CoChat
Sign Up
Cited by 33Digital and Cyber ForensicsCybercrime and Law Enforcement StudiesDigital Media Forensic Detection

The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.

iCOP: Live forensics to reveal previously unknown criminal media on P2P networks

Open access
Peersman, Claudia, Schulze, Christian, Rashid, Awais, Brennan, Margaret, Fischer, Carl·2016·Digital Investigation
DOI 10.1016/j.diin.2016.07.002
Open this paper in CoChat — free accountOpen PDF

Abstract

The increasing levels of criminal media being shared in peer-to-peer (P2P) networks pose a significant challenge to law enforcement agencies. One of the main priorities for P2P investigators is to identify cases where a user is actively engaged in the production of child sexual abuse (CSA) media – they can be indicators of recent or on-going child abuse. Although a number of P2P monitoring tools exist to detect paedophile activity in such networks, they typically rely on hash value databases of known CSA media. As a result, these tools are not able to adequately triage the thousands of results they retrieve, nor can they identify new child abuse media that are being released on to a network. In this paper, we present a new intelligent forensics approach that incorporates the advantages of artificial intelligence and machine learning theory to automatically flag new/previously unseen CSA media to investigators. Additionally, the research was extensively discussed with law enforcement cybercrime specialists from different European countries and Interpol. The approach has been implemented into the iCOP toolkit, a software package that is designed to perform live forensic analysis on a P2P network environment. In addition, the system offers secondary features, such as showing on-line sharers of known CSA files and the ability to see other files shared by the same GUID or other IP addresses used by the same P2P client. Finally, our evaluation on real CSA case data shows high degrees of accuracy, while hands-on trials with law enforcement officers demonstrate the toolkit's complementarity to extant investigative workflows.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1016/j.diin.2016.07.002

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Targeted chats can be used to target under-aged online users (minors and children) for sexual favors and abuse.

    “Targeted chats can be used to spread hatred [7], manipulate the victim for propaganda, coordinate criminal or terrorist activities [1,2,8], radicalization, and in the worst of scenarios to target under-aged online users (minors and children) for sexual favors and abuse [9,10].”

    From Online grooming detection: A comprehensive survey of child exploitation in chat logs (2023) · cites this paper as [10]

    The Introduction and the section on challenges for live forensic analysis discuss online child sexual abuse and the identification of child victims. They do not say that targeted chats are used to approach minors for sexual favors or abuse; the paper focuses on child sexual abuse media shared through P2P networks. No page numbers are available in our copy. (LLM, conf=0.82)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 40

