Internet Auction Fraud Investigations

brewerobstructionAI and Robotics

Nov 7, 2013 (3 years and 7 months ago)

93 views

Internet Auction Fraud Investigations


Michael Y.K. Kwan
2
,
Richard
E.
Overill
1
, K.P. Chow
2
,

Jantje A. M. Silomon
1
,

Hayson Tse
2
,
Frank Y.W. Law
2
, and Pierre K.Y. Lai
2


1

Department of Computer Science, King’s College London, Strand, London WC2R 2LS, U.K.

2

Department of Computer Science,
The University of
Hong Kong, Hong Kong
.


{
richard.overill
,
jantje.a.silomon}@kcl.ac.uk
,

{ykkwan,chow,
hkstse,ywlaw,
kylai}@cs.hku.hk



Abstract


The
Internet has brought new business opportunities, including online auction
s
. T
he
se

oppo
rtunities have
also

been

seized by criminals. Internet auction fraud has become
prevalent

and s
tudies h
ave been carried out to discover

the characteristics of
transactions by
perpetrated
fraudsters. From those characteristics, methodologies
for
detecting fraudulent online transactions
were designed
. The methodologies made use
of historical information on I
nternet auction users to decide whether
or not
a user is a
potential fraudster. Such information includes reputation scores, values of items,

time
frame and other transaction records. In this paper, a total of 278 allegations relating to
selling of counterfeit goo
ds on Internet auction sites were

studied. A distinctive set of
characteristics for fraudsters selling counterfeit goods was identi
fied. Addit
ionally,
evidential traces of digital evidence were revealed from 20 prosecuted cases involving
Internet auctions of counterfeit goods in Hong Kong. Through the construction of
Bayesian network models representing the scenarios of the prosecut
ion and the defense,
this paper proposes an approach using the likelihood ratio as a criterion for determining
the relevance of the associated digital evidence for prosecuting Internet auction frauds.







1. Introduction

According to the Data Center of
the China Internet [1], in the first six months of 2008,
China Internet users spent 2.56 trillion Renminbi
(
USD
698 billion
)

via the Internet. It
was an increase of 58.2%

as comparing to the same period in 2007
. 35% of the 2.56
trillion Renminbi
(
USD
698

billion)
was spent on purchases made via the Internet
, with
65% spent mainly on on
-
line games and network communities [1]
. According to the
China Internet Network Information Center [2], there are more Internet users in China
than anywhere else in the wo
rld. China has 253 million Internet users in 2008

[2]
. This
is predicted to increase to 480 million in 2010

[2]
. By then, the volume of online
transactions in China is expected to overtake Japan and South Korea

[2]
.


The advancement of technology has br
ought new opportunities for shoppers and
business entities. Shoppers have been able to search, compare, decide, bargain and buy
commodities. They have done so while sit
ting at home

via
the Internet
. Business
entities have also seized the opportunities t
o sell their goods through
the Internet
. They
have offered customers low prices, convenience, and a wide selection of merchandise.
The advancement in technology has also attracted those who used to sell their second
hand goods at flea markets. One of the

new opportunities is
Internet

auction sites.


Internet

auctions have provided opportunities to honest and dishonest

users, buyers and
sellers.

Internet

auctions have provided buyers

unparalleled wide selections and
potential values.

They have

also provi
ded

sellers
with
a way to reach millions of buyers.
Criminals have been attracted

by t
he great profit and low entry

costs of
Internet

auction
s
.

Less

scrupulous sellers take adv
antage of buyers. Some misstate the quality
or condition

of their commodities.

Some have no intention of
deliver
ing the goods they
offer

to sell.

As a result,
Internet

auction

fraud has been ranked the highest amongst the
reported fraud cases in

electronic commerce

[4]
.


The purpose of this paper is to examine the characteristics o
f
Internet
auction fraud
regarding
the
selling of faked goods in Hong Kong.

