WO2022092497A1

WO2022092497A1 - System for providing similar case information, and method therefor

Info

Publication number: WO2022092497A1
Application number: PCT/KR2021/009858
Authority: WO
Inventors: 양중식; 이영준; 염경록; 조영준
Original assignee: (주)아이와즈
Priority date: 2020-10-29
Filing date: 2021-07-29
Publication date: 2022-05-05

Abstract

A system for providing similar case information, according to the present invention, comprises an integrated security information data bank and a criminal knowledge network, searches for similar cases by combining main feature information of people and cases, and provides similar case information.

Description

Similar incident information providing system and method therefor

The present invention relates to a similar case information providing system and method, and more particularly, by combining main characteristic information of a person and an incident using a security information data bank and a criminal person knowledge network, search for similar cases and provide the information It relates to a similar event information providing system and method therefor.

There are various security information systems managed by the National Police Agency across the country and an integrated security information data bank, which is big data for security information accumulated in these systems for decades. Recently, an information provision system that utilizes such big data to investigate similar cases has been developed.

Since the conventional case investigation relies on the similar case resolution experience or search know-how of investigative personnel, there are individual differences in the investigation.

In order to solve the above problem, the present invention is to provide similar case information and related data to investigative personnel by searching for similar cases based on case and person.

The similar incident information providing system according to the present invention to solve the above problems includes an integrated security information data bank and a criminal person knowledge network, and the criminal person knowledge network identifies and extracts criminal suspects from unstructured documents and structured data a criminal suspect candidate extraction module; a criminal character inference module for inferring the criminal suspect as a criminal through learning of the criminal suspect extracted from the criminal suspect candidate extraction module; a criminal name classification module in the document for creating a node candidate list by integrating the criminal name inferred from the criminal person inference module and the criminal name extracted from the security information data bank; Create a human node with the names of criminals extracted from the criminal name classification module and related names extracted from the security information data bank, and reanalyze and reconstruct the case contents through the past criminal record information of the persons and the information related to similar cases. Including a criminal person knowledge network construction module that builds a criminal person knowledge network and an information support module that supports the criminal person knowledge network information to a user, search for similar cases by combining main characteristic information of a person and an event, and similar case information It is characterized in that it provides.

As another embodiment of the present invention, a similar incident information providing service method using a similar incident information providing system includes the steps of: inputting information related to a case currently under investigation; deriving main characteristics by analyzing cases and people in the criminal person knowledge network; It characterized in that it comprises the steps of searching for similar incidents in the integrated security information data bank by utilizing the derived main characteristics and providing information related to similar incidents to the user.

The step of deriving the main features based on the event may include: performing natural language processing analysis on the received information; It is characterized in that it comprises the steps of extracting the main keywords related to the event, and performing entity name recognition and tagging.

The step of deriving the main characteristics centered on the person may include: performing natural language processing analysis on the received information; It characterized in that it comprises the steps of performing tagging by extracting the life candidate related to the case and by classifying the position in the document for the human name.

The step of searching for similar events may include combining main characteristics and information centered on the event and person; retrieving past criminal records of major persons including the suspect; It characterized in that it comprises the steps of searching for an incident similar to the case input from the search result and the security information data bank, and storing the search result in the similar case information list.

Similar event search is characterized by using the TF-IDF similarity analysis algorithm.

obtaining additional case and person information related to the case input from the criminal person knowledge network; It is characterized in that it further comprises a similar incident expansion search step comprising the step of re-searching the similar incident in the integrated security information data bank by adding additional information and adding the additionally confirmed information to the similar incident information list.

The step of providing similar event-related information includes providing a list of similar event information searched for based on the event information input by the user and providing a visualization function for the convenience of identifying similarities with the inputted event. characterized in that

According to the present invention, by providing similar case information and related data to investigative personnel by searching for similar cases based on the case center and the person center, it is possible to conduct an accurate and fast investigation.

In addition, similar incident information can be provided quickly and accurately from the security information data bank by automating the similar incident search system.

1 is a conceptual diagram illustrating a similar event information providing system according to an embodiment of the present invention.

2 is a block diagram of a criminal person knowledge network according to an embodiment of the present invention.

3 is a flowchart of a service method using a similar event information providing system according to another embodiment of the present invention.

4 is a flowchart of the steps of deriving main features based on an event.

5 is a flowchart of a step of deriving a main characteristic centering on a person.

6 is a flowchart of the steps of searching for similar events.

7 is a flowchart of a similar event extension search step.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and contents described in the accompanying drawings, but the present invention is not limited or limited by the embodiments.

The present invention provides three-dimensional information by searching for similar incidents using various big data analysis techniques and search techniques based on an integrated security information data bank and a criminal person knowledge network.

