Collins, L

Elliott, JR

Lambourne, AD

Miller, S

Schreuders, ZC

Leeds Beckett Repository

 SoİtǄare Pilot and User Guide EWT: Chat Loı Groominı DeteĊtion  AndƐeǄ LamĉouƐne, John Elliott, Stephen MilleƐ, LeǄis Collins, and Z. Cliİİe SĊhƐeudeƐs Leeds BeĊkett UniǃeƐsitǊ and West YoƐkshiƐe PoliĊe ǻǹǺȁ   This soİtǄare is Ċurrently aǃailaĉle İor poliĊe use. ​See ĉeloǄ İoƐ details on oĉtaininı EWT and paƐtiĊipatinı in the pilot.    The CARI ProjeĊt The CARI PƐojeĊt is a laƐıe-sĊale ĊollaĉoƐation ĉetǄeen West YoƐkshiƐe PoliĊe and the ​CǊĉeƐĊƐime and SeĊuƐitǊ Innoǃation CentƐe ɇCSI                                     CentƐeɈ at Leeds BeĊkett UniǃeƐsitǊ​. The CARI PƐojeĊt aims to impƐoǃe and inĊoƐpoƐate an eǃidenĊe-ĉased appƐoaĊh into the poliĊinı                                     oİ diıital İoƐensiĊs and ĊǊĉeƐĊƐime inǃestiıations. An eǉtensiǃe needs assessment oİ UK poliĊinı and ĊǊĉeƐĊƐime and diıital eǃidenĊe                                   Ǆas ĊonduĊted to undeƐstand the ĊuƐƐent situation, and to identiİǊ needs aĊƐoss the İoƐĊe. The CARI PƐojeĊt also inǃolǃed                                     implementinı a tƐaininı and ƐeseaƐĊh pƐoıƐamme that has impaĊted the ĊapaĉilitǊ oİ the diıital İoƐensiĊs and ĊǊĉeƐ units Ǆithin West                                       YoƐkshiƐe PoliĊe to enıaıe in ƐeseaƐĊh. This needs assessment and ƐeseaƐĊh tƐaininı led to the deǃelopment oİ a set oİ ƐeseaƐĊh                                         pƐoposals, ǄhiĊh ǄeƐe sĊoƐed and seleĊted. SuĉseƏuentlǊ, aĊademiĊs and poliĊe staİİ Ċo-pƐoduĊed Ȃ ƐeseaƐĊh and deǃelopment                               ǄoƐkstƐeams: a İƐameǄoƐk İoƐ seizuƐe, pƐeseƐǃation and pƐeseƐǃation oİ Ċloud eǃidenĊe; automated İoƐensiĊ analǊsis; imaıe linkaıe İoƐ                                 ǃiĊtim identiİiĊation and İƐameǄoƐk İoƐ imaıe İinıeƐpƐint manaıement; automated ıƐoominı deteĊtion; İƐontline oİİiĊeƐ aǄaƐeness                           deǃelopment and deĊision suppoƐt moĉile app; assessment oİ methods oİ ĊǊĉeƐ tƐaininı; an eǃaluation oİ the Ɛole oİ the Diıital Media                                         InǃestiıatoƐ Ǆithin WYP; and ĊhaƐaĊteƐistiĊs oİ ǃiĊtims oİ ĊǊĉeƐĊƐime. EaĊh oİ these pƐojeĊts ǄeƐe desiıned to addƐess needs Ǆithin                                     laǄ enİoƐĊement and outputs inĊlude eǃidenĊe-ĉased pƐoĊeduƐes, neǄ Ċapaĉilities suĊh as soİtǄaƐe/alıoƐithms, and aĊtionaĉle                           intelliıenĊe. This ǄoƐk Ǆas suppoƐted ĉǊ a PoliĊe KnoǄledıe Fund ıƐant, administeƐed ĉǊ the Home OİİiĊe, Colleıe oİ PoliĊinı, and the HiıheƐ                                         EduĊation Fundinı CounĊil İoƐ Enıland ɇHEFCEɈ.   EWT: Chat Loı Groominı DeteĊtion The aim oİ this ǄoƐk is the ĊƐeation oİ tools and teĊhniƏues to deteĊt and İlaı eǃidenĊe oİ                                   pƐedatoƐǊ ĉehaǃiouƐ ĉǊ sĊanninı Ċhat and otheƐ soĊial media loıs eǉtƐaĊted İƐom seized                         eƏuipment. Althouıh the ƐeseaƐĊh liteƐatuƐe pƐoposes teĊhniƏues İoƐ modellinı and                   deteĊtinı ɕluƐinıɖ dialoıues ɇOlson et al., ǻǹǹȀ; LeatheƐman, ǻǹǹȂɈ, Diıital FoƐensiĊs                     Units ɇDFUɈ tǊpiĊallǊ ƐelǊ on manual ƐeǃieǄ, seaƐĊhinı, and simple keǊǄoƐd lists. Based                         on analǊsis oİ this inİoƐmation and the assoĊiated aĊademiĊ papeƐs, a seƐies oİ pƐedatoƐǊ                           speeĊh aĊts ǄeƐe identiİied as ĉeinı Ɛeleǃant to the automated deteĊtion oİ ıƐoominı.                         