These
are goods bearing false tra
de
descriptions or forged trade
marks.

This

paper also applies a Bayesian approach to

the
analysis of
the
evidence in
an Internet auction

fraud ca
se
involving the selling of
counterfeit or faked goods.


2. Background and Previous Work

In this section, the characteristics of Internet auction fraud are reviewed. Related
approaches to fraud detection in online auction sites are

also surveyed.


2.1 The

Success of Internet Auctions and How It Works

Internet auctions are successful for many reasons. Morzy et al. [3] have listed some of
them. Bidders are not constrained by time. They can bid 24 hours a day, 7 days a week.
Potential users have sufficien
t time to search for interesting items. The Internet does
not impose geographical constraints on users. Users are not required to attend
physically at an auction. The large number of sellers and buyers can reduce overall
selling costs. It also decrease
s prices of goods because of large number of suppliers.
Finally, many users describe their bidding experiences as comparable to gambling. The
offering of the highest bid is considered by bidders as winning a game. This makes
bidding exciting.


Ochaeta [
4] listed 6 basic activities of safe Internet auction. They are:


(a)

Initial buyers and sellers registration: This step is the authentication of the
trading parties.
It involves the exchange
of cryptography keys and the
creation of a profile for each trader
. The profile reflects the trader’s interest in
products of different kinds and possibly his authorized

spending limits.


(b)

Setting up a
particular auction event:
This step is the setting up of
the
protocol and
rules of the auction. Such rules include the de
scriptions of the
item
s

being sold or acquired, the type of auction being conducted (e.g. open
cry, sealed bid, or Dutch), parameters negotiated (e.g. price, delivery dates,
terms of payment), starting date and time of the auction, and
the
auction
closing
rules, etc.


(c)

Scheduling and
advertising: In order to draw the attention of potential buyers,
i
tems of the same category (e.g.

art, jewelry) are

generally auctioned together
on

a regular schedule. Popular auctions are sometimes mixed with less
popular aucti
ons. Items to be auctioned in upcoming auctions are

also

adve
rtised
. Potential buyers are notified of these upcoming events.


(d)

Bidding: The bidding step handles the collection of bids from buyers. It
implements the bid control rules of the auction (i.e. min
imum bid, bid
increment, deposits required with bids). It also notifies the participants when
new high
er

bids are submitted.


(e)

Evaluation of bids
and closing the auction: This step implements the auction
closing rules and notifies the winners and losers of
the auction.


(f)

Trade
settlement: This final step handles the payment to the seller, and the
transfer of goods to the buyer. If the seller is not the auctioneer, this final step
handles payment of fees to the auctioneer and other agents.


2.2 Reasons for Int
ernet Auction Fraud

The advance of
Internet

and the continuous growth of electronic

commerce have
offered new opportunities to criminals.

Gajek et al. [
5
]

observed that criminals have

discovered
the Internet

as a profitable ground

for illicit business.

A
ccording to the
research of Choo [
6
],
organized
crime groups (including organi
z
ed cybercrime groups)
are known to

have been involved in technology
-
enabled crimes, including online

auction frauds.


Sakurai et al. [
7
] concluded that remaining anonymous was a

factor

in

Internet fraud
and

that the existence of indivisible

bids caused difficulty in match
ing supply and
demand.

This was

because a seller or a buyer might submit a false
-
name
-
bid by
pretending

to be a potential buyer or
seller.

In this

way

they may

be able to manipulate
the supply
-
and
-
demand chain.

Chae
et al. [8
] confirmed the findings
of
Sakurai et al.
and concluded that online auction fraud was successful through the information
asymmetry and anonymity problems.


There are
many
reasons for the p
roliferation of
Internet

auction fraud.

Chua et al. [
9
]
have
listed some of them.

They concluded that
a
high degree

of anonymity was
at the
top of the

list. In
Internet

auctions, no

authentication barrier exists.

Therefore, it is easy
for dishonest user
s to

avoid investigation and prosecution.

