Semantic Interoperability between ballistic systems through the application of ontology

8.2 Semantic Interoperability between ballistic systems through the application of ontology

Ballistic systems providers and crime data repositories currently do not effectively share and cross-correlate data from different sources. This paper will focus on the application of ontology-driven technologies to leverage interoperability between heterogeneous systems within a Pan-European Odyssey security project. An integrated data model will facilitate knowledge exchange and intelligence discovery between law enforcement agencies, this will allow information to be used more innovatively.

Semantics, Data Mining, Ontology, Interoperability, Integration

INTRODUCTION

Project Odyssey will allow police organisations to automatically share information relating to gun crime and terrorism across the European Union (EU). The system, built by a team of police experts, industrialists, computer scientists and researchers, will use sophisticated methods to process, analyse and share enormous amounts of ballistics data. The benefit to policing will be an automated intelligent computer aided data sharing and analysis tool. This will speed up police response times, reduce cost and enable data to be shared, fast, effectively and accurately across the entire EU. Moreover, the Odyssey project undertakes research to create and develop a secure interoperable situation awareness platform for the EU to combat organised crime and terrorism. The project utilises non-personal ballistics data and crime information to identify connections and links that previously would not have been discovered.

The project will automatically combine data from disparate high volume data repositories with data from different cultural/domains with multiple reference models using real-time data feeds and historical databases. Intelligence will be extracted using semantic knowledge extraction and data-mining to facilitate appropriate, fast and responsible decision making and alerts (Akhgar, 2009).

Interoperability has always been a drawback when deploying specialised and self-determined systems into large scale heterogeneous environments. Especially, where autonomous purpose designed systems were developed in closed environments (Bertino and Ferrari, 2001). For example forensic analysis, and data sharing or any other communication with external applications was collectively inaccessible. These systems are supposed to perform a specific task and present results in their own user interface only. Moreover, data exported is commonly wrapped using an exclusively developed piece of software. The output from the software is not in a common standard for example XML. This paper aims to present ontology(Gruber, 1993) using core data which allows the integration of ballistic systems. In the Odyssey project the ontology is integral to every layer of the application stack, as it integrates through the use of abstraction and logic reasoning. Further to this, ontology predefines the unified Odyssey data model that enables the merging of information from different data sources into a single database schema. The application of semantics is an additional layer to this platform.

Figure 1 is an abstraction of the Odyssey application stack. In brief, upon completion of the extract, transform and load (ETL) processes. The data is mapped into an ontology-driven database schema, based on rules specified within ontology.

6. 
   Odyssey platform application stack
   

The ontology is a abstraction of the application and concepts, this places a crucial role on the usability of the interface, but the platform remains extendable. In short, the use of the global ontology leverages a semantic search function across ballistic systems throughout the Odyssey platform. This makes the alerting service more accurate and increases the usability of the interface. Hence, the platform is easy to use for non-technical professionals.

UnderstandIng interoperability

T

Figure 2. Interoperability of data through the platform

Additionally, external systems are not expected to be interoperable between each other or even with the Odyssey platform. In this instance interoperability is defined as the ability to integrate data as opposed to the individual systems and their communication protocols. It is anticipated that this will be a significant challenge to the Odyssey project. However, the perceived lack of interoperability between ballistic systems has made integration into one single platform difficult. Indeed, each company has created its own platform in which their own particular tools are system specific. This has created a demand, across the EU, for an interoperable solution to meet the requirements of the European law enforcement agencies (Akhgar, 2009). Currently, these actions are limited by a vast amount of different and entirely incompatible systems competing for the EU market share. The Odyssey platform facilitates the exchange of information and joint cooperation of police agencies across the EU, as set out in the 2008 Lisbon Treaty.

