12.4 Modeling the Behavior of Offenders Who Commit Serious Sexual Assaults: A Case Study

12.4 Modeling the Behavior of Offenders Who Commit Serious Sexual Assaults: A Case Study

      Richard Adderley      West Midlands Police      Queens Road Police Station      Birmingham, B6 7ND, UK      [e-mail]      Peter B. Musgrove      University of Wolverhampton      35–49 Lichfield St.      Wolverhampton, WV1 1SB, UK      Tel: [phone]      [e-mail] 

12.4.1 Abstract

This paper looks at the application of data mining techniques, principally the self-organizing map, to the linking of records of crimes of serious sexual attacks. Once linked, a profile of the offender(s) responsible can be derived automatically.

The data was drawn from the major crimes database at the National Crime Faculty of the National Police Staff College, Bramshill, United Kingdom. The data was encoded from text by a small team of specialists working to a well-defined protocol. The encoded data was analyzed using the self-organizing map tools of SPSS/Clementine. Two experiments were conducted. These resulted in the linking of several offenses in to clusters, each of which were sufficiently similar to have possibly been committed by the same offender(s). A number of interesting clusters were used to form profiles of offenders. Some of these profiles were confirmed by independent analysts as either belonging to offenders who had already been detained in connection with a number of the offenses or as appearing sufficiently interesting to warrant further investigation.

The system described in this paper is a prototype developed over a 10-week period. This contrasts with an in-house study using conventional techniques, which took two years, but achieved similar results. As a consequence of this study, the Home Office intends to devote more resources to a follow-up study to investigate the efficacy of routine application of a derivative of the current system to similar serious offenses.

Keywords

Knowledge discovery, data mining, crime pattern analysis, self-organizing map.

12.4.2 Introduction

Data mining is now a proven technology in many areas of commerce and industry. The challenge now is to extend the range of applications to which data mining is used in order to both spread benefits and investigate any domain-specific problems that require enhancements to current data mining practices.

Police forces across the developed world have attempted to apply advanced computing technologies to tackling crime [2]. However, comparatively little use has been made of data mining techniques in analyzing and modeling the behavioral patterns that occur at each stage of the commission of a crime.

In this paper, we look at applying data mining techniques to the task of linking crimes of a serious sexual nature. The challenge is to decide which of the separate offenses can be linked as being possibly committed by the same offender(s). The intent is to link offenses based on coded data (see section 12.4.4) and to subsequently produce a profile of the offender(s) that describes the linked theme.

This work draws on an earlier study applied to linking crimes of burglaries due to the offender(s) passing themselves off as a bogus official in order to gain access to a dwelling with the intention of committing theft [1]. The current study was conducted on a larger scale and provided with more resources, which enabled the system to be provided with cleaner data.

The commercial data mining package, SPSS Clementine, was used in order to speed development and facilitate experimentation within a Cross Industry Platform for Data Mining (CRISP-DM) methodology [6]. This enabled the prototype system described in this paper to be developed in 10 weeks. This contrasts with an in-house study using conventional techniques, which lasted two years and produced similar results.

In this paper two specific data mining techniques, the self-organizing map and visualization techniques, are used to analyze sexual assaults and rape offenses held in a ViCLASS relational database within the National Crime Faculty (NCF) at Bramshill, the National Police Staff College. The stages of data selection, coding, and cleaning are described, together with the interpretation of the results.

12.4.3 Task Understanding

When a specified offense occurs within the United Kingdom the force in which the offense occurred has the remit to forward full details to the NCF for subsequent entry into the Violent Crime Linkage Analysis System (ViCLASS) system. A specified offense includes a sexually motivated murder, rape where the offender is a stranger or only has limited knowledge of the victim, abduction for sexual purposes, and serious indecent assaults. ViCLASS is a relational database developed in 1991 by the Royal Canadian Mounted Police comprising 53 tables, not all of which are used in the United Kingdom. The system not only stores hard factual information relating to the crime, but the offender's behavior is also encoded. Trained analysts examine a 165, question input document and extract behavioral information from narrative text, such as the offender's speech and physical actions immediately prior to and during the commission of the crime.