Second on their list are

the

low costs for entry and exit.

These are
precisely the

reasons for the

success of
Internet

auction
s
.


2.3 The Nature of Internet Auction Fraud

Internet

auction fraud has become a major

threat.

According to the

“2008
Internet

Crime Report” [1
0
], the median dollar loss per complaint

of
Internet

fraud was US
D

931 in 2008 in

the USA
.

The total dollar loss was US
D

264.60 million

[10]
. During
2008, there were

275,284 received complaints

in
the USA

[10]
.

This figure

includes
auction fraud, non
-
delivery, and credit/debit card fraud, computer

intrusions, spam, and
child pornography

[10]
.
Internet

auction fraud

was the most reported offense.

It
comprised 25.5% of all

complaints.

Auction
f
raud

comprised 16.3% of the reported
total
dollar
loss

[10]
.

The average

median
dollar
loss per auction fraud complaint is
US
D

610

[10]
.


Gregg et al. [
11
] found that

Internet

auction fraud took various forms, such as
delivering goods

not as requested, of low

quality, without ancillary item or parts, being

defective, being damaged, or being black market item
s
. Morzy et al.

[
3
] identified other
practice
s, such as bid shielding and

bid
shilling.


Bid shielding is the offering of an artificially high bid for an i
tem

in order to
discouraging other bidders from competing for an item.

The one who makes such an
offer is known as a shielder.

At the last

moment, the shielder withdraws the

bid.
Accordingly, the winner
is the second highest bidder.

The winner in fact c
ooperates
with the

shielder to win the bid.


Bid s
hilling is the use of a false bidder identity to drive up the price of

an item on behalf
of the seller.


Gregg et

al. [
11
] observed that there were an increasing number of

comp
laints
regarding another form
of

Internet auction fraud, namely

“accumulation” fraud.

This

is
a seller attempting to build up

his

reputation by selling much low
-
value merchandise
over a long

period of time.

After this initial investment, the seller presents an offer

of
expensive good
s.

The buyer never gets the expensive goods after

making their
payment.


Chua et

al. [
9
] accepted that
Internet

auction fraud itself might take

multiple forms.
They also crea
t
ed the taxonomy presented below:


Seller as Fraudster

Bid shilling

Seller bids
on own auctions to drive up the
price

Misrepresentation

Seller intentionally misdescribes the item

Fee stacking

Seller adds hidden costs such as handling
charges to the item after the auction ends

Failure to ship

Seller never sends the goods

Reproducti
ons & counterfeits

Seller advertises counterfeit goods as the real
thing

Triangulation fencing

Stolen goods are sold

Shell auction

Seller sets up an auction solely to obtain names
and credit cards


Buyer as Fraudster

Bid shielding

Two
buyers

collude on

an auction. One bidder
makes a low bid, while the second makes an
inflated bid. Before the auction ends, the
higher bidder withdraws

Failure to pay

Buyer never sends the money

Buy & switch

Buyer receives merchandise and refuses it.
However, buyer swit
ches original merchandise
with inferior merchandise

Loss or damage claims

Buyer claims item was damaged and buyer
disposed of it. Buyer wants money back


From an economic point of view, Chua et

al. [
9
] concluded that

all
of
the above
mentioned types of f
raud are very dangerous.

This is

because they undermine the trust
that users develop toward
s

the online

auction site. They also decrease the reputation of
the service, which

can be disastrous for

the online auction

site
.


According to the study of Ku et

a
l. [
12
], frauds
may happen
to either

th
e buyer or the
seller. A buyer

is
more
easily
targeted as

a victim than

a seller

[12]
.

Due to the nature of
the Internet

auction, it was found that 89.0%

of all seller
-
buyer pairs conducted just one
transaction
durin
g the time period

of the study

[12]
.


At most, there were four
transactions

between a seller
-
buyer pair.