Application scenario

Globalization and the relaxation of borders in the EU not only enabled people to travel freely for pleasure and commercial, but it also made it easier for criminals to travel, often with possession of firearms to commit crime and terrorist acts (De Kinder, 2002). Currently, linking the use of a firearm used in one Member State to a crime committed in another is ineffective, highly problematic and extremely expensive. It can be done in isolated rare cases but it is not routine. Databases are localised to Member States and often to Cities or Regions. The sharing of ballistics and crime information and the ability to rapidly link organised crime and terrorism is, at the moment not available and is much needed (Leon, 2006).

What follows is a representation of a typical forensic investigation process (high-level) in the context of ballistics. A deceased male was found in an apartment in Germany with gunshot wounds to the chest. A witness heard the sound of what she thought was gun-fire and notified the police by telephone. The police attended and found the man dead in a pool of blood. The entrance door was open. On the floor near the doorway to the bedroom was a knife. There was no obvious motive for the killing and suspicions were further aroused by the fact that no gun was found at the scene.

Forensic investigators attended the scene to gather evidence. They photographed the scene and commenced a forensic examination. A large pool of what appeared to be the deceased’s blood, from an open gun-shot wound, was found on the floor and there were footprints going away from the body that appeared to be made in blood. These were in the direction of the open entrance door. Crucially, amongst other items, two cartridge cases were recovered from outside the entrance door. One was clearly from a rifle and the second from a 9mm, possibly from a Glock. A post mortem recovered a spent bullet from the deceased.

The deceased was unable to provide any information about the crime because he died within seconds of being shot. The 9mm cartridge case was examined at the forensic laboratory. Breach face and firing pin marks on the cartridge case matched it to a recovered cartridge case from another shooting incident in the same city in Germany. Despite extensive enquiries the crimes were not solved. No further intelligence or evidence was forthcoming. The links were limited to the two shooting incidents.

Investigating the same homicide using the Odyssey platform would potentially produce a different result. With access to the Odyssey platform the investigation could be taken much further. One year later the police in Spain were called to a car park where a rifle had been discarded from a passing car driving at speed. The rifle was later test fired in Spain but links were not found to any crimes in Spain. Later that day the Odyssey platform ‘Alerted’ the investigating officer that the rifle cartridge case test fired in Spain, matched with the cartridge case found at the crime scene in Germany. The automated correlation process, across the Odyssey platform, alerted both the Spanish and German police forces that both cartridge cases had been fired from the same rifle - the Odyssey platform had discovered a ‘Match’.

ontology used to integrate data

O

ontology facilitated data integration

The platform uses SAS® software capabilities to deliver the highest quality of information processing. The data is integrated using the SAS® Data Integration Studio™ as the main ETL (Extract Transform and Load) tool, which is used in conjunction with SAS® Enterprise Miner™. SAS® Enterprise Miner™ is used in the next phase of the information retrieval and knowledge discovery. Following this, the data is mapped into an ontology driven unified database. Integration of the statistical software and semantics increases the usability and maintainability of the whole platform.

E

Figure 4 - ETL process

Figure 4 presents the Odyssey data model as an aggregation of heterogeneous data from various data sources. Subsequently, the new data source allows data mining techniques to be applied across the whole dataset.

The challenge of the project is to transform the ballistic data from different providers into a format that enables cross system bullet or cartridge case matching. Initially, the data capture techniques and fuzziness appeared to be potential obstacles. However, through adopting the approach outlined above, a process of cross-platform correlation - based on probabilistic models directly linked to the ontology concepts - was developed. As a result of this, the data mining techniques with the semantically enhanced data model are the core of the Odyssey platform.

Semantically enhanced alerting Service

A search on the Odyssey platform may not immediately generate results, but could yield a subsequent alert. The Odyssey platform allows a query to be stored and an alert to be triggered when new data is added to the information repository.

The alerting system has a dual role. It is an integrated service, for aggregation of information and scenarios, and a modelling and classification tool that identifies anomalies for real-time data feeds. The alerting service provides an automated knowledge extraction framework, which will leverage situation awareness and enable real-time incident identification, modelling, and classification. The alerting component is part of the Odyssey InfoBroker framework, which is a set of security and communication components that provide information exchange within a subsystem of the Odyssey platform.

