Research in Progress Short Paper: The Adoption of Criminal Profiling for Computer Crime
J. Preuß, Steven Furnell, Susan J. Lea, Drake Circus · 2004
This paper discusses ongoing research in relation to the adoption of criminal profiling for computer crimes. It begins by introducing the concepts of psychological, behavioural or criminal profiling used in traditional crime, discussing methods such as inductive reasoning or deductive reasoning, and then proceeds to outline computer forensic methods, which may be used to examine computer systems after an incident. It also discusses the possibilities and problems analysing network activities. The paper suggests how the methods of criminal profiling can be adopted for computer crime incidents, as an assistance of the investigations of law enforcement agencies against hackers, and other criminals who focus upon the computer to commit their crimes. To this end, the discussion presents a top-level mapping of behavioural evidence analysis within a computing context. Authors: Preuss, J., Furnell, S. & Lea, S. EICAR 2004 Conference CD-rom: Best Paper Proceedings EICAR 2004 Conference CD-rom Editor: Urs E. Gattiker ISBN: 87-987271-6-8 Copyright © 2004 by EICAR e.V. 3 Structure Of The Paper Statistics from recent years have illustrated a dramatic rise in the incidence of cybercrimes, such as hacking, malware, and system abuse. For example, figures from Bundeskriminalamt (BKA) in 2001 identified 79,283 related incidents in Germany (Bundeskriminalamt, 2001), compared to only 45,359 in 1999 (Bundeskriminalamt, 1999). Similarly, CERT (2004) shows that there were over 80,000 incidents in 2002, an increase of about 30,000 compared to the previous year. For the year 2003, CERT reported 137,529 incidents showing that problems are occurring in spite of advances in network security technologies, and suggesting that a technological approach alone is not a sufficient basis for tackling the problem. To more effectively combat cybercrimes it is necessary to understand the reasons and motivations for incidents, and the methods by which they are perpetrated, and then use this as a means of informing investigation and detection activities. This paper will explain the concept of criminal profiling, which is used to provide a picture of an unknown offender, by analysing his or her crime perpetration. The paper will also consider ongoing research relating to how these methods can be used for computer-based crime. The discussion begins by presenting a background to the profiling concept, before proceeding to review the common approaches used within traditional criminal investigations. The desirability of profiling computer criminals is then considered, leading to an overview of the accompanying technical methods that could be used to assist the evidence gathering process. The results section shows how these methods can be mapped into a behavioural evidence analysis approach, in order to provide a potential top-level profiling method for computer crimes. When the paper refers at the male perpetrator, it is always meant the male and female criminal.