Classifying Indonesian Cyber Crime Cases under ITE Law Using a Hybrid of Mutual Information and Support Vector Machine

In order to classify the law violation of cybercrime cases, the authors proposed a study consisting of several processes. These processes are as follows: data acquisition which was divided into two categories of training data and test data. After data acquisition, it would go through pre-processing. The process consists of data cleaning, case folding, stop word removal, stemming, and tokenization. After the pre-processing process, feature selection was carried out using mutual information while the feature extraction process was conducted using the TF-IDF method. The final step would be the classification of cybercrime cases. The classification would be performed using the Support Vector Machine algorithm. The general architecture of this study can be seen in Figure 1.

1.png

Figure 1. General architecture

2.1 ITE Law Article 27-30

The ITE Law contains nine articles related to cybercrimes: from article 27 to article 35, with 20 forms or types of ITE crimes. Furthermore, criminal threats from ITE cases are regulated in articles 45 to 52. The contents of the articles on ITE crimes are as follows:

Article 27:

(1) Any person intentionally and without rights distributes and/or transmits and/or causes an electronic information and/or electronic document with contents against decency to be accessible.

(2) Any person intentionally and without rights distribute and/or transmits and/or causes an electronic information and/or electronic document with gambling contents to be accessible.

(3) Any person intentionally and without right distributes and/or transmits and/or causes an electronic information and/or electronic document with defamation and/or slander contents to be accessible.

(4) Any person who intentionally and without rights distributes and/or transmits and/or causes an electronic information and/or electronic document with extortion and/or threat contents to be accessible.

Article 28:

(1) Any person intentionally and without rights spreads false and misleading news that results in consumer losses in Electronic Transactions.

(2) Any person intentionally and without rights disseminates information aimed at causing feelings of hatred or hostility to certain individuals and/or groups of people based on ethnicity, religion, race, and inter-group (SARA).

Article 29:

Any person intentionally and without rights sends electronic information and/or electronic documents that contain threats of violence or intimidation aimed at personally.

Article 30:

(1) Any Person intentionally and without rights or against the law accesses computers and/or electronic systems belonging to other persons in any way.

(2) Any Person intentionally and without rights or against the law accesses a computer and/or electronic system in any way with the purpose of obtaining electronic information and/or electronic documents.

(3) Any person intentionally and without rights or against the law accesses a computer and/or electronic system in any way by violating or breaking through the security system.

2.2 Dataset

The dataset used in this study is a chronology of cybercrime cases obtained from cybercrime case decision documents of case verdict documents downloaded manually from https://ujungan3.mahkamahagung.go.id/. We gather up around 500 documents then we check every document and classify it to several law violation categories such as article 27 paragraph 1, article 27 paragraph 3, article 27 paragraph 4, article 28 paragraph 1, article 28 paragraph 2, and other documents. One think to be considered in this process, we need to exactly find the real decision of this case, weather the verdict goes to guilty or not guilty. If it is not guilty then we are not considered it as violation and we are not input it in our dataset. For the sample of the raw data that has been collected can be seen in Figure 2.

 From the case verdict document, we took the chronology of the case in the document that will be used as input in this study and it is manually labeled to our system shown in Figure 3. In this study, the input consists of two parts, i.e., training data and testing data. Training data is the data that has been defined based on the article on ITE Law. Testing data is the data that will be tested to be classified based on the related article. This sorting process then resulted in 255 file which categorized as a good data to be processed. It is shown in Table 1, which consist of 220 data to be used in training process and 35 data to be used in testing process.

Table 1. Training and testing data

2.png

Figure 2. Example of case verdict document

2.3 Data pre-processing

The preprocessing stage was conducted to alter the text to be more structured. This preprocessing stage was divided into several stages: Cleaning data to remove or clean sentences from elements that are not needed to reduce noise in the data such as HTML characters, retweets, usernames, hashtags, URLs, symbols, punctuation marks, and number, shown in Table 2.

