Vivien Chan

Kam-Pui Chow

Michael Kwan

Guy Fong

Michael Hui

Jemy Tang

AN EXPLORATORY PROFILING STUDY OF ONLINE AUCTION FRAUDSTERS

Keywords: Online auctions, criminal profiling, multivariate behavioral analysis

Online auctions are one of the most popular e-commerce applications. With the growth of online auctions, the amount of online auction fraud has increased significantly. Little work has focused on the criminal profiling of online auction fraudsters. This exploratory study uses multivariate behavioral analysis to profile 61 online auction fraud offenders based on their behavior. The relationships between offender behavior and personal characteristics are also examined. The results yield a taxonomy of online auction fraud offenders: (i) novice-moderatelyactive; (ii) intermediate-inactive; and (iii) experienced-active. Discriminant analysis of the personal characteristics of offenders yields 78.6% accurate identification of the offender type. The results demonstrate that (intrinsic) personal motivation, education level and age are the most significant characteristics of experienced-active offenders.

Introduction

The growth of online shopping has been phenomenal. Online auctions are one of the most popular online shopping platforms as evidenced by eBay's 19% increase in profits (totaling $677 million) during the first quarter of 2013 alone [START_REF] Richter | eBay's profit rises 19 percent, Statista[END_REF]. The increased popularity of online auction sites has seen a related growth in online auction fraud. According to the U.S. Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3), online auction fraud is consistently among the top complaints, with a high of 71.2% in 2004 [START_REF] Aleem | Internet auction fraud: The evolving nature of online auction criminality and the mitigating framework to address the threat[END_REF].

Research on online auction fraud by Dong, et al. [START_REF] Dong | Combating online in-auction fraud: Clues, techniques and challenges[END_REF] and Trevathan and Read [START_REF] Trevathan | Undesirable and fraudulent behavior in online auctions[END_REF] has focused on the typology of online auction frauds. Pandit, et al. [START_REF] Pandit | NetProbe: A fast and scalable system for fraud detection in online auction networks[END_REF] have identified online auction fraudsters by analyzing interactions between buyers and sellers. Meanwhile, researchers have ascertained that traditional criminal profiling techniques can be very useful in dealing with different types of cybercrimes [START_REF] Rogers | The role of criminal profiling in the computer forensics process[END_REF]. However, empirical studies that apply criminal profiling techniques to real online auction offender data are practically nonexistent.

This paper uses multivariate behavioral analysis to profile 61 online auction fraud offenders. The relationships between offender behavior and personal characteristics identify three types of online auction fraud offenders: (i) novice-moderately-active; (ii) intermediate-inactive; and (iii) experienced-active. The results also demonstrate that (intrinsic) personal motivation, education level and age are the most significant characteristics of experienced-active offenders.

Profiling Fraudsters

Casey [START_REF] Casey | Cyberpatterns: Criminal behavior on the Internet, in Criminal Profiling: An Introduction to Behavioral Evidence Analysis[END_REF] states that criminal profiling is very useful when little is known about the offenders, which is particularly important because criminals often use the Internet to conceal their identities and activities. Rogers [START_REF] Rogers | The role of criminal profiling in the computer forensics process[END_REF] emphasizes the importance of using criminal profiling in cybercrime investigations, but there is no general theoretical model or approach for profiling cybercrime offenders.

Rogers [START_REF] Rogers | The role of criminal profiling in the computer forensics process[END_REF] notes that two major criminal profiling approaches are employed by forensic scientists and practitioners: inductive and deductive profiling. An inductive approach is commonly employed by the FBI in profiling traditional crimes; many forensic scientists also adopt an inductive approach in profiling cybercrimes. However, other forensic scientists (e.g., [START_REF]Criminal Profiling: An Introduction to Behavioral Evidence Analysis[END_REF]) argue that a deductive approach should be employed in investigating cybercrimes. In particular, they recommend the use of behavioral evidence analysis for cybercrime offender profiling because it is more objective, i.e., it relies more on facts than statistical inferences.

The application of traditional criminal profiling models to cybercrime investigations is an interesting concept. Goodwill, et al. [START_REF] Goodwill | What works in offender profiling? A comparison of typological, thematic and multivariate models[END_REF] have compared three models of offender profiling on a group of (stranger) rapists to help predict the characteristics of offenders. The three models include the power and anger model of Hazelwood [START_REF] Hazelwood | Analyzing the rape and profiling the offender, in Practical Aspects of Rape Investigation: A Multidisciplinary Approach[END_REF], the behavioral thematic model of Canter, et al. [START_REF] Canter | Differentiating sex offenses: A behaviorally based thematic classification of stranger rapes[END_REF], and the MTC:R3 typology [START_REF] Knight | Classifying sexual offenders: The development and corroboration of taxonomic models[END_REF] with a multivariate approach adapted from [START_REF] Canter | Differentiating sex offenses: A behaviorally based thematic classification of stranger rapes[END_REF]. Goodwill, et al. [START_REF] Goodwill | What works in offender profiling? A comparison of typological, thematic and multivariate models[END_REF] recommend a fourth model, multivariate behavioral analysis, which combines clusters of behavior over simple bivariate relationships between individual behavior and background characteristics. In fact, their study concluded that multivariate behavioral analysis yields results that greatly surpass those obtained with the other three models. The multivariate profiling approach [START_REF] Goodwill | What works in offender profiling? A comparison of typological, thematic and multivariate models[END_REF] illustrated in Figure 1 helps understand the underlying factors that can be used to classify offenders, and how personal characteristics may be used to predict the types of offenders. Multivariate analysis has proved to be effective at profiling cybercrimes. Stabek, et al. [START_REF] Stabek | The seven scam types: Mapping the terrain of cybercrime[END_REF] have applied the technique to understand the incidence of scams. Their content analysis technique is similar to that used by Goodwill, et al. [START_REF] Goodwill | What works in offender profiling? A comparison of typological, thematic and multivariate models[END_REF], who leverage hierarchical clustering and discriminant function analysis. Kjaerland [START_REF] Kjaerland | A taxonomy and comparison of computer security incidents from the commercial and government sectors[END_REF] has applied multivariate profiling to account for the multitude of features that appear simultaneously in cyber incidents.

This exploratory study applies the multivariate profiling methodology to analyze offender behavior. The relationships between the behavior and personal characteristics of offenders are also examined. The results provide insights into the use of multivariate profiling to create profiles of online auction fraudsters.

Profiling Methodology

Aleem and Antwi-Boasiako [START_REF] Aleem | Internet auction fraud: The evolving nature of online auction criminality and the mitigating framework to address the threat[END_REF] have developed a taxonomy of eBay auction frauds based on the modus operandi of cyber criminals. The frauds include non-delivery of merchandise, failure to pay, counterfeits and reproductions, bid shilling, bid shielding, misrepresentation, fee stacking, shell auctions and phishing, triangulations and fencing, buying and switching, and loss/damage claims. This exploratory study focuses on one type of online auction fraud -counterfeits and reproductions. The reason is that the study is based on the online auction offender database of the Hong Kong Customs and Excise Department, which maintains data pertaining exclusively to counterfeit goods. Total seizure value was less than HK$10,000 S5 SeizureValue10k 50k

Total seizure value was HK$10,001 to HK$50,000 S5 SeizureValueAbove50k Total seizure value was more than HK$50,001

The online auction offender database contained case reports from 2012 to the middle of 2013. In the study, we assumed that each offender was responsible for his/her offenses, although not all the offenders were convicted of their alleged crimes at the time of the study. The database had 121 cases. Cases with missing data were eliminated, yielding a total of 61 online auction offender cases that were considered in the study. Seven offenders were accused of copyright infringements while 54 were accused of trademark infringements.

Preparation of Variables

The variables collected from the offender database were divided into two categories: (i) offender behavior variables; and (ii) personal characteristics variables.

