^{1}

^{1, 2}

^{3}

^{1}

^{2}

^{3}

We investigate a sequence of dynamic criminal networks on a time series based on the dynamic network analysis (DNA). According to the change of networks’ structure, networks’ variation trend is analyzed to forecast its future structure. Finally, an optimal arresting time and priority list are designed based on our analysis. Better results can be expected than that based on social network analysis (SNA).

Since September 11 attacks, focus of criminal analysis has been shifted to find terrorist networks, and a number of results have been obtained [

Since the research to find the suspects and predict the crime time is still based on analyzing frequency and content of communications between suspects, which can be easily concealed and disguised by real criminals, we start from another direction, by observing a sequence of criminal networks of different time and making use of hierarch clustering to analyze the structure changes of criminal networks.

Suppose that we have got a database of message traffic records of all the criminal suspects. Of course, the time that the message is sent will be marked. Furthermore, we suppose that semantic network analysis has been finished and all the messages about crime and suspects have been extracted from the original database. So we can skip preparation part and directly focus our attention on researching the structure of criminal networks.

As our first contribution, we introduce DNA to construct a sequence of criminal networks. For the second contribution, we modify the definition of centrality and partition method based on hierarchy clustering to make it serve our model better. As our third contribution, we suggest a method, time series analysis. By this way, we can predict the possible crime time of every suspects. Finally, through analyzing the structural changes of networks, we propose four different processes to help determine the best arresting time; meanwhile, we design an arresting priority list based on the degree of importance of the suspects.

Denote the time interval by

Now, we get a sequence of criminal networks. For each network

In order to describe the network

Here are some notations that we will use as follows:

: the index of member nodes;

Then, we get the relation distance matrix

These two matrixes contain nearly all the information of the messages traffic of time between

According to Freeman’s research, there are three popular centrality measures—degree centrality

Degree centrality is defined as follows:

Betweenness centrality is defined as follows:

Closeness centrality is defined as follows:

The centralities above describe different characters of nodes in a network.

Degree centrality shows the number of nodes’ connections, which also reflects connectivity of nodes in a network. Nodes with more connections can be viewed as more important like a leader [

Betweenness centrality shows the number of shortest paths passing by certain node. It also reveals the dependency of a node from other nodes. Obviously, if a node is dependent on other nodes quite much, the node must be very important for the smooth communication, like a gatekeeper [

Closeness centrality actually measures how far away one node is from other nodes. Apparently, small closeness value of a node reflects its high importance.

Given a criminal network

Here we design an optimal function to avoid the above problems as the following:

This optimal function is based on the density of each subnetwork. If the partition

From the definition of density, we can find that density increases when the ratio of the inner interaction of subnetwork dominates the whole interaction of the members of the subnetworks, which reveals the information that these members are intensively connected. And we multiply all the subnetworks’ densities to get the optimal function:

Below is the pseudocode of an algorithm which is designed to find the optimal value of

To find the maxima value of the optimal function, we must calculate the values of all possible partitions, which needs

This clustering method is based on the designed optimal function; it can determine actual number and structure of subnetworks beforehand perfectly in theory. And the precondition is that

As usual, the communications between two people are rarely affected by others, and we regard the arbitrary edge’s weight as being independent on other edges. So, we extract all edges’ weights, respectively, from the sequence of networks and compose them of some new series:

We regard communication as an event, and

Beforehand, as different events adjust to different methods, we categorize the criminal event into two kinds.

Crimes which is so serious that we must prevent them from happening in advance: terrorist attacks like 9/11, premeditated kidnaps and homicides, and so forth.

Crimes which have less direct damage and can be monitored for a long term in order to obtain crucial evidence or destroy and arrest the criminal gangs entirely: drag trafficking organization, a group of traitors who steal corporation’s accounts and cash, and so forth.

For the first case, it usually goes through a relatively short interval of time from the formation of criminal motive to implementation; therefore, it lacks obvious regularity and shows a drastic trend from preparation to operation. So, we choose the ARIMA model to predict the communication behavior of every two people in the near future.

As to the second case, according to He’s investigation [

This part is not the emphasis of what we discuss, and we just give the brief steps of predicting method [

Now, we can get the expected networks

Similar series of relation strength matrixes, each edge’s modified centralities, and clustering networks can be gotten in the similar way.

