更改

Data itself has inherent issues including integrity (or lack of) and continuous changes. Data may contain “errors of omission and commission because of faulty collection or handling, and when entities are actively attempting to deceive and/or conceal their actions”.<ref name="Link Analysis Workbench"/> Sparrow<ref>Sparrow M.K. 1991. Network Vulnerabilities and Strategic Intelligence in Law Enforcement’, [[International Journal of Intelligence and Counterintelligence]] Vol. 5 #3.</ref> highlights incompleteness (inevitability of missing data or links), fuzzy boundaries (subjectivity in deciding what to include) and dynamic changes (recognition that data is ever-changing) as the three primary problems with data analysis.<ref name=Krebs/>

Data itself has inherent issues including integrity (or lack of) and continuous changes. Data may contain “errors of omission and commission because of faulty collection or handling, and when entities are actively attempting to deceive and/or conceal their actions”.<ref name="Link Analysis Workbench"/> Sparrow<ref>Sparrow M.K. 1991. Network Vulnerabilities and Strategic Intelligence in Law Enforcement’, [[International Journal of Intelligence and Counterintelligence]] Vol. 5 #3.</ref> highlights incompleteness (inevitability of missing data or links), fuzzy boundaries (subjectivity in deciding what to include) and dynamic changes (recognition that data is ever-changing) as the three primary problems with data analysis.<ref name=Krebs/>

Data itself has inherent issues including integrity (or lack of) and continuous changes. Data may contain “errors of omission and commission because of faulty collection or handling, and when entities are actively attempting to deceive and/or conceal their actions”. highlights incompleteness (inevitability of missing data or links), fuzzy boundaries (subjectivity in deciding what to include) and dynamic changes (recognition that data is ever-changing) as the three primary problems with data analysis.

Data itself has inherent issues including integrity (or lack of) and continuous changes. Data may contain “errors of omission and commission because of faulty collection or handling, and when entities are actively attempting to deceive and/or conceal their actions”. Sparrow highlights incompleteness (inevitability of missing data or links), fuzzy boundaries (subjectivity in deciding what to include) and dynamic changes (recognition that data is ever-changing) as the three primary problems with data analysis.

数据本身存在固有的问题，包括完整性(或缺乏)和持续的更改。数据可能包含”由于错误的收集或处理，以及当实体积极试图欺骗和 / 或隐瞒其行为而造成的遗漏和委托错误”。强调数据分析的三个主要问题是不完整性(缺失数据或链接的必然性)、模糊边界(决定包括什么的主观性)和动态变化(认识到数据是不断变化的)。

数据本身存在固有的问题，包括完整性(或缺失性)和持续的改变。数据可能包含“由于错误的收集或处理，以及当实体积极试图欺骗和 / 或隐瞒其行为，而造成的错误的遗漏和委托”。Sparro强调了数据分析中三个主要的问题，不完整性(数据或链接缺失的必然性)、模糊边界(边界确定的主观性)和动态变化(数据的持续变化性)。

Once data is transformed into a usable format, open texture and cross referencing issues may arise. Open texture was defined by Waismann as the unavoidable uncertainty in meaning when empirical terms are used in different contexts. Uncertainty in meaning of terms presents problems when attempting to search and cross reference data from multiple sources.

Once data is transformed into a usable format, open texture and cross referencing issues may arise. Open texture was defined by Waismann as the unavoidable uncertainty in meaning when empirical terms are used in different contexts. Uncertainty in meaning of terms presents problems when attempting to search and cross reference data from multiple sources.

The primary method for resolving data analysis issues is reliance on domain knowledge from an expert. This is a very time-consuming and costly method of conducting link analysis and has inherent problems of its own. McGrath et al. conclude that the layout and presentation of a network diagram have a significant impact on the user’s “perceptions of the existence of groups in networks”. Even using domain experts may result in differing conclusions as analysis may be subjective.

The primary method for resolving data analysis issues is reliance on domain knowledge from an expert. This is a very time-consuming and costly method of conducting link analysis and has inherent problems of its own. McGrath et al. conclude that the layout and presentation of a network diagram have a significant impact on the user’s “perceptions of the existence of groups in networks”. Even using domain experts may result in differing conclusions as analysis may be subjective.

Link analysis techniques have primarily been used for prosecution, as it is far easier to review historical data for patterns than it is to attempt to predict future actions.

Link analysis techniques have primarily been used for prosecution, as it is far easier to review historical data for patterns than it is to attempt to predict future actions.

Krebs demonstrated the use of an association matrix and link chart of the terrorist network associated with the 19 hijackers responsible for the September 11th attacks by mapping publicly available details made available following the attacks. Even with the advantages of hindsight and publicly available information on people, places and transactions, it is clear that there is missing data.

