SEEK (Steganalytic vidEo rEsearch frameworK)

Lead Research Organisation: City, University of London
Department Name: Sch of Engineering and Mathematical Sci

Abstract

The proposed research project aims to discover whether videos uploaded and exchanged by terrorists and sympathizers contain hidden data, and to recover any such data if this was the case for gathering intelligence on their plans and operations.

For that, we will create a high performance and scalable video steganalysis tool called SEEK (Steganalytic vidEo rEsearch frameworK).

The tool will be at the core of a system capable of locating, collecting, analyzing, and sanitizing videos shared on the Internet by terrorists or their affiliates.

While primarily aimed at helping counter terrorism and law enforcement, with a primary objective of significantly enhancing UK security, the outcomes of the SEEK proposal will also benefit a number of other disciplines and activities.

We will contribute to the UK digital economy by improving the security of companies in general and video hosting or sharing sites in particular.

For instance, some of SEEKs outputs will directly help companies eliminate any hidden data in any video, and detect and stop data loss when video steganography is used by cyber criminals to exfiltrate stolen data stealthily, which is becoming an increasingly common practice.

SEEK also has some potential as a business venture expanding as steganalysis as a service (including analysis of other media), which could create jobs and bring unique technological expertise in the UK.

Publications

10 25 50
 
Description First, we have run steganalysis tools on thousands of videos, and so far have not found signs of steganography. This is not a definitive result yet because thousands is still a relatively small number. We are continuing experiments and collecting more videos. Second, 'officially produced' videos have obvious branding, such as logos, that make them fairly easy to recognise. However, it is much more difficult to recognise or classify 'terrorism-supporting' videos that are not officially produced and do not have obvious branding. Such videos are much more diverse in subject matter.
Exploitation Route We have developed a video analytics software tool Raven that can be used to process and analyse videos. This tool can be used to: (1) review videos (2) automatically identify and extract certain objects in videos (3) classify videos as propaganda.
Sectors Digital/Communication/Information Technologies (including Software),Security and Diplomacy

 
Description We have developed a video analytics software tool Raven and started a company Raven Science to commercialise it. We are planning for a trials with Met Police to test it. We are also one of four finalists in the Mayor of London's Civic Innovation Challenge, where the winner (40k award to pilot the product) will be decided soon.
First Year Of Impact 2019
Sector Digital/Communication/Information Technologies (including Software),Security and Diplomacy
Impact Types Societal

 
Description Raven: to Locate and Identify Extremist Online Multimedia
Amount £97,641 (GBP)
Funding ID 133730 
Organisation Innovate UK 
Sector Public
Country United Kingdom
Start 08/2018 
End 01/2019
 
Title Crawler 
Description We created a crawler to download terrorist videos, as described in the original proposal. This crawler is different from the off-the-shelf crawler in these ways: (i) It is aimed at specific Youtube, Telegram, and terrorist channels that are suspected of being used by terrorists. We had to consult several outside parties for advice about where to find these channels. (ii) We have gone through the university's internal Ethics and IT Services review process to make sure that the crawling conforms to university policies. (iii) All downloaded videos are stored encrypted in a special disk space called Secure Store in the university's cloud. Videos can not be moved or copied elsewhere. (iv) Access control is strict and monitored, and all accesses are logged. So far, we have collected 3,593 'officially produced' terrorist videos and 5,615 'terrorism-supporting' videos. We have not made the video collection available to others except our partners at University of Kent, due to the nature of the videos. 
Type Of Material Improvements to research infrastructure 
Year Produced 2018 
Provided To Others? Yes  
Impact According to the original proposal, we are using the web crawler to collect terrorist videos. We are continuing to do this. At the same time, we are using the videos with our partners at University of Kent to run their steganography tools to try to detect signs of hidden content within the videos. So far we have run the tools on thousands of videos and have not found signs of steganography yet. We are also investigating the 'officially produced' videos for signs of branding, such as logos. We have created software to extract logos from the official videos, and carried out preliminary experiments using machine learning to recognise the logos. 
 
Title Raven 
Description We developed a machine learning algorithm (convolutional neural network) to classify videos as extremist propaganda or not, and trained it using our dataset of extremist videos. We implemented the classifier in Python software under the name Raven. 
Type Of Material Improvements to research infrastructure 
Year Produced 2019 
Provided To Others? Yes  
Impact We are providing the Raven software to London Met Police and Europol for testing. They will trial the software with their own video datasets and provide feedback on classification accuracy. 
URL http://www.ravenscience.com
 
Title Terrorism-related videos 
Description Using the crawler that we developed as part of the SEEK project, we have collected thousands of 'officially produced' terrorist videos and 'terrorism-supporting' videos. So far, we have collected 3,593 'officially produced' terrorist videos and 5,615 'terrorism-supporting' videos. This number is increasing continually as the crawler keeps downloading more videos. We have worked closely with the university's Ethics and IT Systems staff to make sure that videos are downloaded and stored in a way that is consistent with legal obligations, considering the nature of the videos. This collection of videos is stored encrypted within a special disk space called Secure Store in the university's cloud. It has strict access control, and all accesses are monitored and logged. Due to the nature of the videos, they are shared only with our partners at the University of Kent. 
Type Of Material Database/Collection of data 
Year Produced 2018 
Provided To Others? Yes  
Impact We have run experiments with our partners at the University of Kent to try to detect signs of steganography. We have run their tools on thousands of videos, and have not detected steganography so far. We have also studied the 'officially produced' videos for signs of branding, such as logos. We have created software to extract logos, and run experiments using machine learning to recognise the logos. 
 