All the offender behavior variables were recoded as dichotomous variables to facilitate analysis and interpretation. Variables with multiple categories were dummy coded as multiple dichotomous variables (e.g., variables for the engagement period and source of auction items) and a pool of eighteen variables was created. The eighteen variables and their descriptions are presented in Table 1. Note that all currency values are expressed in Hong Kong dollars (HK$).

The personal characteristics variables are categorized into two conceptual groups: demographic variables (e.g., sex, age and education level) and intrinsic motivation (e.g., reason for engaging in online auction activities and why [the offender was] not afraid of being caught). The personal characteristics variables, their descriptions and other key information are presented in Table 2.

Analytical Process

The data analysis process involved three steps. First, multidimensional scaling analysis was applied to the eighteen dichotomous offender behavior variables. This technique identified the underlying structure of the offender behavior variables: similar variables formed clusters when the variables were plotted as points in two-dimensional space. The second step performed k-means clustering to classify the offender cases into offender types based on the clusters of offender behavior variables. The final step performed discriminant analysis to check if the offender types could be predicted from the personal characteristics variables.

Results

This section describes the multidimensional scaling results and the discriminant analysis results.

Offender Behavior Variables

Nearly 50% (30 of the offenders were engaged in online auction fraud for periods ranging from four months to twelve months, while 28% (17) and 23% [START_REF] Stabek | The seven scam types: Mapping the terrain of cybercrime[END_REF] were engaged in online auction fraud for less than three months and more than one year, respectively. The total seizure value was about HK$1 million, but only 5% (3) of the offenders were involved in seizures valued at more than HK$50,000. Most of the offenders (52%) earned less than HK$1,000 per month from online auction fraud activities, with about 16% [START_REF] Pandit | NetProbe: A fast and scalable system for fraud detection in online auction networks[END_REF] earning more than HK$5,000 per month. Only 18% of the offenders were actively involved with more than 30 transactions per month; the majority of the offenders were less active with fewer than eleven transactions per month (48%) or moderately active with 11-30 transactions per month (31%). About 80% of the counterfeit goods were sourced from other online websites while the remaining 20% of the goods were bought from factories in Hong Kong or China or bought from other sources.

Personal Characteristics Variables

Table 2 provides detailed information about the personal characteristics variables. The personal characteristics variables reveal that most of the offenders were male (67%), single or divorced (72%), lived with their parents (64%) and were between the ages of 22 and 39 (68%). Most of the offenders had secondary school education (64%) and were employed (56%), but were relatively poor (64%) with only 8% (5) of them earning more than HK$20,000. Nearly all the offenders (90%) did not have a previous arrest history. Most of them (79%) were engaged in online auctions for monetary reasons (e.g., to improve their living standards). About half the offenders (49%) said that they did not know that the goods they sold were counterfeit.

Multidimensional Scaling Results

The two-dimensional coordinates for the 18 offender behavior variables were hierarchically clustered using Ward's Method with the squared Euclidean distance and standardized Z-score. Figure 2 shows the results with regional hierarchical clustering of scaling coordinates. Three clusters of offender behavior variables were identified; they are marked in Figure 2. The three clusters divide the two-dimensional space of offender behavior variables into three non-overlapping areas and one common central region. The three clusters correspond to the following three offender types:

Offender Type 1 (Novice-Moderately-Active): This cluster is marked with a "+" in Figure 2. Variables at the right end of Dimension 1 and the bottom end of Dimension 2 suggest a pattern of moderately-active auction fraud activities with the number of online fraud transactions (S2 11 30Tx), related earnings (S3 Earn1k 5k) and seizure value (S5 SeizureValue 10k 50k) falling in the middle of all the offender cases. Interestingly, this behavioral pattern clustered offenders who engaged in less than three months of online fraud (S1 Engaged3mLess).

Offender Type 2 (Intermediate-Inactive): This cluster is marked with a "o" in Figure 2. Variables at the left end of Dimension 1 and the bottom end of Dimension 2 suggest a pattern of inactive auction fraud activities with the lowest number of transactions (S2 6 10Tx, S2 5TxBelow) and earnings per month (S3 Earn1kLess). In addition, these variables are also clustered with the lowest seizure value (S5 SeizureValue10kBelow) and the offenders who engaged in online fraud for a moderate period of time (S1 Engaged4 6m, S1 Engaged7 12m).

Offender Type 3 (Experienced-Active): This cluster is marked with a "-" in Figure 2. Variables at the right end of Dimension 1 and the top end of Dimension 2 suggest a pattern of very active auction fraud activities with the largest number of transactions (S2 31 99Tx, S2 100TxAbove) and earnings per month (S3 Earn5kMore). In addition, these variables are also clustered with the highest seizure value (S5 SeizureValueAbove50k) and the offenders who engaged in online fraud for the longest period of time (S1 Engaged13mAbove).

The central region of the two-dimensional scaling plot (marked with three "x" symbols in Figure 2) shows an absence of variables related to online fraud offender behavior. Careful examination reveals that this common region shared by the three clusters is the source of goods bought, which means that all the offender types bought goods from similar sources. In addition, Dimension 1 suggests a measure of the activity level of offender behavior while Dimension 2 suggests a measure of the period of engagement in online fraud activities.

Discriminant Analysis Results

The k-means clustering technique (with k = 3 clusters) was used to group the offender cases. The data was analyzed using a non-parametric mean test with k-independent samples on the set of offender behavior variables. A Kruskal-Wallis test indicated significant effects of the grouping on engagement period (χ 2 (2)=17.189, p<0.01), transactions (χ 2 (2)=14.304, p < 0.01), earnings (χ 2 (2)=10.011, p < 0.01) and seizure value (χ 2 (2)=23.587, p < 0.01), but no significant effect on the source (χ 2 (2)=0.905, p > 0.05). These results are consistent with the results of the multidimensional scaling analysis described in the previous section, where the three types of offenders had distinct behavior, but no difference with regard to the sources of their auction items.

Further analysis indicated that the effects of the grouping on age (χ 2 (2)=7.08, p < 0.05), education level (χ 2 (2)=8.21, p < 0.054) and why not afraid of being caught (χ 2 (2)=10.22, p < 0.01) are significant. However, the effect on motive is marginally insignificant (χ 2 (2)=4.69, p = 0.096) and the effects on the other personal characteristics variables are not significant.

Upon closer examination of the three offenders types using the three significant personal characteristics variables, we noticed that the novicemoderately-active offender group is the youngest of the three groups (mean = 28), with half the offenders (50%) having tertiary or university or higher education levels (50%) and most of them (61.5%) believing that they would not get caught. On the other hand, the experienced-active offenders is the oldest group (mean = 36), with the vast majority of them (81.8%) having primary or secondary education levels and almost all of them (90.9%) claiming that they did not know that their activities were illegal. The mean age of the intermediate-inactive offender group is 29, most of them (79.2%) having a secondary school education level, about half of them (45.8%) claiming that they did not know that their activities were illegal and 41.7% believing that they would not get caught.

Discriminant function analysis was applied to differentiate the three offender types: novice-moderately-active, intermediate-inactive, and experienced-active. The independent variables corresponded to the personal characteristics, which included demographic characteristics (e.g., sex, age, education level and income level) and intrinsic motivation (e.g., objective and why the offenders were not afraid of being caught). Table 3 presents the Wilks' lambda and canonical correlations for the three offender types. The canonical discriminant functions show a high correlation (0.771) with an effect of R 2 c = 59.4%. The first and second functions significantly differentiate the three groups (Wilks' Lambda = 0.327, χ 2 (22) = 37.8, p < 0.05). The results obtained for the second function alone were not significant (p = 0.713). Table 4 presents the structure matrix and structure coefficients for the three offender types corresponding to the first function (Function 1). Note that age, education level and intrinsic motivation (objective and why [an offender was] not afraid of being caught) are primarily responsible for differentiating between the offender types. On the other hand, education level is negatively correlated with the other three variables, which are positively correlated in Function 1.