Krebs demonstrated the use of an association matrix and link chart of the terrorist network associated with the 19 hijackers responsible for the September 11th attacks by mapping publicly available details made available following the attacks. Even with the advantages of hindsight and publicly available information on people, places and transactions, it is clear that there is missing data.

Alternatively, Picarelli argued that use of link analysis techniques could have been used to identify and potentially prevent illicit activities within the Aum Shinrikyo network. “We must be careful of ‘guilt by association’. Being linked to a terrorist does not prove guilt – but it does invite investigation.” Balancing the legal concepts of probable cause, right to privacy and freedom of association become challenging when reviewing potentially sensitive data with the objective to prevent crime or illegal activity that has not yet occurred.

Alternatively, Picarelli argued that use of link analysis techniques could have been used to identify and potentially prevent illicit activities within the Aum Shinrikyo network. “We must be careful of ‘guilt by association’. Being linked to a terrorist does not prove guilt – but it does invite investigation.” Balancing the legal concepts of probable cause, right to privacy and freedom of association become challenging when reviewing potentially sensitive data with the objective to prevent crime or illegal activity that has not yet occurred.

There are four categories of proposed link analysis solutions:

There are four categories of proposed link analysis solutions:

有四类拟议的链接分析解决方案:

有四类拟议的链路分析解决方案:

  Statistical

  Statistical

Heuristic-based tools utilize decision rules that are distilled from expert knowledge using structured data. Template-based tools employ Natural Language Processing (NLP) to extract details from unstructured data that are matched to pre-defined templates. Similarity-based approaches use weighted scoring to compare attributes and identify potential links. Statistical approaches identify potential links based on lexical statistics.

Heuristic-based tools utilize decision rules that are distilled from expert knowledge using structured data. Template-based tools employ Natural Language Processing (NLP) to extract details from unstructured data that are matched to pre-defined templates. Similarity-based approaches use weighted scoring to compare attributes and identify potential links. Statistical approaches identify potential links based on lexical statistics.

基于启发式的工具利用结构化数据从专家知识中提取的决策规则。基于模板的工具使用自然语言处理(Natural Language Processing，NLP)从非结构化数据中提取与预定义模板匹配的细节。基于相似度的方法使用加权评分来比较属性和识别潜在的链接。统计方法基于词汇统计识别潜在的链接。

基于启发式的工具运用从专家知识中提取出来的决策规则对结构化数据进行操作。基于模板的工具使用自然语言处理(Natural Language Processing，NLP)从非结构化数据中提取与预定义模板匹配的细节。基于相似度的方法使用加权评分来比较属性和识别潜在的链接。统计方法基于词汇统计识别潜在的链接。

J.J. Xu and H. Chen propose a framework for automated network analysis and visualization called CrimeNet Explorer. This framework includes the following elements:

J.J. Xu and H. Chen propose a framework for automated network analysis and visualization called CrimeNet Explorer. This framework includes the following elements:

和 h. Chen 提出了一个自动化网络分析和可视化的框架，叫做 CrimeNet Explorer。这一框架包括以下内容:

J.J.Xu和H.Chen 提出了一个自动化网络分析和可视化的框架，叫做 CrimeNet Explorer。这一框架包括以下内容:

* Network Creation through a concept space approach that uses “[[Co-occurrence networks|co-occurrence]] weight to measure the frequency with which two words or phrases appear in the same document. The more frequently two words or phrases appear together, the more likely it will be that they are related”.<ref name=Xu/>

* Network Creation through a concept space approach that uses “[[Co-occurrence networks|co-occurrence]] weight to measure the frequency with which two words or phrases appear in the same document. The more frequently two words or phrases appear together, the more likely it will be that they are related”.<ref name=Xu/>

* Network Partition using “hierarchical clustering to partition a network into subgroups based on relational strength”.<ref name=Xu/>

* Network Partition using “hierarchical clustering to partition a network into subgroups based on relational strength”.<ref name=Xu/>

* Structural Analysis through “three centrality measures (degree, betweenness, and closeness) to identify central members in a given subgroup.<ref name=Xu/> CrimeNet Explorer employed [[Dijkstra's algorithm|Dijkstra’s shortest-path algorithm]] to calculate the betweenness and closeness from a single node to all other nodes in the subgroup.

* Structural Analysis through “three centrality measures (degree, betweenness, and closeness) to identify central members in a given subgroup.<ref name=Xu/> CrimeNet Explorer employed [[Dijkstra's algorithm|Dijkstra’s shortest-path algorithm]] to calculate the betweenness and closeness from a single node to all other nodes in the subgroup.

* Network Visualization using Torgerson’s metric [[Multidimensional scaling|multidimensional scaling (MDS)]] algorithm.

* Network Visualization using Torgerson’s metric [[Multidimensional scaling|multidimensional scaling (MDS)]] algorithm.