An Analysis of Data Mining Applications
in Crime Domain
P. Thongtae and S. Srisuk
Abstract— In this paper, we give comprehensive surveys of
efficient and effective methods/techniques on data mining for
crime data analysis. These techniques aim at finding the illegal
activities of professional identity fraudsters based on knowledge
discovered from their own histories. We also raise some
problems of applied data mining in crime control and criminal
suppression. It is known that detecting crime from data analysis
can be difficult because daily activities of criminal generate
large amounts of data and stem from various formats. In
addition, the quality of data analysis depends greatly on
background knowledge of analyst. A criminal can range from
civil infractions such as illegal driving to terrorism mass
murder such as the 9/11 attacks, therefore it is difficult to model
the perfect algorithm to cover all of them. Finally, this paper
proposes a guideline to overcome the problem.
Index Terms—Crime data, Crime data mining, Crime
control, Criminal suppression
I. INTRODUCTION
Data mining is a powerful technique with great potential
to help criminal investigators focus on the most important
information in their crime data. The knowledge discovered
from existing data leads to reveal a value-added of its
information. Successful data mining methodology depends
heavily on the particular choice of techniques used by
analyst. Their practical applications are, for example, the
criminal investigation, market sale prediction and playing
behavior analysis in sport games. However the more data and
more complex queries being processed and maintained, the
more powerful the system is required. This includes the
capability of the system to analyze large amount of data and
complex information from diverse sources
In crime control of the law enforcement, there are many
storage data and formats that have to be discovered. When its
quantity has grown, it is difficult to analyze and search some
new knowledge from them. Therefore, the data mining is
applied to crime control and criminal suppression by using
frequency occurrence and distance method under which these
assumptions can be accomplished. All these techniques give
results to benefit investigators in searching behavioral
patterns of professional criminal.
P. Thongtae is with the Department of Computer Engineering,
Mahanakorn University of Technology, Bangkok THAILAND. (e-mail:
securitythai@gmail.com).
S. Srisuk is with the Department of Computer Engineering, Mahanakorn
University of Technology, Bangkok THAILAND. (e-mail:
sanun@mut.ac.th).
The applications in law enforcement from data analysis
can be categorized into two critical elements, crime control
and criminal suppression. Crime control tends to use
knowledge from the analyzed data to control and prevent the
occurrence of crime, while the criminal suppression tries to
catch a criminal by using his/her history recorded in data
mining.
Brown [2] has constructed a software framework for
mining data in order to catch professional criminals. They
proposed an information system that can be used to catch the
criminals in their own regions. The software can be used to
turn data into useful information with two technologies, data
fusion and data mining. Data fusion manages, fuses and
interprets information from multiple sources, and it
overcomes confusion from conflicting reports and cluttered
or noisy backgrounds. Data mining is concerned with the
automatic discovery of patterns and relationships in large
databases. His software was called ReCAP (Regional Crime
Analysis Program), which was built to provide crime analysis
with both technologies.
When the terrorism was exploded by 9/11 attacks, concern
about national security has increased significantly and the
world has changed forever. The strategic against a terrorist
must be more advanced in order to prevent suicide attacks
from their stratagem. In the congressional conference, Robert
S. Mueller – The director of investigative department of FBI,
indicated that the excessively emphasize to catch the criminal
with slightly attention for crime control is the main problem
of law enforcement in the world [4]. It is more interesting
now in data gathering for criminal control plan.
Abraham et. al. [1] proposed a method to employ computer
log files as history data to search some relationships by using
the frequency occurrence of incidents. Then, they analyze the
result to produce profiles. The profiles could be used to
perceive the behavior of criminal. It should be noted that the
types of crime could be changed over time influenced by the
variations of globalization and technology. Therefore, if we
want to prevent the crime efficiently, the behavior must be
used with another kind of knowledge. We need to know the
crime trends. de Bruin et. al. [3] introduced a new distance
measure for comparing all individuals based on their profiles
and then clustering them accordingly. This method yields a
visual clustering of criminal careers and enables the
identification of classes of criminals. They demonstrated the
applicability of data mining in the field of criminal career
analysis. Four important factors play a role in the analysis of
criminal careers: crime nature, frequency, duration and
severity. They also develop a specific distance measure to
combine this profile difference with crime frequency and
change of criminal behavior over time. The matrix was
created that describes the amount of variation in criminal
careers between all couples of perpetrators. The data analysis
can be used to determine the trend of criminal careers. Nath
[6] proposed a method for data partitioning in order to use
them to present in the form of geographic map. We could
decide the data partitions to be the trend of offend across
many areas.