Table 5 shows the centroids of the three offender groups for Function 1. The group centroids suggest that intrinsic motivation and age (i.e., Function 1) tend to be most elevated for experienced-active offenders and least evident in novice-moderately-active offenders. This suggests that the offender type differences observed in Function 1 pertaining to the personal characteristics variables (age, education level, objective and why not afraid of being caught) can be attributed to experienced-active offenders.

Based on the data presented in Table 4, the following equation can be used to determine the offender type based on personal characteristics information:

Offender Type (F unction 1) = -0.09x 1 + 0.62x 2 -0.84x 3 + 0.20x 4 -0.20x 5 -0.04x 6 -1.05x 7 + 0.52x 8 -0.43x 9 + 0.69x 10 + 0.75x 11 .

Tests of this equation with the available data revealed that 78.6% of the original cases were classified correctly.

Discussion

The results of the study show that a multivariate approach [START_REF] Goodwill | What works in offender profiling? A comparison of typological, thematic and multivariate models[END_REF] is useful for profiling online auction offenders. Three distinct types of offenders, novice-moderately-active, intermediate-inactive and experienced-active, were identified using multidimensional scaling and hierarchical clustering, and these three types of offenders are statistically different.

Discriminant analysis applied to the personal characteristics variables yielded an equation (model) for offender type determination that is 78.6% accurate when used with the available data. In addition, certain personal characteristics variables (i.e., age, education level, objective and why not afraid of being caught) have higher predictive values in discriminating online auction fraud offenders. These variables are most elevated in the case of experienced-active offenders, which is consistent with the k-independent sample test results (i.e., a group of older offenders with lower education levels who mostly believed that the online auction activities they were conducting were not illegal). At the other end are the novice-moderately-active offenders, typically young with high education levels who did not believe that they would get caught, which is also consistent with the k-independent sample test results. Additionally, although the experienced-active offenders said that they were unaware that their online auction activities were illegal, there is the possibility that they were lying to law enforcement investigators.

Figure 3 shows the predictive model constructed based on the results of this study. This model could assist investigators in narrowing their search for offenders after the online auction activities and behavior of the subjects are known.

The two personal characteristics variables, objective and why not afraid of being caught, correspond to the intrinsic motivation of offenders. Interestingly, the results of the study reveal that this psychological factor may play an important role in predicting the offender type. As Rogers, et al. [START_REF] Rogers | Self-reported computer criminal behavior: A psychological analysis[END_REF] note, like any other crime, people are also involved in cybercrimes, so it is necessary to include psychological traits and personal characteristics when profiling cyber criminals. Therefore, it would be useful if future research on online auction fraud (and other cybercrimes) could also study how psychological factors could be used to predict offender behavior.

The current study only considered online auction fraudsters who were apprehended. It is possible that undetected offenders may have certain personal characteristics that could enhance prediction. Although the inclusion of undetected offenders is difficult in empirical research, it is, nevertheless, important to acknowledge the fact that this group was not considered in the study.

In addition, the use of law enforcement records as research data is not ideal. The data was not collected for the purpose of empirical research and, therefore, may be biased towards criminal investigations [START_REF] Canter | Differentiating sex offenses: A behaviorally based thematic classification of stranger rapes[END_REF]. In fact, Farrington and Lambert [START_REF] Farrington | The Feasibility of a Statistical Approach to Offender Profiling: Burglary and Violence in Nottinghamshire[END_REF] note that law enforcement data has limited utility with regard to offender profiling.

The results of this exploratory study show how a taxonomy of online auction fraud offenders can be created and that certain personal characteristics could predict the offender type. A good topic for future research is to collect data pertaining to additional personal characteristics and examine if the profiling of online auction fraudsters could be improved. In particular, the motivations of offenders could be explored more deeply to discern new offender behaviors. Additionally, the multivariate profiling approach employed in this study could be applied to other types of cybercrimes.

Conclusions

Multivariate behavioral analysis is a promising approach for profiling online auction fraud offenders. Multidimensional scaling and hierarchical clustering of the various offender behavior variables yielded a taxonomy of three distinct types of auction fraud offenders: (i) novice-moderatelyactive; (ii) intermediate-inactive; and (iii) experienced-active. Personal characteristics were also found to be predictive of the offender types; discriminant analysis of the personal characteristics of offenders resulted in 78.6% accurate identification of the offender type.

Figure 2 .

 2 Figure 2. Multdimensional scaling plot of the offender behavior variables.

Figure 3 .

 3 Figure 3. Predictive model of offender types based on Function 1.

Table 1 .

 1 Offender behavior variables.

	Variable	Description
	S1 Engaged3mLess	Engaged for less than 3 months
	S1 Engaged4 6m	Engaged for 4-6 months
	S1 Engaged7 12m	Engaged for 7-12 months
	S1 Engaged13mAbove	Engaged for more than 13 months
	S2 5TxBelow	Less than 5 transactions per month
	S2 6 10Tx	Between 6-10 transactions per month
	S2 11 30Tx	Between 11-30 transactions per month
	S2 31 99Tx	Between 31-99 transactions per month
	S2 100TxAbove	More than 100 transactions per month
	S3 Earn1kLess	Earned less than HK$1,000 per month
	S3 Earn1k 5k	Earned between HK$1,001 to HK$5,000 per month
	S3 Earn5kMore	Earned more than HK$5,001 per month
	S4 BoughtFromWebsite	Items bought from online websites (e.g., Taobao)
	S4 BoughtFromHK China Items bought from shops/factories in China/HK
	S4 BoughtFromFriends	Items bought from friends or other sources
	S5 SeizureValueBelow10k

Table 2 .

 2 Personal characteristics variables.

	Variable	Description	Value	Frequency
	Sex	Gender of offender	Female	32.80%
			Male	67.20%
	Age	Age of offender	-	Mean = 30
				Min = 18
				Max = 54
	Education Level	Education level	Primary or lower	3.30%
		of offender	Secondary	63.90%
			Tertiary	13.10%
			University or higher	19.70%
	Occupation	Occupation of	Unemployed	24.60%
		offender	Student	14.80%
			Employed	55.70%
			Housewife	4.90%
	Income Level	Income level of	No stable income	14.80%
		offender	Income of HK$9,999	21.20%
			or lower
			Income of HK$10,000	27.90%
			to HK$19,999
			Income of HK$20,000	8.20%
			or higher
			Missing data	27.90%
	Economic Status	Economic status of	Poor	63.90%
		offender	Average	32.80%
			Rich	3.30%
	Marital Status	Marital status of	Single	63.90%
		offender	Married	27.90%
			Divorced	8.20%
	Living Status	Living arrangement	Lived alone	4.80%
		of offender	Lived with parents	63.90%
			Lived with spouse	31.30%
			or friend
	Arrest History	Previous arrests of	No arrest history	90.20%
		offender	Related fraud	4.20%
			arrest history
			Non-related arrest	5.60%
			history
	Objective	Reason for engaging in	Monetary	78.90%
		online auction activities	Thrill	21.10%
	Why not afraid	Why the offender was not Believed would not	42.60%
	of being caught	afraid of being caught	get caught easily
		by the Customs and	Did not know it	49.20%
		Excise Department	was an offense
			Did not disclose	8.20%

Table 3 .

 3 Wilks' lambda and canonical correlations for the three offender types.

	Function Wilks' Lambda	χ 2	df	p	Rc	R 2 c
	1-2	0.327	37.8 22 0.019 0.771 59.40%

Table 4 .

