7/28/2019 Strategies to Disrupt Online Child Pornography Networks

1/41

K I L A J O F F R E S , M A R T I N B O U C H A R D ,

R I C H A R D F R A N K , B R Y C E W E S T L A K E

S I M O N F R A S E R U N I V E R S I T Y

Strategies to Disrupt Online

Child Pornography Networks

Partially supported by the International Cybercrime Research Centre, SFU

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

2/41

Study Objectives

To use a specially designed Web-crawler to extractonline child pornography networks

To determine which attack strategies are most

effective at disrupting these networks Strategies include: hub, bridge, and fragmentation attacks.

Measures of disruption include: density, clustering,compactness, and average path length.

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

3/41

Motivation

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

4/41

Child Pornography and the Web

The web has facilitated the distribution of and accessto child pornography through its

Apparent anonymity,

Global reach, and

Lack of regulation

The United Nations estimated that there are over 4million websites with child pornography

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

5/41

Online Intervention Strategies

Current attempts to limit child exploitation haveoften focused on: Chat room stings

Injunctions against websites hosting child pornography

Establishing hotlines and complaint sites, and image databases

There are two problems with this approach: Overreliance on investigating and targeting sites in isolation

Current enforcement efforts have been met with limited

success Social network analysis can produce a more effective

method of disrupting online child pornography sites

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

6/41

Online Intervention Strategies

Which node to attack?

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

7/41

Online Intervention Strategies

Which node to attack?

(IPv6 network, April 2008 -http://www.informationweek.com/galleries/showImage?galleryID=246&imageID=10&articleID=210600289)

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

8/41

The Topology of the Web

It is important to consider the topology of the Web

Online networks have two important structuralfeatures Power-law distribution (aka scale-free),

Small-world properties

The Web is distinguished by a few very highlyconnected nodes or hubs

The average path length within the Web ranges from16 to 19 It also has a higher degree of clustering than is expected from

random networks

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

9/41

Identifying Attack Strategies

Scale-free (power-law) networks are resilient torandom attacks but vulnerable to targeted attacks

for example, there are 13 root name servers in the Internet,take those out, domain names

Different attack strategies Hub attacks remove nodes with lots of links to and from

Bridge attacks remove nodes that broker (connect)

Fragmentation attack remove nodes such that it would severthe greatest number of connections in the network

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

10/41

Methods

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

11/41

Network Extraction

Takes as input a starting webpage

11

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

12/41

Network Extraction

Retrieve that page

12

Frequency

Boy 3Girl 5

Child 11Love 10Teen 12Lolli* 16

Young 11Bath* 5

Innocent 0Smooth/Hairless

20

Mastur* 6Sex 20

Penis 15Vagina 5

Anal 13Oral 0

Naked 10Virgin 14

Websites: 1 Pages: 1

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

13/41

Network Extraction

Retrieve one of the linked pages

13

Frequency

Boy 8Girl 4

Child 16Love 9Teen 3Lolli* 13

Young 0Bath* 20

Innocent 8Smooth/Hairless

1Mastur* 9Sex 15

Penis 1Vagina 9

Anal 12Oral 6

Naked 9Virgin 20

Websites: 2 Pages: 2

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

14/41

Network Extraction

Retrieve one of the linked pages

14

Frequency

Boy 0Girl 0

Child 0Love 0Teen 0Lolli* 0

Young 0Bath* 0

Innocent 0Smooth/Hairless

0Mastur* 0Sex 0

Penis 0Vagina 0

Anal 0Oral 0

Naked 0Virgin 0

Websites: 3 Pages: 3

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

15/41

Network Extraction

Retrieve one of the linked pages

15

www.microsoft.com

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

16/41

Network Extraction

Retrieve one of the linked pages

16

Websites: 3 Pages: 3

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

17/41

Network Extraction

Retrieve one of the pages

17

Websites: 3 Pages: 4

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

18/41

Network Extraction

Retrieve one of the pages until done

18

Websites: 3 Pages: 4

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

19/41

Network Extraction

Statistics are aggregated up to thewebsite level

19

Frequency

Boy 338Girl 1863

Child 1217Love 425Teen 1862Lolli* 833

Young 1506Bath* 1640

Innocent 1891Smooth/Hairless 959Mastur* 1486

Sex 997Penis 1221

Vagina 1610Anal 662Oral 1702

Naked 1244Virgin 166

Websites: 3 Pages: 10

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

20/41

Network Extraction

Result in anetworkAggregate to

Server Level

20

4 pages

3 pages3 pages

2 links

1 link

2 links

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

21/41

Methods

Three limits were imposed on CENE:

1. A limit of 250,000 webpages

2. A limit of 200 websites

3. Each webpage had to contain at least 7 of 63 childpornography-related keywords

Many of these keywords were:

commonly used by the Royal Canadian Mounted Police (RCMP)to locate illegal child-related content, and

used in our former studies of online child pornography

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

22/41

Methods

Limitations to CENE

False positives

Password protected websites

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

23/41

Methods

For this study, two networks were extracted usingdifferent starting websites

Network A

as identified as girl-centered

including mostly female-related terms such as vagina, Lolita, girl,and so on.

Network Bboy-centered

including mostly male-related terms as penis and boy.

