In the last 20 years mobile devices gained an important role in daily life and became must have items for everyone. As mobile devices give us the much needed flexibility and mobility, they also represent one major concern; security. As the information is transmitted from node to node via radio frequencies, an imposter can gain access into a mobile network without the need to gain physical access to firewalls and gateways. Also, as they are light and small, mobile devices are easily lost and often used without any PIN or password protection enabled. Hence, it is not difficult for someone even without any technical knowledge to gain access to such devices if they have been left behind or stolen. As traditional intrusion detection systems are not very effective against this kind of attack, there is a need of a different approach that can assist in the identification of a potential imposter. This thesis begins by assessing the security needs of the mobile devices, and establishes the perceived inadequacy of existing safeguards in this respect. Therefore this research considers using Behaviour-Based Mobile Intrusion Detection System (BeMIDS) that aims to assist the identification of anomalous user activity. This in return presents the two main characteristics needed to classify a legitimate user inside a mobile network: first with whom, when and what type of connection is established and then at where the mobile device is left open. After this the research proposes a novel approach that investigates the application of three machine learning algorithms to profile user behaviour in mobile networks. In BeMIDS, historical user profiles are created and then compared with the real-time ones in order to detect unusual activity in mobile networks. If a user’s behaviour changes, this results in alerting the system as an anomalous activity. Specific examples of behaviours that BeMIDS appears to be particularly sensitive to include duration (of calls and of connection with cell towers), time of day (calls are made and cell towers are connected), and frequency of caller usage. In order to classify a legitimate user over a mobile network the thesis then validates this approach by implementing C4.5, RIPPER and SOM algorithms over MIT’s Reality Mining Dataset. The results support the proposed architecture and present accuracy rate as high as 96% for call logs and 94% for tower logs under training conditions.

This study is the first of its kind to explore the phenomenon of serial rape from a behavioural profiling perspective within the South African context. The dearth of scientific research on serial rape in South Africa has impacted negatively on the recognition and investigation of such cases. The data set for the study consisted of police dockets, victim statements, court transcripts, detectives’ reports, and correctional services reports on nine serial rapists who assaulted and/or raped a total of seventy five victims. A behavioural profiling framework that was developed from existing literature was used to systematically analyse the victim and offender data using both qualitative and quantitative data analysis techniques. Initial victim and offender profiles were constructed using key elements such as age, population group, modus operandi, and sexual behaviour of the offenders. The initial results showed that the South African serial rapists typically exhibit the same behavioural elements reported in international literature with respect to aspects such as the methods of approach utilised, average age of the victims, ages of the offenders, offender – victim relationship, and sexual acts. However, the research also illustrated that South African serial rapists also displayed some behavioural aspects that have not been reported in international literature. In particular, South African serial rapists approach and attack their victims at two different locations. The research also showed that South African serial rapists are more willing to target victims outside their own populations groups. Young children also appear to be targeted more frequently by the South African serial rapists. The South African offenders also employed a new method of approaching the intended victim (i.e. the delayed-con approach). The results are discussed in terms of the extent to which the behavioural patterns, similarities and differences with observations made in international literature, and current police practices with respect to the investigation of serial rape in South Africa could be utilised to enhance investigative processes. Also, specific areas in need of further examination are identified, as are strategies that could assist in decreasing the occurrence of ‘linkage blindness’ in serial rape investigations in South Africa. / Thesis (DPhil)--University of Pretoria, 2009. / Psychology / unrestricted