This

means

that the repeated transaction rate
of the

same seller
-
buyer pair is lower
than 2%

[12]
.

This transaction rate is an
indication of whether
or not the

transactions between a sell
-
buyer pair are normal.

If
the transaction

rate is
significantly
higher than 2%, it indicates that the transactions
between a

sell
er
-
buy pair might be suspicious,

for example

they may be shilling

or
shielding

[12]
.


A
s observed by Kobayashi et

al. [
13], a

common trick in
Internet
auction fraud was for
the fraudsters to pretend to carry out honest

dealings in t
he early period of using the
auction, but once they became trusted

they committed fraud.


Ochaeta [4] also stud
i
ed the behavior of fraudsters i
n
Internet
fraud.

She concluded that
the
se criminals had tried to establish

a good
enough reputation
prior to their imminent
fraudulent acts

[4]
.

Therefore
the
ir reputation building process wa
s different from that
of legit
imate

users

[4]
.

These fraudsters

attempted to gain as much one
-
time profit

as
possible
as quickly as practicable

[4]
.

If the
ir

reputation fabrication process can be

discovered, the fraudsters can be identified

[4]
.


The patterns used by these fraudsters

to build
their
reputation
s

are:

(a)

selling or buying numerous cheap items from users with a good reputation;

(b)

selling or buying moderate value or expensive items from accomplices; and

(c)

the process usually takes place over a short period of time.


In order to b
uild up
a reputation over

a short period of time, most

Internet

auction
fraudsters tend to sell a lot of low priced or cheap

products.


These acts take place at the
beginning of their fraudulent

auction lives.

Simultaneously, fraudsters also try to bid
in
expensive

items from users with good reputation scores.

This is done for the

purpose
of establishing
a
favorable
reputation
score through numerous legitimate

transactions.


3.
Characteristics of Internet auction fraud regarding fake goods in Hong Kong

3.
1

Internet Auctions Sites for Faked Goods

W
e have
statistically
examined 278

cases in Hong Kong

in order to reveal the
characteristics of Internet auction fraud regarding fake goods
.

The

cases
were
complaints
lodged to the Hong Kong Customs & Excise Depart
ment on selling of fake
goods on
Internet
auction sites.
The
Customs & Excise Department
is the prime law
enforcement agency
in Hong Kong
responsible for the protection of intellectual
property rights
.

In th
e
se
278
cases, we

note
d

the following character
istics

for fraudsters
selling counterfeit or faked goods on Internet auction sites
:


(a)

The fake goods were sold at
unreasonably low
costs
at

about
only 10% of
legitimate products;

(b)

About two
-
thirds of them
(180

out of 278
)
offered to sell those goods within
7

days of setting up their accounts;

(c)

They have multiple auction accounts that do not carry high trust values or
reputation scores

of 8 or more out of 10
;

(d)

They are s
hort lived

(less than 10 days)
and

tend to
switch

to other auction
accounts before expiry of
the
auction period
;

(e)

Many

varieties of items
(more than 5)
belonging to different categories are
sold, e.g.
a
mixture of watches, mobile phone, footwear, sportswear, etc.


4. Investigation Model for Online Auction Site Selling Counterfeit Goods

4.1 Digital
Forensic Hypotheses and Evidential Traces

In this section, an investigation model for online auction fraud in selling of counterfeit
goods using a Bayesian network
approach is proposed.
Based on 20 prosecuted cases
from the 278 complaints
of selling count
erfeit items by online auctions, the digital
evidence
collected led to the following three hypotheses regarding actions taken by the
fraudsters in those cases.

Because there were no detailed judgments on these 20
prosecuted cases, interviews were carried
out with the responsible digital forensic
examiners to elicit the following three hypotheses.



1.

Uploading of auction related material (e.g. images or descriptions of the items)
has been performed;

2.

Manipulation of the corresponding auction item (e.g.
pric
e adjustment
) has
taken place;

3.

