A Novel Ontology Construction and Reasoning Approach Based on the Case Investigation

: The big data has become a key component for intelligent systems and it is very important about data mining and cognitive reasoning in the field of criminal data analysis. Modeling of investigation knowledge is very important to realize the semantic retrieval, knowledge discovery, information push and classification for case data. Ontology modeling combined with the characteristics of the case in the investigation process, a method of ontology construction based on investigation knowledge is proposed in this paper. It builds an organization system of the investigation process at the first, which is described in stages by collecting terminology. Then the ontology of investigation knowledge is constructed. In addition, an instance is added for verification to describe the investigation process in detail. The method has a good advantage of describing the detection process quickly and integrate knowledge according to different investigation stages, formulating a standardized organization mode and providing standardized knowledge assistance in the investigation process


Introduction
The big data has become a key component for intelligent systems, such as intelligent vehicular networks, smart cities and it has been applied in the field of criminal data analysis. This interconnectivity together with large-scale data processing and new electronic techniques steadily brings innovation and business models of the digital space into the physical world [1][2][3]. It would extend tradition data technologies by incorporating knowledge from domain experts as well as the latest artificial intelligence solution, such as how to perform decision support with the case data collected by secure systems. The large amount of data is collected through secure systems to help human expert decision-making. In recent years, there are some researches about the application of big data [4]. Abdulaziz Alzubaidi explored a novel fraudulent user detection method based solely on the app usage patterns of legitimate users [5]. That presents a survey of the potential applications, architecture, modulation techniques, standardization and research challenges in visible light communication [6]. It develops an open source platform for identifying vulnerabilities in the network and facilitating wearable security research to mitigate them [7]. It is very important about data mining and cognitive reasoning, such as for smart case analysis.
In the fight against and rectification of criminal activities, case investigation is an intensive business in the field of public security and it is a main form as well [8]. Investigation knowledge is the summary and induction of intellectual achievements in public security business, which can be divided into explicit knowledge and implicit knowledge [9]. Explicit knowledge can be easily found in various papers and textbooks. Implicit knowledge exists somewhere in the theoretical expression and is contained in various public security cases. Therefore, case investigation is a kind of domain knowledge, corresponding to general knowledge. The investigation knowledge modeling of cases can satisfy the semantic retrieval, knowledge demand discovery, information push of police information knowledge and are used for the structure and classification of case data as well. The modeling of case investigation knowledge follows the process of general knowledge modeling. Case investigation knowledge has two aspects: case investigation and promoting investigation business. The former corresponds to the investigation theory and the latter corresponds to the investigation practice. This paper focuses on the latter. The process of case investigation needs to use meta-data to describe its information, then organizes and integrates this process or the relationship between the stages by associating knowledge. Based on the theory and method of ontology, this paper is first proposed construction model of the case investigation. According to the organization of the case investigation, the concepts, attributes and relationships are firstly defined. Then the meta-data is semantically described and the instance verification is added. Based on the above process, the content and the construction of case investigation ontology can be modeled.

Background and Related Work
With the development of knowledge engineering, the technology of ontology construction has been paid more and more attention. And it is used to construct the domain model to express the key knowledge and the relationship between domain, making final inference and prediction. At present, ontology-based methods have been applied in many fields. In some fields, standard languages of ontology modeling such as OWL have been used to describe domain content [10]. However, there is no complete ontology of constructing intention content analysis about how to judge the suspects' intentions based on known clues in the field of case investigation. And there is no effective analysis content of the clues in the environment of investigation cases, which makes it difficult to indicate the suspects' intentions and investigate the semantic content. In the process of case investigation, the analysis and research of potential clues are the key factors for effectively targeting suspects and investigating cases. It is an effective way to use the case ontology modeling for clue analysis, which must be built on the basis of modeling ontology for the case investigation. In recent years, there has been a lot of researches about ontology construction in some fields at home and abroad. The ontology construction is mostly applied in e-commerce domain [11], the domain of knowledge representation [12][13][14], the research of knowledge reasoning construction [15][16][17] and other fields [18][19][20]. Meanwhile, it is often used in the field of knowledge mining based on the ontology modeling [21][22][23] and so on. In the military field, it is common to study the ontological modeling of enemy tactical intentions [24,25], the construction of combat operations ontology [26] and the description of complex video content with ontology framework [27,28] etc. In the security field, the application of ontology construction can be traced back from the early network ontology construction of forensics analysis [29] to terrorist organization ontology [30,31], criminal ontology and knowledge reasoning [32,33] in recent years. However, semantic understanding of content needs specific background knowledge. Meanwhile, in the field of case investigation lacks unified semantic description and in the process of the case investigation also lacks research about ontology construction. Therefore, this paper applies the theory of ontology modeling to case investigation. It builds the knowledge base of domain ontology by collecting key concepts in this field and describing the relationship between concepts. With the increase of clue resources, it's urgent to find intelligent methods to understand, store, index and retrieve the clue data at the semantic layer in the process of case investigation. To facilitate the case investigation for the police, the semantic description of shared clues requires unified definition in the conceptual semantic content. Therefore, it is a certain trend to use the ontology-normalized concepts of clues analysis in the process of case investigation.
This paper focuses on applying ontology theory to build the investigation knowledge models combined with the implementation process of case investigation. This method can be applied to the actual practice of case investigation to improve the traditional pattern of clue analysis. It serves for accomplishing the analysis of potential clues and provides a foundation for predicting the trend. In this paper, cases-added ontology construction and reasoning experiments verify the proposed ontology modeling method.