On receipt of the document, an analyst assistant uses a quality-control document for guidance to ensure a consistent approach to data interpretation. It is the role of the NCF analysts to examine each new case, the index case, with a view to identifying similarities with existing offenses within the system. If such links are made, it can identify that the index case is part of an emerging series of crimes committed by the same offender(s), who may or may not be known. If a specific series cannot be identified, the analysis may still reveal similarities with other crimes that will assist the senior investigating officer (SIO) in the investigation of the index crime. Current police crime recording systems do not transcend individual police force boundaries; therefore those crimes that occur in different force areas are more difficult to detect. It is within the NCF remit to provide additional assistance in these circumstances.

Before the results of the encoded behavior can be utilized it is important to understand the current research relating to criminology and its relevance to the data set in question.

Routine activity theory requires that there are a minimum of three elements for a crime to occur; a likely offender, a suitable target and the absence of a suitable guardian. Offenders do not offend 24 hours a day committing crime, they have recognizable lives and activities, for example, go to work, support a football team, regularly drink in a public house. They have an awareness space in which they feel comfortable, which revolves around where they live, work socialize and the travel infrastructure that connects those places.

One offender from the ViCLASS system committed 12 of his 13 offenses on his way to and home from work, his remaining offense occurred along his route to a repair shop where he took his lawnmower. All of the recorded offenders, who commit their assaults in more than one Force area, offend within an average distance of 3.37 miles of their home current address at the time of committing the offense. This is the entire population of such offenders using the shortest road route.

It has been stated that crimes against the person such as rape, homicide and assault occur closer to the offender's home than property crimes such as burglary. However the authors have established that offenders who commit sexual crimes commit their crimes further from home than burglary offenders. Based on 2 years of burglary crimes in a district of the West Midlands Police area the average distance that a burglary offender travels from his/her home address is 1.47 miles. Sampling a random 60% of recorded offenders from the ViCLASS database who only commit offenses within the border of a single Force, the average distance from their home address is 4.11 miles.

The rational choice perspective states that committing a crime is conscious process by the offender to fulfill his/her commonplace needs such as money, sex and excitement. An unknown offender within the system has committed 22 offenses by committing a burglary and indecently assaulting the female occupant. By these actions he is possibly fulfilling two of the stated needs, sex and excitement.

12.4.4 Data Understanding

A copy of the database used in this study contained 2,370 recorded sexual offenses that occurred throughout England, Scotland, Wales, and Northern Ireland between March 1998 and June 26, 2000 and were referred to NCF for analysis. Table 12.1 shows the eight specific crime categories and the numbers of offenses associated with each. The categories are not mutually exclusive, an example being an offender who commits a burglary with a view to sexually assaulting the victim.

Table 12.1: Classification of Sexual Crimes

Offense Category	Date Rape	Burglary	Sexual Assault	Multiple Offenders	Abduction	Weapon	Aggravated Assault	Other	Total	Offense Total
Total	22	138	1786	223	230	306	339	266	3310	2370

There are 1,015 known offenders (convicted, charged, or suspected), 90 of whom are believed to have committed two or more offenses (see Table 12.2). It is possible, however, that some of the undetected crimes in the database may be attributed to these recorded offenders. Also the offenders of the crimes reported in the database may have committed other similar crimes that have not been reported to the NCF for analysis.

Table 12.2: Number of Crimes Attributed to Known Offenders

Number of Offenses	Number of Offenders
18	1
13	1
10	1
9	1
7	1
6	1
5	7
4	8
3	9
2	60

Offenses committed by persons unknown to the victim are particularly difficult to detect. However, within a series, the offender's behavior often has consistencies across the crime set [8, 10]. There is a tendency for the levels of violence to escalate across time.