Communication between the seller and the buyer related to the auctioned fake
item (e.g. email, instant messaging) has occurred.


These three sub
-
hypotheses, which substantiate the overall prosecution hypothesis that
an online

auction fraud crime has been committed

in the 20 prosecuted cases
, are
supported by 13 distinct evidential traces
, again obtained from the responsible digital
forensic examiners,

as shown in the simple Bayesian network model given in Figure 1.


This inves
tigation model does not of itself substantiate the whole prosecution case. The
auctioned item also has to be procured physically by the investigator and to be
examined by the trademark owner in order to ascertain whether or not the item is
counterfeit in
nature.



































Figure 1 Bayesian network
model
for prosecution hypotheses and
related evidential traces


In order to evaluate the relevance of the digital evidential traces, another simple
Bayesian network model representing the

defense scenario has also been established.
Although the root hypotheses of the two models appear to be the same, they are in fact
different due to the two different sets of supporting sub
-
hypotheses representing the
prosecution and defense scenarios res
pectively. In both models, the same set of
evidential traces is used. Figure 2 presents the defense’s hypotheses and their
associated evidential traces.






























Figure 2 Bayesian network
model
for defense hypotheses and
related ev
idential traces


4.2
Evidence Evaluation

We propose to use

the

Likelihood Ratio

(LR) to evaluate the evidence of the case.
LR
is a general technique that can be applied to any scenario with decision uncertainty.
According to Lucy [1
4
], LR has been an ef
fective tool to
quantify the value or
relevance of evidence
. Broadly speaking, the closer a LR is to 1 the less relevant

or
valuable
is

the evidence. Evett [1
5
] generalized the LR approach of relevance by using
a form of LR to represent the situation whe
re it is uncertain whether
or not the
evidence
is a result of the
suspect’
s activity. The general form proposed by Evett is :




Pr( | )

Pr( | )
p
d
E H
LR
E H

w
her
e E is the
total digital
evidence
relate
d to the crime
.


In our simple Bayesian network models, the existence of each individual trace of digital
evidence does not imply the existe
nce of any other such traces. Since the evidential
traces are mutually independent, their individual probabilities can be multiplied
together to determine the probability of E given a root hypothesis.

The prior
probability values of the individual eviden
tial traces for the online auction fraud models
(both prosecution and defense) were obtained from a survey of the digital forensic
examiners of the Hong Kong Customs & Excise Department, and are generally
accepted values within this community of experts.


4.2.1 Evaluation of
I
ndividual
S
ub
-
hypothe
sis

Evidential Relevance

To evaluate the evidential relevance
or LR values
of individual hypotheses, we need to
set individual hypotheses to

yes


separately and then multiply the
prior
probability
values of thei
r associated evidence.
The LR of e
vidence

for hypothesis against the
evidence for hypothesis is :







Applying the interpretation adopted by the Forensic Science Service

[16]
, a major
forensic laboratory in England and Wales, a LR valu
e of 95,600 indicates very strong
support

of
the
evidence
for the

prosecution
’s

claim
over the

defense
’s

claim. Figure 3
illustrates the interpretation used by the Forensic Science Service.








Figure
3

Conclusions drawn by the Forensic Science Servic
e on LR values


Similarly, the LR values for
2
p
H

against
2
d
H

and
3
p
H

against
3
d
H

are found as :



and



In summary, t
he value of LR indicates a very strong support of the evidence for the
prosecution sub
-
hypothesis

.
As for the LR values for both






,

1 1 1 2 1 3 1 4 1 5 1
1 1 1 2 1 3 1 4 1 5 1
Pr( | ) Pr( | ) Pr( | ) Pr( | ) Pr( | ) Pr( | )
Pr( | ) Pr( | ) Pr( | ) Pr( | ) Pr( | ) Pr( | )
p p p p p p p p p p p
d d d d d d d d d d d
E H E H E H E H E H E H
E H E H E H E H E H E H
   

   
1
p
H
1
d
H
1
p
H
2 3
and
p p
H H
0.9 0.75 0.6 0.75 0.85 0.258
95,600
0.9 0.05 0.6 0.01 0.01 0.0000027
   
  
   
2
2
Pr( | )
0.247
774
Pr( | ) 0.000319
p
d
E H
E H
 
3
3
Pr( | )
0.190
203
Pr( | ) 0.000938
p
d
E H
E H
 
they

indicate that the evidence supports the prosecution
sub
-
hypotheses

moderately strongly.


