Fuzzy based binary feature profiling for modus operandi analysis

32 Pages·2016·1.52 MB·English

Fuzzy based binary feature profiling for
modus operandi analysis
MahawagaArachchigePathumChamikara1,2, AkalankaGalappaththi1,
RoshanDharshanaYapa1,2, RuwanDharshanaNawarathna1,2,
SalukaRanasingheKodituwakku1,2, JagathGunatilake1,2,
AththanapolaArachchilageChathraneeAnumithaJayathilake2 and
LiwanLiyanage3
1PostgraduateInstituteofScience(PGIS),UniversityofPeradeniya,Peradeniya,SriLanka
2FacultyofScience,UniversityofPeradeniya,Peradeniya,SriLanka
3SchoolofComputing,EngineeringandMathematics,UniversityofWesternSydney,WesternSydney,
NSW,Australia
ABSTRACT
It is a well-known fact that some criminals follow perpetual methods of operations
known as modi operandi. Modus operandi is a commonly used term to describe
the habits in committing crimes. These modi operandi are used in relating criminals
to crimes for which the suspects have not yet been recognized. This paper presents
the design, implementation and evaluation of a new method to find connections
betweencrimesandcriminalsusingmodioperandi.Themethodinvolvesgeneratinga
featurematrixforaparticularcriminalbasedontheflowofeventsofhis/herprevious
convictions. Then, based on the feature matrix, two representative modi operandi
are generated: complete modus operandi and dynamic modus operandi. These two
representativemodioperandiarecomparedwiththeflowofeventsofthecrimeathand,
in order to generate two other outputs: completeness probability (CP) and deviation
probability(DP).CPandDPareusedasinputstoafuzzyinferencesystemtogeneratea
scorewhichisusedinprovidingameasurementforthesimilaritybetweenthesuspect
and the crime at hand. The method was evaluated using actual crime data and ten
Submitted21November2015 otheropendatasets.Inaddition,comparisonwithnineotherclassificationalgorithms
Accepted 12May2016 showedthattheproposedmethodperformscompetitivelywithotherrelatedmethods
Published13June2016
provingthattheperformanceofthenewmethodisatanacceptablelevel.
Correspondingauthor
MahawagaArachchige
PathumChamikara,
SubjectsAlgorithmsandAnalysisofAlgorithms,ArtificialIntelligence,DataMiningand
[email protected]
MachineLearning
Academiceditor Keywords Modusoperandianalysis,Fuzzyinferencesystems,Binaryfeatureanalysis,
SebastianVentura Classification,Associationrulemining
AdditionalInformationand
Declarationscanbefoundon
INTRODUCTION
page27
DOI10.7717/peerj-cs.65 Scientists have long played a role in examining deviant behavior in society. ‘‘Deviance
behaviour’’ is a term used by scientists to refer to some form of ‘‘rule-breaking’’
Copyright
2016Chamikaraetal. behaviour (Holdaway, 1993). It can be the behaviour of violating a social norm or the
Distributedunder law.Criminalbehaviourisalsoaformofdeviance,onethatisdefinedasthebreakingof
CreativeCommonsCC-BY4.0 legalrules.Nevertheless,thereisadifferencebetweendevianceandcrime.Devianceinvolves
breaking a norm and evoking a negative reaction from others. Crime is a deviance that
OPENACCESS
HowtocitethisarticleChamikaraetal.(2016),Fuzzybasedbinaryfeatureprofilingformodusoperandianalysis.PeerJComput.Sci.
2:e65;DOI10.7717/peerj-cs.65
breaksalaw,whichisanormstipulatedandenforcedbygovernmentbodies(Holdaway,
1993). However, crimes negatively affect society. Therefore, law enforcement authorities
takenecessaryactionstomitigatecrimesinanenvironmentwherehighcrimefrequencies
areobservedeachyear.Inthisexercise,theapplicationoftechnologyforcrimeanalysisis
being widened in the world. Locard’s exchange principle states that every contact of the
perpetratorsofacrimesceneleavesatrace.Theperpetratorswillbothbringsomethinginto
thesceneandleavewithsomethingfromthescene(Chisum&Turvey,2000).However,the
cognitiveabilitiesofcriminalswillalwaysmakethemminimizetheirrisksofapprehension
byconductingtheperfectcrimeandmaximizingtheirgain(Paternoster&Bachman,2001).
