Home > Research > Publications & Outputs > iCOP

Electronic data

  • icop_DI_2

    Rights statement: This is the author’s version of a work that was accepted for publication in Digital Investigation. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Digital Investigation, 18, 2016 DOI: 10.1016/j.diin.2016.07.002

    Accepted author manuscript, 208 KB, PDF document

    Available under license: CC BY-NC-ND: Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License

Links

Text available via DOI:

View graph of relations

iCOP: live forensics to reveal previously unknown criminal media on P2P networks

Research output: Contribution to Journal/MagazineJournal articlepeer-review

Published

Standard

iCOP : live forensics to reveal previously unknown criminal media on P2P networks. / Peersman, Claudia; Schulze, Christian; Rashid, Awais et al.

In: Digital Investigation, Vol. 18, 01.09.2016, p. 50-64.

Research output: Contribution to Journal/MagazineJournal articlepeer-review

Harvard

APA

Vancouver

Peersman C, Schulze C, Rashid A, Brennan M, Fischer C. iCOP: live forensics to reveal previously unknown criminal media on P2P networks. Digital Investigation. 2016 Sep 1;18:50-64. Epub 2016 Jul 16. doi: 10.1016/j.diin.2016.07.002

Author

Peersman, Claudia ; Schulze, Christian ; Rashid, Awais et al. / iCOP : live forensics to reveal previously unknown criminal media on P2P networks. In: Digital Investigation. 2016 ; Vol. 18. pp. 50-64.

Bibtex

@article{f895f319ce8d4264b3272a6dfce57c9f,
title = "iCOP: live forensics to reveal previously unknown criminal media on P2P networks",
abstract = "The increasing levels of criminal media being shared in peer-to-peer (P2P) networks pose a significant challenge to law enforcement agencies. One of the main priorities for P2P investigators is to identify cases where a user is actively engaged in the production of child sexual abuse (CSA) media – they can be indicators of recent or on-going child abuse. Although a number of P2P monitoring tools exist to detect paedophile activity in such networks, they typically rely on hash value databases of known CSA media. As a result, these tools are not able to adequately triage the thousands of results they retrieve, nor can they identify new child abuse media that are being released on to a network. In this paper, we present a new intelligent forensics approach that incorporates the advantages of artificial intelligence and machine learning theory to automatically flag new/previously unseen CSA media to investigators. Additionally, the research was extensively discussed with law enforcement cybercrime specialists from different European countries and Interpol. The approach has been implemented into the iCOP toolkit, a software package that is designed to perform live forensic analysis on a P2P network environment. In addition, the system offers secondary features, such as showing on-line sharers of known CSA files and the ability to see other files shared by the same GUID or other IP addresses used by the same P2P client. Finally, our evaluation on real CSA case data shows high degrees of accuracy, while hands-on trials with law enforcement officers demonstrate the toolkit{\textquoteright}s complementarity to extant investigative workflows.",
keywords = "Computer crime, Peer-to-peer computing, Image classification, Text analysis, Forensic triage",
author = "Claudia Peersman and Christian Schulze and Awais Rashid and Margaret Brennan and Carl Fischer",
note = "This is the author{\textquoteright}s version of a work that was accepted for publication in Digital Investigation. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Digital Investigation, 18, 2016 DOI: 10.1016/j.diin.2016.07.002",
year = "2016",
month = sep,
day = "1",
doi = "10.1016/j.diin.2016.07.002",
language = "English",
volume = "18",
pages = "50--64",
journal = "Digital Investigation",
issn = "1742-2876",
publisher = "Elsevier",

}

RIS

TY - JOUR

T1 - iCOP

T2 - live forensics to reveal previously unknown criminal media on P2P networks

AU - Peersman, Claudia

AU - Schulze, Christian

AU - Rashid, Awais

AU - Brennan, Margaret

AU - Fischer, Carl

N1 - This is the author’s version of a work that was accepted for publication in Digital Investigation. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Digital Investigation, 18, 2016 DOI: 10.1016/j.diin.2016.07.002

PY - 2016/9/1

Y1 - 2016/9/1

N2 - The increasing levels of criminal media being shared in peer-to-peer (P2P) networks pose a significant challenge to law enforcement agencies. One of the main priorities for P2P investigators is to identify cases where a user is actively engaged in the production of child sexual abuse (CSA) media – they can be indicators of recent or on-going child abuse. Although a number of P2P monitoring tools exist to detect paedophile activity in such networks, they typically rely on hash value databases of known CSA media. As a result, these tools are not able to adequately triage the thousands of results they retrieve, nor can they identify new child abuse media that are being released on to a network. In this paper, we present a new intelligent forensics approach that incorporates the advantages of artificial intelligence and machine learning theory to automatically flag new/previously unseen CSA media to investigators. Additionally, the research was extensively discussed with law enforcement cybercrime specialists from different European countries and Interpol. The approach has been implemented into the iCOP toolkit, a software package that is designed to perform live forensic analysis on a P2P network environment. In addition, the system offers secondary features, such as showing on-line sharers of known CSA files and the ability to see other files shared by the same GUID or other IP addresses used by the same P2P client. Finally, our evaluation on real CSA case data shows high degrees of accuracy, while hands-on trials with law enforcement officers demonstrate the toolkit’s complementarity to extant investigative workflows.

AB - The increasing levels of criminal media being shared in peer-to-peer (P2P) networks pose a significant challenge to law enforcement agencies. One of the main priorities for P2P investigators is to identify cases where a user is actively engaged in the production of child sexual abuse (CSA) media – they can be indicators of recent or on-going child abuse. Although a number of P2P monitoring tools exist to detect paedophile activity in such networks, they typically rely on hash value databases of known CSA media. As a result, these tools are not able to adequately triage the thousands of results they retrieve, nor can they identify new child abuse media that are being released on to a network. In this paper, we present a new intelligent forensics approach that incorporates the advantages of artificial intelligence and machine learning theory to automatically flag new/previously unseen CSA media to investigators. Additionally, the research was extensively discussed with law enforcement cybercrime specialists from different European countries and Interpol. The approach has been implemented into the iCOP toolkit, a software package that is designed to perform live forensic analysis on a P2P network environment. In addition, the system offers secondary features, such as showing on-line sharers of known CSA files and the ability to see other files shared by the same GUID or other IP addresses used by the same P2P client. Finally, our evaluation on real CSA case data shows high degrees of accuracy, while hands-on trials with law enforcement officers demonstrate the toolkit’s complementarity to extant investigative workflows.

KW - Computer crime

KW - Peer-to-peer computing

KW - Image classification

KW - Text analysis

KW - Forensic triage

U2 - 10.1016/j.diin.2016.07.002

DO - 10.1016/j.diin.2016.07.002

M3 - Journal article

VL - 18

SP - 50

EP - 64

JO - Digital Investigation

JF - Digital Investigation

SN - 1742-2876

ER -