Supporting forensic investigators on exploring web forums through Interactive Topic Modeling

Supporting forensic investigators on exploring web forums through Interactive Topic Modeling

Pols, A.

Hauff, C. (mentor)

Electrical Engineering, Mathematics and Computer Science

Software Technology

Web Information Systems

2016-06-13

Forums on the Web have become a highly popular platform for malicious activities as recent technologies allow to preserve anonymity. Forensic investigators are more and more interested to use these forums on the so-called Dark Web as their source of intelligence. Exploring the forums one by one is too time-consuming and it requires much effort of the investigator to create an overview. Topic Modeling (TM) has shown to be able to give insights on discussions on forums, this way improving the exploration of this unknown data, as an alternative to a traditional search engine. Interactive Topic Modeling (ITM) moreover has been introduced as a technique to incorporate the domain knowledge of the user into the generated topic model. As the investigators have much domain knowledge, incorporating their knowledge into the topic models should increase the quality of the model and align it the goal of the investigator. In lab studies in related work, ITM has shown to outscore both TM and traditional search. In this thesis, we evaluate the effectiveness, efficiency and preference of using ITM in a more realistic setup with stakeholders (forensic investigators) in a domain of their expertise (the Dark Web) in a user study setup. For this, based on stakeholder interviews and earlier research, we designed and built an ITM framework to explore forums on the Dark Web. We found that TM was more effective than ITM for forensic investigators to complete their tasks. Furthermore, traditional search was found most efficient and preferred. It was observed that participants incorrectly interacted with the topic model. Additionally, we found that the difficulty of a task influenced the use of ITM versus search. Users were found to fall back on using traditional search to complete their task more often for tasks with a low or high difficulty. We state that as ITM is introduced as a promising technique in lab studies; more effort is needed in explaining its use to the end user.

Interactive Topic Modeling
Text Mining
Dark Web
Forensics

http://resolver.tudelft.nl/uuid:e12ddb8d-ab56-411a-bbab-dbc942fe8b60

Student theses

master thesis

(c) 2016 Pols, A.