I
Figure 5 - Alerting component general view
n addition to this, the framework and its components are using ontology and associated technologies as the main information modelling facility. Consequently, the alerting service makes use of semantic and logic reasoning capabilities provided by the use of ontology. The use case diagram below (figure 5) presents a general view on how the alerting service is realised within the Odyssey platform.

The user can run predefined or specialised queries, these are saved into the query repository for later automated use. The security is enhanced through restricting the users' access to individual login profiles. The platform will discover possible links and provide the users uploading the data with possible related information. The system uses stored queries to run analysis when there is a potential link. Queries and information in the database are stored using Odyssey data model, which enables abstraction and semantic reasoning.

Furthermore, queries are created using an ontology browsing tool. This builds a very coherent and self organising environment, where knowledge base, database structure and the query engine are directly linked through ontology. When an alert is triggered notification will be sent to the user informing them of a possible link. These messages are constructed using semantic capabilities (with an emphasis on abstraction of events), situation reporting (using visualisation tools based on logic embedded within the ontology) and further ontology enabled situation modelling.

Further Semantically driven Alerting

It is imperative that the results from the Odyssey platform deliver precise and relevant information to the end-user. For this reason, a user profiling facility was implemented within the scope of the Odyssey ontology. This will provide the users' with the capability to query the data that is already linked to the individuals' profile - for example, same location, time scale and type of crime. When the dataset is extended by new feeds, the alerting service will notify the end-user of any new possible correlations. Additionally, the user always has an option to close a single crime case and not to receive further linked information. However, the newly discovered links are still stored within the platform for further cross case correlation.

At first, user queries are executed against the users' stored profile. The initial crime case can be first internally correlated, such as within the borders of a single member states. Further advanced queries can include cross correlation with additional information using expert defined semantic queries and standard statistical analysis techniques - using data from across Europe.

Conclusions

This paper sets out the process of developing a cross European system, which facilitates the sharing of ballistics information between police organisations - the Odyssey platform. It outlines how semantic knowledge structures used in conjunction with standard statistical methods can facilitate interoperability between the numerous standalone ballistic systems. It goes on to illustrate the benefits of such a platform through the introduction of a use case scenario.

Ontology permeates every component of the Odyssey platform, from data integration to the presenting of results. Odyssey utilises ontology to create a common model for ballistic, crime and situation awareness data. A key function of the Odyssey platform is the alerting service that alerts, pre registered users, to correlations between historical and new data that is loaded into the system. The Odyssey platform is a ground-breaking solution. As it is the only platform that is able to link, and ultimately facilitate the resolution of, gun crimes committed across many European countries.

References

Akhgar, B. (2009) 'A Pan European Platform for Combating Organized Crime and Terrorism (Odyssey Platform)', Centeris Conference on Enterprise Information Systems.

Bertino, E. and Ferrari, E. (2001) 'XML and Data Integration', IEE Internet Computing, pp.75-76.

Bonino, D., Corno, F., Farinetti, L., and Bosca, A. (2004) 'Ontology Driven Semantic Search', WSEAS Transaction on Information Science and Application, Vol. 1, No. 2, pp.1597-1605.

Bonino, D., Corno, F. and Farinetti, (2004) 'Domain Specific Searches using Conceptual Spectra', 16th IEEE International Conference on Tools with Artificial Intelligence, 2004. ICTAI 2004, pp.680-687.

Carney, D., Fisher, D., Morris, E. and Place, P. (2005) 'Some Current Approaches to Interoperability', Carnegie Mellon Software Engineering Institute, pp.1-19.

De Kinder, J. (2002) 'Ballistic fingerprinting databases', Science & Justice, Vol.42, No.4, June, pp.197-203.

Gruber, T. (1993) 'A Translation Approach to Portable Ontologies', Academic Press, Vol.5, No.2, pp.199-220.

Leon, F.P. (2005) 'Automated comparison of firearm bullets', Forensic Science International, Vol. 156, February, pp.40-50.