAKED BASED O THEIR SCORES SHOW I FIG. 3 Rank Score Criinal ae 1 16 JAMES 2 13 DAVID 3 12 MARK 4 11 BRIA 5 10 JOSE 6 9 PETER 7 6 SCOTT 8 5 JASO 9 4 STEVE 10 1 JOH, ROBERT, LARRY, ERIC 14 0 THOMAS, PAUL, JERRY, JEFF Conider Fig. 3 and the following query: Q( THOMAS, LARRY ). The query ak for the iediate leader of THOMAS and LARRY. A Fig. 4 how, STEVE i the iediate leader, becaue of the following: (1) vertex STEVE i located at the convergence of the ubtree of the MST that pae through vertice THOMAS and LARRY (recall the lat paragraph in ubection IV-B), and (2) the exitence of vertice THOMAS and LARRY in the MST i dependent on vertex STEVE (the reoval of vertex STEVE will caue the two vertice to be unable to reach each of the vertice in the other ubtree containing the root vertex). Fig. 4: The red path how that vertex STEVE i located at the convergence of the ubtree of the MST that pae through vertice THOMAS and LARRY Conider Fig. 3 and the query: Q( JERRY, ERIC ). The query ak for the iediate leader of JERRY and ERIC. A Fig. 5 how, PETER i the iediate leader, becaue of the following: (1) vertex PETER i located at the convergence of the ubtree of the MST that pae through vertice JERRY and ERIC (recall the lat paragraph in ubection IV-B), and (2) the exitence of vertice JERRY and ERIC in the MST i dependent on the exitence of vertex PETER. Fig. 5: The red path how that vertex PETER i located at the convergence of the ubtree of the MST that pae through vertice JERRY and ERIC. VI. EXPERIMETAL RESULTS We ipleented in Java, run on Intel(R) Core(TM) i7 proceor, with a CPU of 2.70 GHz and 16 GB of RAM, under Window 10. We evaluated the quality of by coparing it with LogAnalyi [8], Crieet Explorer [12], and our previouly propoed yte SIIMCO [19]. The following are brief decription of the three yte: LogAnalyi [8]: It eploy Girvan & ewan [11] algorith to identify the degree of relationhip between vertice repreenting criinal in a criinal network. It can identify the influential eber in criinal organization. It can ue obile phone counication data that belong to a criinal organization to contruct a network depicting the relationhip between the criinal in the organization. Crieet Explorer [12]: It ue hierarchical clutering technique to partition a network repreenting a criinal organization into ubnetwork baed on the trength of the relationhip between the vertice in each ubnetwork. It eploy the Cloene, Degree, and Betweenne centrality etric to deterine the iportant vertice in a ubnetwork. It firt identifie the degree of relationhip between vertice uing the hortet path algorith and Blockodeling [3]. SIIMCO [19]: It ue a forula that quantifie the degree of influence of each criinal in a criinal organization relative to all other criinal. Given a et of query vertice, SIIMCO deterine the relative iportance of each vertex in the network with repect to the query vertice, uing forula that quantify the degree of influence of a vertex. One of the key difference between and SIIMCO i that SIIMCO adopt vertex-centric approach while adopt edge-centric approach. In SIIMCO, the iportance of a vertex v i deterined baed on the iportance of the vertice connecting v with the network. In, the iportance of a vertex v i deterined baed on the iportance of the edge connecting v with the network, uing the concept of exitence dependency.

