Knowledge mining and social dangerousness assessment in criminal justice: metaheuristic integration of machine learning and graph-based inference

Abstract

One of the main challenges for computational legal research is drawing up innovative heuristics to derive actionable knowledge from legal documents. While a large part of the research has been so far devoted to the extraction of purely legal information, less attention has been paid to seeking out in the texts the clues of more complex entities: legally relevant facts whose detection requires to link and interpret, as a unified whole, legal information and results of empirical analyses. This paper presents an ongoing research that points in this direction, trying to devise new ways to support public prosecutors in assessing the dangerousness of individuals and groups under investigation, an activity that precisely relies on the cross-sectional evaluation of legal and empirical data. A knowledge mining strategy will be outlined that lines up, into a single metaheuristic model, information extraction, network-based inference, machine learning and visual analytics. We will focus, in particular, on the integration of graph-based inference and machine learning methods used both to support classification tasks and to explore new forms of man-machine cooperation. Experiments made involving public prosecutors from the Italian Anti-Mafia Investigation Directorate and using data from real investigations have not only shown the potentialities of our approach but also offered an opportunity to reflect on the role we could assign to AI when thinking about the future of legal science and practice.

Appendices

Appendix: CrimeMiner data tier

The Data Tier represents the first tier of the knowledge mining architecture we conceived (see an overall sketch in Fig. 13).

Fig. 13

The Data Tier’s tagging mechanism: relations between documents and database. The trial documents first are analyzed through string matching mechanisms, then the user can interact with them via Document-enhancement functionality to reduce errors and add significant information. The tags are then translated into XML files

In this tier, we extract entities and relations within trial documents. For the extraction we adopt straightforward string matching mechanism. For entities such as names, we employ dictionaries of Italians names. For locations, we employed an open maps dataset concerning Campania region, and for relations such as tapped phone calls, we searched for main Italian verbs referring to calls (a list manually crafted), e.g., “ha chiamato”, “ha telefonato”, “chiama”, “telefona”, “parla al telefono”, “conversazione”, and so on (in English, “has called”, “called”, “calls”, “talks on the phone”, “conversation”). The result is an XML file that is then ported into the database of CrimeMiner. Given such a strategy has the downside to produce different errors in the data entry, we introduced a document-enhancement functionality where the user interacts with the trial documents and supports the extraction procedure. The adoption of solutions somehow inspired by the social media tagging mechanism, allows us to avoid different irregularities like the one deriving, for instance, by the fact that when the same person is mistakenly reported as Giuseppe, Peppe, or Peppino (in English could be Jo, Joe, Joseph) this produces three entities and, consequently, three different nodes on the final graph. As shown in Fig. 14, CrimeMiner provides an advanced editor that allows the creation of a database containing all relevant information for the investigation. Figure 14 gives an example of how the system highlights tagged people in the trial document (the one matched with dictionaries for example). The system helps avoiding errors in data entry by suggesting that the name of a person the user is typing is already available in the database (in the example, the person, anonymized as “Node 72”, is highlighted in violet). In addition, to allow a check on the correctness of the system’s suggestion, CrimeMiner shows details about that individual (see Fig. 14) by simply clicking on the name.

Fig. 14

Document-enhancement functionality in Data Tier of CrimeMiner

Appendix: CrimeMiner’s architecture

The CrimeMiner is built upon the Java EE Spring Data Neo4j framework whose architecture is structured in three layers, as shown in Fig. 15. We describe each of them in the following.

• Storage: This layer stores all the data (including graphs) under examination. Managing data in this layer requires the communication between Neo4j and Spring Data Neo4j. This is accomplished by a Neo4j HTTP Driver (system integrated thanks to a Maven dependency). Data stored include personal details of investigated individuals, tappings (telephone and environmental tappings) and, finally, the document created by the user by means of CrimeMiner;

• Server: this layer is responsible of the mapping of Neo4j relations and entities in Java classes. Besides, it processes data mapped and provides developed services to the top layer (thanks to a REST service returning JSON data). In this layer, all SNA metrics are also defined. Here, the tool invokes WEKA library for classifying individuals under investigation as well as updating the KStar model underlying the “Dangerousness module”;

• Client: it includes user interface allowing PPs to interact with CrimeMiner’s features. Processed data, exploiting JavaScript libraries, are shown to the user through: graph visualizations via Linkurious²¹, 2D and 3D graphics with Highcharts²²) and finally, tables with rich functionalities using Datatables.²³

Fig. 15

Java EE Spring Data Neo4j architecture for CrimeMiner

Appendix: CrimeMiner interaction tier

The Appendix sketches how CrimeMiner’s users interact with the system. In particular, we detail how visual metaphors are used to enable the exploration of the features of the organization and its members (organization structure, roles and criminal profiles of single individuals) and their evolution over time. To this end, two visualizations are taken into account in the following:

• basic graphs visualizations—like those in Sect. 5.1 and more—(Appendix C.1);

• Similarity visualizations (Appendix C.2);

• Temporal graph visualization (Appendix C.3).

We remark that all visualizations are actionable from a left-sided menu panel in the CrimeMiner (see Fig. 16).