Modusoperandiormethodofoperationsuchaspreparationactions,crimemethodsand
weaponsarefrequentlyusedincriminalprofilingbecausethepastcrimetrendsshowthat,
aftercriminalsgetusedtoacertainmethodofoperation,theytrytousethesamemodus
operandiincommittinghis/hernextcrime(Palmiotto,1988).
Thecriminalsdevelopasetofactionsduringtheperformanceofaseriesofcrimeswhich
werefertoas‘‘modusoperandi’’(MO).MOisdevelopedwiththecrimeshe/shecommits
and the nature of trying to stick with the developed MO that has worked throughout
the previous crimes (Douglas&Douglas, 2006). In any criminal career, the MO happens
to evolve, no matter what the circumstances. Also, it is a common behaviour that serial
offenders tend to exhibit significant behaviour known as his/her signature. Therefore,
MOsofcriminalsplayamajorroleininvestigatingcrimes(Douglas&Douglas,2006).It
isaknownfactthatfeaturessuchascriminalsignatureandphysicalappearanceareused
incrimeinvestigationsinalmostallthepolicedepartmentsaroundthe world.SriLanka
police also use MOs of criminals to identify the suspects who have conducted crimes.
Currently Sri Lanka Police use a manual crime recording and investigation system. This
manual system has many problems such as data redundancy, inefficiency, tediousness,
inability to support crime investigation and many other problems which are associated
withaconventionalmanualsystem.Toovercometheseproblems,aweb-basedframework
was proposed with geographical information support containing a centralized database
for crime data storage and retrieval, named SL-CIDSS: Sri Lanka Crime Investigation
Decision Support System (Chamikaraetal., 2015). The proposed system accompanies a
collection of data mining algorithms which effectively support the crime investigation
process.Fuzzybasedbinaryfeatureprofiling(BFPM)formodusoperandianalysisisone
novelalgorithmwhichisintegratedwiththesystemtoprovideaneffectivewaytofindthe
similaritybetweencrimesandcriminals.
AccordingtothepenalcodeofSriLankafirstenactedin1882andamendedsubsequently
several times in later years (The‘LectricLawLibrary, 0000), Sri Lanka police classifies
crimes into two categories: Grave crimes and Minor offences. Until 2014, grave crimes
wereclassifiedunder21crimecategoriesandin2015another5newcrimecategorieswere
introduced,makingit26categoriesofgravecrimetypes.Kidnapping,Fraudormischief
causingdamagegreaterthan25,000rupees,Burglary,Grievoushurt,Hurtbysharpweapon,
Homicide,Rape,Robbery,Cheatingbytrust,Theftare10ofthemostfrequentcrimetypes.
Toidentifythepatternsinvolvedincrimes,acollectionofsubtypeswereidentifiedunder
these26crimetypes.Thesesubtypeshavebeencreatedmainlyforthepurposeofmodus
Chamikaraetal. (2016),PeerJComput.Sci.,DOI10.7717/peerj-cs.65 2/32
Figure1 Relationshipbetweenmaincrimetype,subtypesandcrimeflows.
operandi analysis. Most frequent behaviors of criminals/crimes are considered as crime
subtypes.WhenacrimeisloggedintheGraveCrimeRecord(GCR)book,itisclassified
under one of the 26 main categories. But, under the section of ‘‘nature of crime’’ in the
GCRbook,thepoliceofficersrecordtheflowofthecrimeincidentincludingthesubtypes.
