Use Case and Examples

How can the Imagefilter API help Intelligence Solution to make better data discovery and analytics.

Image Object Detection to Trace Illegal Trading

Image objects that imply illegal context

Our system analyzes images in the dark networks and finds different types of objects that can directly refer to illicit contexts, such as:

  • Pill, Powder - usually implies drug trafficking
  • Gun, Knife - weapon, usually implies weapons trafficking
  • Credit-Card - usually implies illegal carding
  • Boy, Girl, Child - usually implies sexual or pedophile context

Example:

Searching powder typed object in images crossed with site typed market that includes the author:

Query: image_label:powder AND author:* AND site.type:market

Results:
Posts that include cocaine (powder) in their images attached to the posts were discovered.
An example of how the image appears:

Here is a sample from the Cyber API that includes the CyberDoc Object returned with the image analysis.

{
      "url": "http://fdwmarkzfbfjq4lykg64qlxttgtnmntyst...",
      "uuid": "edac6ec00756e2add1f13aa9e4f0d9a7d613d47a",
      "parent_uuid": "edac6ec00756e2add1f13aa9e4f0d9a7d613d47a",
      "title": "Top 3 Boutique Mieux Noté!!! ...",
      "text": "Prix en € 60,00 Prix en ฿ 0,00857534 isback pour le ...",
      "author": [
        "isback"
      ],
      ....
        "ord_in_thread": 0,
      "extended": {
        "external_images": [
          {
            "url": 
            "http://image.noelshack.com/fichiers/2019/19/3/1557340566-i-hgzu.jpeg",
            "meta_info": 
            "/imageFilter?token=bd585cce-fac4-468a-811c-1a17ef2032b3&format=json&q=uuid:234504359941279182823851792283667620680",
            "uuid": "234504359941279182823851792283667620680",
            "label": [
              "Food",
              "Text",
              "Powder",
              "Flour"
            ],
			....

Geo-Fence based on images

Geo-Fence query is capable of querying based on a geographical rectangle of the data.

Our system extracts metadata from the images such as camera model, author, description, GPS location and more. In some of the cases cybercriminals "forget" to remove such information from the image.
Using geo fence we can monitor or trace images originated in a specific region.
Example use of geo=fence:

  • Countrywide monitoring for intelligence
  • A sensor in a fusion multi-source solution
  • Border-based monitoring and complementary to a tactical solution

Example:

Searching Germany for GPS-based images

Query: http://webhose.io/imageFilter?token=[YOUR TOKEN]&format=json&q=*&tl_lat=54.629056&tl_lon=4.102915&br_lat=47.664709&br_lon=14.148460&latest=true

Results:
Found 47 images in the given location, one of the latest images (from May 17, 2019) is from a racist attack in Prignitz, Germany.

The image as it appeared:

Sample data from the ImageFilter JSON data.

{
uuid: "206525643603358088456973862383038943159",
label: [ "Nature","Text","Person","Human","Outdoors","Banner",],
width: 624,
height: 312,
description: "<  (muymmm Iery Smmnmne Naz >",
creation_date: null,
modify_date: null,
bits_pixel: null,
compression: null,
mime_type: "JPEG",
endianness: null,
gps_info: [ ],
artist: "ppl tmk",
copyright: "usage Germany only, Verwendung nur in Deutschland",
iptc: {
object_name: "30815930",
city: "Neuruppin",
province_state: "Brandenburg",
country: null,
category: null,
},
...
related_docs: "/cyberFilter?token=349d24b0-a943-41a2-ba58-cdf40fca4afe&format=json&q=related_image_docs:206525643603358088456973862383038943159&latest=true",
crawled: "2019-05-17T11:04:33.000+02:00",
},

Image UUID as a unique identifier to catch vendors

Image UUID is a unique hash-code that identifies it across all dark networks

In the case where a vendor publishes his logo/banner in a marketplace or a forum, the vendor can use the same banner across different networks.
Using the unique hash-code generated to the image, one can track it over multiple places and find the same vendor in different marketplaces/networks. This can help:

  • Find additional identifiers to validate an actor/vendor
  • Cross-check vendor names over different marketplaces
  • Monitor vendor activity

Example:

  • Step 1: Find PayPal illicit activity of a vendor named Tarasen
    Query: title:"PAYPAL" AND image_label:"credit-card" AND author:Tarasen
  • Step 2: Per specific image found, find all domains this specific image uuid appears in
    Query: images.image.uuid:124593016764352258034172533819092527344
    Results: 6 different TOR based domains where this vendor trades their stolen cards

Here are the domains:

Here is the image published by the vendor Tarasen:

Use Case and Examples


How can the Imagefilter API help Intelligence Solution to make better data discovery and analytics.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.