6 A. Copiling Dataet for the Evaluation We ued the following two real-world counication dataet: Kreb 9/11 dataet [26, 27] and Enron eail corpu [9]. We converted the dataet into network. Below are brief decription of the dataet: Kreb 9/11 dataet [26, 27]: We ued the Kreb wellknown dataet of the 9/11 incident. The 9/11 were a erie of four coordinated terrorit attack on the United State on the orning of Septeber 11, We ued a weighted verion of the Kreb 9/11 network dataet [26, 27]. The network conit of 62 node repreenting all individual involved in the incident. The network contain 153 edge. Thee edge repreent reported interaction between the actor involved in the incident. The average node degree in the network i 4.9. The weight of an edge reflect the degree of counication between the two individual repreented by the two node connected by the edge. Enron eail dataet [9]: Enron eail corpu urfaced following a criinal candal involved Enron eployee. The corpu include 619,446 eail eage belonging to 158 Enron eployee. We cleaned the dataet by reoving eail that were exchanged between people other than the 158 eployee. The reaining dataet include 200,136 eail fro 151 Enron eployee. B. Evaluating the Accuracy of Identifying the Influential Meber of a Criinal Organization 1) Calculating the Recall, Preciion, and F-value of the Syte by Coparing their Reult with Reult Deterined by the Standard etwork Metric In thi tet, we eaure the perforance of the yte by coparing their reult with the reult deterined by the tandard Cloene, Betweenne, In Degree, and Out Degree etric. Degree i the nuber of tie that a vertex ha. Vertice with high degree centralitie are central in the network. The betweenne centrality of a vertex v i the nuber of hortet path between other vertice that pa through v. Cloene centrality i the length of the hortet path to all other vertice. It eaure how a vertex i cloe to other vertice. We calculated the Recall, Preciion, and F- value uing the following tandard etric: Recall where yte, c, Preciion c, 2 Recall Preciion F value Recall Preciion c i the nuber of correct vertice returned by a i the nuber of actual correct vertice, and i the nuber of vertice returned by a yte. Let L be the lit of vertice returned by a tandard network etric and let L be the lit of correct vertice returned by a yte. c L and = L. We ubitted the network repreenting the Kreb 9/11 and Enron dataet to the four tandard network etric, and we alo ubitted the ae network to each of the four yte. We then calculated the Recall, Preciion, and F-value of the reult returned by each of the four yte. The reult are hown in Table II and III. TABLE II PERFORMACE OF THE SYSTEMS USIG THE 9/11 DATASET COMPUTED BASED O THE TOP VERTICES RETURED BY THE STADARD ETWORK METRICS Recall Preciion F-value SIIMCO Crieet Explorer LogAnalyi SIIMCO Cloene Betweenne Crieet Explorer LogAnalyi SIIMCO In Degree Crieet Explorer LogAnalyi SIIMCO Out Degree Crieet Explorer LogAnalyi TABLE III PERFORMACE OF THE SYSTEMS USIG ERO DATASET COMPUTED BASED O THE TOP VERTICES RETURED BY THE STADARD ETWORK METRICS Recall Preciion F-value SIIMCO Crieet Explorer LogAnalyi SIIMCO Cloene Betweenne Crieet Explorer LogAnalyi SIIMCO In Degree Crieet Explorer LogAnalyi SIIMCO Out Degree Crieet Explorer LogAnalyi ) Calculating the Euclidean Ditance between the Reult of each Syte and the Reult of the etwork Metric We eaured the average Euclidean Ditance between the ranked n vertice returned by a yte and the correponding ranked n vertice returned by a tandard network etric. We conidered n equal 5, 10, and 15. We ued the following Euclidean ditance eaure. d(, ) ( v) ( v) x are the n vertice returned by network etric. 0,1 and 0,1 are the ranked n vertice returned by etric and yte, repectively. (v ), (v ) are the poition of vertex v in the lit and repectively. Fig. 6 how the average Euclidean Ditance uing the Kreb 9/11 and Enron dataet.

