6.11 Neural Network Investigative Applications

For the investigative data miner the power of neural networks comes from their ability to learn from experience, from samples of historical evidence collected in a criminal scene or instance. A neural network learns how to identify patterns by adjusting its weights in response to data input. This learning, as we have seen, can occur with a neural network via a supervised or an unsupervised setting. With supervised learning, which is the most typical, every training sample has an associated known output value. The difference between the known output value and the neural network output value is used during training to adjust the connection weights in the network (Hecht-Nielsen, 1990).

With unsupervised learning, which usually involves a SOM or Kohonen neural network, clusters are found in the input data that are close to each other based on a mathematical definition of distance. Self-organizing feature maps (SOFMs) transform the input of random values into a two-dimensional discrete map subject to a topological (neighborhood-preserving) constraint. In either case, after a neural network has been trained, it can be deployed within an application and used to make decisions or perform actions when new data is presented. For the investigative data miner, this means new crimes can be detected and patterns of crimes can be discovered. This does not mean that networks can replace investigators or criminalists; they are simply a new set of forensic tools.

Empirical studies have shown that neural networks can be paired with other techniques and technologies, such as genetic algorithms and fuzzy (continuous) logic, to construct some of the most powerful tools available for detecting and describing subtle relationships in massive amounts of seemingly unrelated data. As more and more crime is committed in our digital, interconnected environment, the criminal investigators and intelligence analysts of the future will need to rely on powerful new tools, such as these, that capture the nuance of criminal acts and potential threats to our security.

System intrusion, fraud, and other cybercrimes are just new types of digital crime spawned by the Internet and computers. In the following case study, a SOM is used by an innovative investigator to cluster the criminal modus operandi of perpetrators, which could apply to any type of criminal activity. We present the case study in its original version and would like to thank Inspector Rick Adderley for its contribution and permission to use it. It is worth noting that prior approaches, both manual review of cases and the use of an expert system, did not yield the type of success that resulted from the use of this data mining analysis.