A Generalized Benford Framework for Threat Identification in Counter-Intelligence

TL;DR

This paper introduces a generalized Benford framework for counter-intelligence that analyzes frequency data to identify anomalies and guide investigations by detecting deviations from Benford's law.

Contribution

It develops a novel framework using Benford models and matrices to analyze suspect activity data, enhancing detection of hidden patterns in counter-intelligence.

Findings

Framework effectively identifies anomalies in frequency data.

Benford test statistic highlights suspicious sites.

Method complements existing outlier analysis models.

Abstract

In this paper, we develop a framework of 'Benford models' for counter-intelligence investigations which analyze frequency data of a suspect's visits to physical locations, online websites, and communication channels. We accomplish this by establishing the Benford measure for continuous & bounded domains, generalizing the accumulated percentage differences between sites in the frequency data with the log-determinant of 'Benford Matrices,' employing an estimator to determine a 'Benford Test Statistic,' and identifying maximal values of that test statistic across all permutations of included sites in our data. This framework is intended to complement outlier analysis models by finding where hidden Benford patterns 'break' in frequency data and telling investigators which sites they should investigate.