7 Crieet Explorer [12] SIIMCO [19] LogAnalyi [8] (a) Fig. 6: Average Euclidean ditance between the reult returned by each of the four yte and the reult returned by the tandard network etric uing Kreb 9/11 and Enron dataet. C. Evaluating the Accuracy of Identifying the Iediate Leader of Lower Level Criinal in a Criinal Organization We evaluated the accuracy of the four yte for identifying the ot iportant vertice to a given lit of vertice in the network repreenting the Kreb 9/11 and Enron dataet. We randoly elected 50 lit of 2-query vertice, 50 lit of 3-query vertice, and 50 lit of 4-query vertice fro each of the two network. We ubitted the query vertice and the network repreenting the dataet to the tandard network etric and to the four yte. We conidered only the 5 vertice returned by each of the etric a the lit (recall ection VI-B-1). We copared the 5 vertice returned by each yte with the lit l. We then calculated the Recall, Preciion, and F-value of each yte. Fig. 7 and 8 how the reult for the Kreb 9/11 and Enron dataet, repectively. Crieet Explorer [12] SIIMCO [19] LogAnalyi [8] (a) (b) (c) Fig. 7: (a) Recall, (b) Preciion, and (c) F-value of the four yte for identifying the iportant vertice to a given lit of query vertice uing the Kreb 9/11 dataet. In the figure, 2v, 3v, and 4v denote the following: 2 query vertice, 3 query vertice, and 4 query vertice repectively. (b) (c) Fig. 8: (a) Recall, (b) Preciion, and (c) F-value of the four yte for identifying the iportant vertice to a given lit of query vertice uing the Enron dataet. In the figure, 2v, 3v, and 4v denote the following: 2 query vertice, 3 query vertice, and 4 query vertice repectively. D) Dicuion of the Reult The following are our obervation of the experiental reult uing the Kreb 9/11 dataet: a) wa able to identify the key node in the network not only becaue they have ore connection, but alo becaue their link to other node in the network are uch tronger copared to the link of the le central node. b) wa able to identify the node in the network repreenting the following ot influential (i.e., central) actor in the incident: Atta, Al-Shehi, Jarrah, Kheai, Mouaoui, Hanjour, Al-Hazi, Al-Shibh, and Eabar. c) wa able to identify the node repreenting Atta, the ringleader of the hijacker, a the ot central node in the network. d) Each of the four node identified by repreent one of the hijacker on one of the four plane. e) ranked the node repreenting Kheai, Mouaoui, and Jarrah very high. It ha been revealed that Kheai and Mouaoui erved a coordinator between the hijacker and other actor involved in the incident. It ha alo been revealed that Jarrah wa one of the aterind of the 9/11 plot The five node returned by in the Enron network repreent the following actor in the Enron candal: o Arthur Anderen (auditor). o Kenneth Lay (CEO). o Sheila Kahanek (accountant). o Andrew Fatow (financial officer). o Jeffrey Skilling (COO). Three of thee five individual have been charged and found guilty of variou conpiracy and accounting fraud.

8 A Fig. 6-8 and Table II and III how, outperfored the other three yte. Baed on our obervation of the experiental reult, we attribute the perforance of over the three yte to the following liitation of LogAnalyi, Crieet Explorer, and SIIMCO: 1. LogAnalyi liitation: a) It doe not work well for clutering large-ize network. The reult howed that it cluter allize network ore accurately than large-ize one. b) It i biaed to globular cluter. c) It cannot detect and undo incorrect clutering that wa done at an early tage. d) If cluter have different ize, it ay not work well. e) Due to the nature of it technique, oe vertice ay not contribute to the overall iportance value of a vertex (Incoplete Contribution) and oe vertice ay contribute unequally to the overall iportance value of a vertex (Inconitent Contribution). 