_____Data Mining Techniques for Crime Pattern Recognition and

Early Warning System___

Data Mining Techniques for Crime Pattern

Recognition and architecting Early Warning
System.
Saurav Jana, 08BM8010 MBA
Vijay Kumar Das, 08BM8003 MBA

Abstract

This paper tells about the detectives to speed up the

Data mining Techniques process of solving crimes.
that can be used to detect In this paper we will take an
the Crime pattern, region- approach which is a
wise and behavior or nature- combination between
wise. It tries to find out a computer science and
framework for an Early criminal justice to study a
Warning System and data mining technique that
proposes an Architecture for can help solve crimes faster.
the design of the system. We will use clustering based
models to help in
Introduction identification of crime
pattern on the basis of their
Data mining and data characteristics. We will then
analysis techniques are use this valuable data to
powerful tools in today’s make an Early Warning
world which are helpful in system for possible threats
contributing for the and attacks by terrorists and
intelligence and countering offenders in future.
terrorism by law-
enforcement officers. By the Survey of Literature
increasing use of the First of all, most of us are
computerized and confused with the term
automated systems to track ‘Data mining’. Data mining
crimes, computer data as mentioned in Wikipedia-
analysts have been helping [1] is the process of
the Law enforcement extracting patterns from
officers, sleuths and data. Data mining is
becoming an increasingly
important tool to transform
this data into information
and give a meaningful idea
to the data by analysis.
What data mining does is:
“discover useful, previously
unknown knowledge by
analyzing large and
complex” datasets.[2]
Clustering or Cluster
analysis is the grouping of
a set of observations into
groups called clusters, so
that observations in the
same cluster are similar in
some sense. Clustering is a
method of unsupervised
learning and a common
technique for statistical data
analysis used in many fields,
including machine learning,
data mining, pattern
recognition and bio-
informatics.
Here we will discuss about
the k-means[3] algorithm for
clustering. It assigns each
point to the cluster whose
center also called the
centroid, is nearest. The
center is the average of all
the points in the cluster. By
this we mean, its
coordinates are the
arithmetic mean for each
dimension separately over
all the points in the cluster.
Example: The data set has
three dimensions and the
cluster has two points: X =
(x1, x2, x3) and Y = (y1, y2,
y3). Then the centroid Z
becomes Z = (z1, z2, z3),
where z1 = (x1 + y1)/2 and
z2 = (x2 + y2)/2 and z3 =
(x3 + y3)/2.
A warning system is any
system of biological or
technical nature deployed
by an individual or group to
inform of a future danger. Its
purpose is to enable the
deployer of the warning
system to prepare for the
danger and act accordingly
to mitigate against or avoid
it.
Early warning can be
defined as information which
a national government or
international or regional
organization receive in
advance in order to be able
to react timely and
effectively towards a crisis
situations. An early warning
system[4] in context of
crime reporting will need to
address the following
questions:
1) to identify “who is doing
what”
2) to estimate “who can do
what” in order to
3) predict “what can really
happen tomorrow”.
Crime Reporting Systems
and Databases:
Most police departments use
some electronic systems for
crime reporting that have
replaced the traditional Hence clustering algorithms
time-consuming paper- in data mining are
based crime reports. These equivalent to identifying
crimes reports have the groups of records that have
following kinds of similarities between
information categories themselves but have
namely - type of crime, differences from the rest of
date, time, location, the groups. Thus we need to
weaponry etc. There is work on the variances of the
information about the data between the groups
suspect (identified or and within the groups. In our
unidentified), victim and the case some of these clusters
witness. Also, there is the or groups will be useful for
narrative information or identifying a crime spree
description of the crime and committed by one or same
Modus Operandi (MO) that is group of suspects.
usually in the text form. The Thus, provided with this
police officers or detectives information, the next
use free text to record most challenge is to find the
of their observations which variables providing the best
are particular to the cases clustering. The variables can
and which cannot be be Crime type, Suspect race,
included in checkbox kind of age, sex, Crime weapon,
pre-determined questions. motives etc. Without a
While storing the first two suspected crime pattern, the
categories of information detective will be less likely
are usually done in the to build the complete
computer databases as picture from bits of
numeric, character or date information from different
fields of table, the last crime incidents.
category is often stored as
free text. Today most of this process
of connecting the data-
points is manually done with
Data mining using the help of multiple
Clustering: Use and spreadsheet reports that the
Implementation detectives usually get from
In crime terminology a the computer data analysts
cluster is a group of crimes and their own crime logs.
in a geo-spatial region or a Simple example:
hot spot of crime. In data
CRIM SUSPEC VICTIM WEAPO SITE*
mining terminology a cluster E T AGE AGE N
is group of similar data TYPE*

