Result: Proposed Methodology for Cyber Criminal Profiling

Criminal profiling is an important tool employed by law enforcement agencies in their investigations. Criminal profiling is much more than an educated guess; it requires a scientific-based methodology. Cyber crimes are occurring at an alarming rate globally. Law enforcement agencies follow similar techniques to traditional crimes. As is the case in traditional criminal investigation, cyber criminal profiling is a key component in cyber crime investigations as well. This paper examines cyber criminal profiling techniques prevalent today, including inductive and deductive profiling, and the need for employing a hybrid technique that incorporates both inductive and deductive profiling. This paper proposes a cyber criminal profiling methodology based on the hybrid technique. Criminal behavior and characteristics are identified by analyzing the data against a predefined set of metrics.

AN0099753634;[6mr3]01aug.14;2019Mar05.12:18;v2.2.500

Proposed Methodology for Cyber Criminal Profiling. 

Criminal profiling is an important tool employed by law enforcement agencies in their investigations. Criminal profiling is much more than an educated guess; it requires a scientific-based methodology. Cyber crimes are occurring at an alarming rate globally. Law enforcement agencies follow similar techniques to traditional crimes. As is the case in traditional criminal investigation, cyber criminal profiling is a key component in cyber crime investigations as well. This paper examines cyber criminal profiling techniques prevalent today, including inductive and deductive profiling, and the need for employing a hybrid technique that incorporates both inductive and deductive profiling. This paper proposes a cyber criminal profiling methodology based on the hybrid technique. Criminal behavior and characteristics are identified by analyzing the data against a predefined set of metrics.

Keywords: cyber attacks; cyber criminal profiling; forensics; profiling framework

INTRODUCTION

The growing reliance on the cyber space among government institutions and businesses alike has led to a tremendous surge in cybercrimes. The Internet Crime Reports published yearly by the Internet Crime Complaint Center (IC3) is testimony to the menace of cybercrime. IC3 received 289,874 consumer complaints with an adjusted dollar loss of $525,441,1101, an 8.3% increase in reported losses since 2011 (Annual Report, [1]).

Before we dig deeper into cyber crime profiling, it is important to understand what cyber crime is. There is no official meaning of cyber crime written in any dictionary. Cyber crime is a subgroup of computer crime (Shinder & Tittel, [13]). Computer crime, as per the U.S. Department of Justice (DOJ), is defined as "any violation of criminal law that involves the knowledge of computer technology for its perpetration, investigation or prosecution" (Shinder et al., [13]). There are varying definitions on cyber crime as described by legislators and organizations. The United Nations (UN) defines cyber crime as "any illegal behavior committed by means of, or in relation to, a computer system or network, including such crimes as illegal possession of and offering or distributing information by means of a computer system or network" (Shinder et al.,

[13]). Symantec (n.d.) defines cyber crime as "any crime that is committed using a computer or network, or hardware device. The computer or device may be the agent of the crime, the facilitator of the crime, or the target of the crime."

There is a motive behind every crime, and cyber crimes are no different. Cyber crimes are performed for the various motives such as financial gain, intellectual property (IP) theft, espionage, terrorism, and for thrill. A UN study (Malby et al., [10]) on cyber crime states that "upwards of 80% of cybercrime acts are estimated to originate in some form of organized activity, with cybercrime black markets established on a cycle of malware creation, computer infection, botnet management, harvesting of personal and financial data, data sale, and 'cashing out' of financial information."

PROFILING

Criminal profiling is a key tool available to investigators used to narrow the range of suspects and evaluate the likelihood of a suspect committing a crime. Criminal profiling is a scientific technique to assess and analyze the scene of a crime and deduce behavioral characteristics of the individual committing the crime <bold>(</bold>Kirwan & Power, [8]). A profile consists of a set of characteristics likely to be shared by criminals who commit a particular type of crime (Shinder et al., [13]). Profiling methods are based on two assumptions (Kirwan et al., [8]) that are as follows:

Two types of criminal profiling methods are prevalent today. These are inductive profiling and deductive profiling.

Inductive profiling method (Figure 1) employs a database that contains extensive data on criminals committing a type of crime. The profiler analyzes the data, establishes correlations, and deduces the characteristics common to statistically large number of offenders committing a specific type of crime (Shinder et al., [13]).

Graph: FIGURE 1 Inductive profiling methodology.

Deductive profiling (Figure 2) involves analysis of forensic evidence and victim profiling to determine the motive and attacker characteristics (Tennakoon, [15]). The profiler analyzes the forensic evidence, employs the principles of victimology, and utilizes his/or her experience to deduce criminal characteristics (Shinder et al., [13]).

