Predictive analysis of cybercrime

Following the rise of the Internet age in late 1980’s, Internet communication now gradually moved to various forms of social media platforms. Today, the active social media users reached a penetration rate of 31% of the world population (Chaffey, 2016). However, this growing penetration rate of the Internet and social media in our everyday lives also provide new opportunities for criminals to commit crimes on these new platforms. In 2015, the financial losses due to technology crime cases in Hong Kong was approximately HK dollars 1,829 million (i.e. around US dollars 235.7 million) (InfoSec, 2016), and the estimated dollar loss due to Internet crime in U.S. was about US dollars 800 million in 2014 (FBI, 2015). Instead of reactively investigate cybercrimes after a crime was committed, proactive approach of combating cybercrimes before there is a crime is now more preferred by law enforcement units, governments, and policy makers. Can we predict crime on the cyberspace? Many of the previous cybercrime related studies focus on the investigation or forensic methodologies of cybercrimes. There are not many studies in the area of empirical evaluation of predictive analytics methods on cybercrimes. This thesis aims at empirically testing the application of predictive analytics methods on cybercrimes. The challenges of this study include, a) how to effectively extract useful intelligence from the vast volume of social media data; b)how to link the online behaviours to offline phenomenon, c) how to identify those key online attributes that might be related to cybercrimes, and d) how to use online data to identify potential cybercrime offenders or to predict cybercrimes. In order to tackle these challenges, this thesis proposes to use scientific statistically approach to conduct offender profiling for cybercriminals, and to use predictive modelling to predict cybercrimes. This thesis used three types of cybercrimes to illustrate the empirical evaluation of predictive analytics methods on cybercrimes, and three conceptual models of predictive analysis were developed during the process. These cybercrimes were real-world cases including offender data samples from Customs and Excise Department of Hong Kong Government, and online data collected from the most popular discussion forums in Hong Kong. Based on the application of statistical modelling on cybercrimes, three conceptual models were developed, including, a) profiling of online auction fraudsters using multivariate profiling analysis; b) profiling of online flash mob organizers using clustering analysis and the development of social influence index; and c) prediction of civil unrest events using machine learning algorithm with time-series attributes. The findings of these three predictive analytics models showed that it is feasible to use statistical modelling methods to profile cybercrime offenders and to predict cybercrimes. This thesis has contributed to the study of predictive analysis of cybercrimes through empirically testing the offender profiling and predictive modelling methods using real-world cases.published_or_final_versionComputer ScienceDoctoralDoctor of Philosoph