William Nick

Author identification using Sequential Minimal Optimization

Author identification is a substantial factor in the global economic loss due to computer-related crimes. According to the Center for Strategic and International Studies (CSIS), computer crimes or cyber-crimes cost the global economy an estimated 375 to 575 billion dollars each year [1]. Recently, various techniques have been used to improve the accuracy of author identification. In this paper, we propose combining unigram features and a variety of stylometric features that include n-grams and part-of-speech. Using a Reuters Corpus dataset of 2,500 unique articles (50 authors with 50 news articles each), we were able to effectively capture a non-topic sensitive sample. Results with the Weka machine learning software produced classification accuracies ranging from 76.08 to 84.88 percent using classification techniques such as Random Forest and Sequential Minimal Optimization (SMO). Weka also ranked and weighted the most influential feature attributes.

Situations, identity, and the Semantic Web

We present a prototype of a computational framework for identity based on situation theory as developed by Barwise et al. Taking our cue from Kokars Situation Theory Ontology (STO), we use Semantic Web standards to capture the information present in a constellation of situations that relate to identity attributions. We do so in a way that supports cross-situation queries and reasoning. Our ontology, however, differs substantially from STO. Central to our account are id-situations, where an id-action (pronouncing on the identity of an agent) is performed. Our account focuses on evidence, provenance of information, and appropriate actions that back evidence, so we also address situations that support id-situations by providing artifacts, collecting evidence, and generally enabling and informing id-actions. We note that Semantic Web resources are ideal for representing situations since the Semantic Web is open and situations are partial information structures. Situations in our application area, while not dynamic like those typically of interest in studies of situation awareness, like them, rely on trust in automation and in our collaborators. In presenting a computational approach to identity, this paper shows how situations can be used to model the support we have for judgments and how Semantic Web standards can be used to represent and reason about constellations of situations.

Structure and evidence in identity cases

We present a framework for agent identity with a focus on structured cases and numerical levels of evidence and their handling. Our framework focuses on id-situations, where a person is judged to be the agent in some scenario, particularly a crime scene. An id-situation has a constellation of associated situations (providing what we call an id-case) to produce the objects used in it. Our idea of a situation is modeled on Barwise and Perrys situation theory. We represent our situations using semantic web notation because, for one thing, the semantic web supports a structure of partial information. From a numeric standpoint, we create a justification-based mass function from each id-situation and then combine the multiple functions we get from having multiple id-situations using Dempster-Shafer theory. The id-situations give a measure of similarity between each suspect involved and the as yet unknown criminal, which we adapt to get a mass function, with a frame of discernment that can be approximated as the list of suspects. We then refine our frame of discernment using constraints based on objects shared between the id-situation and its corresponding supporting situations.

Marshalling situation-based evidence in identity cases

This paper presents an expanded framework for identification of agents in a given scenario, particularly in relation to criminal justice. This identification is centered around an id-case, a set of situations leading up to a judgment of agent identity. The id-case consists of an id-situation, where the actual judgment is made, and a number of resource situations, which support the id-situation. The notion of situations used is based on Barwise and Perrys situation theory and expressed using semantic web notation. Each id-case corresponds to a justification-based mass function, which can be combined with other mass functions using Dempster-Shafer theory. This paper explores the relation between the id-situations, which provide similarity measures that serve as a basis for an initial mass function, and resource situations, which can modify that mass function in a number of ways.

Situation-based ontologies for a computational framework for identity focusing on crime scenes

We are interested in how evidence in a case fits together to support a judgment about the identity of an agent. We present a computational framework that extends to the cyber world although our current work focuses on physical evidence from a crime scene. We take Barwises situation theory as a foundation. Situations support items of information and, by virtue of constraints, some carry information about other situations. In particular, an utterance situation carries information about a described situation. We provide an account of the support for an identity judgment (in an utterance situation called an id-situation) that looks at building a case (called an id-case), like a legal case, since identity cases can lead to multiple situations that impact the value of our evidence. We have developed a novel situation ontology on which we built an id-situation ontology. To capture our current focus, we developed a physical biometrics ontology, a law enforcement ontology, and several supporting stubs. We show how a case can be encoded in the RDF in conformance with our ontologies. We complement our id-situation ontology with SWRL rules to infer the agent in a crime scene and to classify situations and id-cases. Combining possibly conflicting evidence is handled with Dempster-Shafer theory, as reported elsewhere.

