<p>TIKTOK FORENSIC SCRAPER TO RETRIEVE USER VIDEO DETAILS.</p> <p><br></p> <p>Thesis - Akshata Thole </p> <p><br></p>

Open source intelligence (OSINT) has always been strongly tied to the information and communication technology (ICT) of the day. This paper is an examination of the current state of OSINT as it relates to ICTs by looking at overarching problems that exist across multiple types of collection methods, as well as looking at specific cases where there are issues, such as China and the Middle East, and ending with some minor recommendations on how to fix or minimize the issues highlighted. / text

SOCMINT, or Social Media Intelligence has recently become focus of security community and started to be increasingly favored intelligence gathering method. Apart from providing relevant information and its cost-effective use, main advantage is that the potential of this intelligence technique is very diverse. Due to the relatively public nature of social networks, SOCMINT was generally regarded as unproblematic. However, on closer examination, this intelligence method presents a number of risks. The interest it raised from intelligence and security services in such a short time has given way to a situation where the techniques used by SOCMINT have begun to develop without precise methodological, legal and ethical rules. If the intelligence community wants to use this tool in its full potential and without risking negative response to SOCMINT techniques from the society, a framework must be set up as soon as possible to keep SOCMINT within the proper limits. This thesis aims to examine what opportunities and challenges SOCMINT brings to security community and society and propose how to deal with them.

The number of reported cybercrimes in Sweden is increasing every year. Cybercrimes arebecoming more sophisticated and the attackers are more skilled than before. Attackers usedifferent tactics, techniques and procedures, TTP, to establish their goals. These TTP can beidentified and later used to combat future cyberattacks. This process is known as TacticalThreat Intelligence, TTI, and is characterized by the use of open source intelligence, OSINT, to gather information about previous attacks and TTP. This paper is a literature review toprovide a background of the topic. To further investigate the topic this paper also presents theanalyzis of three different threat intelligence sharing platforms to deepen the understanding ofhow TTI is used today. A statistical analysis is also presented in order to predict future ofcyberthreats. The results of the analysis of the threat intelligence sharing platforms clearly displays theneed to search for information in more than one source. This information will become thefoundation of intelligence, which makes information gathering one of the most importantsteps when working with TTI. The results of the statistical analysis show that cybercrime inSweden will continue to rise. One of the biggest challenges was to identify the current stateof the global cyberthreat landscape since global statistics for cybercrime could not be found.However, the Covid-19 pandemic has forced more people to work from home which hasincreased the number of potential cybercrime victims since home security tends to be lowerthan at a physical offic. Despite this, the number of reported cybercrimes has not increasedremarkably.

OSINT is the collection and analysis of data from open sources such as Twitter, Instagram or Tiktok. Since most people in today's digitised society have access to mobile devices and cameras, anyone can publish sensitive material on for example troop movements. The aim of this work is to contribute on how OSINT methods can potentially be used for intelligence gathering and by increasing knowledge in this area also protect against the problem of people sharing sensitive information by mistake. This is accomplished by conducting an experiment in which three web scraping methods and three manual methods are used for the collection of potential intelligence on three different social media platforms. Due to the state of the world today, the experiment focuses on the Ukraine conflict. All methods tested during the experiment can be used for intelligence gathering. However, the methods differ in their search capabilities and how well they can filter the results of its searches. Overall, the TWINT tool and manual searches of Twitter performed best because they have the most search options and filtering capabilities. / OSINT är insamling och analys av data från öppna källor som Twitter, Instagram eller Tiktok.Eftersom de flesta i dagens digitaliserade samhälle har tillgång till mobila enheter och kamerorkan vem som helst publicera känsligt material på exempelvis truppförflyttningar. Syftet meddetta arbete är att bidra med kunskap om hur OSINT metoder kan potentiellt användas förinsamling av underrättelse och genom en ökad kunskap kring området också skydda motproblemet där personer delar med sig av känslig information av misstag. Detta genomförsgenom att utföra ett experiment där tre web scraping metoder och tre manuella metoderanvänds för insamling av potentiell underrättelse på tre olika sociala medier plattformar. Pågrund av hur läget ser ut i världen idag så fokuserar experimentet på Ukraina konflikten. Allametoder som testades under experimentets gång kan användas för inhämtning av underrättelse.Metoderna skiljer sig i dock sina sökfunktioner och hur väl de kan filtrera resultaten från desssökningar. Överlag så presterade verktyget TWINT och manuella sökningar av Twitter bäst föratt de har flest sökalternativ och filtreringsmöjligheter.