 4 Standardized discriminant function and structure coefficients.

	Scale	Coefficient	rs	r 2 s
	Function 1
	Sex (x1)	-0 . 0 9	-0 . 2 03 . 9 6 %
	Age (x2)	0 . 6 2	0 . 3 31 0 . 6 9 %
	Education Level (x3)	-0 . 8 4	-0 . 2 8	8 . 0 7 %
	Occupation (x4)	0 . 2 0	0 . 0 3	0 . 0 7 %
	Income Level (x5)	-0 . 2 0	0 . 0 7	0 . 5 3 %
	Economic Status (x6)	-0 . 0 4	0 . 0 4	0 . 1 4 %
	Marital Status (x7)	-1 . 0 5	0 . 0 8	0 . 6 9 %
	Living Status (x8)	0 . 5 2	0 . 1 8	3 . 1 3 %
	Arrest History (x9)	-0 . 4 3	-0 . 2 1	4 . 2 0 %
	Objective (x10)	0 . 6 9	0 . 2 9	8 . 2 4 %
	Why no fear of being caught (x11)	0 . 7 5	0 . 3 5	1 2 . 1 1 %

Table 5 .

 5 Group centroids resulting from discriminant function analysis.

	Offender Type	Function 1
	Novice-moderately-active	-1.314
	Intermediate-inactive	0.124
	Experienced-active	1.761

Acknowledgement

The authors wish to thank Dr. Kenneth Yuen for his valuable advice during the data analysis phase.


Xiao-Xi Fan

Kam-Pui Chow

Fei Xu

WEB USER PROFILING BASED ON BROWSING BEHAVIOR ANALYSIS

Keywords: Web user profiling, browsing behavior, term frequency

Determining the source of criminal activity requires a reliable means to estimate a criminal's identity. One way to do this is to use web browsing history to build a profile of an anonymous user. Since an individual's web use is unique, matching the web use profile to known samples provides a means to identify an unknown user. This paper describes a model for web user profiling and identification. Two aspects of browsing behavior are examined to construct a user profile, the user's page view number and page view time for each domain. Four weighting models, based on the term frequency and term frequency -inverse document frequency weighting schemes, are proposed and compared. Experiments involving 51 personal computers demonstrate that the profiling model is very effective at identifying web users.

Introduction

Due to the widespread use of computers and networks, digital evidence plays an important role in criminal investigations. The large amount of digital evidence that resides on computer systems can help investigate and prosecute criminal actions [START_REF] Colombini | Digital profiling: A computer forensics approach[END_REF]. The evidentiary artifacts are varied and include chat logs, agendas, email, application information, Internet history and cache files. In many cases, investigative leads are found in a criminal's web browser history [START_REF] Jones | Web Browser Forensics, Part 1, Symantec[END_REF].

Investigators often face situations where a computer associated with a cybercrime has been found, but the suspect is unknown. In such a scenario, the investigator can create the suspect's profile from the digital evidence residing on the computer, and match the profile with the profiles of other individuals to identify the suspect.

Identifying a user from his/her web browsing history requires an efficient model that associates individuals with their web activities. This paper proposes a web user identification model that creates a user profile based on web browsing activities and identifies relationships between different users. The model provides web user identity information based on the assumption that a given user has consistent preferences. Experiments involving 51 computers demonstrate that the profiling model can be used to identify web users.

Related Work

User profiling has been used in the context of e-commerce and personalization systems, the two primary applications being content-based filtering and collaborative filtering. Grcar, et al. [START_REF] Grcar | User profiling for the web[END_REF] have developed a topic-ontology-based system that creates dynamic profiles of users from their browsed web pages. The viewed pages are represented as word vectors and hierarchical clustering is performed to construct a topic ontology. A similarity comparison maps users' current interests to the topic ontology based on their browsing histories.

Fathy, et al. [START_REF] Fathy | Enhancing web search with semantic identification of user preferences[END_REF] have proposed a personalized search that uses an individual's click-history data to model search preferences in an ontological user profile. The profile is then incorporated to re-rank the search results to provide personalized views.

Some research has been conducted in the area of behavioral profiling. Bucklin, et al. [START_REF] Bucklin | A model of website browsing behavior estimated on clickstream data[END_REF] have modeled the within-site browsing behavior of users at a commercial website. Their model focuses on two browsing behaviors: a user's decision to continue browsing the site or to exit, and how long a user views each page during a website visit.

Forte, et al. [START_REF] Forte | Learning human behavioral profiles in a cyber environment[END_REF] conducted a web-based experiment to observe how people with different backgrounds and levels of experience make decisions. The experiments analyzed the types of actions, sequences of actions and times between actions using significance testing, regression modeling and evidence weighting. The results suggest that recording the actions taken and the time spent on each decision can help create statistical models that can discern demographic information.

Similarly, Hu, et al. [START_REF] Hu | Demographic prediction based on user's browsing behavior[END_REF] have presented an approach that predicts user gender and age from web browsing behavior. Gender and age are predicted by training a supervised regression model based on users' selfreported gender, age and browsing history. Then, based on the age and gender tendency of the web pages that a user has browsed, a Bayesian framework is used to predict the user's gender and age.

Research in the areas of user profiling and behavior analysis have not explicitly targeted digital forensic investigations. Indeed, criminology profiling techniques have primarily focused on violent criminal activities.

One area in which criminal profiling has been applied to computer crimes is the insider threat. McKinney, et al. [START_REF] Mckinney | User identification via process profiling: Extended abstract[END_REF] have proposed a masquerade detection method, which creates a user profile using a naive Bayesian classifier that analyzes running computer processes. Bhukya and Banothu [START_REF] Bhukya | Investigative behavior profiling with one class SVM for computer forensics[END_REF] engage GUI-based behavior to construct user profiles; a support vector machine learning algorithm is used to train the system to classify users. To our knowledge, there is little, if any, research that has explicitly focused on identifying web users based on their browsing history.

Methodology

Figure 1 presents a schematic diagram of the proposed web user profiling and identification model. The investigator uses evidence from the target computer to identify the user. The suspect computers are the candidate computers that are compared with the target computer. The candidate computer with the highest similarity score is assumed to have been used by the same user as the target computer.

Browsing activity data is extracted from all the browsers installed on the target and candidate computers. After preprocessing the data, the user's domains of interest are extracted and the page view number (PVN) and page view time (PVT) are calculated for each domain. Each computer is then represented as a weighted vector of the domains, where each weight is the term frequency (TF) or term frequency -inverse document frequency (TFIDF) of the PVN or PVT. Finally, a cosine similarity measure is applied to calculate the similarity scores between the target computer profile and the candidate computer profiles to identify the candidate computer with the highest similarity score.

Data Extraction

Web browsers can be classified based on their web browser engines, as shown in Table 1 [START_REF]Wikipedia, List of web browsers[END_REF]. Different browsers record browsing history in different ways. Table 1 shows that most browsers are based on the Trident engine (IE core). Every web page visited by a Trident engine browser is stored in the index.dat file, along with the access time, Windows user name, etc. Analyzing the index.dat file can help understand a user's browsing behavior. Some browser forensic tools can automatically parse the index.dat file; example tools are Index.dat Viewer, Pasco, IE History View, Web Historian and NetAnalysis. We used IE History View v1.70 [START_REF] Sofer | IE History View v1.70 -View Visited Web Sites of Internet Explorer, NirSoft[END_REF] to extract Internet history records from index.dat files in this research. Also, Chrome History View v1.16 [START_REF] Sofer | Chrome History View v1.16[END_REF] and Mozilla History View v1.51 [START_REF] Sofer | Mozilla History View v1.52 -Mozilla/Firefox Browsers History Viewer[END_REF] were used to extract history records from Google Chrome and Mozilla Firefox browsers, respectively.

For each computer, the history records from all the installed browsers were extracted and combined together. Each record contained a URL, title, access time and Windows user name. When a computer had multiple users, a separate profile was created for each user. History records from the target and candidate computers were extracted for the last 40 days. The reason for using a 40-day observation period is that users can easily change their browsing topics over short periods of time, but it is much harder for users to change their browsing interests over the long term.