Graph: FIGURE 2 Deductive profiling methodology.

CYBER CRIMINAL PROFILING

Criminal profiling plays a key role in investigations. This paper uses the definition provided in "Examination of Cyber-criminal Behavior" (Jahankhani & Al-Nemrat, [7]), which is as follows: "An educated attempt to provide specific information as to the type of individual who committed a certain crime. A profile based on characteristics patterns or factors of uniqueness that distinguishes certain individuals from the general population."

As is the case with a crime, cyber criminal profiling must be used as a tool for cyber crime investigations. Cyber criminal profiling is effective as a law enforcement tool only when a standard methodology is used in developing profiles and is not based on an educated guess.

Cyber criminal profiling is garnering tremendous attention due to the rise in cyber crimes. Although it is similar to traditional criminal profiling, it presents numerous challenges to investigators. The perpetrators of the crime are remote and may be residing on different continents (Jahankhani et al., [7]). An interdisciplinary approach is required that applies not only psychology, criminology, and law but also a technological understanding on the subject of cyber crime (Tennakoon, [15]).

Profiling is still based on educated guesses wherein investigators try to identify patterns by comparing with recorded cyber crimes that may lead to results that are inaccurate. Without a proper use of a scientific methodology and empirical analysis, profilers may come to different conclusions and recommendations (Broucek & Turner, [4]). Therefore, a standard methodology is required for cyber criminal profiling to be a credible and effective tool for law enforcement agencies.

Forensic psychology offender profiling techniques are being used in cyber crime investigations as well. Inductive profiling involves a statistical analysis and is a method frequently used by the Federal Bureau of Investigation (Jahankhani et al., [7]). The inductive profiling method utilizes data mining techniques to develop models for pattern detection and involves the examination of data to identify patterns that match known fraud profiles (Wheelbarger, [18]).

Much academic work has been done on building a database of cyber criminal profiles. One of the projects known as the Hackers Profiling Project revolved around building a huge database on existing hacker profiles that included demographics, socioeconomic background, social relationships, and psychological traits (Kirwan et al., [8]). However, profiling was based on data obtained from self-reporting questionnaires rather than hacker activities and offenses (Kirwan et al., [8]). Donato ([5]) in his paper on criminal profiling proposes a methodology on how to use criminal profiling to improve digital forensics and cybercrime investigations. Donato's methodology focuses on finding the capability of the attacker in terms of skill level and deducing psychological characteristics on basis of the evidence (Kirwan et al., [8]). Donato's methodology does not look at empirical analysis to establish patterns, nor does it look at demographic characteristics of previous offenders (Kirwan et al., [8]).

In the cyber world, technology keeps on changing and hackers develop and employ new techniques known as zero day attacks. Their behavior is dynamic and may change over time with the acquisition of new skills (Jahankhani et al., [7]). The other issue is that the data are based on generalizations, and the sampling leaves out a dataset of skillful people who avoid detection over a period of time, thereby introducing inaccuracies in the results (Benny, [3]). Therefore, relying on inductive profiling only is not suitable for cyber criminal profiling. On the other hand, relying just on deductive profiling will leave investigators oblivious to the current trends such as popular attack methods, likely targets and victims (Tennakoon, [15]). Therefore, a hybrid methodology must be employed for cyber criminal profiling.

PROPOSED METHODOLOGY

The proposed methodology is based on a hybrid profiling model wherein the initial processes are deductive in nature and statistical analysis is performed to identify common patterns and characteristics. Digital forensics data can provide vital clues about the attacker such as sophistication of attack, motivation, tools used, and vulnerabilities exposed (Kwan, Ray, & Stephens, [9]). Cyber criminals, like traditional offenders, have their modus operandi that they tend to repeat at each crime (Shinder et al., [13]).

The proposed methodology employs six Profile Identification Metrics to determine the offender's modus operandi, psychology, and behavior characteristics:

The proposed methodology is a four-step process as follows:

Process 1 or P1

The first stage (Figure 3) involves victim profiling. P1 involves identifying the various aspects of an individual or an organization that attracted criminals (Tennakoon, [15]).

Graph: FIGURE 3 Process 1/ P1 of the proposed methodology.

Process 2 or P2

The second stage (Figure 4) involves identifying the motive behind the attack. A motive is closely associated with a victim. For example, an attack on government implies that the motive is espionage. This stage also involves analyzing the digital forensic evidence to deduce possible characteristics.

Graph: FIGURE 4 Process 2/ P2 of the proposed methodology.