Asubtypeisasubcategoryofoneofthemaincrimetypes.Forinvestigation,thenature
ofthecrimeisbrokenintosubtypesandflowsaccordingtotheirfrequencyofoccurrence
anduniqueness.Thesesubcategorizationshavebeenintroducedmainlytominimizethe
broadness of main type and to improve clarity. Figure 1 depicts the relationship of the
subtypesandflowswheretherecanbeaflowofeventstoacrimerecordedasoneofthe
26maincrimetypes.Forthesimplicityandeasyhandlingofdata,theinvestigatorshave
provided subtype codes and flow codes. The flow of events provides a modus operandi
whichismostofthetimeuniquetoanoffender.Eachsubtypeisprovidedwithacodeunder
the main type, to make the crime investigation process easier. For example, ROB/S001
denotesasubtypethatisHighwayrobbery;hereROBdenotesthemaintypeunderwhich
the corresponding subtype appears. In this case, it is Robbery. Crime types are further
subdivided into sub types to make the analysis and processing simpler. In this manner,
crimesubtypesandflowshavebeenidentifiedunderallthe26crimetypes.Thespacefor
addingmoresubtypesandflowsunderthesecrimetypesexists.Anewsubtypeoraflowis
introducedtoaparticularmaincrime,ifthesamesubtypeortheflowhappenstopersist
foraprolongedtime.
This paper proposes a novel method of criminal profiling using modus operandi
which can be used to identify associations between crimes and criminals. The method
is based on a new technique named, ‘‘binary feature vector profiling.’’ Key relationships
betweenacriminalandthepreviousconvictionsareanalyzedusingbinaryfeatureprofiling
andassociationruleminingtechniques.Duetotheimprecisenessandvaguenessofthese
extractedattributes,afuzzyinferencesystemisusedinmakingthefinaldecision.Thenewly
proposedmethodwasadaptedintoaclassificationalgorithminordertotestitsaccuracy.
Anactualcrimedatasetwasusedintestingtheperformanceofthenewlyproposedmethod
anditwascomparedagainstninewell-establishedclassificationalgorithmsusingtenopen
data sets. The results confirmed that the proposed method produce competitive results
comparedtotheothernineclassificationalgorithms.
Chamikaraetal. (2016),PeerJComput.Sci.,DOI10.7717/peerj-cs.65 3/32
The rest of the paper is organized as follows. The Related work section presents a
summary of the work that has been conducted on modus operandi analysis as well as
a brief discussion on crime investigation using link analysis and association mining in
general.TheMaterialsandMethodssectiondiscussesthemainstepsofthenewlyproposed
algorithm.Next,theResultsandDiscussionsectionprovidesavalidationandperformance
evaluationofthenewlyproposedmethodalongwithaperformancecomparisonwithnine
otherclassificationalgorithms.Finally,someconcludingremarksandfutureenhancements
areoutlinedintheConclusionsection.
Related work
Literature shows many methods which have been developed in the area of automated
crime investigation. Our major concern has been laid upon the research carried out on
crime investigation using association mining as our research considers on developing
a model to find the associations between the criminals and the crimes depending on
the modes operandi. Bennell&Canter (2002) have proposed a method to use statistical
modelstotestdirectlythepolicepracticeofutilizingmodusoperanditolinkcrimestoa
commonoffender.Theresultsindicatedthatcertainfeaturessuchasthedistancebetween
burglarylocations,leadtohighlevelsofpredictiveaccuracy.Bennell&Jones(2005)have
triedtodetermineifreadilyavailableinformationaboutcommercialandresidentialserial
burglaries,intheformoftheoffender’smodusoperandi,providesastatisticallysignificant
basis for accurately linking crimes committed by the same offenders. Leclerc,Proulx
&Beauregard (2009) have reviewed the theoretical, empirical, and practical implications
relatedtothemodusoperandiofsexualoffendersagainstchildren.Theyhavepresentedthe
rationalchoiceperspectiveincriminologyfollowedbydescriptivestudiesaimedspecifically
atprovidinginformationonmodusoperandiofsexualoffendersagainstchildren.