Data Preprocessing

Several preprocessing steps were applied to the history data that was collected. For Trident engine browsers, duplicate records may exist in the primary index.dat history file as well as the daily/weekly index.dat file. Duplicate records with the same URLs and access times were deleted. Also, pop-up desktop news notices were removed because, if the users did not actively click on the pop-ups, they were likely not of interest. Next, the domain information was extracted from each history record. Most URLs have the structure shown in Figure 2. The structure includes the protocol, domain, path, page file and variable-value pairs [START_REF] Oh | A study for classification of web browser logs and timeline visualization[END_REF]. For example, the domain of the URL http://en.wikipedia.org/wiki/ Domain is en.wikipedia.org. Every domain name is a hierarchical series of character strings, with the different levels separated by dots proceeding from the top-level domain at the right end to specific host names on the left (Table 2).. The top-level domain is expressed using a generic code (e.g., .com, .edu or .gov) or a country code (e.g., .cn or .uk). The second label from the right denotes the second-level domain. Labels to the left of the second-level domain correspond to sub-domains of Note that an extracted domain visited only once during the observation period was not included in a profile. This is because one-page visits were assumed to be primarily due to user input errors.

Vector Representation

A vector space model was used to build computer profiles. Each computer (c j ) was represented as a vector c j = (w 1 , w 2 , ..., w N ), where N is the number of domains. Each weight domain pair (w i ) corresponds to a domain extracted from the history records of the target computer. The weight was calculated using TF and TFIDF over the PVN or PVT of the domain. Domains were ranked according to their weighting values. The top N domains from the target computer were chosen to form the profile vectors of the target and candidate computers. This resulted in four web user profile models: TF-PVN, TF-PVT, TFIDF-PVN and TFIDF-PVT.

TF-PVN Model. Term frequency (TF) is the number of times that a term occurs in a document. In this study, the TF-PVN model assigns a weight to the page view frequency tf pvn d,c of domain d in the browser history of computer c according to the equation [START_REF] Manning | Introduction to Information Retrieval[END_REF]:

tf pvn d,c = pvn d,c k pvn k,c (1)
where pvn d,c is the number of page views of domain d from computer c during the observation period and k pvn k,c is the total number of page views from computer c during the observation period. For a given computer c, the set of weights determined by TF-PVN may be viewed as a quantitative digest of the computer. Table 3 shows the top seven domains from a target computer sorted by their TF-PVN TFIDF-PVN Model. TFIDF-PVN attenuates the effect that frequently visited domains have on domain weighting by giving high weights to domains that occur frequently for one computer but rarely for the other computers.

Computing the TFIDF-PVN of a domain for a given computer involves two sub-calculations: how often the domain is visited by the computer (TF) and how many computers in the collection visit the domain (DF). The DF is inverted to yield the IDF, which is then combined with the TF. IDF is calculated as the logarithm (base 2) of the quotient of the total number of computers (|C|) and the number of computers containing the domain (|{c ∈ C|d ∈ c}|) in order to scale the values [START_REF] Manning | Introduction to Information Retrieval[END_REF]:

tf idf pvn d,c = tf pvn d,c × log 2 |C| |{c ∈ C|d ∈ c}| . (2)
Table 4 shows the same seven domains from the target computer as in Table 3 sorted by their TFIDF-PVN values. Note that some new domains have emerged among the top seven domains. Also, the weight of chinamac.com has increased substantially because only two out of fifteen computers shared this domain (high IDF). Furthermore, the weight of google.com has decreased because it appeared in almost all the computers (low IDF). The reason for these differences is that TFIDF-PVN assigns a high value to a domain when it occurs many times in a small number of computers (high discriminating power for the computers). The value is lower when a domain occurs few times on a computer or occurs on many computers (low discriminating power for the computers). The value is the lowest when a domain appears on virtually all the computers.

TF-PVT Model. The PVN indicates a user's preferred (i.e., frequently visited) websites, but the same weight is assigned to each visit and the weight does not reflect the amount of time the user spent viewing the website. For example, a user who watches videos on a website would spend more time on the website, but the click frequency would be low. The page view time (PVT) is used to capture this important aspect of a user's browsing behavior.

The PVT calculation is based on a view session [START_REF] Bucklin | A model of website browsing behavior estimated on clickstream data[END_REF]. A view session starts when a website is requested and ends after an idle period of at least 30 minutes or when a new domain is requested. The idle period accounts for the fact that a browser does not record when a user leaves a page. The PVT is computed as the difference in access times between two consecutive page views based on the assumption that a user browses the new page after clicking a link. Thus, the TF-PVT weight is the time spent on domain d based on the browser history of computer c:

tf pvt d,c = pvt d,c k pvt k,c (3)
where pvt d,c is the total page view time for all the pages corresponding to domain d for computer c during the observation period, and k pvt k,c is the total page view time for computer c during the observation period. Table 5 shows the same seven domains and their weights. Note that TF-PVT gives different results than TF-PVN. For example, the weights of youtube.com and taobao.com are high because the user watches Table 6 shows the same trend as TFIDF-PVN (Table 4) in that TFIDF-PVT enhances the domain weight due to a high IDF. Specifically, TFIDF-PVT assigns a high weight to a domain when it consumes a lot of browsing time on a few computers (high discriminating power).

tf idf pvt d,c = tf pvt d,c × log 2 |C| |{c ∈ C|d ∈ c}| . ( 4
)
A low weight is assigned when the page view duration for the domain was short or the domain was browsed by many computers (low discriminating power). The lowest weight is assigned when a domain was browsed by all the computers.

Web User Identification

The cosine similarity measure is commonly used to assess the similarity of two documents. We use this measure to assess the similarity of two browsing histories:

Similarity cos = c 1 • c 2 ||c 1 ||||c 2 || = N i=1 c 1,i × c 2,i N i=1 (c 1,i ) 2 × N i=1 (c 2,i ) 2 . ( 5
)
In the cosine similarity calculation, c 1 • c 2 denotes the intersection of computers c 1 and c 2 , and ||c i || is the norm of vector c i . Candidate computers that share domains with the top N domains of the target computer have higher similarity scores, while candidate computers that share no domains are assigned similarity scores of zero. The candidate computer with the highest similarity score has the highest probability that it was used by same web user as the target computer.

Experimental Design and Results

The web user profiling model was tested using 34 participants from the University of Hong Kong. The participants, all of whom were students between the ages of 20 to 31, provided their personal computers for model testing. All the computers had been in use for at least two months.

A total of 51 computers were collected from the 34 participants; seventeen of the participants had two computers. Thirty four computers, one from each participant, were assigned to Group I (i.e., computers that can be used as the target computer or candidate computers). The seventeen remaining computers were placed in Group II (i.e., computers that can only be used as candidate computers).

Browsing history records from July 1, 2013 through August 9, 2013 (40 days) were extracted from each computer. The time settings and time change logs were reviewed before data extraction. Table 7 presents the browsing history statistics of the collection of 51 computers.

Evaluation Metric

The performance of the profiling model was evaluated using an accuracy metric, which is defined as the proportion of the correctly identified examples out of all the examples to be identified. The accuracy was calculated using the equation:

accuracy = J j tp j K (6)
where tp j is the number of true positives for participant j chosen in Group I, J is the number of different participants chosen in Group I and K is the total number of computers chosen in Group I.

Experimental Design

Two evaluations of the web user profile model were performed. The first evaluation compared the impact of TF-PVN, TFIDF-PVN, TF-PVT and TFIDF-PVT. The second examined the impact of the size of the profile group (M ) on model accuracy.