2) Crieet Explorer liitation: Let (u, v) be the ot iportant incoing edge to vertex v. Crieet Explorer deterine the weight of vertex v baed olely on the weight of edge (u, v) and vertex u. 3) SIIMCO liitation: It doe not work well when the network conit of a large nuber of vertice and edge. We reached thi concluion after coparing SIIMCO with uing dataet with variou nuber of vertice and edge. We ued for the coparion the following three real-world dataet copiled by the Stanford etwork Analyi Project (SAP) [28]: co-friendter (65,608,366 node, 1,806,067,135 edge), co-orkut (3,072,441 node, 117,185,083 edge), and co- Aazon (334,863 node, 925,872 edge). We eaured the perforance of SIIMCO and by coparing their reult with the reult returned by the tandard Cloene, Betweenne, In Degree, and Out Degree etric uing the ae procedure decribed in ubection VI-B-1. We oberved that achieved the highet perforance over SIIMCO when the co-friendter dataet wa ued. achieved the econd highet perforance over SIIMCO when the co-orkut dataet wa ued. The leat perforance of over SIIMCO wa when the co-aazon dataet wa ued. VII. COCLUSIO We introduced in thi paper a forenic analyi yte called. The yte can deterine the influential eber of a criinal organization a well a the iediate leader of a given lit of lower-level criinal aociated with the organization. Firt, contruct a network repreenting a criinal organization fro either MCD that belong to the organization or fro crie incident report containing inforation about the organization. A vertex in uch a network repreent an individual criinal and an edge repreent the relationhip between two criinal. identifie the influential eber of the criinal organization by deterining the iportant vertice in the network repreenting the organization, uing the concept of exitence dependency. A vertex v i influential to a et S of vertice in the network, if the exitence of S in the network i dependent on the exitence of v through the path of the MST that connect v with S. Each vertex v i aigned a core, which i the nuber of vertice in et S. Vertice are ranked baed on their core. Criinal repreented by the ranked vertice are conidered the influential eber of the criinal organization. We experientally copared with SIIMCO [19[, Crieet Explorer [12], and LogAnalyi [8] for identifying the iportant vertice in network. Reult revealed that outperfor the three yte. REFERECES [1] Agrete, S., Catanee, S., De Meo, P., Ferrara, E., & Fiuara, G. (2015). etwork Structure and Reilience of Mafia Syndicate. arxiv preprint arxiv: [2] BREIGER, R. L The analyi of ocial network. In Handbook of Data Analyi, M. A. Hardy and A. Bryan, Ed. Sage Publication, London, U.K [3] BREIGER, R. L., BOORMA, S. A., AD ARABIE, P An algorith for clutering relational data, with application to ocial network analyi and coparion with ultidienional caling. J. Math. Pych. 12, [4] BAKER, W. E. AD FAULKER R. R The ocial organization of conpiracy: Illegal network in the heavy electrical equipent indutry. Aer. Soc. Rev. 58, [5] CHE, H. AD LYCH, K. J Autoatic contruction of network of concept characterizing docuent databae. IEEE Tran. Syt. Man Cybernet. 22, [6] CHE, H., ZEG, D., ATABAKHSH, H., WYZGA, W., AD SCHROEDER, J Coplink: Managing law enforceent data and knowledge. Coun. ACM 46, [7] Catanee, S., Ferrara, E., & Fiuara, G. (2013). Forenic analyi of phone call network. Social etwork Analyi and Mining, 3(1), [8] E. Ferrara, P. De Meo, S. Catanee, and G. Fiuara, Detecting criinal organization in obile phone network, Expert Syte with Application, vol. 41, no. 13, pp , [9] Enron Eail Dataet. Available at: [10] Ferrara, E., Catanee, S., & Fiuara, G. (2015). Uncovering Criinal Behavior with Coputational Tool. In Social Phenoena (pp ). Springer International Publihing. [11] Girvan, M., ewan, M. (2002). Counity tructure in ocial and biological network. Proceeding of the ational Acadey of Science, 99(12), [12] J. J. Xu and H. Chen, Crieet explorer: A fraework for criinal network knowledge dicovery, ACM Tran. Inf. Syt., vol. 23, no. 2, pp , Apr [13] J. Pattillo,. Youef, and S. Butenko, Clique relaxation odel in ocial network analyi, in Handbook of Optiization in Coplex etwork. Springer, 2012, pp [14] L. Langohr, Method