The Implementation Process Based on Ontology Theory
The ontology of investigation knowledge is domain ontology. It is necessary to establish a domain knowledge ontology base under the experienced police in public security field. The implementation details included collecting relevant data, storing data, describing investigation knowledge in a standardized and unified language. It makes some exploration to realize the automated process of case investigation. And it also helps organizing information, formalizing domain knowledge, storing data and connecting information through semantic network. Domain experts can use the constructed ontology to evaluate, extend, adjust and update this ontology. The detail of ontology construction are shown in Figure 1.
The ontology construction firstly determines whether there is a reusable ontology. If it is a reusable ontology, it can evaluate and evolve the ontology. If it is not, it needs to collect terms, construct every stage, construct the relationship and evolve the ontology. Among them, the stage construction is the core part. It is necessary to define the scope of each stage, identify concepts, attributes and relationships, express the key content through formalization in the end.

Organization of Case Investigation
Nowadays, the rapidly increase of information and digital organization has become an important way in the process of criminal investigation. And it is also an important basis for the current investigation or handling of cases. With the improvement of big data and intelligent level, the drawbacks of the original mode are gradually appeared. The original data of each stage can't reflect the connection between the investigation processes. Therefore, this paper constructs the case investigation knowledge organization, which can better realize the connection between investigation processes through computer language. And it also organizes and integrates useful data to realize data sharing so as to provide help for investigators. The organization of investigation process is shown in Figure 2.

Terminology Collection
Collecting terms is to summarize and collect some key words in the field of case investigation. Terms are the most basic part of building an ontology. Through domain analysis and expert review, we choose the method of document description to collect terms from the current system [34]. The fragment ontology of collected terms is shown in Figure 3.

