CrimeFighter Investigator: Integrating synthesis and sense-making for criminal network investigation

Security Informatics

Table 1 Overview of tool capability comparison based on support of criminal network investigation processes and tasks

	AN 8.5*	PG 3.0*	XLE 6.0*	Aruvi	Sandbox	POLESTAR	CFI*
Aquisition	3	4	4	2	2	3	2
Acquisition methods	■	■	■	■	■	■	■
Dynamic attributes	■	■	■	■	■	■	■
Attribute mapping	■	■	■	$□$	$□$	■	■
Synthesis	2	3	2	1	3	2	4
Entities	■	■	■	■	■	■	■
Associations	■	■	■	$□$	■	■	$□$
Re-structuring	■	■	■	$□$	■	■	■
Grouping	■	■	$□$	■	■	■	■
Collapsing and expanding	$□$	■	$□$	■	■	$□$	■
Brainstorming	■	■	■	$□$	■	■	■
Information types	■	$□$	■	$□$	$□$	$□$	$□$
Emerging attributes	■	■	■	$□$	$□$	$□$	$□$
Sense-making	1	3	1	2	2	2	4
Retracing the steps	$□$	■	$□$	■	$□$	$□$	■
Creating hypotheses	■	■	$□$	■	■	■	■
Adaptive modeling	$□$	$□$	$□$	$□$	$□$	$□$	$□$
Prediction	$□$	$□$	$□$	$□$	$□$	$□$	■
Alias detection	$□$	$□$	$□$	$□$	$□$	$□$	$□$
Exploring perspectives	■	■	■	■	■	■	■
Decision-making	■	■	■	■	■	■	■
Social network analysis	■	■	■	$□$	$□$	$□$	■
Dissemination	3	4	2	3	2	1	4
Storytelling	$□$	■	$□$	■	$□$	■	■
Report generation	■	■	■	■	■	$□$	■

^*>Tool abbreviations (AN: Analyst’s Notebook, PG: Palantir Government, XLE: Xanalys Link Explorer, CFI: CrimeFighter Investigator). Investigative processes (0: no support, 1: fragmentary support, 5: full support). Investigative tasks (■: supported, ■: partially supported, $□$ : not supported).