Since the Russian invasion of Ukraine on the 24th of February 2022 – most of the United Nations have, in one way or another, participated in the most significant war of many decades. The war is characterized by Russia’s atrocious war crimes, illegal annexations, terror, propaganda, and complete disrespect for international law. On the other hand, the war has also been characterized by Ukrainian resilience, a united Europe, and a new dimension of intelligence gathering through social media.Due to the internet, social media, the accessibility of mobile devices, and Ukraine’s military and civilianeffort in documenting Russian equipment – its whereabouts, status, and quantity, Open-Source Intelligence possibilities have reached new levels for both professionals and amateurs. Despite these improved possibilities, gathering such a vast amount of data is still a Herculean effort.Hence, this study contributes a starting point for anyone wanting to compile equipment losses by providing a process specialized in automatic data extraction and summarization from an existing database. The database in question is the image collection from the military analysis group Oryxspioenkop. To further complement the information provided by Oryxspioenkop, the method automatically extracts and annotates dates from the images to provide a chronological order of the equipment loss as well as a graphical overview.The process shows promising results and manages to compile a large set of data, both the information provided by Oryx and the extracted dates from its imagery. Further, the automated process proves to be many times faster than its manual counterpart, showing a linear relationship between the number of images analysed and manhours saved. However, due to the limited development time – the process still has room for improvement and should be considered semi-automatic, rather than automatic. Nevertheless, thanks to the open-source design, the process can be continuously updated and modified to work with other databases, images, or the extraction of other strings of text from imagery.With the rise of competent artificial image generation models, the study also raises the question if this kind of imagery will be a reliable source in the future when studying equipment losses, or if artificial intelligence will be used as a tool of propaganda and psychological operations in wars to come. / Sedan Rysslands oprovocerade invasion av Ukraina den 24e februari 2022 – har stora delar av de Förenta nationerna engagerat sig i århundradets mest signifikanta krig. Kriget har karaktäriserats av ryska krigsbrott, olagliga annekteringar, terror, propaganda samt en total avsaknad av respekt för folkrätt. I kontrast, har kriget även karaktäriserats av Ukrainas ovillkorliga motståndskraft, ett enat Europa och en ny dimension av underrättelseinhämtning från sociala medier.Genom internet, sociala medier, tillgängligheten av mobiltelefoner och Ukrainas militära och civila ansträngning att dokumentera rysk materiel – vart den befinner sig, vilken status den har samt vilken kvantitet den finns i, har öppen underrättelseinhämtning blomstrat på både professionell och amatörnivå. Dock, på grund av den kvantitet som denna data genereras i, kräver en helhetssammanställning en oerhörd insats.Därav avser detta arbete ge en grund för sammanställning av materielförluster genom att tillhandahålla en automatiserad process för att extrahera data från en befintlig databas. Detta har exemplifierats genom att nyttja bildkollektioner från Oryxspioenkop, en grupp bestående av militäranalytiker som fokuserar på sammanställning av grafiskt material. Utöver detta så kompletterar processen befintliga data genom att inkludera datumet då materielen dokumenterats. Därigenom ges även en kronologisk ordning för förlusterna.Processen visar lovande resultat och lyckas att effektivt och träffsäkert sammanställa stora mängder data. Vidare lyckas processen att överträffa sin manuella motsvarighet och visar på ett linjärt samband mellan antalet analyserade bilder och besparade mantimmar. Dock, på grund av den korta utvecklingstiden har processen fortfarande en del utvecklingsmöjlighet och förblir semiautomatisk, snarare än automatisk. Å andra sidan, eftersom processen bygger på öppen källkod, finns fortsatt möjlighet att uppdatera och modifiera processen för att passa annat källmaterial.Slutligen, i och med den kontinuerliga utvecklingen av artificiell intelligens och artificiellt genererade bilder,lyfter studien frågan om denna typ av data kommer vara en trovärdig källa i framtida analyser av materielförluster, eller om det kommer att förvandlas till verktyg för propaganda och påverkansoperationeri ett framtida krig.