Clustering crimes, finding links between crimes, profiling offenders and criminal
networkdetectionaresomeofthecommonareaswheredataminingisappliedincrime
analysis (Oatley&Ewwart, 2011; King&Sutton, 2013; Borgetal., 2014). Association
analysis,classificationandprediction,clusteranalysis,andoutlieranalysisaresomeofthe
traditional data mining techniques which can be used to identify patterns in structured
data. Offender profiling is a methodology which is used in profiling unknown criminals
or offenders. The purpose of offender profiling is to identify the socio-demographic
characteristicsofanoffenderbasedoninformationavailableatthecrimescene(Mokros&
Alison,2002;Canteretal.,2013).Associationruleminingdiscoverstheitemsindatabases
whichoccurfrequentlyandpresentthemasrules.Sincethismethodisoftenusedinmarket
basketanalysistofindwhichproductsareboughtwithwhatotherproducts,itcanalsobe
usedtofindassociatedcrimesconductedwithwhatothercrimes.Here,therulesaremainly
evaluatedbythetwoprobabilitymeasures,supportandconfidence(Agrawal,Imielinkski
&Swami, 1993; Yietal., 2015). Association rule mining can also be used to identify the
environmental factors that affect crimes using the geographical references (Koperski&
Han,1995).Incidentassociationminingandentityassociationminingaretwoapplications
of association rule mining. Incident association mining can be used to find the crimes
committedbythesameoffenderandthentheunresolvedcrimescanbelinkedtofindthe
Chamikaraetal. (2016),PeerJComput.Sci.,DOI10.7717/peerj-cs.65 4/32
offenderwhocommittedthem.Therefore,thistechniqueisnormallyusedtosolveserial
crimeslikeserialsexualoffensesandserialhomicides(Chen,2006).
Similarity-based association mining and outlier-based association mining are two
approaches used in incident association mining. Similarity-based association mining is
used mainly to compare the features of a crime with the criminal’s behavioral patterns
whicharereferredasmodusoperandiorbehavioralsignature.Inoutlier-basedassociation
mining,crimeassociationswillbecreatedonthefactthatboththecrimeandthecriminal
havethepossibilityofhavingsomedistinctivefeatureoradeviantbehavior(Lin&Brown,
2006).Entityassociationmining/linkanalysisisthetaskoffindingandchartingassociations
betweencrimeentitiessuchaspersons,weapons,andorganizations.Thepurposeofthis
technique is to find out how crime entities that appear to be unrelated at the surface,
are actually linked to each other (Chen, 2006). Link analysis is also used as one of the
mostapplicablemethodsinsocialnetworkanalysis(Berry&Linoff,2011)infindingcrime
groups,gatekeepersandleaders(Chenetal.,2003).
Attribution can be used to link crimes to offenders. If two offences in different places
involvethesamespecifictype,thosemaybereadilyattributedtothesameoffender(Oatley
&Ewwart,2011).Therearethreetypesoflinkanalysisapproaches,namelyHeuristic-based,
Statistical-based and Template-based (Chen, 2006). Sequential pattern mining is also a
similartechniquetoassociationrulemining.Thismethoddiscoversfrequentlyoccurring
itemsfromasetoftransactionsoccurredatdifferenttimes(Chenetal.,2014).Deviation
detectiondetectsdatathatdeviatessignificantlyfromtherestofthedatawhichisanalyzed.
This is also called outlier detection, and is used in fraud detection (Chenetal., 2014;
Capozzoli,Lauro&Khan,2015).