points –that is a possible TA 25 37 Bomb 1

crime pattern.
TA 34 56 Bomb 1 TA 28 13 Grenad 2
e
MA 25 34 Mine 3
MA 35 65 Bomb 3

*Let,
TA- Terrorist attack, labeled
as 1.
MA- Maoist attack, labeled
as 2.
Sites are Jammu=1,
Delhi=2, Jharkhand=3.
Output of statistical tools
like SPSS for Two-means
cluster for variables Crime
type and Site is given:
From the above figure it is
clear that the first cluster
contains the Site 1 and 2
both of which comes under
terrorist attack type and the
second cluster contains the
Site 3, which is of the Maoist
attack crime type.

The figure can be plotted as:

Figure: Pie chart showing

Cluster size
The figure shows that we
obtained two clusters, the
cluster1 consists three
cases, and the cluster2
consists 2 cases.

Figure: Map of the Crime sites

by plotting the cluster analysis
data.

Thus this picture gives

valuable information of the
crime pattern on the basis of
the Crime sites and the type understanding and mapping
of the crime committed. This the threat; followed by
type of technique is very prevention of the threat. The
helpful for the crime third phase is about
department to know the monitoring the risk in order
type of the crime to detect possible early
committed, by segregating warnings, including
the vast source of forecasting the near future
information and pulling out events. Dissemination of the
the threads which has the comprehensible warnings to
necessary meaning and political authorities and the
information. inhabitants are disclosed
later. Within the fifth phase
of the system appropriate
Early Warning System: and timely actions in
Architecture response to the warnings
are carried out.
Typically EWAS consist of
five phases[5] which are all In this paper we will discuss
associated to each other. the architecture of a EWAS
The first step is risk [5] that can be used to warn
assessment which involves in case of a threat or attack.