The target and candidate computers were selected from the pool of M = 51 computers. Computers from Group I were successively selected as the target. Three samplings of candidate computers were used (M = 15, 33, 51). The samplings included ten computers from Group I and five computers from Group II (M = 15); 22 computers from Group I and eleven computers from Group II (M = 33); and all the computers from the two groups (M = 51). When M < 51, ten repeated experiments were performed for each M and the average accuracy was computed.

After the weight of each domain was computed for the target computer, the top N domains were chosen. When N < 10, the possibility existed that these domains could not be found on any of the candidate computers if the domains were too special. Therefore, we decided to choose more than ten domains on the target computer as features.

Feature Influence

Since the average number of extracted domains per computer was 63, we tuned the parameter N from 10 to 60 to observe the influence on web user identification accuracy for the four weighting models: TF-PVN, TFIDF-PVN, TF-PVT and TFIDF-PVT.

Figure 3 presents the results obtained for the three computer group profile sizes (M = 15, 33, 51). For all four weighting models, when user identification was performed on a small group (M = 15), the performance improves and then flattens as N increases. In the case of the TF-PVN model, the best user identification result occurred for N = 26 (67%). For TFIDF-PVN, the best user identification result was 92% when N = 32, which indicates that TFIDF is more effective than TF.

The best accuracy for TFIDF-PVT was 90% when N = 24, which is a slightly lower than TFIDF-PVN, but this result was obtained with fewer domains. Also, TF-PVT yielded better results (73%, N = 20) than TF-PVN, but worse results than TFIDF-PVT.

The trends for each feature remain consistent as M increases. However, Table 8, which presents the complete results, shows that better performance was obtained for smaller computer profile groups.

Profile Group Size Influence

Figure 4 presents the analysis of the influence of the computer profile group size M . For all the features, as the size of computer profile group increases, the web user identification accuracy gradually decreases. Also, when the number of domains (N ) is 20 and 30, the performance relation TFIDF-PVT > TFIDF-PVN > TF-PVT > TF-PVN holds for all M . However, when N = 40, TFIDF-PVN and TFIDF-PVT have about the same accuracy. When N = 50, TFIDF-PVN has better performance than TFIDF-PVT for all M , which implies that if high accuracy is required, TFIDF-PVN should be used, but more domains would be required; otherwise TFIDF-PVT is a good choice.

Conclusions

The model proposed for web user profiling and identification is based on the web browsing behavior of users. Experiments involving 51 computers show that the profiling model can be applied to identify web users. Evaluation of the performance of the four weighting models, TF-PVN, TFIDF-PVN, TF-PVT and TFIDF-PVT, demonstrates that TFIDF-PVN is the most accurate at identifying web users.

Our future research will attempt to combine PVN and PVT to create a more accurate identification model. Additionally, the dataset will be expanded by collecting computers from a broader population in a realworld scenario. Our research will also focus on more complex scenarios, such as identifying all the users who have used a public computer.

Figure 1 .

 1 Figure 1. Proposed web user profiling and identification model.

Figure 2 .

 2 Figure 2. URL structure.

Figure 3 .

 3 Figure 3. Influence of feature number for the four weighting models.

Figure 4 .

 4 Figure 4. Influence of computer profile group size using the four weighting models.

Table 1 .

 1 Web browser categories.

	Engine	Corresponding Browsers
	Trident	Internet Explorer, MyIE9, The World, Maxthon,
	(IE Core) Tencent Traveler, 360 Secure Browser, Sougou
		Explorer, 360chrome, MenuBox, GreenBrowser
	Gecko	Mozilla Firefox
	Webkit	Google Chrome, Safari
	Presto	Opera

Table 2 .

 2 Examples of domain names.

	Domain	Host	Sub-	Second-	Top-	Extracted
	Example	Name Domain	Level	Level	Domain
				Domain Domain	Part
	www.hku.hk	www	-	hku	hk	hku.hk
	www.cs.hku.hk	www	cs	hku	hk	hku.hk
	www.discuss.com.hk	www	-	discuss	com.hk	discuss.com.hk
	the second-level domain. The top-level and second-level domains (ref-
	erenced as domain in later sections) were extracted from every history
	record.

Table 3 .

 3 TF-PVN weighting results. The exact ordering of domains can be ignored, but the number of occurrences of each domain is material. However, certain domains such as google.com are visited very frequently by users. These domains have high TF-PVN values for most users and, therefore, have little or no user discriminating power.

	Domain	pvn	tf pvn
			(3,067 Visits)
	google.com	535	0.174
	hku.hk	366	0.119
	taobao.com	235	0.077
	chinamac.com	202	0.066
	hsbc.com.hk	102	0.033
	hkst.com	68	0.022
	youtube.com	60	0.020
	values.

Table 4 .

 4 TFIDF-PVN weighting example.

	Domain	pvn	tf pvn	idf	tfidf pvn
			(3,067 Visits) (15 Computers)
	chinamac.com	202	0.066	2.907	0.191
	taobao.com	235	0.077	1.100	0.084
	hku.hk	366	0.119	0.447	0.053
	hkst.com	68	0.022	1.585	0.035
	hsbc.com.hk	102	0.033	0.907	0.030
	youtube.com	60	0.020	0.907	0.018
	google.com	535	0.174	0.100	0.017

Table 5 .

 5 TF-PVT weighting example.

	Domain	pvt	tf pvt
		(sec.) (207,021 sec.)
	google.com	42,506	0.205
	youtube.com	16,805	0.081
	taobao.com	14,474	0.070
	hku.hk	14,112	0.068
	chinamac.com 11,343	0.055
	hkst.com	3,815	0.018
	hsbc.com.hk	859	0.004
	videos and shops online. Like TF-PVN, this weighting scheme does
	not abandon non-discriminating domains such as google.com that may
	lead to incorrect user identification.

TFIDF-PVT Model. Like TFIDF-PVN, TFIDF-PVT attempts to provide more meaningful weights. If a domain is viewed for a long time from most of the computers, the discriminating ability of this domain is weaker. Consequently, TFIDF-PVT ranks the website lower than TF-PVT. The TFIDF-PVT weight is computed as:

Table 6 .

 6 TFIDF-PVT weighting example.

	Domain	pvt	tf pvt	idf	tfidf pvt
		(sec.) (207,021 sec.) (15 Computers)
	chinamac.com 11,343	0.054	2.907	0.159
	taobao.com	14,474	0.070	1.100	0.077
	youtube.com	16,805	0.081	0.907	0.074
	hku.hk	14,112	0.068	0.447	0.031
	hkst.com	3,815	0.018	1.585	0.029
	google.com	42,506	0.205	0.100	0.020
	hsbc.com.hk	859	0.004	0.907	0.004

Table 7 .

 7 Browsing history statistics.

	July 1, 2013 to August 9, 2013 (40 days)
	Number of computers	51
	Number of sessions	36,801
	Total page views	131,709
	Total page view time (seconds)	8,822,703
	Mean sessions per computer	721.588
	Mean page views per computer	2,582.529
	Mean page view time per computer (seconds) 172,994.177
	Mean extracted domain per computer	63.980
	Mean page views per session	3.579
	Mean page view time per session (seconds)	239.741
	Mean page view time (seconds)	66.986
	Mean sessions per domain	11.278
	Mean page views per domain	40.364
	Mean page view time per domain (seconds)	2,703.862

Table 8 .

 8 Web user identification accuracy for the four weighting models.

	M	T F I D F -P V N T F I D F -P V T	T F -P V N	T F -P V T
	15 Min	0.670 (N=10)	0.690 (N=10)	0.520 (N=10)	0.62 (N=10)
	Max	0.920 (N=32)	0.900 (N=24)	0.670 (N=26) 0.730 (N=20)
	33 Min	0.650 (N=12)	0.677 (N=10)	0.427 (N=10) 0.505 (N=10)
	Max	0.873 (N=46)	0.845 (N=34)	0.595 (N=32) 0.636 (N=24)
	51 Min	0.471 (N=10)	0.529 (N=10)	0.382 (N=10) 0.441 (N=10)
	Max	0.676 (N=46)	0.647 (N=30)	0.441 (N=34) 0.500 (N=20)

Acknowledgement

This research was supported by the University of Hong Kong and by a Conference Grant.