In classification, the data points will be assigned to a set of predefined classes of data
by identifying a set of common properties among them. This technique is often used to
predictcrimetrends.Classificationneedsareasonablycompletesetoftrainingandtesting
datasinceahighdegreeofmissingdatawouldlimitthepredictionaccuracy(Chenetal.,
2014). Classification comes under supervised learning method (Chen, 2006; Chikersal,
Poria&Cambria,2015)whichincludesmethodssuchasBayesianmodels,decisiontrees,
artificial neural networks (Chen, 1995) and support vector machines. String comparison
techniquesareusedtodetectthesimilaritybetweentherecords.Classificationalgorithms
comparethedatabaserecordpairsanddeterminethesimilarityamongthem.Thisconcept
canbeusedtoavoiddeceptiveoffenderprofiles.Informationofoffenderssuchasname,
address,etc.mightbedeceptiveandthereforethecrimedatabasemightcontainmultiple
recordsofthesameoffender.Thismakestheprocessofidentificationoftheirtrueidentity
difficult(Chenetal.,2014).
SYSTEMS AND METHODS
This section provides a description about the systems and methods used in developing
the fuzzy based binary feature profiling for modus operandi analysis. First, an overview
abouthowSL-CIDSScapturesthelogicsofmodusoperandiisexplained.Thenadetailed
descriptionaboutthestepsofthenewlyproposedalgorithmisexplained.
Chamikaraetal. (2016),PeerJComput.Sci.,DOI10.7717/peerj-cs.65 5/32
Figure2 CrimeflowentityarrangementinSL-CIDSS.
Figure 2 shows how SL-CIDSS database captures the crime types and subtypes. A
crime record has a crime record flow. Typically, a crime is committed by a criminal and
a particular accused might commit one or more crimes. A CRIME RECORD can be of
onethe26crimetypes.AparticularCRIMERECORDwillbeconsideredunderonemain
CRIMETYPEwiththehighestprecedenceintheorderofseriousness.Forexample,acrime
incident that includes a murder and a robbery will be categorized as a murder though a
robberyhasalsotakenplace.Butinthenatureofcrimesection,allcrimesfollowedbythe
main type will be stated. Therefore, the CRIME RECORD FLOW captures all the steps
of the crime as a sequence of steps recorded. The crime flows that have been previously
registeredaremappedunderCRIMEFLOWCODE.Also,aparticularCRIMERECORD
instancecancontainmultipleSUBTYPESwhicharerecordedasCRIMESUBTYPE.The
SPECIALCATEGORYcapturesthecrimeswithspecialfeaturessuchascrimesoccurring
atthesamelocationorretailshop.Acrimemayinvolveseveralspecialcategorieswhichare
savedintheCRIMESPECIALCATEGORY.TheACCUSEDentityrecordstheinformation
ofsuspectsandaccusedandtheyarerelatedtocrimethroughtheCRIMESUSPECTentity.
Asthefirststepofthenewlyemployedmethod,afeaturematrixisgenerated,resulting
in a binary matrix representing the crime flows. This binary feature matrix is composed
ofthebinarypatternsgeneratedonpreviousconvictionsofaparticularcriminal/suspect.
This binary form of the feature matrix provides a provision to direct application of
computer algorithms with methods such as Apriori based association rule mining. The
reducedcomplexityofthebinaryfeaturematricesprovidesaneasymanipulationoverthe
categoricalandcontinuousvaluedfeatures.Figure3showsthestepsoftheproposedMO
analysisalgorithm.
Chamikaraetal. (2016),PeerJComput.Sci.,DOI10.7717/peerj-cs.65 6/32
Figure3 Stepsofthenewlyemployedalgorithm.
Generating the feature matrix
Table1showshowthefeaturevectorsaregeneratedandprovidesthewaytogeneratemodi
operandiofcriminalsasbinarysequences.Accordingtothetable,eventsofthecrimescene
are observed starting from its crime type. After a particular crime type is identified, the
feature vectors are updated with ones for each subtype and flow code that is available in
thecrimeorsuspect’smodusoperandi.Thevectorswillbefilledbyzerosinplaceswhich
the modus operandi does not have any contact with. The column names to the feature
matrix are generated in such a way that it covers the collection of main types, sub types,
crime flows and special categories at hand. For example, if we consider the list of crime
types,subtypes,crimeflowsandthespecialcategoryinTable1,itresultsin21-bitfeature
vectorsasshowninthelasttwocolumns.