In attempting to model offender behavior by linking crimes, it is necessary to understand certain fundamental limitations:

• The data set is not complete. Although all forces have the remit to forward specified cases to the NCF, it is apparent that this is does not always occur. In some instances, a force will forward a number of crimes that it has already linked with a view to gaining further assistance with the series.

• It is possible that unsolved crimes held within the database may be attributed to one of the known offenders.

• Although the same team of people has input the crimes, there are discrepancies in the encoding process, which are discussed below.

• Additional information that could be used to identify similarities between the crimes is held in free-text memo fields within the database. They are not currently used in the modeling process.

• The crimes in series identified by NCF analysts for which no offender has been charged, suspected, or convicted are assumed to have been committed by the same person(s) for purpose of validation of the models.

• It has to be assumed that the known offenders have actually committed the crimes that have been attributed to them.

12.4.5 Data Preparation

Ambiguous Data

The results of the mining process are directly proportional to the quality of the data. With a small number of persons responsible for encoding and entering the data, it was assumed that the quality would be high. However, there were some discrepancies within the subsequent encoding. Table 12.3 illustrates an example of confusing encoding of free-text information. In this example, the variable being encoded relates to whether the victim was specifically targeted as an individual (not just targeted due to the type of person he or she was). It is clear that both the yes and no contain the same information and all should have been encoded as no.

Table 12.3: Data Encoding Examples (3 Yes and 3 No)

Specifically Targeted = Yes	Specifically Targeted = No
The intention of the group involved in this offense was to pick up a prostitute, so to that extent she was targeted.	Required prostitute, but the individual was not targeted.
In that she was a prostitute, however, it need not have been specifically her.	The offender did not target that particular prostitute.
As being a vulnerable female.	Only in as much as she was a single, young, vulnerable female.

Missing Data

It is not uncommon for the encoded data to have fields that contain unknown or missing values. There are a variety of legitimate reasons why this can happen. In this specific task, one such occurrence might be due to the victim's not recalling certain facts due to the trauma associated with the crime. How should they be treated? Are those fields essential to the mining process? There are a number of methods [12] for treating records that contain missing values:

1. Omit the incorrect field(s)

2. Omit the entire record that contains the incorrect field(s)

3. Automatically enter/correct the data with default values (e.g., select the mean from the range)

4. Derive a model to enter/correct the data

5. Replace all values with a global constant

Within this study, both missing and unknown data have been set to zero when used in dichotomous variables.

Data Encoding

Data was encoded as binary dichotomous variables. Categorical data, such as build, was encoded by a set of mutually exclusive binary variables. An example is the offender's build, which could be Unknown, Thin/Skinny/Slim, Medium, Heavy/Stock/Fat being encoded as a 1 and the remainder as 0.

Three of the data fields each contain a large number of options, some of which appear to be close in meaning:

1. The approach, the type of behavior that the offender exhibited at the beginning of the crime

2. The precautions that the offender took during the commission of the crimes

3. The verbal themes, as described above.

There are 29 options for the approach classification, 22 for precautions, and 28 for the verbal-themes options. Encompassing research [4, 7] the 29 approach options have been reduced to three mutually exclusive dichotomous variables. In conjunction with extensive discussions with the analysts, the precautions options have been reduced to four mutually exclusive dichotomous variables, and the verbal themes reduced to seven fuzzy dichotomous variables.

It is during the data preparation stage in the CRISP-DM cycle that a variety of encoding techniques may be utilized to provide additional fields for analysis and to enable fuzzy concepts.

Variable Selection

It is always difficult to ascertain the correct number and combination of variables that are to be used in the modeling process. Within this paper, it is the intention to model offenders' behavior to establish consistency across crimes. Therefore, to test this, two different sets of twin variable combinations representing particular behavioral traits were used.