The organization of this paper is as follows. Section II
describes a literature review on popular techniques that are
used in data mining for crime analysis. Relevant research is
presented in section III. We give a discussion in section IV.
Finally, section V concludes the research issues in data
mining.
II. LITERATURE REVIEW
A. Popular Techniques in the Data Mining
Several techniques have been proposed for solving a
problem of extracting knowledge from explosive data, each
of which adopts different algorithm. One of the areas where
information plays an important role is that of law
enforcement. Obviously, the growing amount of criminal
data gives rise to various problems including data storage,
data warehousing and data analysis. The main ideas, used in
data mining, can be categorized as follows [4]:
1. Association Mining
A main idea of association mining technique is to search a
relationship of attributes and tuples, by discovering
frequently occurring item sets in database. A result is patterns
described as rules that represent one-way relationship.
Furthermore, result rules consist of a confidential value and
support value, a value of which is used to identify the pattern.
The support is a number of instances that complies with the
rules, whereas the confidential is a percentage of instances
that must likewise be complied by rules. In basket analysis,
for example, the association mining is a customer’s behavior
analysis that determines the products the customer frequently
buy together.
2. Classification and Prediction
The classification and prediction approaches are based on
a divide-and-conquer technique by which the data are
grouped and missing values are predicted. The data, with
sharing common properties among different crime entities,
are specified into predefined classes. A main target
application is credit card approval, target marketing and
medical diagnosis.
3. Clustering
Clustering is a method to group data into classes with
identical characteristics in which the similarity of intra-class
is maximized or minimized. An investigator may use this
technique to identify suspects who conduct crimes in similar
ways or discriminate among groups belonging to different
gangs. A distance measure is often used as a data partitioning
function. However, in clustering technique data are usually
not label in advance.
B. Data Mining Processes
1. Data Preprocessing
A data preprocessing is a data gathering, which is collected
from various sources. The preprocessing process consists of
data cleaning, data integration and data transformation which
is usually processed by a computer program. It intends to
reduce some noises, incomplete and inconsistent data. The
results from preprocessing step can be later proceeding by
data mining algorithm. Some approaches of data
preprocessing are regression and sampling.
2. Data mining primitive
A data mining primitive defines data mining tasks as what
we perform in data mining process. It depends on a
hypothesis of analyst and how we want to prove that
hypothesis. It is likely a guideline that we must choose before
we actually do the data mining process. The data mining
primitive consists of many procedures as follows:
2.1 Task-relevant data: It defines which data we are
interested in their dimensions and attributes. It also defines a
data grouping criteria for data aggregation, such as data cube.
2.2 Type of knowledge: It defines data mining techniques
that are best suited for a problem at hand. The types of
knowledge are characterization, discrimination, association,
classification/prediction, clustering and outlier-analysis.
2.3 Background knowledge: It is a predefined rule set for
making a decision in data mining. Examples of which is size
of street is smaller than size of city and the age between 20
and 39 is identified as young. This can be defined by using a
common rule set or fuzzy set indicating a level of condition.
2.4 Measurements of pattern interestingness: A
measurement of pattern interestingness is criterions to
determine a level of interest. There are many factors that are
used in measurements including simplicity, certainty, utility
and novelty. In addition, an evaluation in the level of interest
depends heavily on knowledge of researchers. For instance,
if relation rule is too long and the level of interest (support
value) is low, then researcher may ignore this rule because it
is low interesting.
2.5 Visualization of discovered patterns: Visualization of
discovered pattern is a form of result from data mining in
which the outcome is being display. There are various forms
that would be appropriate for the knowledge background of
researcher. The examples of visualizations are relation rules,
graphs, pie/bar chart and tables.