InthismannerwecanproducebinaryMOpatternsbasedonthecrimescommittedby
differentcriminalsasshowninthelasttwocolumnsofTable1.AccordingtoTable1,Sus-
pect1hascommittedarobberywiththesubtypes,ABD/S003(anabductionofachildfrom
the legal guardian), ROB/S001 (an organized vehicle robbery) and the flows, ROB/F001
(Identity cards have been shown), ROB/F003 (accused has been wearing uniforms).
Suspect 2 has committed a house breaking with the sub type BGL/S004 (use of stealth),
andtheflows,BGL/F001(Enteringfromthewindow),BGL/F003(RemovingGrills).
Table 2 shows a feature matrix of binary patterns which is generated by considering
the previous convictions of suspect 1 assuming that he has conducted another robbery
(conviction2).ct,st,fl andsc inTable2representtheabbreviationsfor‘‘crimetype,’’‘‘sub
type,’’‘‘crimeflow’’and‘‘specialcategory’’respectively.
Generating the dynamic MOs (DMOs) of the criminals
Dynamic MO is a binary feature vector which is generated on bit patterns of the feature
matrixofaparticularcriminal.ThemainpurposeoftheDMOistoobtainacriminalspecific
crimeflowwhichcapturesthecrimepatternswhicharefrequentlyfollowedbyaparticular
criminal.Itisnamedasthedynamicmodusoperandiasitissubjecttochangewhenthenew
crimeflowsareaddedtothefeaturematrix.Therefore,thisaddressesthechangingnature
Chamikaraetal. (2016),PeerJComput.Sci.,DOI10.7717/peerj-cs.65 7/32
Table1 Aninstanceoffeatureselectionforthefeaturematrixgeneration.
MainSemantic Crimeflow Description Suspect1 Suspect2
elementcode
Crimetypes HB HouseBreaking 0 1
HK HurtbyKnife 0 0
RB Robbery 1 0
TH Theft 0 0
Subtypes ABD/S003 Abductionfromthelegalguardian 1 0
ABD/S004 Abductingtomarry 0 0
ABD/S005 Abductingforsexualharassment 0 0
BGL/S004 Useofstealth 0 1
BGL/S011 Burglaryinbusinessplaces 0 0
ROB/S001 Organizedvehiclerobbery 1 0
Crimeflows BGL/F001 Enteringfromthewindow 0 1
BGL/F002 EnteringfromtheFanlights 0 0
BGL/F003 Removinggrills 0 1
BGL/F004 Breakingglasses 0 0
ROB/F001 Showingidentitycards 1 0
ROB/F003 Wearinguniforms 1 0
ROB/F004 Robberyusingidentitycards, 0 0
uniformsandchains
ROB/F009 Seizinginmates 0 0
ROB/F010 AppearingasCIDofficers 0 0
Specialcategory Retailer1 Attacking/robbingretailer1’s 0 0
stores
Retailer2 Attacking/robbingretailer2’s 0 0
stores
ofthepatternsusedbythecriminalsincommittingcrimes.First,afrequencythresholdis
generatedusingcharacteristicfeaturesofthefeaturematrixathandwhichisthematrixofall
crimescommittedbythesamecriminalunderconsideration.ThematrixshowninTable3
is an example to a situation of a feature matrix generated on the previous convictions
ofacriminal.Forthesakeofsimplicity,let’sconsiderafeaturematrixof10columns.
IfweconsiderA–JofTable3ascrimeflowfeaturesofthecorrespondingMOs,wecan
understandthatinthefirstMOthecriminalhasfollowedacrimeflowofA-E-F-G-I.The
samecriminalhasfollowedacrimeflowofA-D-F-G-Iinhissecondcrime.Likewisethe
othertwocrimeflowsare,A-E-F-H-IandA-D-F-G-H-Irespectively.