The research focuses on the utilisation of open-source information in augmentation of the all-source counterespionage endeavour. The study has the principal objective of designing, contextualising and elucidating a micro-theoretical framework for open-source environmental scanning within the civilian, statutory counterespionage sphere. The research is underpinned by the central assumption that the environmental scanning and the contextual analysis of overt information will enable the identification, description and prioritisation of espionage risks that would not necessarily have emerged through the statutory counterespionage process in which secretly collected information predominates. The environmental scanning framework is further assumed to offer a theoretical foundation to surmount a degenerative counterespionage spiral driven by an over-reliance on classified information. Flowing from the central assumption, five further assumptions formulated and tested in the research are the following: (1) A methodically demarcated referent premise enables the focusing and structuring of the counterespionage environmental scanning process amid the exponential proliferation of overt information. (2) Effective environmental scanning of overt information for counterespionage necessitates a distinctive definition of ‘risk’ and ‘threat’, as these are interlinked yet different concepts. It is therefore asserted that current notions of ‘threat’ and ‘risk’ are inadequate for feasible employment within an overt counterespionage environmental scanning framework. (3) A framework for overt counterespionage environmental scanning has as its primary requirement the ability to identify diverse risks, descriptively and predicatively, on a strategic as well as a tactical level. (4) The degree of adversity in the relationship between a government and an adversary constitutes the principal indicator and determinant of an espionage risk. (5) The logical accommodation of a framework for overt counterespionage environmental scanning necessitates a distinctive counterintelligence cycle, as existing conceptualisations of the intelligence cycle are inadequate. The study’s objective and the testing of these five assumptions are pursued on both the theoretical and pragmatic-utilitarian levels. The framework for counterespionage, open-source environmental scanning and risk assessment is presented as part of a multilayered unison of alternative theoretical propositions on the all-source intelligence, counterintelligence and counterespionage processes. It is furthermore advanced from the premise of an alternative proposition on an integrated approach to open-source intelligence. On a pragmatic-utilitarian level, the framework’s design is informed and its application elucidated through an examination of the 21st century espionage reality confronting the nation state, contemporary statutory counterintelligence measures and the ‘real-life’ difficulties of open-source intelligence confronting practitioners. Although with certain qualifications, the assumptions are in the main validated by the research. The research furthermore affirms this as an exploratory thesis in a largely unexplored field. / Thesis (Ph.D)--University of Pretoria, 2010. / Political Sciences / Unrestricted

Nous modélisons une chaîne de traitement de documents comme un processus de décision markovien, et nous utilisons l’apprentissage par renforcement afin de permettre à l’agent d’apprendre à construire des chaînes adaptées à la volée, et de les améliorer en continu. Nous construisons une plateforme qui nous permet de mesurer l’impact sur l’apprentissage de divers modèles, services web, algorithmes, paramètres, etc. Nous l’appliquons dans un contexte industriel, spécifiquement à une chaîne visant à extraire des événements dans des volumes massifs de documents provenant de pages web et d’autres sources ouvertes. Nous visons à réduire la charge des analystes humains, l’agent apprenant à améliorer la chaîne, guidé par leurs retours (feedback) sur les événements extraits. Pour ceci, nous explorons des types de retours différents, d’un feedback numérique requérant un important calibrage, à un feedback qualitatif, beaucoup plus intuitif et demandant peu, voire pas du tout, de calibrage. Nous menons des expériences, d’abord avec un feedback numérique, puis nous montrons qu’un feedback qualitatif permet toujours à l’agent d’apprendre efficacement. / Information extraction (IE) is defined as the identification and extraction of elements of interest, such as named entities, their relationships, and their roles in events. For example, a web-crawler might collect open-source documents, which are then processed by an IE treatment chain to produce a summary of the information contained in them.We model such an IE document treatment chain} as a Markov Decision Process, and use reinforcement learning to allow the agent to learn to construct custom-made chains ``on the fly'', and to continuously improve them.We build a platform, BIMBO (Benefiting from Intelligent and Measurable Behaviour Optimisation) which enables us to measure the impact on the learning of various models, algorithms, parameters, etc.We apply this in an industrial setting, specifically to a document treatment chain which extracts events from massive volumes of web pages and other open-source documents.Our emphasis is on minimising the burden of the human analysts, from whom the agent learns to improve guided by their feedback on the events extracted. For this, we investigate different types of feedback, from numerical rewards, which requires a lot of user effort and tuning, to partially and even fully qualitative feedback, which is much more intuitive, and demands little to no user intervention. We carry out experiments, first with numerical rewards, then demonstrate that intuitive feedback still allows the agent to learn effectively.Motivated by the need to rapidly propagate the rewards learnt at the final states back to the initial ones, even on exploration, we propose Dora: an improved version Q-Learning.