Exercise 1

The first modeling exercise used only the approach and verbal-themes sets of variables. This combination was selected to examine behavioral traits at the initial offender/victim point of contact and the subsequent dialogue throughout the crime. This resulted in a total of three approach and seven verbal-themes variables being used in training the model.

Exercise 2

Research conducted on male offenders who have committed rape offenses within the south of England [5] established that they committed their offenses close to their home base. Therefore, in conjunction with the findings discussed in Section 12.4.3, the second modeling exercise was restricted to a single police area. The variable set of approach and precautions was used. This combination was selected to examine behavioral traits at the initial offender/ victim point of contact and the precautions that the offender took in committing the crime. This resulted in a total of three approach and four precaution variables being used in training the model.

Model Building

A Kohonen [9] self-organizing map was used in the modeling process for both exercises discussed above. A self-organizing map was selected because it has the ability to cluster similar records into the same cell, while producing a two-dimensional topological map showing the relationship of those records to near neighbors. This can be used to form larger clusters by merging neighboring cells [1]. It also aids in determining the relationship between broad categories of crime. In this application, this could be useful as crimes that are broadly similar may have been split into different clusters due to slight variations in offender behavior due to the specific circumstances in which the crime was committed or even due to missing data.

Figure 12.4 Exercise Mode 1 illustrates the 2D representation of the resulting modeling process for Exercise 1. The map shows the 2,370 crimes on a 20 x 20 grid (400 cells) as points agitated to show density. Lines and a circle have been manually drawn on the graph to show broadly the differing types of approach that the offender used at the point of contact with the victim. These have been broadly categorized as cons, surprise, and blitz. (An alternative automated approach to manually drawing these regions would have been to use a multi-layered perceptron to take the output coordinates from the SOM and label the regions appropriately.) The square shapes contain those crimes from each of the "approach" types that were selected at random from within each broad area for independent verification.

Figure 12.4: Approach and verbal-themes behavior.

Exercise 2 Model

Figure 12.5 illustrates the 2D representation of the resulting modeling process for Exercise 2 on a 10 x 10 grid (100 cells). Again, individual crimes lying within a cell have been agitated to show density. Lines broadly separate the differing types of approach that the offender used at the point of contact with the victim. The triangle contains those crimes that were independently validated. Again, while the super clusters have been allocated manually, they could have been formed automatically by use of a multilayered perceptron.

Figure 12.5: Approach and precautions behavior.

Verification

NCF analysts who took no part in the modeling undertook the validation process, but due to their workload they could not examine all crimes within all clusters. Each analyst was only presented with a list of crime identification numbers with a remit to ascertain whether there were similarities between the crimes. They had no other information. The narrative was mainly used to ascertain the similarities between the crimes.

Exercise 1

Three clusters represented by the squares in Figure 12.4 were sent for independent verification; the only information provided to the analysts was the unique case reference number and a cluster number. In Exercise 1 the initial clustering process used the approach and verbal-themes variables, and it was established that there were additional similarities between the crimes contained in each cluster.

The similarities in cluster 1 consisted of the following:

• 80% of the victims were under the influence of alcohol.

• The type of sexual assault was 100% consistent.

• Precautions were taken by the offender in 80% of crimes.

• Although the offender immediately overpowered the victim on contact, only minor injuries were caused in 80% of the crimes.

The similarities in cluster 2 consisted of the following:

• 50% of the offenders were of the same nonwhite race.

• 53% of the victims were walking in public places at the time of the offense.

• A further 33% of victims were asleep at the time of the attack.

• There were two partial series contained within this cluster.

• Four crimes were part of a known series.

The similarities in cluster 3 consisted of the following:

• The victim was subjected to a number of sexual acts in 100% of the crimes.

• 100% of the offenders took precautions.

• In 100% of the crimes the offender disrobed himself as well as the victim

Of the three clusters submitted for validation, cluster 2 contained the largest number of offenders and cluster 3 the smallest. It would appear that the number of crimes contained within the clusters indicates the accuracy of the clustering process; the fewer the crimes in the resulting clusters, the more similarities there appear to be.