The EWT sĊanninı alıoƐithm Ǆas tuned and Ɛeİined İiƐst aıainst PJ loıs and also aıainst                             Ɛeal ǄoƐld data.  The Ɛesult is a soİtǄaƐe tool that Ċan ĉe used ĉǊ inǃestiıatoƐs to automate loı-İile                             sĊƐeeninı to ƏuiĊklǊ İilteƐ thƐouıh Ċhat loıs to identiİǊ eǃidenĊe. The appƐoaĊh is                         suİİiĊientlǊ ıeneƐiĊ to alloǄ the same tool to ĉe used Ǆith diİİeƐent leǉiĊons to deteĊt                             otheƐ dialoıues oİ ĊonĊeƐn suĊh as ĊǊĉeƐ-stalkinı and ƐadiĊalisation oƐ teƐƐoƐist                     ƐeĊƐuitment. CuƐƐent status: Ǆe aƐe pilotinı the soİtǄaƐe in a numĉeƐ oİ İoƐĊes ɇstaƐted MaǊ ǻǹǺȁɈ. UK                               İoƐĊes aƐe inǃited to ĊontaĊt DCI Vanessa Smith ɇ​ǃanessa.smith                 @ǄestǊoƐkshiƐe.pnn.poliĊe.uk​Ɉ and DƐ Z. Cliİİe SĊhƐeudeƐs ɇ​Ċ.sĊhƐeudeƐs             @leedsĉeĊkett.aĊ.uk​Ɉ to join the pilot.  Contents HoǄ to install StaƐtinı EWT HoǄ the soİtǄaƐe is used Step ǺɈ ImpoƐt Ċhat loıs. Step ǻɈ PƐoĊess Ċhat loıs. Step Ǽ: VieǄ Ɛesults. Step ǽɈ PƐoǃidinı İeedĉaĊk. InİoƐmation sheet Consent statement    HoǄ to install EWT has ĉeen deǃeloped and tested on Linuǉ and WindoǄs. Step ǺɈ Install AnaĊonda, PǊthon ǻ.Ȁ ǃeƐsion AnaĊonda Ċan ĉe doǄnloaded İƐom heƐe: https://ǄǄǄ.anaĊonda.Ċom/doǄnload This inĊludes all the ǃaƐious liĉƐaƐies Ǌou need to Ɛun EWT. AlteƐnatiǃelǊ, Ǌou Ċould manuallǊ install PǊthon ǻ.Ȁ, QtǾ, and all the ƐeƏuiƐed PǊthon                         modules, inĊludinı ǉlsǉǄƐiteƐ, aƐıpaƐse, and hashliĉ. HoǄeǃeƐ, installinı AnaĊonda is the                     ƐeĊommended appƐoaĊh. Step ǻɈ Saǃe the EWT soİtǄaƐe to a loĊation oİ ǊouƐ Ċhoosinı ɇsuĊh as a İoldeƐ in ǊouƐ                                   home diƐeĊtoƐǊɈ. Iİ Ǌou ƐeĊeiǃed EWT as a zip İile, this inǃolǃes eǉtƐaĊtinı the Ċontents oİ                               that İile to a PC.  Note: Ǌou Ǆill launĊh the soįtǄare įrom this įolder. Iį Ǌou Ǆant to add a shortĊut to Ǌour                                   desktop, Ǌou Ċan ĊopǊ the eǄt_ǄindoǄs shortĊut to Ǌour desktop, then edit the shortĊut ĉǊ riİht                               ĊliĊkinİ the ĊopǊ oį the shortĊut, seleĊtinİ Properties, and the Tarİet įield Ċan ĉe edited to insert                                 the įull path Ǆhere Ǌou haǃe saǃed fWT just ĉeįore ɕeǄt_İui.pǊɖ. For eǉample: it ĉeĊomes                             ...ɕstart pǊthonǄ C:\fWT\eǄt_İui.pǊɖ...  Startinı EWT On WindoǄs Ǆith AnaĊonda​, simplǊ douĉle ĊliĊk on ɕeǄt_ǄindoǄsɖ  On Linuǉ Ǆith AnaĊonda,​ simplǊ Ɛun ɕeǄt_linuǉ.shɖ Or on WindoǄs or Linuǉ Ǆith manual install​, staƐt a ĉash shell in the EWT diƐeĊtoƐǊ and Ɛun: python ewt_gui.py    HoǄ the soİtǄare is used FiƐst, ĊƐeate a Ċase.  Step Ǻ) Import Ċhat loıs.  The tool impoƐts TSV eǉpoƐts, ǄhiĊh most İoƐensiĊ tools Ċan easilǊ eǉpoƐt Ċhat loıs to.     Step ǻ) ProĊess Ċhat loıs.  SimplǊ ĊliĊk ɕAnalǊse!ɖ  EǃeƐǊ messaıe is analǊsed and Ɛesults aƐe saǃed.      Step Ǽ: VieǄ results.  SimplǊ douĉle ĊliĊk to open eaĊh Ɛesults İile, ǄhiĊh aƐe spƐeadsheets Ǆith İilteƐs İoƐ                           ƏuiĊklǊ ǃieǄinı and makinı sense oİ the Ċhat loıs.  EǃeƐǊ messaıe has ĉeen analǊsed and assiıned a matĊhinı ​speeĊh aĊt ĊateıoƐǊ.                       