As mentioned before, the data mining primitive must be
proceed before we actually start to perform data mining
process. Some tasks are normally related. For example, if we
choose the type of knowledge to be “association”, we also
determine in the length of rules and “support value” as
measurements of pattern interestingness. The visualization is
the relation rules.
3. Data mining
The final step is the data mining process which is used to
extract hidden predictive information from large crime
database. Data mining tools predict future trends and
behaviors of criminals, allowing investigators to make
knowledge-driven decisions. It can be implemented rapidly
on software and hardware platforms to enhance the value of
existing information. When data mining is developed in a
high performance computer or a complex grid computing, it
can be used to analyze massive crime data to deliver answer
to investigators such as "Where is the highest probability of
crime occurrences in Friday?" The result is then evaluated to
determine the value of knowledge.
III. RELEVANT RESEARCH WORK
A. The Regional Crime Analysis Program
In 1998, the USA law enforcement increasingly required a
database management system and a geographic information
system to support their crime analysis. Newly crime analysts
manually used these systems to search an interesting data.
They then analyzed data in order to discover its relationship.
Finally, the result from data analysis could be used to display
on the geographic map [2].
A great experiment of laborious research on data mining
with crime data analysis has been explored in the same year.
Charlottesville City and Albemarle County areas were a
relatively safety community within a central Virginia. The
number of reported criminal incidents in this area was
typically 30,000 events per year. In contrast, Richmond City
alone has approximately 100,000 events of incidents per
year. The analyst needed to get the details of data such as
where incidents occurred and when. They needed to query
incidents from database management system in order to
generate all reports. Then, the results queried from database
are turned into useful information to display on the
geographic map and to determine the pattern of relationships.
It should be noted that, it took three minutes to search and
analyze and took five queries per report. Therefore, the
analyst might spend 450,000 minutes for Charlottesville City
and 1.5 million minutes for Richmond City. Clearly,
manually analysis of crime data is infeasible.
The data mining is therefore a must choice that can be
used to support a geographic information system. It reduces
data analysis time consuming and enlarges a frontier of crime
analysis. The knowledge from crime analysis can be
available by which the data mining is used as a core process
in data analysis.
Brown [2] proposed a framework for regional crime
analysis program (ReCAP). The data mining was adopted as
an algorithm for crime data analysis. The core concept of
ReCAP program consists of:
4.1.1 Meta-Data: A data context described about data itself
such as pistol data and periodic report.
4.1.2 Process and Display: An analysis process of data
such as database querying and clustering algorithm. A
displaying system is a graphical information system that is
used to turn data into useful spatial information.
In figure 1, the system is a general data mining, its
structure is aimed to be used in geo-graphic data mining. In
addition, the author provides a software framework for
spatial data mining. This method employs two significant
technologies, GIS and DBMS, to support a broader range of
crime analytical function. Information queried from
geo-graphic data consume a long period of time. Therefore, if
we can construct a technique to filter data such as eliminating
a small side road that we could not see, the analyst would
concentrate on searching relationship of more important data
rather than a redundant one. Normally, an analysis in
geo-graphic data is harder than a query process in database
system, such as an attributed matching based on distance
measure is computed as line of sight, travel distance and its
shortest path. Hence, its computation is much more complex
than querying in usual database system. In addition, the
results from geo-graphic data mining can be applied
immediately in crime analysis to identify when and where the
crime occurs. Spatial data mining from GIS and DBMS
systems enables investigators who may lack extensive
training as data analysts to explore a large crime database
with a useful geometric data for law enforcement.
ReCAP Data Flow Diagram
Routine Reporting
Pistol 2000 Analysis Database Visual Basic
Visual FoxPro Visual FoxPro
Geographic
Database Clustering
Information System Control Charting
Querying MapInfo Visual Basic
Algorithms
Visual Basic
Visual Basic Visual Basic
Printed Results
Disk Storage
Graphical User Interface
Visual Basic
Figure 1: A diagram of ReCAP [2]
It should be emphasized that this is not a new approach in
data mining. It is only a feasible framework in development
process. However, one attractive feature of the approach is
that knowledge from data analysis can be presented in a form
of geo-graphic map.
