SECURITY SOLUTIONS TODAY17 May 2017
Tracking the Culprit: SEC Technologies and Fraunhofer IPK develop Technology to Identify Criminal Activities in Enterprise Networks
Views: 172

Violence, extremism and child abuse: A lot of criminal activities are captured in images and distributed via internet and social media. But how can companies protect their network if being abused for such a purpose? If operators do not want to be unwilling accomplices, they must meet necessary measures to prevent these crimes. SEC Technologies, SEC Consult's subsidiary for technical innovation and development, and Fraunhofer IPK set a technical milestone in identifying criminal images: Traffiic (Traffic analysis for incriminating image content) is able to recognize acts of abuse by combining text and image analysis and machine learning, which makes it possible to evaluate the image content and raise alarm, if necessary.

The aim of the jointly-developed technology was a software, which is able to discover such content and helps to antagonize against the misuse of infrastructure. A modular system emerged, which can be integrated in the enterprise network as a passive component. Least possible delay in the network traffic and minimal hardware requirements make it easy to work with this technology in the background. Heart of the system is the possibility of data extraction: In case of findings the network operator gets informed immediately and is able to set countermeasures.

High quality technology against violent crime

Fraunhofer IPK developed a new system which enables acts of abuse by combining text and image analysis with machine learning. To achieve a high detection rate with a low error rate a few different, specialized and intelligent "classifieres" are used. So for example, the first "classifier" recognizes erotic figures. Such a "positive" finding activates another "classifier", which was trained to recognize child abuse. Apart of image information also filename and eXiF-information, which shares facts about the used camera, are analyzed.

Markus Robin, General Manager SEC Consult: "Apprehending criminals and safeguarding victims was our guiding idea during the development of this technology. Studies show that in hidden services, 80% of site visits were related to child abuse content. As cybersecurity experts it is also our responsibility to enable a safe world. More and more frequently, companies register a misuse of their network and infrastructure. That's why we developed Traffiic - to support companies in their network protection, save them from the act of accomplice and set measures against the horrible sharing of violent crimes."

In the course of this project SEC Technologies developed solutions for detecting and analyzing critical content in networks. The module implemented for data extraction allows to identify images and videos in the networks' data streams and to extract and store them for analysis. Additional to extracting the files, evaluating the source of an image is of central importance. Based on former data analyses another module for the evaluation of network sources investigates the reputation of the system in question, by linking and examining different data sources like Who-is-data bases and IP reputation services. As a result, the system's reputation can be included in the evaluation of an image and significantly enhances the accuracy of the whole evaluation.