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

24/41

Methods

The goal is to identify the most effective attackstrategies to disrupt online child pornographynetworks

Four attack strategies were assessed1. Hub attacks (using the measure of degree centrality)

2. Bridge attacks (using the measure of betweenness),

3. Fragmentation attacks (using the measure developed byBorgatti),

4. Random attacks (where each node has an equal chance ofbeing targeted)

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

25/41

Methods

The removal of websites identified by these attackstrategies followed a sequential process whichinvolved

1. identifying the website that scored highest for onemeasure,

2. removing it, and

3. reanalyzing the network to identify the next top website

This process was repeated until five websites wereeliminated

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

26/41

Methods

The impact of the attack strategies used was assessedon four outcome measures

Density

Clustering coefficient

Average path distance

Distance-based cohesion

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

27/41

Results

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

28/41

NETWORKDESCRIPTIVES

Network

Measure Network A Network B

Nodes 46 111

Ties 150 663

Density 0.0725 0.0543

Clustering Coefficient 0.442 0.424

Average Path Length 3.490 2.409

Distance-Based Cohesion 0.200 0.131

Centralization Out 19.852% 21.124%

In 13.037% 22.041%

Results

number of existing ties /number of possible ties

likelihood that twowebsites, which are linkedto one particular website,

are also linked to oneanother

extent to which a networkis compact (how close

websites are to each other)

overall degree of variance

in network centrality

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

29/41

NetworkMeasure Network A Network B

Density

(Change)

Ties Left Density

(Change)

Ties

Left

Fragmentation 0.0561

(22.62%)

92 0.0482

(11.233%)

537

Betweenness 0.0506

(30.207%)

83 0.0469

(13.627%)

522

Degree Out 0.0500

(31.034%) 82 0.0442(18.6%) 492

In 0.0506

(30.207%)

83 0.0455

(16.206%)

506

Random Attack 0.0732

(0.551%)

120 0.0541

(0.368%)

602

Results - Density

Possibly due to the differences in network size, with the removal of 5 nodeshaving a greater impact in the smaller Network A.

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

30/41

Results

Network A, before and after theout-degree attack

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

31/41

Results

Network B, before and after theout-degree attack

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

32/41

Network

Measure Network A Network B

Fragmentation 0.514 (16.289%) 0.430 (1.415%)

Betweenness 0.438 (0.09%) 0.426 (0.471%)

Degree Out 0.429 (2.941%) 0.422 (0.471%)

In 0.415 (6.108%) 0.434 (2.358%)

Random Attack 0.441 (0.226%) 0.432 (1.886%)

Results - Clustering Coefficient

- Certain attacks in thisnetwork actually increaseclustering

- suggests certain changes tothe network are prome toleaving it with more tightly-knit groups

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

33/41

Network

Measure Network A Network B

Fragmentation 0.093 (53.50%) 0.073 (44.27%)Betweenness 0.085 (57.50%) 0.075 (42.75%)

Degree Out 0.103 (48.50%) 0.082 (37.40%)

In 0.119 (40.50%) 0.085(35.11%)Random Attack 0.207 (3.50%) 0.129 (1.35%)

Results - Distance-Based Cohesion

Bridge attacks werevery successful

extent to which a network is compact (how close websites are to each other)

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

34/41

Measure Network A Network B

Fragmentation 1.852 (46.934%) 1.741 (27.729%)Betweenness 2.014 (42.292%) 1.812 (24.782%)

Degree Out 2.738 (21.547%) 1.980 (17.808%)

In 3.431 (1.69%) 2.049 (14.943%)

Random Attack 3.574 (2.406%) 2.414 (0.207%)

Results Average Path-Length

Network B was initially much less compact than Network A. Effect of attackmore easily seen.

1021

230

# of paths

859

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

35/41

Discussion & Conclusion

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

36/41

Discussion

The purpose of this paper was to isolate those attackstrategies (hub, bridge, fragmentation) that wouldmaximally disrupt two online child exploitationnetworks

Three general findings emerged:1. Targeted attacks are more effective than random ones

2. For different outcome measures (density, clustering,distance), different intervention strategies are warranted

3. For different networks, different attack strategies are more orless effective

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

37/41

Discussion

To reduce density and clustering hub attacks

To reduce network reachability fragmentation

To reduce network compactness fragmentation

In certain cases, the bridge attack was almost aseffective, and in one case more effective, than otherstrategies for Network A

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

38/41

Conclusion

This project has practical implications in terms of Focusing the effective use of police resources, and

Decreasing the accessibility of online child pornography.

Pairing the web-crawler with social network analyses Assists in target prioritization

Identifies websites that would maximally disrupt the network

Prioritizes targets

The current study provides methodologicalguidelines on which to base such decisions

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

39/41

Limitations

The inclusion of false positives

Limitations of CENE

# of pages # of websites

Failure to account for the content of the websites

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

40/41

Future Directions

Adopting longitudinal designs Tracking the way networks evolve when attacked and how they

recover from, or adapt more easily to, specific attacks

Modifying the Web-crawler to extract othernetworks, such as ones relating to terrorism, druguse, or other illegal behaviours

7/28/2019 Strategies to Disrupt Online Child Pornography Networks

41/41

K I L A J O F F R E S , M A R T I N B O U C H A R D ,

R I C H A R D F R A N K , B R Y C E W E S T L A K E

S I M O N F R A S E R U N I V E R S I T Y

Strategies to Disrupt Online

Child Pornography Networks

Thank you!