Ricci Ieong

Kam-Pui Chow

VALIDATION RULES FOR ENHANCED FOXY P2P NETWORK INVESTIGATIONS

Keywords: Peer-to-peer networks, Foxy, first seeder, network simulation

Experiments with the Foxy P2P network have demonstrated that the first uploader of a file can be identified when search queries are submitted to all the network nodes during initial file sharing. However, in real Foxy networks, file search queries are not transmitted to the entire Foxy network and this process may not identify the first uploader. This paper presents a set of validation rules that validate the observed first uploader. The validation rules define the seeder curve that consistently describes the number of uploaders over time. Analysis of four scenarios shows improved accuracy at detecting the first uploader and that, in situations with insufficient competition for file content, the first uploader may not be identified precisely.

Introduction

The Foxy peer-to-peer (P2P) network, which employs the Gnutella 2 protocol, has for several years been a popular file-sharing P2P application in Chinese communities. When the Government of Taiwan shut down the Foxy client publisher in 2009, the use of the Foxy network dramatically decreased and leakage of files through the network dropped temporarily. However, recent incidents have brought considerable media attention. In August and September 2013, sensitive Hong Kong government documents were leaked using the Foxy network [START_REF] Ckseol | More personal data identified by Foxy King (in Chinese), HKHeadline.com[END_REF][START_REF] Tao | Another personal data leak from HK Police Force identified by Foxy King[END_REF]. In such situations, if the appropriate legal entities can identify the first uploader of the sensitive files, then they can reduce or even eliminate the leaks at an early stage.

Ieong, et al. [START_REF] Ieong | Forensic investigation and analysis of peer-to-peer networks[END_REF] have shown that the seeder curve -a plot of the number of uploaders (seeders) over time -provides information about the number of seeders as well as the stage of P2P file sharing. However, monitoring rules derived for detecting the first uploader using the seeder curve have high error rates as the number of hub nodes increases [START_REF] Ieong | Validation of rules used in Foxy peer-to-peer network investigations[END_REF]. A second monitoring strategy used three rules to monitor search queries in the Foxy P2P network to identify the first uploader [START_REF] Ieong | Enhanced monitoring rule through direct node query for Foxy network investigation[END_REF]. The rules leverage the fact that, in search-based P2P networks, a user locates files by executing a search query in the network. Hub nodes relay and filter search queries from the leaf nodes in the Foxy network. Thus, it is possible to identify the first uploader by monitoring queries at hub nodes.

This paper examines the effects of large numbers of hub nodes on monitoring accuracy. Increasing the number of hubs from one to 1,000 indicates that the number of hubs affects the overall accuracy of the monitoring rules by introducing delays in the appearance of the first uploader without affecting the shape of the seeder curve. To counteract this behavior, supplementary rules are proposed to enhance the accuracy of validation if the first uploader is identified during the slow-rising or rapid-rising periods of the seeder curve. If the first uploader is not identified before the rapid-rising period, then the identified individual is unlikely to be the first uploader.

Foxy P2P Query Monitoring

The rules utilized to monitor the Foxy network were presented in a previous study [START_REF] Ieong | Enhanced monitoring rule through direct node query for Foxy network investigation[END_REF]. When file-sharing activities are observed, the monitoring rules initiate file content requests to the nodes that possess the targeted file and then determine if the observed file contains the entire file content. The first uploader returned in the uploader lists that have been verified to possess the entire file content is considered to be first seeder. This rule is referred to as the file existence verification function.

Figure 1 shows a simplified diagram of a Foxy P2P network with four hubs. The solid lines denote the connections between the hubs and leaf nodes. The black and white leaf nodes represent the uploader and downloaders, respectively. The dashed line indicates the direction of file download.

Previous experiments have tested the effect of a small number of hubs on the accuracy of first seeder identification [START_REF] Ieong | Validation of rules used in Foxy peer-to-peer network investigations[END_REF]. When a small number of hubs is introduced to the Foxy network, the probability of identifying the first seeder remains the same. To evaluate the functionality of the monitoring rule, it is assumed that the hub node broadcasts all the search queries to all the leaf nodes in the network in a simulated environment. Therefore, all the hubs share the same list of seeders, such that all the leaf nodes can identify the uploaders. If the search query reaches the entire Foxy network, the identified first uploader should be the first uploader of the file.

However, in a real Foxy network, a hub node does not broadcast a search query message to all the nodes; only a limited set of nodes receive the search query [START_REF] Ieong | Enhanced monitoring rule through direct node query for Foxy network investigation[END_REF]. Thus, a file search request may only be observed by leaf nodes that are connected to a hub where the search query can be accessed. Additionally, since the hub nodes serve as the repository for the list of available uploaders close to the downloader, when a downloader is connected to the hub with the uploader (H3 in Figure 1), its download requests are accepted first. In contrast, although the initial search queries of downloaders located at hubs not connected to the uploader were submitted earlier (e.g., H4 in Figure 1), these downloaders can initiate downloads only after the nodes connected to the hub because uploaders have initiated and completed their file downloads (e.g., leaf node H3 in Figure 1).

The hub node connectivity in a search-based P2P file-sharing network means that, as the number of hub nodes increases, the probability of identifying the first seeder through the investigation algorithm is only affected by the probability of the first uploader and the monitoring node connected to the same hub.

With this implicit nature of the partial uploader list, the investigation algorithm can only confirm if the identified uploader is the first observable full content file holder among the uploaders in the localized lists of connected hubs, even if the file existence verification function can identify a first seeder. However, it cannot be ascertained if the observed uploader is the actual first uploader. When two full content uploaders are simultaneously present in the network, no mechanism exists to distinguish the first seeder from another seeder unless the target machines are analyzed forensically.

The file existence verification function cannot validate if the collected uploader lists fully cover all the uploaders. Thus, a validation scheme should be designed to utilize the results from the file existence verification function.

First Uploader Validation Rules

Three validation rules were derived to confirm if the first uploader can be correctly identified in a given situation. The rules focus on the fact that identifying the first uploader depends on the monitoring node that receives the initiation time of the search query. This can be affected by the distance from the query and the size of the file being shared. The first two rules are concerned with the issue of the shared file being small and, therefore, being replicated quickly. The two rules are: Rule 1: If the time required to download the file is short, then the probability of confirming the observed first uploader is very small. Therefore, the observed uploader should be rejected.

Rule 2: If the entire file existence verification test is completed by the queried uploader in a short time, then the observed first uploader is less likely to be the actual first uploader. Therefore, the observed uploader should be rejected.

Although numerous downloaders are present in a P2P network, only one uploader has the full file content when the monitoring node initiates the search during the slow-rising period. Many detected uploaders from the list should be confirmed as partial file-content uploaders only, especially during the slow-rising period. A third rule then confirms that there is only one individual with the full version of the file. This rule is given by: Rule 3: In the list of returned uploaders, if all the detected uploaders are full file-content uploaders with no partial file-content uploaders detected by the file existence verification test during the initial stage, then the observed uploader should be rejected.

Experimental Design

Simulations were performed in a Foxy ns-3 simulation environment [4] using the monitoring and validation rules. All the parameters other than the number of hub nodes and the size of the files being shared were the same as specified in [START_REF] Ieong | Enhanced monitoring rule through direct node query for Foxy network investigation[END_REF]. The request broadcast cascade level (defined by the time-to-live (TTL) value in the query) was set to three and the maximum number of connected hubs for a leaf node was set to three according to the GnucDNA implementation [START_REF] Gnucleus | GnucDNA -Free P2P Core Component[END_REF]. The number of leaf nodes was set to 200, number of downloaders to 100, search time to approximately 500 seconds and transfer bandwidth to 1,024 KB.

