A valuable aspect during crime scene investigation is the digital documentation of the scene. Traditional means of documentation include photography and in situ measurements from experts for further analysis. Although 3D reconstruction of pertinent scenes has already been explored as a complementary tool in investigation pipelines, such technology is considered unfamiliar and not yet widely adopted. This is explained by the expensive and specialised digitisation equipment that is available so far. However, the emergence of high-precision but low-cost devices capable of scanning scenes or objects in 3D has been proven as a reliable alternative to their counterparts. This paper summarises and analyses the state-of-the-art technologies in scene documentation using 3D digitisation and assesses the usefulness in typical police-related situations and the forensics domain in general. We present the methodology for acquiring data for 3D reconstruction of various types of scenes. Emphasis is placed on the applicability of each technique in a wide range of situations, ranging in type and size. The application of each reconstruction method is considered in this context and compared with respect to additional constraints, such as time availability and simplicity of operation of the corresponding scanning modality. To further support our findings, we release a multi-modal dataset obtained from a hypothetical indoor crime scene to the public.

Cyber Threat Intelligence (CTI) is an important asset for organisations to facilitate the safeguarding of their systems against new and emerging cyber threats. CTI continuously provides up-to-date information which enables the design and implementation of better security measures and mitigation strategies. Organisations gather data from different sources either internal or external to the organisation, which are analysed, resulting in CTI. Nevertheless, the gathered data usually contain a large amount of content that is irrelevant to CTI or even to cybersecurity. Furthermore, most approaches concerning CTI management (e.g., gathering, analysis) involve simply gathering and storing the information without any enrichment such as classification or correlation. However, in order to obtain the optimal results, organisations should be able to utilise all capabilities of CTI. Therefore, in this work, we propose ThreatWise AI, a novel framework which enables the gathering, analysis, enrichment, storing and sharing of CTI in an efficient and secure manner. In particular, we have developed a novel pipeline in ThreatWise AI which incorporates different advanced tools, with distinct capabilities that interact with each other to provide a complete set of functionalities for the administration of the overall CTI lifecycle. The developed tools integrate various Python scripts and provide gathering and analysis functionalities of CTI. Furthermore, the proposed framework leverages the MISP platform for storing, enriching and sharing while it also integrates Artificial Intelligence (AI) and Machine Learning (ML) algorithms for advanced data enrichment.

Given the increasing occurrence of deviant activities in online platforms, it is of paramount importance to develop methods and tools that allow in-depth analysis and understanding to then develop effective countermeasures. This work proposes a framework towards detecting statistically significant change points in terrorism-related time series, which may indicate the occurrence of events to be paid attention to. These change points may reflect changes in the attitude towards and/or engagement with terrorism-related activities and events, possibly signifying, for instance, an escalation in the radicalization process. In particular, the proposed framework involves: (i) classification of online textual data as terrorism- and hate speech-related, which can be considered as indicators of a potential criminal or terrorist activity; and (ii) change point analysis in the time series generated by these data. The use of change point detection (CPD) algorithms in the produced time series of the aforementioned indicators—either in a univariate or two-dimensional case—can lead to the estimation of statistically significant changes in their structural behavior at certain time locations. To evaluate the proposed framework, we apply it on a publicly available dataset related to jihadist forums. Finally, topic detection on the estimated change points is implemented to further assess its effectiveness.

This work presents a framework for predicting the likelihood of terrorist incidents within a specific time period in a target country based on machine learning and deep learning models. These models are trained on localised news data sourced from the Global Event, Language, and Tone Database (GDELT) Project for the target country, while the terrorist incidents recorded in the Global Terrorist (GTD) Database serve as the ground-truth. To cope with the massive volume of information acquired from localised news, a novel feature selection process based on Random Forest models is proposed, where the predictive power of each feature is calculated and only features estimated to have sufficient predictive power are subsequently considered. Experiments are performed by considering the United Kingdom as a case study and six predictive models are evaluated across four evaluation metrics. The experimental evaluation results indicate that the proposed framework enhances the predictive power of both machine learning and deep learning models that use the proposed feature selection in forecasting the likelihood of terrorist incidents, surpassing models trained (i) on all baseline features and (ii) on features selected by two well established feature selection approaches. Overall, the proposed framework aims at assisting counter-terrorism efforts by providing a projection of the likelihood of such terrorist incidents and thus the overall terrorism risk in a target country, using the most valuable features provided by GDELT.