3.png

Figure 3. Case decision document

Table 2. Cleaning process

Case folding is the process of converting all text in a document to the same characters, both upper and lower case, to speed up the comparisons during the indexing process. At this stage, characters other than the alphabet will be removed and considered delimiters. The purpose of case folding is to make the characters to be uniform to speed up the indexing process. At this stage the system converts into all lowercase characters. The results of the case folding process can be seen in the Table 3.

Table 3. Case folding process

Stop-word removal is the process of removing or eliminating stop words. Stop words are words that often appear in large numbers and are considered meaningless in text documents. Examples of stop words are "which", "and", "will" and others.

In this study, apart from using stop-words from the Python library, we also added a list of stop-words which included defendant, Twitter, account, status, uploading, posting, BBM, Facebook, witness, fb, Blackberry, Messenger, December, January, February, March, April, May, June, July, August, September, October, November, media and social. The results of the stop-word removal process can be seen in the Table 4.

Table 4. Stop-word removal process

Table 5. Stemming process

Stemming is the stage of changing a preposition into a basic word by removing the prefix and suffix in the word. The purpose of stemming is to group words derived from common stem data and base words.

In the process of this research, the author uses the stemming process to change affixed words into root words. The python library used in this study uses literature. The results of the stemming process can be seen in the Table 5.

Tokenization is the stage of parsing text in a paragraph, sentence, or page into pieces called tokens for later analysis. The purpose of tokenization is for the words in a paragraph, sentence or page to be converted into word units.

In this study, the dataset is broken down into words called tokens. The results of the tokenization process can be seen in the Table 6.

Table 6. Tokenization process

2.4 Mutual information feature selection

After the preprocessing process is complete, the next process would be featuring selection. Feature selection is the stage of selecting terms or features that exist in the dataset to take relevant features to each class, while irrelevant features will be discarded. This process aims to reduce existing terms to be shorter. The mutual information (MI) method was used as the feature selection process in this study.

Mutual information (MI) is a feature selection method in a document. MI is a method that calculates the correlation between terms from one document to another document and sees the contribution of a term to make decisions on the classification process in a class [12]. Features are selected based on the MI values between terms and classes. The MI value can be obtained by calculating the frequency of term X in class A, the frequency of terms other than X in class A, the frequency of term X not in class A, the frequency of terms other than X not in class A and the sum of all existing terms. After the frequency value is obtained, the next step is to calculate the MI value of each term. The MI calculation can be seen from Eq. (1) below [27]:

$I(K ; C)=\sum_{e_{t\{10\}}} \sum_{e_{c\{10\}}} P\left(K=e_t C e_c\right) \log \frac{P\left(K=e_t C=e_c\right)}{P\left(K=e_t\right) P\left(C=e_c\right)}$                     (1)

K is the term value and C is the class. K is a random variable with a value of e_t=1 and e_t=0. The value of e_t=1 is the frequency of the term X while e_t=0 is the frequency of the term other than X. C is a random variable with the value of 1 and 0. The value of e_c=1 is the feature frequency that is in class C while the value of e_c=0 is the feature frequency that is not in class C. If Eq. (2) is described, the results of the MI value calculation can be obtained through Eq. (2) as follows [28].

$\begin{aligned} I(K C)=\frac{N_{11}}{N} \log \frac{N \cdot N_{11}}{N_1 \cdot N_1}+\frac{N_{01}}{N}+\log \frac{N \cdot N_{11}}{N_0 \cdot N_1}+\frac{N_{10}}{N} +\log \frac{N \cdot N_{11}}{N_1 \cdot N_0}+\log \frac{N \cdot N_{00}}{N_0 \cdot N_0}\end{aligned}$                    (2)

Based on Eq. (2), N denotes the number of existing terms. Nuc is the number of documents that have e_t and e_c values. For example, N₁₀ is a sentence containing term k (e_t=1) but not in class c (e_c=0). N₁=N₁₁+N₁₀ is the number of documents containing term k (e_t=1) and the number of documents that are not in class c (e_c {10}). N=N₀₀+N₀₁+N₁₀+N₁₁ is the number of documents. After calculating the MI value, the MI results are compared from one class to another and the scattered MI values will be stored. Then the features are sorted from the highest to the smallest value.