1 is a conceptual diagram illustrating a similar incident information providing system according to an embodiment of the present invention. When incident information is input based on the integrated public security information data bank 200 and the criminal person knowledge network 100, it is a person-centered and event-centered It provides a visualization method that can identify similarities and lists of similar events by extracting key features and searching for similar events.

In the present invention, the integrated security information data bank is data collected from various security information systems managed by the National Police Agency across the country, and the criminal person knowledge network creates a life node with criminals and their related persons extracted from the integrated security information data bank. It is a system that provides three-dimensional information related to a suspect through information related to past criminal records and similar incidents.

Figure 2 is a criminal person inference inferred as a criminal through the configuration book of the criminal person knowledge network, a criminal name candidate extraction module 10 that identifies and extracts criminal suspects from unstructured documents and structured data, and the extracted criminal suspects The module 20, the integrated security information data bank 200 and the criminal name classification module 30 in the document for tagging the criminal and their related persons extracted from the biography dictionary and creating a node candidate list, the integrated security information data bank and the criminal name A knowledge network construction module that creates a human node with criminals and their related people extracted from the extraction module, and re-analyses and reconstructs the case contents through information related to past criminal records and similar cases to build a criminal knowledge network (40) and an information support module 50 that supports the criminal person knowledge network information to the user.

The atypical document of the candidate extraction module 10 includes investigation data, 112 report data, and a report.

The extraction target of the present invention may include semi-structured and structured documents, including unstructured documents.

Data is divided into structured, semi-structured, and unstructured data according to the degree of standardization. Structured data refers to data stored in a fixed field with a certain format, for example, data stored in DB or Excel, and semi-structured data is a fixed field. Although it is not stored in , it can be viewed as data including metadata or schema such as XML or HTML. , videos, comments, conversations divided by direct message (DM), KakaoTalk messages, smartphone GPS location information, etc.

The unstructured documents and structured data are analyzed through natural language processing technology, and criminal name candidates are extracted by referring to a pre-established biographical dictionary to create a list.

Natural language processing technology is one of the fields of automation technology in which machine learning (deep learning) is added to artificial intelligence technology. It is a calculation technique to automate human language analysis and expression.

By extracting the list of words around the extracted human candidates, it is checked whether the candidate is the real person, and the candidates identified as the person are stored.

In the above confirmation process, whether or not the nominative investigation is combined, whether the actor and the subject are marked, etc. may be included in the judgment items.

A nominative investigation means an investigation that points to the subject of an action, such as '△△goes', △△ is, or △△in(heard). It is more likely to be placed on the root node, which is the central node of the human node.

The actor-subject mark is an element that distinguishes which character is the actor and the subject through morphological analysis. can

The criminal character inference module 20 is a module for inferring a criminal suspect as a criminal through learning the location information of a specific suspect and age, gender, complex, language habits, etc., in order to generate an inference module with high probability You may need the advice of a profiler (criminal psychoanalyst).

The criminal name classification module 30 in the document performs the task of tagging the criminal persons extracted from the integrated security information data bank 200 and the biographical dictionary and their related persons, and creating a node candidate list.

The integrated security information data bank is big data of security information managed by the National Police Agency. It is used for case resolution or prediction and automatically builds a life dictionary, which is one of the main elements of integrated security information management. It is one of the public services that collects suspect information from various angles and provides information to users so that security information existing in other systems can be used as related information.

Through natural language analysis from the data of the integrated security information data bank, the location where the suspect's name appears in the document and the surrounding words appearing with the suspect are extracted and trained in the classification model.

Specifically, by using artificial intelligence technology, the people appearing in the new input document are classified into suspects and people around them, and what kind of relationship the people around them have with the suspect is automatically analyzed.

The input documents are atypical documents such as police reports or case documents, but they are highly structured documents with a high probability of being structured to a certain extent. It is possible to automatically classify and tag the positions or roles that the persons extracted by learning with the document have in the document.

For example, 'Around 15:30 on November 1, 2019, the suspect Hong Gil-dong broke into the studio while Kim Chul-su was away from the studio in Geumcheon-gu, Seoul and stole money worth 1 million won. The result of automatic tagging is 'Hong Gil-dong/Suspect, Kim Cheol-soo/victim, and Lee Young-hee/reporter' from the case document 'At the scene of the report of Lee Young-hee, a neighbor who found it strange that Kim Cheol-soo's house, which was usually quiet, was disturbing.'

In addition, since the system for verifying the correct rate of the classification model is included in the criminal name classification module 30, it is frequently tested whether the correct rate of the classification model is higher than or equal to the reference value, and if it is less than the standard, the process of re-learning is repeated until it becomes higher than the standard value. . The standard correct answer rate can also be set through expert advice.