Fig. 16

Left sided menu panel of CrimeMiner

1.1 Basic graphs visualizations

CrimeMiner offers a graph visualization module where the user can select and visualize different types of graphs (e.g., those defined in Sect. 5.1). In Fig. 17 we show the multi-graph individual-phone call, the bi-partite individual-environment graph and the projection of it. Such a projection graph represents a network projection using individual-environmental tapping data: G(V, E) where $V=\left\{ v_{1},v_{2},...,v_{n}:v_{i} = individual\right\}$ and $\exists (v_{i},v_{j})$ $\Leftrightarrow v_{i}$ and $v_{j}$ were involved in the same environmental tapping. When clicking on a node of interest, the tools shows its main information and its edges are highlighted. In addition, from this module it is possible to apply all the NA metrics (centrality measures) seen in Sect. 5.4. The application of a specific metric has spillovers on the nodes size (the bigger the higher the metric value).

Fig. 17

Examples of visualizations in CrimeMiner

1.2 Similarities between criminals at a glance

The similarity—in terms of criminal profile—between two or more individuals is an information of major interest on the investigative level.

CrimeMiner offers a Similarity module implementing SimRank (Jeh and Widom 2020), a similarity measure based on a graph-theoretical model. The module provides user with information about similarities (in terms of individual’s characteristics, social relationships) that may exist between individuals under investigation (Lettieri et al. 2021). To increase understanding of the similarities measures applied on various types of graphs, we create 2D and 3D graphics, thanks to Highcharts²⁴JavaScript Library. In Fig. 18a, we show a plotted 3D graphic in which x-z axes are for individuals’ names and the y-axis shows similarity percentages between each pair of individuals, respectively. Using this arrangement on a Cartesian graph, we can clearly show that top points represent the more similar pairs. The pair is represented as a point in the Cartesian graph. With a mouse over, the Similarity module shows names and similarity percentage of each pair of individuals. Using “Data Settings” option, the user can modify the SimRank threshold to better visualize the levels of similarity he/her is interested in (default: $[30, 100\%]$) and, of course, it is possible to select just one individual to get his SimRank with all the others (see Fig. 18b). In this case, the similarity module exploits a bar chart where the bars represents the similarity (the higher the more similar) and on the x-axis there are the individuals belonging to the network.

Fig. 18

SimRank visualization of individuals included in criminal proceedings using the individual-phone calls graph. Individuals’ names are blurred for privacy

1.3 About time: visualizing the evolution of criminal networks

Studying the diachronic evolution of the criminal network can better support the evaluation of dangerous individuals, highlighting suspicious social patterns. CrimeMiner offers a temporal graph-based visualization module, providing to the user the chance to browse the social relationship between individuals in the criminal network over the period of investigation. This helps to grasp the evolution of social patterns, highlighting suspicious ones. An abstracted version of the visualization is available in Fig. 19a–b.

Fig. 19

Temporal graph visualization module: abstracted and instantiated version

The temporal-graph based visualization module works with every kind of social relation (thus graph) CrimeMiner handles; here we present the visualization’s details using phone calls as testbed. Fig. 19 depicts the temporal multi-graph $G=(V,E)$. Formally, let $V=\left\{ v_{1},v_{2},\ldots ,v_{n}\right\}$ be a set of individuals, and E be a set of tapped phone calls such that $(v_{i},v_{j})_t \in E$ if there exists a tapped phone call from $v_i$ to $v_j$, with $1 \le i,j \le n$ and $i \ne j$ at time t. We define $C=\{0, 1,\ldots , 360\}$ as the set of colors according to the HSL metrics (Hue, Saturation, Lightness)—which goes from blue to red –, and a color function $color: V \rightarrow C$, assigning to every node $v_i\in V$ a color $c\in C$. The color of $v_i$ depends on the sum of outgoing and ingoing edges from $v_i$. We define $\forall v_i\in V$, $E_{v_i}=\{(vj,vk)_t | v_j=v_i \vee v_k=v_i\}$, with $E_{v_i}\subseteq E$, as the set of outgoing and ingoing edges of $v_i$ at time t. Therefore, the shade of $v_i$ is given computing

$$\begin{aligned} color(v_i) = \Bigl \lfloor \frac{(bc_{v_i,G_t}-m_t)}{(M_t-m_t)}\times 360 \Bigr \rfloor \end{aligned}$$

where $m_t$ and $M_t$ are the minimum and maximum centrality value at the time t respectively.

We define a thickness function $thick: E \rightarrow {\mathbb {N}}$ which assigns a thickness to the edges of the temporal graph, acting as a grouping function to reduce the visual clutter. The thickness of a visualized edge at time t is proportional to the number of edges between two nodes at time t. Formally, let $v_i,v_j\in V$ two nodes, we compute the thickness

$$\begin{aligned} thick((v_i,v_j)_t)=|E_{v_i}\cap E_{v_j}| \end{aligned}$$

By double-clicking on a node of interest, the user highlights all its social relationships, belonging to the first (individuals called or that have called, informally “friends”) and second level (individuals called or been called by individuals of the first level, informally “friends of friends”). The timeline at the bottom considers all the investigation period, in our case, from October 2002 to 2006. By default, the temporal graph displayed covers all the investigation period but the timeline allows to display the criminal network at a time t or in a time range $[t_s,t_e]$ (see Fig. 19c–d). The timeline is composed of two graphics sharing the x-axis as the time axis. The y-axis represents the number of tapped phone calls. Therefore, a depicted point $P(t_p,pc_p)$ in the timeline represents the number of tapped phone calls $pc_p=|E|$ in the temporal graph at a specific time $t_p$. Furthermore, these points are colored up according to the total duration of tapped phone calls; the more the duration, the darker the color.

To implement this module, we adopted two JavaScript libraries, that is Ogma²⁵ e D3.js.²⁶