The three square clusters in Figure 12.4 were examined using the variables identified in Table 12.4 together with a control group formed by averaging attribute values of 100 randomly selected crimes.

Table 12.4: Cluster Comparison

Cluster	Same Sub Approach	Same Sub Verb Theme	Negotiation	Disrobing	Reassurance	Questions	Victim Build	Victim Marital Status	Victim Drug Use
1	91%	36%	82%	60%	91%	92%	40%	60%	80%
2	53%	80%	67%	20%	80%	55%	46%	65%	52%
3	75%	100%	75%	25%	50%	50%	24%	100%	25%
Cluster Average	58%	82 %	68%	22%	67%	49%	48%	73%	34%
S1	20%	60%	70%	40%	70%	50%	40%	90%	40%
S2	10%	20%	70%	20%	40%	60%	30%	50%	40%
S3	20%	60%	70%	50%	70%	50%	10%	30%	30%
S4	20%	60%	70%	50%	70%	50%	40%	50%	40%
S5	10%	30%	70%	10%	80%	60%	50%	70%	30%
	20%	10%	80%	30%	90%	80%	60%	60%	20%
	20%	40%	80%	30%	90%	70%	60%	60%	20%
	10%	30%	70%	40%	60%	70%	50%	60%	20%
	30%	40%	60%	20%	70%	50%	40%	60%	20%
	30%	30%	90%	10%	70%	50%	60%	50%	10%
Control Cluster	19%	38%	73%	30%	71%	59%	44%	58%	27%

The headings in Table 12.4 refer to the attributes in the database tables; for example, Questions refers to whether the offender questioned the victim and the degree of the questioning process.

Both approach and verbal-themes variables, described in the section "Data Encoding" above, comprise a number of subvariables that, individually, are used in this table for comparison purposes. An example is that 91% of offenders in cluster 1 used the same subapproach type on initial contact with the victim as compared with 19% of the control group. This is, therefore, a significant behavioral trait appertaining to that cluster.

It is important to note that such traits that fall below the average are also significant in identifying individual offenders (e.g., only 22% of offenders in cluster 6 try to offer reassurance to their victim's during the commission of the offense, as compared with 71% from the control group). This indicates that the majority of offenders reassure their victim in some way, whereas the offenders in cluster 6 do not, thereby identifying the particular behavioral trait of that cluster.

Exercise 2

The crimes belonging to the single-approach type that are captured within the triangle in Figure 12.5 were passed to an analyst for validation purposes. Individual clusters were not identified due to the group of 54 crimes being considered a Super Cluster.

Within the triangle, a complete crime series of four and five partial series were identified and the following similarities were found:

• 92% of offenses were committed by person(s) unknown to the victim.

• 59% of offenders had the same motive.

• Full intercourse took place in 51% of offenses.

• 46% of victims were fondled by the offender.

• 41 % of offenders committed burglary to commit the offense.

• 38% of offenders were concerned about their own safety.

• 35% of offenders used the attack for ego satisfaction/pleasure.

• A weapon was visible in 32% of offenses.

None of the above was used in the modeling process.

12.4.6 Discussion

Given the existing limitations identified in Section 12.4.4, the results are encouraging. In both exercises, based on the results of the validation process, the authors have illustrated that the models identify consistency in offender behavior. The analysts established that crimes in individual clusters exhibited strong similarities, with adjacent clusters that are based on a variable theme having similar traits, as illustrated in Figure 12.4.

An analyst currently compares the index case against the remainder of the database by selecting one or more variables from the screen, which is then translated into a SQL query. This process relies on the analyst's skill and intuition, often resulting in a time-consuming process of multiple queries returning different overlapping sets in order to ensure that all variances are returned for examination. In both exercises, the analysts report that all crimes that they would have wished to examine were contained within the clusters.