In addition, the standard probability value after expert advice is applied in the tagging process for criminals and related persons. That is, the suspects are classified in the order of highest probability, and those with probability values greater than or equal to the standard are tagged with their respective statuses, and those with lower than the standard are tagged with other classifications. It is desirable to allow the user to view and edit all status tags.

The knowledge network building module 40 creates a human node with the criminals and their related persons extracted from the integrated security information data bank and the criminal name extraction module, and the case contents through past criminal record information and correlation information with similar cases Reanalyze and reconstruct the criminal character knowledge network.

In the creation of human nodes, each human information is noded through the human name information list for the integrated security information data bank, which is the security information big data managed by the National Police Agency, and the criminal name candidates constructed by extracting and constructing natural language processing technology from unstructured and structured data. It specifies the relationship between human nodes through the status classification tag in the document.

The process first creates a root node using the suspect information, and personal information other than the suspect is created and stored as a subnode of the root node according to the relationship with the root node, and the relationship between the nodes is indicated by using the status tag in the document. will do The root node is the central node in the criminal knowledge network, and is the first node to be created and a suspect candidate.

For reference, a node corresponds to a point in a graph of a tree structure consisting of points and lines. The highest node is called a root node and the lowest node is called a leaf. In a data communication network, it is one or more functional units connected to a data transmission path and mainly refers to a branch point of a communication network or an access point of a terminal. In the present invention, a node is mapped with personal information such as a suspect, an accomplice, a victim or a reporter, and a line indicates a relationship between them.

Building a criminal knowledge network is to search for the suspect's past criminal record information in the integrated security information data bank, analyze the information, collect relevant information, reconstruct the data according to the schema based on the six-fourth principle, and store it in the criminal name node. .

The criminal person knowledge network is constructed by extracting basic information from the documents input by the user to compose basic information about the suspect, and for insufficient matters, supplementary data is obtained from the data bank and basic information is prepared; As basic suspect information, if the suspect's past criminal record exists as a result of the data bank search, the record is analyzed and the original document for the case is generated as a past incident node; Creates human nodes of past events as sub-nodes of past event nodes, summarizes event contents according to schema based on the six-fold principle, for example, person, time, place, event, motive, method, etc. to provide an easy access to the gist of past events; modify the node using the additional information and build a criminal knowledge network; Separately from the suspect, through similarity analysis techniques such as keyword extraction and TF-IDF, an event record similar to the event shown in the document entered by the user is searched for, and the original document of the similar case is created as a similar event node by analyzing the record. generating life nodes for the similar event as sub-nodes of the similar event node; When analyzing similar events, summarize the contents of the event according to the schema based on the six-fold principle, for example, person, time, place, event, motive, method, etc. and provide the information to the user so that the main points of the similar event can be easily grasped; It refers to modifying nodes with additional information, expanding the criminal knowledge network, and so on.

Among the similarity analysis techniques, Term Frequency-Inverse Document Frequency (TF-IDF) is an algorithm that calculates the similarity between sentences based on the frequency of words and the specificity of words.

The information support module 50 provides a user with a choice between selecting a suspect's name and selecting a person with the same name to the user, and provides a criminal information support service for the target selected by the user.

The information support module provides a visualization of all the contents analyzed by the system or the criminal person knowledge network narrowed by the user through an intermediate option, and displays the contents summarized in the six-fold principle when clicking on a past case or similar case or view the original text When clicking each node, such as displaying the original text, the detailed information connected to it is displayed, and items with a high degree of similarity to the root suspect are expressed by using different colors or line thickness to allow the user to track the content related to the suspect. It supports easy access, establishes a criminal person knowledge network that expands by connecting people related to the case, such as accomplices, witnesses, and victims, with the suspect information as the central node, and manages so that users can modify the criminal person knowledge network providing tools, etc.

The visualization service in the information support module provides a visualization tool using a web browser or VR (virtual reality) based on the criminal person knowledge network.

The web browser visualizes the collection status and statistical information according to the monitoring results with various charts and graphs, and configures the web to provide services.

VR uses 3D or augmented reality development tools such as Unity to virtualize monitoring results and reflects them on the implemented virtual space engine. The user provides visualization services such as various charts and graphs for the collection status and statistical information according to monitoring results through interworking with VR devices, and provides related data search results through actions such as clicking and moving data in the form of nodes and networks do.

As another embodiment of the present invention, a service method using a similar case information providing system including an integrated security information data bank and a criminal person knowledge network includes the steps of inputting information related to a case currently under investigation, as shown in FIG. It includes the steps of deriving main characteristics by analyzing the case and the person, using the derived main characteristics to search for similar incidents in the integrated security information data bank, and providing users with similar incident-related information.