MI is a method that calculates the correlation between terms from one document to another document and looks at the contribution of a term to making decisions in the classification process of a class. The following is an example of using MI.

Based on the example above we do feature selection of “status” word in the category of 27 paragraph 3 which resulted below:

Then based on the truth table above we can calculate MI value described as follows:

$\begin{gathered}I(U, C)=\frac{1}{45} \log \frac{45.1}{(1+1) *(1+20)}+\frac{20}{45}+\log \frac{45 * 20}{(20+23) *(20+1)} \\ +\frac{1}{45} \log \frac{45 * 1}{(1+1) *(1+23)}+\frac{23}{45} \\ +\log \frac{45 * 23}{(23+1) *(23+20)}=0.2053\end{gathered}$

After the MI calculation is carried out for all words and classes, the resulting MI values are compared for one class to another and the MI values spread out will be saved. Then the features are sorted from highest to smallest value.

2.5 Feature extraction

The next process would be feature extraction. Feature extraction is the process of converting words into numbers. Feature extraction was done by giving weights to the features that have been selected in the previous process. Term Frequency–Inverse Document Frequency (TF-IDF) is a feature weighting method that is most widely used to assign value to features in text processing. This method was used to calculate the feature weights in the document [13]. The weights in the TF-IDF calculation were used to evaluate words in a set of documents or corpus. The term frequency (TF) and inverse document frequency (IDF) were calculated to obtaining the weight value from TF-IDF.

Term Frequency (TF) measures the frequency of a term appearing in a document. Each document has a different term length in a document allowing a word to have a different frequency. The formula (3) was used to get the term frequency [29]:

$T F(k d)=\frac{f(k)}{\max f(d)}$                        (3)

From the term frequency results in the TF calculation process, the Inverse Document Frequency (IDF) calculation would be carried out. IDF served to reduce the weight of a term if it was considered that the term is spread throughout the document, making it easier to find unique terms. IDF can be obtained through the following calculations:

$I D F(k)=\log \frac{N}{D F}$                       (4)

The value of a term by using TF-IDF can be obtained by performing the following calculations [30]:

$T F-I D F(k d)=T F(k d) * I D F(k)$                   (5)

where, f(k) is Word Frequency, f(d) is Frequency in documents, TF- IDF (kd) is the weight of a word in the whole document, k is word, d is Document, TF (kd) is the occurrence of frequency of a word k in a document d, IDF (k) is the inverse DF of k -word, N is the total number of documents, and IDF (k) is the number of documents containing the word. Based on the above formula, regardless of the value of TF (kd) if the value of N=DF (k) then the result will be 0 for the IDF calculation. For that, a value of 1 can be added on the IDF side.

Feature extraction is the process of changing words into numbers. Feature extraction is carried out by giving weight to the features that have been selected in the previous process. The weighting in this research uses Term Frequency-Inverse Document Frequency (TF-IDF). The values obtained from TF-IDF weighting are stored in matrix form where each row of the matrix is data while each column is a feature. This matrix will be filled with the weight value of each feature for the document or multiplying the TF value with the IDF value. The weight that has been obtained will be input to the system. The following is an example of a TF-IDF calculation which can be seen in the Table 7 with the N value or the number of documents being 50.