CateıoƐies inĊlude:  ● DireĊt Seǉual​: eǉpliĊitlǊ seǉual ● IndireĊt Seǉual​: seǉual innuendo and desensitisation ● Aıe​: Ɛelated to aıe ● Pleadinı/Demandinı​: ĉeııinı, pleadinı, and demandinı ● ApproaĊh​: in peƐson meet ups and initiatinı ĊontaĊt ● Groomers​: ıƐoomeƐs talkinı to ıƐoomeƐs ● Personal​: eǉĊhanıinı peƐsonal inİoƐmation, inĊludinı disĊussinı appeaƐanĊe,             İamilǊ, home, and disĊussinı photos, ǄeĉĊams ● Compliments​: appeaƐanĊe Ċompliments ● Neıatiǃe​: Ɛeİusals, and neıatiǃe Ɛesponses to adǃanĊes ● Trust​: Ɛelated to ĉuildinı tƐust, and ƐeassuƐinı ● Isolation​: isolation İƐom otheƐs    A summaƐǊ doĊument ɇɕ...summaƐǊ.ǉlsǉɖɈ pƐoǃides an oǃeƐǃieǄ oİ the Ɛesults oİ analǊsis.                       This ǃieǄ Ċan help to pƐoǃide insiıhts suĊh as one sided ĊonǃeƐsations, and Ċhat İiles Ǆith                               a hiıh numĉeƐ oİ hits aıainst these ĊateıoƐies.  DƐillinı doǄn, eaĊh Ċhat loı is stoƐed in a sepaƐate spƐeadsheet, Ċoded aıainst the speeĊh                             aĊts:  ɇContents in these imaİes haǃe ĉeen Ċensored.Ɉ We ĊlassiİǊ the İiƐst siǉ ĊateıoƐies           ɇDiƐeĊt Seǉual, IndiƐeĊt Seǉual, Aıe,         Pleadinı/Demandinı, AppƐoaĊh, and     (ƐoomeƐsɈ as ɕRedɖ ɇhiıhest ĊonĊeƐnɈ,         the otheƐs as ɕAmĉeƐɖ. FoƐ a ƏuiĊk ǃieǄ oİ the hiıhest ĊonĊeƐn               messaıes, messaıes Ċan ĉe İilteƐed to           ɕRedɖ tƐaİİiĊ liıht:     LikeǄise, messaıes Ċan ĉe İilteƐed doǄn at the ĊateıoƐǊ leǃel, to deteĊt attempts to                           meet:  OƐ İoĊusinı on seǉual Ċomments:     Step ǽ) Proǃidinı İeedĉaĊk. We ask that duƐinı the pilot, poliĊe useƐs pƐoǃide us Ǆith İeedĉaĊk ƐeıaƐdinı theiƐ use oİ                               EWT.  Please Ċomplete a shoƐt suƐǃeǊ Ǆithin the soİtǄaƐe, ​İor eaĊh and eǃery Ċase durinı the                             pilot period​. TheƐe aƐe onlǊ a İeǄ Əuestions to ansǄeƐ, and this input is eǉtƐemelǊ                             ǃaluaĉle İoƐ Ċontinued ƐeseaƐĊh and deǃelopment.  Please let us knoǄ ǄhetheƐ this is a liǃe oƐ histoƐiĊal Ċase; ǄhetheƐ it has ɇoƐ Ǆould haǃeɈ                                   assisted the inǃestiıation; and hoǄ muĊh time EWT saǃed ĊompaƐed to tǊpiĊal                       manual/keǊǄoƐd seaƐĊhes. Based on the judıement oİ the inǃestiıatoƐ, state ǄhiĊh İiles ǄeƐe ​ıroominı ɇthat is                           eǃidenĊe oƐ diƐeĊtlǊ Ɛeleǃant to the inǃestiıationɈ or suspiĊious ɇƐelated oƐ helpİul ĉut not                           diƐeĊtlǊ useİul as eǃidenĊeɈ. TheƐe aƐe just tǄo Əuestions ǄheƐe Ǆe ask İoƐ some ǄƐitten İeedĉaĊk: Please pƐoǃide some ǄƐitten İeedĉaĊk, Ǆith anǊ positiǃe oƐ neıatiǃe İeedĉaĊk oƐ                       suııestions. A sentenĊe oƐ tǄo at minimum please. FinallǊ, ǄhetheƐ theƐe aƐe anǊ Ċhat messaıes that haǃe ĉeen inĊoƐƐeĊtlǊ İlaııed oƐ                         missed. The useƐ is pƐompted to ƐedaĊt anǊ sensitiǃe Ċontent ɇsuĊh as names and plaĊesɈ                             and pƐoǃide some eǉamples. The pƐoıƐam saǃes these İeedĉaĊk Ɛesponses alonı Ǆith ƐedaĊted ǃeƐsions oİ the analǊsis                         outputs to a ɕİeedĉaĊkɖ İoldeƐ. The ƐedaĊted ǃeƐsions do not Ċontain anǊ messaıe                         Ċontents oƐ paƐtiĊipant names. We ask that the İeedĉaĊk İoldeƐ ĉe pƐoǃided ĉaĊk to us İoƐ                               ƐeseaƐĊh puƐposes. OǃeƐ the İolloǄinı months Ǆe Ǆill aƐƐanıe İoƐ these to ĉe ƐetuƐned to                             us. This inİoƐmation Ǆill enaĉle us to eǃaluate and impƐoǃe the sǊstem, and deǃelop İuƐtheƐ                           teĊhniƏues to automate ǃia maĊhine leaƐninı the pƐoĊess oİ İlaııinı Ċhat loıs most likelǊ                           to Ċontain ıƐoominı.    