B. Investigative Profiling
Investigative profiling can be narrowly used to discover
one or many criminals. It can also be used to search
knowledge from a large amount of data. Normally,
association rules are frequently used to search customer
personalization, by providing a relationship between items.
In a marketing research, this technique can be used to search
pleasure and behavior of consumers, i.e., their buying
pattern. Therefore, retailers can conclude from relationship
and offer products or services to individual, and lastly a
personal profile can be created from customer buying pattern.
In 2002, a profiling technique has been applied in order to
solve a problem in an investigation analysis. They interpreted
the results from data mining as an association rule sets which
is created from log data. The researcher then analyzed them
to create the perpetrator profiles.
Typically, the perpetrator profiling can be categorized into
two types, actual and behavior profiles. Example of actual
profile name is status of hiring and username, and of behavior
profile is log file transactions, header and body of electronic
mail and call recording. By creating profiling by using

association rules, the results are the rules of relationship in
the same or different profile type. For example, a rule
(StaffType = admin) ^ (DayofWeek = tuesday) ^
(Application = database) ⇒ (Access = valid)
is a relationship between actual profile (admin) and behavior
profile (access time). The meaning of this rule is that “the
administrator has authorization to access the database
program.”
In an analysis process, log files can be obtained from
various computers and network devices such as system log
files, database log files and personal user files. The log files
are then processed by using association mining rules, the
results present in the rules of profile relationship. However,
the rules are the item set that usually created with support
value. The remaining rules are pruned. Additional technique
is used as “contrasting raw data to profiles” in order to
change unexpected information to be profiles again. Hence, it
is possible to represent profiles as abnormal behavior of user.
Accordingly, investigative profiling by the association
mining rules can be used to discover the pattern of crime that
is frequently occurred. It can also reveal the behavior that is
hidden or abnormal. By using this technique, the factor of
crimes can be clearly illustrated such as environments,
properties of victims and criminal types. In particular,
knowledge from investigative profiling leads to a plan for
preventing and destroying opportunities of crime.
However, in this method the relevance of attributes must
be selected by analyst before actually mining process.
Therefore, the results of data mining also depend on the
background knowledge of the analyst.
C. Data Mining Approaches to Criminal Career Analysis
The criminal career analysis is an analyzing of data in
order to determine a trend changing in offended behavior. In
2006, the interested attributes were extracted from criminal
profiles, example of which is crime nature, frequency,
duration and severity. The interested attributes is then
processed by a clustering technique. Firstly, this technique
determines percentage of severity in each crime type as
shown in Table 1.
Crime type Traffic Financial … Sex
Crimes Crimes Crimes
Severity minor minor … severe
Percentage 0.0 0.6 … 0.1
Table 1: A criminal’s profile [3]
Next, the algorithm calculates the difference in each
profile class such as crime nature and severity (Table 2). It
then sums all of difference which is computed with a number
of crimes for one year. The result is a difference of criminal
career as two separated data groups, the first one is a general
street crime the other is a serious crime.
Crime Nature Difference
Ind. 1 0.1 0.0 0.0 0.0 0.5 0.4 0.0 0.0
Ind. 2 0.0 0.2 0.1 0.0 0.4 0.3 0.0 0.0 summed
Diff. 0.1 0.2 0.1 0.0 0.0 0.0 0.0 0.0 0.6
Crime Severity Difference
Minor Intermediate Severe
# Fac. # Fac. # Fac. Summed
Ind. 1 0.1 1 0.5 2 0.4 3
0.1 1.0 1.2 2.3
Ind. 2 0.3 1 0.4 2 0.3 3
0.3 0.8 0.9 2.0
Diff. 0.3
Total Profile Difference: 0.9
Table 2: The calculation for difference of crime nature and
severity [3]
Therefore, if the criminal profiles are analyzed for each
year, the trends of criminal career and crime varying would
be revealed. The results from this knowledge discovery can
be used to define the priority in which what types of victim
must be protected. However, this method is time-consuming,
it is therefore not appropriate to use this algorithm with an
enormous data.
D. Crime Pattern Detection Using Data Mining
Nath [6] outlined a new approach for crime pattern
discovery. It is rather complex because the system searches
knowledge from a huge data. Each record is composed of
many attributes which describes the crimes, such as
date/time, location, outline, demographic and weapon.