There is an observed limitation in the application of LR to evaluate the evidential
relevance of individual sub
-
hypotheses. In order to find the appropriate LR values,
corresponding sub
-
hypotheses should exist in both
the prosecution and the defense
Bayesian network models. This requirement renders the LR approach
i
n
applicable

if
the sub
-
hypotheses in both models
do

not correspond. For example, the number of
sub
-
hypotheses in the defense Bayesian network model can be
larger than th
at

in the
prosecution model.


However, under normal
circumstances
, the sub
-
hypotheses of both models
will

correspond because most defense

s sub
-
hypotheses stem from the sub
-
hypotheses of
the prosecution model. Evaluation of individual sub
-
hy
potheses


evidential relevance
can identify the strongest and the weakest sub
-
hypotheses of the models. By such

means
, digital forensic practitioners are able to identify the most significant and/or the
most insignificant groups of
evidence

that are encom
pass
ed by the

individual
sub
-
hypotheses.


4.2.2 Evaluation of
O
verall
H
ypotheses’

Evidential Relevance

To retrieve the value of


, we set the root hypothesis



of the prosecution
Bayesian

network to

yes


and then multiply the
resu
lting
probabili
ty

values
of .

Similarly, to retrieve the value of , we set the root
hypothesis



of the defense Bayesian network to

no


and then multiply the
new
resulting
probabili
ty

values of




.

We find that:




Hence,


The LR value of 164,000 indicates very strong
support

of
the
evidence
for the

prosecution
’s

claim
over the

defense
’s

claim.


5. Conclusions

If all
the
evidential traces are
initially
assumed to be present
,

the
v
alue of the
LR
computed from the prosecution and defense Bayesian network models
can be

used as a
pre
-
processing criterion to determine

whe
ther or not it is worthwhile proceeding with
the search for the expected evidential traces themselves. Specifically,
if the LR is found
to be

relatively
large
(e.g. greater than about 1,000) the
search for the implied
digital
evidence

would proceed. This would be followed by applying the cost
-
effective digital
forensics investigation model as described previously [1
7
],
and the

Bayesian network

Pr( | )
p
E H
Pr( | )
d
E H
p
H
d
H
Pr( | ) 0.000293 and Pr( | ) 0.00000000179
p d
E H E H
 
1 13
to
p p
E E
1 13
to
d d
E E
2 3
and
p p
H H
Pr( | )
0.000293
164,000
Pr( | ) 0.00000000179
p
d
E H
LR
E H
  
model would then be evaluated using the retrieved evidential traces [1
8
].


On the other hand, if the LR is found to be relatively small, this indicates that the
evidence is not strongly supportive of the chosen hypotheses. Theref
ore, the
prosecution should review its hypotheses and/or review the implied evidential traces.


Acknowledgements

The authors wish to express their thanks to Dr Jeroen Keppens of the Department of
Computer Science, King

s College London for his helpful disc
ussion and assistance.


References


[1]

Data Center of the China
Internet
. The First half of 2008 China
Internet

User
Measurment Data IUI Index Report. Technical report, Data Center of the China
Internet
, 2008.


[2]

China
Internet

Network Information Cen
ter. 22
nd

Statistical Report on the
Internet

Development in China. Available at
http://www.cnnic.net.cn/html/Dir/2008/07/31/5247.htm, 2008.