for finding intereting vertice in weighted graph, Ph.D. diertation, [15] MCADREW, D The tructural analyi of criinal network. In The Social Pychology of Crie: Group, Tea, and etwork. D. Canter and L. Alion, Ed. Dartouth Publihing, UK, [16] Meon, Biharat, Identifying Iportant ode in Weighted Covert etwork Uing Generalized Meaure European Intelligence and Security Inforatic Conference (EISIC 2012). [17] Stanford Tokenizer, Part-of-Speech Tagger, and aed Entity Recognizer. Downloaded fro: [18] Shang, X., Yuan, Y. Social etwork Analyi in Multiple Social etwork Data for Criinal Group Dicovery Conference on

9 Cyber-Enabled Ditributed Coputing and Knowledge Dicovery. [19] Taha, K., and Yoo, P. SIIMCO: A Forenic Invetigation Tool for Identifying the Influential Meber of a Criinal Organization. IEEE Tranaction on Inforation Forenic & Security, 2015, Vol. 11, iue 4, pp [20] Taha, K. "Deterining the Seantic Siilaritie aong Gene Ontology Ter". IEEE Journal of Bioedical and Health Inforatic (IEEE J- BHI), 2013, Vol. 17, Iue 3, pp [21] Taha, K. and Elari, R. "BuSEngine: A Buine Search Engine." Knowledge and Inforation Syte: An International Journal (KAIS), 2010, LCS, Springer, Vol. 23, o. 2, pp [22] Taha, K. and Elari, R. "CXLEngine: A Coprehenive XML Looely Structured Search Engine." In proceeding of Databae technologie for handling XML inforation on the web (DataX'08), France, March [23] Taha, K., Hoouz, D., Al Muhairi, H., and Al Mahoud, Z. "GRank: A Middleware Search Engine for Ranking Gene by [502] Relevance to Given Gene". BMC Bioinforatic 2013, 14:251. [24] Taha, K. and Elari, R. "SPGProfile: Speak Group Profile." Inforation Syte (IS), 2010, Elevier, Vol. 35, o. 7, pp [25] U. K. Wiil, J. Gniadek,. Meon; Meauring Link Iportance in Terrorit etwork. Social etwork Analyi, Conference On Advance in Social etwork Analyi and Mining, ASOAM [26] V. E. Kreb, Uncloaking terrorit network, Firt Monday, vol. 7, pp. 4 11, [27] V. E. Kreb, Mapping network of terrorit cell, Connection, vol. 24 (3), pp , 2002 [28] Web Archive Project. Stanford Large etwork Dataet Collection (online). Available at: Kaal Taha i an Aitant Profeor in the Departent of Electrical and Coputer Engineering at Khalifa Univerity, UAE, ince He received hi Ph.D. in Coputer Science fro the Univerity of Texa at Arlington, USA, in March He ha over 70 refereed publication that have appeared in pretigiou ranked journal, conference proceeding, and book chapter. Fifteen of hi publication have appeared (or are forthcoing) in IEEE Tranaction journal. He wa a an Intructor of Coputer Science at the Univerity of Texa at Arlington, USA, fro Augut 2008 to Augut He worked a Engineering Specialit for Seagate Technology, USA, fro 1996 to 2005 (Seagate i a leading coputer dic drive anufacturer in the US). Hi reearch interet pan Inforation Forenic & Security, bioinforatic, inforation retrieval, data ining, and databae, with an ephai on aking data retrieval and exploration in eerging application ore effective, efficient, and robut. He erve a a eber of the Progra Coittee, editorial board, and review panel for a nuber of international conference and journal, oe of which are IEEE and ACM journal. He i a Senior Meber of IEEE. Paul D. Yoo received hi PhD in Engineering and IT fro the Univerity of Sydney (USyd) in He wa a Reearch Fellow in the Centre for Ditributed and High Perforance Coputing, at USyd fro 2008 to 2009, and PHD Reearcher (Quantitative Analyi) at the Capital Market CRC, adinitered by the Autralia Federal Dept. for Education, Science and Training, fro 2004 to He wa with the ATIC-Khalifa Seiconductor Reearch Center, KUSTAR fro 2009 to Fro 2014 to 2016 he worked a a Lecturer at the Data Science Intitute, Bourneouth Univerity, U.K. He i currently a Lecturer at Cranfield Univerity and Defence Acadey, U.K. He hold over 60 pretigiou journal and conference publication and i currently actively involved in editorial board, technical progra coittee, and review panel of the data cience and analytic area for conference and journal.