Description Europol 
Organisation Europol
Country Netherlands 
Sector Public 
PI Contribution We developed a machine learning algorithm to classify videos as extremist propaganda or not, and demonstrated this to Europol (Counter Terrorism Internet Referral Unit).
Collaborator Contribution Europol (Counter Terrorism Internet Referral Unit) has agreed to trial our classifier which is implemented in Python software. They will test our software with their dataset of videos and provide feedback on classification accuracy.
Impact Outcomes: demonstration of software to Europol; Europol starting trial of software with their videos. Multi-disciplinary: cyber security, machine learning, counter terrorism, video processing.
Start Year 2018
 
Description ISD Global 
Organisation Institute for Strategic Dialogue
Country United Kingdom 
Sector Charity/Non Profit 
PI Contribution As a result of this EPSRC project, our team has crawled and downloaded a dataset of extremist videos and non-extremist videos. We asked ISD for help to review the videos and teach us about extremism (terrorism).
Collaborator Contribution ISD experts on extremism (terrorism) worked with us to understand definitions of terrorism and different criteria for judging extremist propaganda. They helped us to review and label a considerable number of videos (hundreds) to create a dataset useful for training our machine learning algorithms.
Impact Yes, multi-disciplinary: machine learning, extremism (terrorism), cyber security. Output: a labeled dataset of extremist propaganda videos that can be used for training and testing machine learning classifiers.
Start Year 2018
 
Description Optalysys 
Organisation Optalysys Ltd
Country United Kingdom 
Sector Private 
PI Contribution NCSC connected us with a SME, Optalysys, which has complementary technology. We are together pursuing funding from NCSC for a proof of concept combining our technologies to show that extremist videos can be analysed and classified quickly using optical processing and machine learning.
Collaborator Contribution Optalysys has a new technology in optical processing specialised to fast convolutions. Their technology can accelerate the processing used in our Raven software which analyses and classifies videos as extremist propaganda (using normal electronic technology).
Impact We presented a joint proposal for a proof of concept to NCSC on 3 March 2020, which was well received, and await further negotiations.
Start Year 2020
 
Description Tech Against Terrorism 
Organisation Tech Against Terrorism
Country United Kingdom 
Sector Public 
PI Contribution We developed a machine learning algorithm that is trained to classify a video as extremist propaganda or not, based on our dataset of extremist videos.
Collaborator Contribution Tech Against Terrorism provided their expertise about social media companies and how they may potentially use our classifier to take down extremist propaganda from their social media platforms. They also provided some useful connections to other parties.
Impact There are no tangible outputs yet. Multi-disciplinary: cyber security, machine learning, public policy
Start Year 2018
 
Title Raven 
Description Raven is a video analytics software tool that processes videos and implements machine learning algorithms to identify certain objects within the videos and classifies videos as propaganda. 
Type Of Technology Software 
Year Produced 2019 
Impact Raven is starting trials with the Met Police and Europol. Depending on the trials (in 2019), there may be impact starting from 2020. 
URL http://www.ravenscience.com
 
Company Name RAVEN SCIENCE LTD 
Description The company is a startup to commercialise Raven, a video analytics software tool that processes videos, identifies and extracts certain objects in the video, and classifies video as propaganda. 
Year Established 2019 
Impact Starting trials of Raven with Met Police and Europol. Depending on success of the trials (in 2019), there may be impacts starting from 2020.
Website http://www.ravenscience.com
 
Description InnnovateUK Cyber Security Academic Startup Programme 
Form Of Engagement Activity A talk or presentation
Part Of Official Scheme? No
Geographic Reach National
Primary Audience Industry/Business
Results and Impact InnnovateUK Cyber Security Academic Startup Programme is for academics to propose new ideas based on their research for possible commercialisation/startup with help from InnovateUK. This is a competitive 6-week programme from 12 February 2018 to 23 March 2018. We made a proposal for extending the SEEK project, and it was accepted as one of 30 for the programme. It was presented in the programme and debated. A final presentation will be made 22 March 2018 in front of a panel to decide whether the proposal will go through to the next phase (expected in May 2018).
Year(s) Of Engagement Activity 2018
URL https://apply-for-innovation-funding.service.gov.uk/competition/100/overview
 
Description Mayor of London's Civic Innovation Challenge 
Form Of Engagement Activity Participation in an activity, workshop or similar
Part Of Official Scheme? No
Geographic Reach National
Primary Audience Policymakers/politicians
Results and Impact Our spinout, Raven Science, is competing in the Mayor of London's Civic Innovation Challenge (violent online extremism challenge) which called for startups in cyber security to address big societal problems. We made it into the first round of 10 competitors, and then into the next round of 4 finalists. We will find out the winner (40k award for a pilot with the London Met Police and Home Office) soon.
Year(s) Of Engagement Activity 2020
URL https://tech.london/challenges
 
Description Pitch at Cyber Den held at CyberUK 2019, which won Honorable Mention 
Form Of Engagement Activity A talk or presentation
Part Of Official Scheme? No
Geographic Reach National
Primary Audience Industry/Business
Results and Impact Cyber Den was held at CyberUK 2019 in Glasgow, sponsored by NCSC and attended by more than 2,500 delegates over two days. Cyber Den was a pitching event for startups in cyber security and judged by a panel of security experts and investors. We pitched Raven, our spinout of this SEEK research, and it won Honorable Mention (second place) among approximately a dozen pitches. The audience was a large room full of security industry, investors, and government agencies. From this event, we were put into contact with Optalysys, which has complementary technology, and we are together pursuing funding from NCSC.
Year(s) Of Engagement Activity 2019
URL https://www.ncsc.gov.uk/section/cyberuk/2019-gallery