Stage Construction
Stage construction is the core problem in the process of ontology construction. The process of case investigation is carried out by stages. Each stage is a sub-model which can be constructed by defining the scope of each stage, identifying the concepts, attributes, relations and formalizing expressions.
Definition for the scope of each stage: The research object of each stage involved in the investigation knowledge determines the scope of each stage and its scope covers the concerned details, since the stage construction is an important part of building the investigation ontology.
The identification of concepts, attributes and relationships: there are major concepts, attributes and relationships at all stages of the investigation process. Concept is an abstract summary of the essential characteristics of things, which has connotation and extension and changes with the development of things. An attribute is a description of an entity, which owns properties such as data type, domain, default value and so on. There are many concepts and relationships among concepts for an ontology.
Formalization: In the process of investigation, formal expression requires a meta-model to describe the acquired knowledge. It contains defining the main concepts, attributes, relationships and describing the details of the concepts, most of which need to be described by attributes and relationships to add the necessary constraint condition.
Upon these introductions, the first stage of investigation is that the ontology of receiving cases will be constructed. There are a series of steps in the stage of receiving cases, including the jurisdiction of the case, whether to accept the case, the initial review before case-filing, etc. The key concepts in the stage of receiving cases include "Filing standard", "Initial review" and so on. In order to describe the process of receiving stage in detail, the key attributes are the description attributes of these concepts, including the basic information such as "time", "manager", etc. The key concept is to describe the relationship between the concept "Filing" and "Precautions" in order to comprehensively describe the process of the receiving stage. There are also precautions in the case, such as the relationship "inclusive-in-filing". For the receiving stage of a case, conceptual details need the key relationship "related to on-filing" to describe the concept of filing and add the necessary constraints. For example, the relationship "includes-in-filing" is used to describe the concept "Filing".
Filing includes in filing ecautions "Filing" includes "Precautions" in the receiving stage. And "Precautions" is an attention-needed part in the filing stage, but it does not only contain "Precautions". Figure 4 is a fragment of the receiving case stage, which describes the top-level conceptual structure of the case-receiving stage.
The details are defined as follows. , , ec re f set t set R P R S P re =Precautions, R f.set ={includes-in-filing, related-to-on-filing}, S t.set ={Case-jurisdiction, Accepting a case, Initial-review, Filing} In the stage of crime scene investigation, it covers different aspects of scene investigation, including investigation preparation, scene protection, scene search and so on. The key concepts of scene investigation are the related concepts of survey process to model the process of scene investigation, including "Survey preparation", "Field protection", "On-site search", "Fixed evidence", and "Transportation and preservation". The key attributes of scene investigation are the description attributes of related concepts to describe the scene survey process in detail, it including the basic attributes of the equipment such as "number", "name", "type" and so on. In order to describe the scene investigation fully, its key relationship is to describe the relationship between the concept "on-site search" and other steps, such as the relationship "has-result-data". At the same time, key attributes and relationships are used to describe the relationship between the concept "On-site search" and other concepts and add the necessary constraints. For example, the relationship "has-result-data" can be used to describe the concept "on-site search": On site search has result data Formalization is identified by defining the scope and identifying concepts, attributes and relationships of this stage. The above steps are used to construct the second stage of the investigation, namely the stage of scene investigation. Figure  5 is a segment of the scene investigation, describing the top-level conceptual structure of the scene investigation. The details are defined as follows. , , , The third stage of the investigation process is the stage of clue analysis and it is constructed through above steps. The key concepts in the stage of clue analysis contain "Types of clue", "Thinking of analysis", "Expansion methods" and "Comprehensive analysis". Key attributes are descriptions of concepts, such as the information attributes of the host clues such as "time", "message", etc. The key relationships are used to describe the connections between concepts, for example, the relationship is "uses". Through defining the scope and recognizing related concepts, attributes, relationships of this stage, formalization describes related concepts of the clue analysis with key attributes or relationships and adds corresponding constraints. For example, the relationship "uses" describes the concept "Network clues" as follows: ∃ clues , Network uses Tools that is network clues can use tools.
After receiving the case and investigating the scene in the early stage, investigation enters into the stage of clue analysis and it covers all the clues that need to be analyzed. Figure 6 is a fragment of the clue analysis, describing the top-level conceptual structure of clue analysis. The details are defined as follows:

={Realistic analysis, Virtual analysis, Data collision}
After the previous stages of receiving cases, scene investigation and clue analysis, investigation enters into the last stage of identifying suspects. At this stage, the scope of this stage is defined firstly, which covered different aspects of identifying suspects, including identity clues, behavioral characteristics, etc. Key concepts contain "Identity clues", "Behavioral characteristics", "Psychological characteristics" and so on. Key relationships are used to describe the connections between concepts such as the "has-origin-data". In the stage of identifying suspects, the formal representation focuses on conceptual details, using key attributes or relationships to describe related concepts and adding the necessary constraints. For example, the relationship "has-origin-data" is used to describe the concept "Behavioral characteristics" as follows.
∀ characteristics has-origin-data custom

Behavioral
The original data of "Behavioral characteristics" contains "custom". Figure 7 is a fragment for the identification of suspects, describing the top-level conceptual structure of identifying suspects. The details are defined as follows.

The Construction of Inter-stage Relationship
The above-mentioned case reception, scene investigation, clue analysis and suspect identification have been constructed respectively and realized the graph ontology. In order to construct the ontology of case investigation knowledge, these four ontologies need to be connected effectively. This paper established a relationships between stages for the progress of the investigation. Therefore, the relationships between stages as follows.
Definition 5 (has-case data) The relationship of "has-case data" is a relationship between stages. It exists between the concept of case filing in the case-receiving stage and the concept of survey preparation in the scene investigation stage. And it is used to describe the initial case and is recorded as has-case data. That is Definition 6 (has-partial clue) Has-partial clue is a kind of relationship between stages, which exists between the fixed evidence in the scene survey stage and corresponding clue analysis stage. It is used to describe the results of the scene survey, which is recorded as has-partial clue. That is Definition 7 (has-legal evidence) Has-legal evidence is a kind of relationship between stages. It exists between the traditional concept of clue in the clue analysis stage and the concept of user information in the suspect determination stage. The result of analyzing clues is recorded as has-legal evidence, that is The definitions of 5, 6, and 7 indicate that the same relationship can exist between multiple concepts. They describe the connection of multiple concepts among the four stages and connect the four stages effectively.

