CRITiCaL - Combatting cRiminals In The CLoud

云是一种新兴技术，它提供了对计算能力、数据存储、软件和服务的民主访问，通常只需要少量的按次付费。像任何一项新技术一样，云技术具有巨大的潜力，但如果落入坏人之手，可能会助长犯罪活动。在这个项目中，我们试图了解在云中可能发生的不同类型的犯罪，建立能够检测这种犯罪行为的系统，并使使用数字证据能够成功起诉云犯罪犯罪者。为了实现这一目标，我们正在组建一个真正的跨学科研究中心，充分利用达勒姆大学和纽卡斯尔大学的优势。将达勒姆大学在犯罪学、法律和伦理学方面的优势与纽卡斯尔大学在（计算机）系统安全、人工智能、数据挖掘和心理学领域的优势结合在一起。我们深信，只有这样一个真正的跨学科中心才能发现和处理云犯罪。这样一个中心将积极为犯罪侦查中成功的计算方法创造研究基础，并结合良好的用户参与，产生可以跨学科并直接为公共政策、警察和起诉实践提供信息的研究，并改变公众对云犯罪的理解。这将涉及对可以在云上进行的犯罪的真正理解的发展。通过开发定义犯罪行为活动的云犯罪脚本来促进，这将有助于不同学科之间的讨论，并且必须以我们的主要利益相关者（云提供商/用户/开发人员、执法机构和刑事司法系统）可以理解的格式呈现。在云中检测犯罪活动需要集成异构传感器、聚合和分析技术，我们利用现有的云安全保证（Gross， IBM）、主机监控和异常检测Ben-ware （McGough, Wall， DSTL）、非结构化数据模糊搜索、入侵检测和分析（Nifty, Yan）方面的专业知识。我们建议将系统专业知识与人工智能中的互补技术相结合，包括数据挖掘（McGough），行为机器学习，异常检测（Ploetz）以及分层机器学习和知识提取（Bacardit）。该组合提供了多种方法来派生和组合情报、呈现定制可视化、态势感知、语法或云犯罪脚本的语言生成。因此，该中心可以根据特定的利益相关者的需求定制情报及其呈现方式。我们建议使用额外的人工计算和众包技术来减少系统错误识别犯罪行为的情况。人工计算和众包的使用也将使我们能够磨练机器学习系统，开发一套混合技术，这些技术将共同改善云犯罪检测，但将以支持随后的皇家起诉程序的方式构建结果。后一项成就将需要犯罪学、法医学、法律和道德等学科的专业知识，并需要与英国各地的警察部队和欺诈行动合作。此外，我们将围绕以下方面引入相关工作：(1)法医心理学（Oxburgh），为证人、受害者和调查人员提供案件敏感型访谈和调查程序；（ii）确保提交法庭的证据不受情报收集方法影响的起诉程序；（iii）防止漏报云犯罪并提高公众的理解和信心。

The Cloud is an emerging technology that offers democratic access to computing power, data storage, software and services often for a small pay-per-use cost. Like any new technology the Cloud has potential for great good, but in the wrong hands can facilitate criminal activity. Within this project we seek to understand the different types of crime that can happen in the Cloud, build systems that will allow the detection of this criminal behaviour and enable the use of digital evidence to lead to successful prosecution of Cloud crime perpetrators.In order to achieve this goal we are forming a truly inter-disciplinary research centre leveraging the strengths of both Durham and Newcastle Universities. Bringing together the strengths of Durham in criminology, law and ethics along with the strengths of Newcastle in the areas of (computer) systems security, artificial intelligence, data mining and psychology. We are convinced that Cloud crime can only be detected and tackled by such a truly inter-disciplinary centre. Such a centre will actively create the research foundations for successful computational methods in crime detection combined with good user engagement, generating research that can cross disciplines and directly inform public policy, police and prosecution practices and transform public understanding of Cloud crime. This will involve development of a true understanding of what crime can be conducted on the Cloud. Facilitated through the development of cloud crime scripts, defining the activities of a criminal act, which will aid discussion between the different disciplines and must be presentable in a format understandable by our key stakeholders: Cloud providers/users/developers, law enforcement agencies and the criminal justice system.The detection of criminal activity in the cloud requires the integration of heterogeneous sensors, aggregation and analysis techniques, where we draw upon existing expertise in cloud security assurance (Gross, IBM), host monitoring and anomaly detection Ben-ware (McGough, Wall, DSTL), and fuzzy search on unstructured data, intrusion detection and analysis (Nifty, Yan). We propose combining the systems expertise with complementary techniques in artificial intelligence, including data mining (McGough), behaviour machine learning, anomaly detection (Ploetz) and hierarchical machine learning and knowledge extraction (Bacardit).This portfolio gives raise to multiple means to derive and combine intelligence, present bespoke visualizations, situational awareness, grammar or language generation for the cloud crime scripts. Thus allowing the centre to tailor the intelligence, and its presentation, to a given stakeholders needs. We propose using additional human computation and crowd sourcing techniques to reduce the number of situations where the system incorrectly identifies a criminal act. The use of human computation and crowd sourcing will also allow us to hone the machine learning system, developing a suite of hybrid techniques that, together, will improve cloud crime detection but will frame the results in such a way as to support subsequent crown prosecution processes. This latter achievement will require expertise in the disciplines of criminology, forensic sciences, law and ethics and will require collaboration with police forces throughout the UK and Action Fraud. In addition we will bring in relevant work around (i) forensic psychology (Oxburgh) that will deliver case-sensitive interview and investigative procedures for witnesses, victims and investigators; (ii) prosecution procedures that will ensure that evidence going to court is not compromised by intelligence gathering methodologies and (iii) prevention of underreporting of Cloud crime and improvement of public understanding and confidence.