CRITiCaL - Combatting cRiminals In The CLoud

云计算是一种新兴技术，它提供了对计算能力、数据存储、软件和服务的民主访问，通常只需支付少量的按使用付费成本。像任何新技术一样，云计算具有巨大的潜力，但在错误的手中可能会促进犯罪活动。在这个项目中，我们试图了解可能发生在云中的不同类型的犯罪，构建能够检测这种犯罪行为的系统，并能够使用数字证据成功起诉云犯罪的肇事者。为了实现这一目标，我们正在利用达勒姆大学和纽卡斯尔大学的优势组建一个真正的跨学科研究中心。汇集了达勒姆在犯罪学，法律和道德沿着与纽卡斯尔在（计算机）系统安全，人工智能，数据挖掘和心理学领域的优势。我们相信，只有这样一个真正的跨学科中心才能发现和解决云犯罪。该中心将积极为成功的犯罪侦查计算方法创造研究基础，并结合良好的用户参与度，产生可以跨学科的研究，直接为公共政策，警察和检察实践提供信息，并改变公众对云犯罪的理解。这将涉及对可以在云上进行的犯罪的真正理解。通过云犯罪脚本的开发来促进，定义犯罪行为的活动，这将有助于不同学科之间的讨论，并且必须以我们的主要利益相关者可以理解的格式呈现：云提供商/用户/开发人员、执法机构和刑事司法系统。在云中检测犯罪活动需要集成异构传感器、聚合和分析技术，我们利用了云安全保证（Gross，IBM），主机监控和异常检测Ben-ware（McGough，Wall，DSTL）以及非结构化数据模糊搜索，入侵检测和分析（Nifty，Yan）方面的现有专业知识。我们建议将系统专业知识与人工智能中的互补技术相结合，包括数据挖掘（McGough），行为机器学习，异常检测（Ploetz）和分层机器学习和知识提取（Bacardit）。该组合提供了多种方法来获取和联合收割机智能，呈现定制的可视化，态势感知，语法或语言生成云犯罪脚本。从而使该中心能够根据特定利益攸关方的需要定制情报及其介绍。我们建议使用额外的人工计算和众包技术来减少系统错误识别犯罪行为的情况。人工计算和众包的使用也将使我们能够磨练机器学习系统，开发一套混合技术，这些技术将共同改善云犯罪检测，但将以支持后续皇家起诉流程的方式构建结果。后一项成就将需要犯罪学，法医学，法律和道德学科的专业知识，并需要与整个英国的警察部队和反欺诈行动合作。此外，我们还将围绕以下方面开展相关工作：（i）法医心理学（Oxburgh），为证人、受害者和调查人员提供对案件敏感的访谈和调查程序;（ii）起诉程序，确保提交法庭的证据不会受到情报收集方法的影响;（iii）防止漏报云犯罪，提高公众的理解和信心。

The Cloud is an emerging technology that offers democratic access to computing power, data storage, software and services often for a small pay-per-use cost. Like any new technology the Cloud has potential for great good, but in the wrong hands can facilitate criminal activity. Within this project we seek to understand the different types of crime that can happen in the Cloud, build systems that will allow the detection of this criminal behaviour and enable the use of digital evidence to lead to successful prosecution of Cloud crime perpetrators.In order to achieve this goal we are forming a truly inter-disciplinary research centre leveraging the strengths of both Durham and Newcastle Universities. Bringing together the strengths of Durham in criminology, law and ethics along with the strengths of Newcastle in the areas of (computer) systems security, artificial intelligence, data mining and psychology. We are convinced that Cloud crime can only be detected and tackled by such a truly inter-disciplinary centre. Such a centre will actively create the research foundations for successful computational methods in crime detection combined with good user engagement, generating research that can cross disciplines and directly inform public policy, police and prosecution practices and transform public understanding of Cloud crime. This will involve development of a true understanding of what crime can be conducted on the Cloud. Facilitated through the development of cloud crime scripts, defining the activities of a criminal act, which will aid discussion between the different disciplines and must be presentable in a format understandable by our key stakeholders: Cloud providers/users/developers, law enforcement agencies and the criminal justice system.The detection of criminal activity in the cloud requires the integration of heterogeneous sensors, aggregation and analysis techniques, where we draw upon existing expertise in cloud security assurance (Gross, IBM), host monitoring and anomaly detection Ben-ware (McGough, Wall, DSTL), and fuzzy search on unstructured data, intrusion detection and analysis (Nifty, Yan). We propose combining the systems expertise with complementary techniques in artificial intelligence, including data mining (McGough), behaviour machine learning, anomaly detection (Ploetz) and hierarchical machine learning and knowledge extraction (Bacardit).This portfolio gives raise to multiple means to derive and combine intelligence, present bespoke visualizations, situational awareness, grammar or language generation for the cloud crime scripts. Thus allowing the centre to tailor the intelligence, and its presentation, to a given stakeholders needs. We propose using additional human computation and crowd sourcing techniques to reduce the number of situations where the system incorrectly identifies a criminal act. The use of human computation and crowd sourcing will also allow us to hone the machine learning system, developing a suite of hybrid techniques that, together, will improve cloud crime detection but will frame the results in such a way as to support subsequent crown prosecution processes. This latter achievement will require expertise in the disciplines of criminology, forensic sciences, law and ethics and will require collaboration with police forces throughout the UK and Action Fraud. In addition we will bring in relevant work around (i) forensic psychology (Oxburgh) that will deliver case-sensitive interview and investigative procedures for witnesses, victims and investigators; (ii) prosecution procedures that will ensure that evidence going to court is not compromised by intelligence gathering methodologies and (iii) prevention of underreporting of Cloud crime and improvement of public understanding and confidence.