The results from Exercise 1 demonstrate that crimes within a single cluster have strong similarities and, as in the results from cluster 2, may even contain crimes that have been committed by the same offender. With further refinements, it should be possible to suggest names from the known offender list as being responsible for as yet unsolved crimes.

The results from Exercise 2 indicate that this type of model could be used as an initial match against the index case by restricting the search space to the police force area in which that crime occurred. A second pass through the data would include those crimes from the adjacent force areas and a third pass could include national data.

This prototype system took 10 weeks to develop from being unfamiliar with the data and its structures to gaining domain understanding, encoding and modeling the data, and passing the results through the validation process. Prior to and independent of this study, three persons, a medical psychologist, a statistician, and a researcher, took two years to complete a piece of work that reached broadly similar results. As a result of this study, the NCF plans to commence an in-depth 12-month pilot using the software.

12.4.7 Further Work

Only two sets of two variable types were used in this study. There is scope to increase the number of sets and the number of variables within each set, model each, and ascertain the behavioral consistency across each type. An example would be approach, verbal themes, and precautions within the same model.

Use several combinations of two variable sets and establish whether the same crimes are clustered in more than one of the resulting models. Greater numbers of crimes clustered across the models may indicate that the same offender is responsible.

Cluster on a single two-variable combination, for example, approach and precautions as in training the model.

Exercise 2 and recluster the results from the triangle using a different set of variables.

12.4.8 Acknowledgments

Our thanks to the National Crime Faculty of the National Police College, Bramshill United Kingdom, for providing the data and independent verification of the results.

References

1. Adderley, R., and Musgrove, P.B. (1999), Data Mining at the West Midlands Police: A Study of Bogus Official Burglaries. BCS Special Group Expert Systems, ES99, London, Springer-Verlag, pp. 191–203.

2. Adderley, R., and Musgrove, P.B. (2001), "Police Crime Recording and Investigation Systems, a User's View." Policing an International Journal of Police Strategies and Management, 24(1), pp. 100–114.

3. Brantingham, P.L., and Brantingham, P.L. (1991), "Notes on the Geometry of Crime," in Environmental Criminology, USA: Wavelend Press, Inc.

4. Canter, D., and Heritage, R. (1990), "A Multivariate Model of Sexual Offense Behaviour: Developments in Offender Profiling I." The Journal of Forensic Psychiatry, 1(2), pp. 185–212.

5. Canter, D., and Larkin, P. (1993), "Environmental Range of Serial Rapists" Journal of Environmental Psychology, 13 pp. 63–69.

6. Chapman, P.,Clinton, J.,Kerber, R.,Khabaza, T,Reinartz, T.,Shearer, C., and Wirth, Rudiger. (2000), CRISP-DM 1.0 Step-by-Step Data Mining Guide, USA: SPSS Inc. CRISPWP-0800 2000.

7. Davies, A. (1992), "Rapists' Behaviour: A Three Aspect Model As a Basis for Analysis and the Identification of Serial Crime." Forensic Science International, 55 pp. 173–194.

8. Hazelwood, R.R.,Reboussin, R., and Warren, J.I. (1989), "Series Rape: Correlates of Increased Aggression and the Relationship of Offender Pleasure to Victim Resistance." Journal of Interpersonal Violence 4 pp. 65–78.

9. Kohonen, T. (1984), "Self-organisation and associative memory," Springer Series in Information Sciences, Vol 8. New York: Springer-Verlag.

10. LeBeau, J.I. (1987), "Patterns of Stranger and Serial Rape Offending: Factors Distinguishing Apprehended and at Large Offenders." Journal of Criminal Law and Criminology 78 pp. 309–326.

11. Rhodes, W.M., and Conly, C. (1991), The Criminal Commute: A Theoretical Perspective in Environmental Criminology, USA: Wavelend Press, Inc.

12. Weiss, S.M., and Indurkhya, N. (1998), Predictive Data Mining: A Practical Guide. San Francisco: Morgan Kaufman Publishers, Inc.