We call these series the

Although criminal gangs will avoid varying their frequency of communication dramatically to avoid the sight of police, we can still determine the possible committing time of crime and the key guys according to the changes of communication clustering structure and modified centrality.

We simulate the criminals’ communication process and visualize the known and predicted clustering results of the networks. By experiments, the changing trends of some structure and criminal members deserve our attention.

First of all, we define that if the subnetwork of a network

As shown in Figure

It is a visualization of change of networks’ structure in a predicted sequence from

In this way, we can prevent the crimes from happening, as well, more members involved can be arrested, and more raw evidence can be obtained.

Inversely, when one big subnetwork break up into several smaller subnetworks, we call this

As shown in Figure

It is a visualization of change of networks’ structure in a predicted sequence from

It also has its reverse process that is called

Structure, differing from the microscopic behavior like several times of communications between limited individuals, is a macroscopic behavior of the whole criminal networks. So structure’s change exposes more deeply the essence of the organized criminal behavior, which is beyond the control of criminals themselves. As once the structure is disguised, the following criminal networks’ behavior will be distorted inevitably. It is easily to understand. Every member of the criminal gangs, even the leaders, only contacts limited members and information, which, in one way, ensures security by a certain degree of isolation; in another, is caused by distrust between different subgangs. So no one in the gangs can know and determine the whole criminal network. But we can detect and research the whole network by monitoring their communications.

Here, we just list and analyze four simplest possible processes. Other more complex processes like derivation of two or three bigger subnetworks and division into three-tier subnetworks or four-tier subnetworks, although can be realized in theorem, are too complicated for actual criminal activities. So, we omit the further discussion. Certainly, other possible processes are worthy to find in the future study.

In the process of capturing, usually it is hard to catch all the members, as each capturing will invite others’ alertness. Therefore, it is an urgent work to find the core members and catch them firstly. Here, we make use of the expected sequences of modified centrality’s of every node who is involved in the newly emerging subnetwork during the integration process or derivation process. Through investigating their changing trend, we are hopefully to find those key guys.

If some nodes whose degree centrality shows an increasing trend and reaches the peak among others’ in the expected sequences, then according to the above conclusion, they are more possible to be the leaders of this subnetworks. We should catch them firstly.

If some nodes whose betweenness centrality shows an increasing trend and reaches the peak among others’ in the expected sequences, then these guys are likely to be the gatekeepers, who make sure the smooth of communication. Catching them will invite others’ alertness immediately. So, we should watch them closely and arrest them lastly.

As to other members, we use the method of TOPSIS [

Beforehand, we define some new notations.

According to the above analysis, we define a vector of trituple which contains three measures of the form as follows:

For the convenience of description,

Therefore, the ideal model of a person who is most crucial among the criminal gangs will have his own measure vector

What we need to do is to calculate the

This distance is the key to determine the priority list of who are more crucial. A further distance apparently indicates a lower possibility of being a key member. On the other side, if the

Similarly, we can define the Euclid distance of

The suspicious members in the subnetworks will be arranged into an initial priority list. The order of the list is arranged according to the value of

Here, we use the data from ICM 2012 problems [

The first three crime networks are drawn by the given data; the forth one is the result of ARMA model. The indexes of nodes from 1 to 82 represent 82 potential crimes, and the edges between two nodes indicate the two people have been that communicating.

Then, we use the method from clustering analysis and software Pajek to give the result of partition of known crime networks at

As we have got the partition of known crime networks and the prediction of future crime networks, now, we can combine them with time series analysis and clustering analysis to forecast the partition of crime networks at

Similarly, we give the 3D picture of Figure

Observing Figures

Left column is the exact result of partition of crime networks at

The future partition of crime networks at

3D picture of last table.

According to the implication from Figures

To choose different perspectives to analyze problems, it will usually obtain some new feelings. In order to close the essence of the criminal network, we abandon the common SNA and frequency analysis or density analysis in DNA, and instead, we observe the overall structure’s change of networks. Although it is hard to analyze quantitatively, we can visualize this process and observe it directly. In this way, we exemplify our superiority to touch overall networks’ image, which is hard for criminals to disguise.

This work was jointly supported by the National Natural Science Foundation of China under Grant nos. 61272530 and 11072059 and by the Natural Science Foundation of Jiangsu Province of China under Grant no. BK2012741.