Four experiments were performed to determine the effect of hub nodes and file size on identifying the first uploader. In each experiment (set), an average was obtained from five simulations using the same parameters.

Set 1: This set of simulation experiments focused on the random search time with ten hub nodes. Two hundred of the 500 leaf nodes were downloaders. The transferred file size was 13 MB. The mean data rate was approximately 1 Mbps.

Set 2: This set of simulation experiments was performed to analyze the effect of the number of hub nodes on the accuracy of the validation rules. The parameters were the same as those used in Set 1, except that the number of hubs was increased to 1,000 nodes.

Set 3: This set of simulation experiments was derived from the monitoring record of a popular television episode. The file size was set to 100 MB. One hundred and thirty-five of the 200 leaf nodes were downloaders; the leaf nodes were connected to 1,000 hub nodes. The mean data transfer rate was approximately 10 Mbps.

Set 4: This set of simulation experiments was derived from the monitoring record in which a small, popular file was shared over the network. Files of size 512 KB were used in the simulation. One hundred thirty-five of the 200 leaf nodes were downloaders; the leaf nodes were connected to one hub node. The hub node was reduced to one to focus on the validation rules in the simulation experiments. The mean data transfer rate was approximately 1 Mbps.

The simulation results for the four experiment sets were evaluated using four criteria: Criterion 1: A correct identification occurs when the first seeder is identified correctly and is validated correctly by the validation rules.

Criterion 2: A correct rejection occurs when a first seeder is identified incorrectly and is rejected correctly by a validation rule.

Criterion 3: A false rejection or Type I error occurs when the first seeder is identified correctly but is rejected incorrectly by a validation rule.

Criterion 4: A false acceptance or Type II error occurs when a first seeder is identified incorrectly but is validated correctly by the validation rules.

Experimental Results

Table 1 shows the results of the simulation experiments. When the P2P investigation algorithm and validation rules were applied to the four experiment sets, more than half of the experiments correctly rejected or confirmed the uploader. However, in two experiment sets, most of the actual seeders were rejected by the validation rules.

Set 1 Results

Figure 2 shows the seeder curve for Set 1. The two indicators show the times of the initial search query responses of the monitoring node for the two correct rejections. The results show that 40% of the simulations did not locate an uploader in the network. The rejections are correct because the monitoring node submitted the first search query after the rapid-rising period. When the number of available uploaders exceeded the response limit, uploader responses were filtered from the monitoring node list, and the validation rules correctly rejected these first uploaders. The result also demonstrates that, in the case of search-based P2P file- sharing networks, accurate results can only be obtained if the search is initiated during the slow-rising period.

Set 2 Results

Set 2 modified Set 1 by increasing the number of hubs and reducing the file size. Two changes are expected in the output. First, with more hubs involved, the probability of correctly identifying the first uploader should be reduced. This is because detection depends on the probability that the monitoring node and the uploader are connected to the same hub node. Second, with a small file size, the download duration decreases and the file should propagate rapidly across the network.

Figure 3 shows the results from a Set 2 simulation. The upper graph shows the seeder curve for the network while the lower graph shows the seeder curve created by the monitoring node. However, the two validation tests failed. The file existence verification was extremely short (rejected by Rule 2). Also, only one partial uploader was identified throughout the verification period (rejected by Rule 3). Since the monitoring node did not see the uploaded file until there were 20 uploaders, the validation rule correctly rejected the incorrectly-identified first uploader.

Set 3 Results

Figure 4 shows the results from a Set 3 simulation. The upper graph shows the seeder curve created by the monitoring node while the lower graph shows the seeder curve for the first 60 uploaders. Four simulations in Set 3 had a Type I error because the observed seeders were rejected by the validation rules. In this set, the uploader list collected by the monitoring node included the actual first uploader. The file existence verification function also returned the first uploader as the detected first uploader. However, the returned results did not pass the validation rules.

In most of the Set 3 simulations, the file existence verification function completed in a very short time. Therefore, the observed uploader was rejected by Rule 2. As a result, the first uploader in Set 3 was incorrectly rejected by the validation rules.

A review of the overall seeder curve in Figure 4 shows that the competition among downloaders might not have been sufficiently demanding. Thus, the download activities had a very short slow-rising period and quickly entered the rapid-rising period. This behavior is similar to that observed when sharing a small file.

The file existence verification function also executed at an early stage of the slow-rising period. The result is that the uploader may not be sharing the file requested by the other downloaders. Without competition for file content, a delay in the file request might not be observed.

Further analysis of the overall seeder curve and the corresponding download duration time shows that shortly after the appearance of three uploaders in the P2P file-sharing network, the download activities proceeded to the rapid-rising period. Therefore, the actual slow-rising pe- riod in Experiment Set 3 was rather short. Even with the complete hub information, the probability of rejecting the first seeder was relatively high.

Set 4 Results

The Set 4 file size was small, which resulted in short file transfer times. Although the hub node serviced all the uploaders and downloaders, the time available for the monitoring node to submit the initial search query was insufficient. Figure 5 shows the seeder curve for Set 4. The query occurred after the slow-rising period and the search query response occurred at 100,400 seconds during the rapid-rising period. The observed first uploader was rejected by all three validation rules.

When the file size is smaller than 512 KB, the Gnutella2 protocol transmits the file in one fragment. Since the transfer time was so short, confirming that a file was originally from a particular uploader was impossible for the monitoring node even if the file locating function in- cluded the first uploader in the search environment. This is due to two reasons. First, a node that successfully downloads one file fragment immediately becomes a full file content holder; the monitoring node then considers the node to be a potential first uploader. Second, if the file is popular, the file search, which can take between ten seconds to a few minutes, may not complete before the end of the slow-rising period. The result is that multiple file uploaders are identified in the network.

Based on these simulation results, it can be concluded that, when a small file is shared, a forensic investigator is unlikely to distinguish the first uploader even if the monitoring node was enabled since the beginning of the file download. However, the investigator can identify the participants, including the potential uploaders and downloaders.

Conclusions

The research presented in this paper enhances the first uploader detection strategy in Gnutella networks. The three proposed validation rules validated and correctly rejected all the incorrectly-identified first uploaders in the simulation experiments. However, the validation rules incorrectly rejected 80% of the actual first uploaders in Set 3 and 20% in Set 4, resulting in a Type I error of 25% over all the experiments. The error is due to the short slow-rising periods and the competition among downloaders.

The overall analysis suggests that, if the seeder curve has an extremely short slow-rising period or if the seeder is identified after the slow-rising

Figure 1 .

 1 Figure 1. Foxy P2P network with four hubs.

Figure 2 .

 2 Figure 2. Seeder curve for Set 1.

Figure 3 .

 3 Figure 3. Summary of results from a Set 2 simulation.

  102,000 104,000 106,000 108,000 110,000 112,000 114,000 Number of Completed Downloads Time (s)

Figure 4 .

 4 Figure 4. Summary of results from a Set 3 simulation.

Figure 5 .

 5 Figure 5. Seeder curve for Set 4.

Table 1 .

 1 Simulation experiment results.

	Experiment	Correct	Correct False Reject False Accept
		Identification	Reject	(Type I)	(Type II)
	Set 1	60%	40%	0%	0%
	Set 2	0%	100%	0%	0%
	Set 3	0%	20%	80%	0%
	Set 4	0%	80%	20%	0%

period, then the observed first seeder cannot be accurately validated. The validation rules can verify an observed seeder, but they eventually result in an incorrect rejection of the seeder.

Future research will investigate P2P network scenarios with short slow-rising periods to enhance the monitoring rules. Also, the research will analyze the characteristics of file-sharing activities and extract attributes that can accurately determine the slow-rising period.