[3]

Mikolaj Morzy. New Algorithms for Mining the Reputation of Participants of
Online Auctions. Algorithmica, 5
2:95


112, 2008.


[4]

Karen Elisa Ochaeta. Fraud Detection for
Internet

Auctions; A Data Mining
Approach. PhD thesis, National Tsing
-
Hua University, 2008.


[5]

Sebastian Gajek and Ahmad
-
Reza Sadeghi. A Forensic Framework for Tracing
Phis
h
er
s. In IFIP
2008: Proceedings of the
International Fe
deration for
Information Process
ing

Third International Conference on
The Future of Identity
in the Information Society, 2008.


[6]

Raymond Kim Kwang Choo. Organised Crime Groups in Cyberspace: A
Typology. Trends
in
Organ
ized

Crime, 11:270


295, 2008.


[7]

Yuko Sakurai and Makoto Yokoo. A False
-
name
-
Proof Double Auction
P
rotocol
for Arbitrary Eval
uation Values. In AAMAS 2003: P
roceeding
s

of
the
Second
International Joint Conference on Autonomous Agents and Multi
agent Systems,
2003.


[8]

Myungsin Chae, Seonyoung Shim, Hyungjun Cho, and Byungtae Lee. An
Empirical Analysis of Fraud Detection in Online Auctions: Credit Card Phanto
m
Transactions. In HICSS 2007: P
roceedings of the 40
th

Annual Hawaii
International Con
ference on System Sciences, 2007.


[9]

Cecil Huang Chua and Jonathan Wareham. Self
-
Regulation for Online Auctions:
An An
alysis. In ICIS 2002: P
roceedings of International Conference on
Information Systems, 2002.


[10]

National White Collar Crime Center.

2008
Internet

Crime Report. Federal
Bureau of Investigation, 2008.


[11]

Dawn G. Gregg and Judy E. Scott. A Typology of Complaints about eBay Sellers.
Communications of the ACM, 51(4):69


74, 2008.


[12]

Yungchang Ku, Yuch
i Chen, and Chaochang Chiu.
A Proposed D
ata Mining
Approach for
Internet

Auction Fr
aud Detection. In PAISI 2007, P
roceeding
s

of
the
Pacific Asia Workshop on Intelligence

and Security Informatics, pp.

238


243, 2007.


[13]

Masao Kobayashi and Takayuki Ito. A Transactional Relations
hip Visualization
System in
Internet

Auctions. Studies in Computational Intelligence, 110:87


99,
2008.


[1
4
]

David
Lucy
.

2005. Introduction to Statistics for Forensic Scientists, John Wiley
& Sons.


[1
5
]

Ian W.

Evett
.

Establishing the Evidential Value
of a Small Quantity of Material
Found at a Crime Scene. Journal of the Forensic Science Society 33(2): 83


86
,
1993
.


[16]

Jeroen Keppens, Towards Qualitative Approaches to Bayesian Evidential
Reasoning, Proceedings of the 11
th

International Conference I
ntelligence and Law,
Stanford, California, USA,
pp. 17
-
25, ACM, 2007.



[1
7
]

Richard E
Overill, Michael Y K Kwan, K P

Chow
, Pierre K Y Lai and Frank Y W
Law, A Cost
-
Effective Digital Forensics Investigation Model, in Proc. 5th Annual
IFIP WG 11.9 Internat
ional Conference on Digital Forensics, Orlando, Florida,
USA, 25
-
28 January 2009, Advances in Digital Forensics V, Ch.15, pp.193
-
202,
Springer, 2009.


[1
8
] Michael
Y K
Kwan, K

P

Chow, Frank
Y W
Law and Pierre
K Y
Lai, Reasoning
About Evidence Using Bayesia
n Networks. In: Proceedings of the Four
th Annual
IFIP WG 11.9 International Conference on Digital Forensics
,

Advances in Digital
Forensics IV, Ch. 12, pp.141


155, Springer, 2008.