The steps of deriving the main characteristics centering on the event are as shown in FIG. 4, and the steps of performing natural language processing analysis on the received information, extracting major keywords related to the event, and performing entity name recognition and tagging are performed. include

The steps of deriving the main characteristics centering on the person are as shown in FIG. 5, and the step of performing natural language processing analysis on the input information, the step of extracting the human candidate related to the event, and the classification and tagging of the status of the person in the document It includes the step of performing

The human candidate extraction extracts the surrounding vocabulary of the human candidate by processing natural language processing whether the nominative investigation is combined and whether the actor and the subject are marked, and checks whether the human candidate is really a human name.

In tagging a person, the position with the highest probability value is tagged as the person's position, and when the probability value is less than the standard value, other classification is tagged. The tagging of a status is viewable and editable by the user.

The step of searching for a similar case is as shown in FIG. 6, a step of searching for a similar event in the security information data bank based on the extracted main characteristics and information, a step of combining the main characteristics and information centered on the case and person, and the main person (suspect etc.), searching for a similar case to the case input from the search result and the security information data bank, and storing the search result in a similar case information list.

Similar event search uses a similarity analysis algorithm such as TF-IDF.

In the present invention, similar cases can be searched for in a wider range as shown in FIG. 7 by utilizing the criminal person knowledge network. The similar case expansion search step includes the steps of acquiring additional case and person information related to the case input from the criminal person knowledge network, the step of re-searching the similar case in the integrated security information data bank by adding additional information, and comparing the additionally confirmed information. adding to the event information list.

The step of providing similar event-related information includes providing a list of similar event information searched based on the event information input by the user, and providing a visualization function for the convenience of identifying similarities with the inputted event. .

The visualization function can highlight the main characteristic information extracted for the search for similar events in the search result, or provide it with a web browser or VR.

[Explanation of code]

10: Candidate extraction module 20: Criminal character inference module

30: Criminal classification module 40: Knowledge network building module

50: information support module

100: criminal person knowledge network 200: integrated security information data bank

Claims

In the similar case information providing system comprising an integrated security information data bank and a criminal person knowledge network, the criminal person knowledge network comprises:

a criminal suspect candidate extraction module for identifying and extracting criminal suspects from unstructured documents and structured data;

a criminal character inference module for inferring the criminal suspect as a criminal through learning of the criminal suspect extracted from the criminal suspect candidate extraction module;

a criminal name classification module in the document for creating a node candidate list by integrating the criminal name inferred from the criminal person inference module and the criminal name extracted from the security information data bank;

Create a human node with the names of criminals extracted from the criminal name classification module and related names extracted from the security information data bank, and re-analyze and reconstruct the case contents through the past criminal record information of the persons and the information related to similar cases. A criminal person knowledge network building module and

Including an information support module that supports the criminal person knowledge network information to the user,

A similar event information providing system, characterized in that by combining main characteristic information of a person and an event, similar cases are searched for and similar event information is provided.
In the similar event information providing service method using the similar event information providing system of claim 1,

inputting information related to the case currently under investigation;

deriving main characteristics by analyzing cases and people in the criminal person knowledge network;

Using the derived main characteristics to search for similar incidents in the integrated security information data bank and

A similar event information providing service method comprising the step of providing similar event related information to a user.
3. The method of claim 2,

The step of deriving the main characteristics based on the event is,

performing natural language processing analysis on the received information;

extracting key keywords related to the incident; and

A similar event information providing service method comprising the step of performing entity name recognition and tagging.
3. The method of claim 2,

The step of deriving the main characteristics centering on the character is

performing natural language processing analysis on the received information;

extracting human candidates related to the case; and

A similar event information providing service method comprising the step of performing tagging by classifying the status of the person in the document.
3. The method of claim 2,

The steps to search for similar events are:

combining event- and person-oriented key features and information;

retrieving past criminal records of major persons including the suspect;

Searching for a case similar to the case input from the search results and the security information data bank; and

A similar event information providing service method comprising the step of storing the search result in a similar event information list.
5. The method of claim 4,

A similar event information providing service method, characterized in that the similar event search uses a TF-IDF similarity analysis algorithm.
3. The method of claim 2,

obtaining additional case and person information related to the case input from the criminal person knowledge network;

Re-searching for similar incidents in the integrated security information data bank by adding additional information; and

Similar event information providing service method, characterized in that it further comprises a similar event expansion search step comprising the step of adding the additionally confirmed information to the similar event information list.
3. The method of claim 2,

The steps of providing information related to similar events are:

providing a list of similar incident information searched based on the incident information entered by the user; and

A similar event information providing service method comprising the step of providing a visualization function for the convenience of identifying similarities with the inputted event.