Network traffic classification for security analysis

We used unsupervised machine learning to identify anomalous patterns of network traffic that suggest intrusion. Such techniques allow one to classify network traffic into clusters that emerge from the training data and do not require that signatures already be known. Data is from the National Collegiate Cybersecurity Defense Competition (NCCDC). All but the TCP connections were filtered out, and the features extracted from the remaining data included characteristics of individual connections as well as patterns across time within a sliding window. The learning technique was k-means, with k = 5 giving the most natural and revealing partition of the data. The results bore out the following two hypotheses consistent with the literature: (1) most network traffic is normal, only a certain percentage being malicious; (2) the traffic from an attack is statistically different from normal traffic.

Ontologies for situation-based crime scene identities

Our interests are in establishing the identity of agents in physical and cyber environments and determining how evidence in cases support identity judgments. Current work centers on physical evidence from a crime scene; however, what is presented is a computational framework that expands to the cyber world. Part of the projects foundation is based on Barwises situation theory because it joins semantics for utterances and accounts of perceptions. Situations both support items of information and carry information about other situations. Specifically, an utterance situation contains information about a described situation. We provide an account of the support for an identity judgment (in an id-situation) that essentially builds cases (aligned to legal cases) called id-cases, because significant cases of identity can lead to various situations that impact the value of evidence. Our framework includes a situation ontology, upon which an id-situation ontology is built. While focusing on physical evidence, we also developed a physical biometrics ontology, which the physical features ontology supports. Additionally, there is a law enforcement ontology and several supporting stubs. We show how a specific case is encoded in RDF in alignment with our ontologies, and complement our id-situation ontology with SWRL rules to infer a culprit in a crime scene.

Implementing webIDs + biometrics

In this paper, our main focus will be on the integration of WebIDs and biometrics. biometrics is the process of utilizing a users physical characteristics to identify them. There are three types of authentication. Knowledge-based authentication, based on the users knowledge, is where the user will use a pin number or a password to gain access. Token-based authentication uses some form of physical identification to verify the user. The final form of authentication is biometric-based authentication. Genetic and Evolutionary Feature Extraction (GEFE) is a feature extraction technique that can be used to evolve local binary pattern (LBP) based feature extractors that are disposable for users of biometric-based authentication systems. LBP compares intensity values of a pixel in a group of pixels to form a texture pattern. Each of these segmented regions has its own histogram that stores the frequency of these unique texture patterns that occur in a region. GEFE is an instance of a genetic and evolutionary computation (GEC). A WebID is a uniform resource identifier (URI) that represents some agent, such as a person, organization, group, or device. A URI is a sequence of characters that identifies a logical or physical resource. Many services that require any type of authentication rely on centralized systems. This means that users are forced to have a different account and identifier for each service they are using. For every service, a new registration needs to be created, which can be a burden on both the user and the service. A WebID will represent a users WebID profile. A users WebID profile contains a set of relations that describe the user. When the users profile is de-referenced, it will resolve to their profile document with structured data in RDF. WebIDs provide a relatively simple and safe alternative to traditional username/password user verification. However, they can still be compromised if an attacker gains direct access to a users computer, or if the users unique certificate is stolen. Adding biometrics to the authentication process can help solve this issue since biometric data (e.g., fingerprints, iris scans) is unique and not easily duplicated. If a biometric element can be added to WebID profiles, then users could be verified through both their WebID and biometric authentication. We are implementing a method of user verification that is convenient, widely applicable via the Internet, and protected against intrusion. Traditionally, sites store user log-in information on their own servers.

Identity Judgments, Situations, and Semantic Web Representations

We present our framework for the identity of agents based on situation theory as developed by Barwise, Devlin, and others. Semantic Web standards are used to capture the information present in a constellation of situations (“id-case”) that relate to identity attributions. We present examples of id-cases and discuss how they are encoded using RDF and other semantic-web standards. The examples include straightforward cases of identification using fingerprints and mugshots. They also include developing a profile from a set of documents. And they include a case with learning, specifically, learning a writing style so as to be able to identify the author. Using semantic-web standards, we can make SQL-like queries and execute rules to classify id-situations and entire id-cases. Our encodings also facilitate and account of how evidence accrues to identity judgments.

Comparing dimensionality reduction techniques

Feature selection techniques are investigated to increase the accuracy of classification while reducing the dimensionality of the feature space. Dimensionality reduction techniques investigated include principal component analysis (PCA), recursive feature elimination (RFE), and Genetic and Evolutionary Feature Weighting & Selection (GEFeWS). A support vector machine (SVM) with linear kernel functions was used with all three techniques for consistency. In our experiment, RFE and GEFeWS performed comparably and both resulted in more accurate classifiers than PCA.