However, only a small portion of which relates to illegal
activities which is useful for crime pattern construction.
Clustering techniques group entities into classes with
similar characteristics, i.e. data in similar characteristic is
defined to be the same class. Each group is then shown on
geo-spatial information which describes distribution of crime
with different colors.
The results from a clustering technique can be used to
identify escape criminal. Incidents of the same group may
have some relationships rise from suspects who conduct
crimes in similar ways. Therefore, evidences from the
incidents can be proved that it is collected from the same
group. For instance, injured person in the incident said that
the offender was black hair, a witness said that the offender
was middle age, and injured person confirmed that he saw a
tattoo on the offender’s left arm.
Hence, the law enforcement can take this technique to
analyze the pattern of crime data, by which the knowledge is
used to catch the escape offender.
IV. DISCUSSION
We can conclude from a comprehensive survey that most
of works analyze large amount of crime data. The algorithm
in meta-data and data mining techniques will be selected
based on background knowledge of analyst. Therefore, it is
possible to choose inappropriate data items which turn into
redundant work when they must repeatedly performing
experiments. As a result, knowledge from crime analysis in
data mining depends heavily on the background knowledge
of analysts.
However, most of analysts may have a computer skill but
they may lack extensive training on discovering the key
factors in crime analysis. Moreover, they can not make sure
that the result from crime data mining is best suited for real
situation in criminal investigations. Finally, they may do not
know that how to use it in practice.
We believe that the statistical method can be used to solve
the addressed problem. There are two interesting issues that
the statistical method can be applied in the future research
work. The first one is an attribute selection in which time
consuming can be reduced. It also helps to decide which data
mining technique can be adopted. The second one is the
quality assessment in the result of the crime data mining. It
can be used in appropriate situation so that a more quality
better could be obtained.

V. CONCLUSION
Data mining has been as active research area for a last
decade. We have shown its usefulness to a variety of tasks
including crime control and criminal suppression. It should
be pointed out that the result from data mining process is
useful knowledge that may be changed over time. In a
conventional system, they started by proposing a design and
development processes of information system for catching
criminal, so the data mining was just a database system based
SQL query command. When we were entered to a terrorism
era, the data mining has become to be knowledge discovery
for crime pattern understanding. Several data mining
techniques have been adopted in order to conquer with
terrorist. For example, the mining association rules can be
used to create the offender’s profile. The clustering technique
composes of two subsequent methods. The first one is the
partitioning which is a method to compute a difference of
crime career. We can also perceive the trends of crime pattern
that changes over year. The second one is data classification
in which the data in similar characteristics is classified as the
same group. Therefore, it can be used to identify the escape
offender. It is very encouraging finding that the crime pattern
understanding can be discovered from data analysis. Finally,
it is also possible to construct a novel method where the
quality of research is conducted from crime prediction point
of view.

REFERENCES
[1] T. Abraham and O. de Vel, "Investigative profiling with computer
forensic log data and association rules," in Proceedings of the IEEE
International Conference on Data Mining (ICDM'02), pp. 11 – 18,
2006.
[2] D.E. Brown, "The regional crime analysis program (RECAP): A
frame work for mining data to catch criminals," in Proceedings of the
IEEE International Conference on Systems, Man, and Cybernetics,
Vol. 3, pp. 2848-2853, 1998.
[3] J.S. de Bruin, T.K. Cocx, W.A. Kosters, J. Laros and J.N. Kok, “Data
mining approaches to criminal career analysis,” in Proceedings of the
Sixth International Conference on Data Mining (ICDM’06), pp.
171-177, 2006.
[4] J. Han and M. Kamber, “Data Mining: Concepts and Techniques,”
Morgan Kaufmann publications, pp. 1-39, 2006.
[5] J. Mena, “Investigative Data Mining for Security and Criminal
Detection”, Butterworth Heinemann Press, pp. 15-16, 2003.
[6] S.V. Nath, “Crime pattern detection using data mining,” in
Proceedings of the 2006 IEEE/WIC/ACM International Conference
on Web Intelligence and Intelligent Agent Technology, pp. 41-44,
2006.