interest to the clients. Such

Figure: System architecture
Media monitoring service
provides clients with
documentation, analysis, or
copies of media content of
services which analyze and
read thousands of news
items from heterogeneous
sources and provide
consolidated channels to
access the news have providing structured
become available. information about entities of
The architecture of EWAS interest by mining news
consists of three main documents provided from
components (as shown in different sources. Europe
Figure): Media Monitor (EMM) RSS
feed is only one of such
1. Input (Data gathering sources for the news
sources) consolidation system.
a. News consolidation
system
b) By using Web analytics
b. Data extraction by Spiner one can use “Spiner”, which
[5] was proposed in a recent
c. Data gathered manually research paper [6]. Spiner
from fields can be a useful system to
practice in a dark web
2. Processing
analysis scenario. Efficient
a. Semantic entity and wrappers were designed for
relationship different banned terrorist
management system groups disguised websites,
terrorism databases, and
b. Social network analysis government information
(SNA) tools sites. The system’s web
c. Framework for social robot crawls through these
scientists interaction like sites and extract valuable
SOMA portal [7] information data provided
by the system’s web robots.
d. Rule based engine
From the analysis in the
3. Output system paper, it is evident that
a. Warning generation Spiner is capable of handling
system the dynamicity and chaotic
characteristic of today’s
b. Dissemination system World Wide Web by using
structural data mining
enhanced with social
Component description:
network analysis tools and
1. Input (Data gathering techniques.
sources) c) Data gathering is done
a) News consolidation manually.
system: The news
consolidation system can be 2. Processing
something which can help a) Semantic entity and
the data analyst by relationship management
system:
The most important things
to early warning include
actors (like individuals,
groups, organizations, and
countries) and resources.
The knowledge about the
things are interpreted by
attributes and character of
the actors and is
represented as profiles.
Finally, the situations,
conditions and context in
which the events take place
is important in that it may
create constraints on the
actors in their choice of
actions or available
opportunities that would
otherwise not have been
possible.
There are numerous ways
available to refer to an actor
of an event, which makes
the identification of the
entities and their
relationships a real problem.
In addition to this, in
terrorism, actors commonly
have name aliases. Hence
we need a mechanism to
identify the entities and
then use the News base to
measure the relations
among these actors.
b) Social network analysis
tool:
After data gathering, we
need to provide social
scientists with some data
mining and social network
analysis tools which can be
used to detect main players
and master-minds in
networks of actors, estimate
their influence and
dependency among them.
c) Framework for interface
for social scientists: A type
of GUI based platform is
required to provide the
social scientists and
investigators with a tool,
where they will be able to
create their own rule based
theories, manage, keep
updating them, and will be
helpful in testing, analyzing,
and prototyping them.
We will assume to use
Stochastic Opponent
Modeling Agents (SOMA)
Terrorist Organizations
Portal (STOP) [7] for this
purpose.
e) Rule-based engine:
A rule-based engine is used,
in which a set of rules are
pre-decided so when any
news of items or data
arrives then the best rule for
it is identified. The engine
also has the provisions for
the mechanisms and
schemes for rating, grading
and success rate of rules
that will reside in rule based
engine.
f) Warning generation
engine:
The Warning generation in
such a system would be a
function of rule or a number
of rules. The task is
accomplished by analyzing
the rules of the engine i.e.,
the warnings can be
generated by sequencing of
rules flagged true by the
rule based engine.
3. Output (Dissemination
system)
a) A dissemination system is
needed to notify the
warnings to subscriber
devices. The notification
system should be able to
perform two tasks- of
managing subscription
information and handling
the subscriber devices. A
simple and realistic way of
doing so would be that we
have to take care of at least
two devices: an email
receiver (i.e an internet
enabled machine) and SMS
and Call receiver (a landline
or mobile phone).
Conclusion
There is ample amount of
scope in data mining to use
valuable data and to extract
information from it, by
further studies in this area
as is done in this paper. .
EWAS is designed to be an
early warning system on
which more advanced data
mining research can be
carried out. There can be
more work on Web analytics
and structural data mining
techniques to enhance the
investigative processes
further.
References:
[1]Wikipedia.org
[2] David Jensen, “Data
Mining in Networks,”
presentation at CSIS Data
Mining Roundtable,
Washington, D.C., July 23,
2003.
[3] Yi Lu, Shiyong Lu,
Farshad Fotouhi, Youping
Deng, and Susan Brown,
"FGKA: A Fast Genetic K-
means Algorithm", in Proc.
of the 19th ACM Symposium
on Applied Computing.
[4] Nasrullah Memon, Uffe
Kock Wiil, “Design and
Development of an Early
Warning System to Prevent
Terrorist Attacks”
[5] Best, C., van der Goot, E.,
Blackler, K., Garcia, T., Horby,
D.:Europe Media Monitor.
Technical Report EUR 22173
EN, European Commission
(2005)
[6] Memon Nasrullah; Qureshi
Abdul Rasool; Hicks David;
Harkiolakis Nicholas:
Extracting Information from
Semi-Structured Documents,
In Y. Ishikawa et al. (Eds.):
APWeb 2008 Workshops,
LNCS 4977, pp. 54–64, 2008
[7] Aaron Mannes, Mary
Michael, Amy Pate, Amy Sliva,
V.S. Subrahmanian, Jonathan
Wilkenfeld. "Stochastic
Opponent Modeling Agents: A
Case Study with Hezbollah,"
First International Workshop
on Social Computing,
Behavioral Modeling, and
Prediction, April 2008