  1. Benzecri, 1973, L'analyse des donnees, vol. 1
  2. Casey, 2009, Investigation delayed is justice denied: proposals for expediting forensic examinations of digital evidence, J Forensic Sci, 54, 1353, 10.1111/j.1556-4029.2009.01150.x · DOI
  3. Cooper, 1998, Sexuality and the internet: surfing into the new millenium, Cyberpsychology Behav, 1, 187, 10.1089/cpb.1998.1.187 · DOI · Paper page
  4. da Silva Eleuterio, 2012, An adaptive sampling strategy for automatic detection of child pornographic videos, Int. Conf. on Forensic Comput Sci, 12, 10.5769/C2012002 · DOI
  5. Edwards, 2012, Collaborative filtering as an investigative tool for peer-to-peer filesharing networks, SCIENCE, 1, 67
  6. Fan, 2008, LIBLINEAR: a library for large linear classification, J Mach Learn Res, 9, 1871
  7. Ferraro, 2004, Current issues confronting well-established computer-assisted child exploitation and computer crime task forces, Digit Investig, 1, 715, 10.1016/j.diin.2004.01.004 · DOI
  8. Gummadi, 2003, Measurement, modeling and analysis of a peer-to-peer file-sharing workload, SIGOPS Oper Syst Rev, 37, 314, 10.1145/1165389.945475 · DOI
  9. Hsieh C, Chang K, Lin C, Keerthi S, Sundararajan S. A dual coordinate descent method for large-scale linear SVM. In Proceedings of the twenty fifth international conference on machine learning (ICML). 2008. p. 408–415. · DOI
  10. Huang, 1997, Image indexing using color correlograms, CVPR, 762
  11. Hughes, 2006, Is deviant behaviour the norm on p2p file-sharing networks?, IEEE Distrib Syst Online, 7, 10.1109/MDSO.2006.13 · DOI
  12. Hurley R, Prusty S, Soroush H, Walls R. Measurement and analysis of child pornography trafficking on P2P networks. In Proceedings of the international world wide web conference, Brazil, 2013. · DOI
  13. Irons, 2014, Digital forensics to intelligent forensics, Future Internet, 6, 584, 10.3390/fi6030584 · DOI
  14. Joffres K, Bouchard M, Frank R, Westlake B. Strategies to disrupt online child pornography networks. Paper presented at the European intelligence and security informatics conference, Athens, Greece, 2011. · DOI
  15. Jones, 2002, Statistical color models with application to skin detection, Int J Comput Vis, 46, 81, 10.1023/A:1013200319198 · DOI
  16. Kim C, Kwon O, Kim W, Choi S. Automatic system for filtering obscene video. In Proceedings of the 10th international conference on advanced communication technology. 2008. p. 1435–1438. · DOI
  17. Latapy, 2013, Quantifying paedophile activity in a large P2P system, Inf Process Manag, 49, 248, 10.1016/j.ipm.2012.02.008 · DOI
  18. Lazebnik S, Schmid C, Ponce J. Beyond bags of features: Spatial pyramid matching for recognizing natural scene categories. IEEE computer society conference on computer vision and pattern recognition, vol. 2. 2006. pp 2169–2178. · DOI · Paper page
  19. Lee, 2006, Implementation of high performance objectionable video classification system, ICACT, 959
  20. Liberatore M, Erdely R, Kerle T, Levine B, Shields C. Forensic investigation of peer-to-peer file sharing networks. In Proc DFRWS Annu Digital Forensics Res Conf, 2010. · DOI
  21. Liberatore M, Levine B, Shields C. Strengthening forensic investigations of child pornography on P2P networks. In Proc ACM Conf Emerg Netw Exp Technol (CoNEXT), 2010. · DOI
  22. Marturana, 2013, A machine learning-based triage methodology for automated categorization of digital media, Digital Investigation Int J Digital Forensics Incident Response, 10, 193, 10.1016/j.diin.2013.01.001 · DOI
  23. Ojala T, Rautiainen M, Matinmikko E, Aittola M. Semantic image retrieval with HSV correlograms. In Proceedings of the 12th scandinavian conference on image analysis. 2001. p. 621–627.
  24. Panchenko A, Beaufort R, Fairon C. Detection of child sexual abuse media on p2p networks: normalization and classification of associated filenames. In Proc Workshop Lang Resour Public Secur Appl 8th Int Conf Lang Resour Eval (LREC), 2012.
  25. Prichard, 2011, Internet subcultures and pathways to the use of child pornography, Comput Law Secur Rev, 27, 585, 10.1016/j.clsr.2011.09.009 · DOI
  26. Quayle, 2000, The internet and offending behaviour: a case study, J Sex Aggress, 6, 78, 10.1080/13552600008413311 · DOI
  27. Quick, 2016, Big forensic data reduction: digital forensic images and electronic evidence, Clust Comput, 1
  28. Rashid, 2013, Who am I? Analyzing digital personas in cybercrime investigations, IEEE Comput, 46, 54, 10.1109/MC.2013.68 · DOI
  29. Rautiainen M, Ojala T. Color correlograms in image and video retrieval. In Proceedings of the 10th finnish artificial intelligence conference. 2002. pp. 203–212.
  30. Rogers M, Goldman J, Mislan R, Wedge T, Debrota S. Computer forensics field triage process model. In Proceedings of the 2006 conference on digital forensics security and law. 2006. p. 2740. · DOI
  31. Rowley, 2006, Large scale image-based adult-content filtering, Int Conf Comp Vis Theory Appl, 290
  32. Sebastiani, 2002, Machine learning in automated text categorization, ACM Comput Surv, 34, 1, 10.1145/505282.505283 · DOI
  33. Seiffert, 2014, An empirical study of the classification performance of learners on imbalanced and noisy software quality data, Inf Sci, 259, 571, 10.1016/j.ins.2010.12.016 · DOI
  34. Shiaeles, 2013, On-scene triage open source forensic tool chests: are they effective?, Digit Investig, 10, 99115, 10.1016/j.diin.2013.04.002 · DOI
  35. A. Ulges, A. Stahl, “Automatic Detection of Child Pornography using Color Visual Words”, In Proc. of the Int. Conf. Multimedia and Expo, 2011. · DOI
  36. Vidas, 2014, OpenLV: empowering investigators and first-responders in the digital forensics process, Digit Investig, 11, S45, 10.1016/j.diin.2014.03.006 · DOI
  37. Wang F, Kan M. “NPIC: hierarchical synthetic image classification using image search and generic features”, In Proceedings of the Conference on Image and Video Retrieval, pp. 473–482, 2006. · DOI
  38. Westlake, 2011, Finding the key players in online child exploitation networks, Policy Internet, 3, 1, 10.2202/1944-2866.1126 · DOI
  39. Westlake B, Bouchard M, Frank R. “Comparing methods for detecting child exploitation content online”, In European Intelligence and Security Informatics Conference (EISIC), pp. 156–163, 2012. · DOI
  40. Xiaofeng T, Duan L, Xu C, Tian Q, Hanqing L, Wang J, Jin J. Periodicity detection of local motion. IEEE International Conference on Multimedia and Expo. 2005. pp. 650–653. · DOI

Cited by

Sorted by citations

Metadata

Authors
Peersman, C., Schulze, C., Rashid, A., Brennan, M., & Fischer, C.
Affiliations
  • Lancaster University (GB)
  • German Research Centre for Artificial Intelligence (DE)
  • University College Cork (IE)
Corresponding author
Peersman, Claudia
ORCID
Venue
Digital Investigation
Publisher
Elsevier BV
Published
2016-09
Volume
18
Pages
50-64
ISSN
1742-2876 (ISSN-L)
DOI
10.1016/j.diin.2016.07.002
OpenAlex
W2496242257
Cited by
33
References
1
Citations by year
2026: 2 · 2025: 4 · 2024: 4 · 2023: 7 · 2022: 4 · 2021: 5 · 2020: 2 · 2019: 2 · 2018: 2 · 2017: 1
FWCI
3.73
Type
journal article
Language
en
Open access
Licence
Locations
  • Digital Investigation (publishedVersion, cc-by)
  • Arrow@dit (Dublin Institute of Technology) (acceptedVersion)
  • Lancaster EPrints (Lancaster University) (submittedVersion)
  • PEARL (University of Plymouth) (submittedVersion)
  • Bristol Research (University of Bristol) (submittedVersion, cc-by-nc-nd)
Funders
European Commission Safer Internet Programme project (SI-2010-TP-2601002)
Topics
  • Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
  • Social Sciences › Law › Cybercrime and Law Enforcement Studies
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
Keywords
peer-to-peer networks, IP address tracking

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review