A review of Spotting Child Sexual Exploitation Material using File Names and their Path [Póster]

A review of Spotting Child Sexual Exploitation Material using File Names and their Path MHD Wesam Al-Nabki∗, Francisco J´ a˜ nez-Martino†‡, Eduardo Fidalgo†‡, Enrique Alegre†‡, Roc´ ıo Alaiz-Rodr´ ıguez†‡ ∗Machine Learning Engineer at Nymiz, Bilbao, ES †Department of Electrical, Systems and Automation, Universidad de Le´ on, Le´ on, ES ‡Researcher at INCIBE (Spanish National Cybersecurity Institute), Le´ on, ES Email: [email protected], {francisco.janez, eduardo.fidalgo, enrique.alegre,rocio.alaiz}@unileon.es Resumen—Law Enforcement Agencies (LEAs) fight the production and distribution of Child Sexual Exploitation Material (CSEM) daily. Typically, the LEAs engage in manual analysis of the content stored on seized devices suspected of containing CSEM data. This task is complex and time-consuming because of the number of files and the obfuscation and patterns that sexual offenders might use in the file names. We proposed two Natural Language Processing approaches: first, training two text classifiers—one dedicated to analyzing filenames and the other to examining absolute paths—and then merging their output into a single output. The second uses only the filename classifier recursively over the absolute path. Moreover, we incorporated in both approaches three novel features to enrich the character n-gram representation before training four machine learning classifiers and two Convolutional Neural Networks (CNN). For CSEM detection, we recommend a CNN model combining both approaches, with an F1-score of 0,988, which was integrated into the tool built in the European Project: Global Response Against Child Exploitation (GRACE). Index Terms—Child Sexual Abuse, Child Sexual Exploitation Material, Cybercrime, Short Text Classification Type of contribution: Already published – Short text classification approach to identify child sexual exploitation material [1] I. INTRODUCTION The European Police Office defines Child Sexual Exploitation Material (CSEM) as the production and distribution on the Internet of images or videos of sexual abuse of a person under the age of 18. The Council of the European Union (EU) considers cybercrimes associated with Child Sexual Abuse (CSA) as the most severe crimes [2]. The priority reported by the European Commission turns CSA into an urgent challenge for cybersecurity organizations and researchers to find, detect, and prosecute this type of crime 1. Pedophiles typically use sharing platforms such as P2P, Darknet networks, and instant messaging to distribute CSEM securely. At the same time, producers of CSEM may store it on their local devices or encrypt it on a cloud server before sharing it. Hence, Law Enforcement Agencies (LEAs) have time constraints when examining a suspect’s device to identify potential CSEM. Although current applications, such as Microsoft’s PhotoDNA, are robust to different attacks like resizing or watermarking, the main drawback is finding correspondences with new files and accessing the original content. To overcome these challenges and reduce the runtime, 1https://www.incibe.es/menores/recursos/stop-abuso-menores retrieved May 2024 in this work, we proposed two modules based on Natural Language Processing to detect CSEM files using files names, File Name Classification (FNC), and absolute paths, File Path Classification (FPC). The FNC included novel preprocessing techniques to extract insights from the file name. Based on these modules, we evaluated two strategies: a) the single iterative application of FNC for file names or path and b) the output fusion of FNC and FPC. We built a novel dataset for training and evaluating the approaches. The best model was integrated into the tool built in European Project called Global Response Against Child Exploitation (GRACE) 2. II. RELATED WORK Some researchers have investigated the detection of CSEM using file names. Panchenko et al. [3] normalized file names to detect CSEM by applying normalization techniques used in Short Message Service (SMS). Peersman et al. [4] created a dictionary-based filter containing the CSEM keywords using an n-grams approach. Due to the lack of public datasets, these models were evaluated on custom and private datasets. On a preliminary work, Al-Nabki et al. [5] compared traditional machine learning algorithms, like Support Vector Machine (SVM) or Na¨ ıve Bayes (NB), with Convolutional Neural Networks (CNNs) [6], achieving the last ones the highest F1-Score, 0,84 on a private dataset of 65,351 file names. Pereira et al. [7] found this CNNs obtained the highest accuracy (96.8%) by also using a private dataset containing the paths of 1,010,000 files from 55,312 unique storage systems provided by Project VIC International. Finally, we explored the detection of phishing URLs [8] due to the similarities in structure and the use of concatenated words. III. FILE CLASSIFIERS The FNC consists of three stages: preprocessing, feature extraction, and classification. In the preprocessing stage, we introduced three novel techniques to extract information from the file name to be concatenated and used as input. Digit and special char. We replaced the special characters by # and numbers by $, hence, a file named “!!!!yoB0yXX” turns into “####yoB$yXX”. This technique allowed us to detect and eliminate names that only differ in some parts, for example, IMG01.png and IMG02.png. Binary representation. To detect the oscillations between letters and other characters blocks, we added a new binary 2https://cordis.europa.eu/project/id/883341 retrieved May 2024 JNIC 2024 ISBN:978-84-09-62140-8 502 representation that assigns a 1for each character block and 0 for anything else. In the “!!!!yoB0yXX” example, the binary representation would be “0101”. Orthographic representation We also extracted the oscillations between orthographic features mapping uppercase (“C”) and lowercase (“c”) letters, numbers (“N”) and characters (“P”), thereby, “!!!!yoB0yXX” returns “PPPPccCNcCC”. After the preprocessing, the final output of “!!!!yoB0yXX” is the merge of all encoded text: “####yoB$yXX0101PPPPccCNcCC”. For feature extraction, we used the Term