TheDMOofaparticularcriminalisgeneratedusingtheApriorimethod(Adamo,2001).
Apriorimethodisusedtofindthecrimeentitieswiththefrequencythreshold(frt)which
isgeneratedaccordingtoEq.(2).AdemonstrationofthegenerationofDinEq.(1)onthe
propertiesoffeaturematrixisshowninTable4.
(cid:40) (cid:12) (cid:41)
(cid:12) (cid:88)n
D= d(cid:12)d= y (1)
(cid:12) i
(cid:12)
i=1
frt =M /n (2)
D
Chamikaraetal. (2016),PeerJComput.Sci.,DOI10.7717/peerj-cs.65 8/32
C
h
a
m
ik
a
r
a
e
t
a
l.
(2
0
1
6
),
P
e
e
r
J
C
o
m
p
u
t.
S
c
i.,
D
O
I
1
0
.7
7
1
7
/p
e Table2 FeaturematrixforSuspect1,generatedusingtheselectedmodusoperandiattributesinTable1.
e
r
j-c
s ct1 ct2 ct3 ct4 st1 st2 st3 st4 st5 st6 fl1 fl2 fl3 fl4 fl5 fl6 fl7 fl8 fl9 sc1 sc2
.6
5 Conviction1 0 0 1 0 1 0 0 0 0 1 0 0 0 0 1 1 0 0 0 0 0
Conviction2 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0
9
/3
2
Table3 Featurematrixgeneratedonfourpreviousconvictionsofacriminal.
A B C D E F G H I J
1 0 0 0 1 1 1 0 1 0
1 0 0 1 0 1 1 0 1 0
1 0 0 0 1 1 0 1 1 0
1 0 0 1 0 1 1 1 1 0
Table4 Column-wiseadditionofthefeaturematrixofthesuspectunderconsideration.
where, D= vector of distinct column frequencies of the feature matrix. y = cells in
i
each column, M = Median of D, n=(cid:80)f = number of values or total frequencies, c=
D
cumulativefrequencyofthemedianclass,h=classintervalsize.
The column-wise addition of the matrix shown in Table 4 gives 4, 0, 0, 2, 2, 4, 3, 2,
4 and 0. The distinct numbers are selected from the resulting vector which results in
D= [0, 2,3, 4].ThemedianofDisthendividedbythenumberofinstances(rows)inthe
matrixasthefrt,whichis2.5/4=0.625fortheabovecase.Therefore,frtwillrangefrom
0 to 1. This value provides an insight to a fair threshold value for the Apriori method to
generatethedynamicmodusoperandiwiththemostfrequentelements.frtisusedasthe
frequencythresholdinfindingthelengthiestMOwithaprobabilityof0.625becausethis
valuesuggeststhatthereisamoderatepossibilityofonefeaturehaving0.625probabilityin
eachofMO.Thisresultsinadynamicmodusoperandi(DMO)asshowninEq.(4),because
theonlytransactionofcrimeattributeswhichprovidesasupportof0.625isσ(A,F,G,I)
asshowninEq.(3).
σ(A,F,G,I) 3
s= = =0.75 (3)
|T| 4
DMO=[1000011010]. (4)
Generating the complete MO profile (CMOP) of the criminals
The complete MO profile (CMOP) is obtained by the OR operation between the bits of
eachcolumnof thefeaturematrixof thecorrespondingcriminal.CMOPguarantees the
provisionofacompositecrimeflowbyconsideringallofthepreviouscrimeflowentities
ofaparticularcriminal.Forexample,thecompleteprofileforthefeaturematrixshownin
Table3isobtainedasshowninTable5.
Therefore,CMOP=[1001111110].CMOPcontains1sforeachplaceforwhicha
particularcrimeflowentityhastakenplaceatleastonce.
Chamikaraetal. (2016),PeerJComput.Sci.,DOI10.7717/peerj-cs.65 10/32