Process 3 or P3

This stage involves an empirical analysis on the data and an identification of trends by conducting a statistical analysis (Figure 5). Criminal behavior and characteristics are identified by analyzing the data against the above mentioned metrics.

TABLE 1 Cyber Criminal Profiles

<table><thead valign="bottom"><tr><td>Cybercriminal Profile</td><td>Motive</td><td>Structure</td><td>Motivation Level</td><td>Skill Level</td><td>Attack Severity</td><td>Attack Method</td></tr></thead><tbody><tr><td>Novice</td><td>Fun Thrill</td><td>Unorganized</td><td>Low</td><td>Basic</td><td>Low to Medium</td><td>Freely available tools</td></tr><tr><td>Hacktivists</td><td>Political Activism</td><td>Unorganized</td><td>High</td><td>Basic to Intermediate</td><td>Low to Medium</td><td>Phishing, Spamming, DoS</td></tr><tr><td>Cyber Criminals</td><td>Financial Gain</td><td>Unorganized with some level of collaboration</td><td>Medium</td><td>Intermediate</td><td>Medium to High</td><td>Spamming, Malware</td></tr><tr><td>Cyber Crime Syndicates</td><td>Financial Gain</td><td>Organized Well Funded</td><td>High</td><td>Intermediate to Advanced</td><td>High</td><td>Malware available in the underground market</td></tr><tr><td>Cyber Spies</td><td>Espionage IP Theft</td><td>State Sponsored Highly Organized Well Funded</td><td>High</td><td>Highly Advanced</td><td>Critical</td><td>Customized codes, zero day attacks</td></tr><tr><td>Cyber Terrorists</td><td>Disruption</td><td>Well Funded Work in small modules</td><td>Medium</td><td>Basic to Intermediate</td><td>Low to Medium</td><td>DoS</td></tr></tbody></table>

Graph: FIGURE 5 Process 3/ P3 of the proposed methodology.

Process 4 or P4

This is the final stage and involves building cyber criminal profiles from the characteristics that have been identified. For example, an extremely skillful attacker that employs zero day exploits to target defense institutions to extract sensitive information falls under the cyber spy bucket.

Cyber criminals are classified into six profiles (see Table 1).

Hacktivists

Hacktivists are politically motivated and target governments, news groups, and companies doing business with governments. Their motive for hacking is to get their political message across. Most hacktivist groups are not organized and rely on freely available tools with the intention of conveying their political message (Nachreiner, [11]). Their skill level can vary from basic to intermediate.

Cyber Criminals

Cyber criminals are driven by financial gains and target consumers and businesses. They are not organized and their skill level ranges from basic to intermediate.

Cyber Syndicates

They are highly organized, well-funded, and headed by crime organizations. They are responsible for stealing billions of dollars from consumers and businesses each year and also buy and sell the private information and intellectual property and trade attack toolkits, zero day exploit code, malware code (Nachreiner, [11]).

Cyber Spies

Cyber spies are state sponsored and very well-funded. Their motive is espionage and IP theft. They target government organizations and business dealing with governments to extract sensitive information. They are highly advanced and create customized codes incorporating previously undiscovered software vulnerabilities (Nachreiner, [11]). They often leverage the most advanced attack and evasion techniques into their attack, using kernel level rootkits, stenography, and encryption to avoid detection (Nachreiner).

Novice

This class of hackers has basic skill level and relies on freely available hacking tools. They do this for fun and entertainment.

Cyber Terrorists

This group is well funded, organized, and engage in hacktivism as well as criminal activity (Bednarz, [2]).

The cyber criminal profiling methodology, as illustrated in Figure 6, must be an interactive process for accuracy and effectiveness. Investigations are iterative in nature. Initial investigations reveal basic details. As the investigations moves from basic to advanced stages, more and more information on the victim is collected, which may help in identifying additional motives that were missed in the initial investigation. Additional evidence may also be collected providing more data for profile characterization.

Graph: FIGURE 6 Iterative Process.

CONCLUSION

Cyber criminal profiling must be based on a scientific process. A standard profiling methodology is required for accuracy, reliability, and effectiveness. The cyber criminal profiling methodology proposed in this paper is based on a hybrid profiling model that involves both inductive as well as deductive profiling. This methodology needs to be tested by simulating different scenarios in a lab setting.

By Arun Warikoo

Reported by Author

Arun Warikoo is a security solutions specialist. He has worked extensively in the private sectors to improve the security of their critical information systems. His research focuses on improving the governance around security and developing frameworks on cyber security.