Inİormation sheet Project aims Thank you for your participation in this study. The aim of this work is the creation of tools and techniques to detect and flag evidence of predatory behaviour by scanning chat and other social media logs extracted from seized equipment. Although the research literature proposes techniques for modelling and detecting “luring” dialogues (Olson et al., 2007; Leatherman, 2009), Digital Forensics Units (DFU) typically rely on manual review, searching, and simple keyword lists. Based on analysis of this information and the associated academic papers, a series of predatory speech acts were identified as being relevant to the automated detection of grooming. The EWT scanning algorithm was tuned and refined first against PJ logs and also against real world data.  The result is a software tool that can be used by investigators to automate log-file screening to quickly filter through chat logs to identify evidence. The approach is sufficiently generic to allow the same tool to be used with different lexicons to detect other dialogues of concern such as cyber-stalking and radicalisation or terrorist recruitment. Current status: we are piloting the software in a number of forces (started May 2018). UK forces are invited to contact DCI Vanessa Smith (vanessa.smith@westyorkshire.pnn.police.uk) and Dr Z. Cliffe Schreuders (c.schreuders@leedsbeckett.ac.uk) to join the pilot.  The results from this pilot will help us to evaluate our existing approach, and to continue research and development into techniques for digital investigation and detection of predatory behaviour. Your participation You have been chosen to take part in this study, because you are involved in police cases and processes that can potentially involve digital evidence and cybercrime, processing chat logs for predatory behaviour as part of police investigations. Your input is very valuable to the project, and we hope you will continue to participate. However, you are under no obligation to take part and can withdraw involvement at any stage.  What do I have to do? Forces who participate in the pilot will use the EWT software to triage chat logs as part of digital investigations, and provide feedback on the effectiveness of the approach. Forces can choose to trial the software on historical cases, or deploy onto live cases, as they deem fit, in combination with any tools and techniques they traditionally use. The identity of investigators, victims, and offenders We ask police to ensure the information they provide via the feedback survey contains no sensitive data, including their own identity.  The feedback data set sent back to us should include no sensitive data; the software automatically creates two copies of it’s output, a sensitive version for police use (including message contents and participants names), and a redacted version for research purposes. Forces are welcome to review the raw data and software code before the feedback directory is sent to us for analysis. No sensitive personally identifiable data will be published. Results are normally presented in terms of groups of individuals, and overall statistics and findings. What are the benefits of taking part? As a force engaged in the pilot, you will have free access to the EWT software (and you can continue using this software for free after the pilot). The EWT software is intended to provide you with tools to save time and increase the effectiveness of digital investigations involving large quantities of chat logs. You will be helping us to