In light of the emergence of social media, and its abundance of facial imagery, facial recognition finds itself useful from an Open Source Intelligence standpoint. Images uploaded on social media are likely to be filtered, which can destroy or modify biometric features. This study looks at the recognition effort of identifying individuals based on their facial image after filters have been applied to the image. The social media image filters studied occlude parts of the nose and eyes, with a particular interest in filters occluding the eye region. Our proposed method uses a Residual Neural Network Model to extract features from images, with recognition of individuals based on distance measures, based on the extracted features. Classification of individuals is also further done by the use of a Linear Support Vector Machine and XGBoost classifier. In attempts to increase the recognition performance for images completely occluded in the eye region, we present a method to reconstruct this information by using a variation of a U-Net, and from the classification perspective, we also train the classifier on filtered images to increase the performance of recognition. Our experimental results showed good recognition of individuals when filters were not occluding important landmarks, especially around the eye region. Our proposed solution shows an ability to mitigate the occlusion done by filters through either reconstruction or training on manipulated images, in some cases, with an increase in the classifier’s accuracy of approximately 17% points with only reconstruction, 16% points when the classifier trained on filtered data, and  24% points when both were used at the same time. When training on filtered images, we observe an average increase in performance, across all datasets, of 9.7% points.

<p>Technological advances have a profound impact on people and the world in which they live. People use a wide range of smart devices, such as the Internet of Things (IoT), smartphones, and wearable devices, on a regular basis, all of which store and use location data. With this explosion of technology, these devices have been playing an essential role in digital forensics and crime investigations. Digital forensic professionals have become more able to acquire and assess various types of data and locations; therefore, location data has become essential for responders, practitioners, and digital investigators dealing with digital forensic cases that rely heavily on digital devices that collect data about their users. It is very beneficial and critical when performing any digital/cyber forensic investigation to consider answering the six Ws questions (i.e., who, what, when, where, why, and how) by using location data recovered from digital devices, such as where the suspect was at the time of the crime or the deviant act. Therefore, they could convict a suspect or help prove their innocence. However, many digital forensic standards, guidelines, tools, and even the National Institute of Standards and Technology (NIST) Cyber Security Personnel Framework (NICE) lack full coverage of what location data can be, how to use such data effectively, and how to perform spatial analysis. Although current digital forensic frameworks recognize the importance of location data, only a limited number of data sources (e.g., GPS) are considered sources of location in these digital forensic frameworks. Moreover, most digital forensic frameworks and tools have yet to introduce geo-contextualization techniques and spatial analysis into the digital forensic process, which may aid digital forensic investigations and provide more information for decision-making. As a result, significant gaps in the digital forensics community are still influenced by a lack of understanding of how to properly curate geodata. Therefore, this research was conducted to develop a transdisciplinary framework to deal with the limitations of previous work and explore opportunities to deal with geodata recovered from digital evidence by improving the way of maintaining geodata and getting the best value from them using an iPhone case study. The findings of this study demonstrated the potential value of geodata in digital disciplinary investigations when using the created transdisciplinary framework. Moreover, the findings discuss the implications for digital spatial analytical techniques and multi-intelligence domains, including location intelligence and open-source intelligence, that aid investigators and generate an exceptional understanding of device users' spatial, temporal, and spatial-temporal patterns.</p>