The Evaluation and Evolution for an Ontology
Through the steps described above, an ontology of investigation knowledge can be constructed, which is defined as follows.
Definition 8 (Investigation Ontology) The case investigation ontology describes the implementation of the investigation. It is a four-tuple and is denoted as Oto i . Behavioral characteristics ∀ has-origin-data custom, …} is a constraint set for inter-stage relationships.
The method of evaluating any ontology is indispensable in the process of constructing ontology. There are different types of evaluation methods for constructing ontology [35]. But the method of ontology evaluation for case investigation should be evaluated according to whether the investigation efficiency of cases is improved in the actual practice. And this is also the goal that building investigation ontology needs to be achieved. It needs to integrate investigation ideas and case characteristics so that investigators can investigate cases more efficiently.
The ontology's evolution of case investigation needs to enrich experts' knowledge constantly to describe it better through the ontology and to improve it further. At the same time, the modeling process needs to be promoted continuously with the development of investigation, receiving different opinions to combine with actual practice and serving for actual practice.

Semantic Reasoning Based on the Case Ontology
The semantics are defined based on the ontology language and have the reason function. This paper will adopt protégé to construct the ontology of case and carry out reasoning of cases. And this paper takes the theft case as an instance to carry out experiments.

The Ontology Model of Theft Case
The theft case generally refers to the criminal act involved in stealing public or private property for the purpose of illegal possession. It needs to collect common occurrence time, the place, victims' characteristics, criminal behavior and other terms of theft cases. And then the relationship between object attributes and classes is defined to construct the ontology model of the theft case.
The classes, instances and relationships between the theft model constitute a complex network structure of the theft ontology. For example, it contains the time, the place, criminal behavior, etc. They are displayed as shown in Figure 8.

The Ontological Experiment of Semantic Reasoning for the Theft Case
The criminal tools used in the theft case are taken as an example in the reasoning experiment of ontology semantics. It is summarized through examples of various theft cases, including electronic technology tools, electronic jammers, memory electronic card readers, violent physical tools, crowbar, technical physical tools, long scissors, etc. Criminals commit crime to steal property or other items through these criminal tools. Firstly, it needs to construct the class of criminal-tool and the class of items involved in the crime process and they are shown in Figure 9.
There are attributes of electronic stealing, violent theft and technical theft among the object properties. Electronic confrontation destruction is the sub-attribute of electronic stealing. Destruction is the sub-attribute of violent theft. Stealing is the sub-attribute of technical theft. And the object properties are constructed separately, as shown in Figure 10.  Meanwhile, electronic technology tools can be interpreted as criminal tools, which steal relevant items technically. And that is the equivalent class of electronic technology tools, as shown in Figure 11. For example, the parent class of the axe breaks the lock by force. So there are association rules about using criminal tools to commit theft. The violent physical tools use violent means to break the lock to carry out the theft. The technical physical tools steal goods by use of the tricky way. The electronic tools use electronic countermeasures to steal the lock. The reasoning is implemented, and the result is shown in Figure  12. As we can see from Figure 12 after realizing the reasoning, the result shows that the electronic jammer, the memory electronic card reader and the plug-in code lock decoder belong to electronic technology tools. The axe, the gun and the crowbar belong to violent physical tools. Tweezers, long scissors and steel wire belong to technical physical tools. The ontological construction of the theft case is not only to establish a knowledge system of cases, and what's more, it can deepen understanding of the internal stages or the links between stages and further identify the key knowledge and share it.

Conclusions
This paper organizes and integrates the knowledge of case clues based on the theory of ontology. It establishes the organization and the relationship of case process by studying the research achievements in other fields. In particular, the case knowledge ontology model is constructed through building the sub-ontology between stages. It is a tentative attempt about knowledge modeling in the cases based on ontology.
However, the ontology construction and the establishment of conceptual relations in the field need further discussion since there is unified standard for this aspect at present. In the background of big data, nowadays, there is a trend of carrying out knowledge integration and modeling in the field of public security. This paper is just provide a preliminary thought. We hope that more experts in this field communicate with each other and exchange ideas to make further contributions about serving the public security.