identify areas for improvement for yourselves in your day-to-day roles. These results will be used to understand how these tools can be improved, and we will use this information to continue development of these techniques and software, potentially impacting your own working environment and the effectiveness of cybercrime investigation. This work is also intended to benefit other police forces and researchers: results will be published in academic venues, such as peer-reviewed conferences and journals. Results will also be summarised and disseminated in presentations, on websites, and in training materials.  Who is funding the research? Development of EWT was supported by a Police Knowledge Fund grant, administered by the Home Office, College of Policing, and the Higher Education Funding Council for England (HEFCE). Leeds Beckett University and West Yorkshire Police led the CARI Project and are continuing to collaborate on the research. CARI Project overview The CARI Project is a large-scale collaboration between West Yorkshire Police and the Cybercrime and Security Innovation Centre (CSI Centre) at Leeds Beckett University. The CARI Project aims to improve and incorporate an evidence-based approach into the policing of digital forensics and cybercrime investigations. An extensive needs assessment of UK policing and cybercrime and digital evidence was conducted to understand the current situation, and to identify needs across the force. The CARI Project also involved implementing a training and research programme that has directly impacted the capability of the digital forensics and cyber units within West Yorkshire Police to engage in research. This needs assessment and research training led to the development of a set of research proposals, which were scored and selected. Subsequently, academics and police staff co-produced 9 research and development workstreams: a framework for seizure, preservation and preservation of cloud evidence; automated forensic analysis; image linkage for victim identification and framework for image fingerprint management; automated grooming detection; frontline officer awareness development and decision support mobile app; assessment of methods of cyber training; an evaluation of the role of the Digital Media Investigator within WYP; and characteristics of victims of cybercrime. Each of these projects were designed to address needs within law enforcement and outputs include evidence-based procedures, new capabilities such as software/algorithms, and actionable intelligence. Consent statement By participating in the EWT pilot and completing the feedback surveys: I confirm that I have read and understand the above. I understand that all personal information will remain confidential and that all efforts will be made to ensure I cannot be identified (except as might be required by law). I agree that data gathered in this study may be stored anonymously and securely, and may be used for future research. I understand that my participation is voluntary and that I am free to withdraw at any time without giving a reason. I agree to take part in this study.  

Software Pilot and User Guide EWT: Chat Log Grooming Detection

http://eprints.leedsbeckett.ac.uk/5078/7/Software%20Pilot%20and%20User%20Guide%20EWT%20-%20Chat%20Log%20Grooming%20Detection.pdf

Software Pilot and User Guide EWT: Chat Log Grooming Detection

Abstract

Similar works

Full text

Available Versions

Leeds Beckett Repository