Frequency - Inverse Document Frequency (TF-IDF) to obtain a file name representation from two to five consecutive characters, quantifying their general relevance. Finally, we evaluated four machine learning classifiers: Logistic Regression (LR), Random Forest (RF), NB, and Gradient Boosted Trees (GBT), as well as two char-based CNN models[6], [9], which automatically extract the feature from the text. We followed the same pipeline components for FPC but modifying the preprocessing step. Firstly, we replace the slash sign (/) with space and the characters and digits as in FNC. Finally, we split the text using uppercase letters as delimiters. Moreover, we considered two approaches to use the FNC and FPC to detect potential CSEM in the file name or path. We refer them in this summary as Fusion 1 and Fusion 2. We introduced a fusion strategy of FNC and FPC (Fusion 1). The final output is determined by selecting the highest CSEM confidence score among the two classifiers. We also presented a single-iterative classifier approach (Fusion 2). The particularity of this model is it leverages the FNC to call Ntimes, allowing the traversal of each directory within the absolute path and returning its isolated output. If one of the entries at least is reported as CSEM, the entire path is considered as CSEM. IV. DATASET CREATION We created two datasets, one for file name and another for file path classification. To evaluate the performance of both systems, we randomly selected and merged 50,000 file paths and 50,000 file names for each test set of paths and file names. We used a dataset from the National Software Reference Library 3for Non-CSEM class. We used the file names provided by the Spanish LEA and extracted from hard disks seized from criminals’ devices for CSEM. After removing duplicates, our dataset contains 519,981 and 37,609 samples per class, respectively. We used an 80/20 split for the training and test set. For the file path dataset, we collected unique paths from eight computers hosting non-CSEM files. For the CSEM class, Spanish LEA support paths from six machines. After the preprocessing, we finally obtained 1,141,145 non-CSEM and 924,445 CSEM paths. We used six Non-CSEM and four CSEM for training and the remaining for testing. V. EMPIRICAL RESULTS We reported the FNC and FPC performance of the classifiers studied. In FNC, we included an evaluation of the impact 3https://www.nist.gov/itl/ssd/software-quality-group/ national-software-reference-library-nsrl/nsrl-download retrieved May 2024 of the binary and the orthographic preprocessing features increasing the F1 score of all models. For both classifiers, Kim et al. [9] model achieved the highest performance in terms of the F1 score, 0.983 for FNC and 0.998 for FPC. Regarding machine learning models, LR and NB achieved the best performance for FNC (0.970) and FPC (0.997), respectively. We noticed that the first fusion strategy, Fusion 1, outperformed the second one. Considering the whole path and name simultaneously provides an overall view of the elements rather than only zooming in on specific parts of the path. Additionally, the results also confirmed the superiority of Kim et al. [9] with an F1 score of 0.988. After a runtime evaluation, we found that this model with a GPU could classify 4,167 files per second. VI. CONCLUSIONS In this work, we proposed two standalone classifiers, one focused on file names (FNC) and another on the absolute path file (FPC), to detect files suspicious of containing CSEM. We also presented two fusion strategies based on using both outputs to make a single decision and recursively the FNC on the path. We introduced three novel preprocessing techniques, two of which (binary and orthography) improved the performance by 0.02 points at least. After evaluating six classifiers, four using machine learning and two CNN models that worked at the character level, the CNN model of [9] achieved the highest performance using the fusion of FNC and FPC outputs. In the future, it could be considered the inclusion of sexual words in non-CSEM examples, such as pornographic websites or movies and distributed training to improve the model. ACKNOWLEDGMENTS This work has been funded by the Recovery, Transformation, and Resilience Plan, financed by the European Union (Next Generation), thanks to the LUCIA project (Fight against Cybercrime by applying Artificial Intelligence) granted by INCIBE to the University of Le´ on. REFERENCIAS [1] Al Nabki, Wesam & Fidalgo, Eduardo & Alegre, Enrique & Alaiz, Roc´ ıo. (2023). Short text classification approach to identify child sexual exploitation material. Scientific Reports. vol 13 16108, pp. 1-10, 2023. [2] Europol. Eu Policy Cycle - Impact. https://home-affairs.ec.europa.eu/ policies/internal-security/child-sexual-abuse en. Accessed Mar 2024. [3] Panchenko, A., Beaufort, R. & Fairon, C. Detection of Child Sexual Abuse Media on p2p Networks: Normalization and Classification of Associated Filenames. In Proceedings of the LREC Workshop on Language Resources for Public Security Applications, 27–31 (2012) [4] Peersman, C., Schulze, C., Rashid, A., Brennan, M. & Fischer, C. ICop: Live Forensics to Reveal Previously Unknown Criminal Media on P2P Networks. Digit. Investig. 18, 50–64 (2016) [5] Al-Nabki, M. W., Fidalgo, E., Alegre, E. & Alaiz-Rodr´ ıguez, R. File Name Classification Approach to Identify Child Sexual Abuse. In Proceedings of the 9th International Conference on Pattern Recognition Applications and Methods, 1, 228–234 (2020). [6] Zhang, X., Zhao, J. & LeCun, Y. Character-level Convolutional Networks for Text Classification. In Advances in Neural Information Processing Systems, 649–657 (2015). [7] Pereira, M., Dodhia, R. & Brown, R. Metadata-based Detection of Child Sexual Abuse Material. arXiv preprint arXiv: 2010. 02387 (2020). [8] Sahingoz, O. K., Buber, E., Demir, O. & Diri, B. Machine Learningbased Phishing Detection from URLs. Expert Syst. Appl. 117, 345–357 (2019). [9] Kim, Y., Jernite, Y., Sontag, D. & Rush, A. M. Character-aware Neural Language Models. In Thirtieth AAAI Conference on Artificial Intelligence, 2741–2750 (2016). Spotting Child Sexual Exploitation Material using File Names and their Path 503