Table 7. Feature selection calculation

2.6 Multi-class Support Vector Machine

Initially introduced by Vapnik, SVM can only classify data into two classes. Further researchers developed SVM so that it could classify data from more than two classes, and can solve nonlinear with high dimensional classification problems [31]. In implementing Multiclass SVM, there are several approaches to achieve it such as combining several binary SVMs or combining all the data contained in several classes into an optimization form. As for the latter approach, the optimization to be solved is much more complicated. In solving multiclass problems, there are two common methods, namely the "one-against-all" method and the "one-against-one" method. If we considered our previous research using similar SVM [13], we found that using Multi-class SVM is better than using regular SVM. Even if we compare with Latent Semantic Indexing [16] which show a worse performance.

The one-against-all method is the simplest method in solving multiclass problems. This method solves the binary problem Ly to classify class j against all other classes with both positive class and negative samples. This method builds i amount of binary SVM models where k is the sum of all existing classes. The xth SVM model is trained with all class samples of positive-labeled x and the remaining negative-labeled x.

The one-against-one method builds a model using binary classification training (K(K-1)/2) where k is the number of classes. Each model receives each pair of classes from the training and must learn to distinguish the two classes given. At the time of testing, the classification (K(K-1)/2) was applied to the sample that was not visible and the class with a "+1" prediction for the highest number would be predicted using the combined classification.

The SVM binary classifier that was produced has been trained to determine whether a given class belongs to the first group or the second group of classes. The aforementioned procedure is iteratively performed on the second group, which has a number of classes beyond two, until each group consists of just one class. The procedure must be halted at that point. By using this approach, the multiclass SVM is converted into multiple SVM binary classifiers. Every Support Vector Machine (SVM) binary classifier is trained using a training matrix, whereby each row represents characteristics that have been retrieved as an observation from a certain class. Following the completion of the training phase, the multiclass Support Vector Machine (SVM) model demonstrates the capability to accurately choose the appropriate class for a given input features vector. In order to categorize an item, its input characteristics vector is sequentially given to each binary classifier from the first to the N^th classifier until a negative result is obtained [32]. The Multi-class SVM is really useful if we want to do character by character classifiers, and very suitable for our requirement. The reason to use this multiclass SVM is because we have several output in this case 6 output article in category 1-6 in Table 1. Thus, one against all is very precise to get the better result compare to one against one multiclass SVM.

The SVM algorithm will learn based on training data and determine groups that match the predetermined labels. If the data has dimensions that are difficult to recognize, the shape will be changed to a higher dimension to make it easier to find the best hyperplane.

The parameters used in SVM modeling in this research include:

1. Parameter Regulation

The parameter C tells the SVM optimizer how much it wants to avoid misclassification of each training example. For large values of C, the optimization will choose a smaller margin hyperplane if that hyperplane does a better job of getting all training points correctly classified. Conversely, a very small value of C will cause the optimizer to search for a larger margin separation hyperplane, even if that hyperplane classifies more points. For very small values of C, we should get misclassification examples, often even if your training data is linearly separated.

2. One against all

The multi-class SVM technique used is one-against-all. This method solves the binary problem L_y to classify class j against all other classes with positive class samples and negative other samples.

3. Loss function

Loss calculations in model training use the squared hinge technique.

4. Iteration

The maximum training iteration is 1000 iterations.

After the model is formed, the model will be used for the system testing stage. The testing process will be carried out by calculating the support vector in the data. Then each vector in the test data will be compared with the vector from the learning model created. The testing data will be tested by comparing the values on the label. After testing is complete, accuracy will be obtained from the success of the system for classifying data.

2.7 Evaluation model

The evaluation method is the last process in text mining. The evaluation method is a calculation of the evaluation value to assess how well the results of the system are by comparing the system's accuracy to the actual results. The system evaluation used in this study are recall, accuracy, f-score, and precision, after we gain True Positive (TP), True Negative (TN), False Positive (FP) and False Negative (FN). Below is the equation of every evaluation metrics:

Recall $=\frac{T P}{T P+F N}$                 (6)

Precision $=\frac{T P}{T P+F P}$             （7）

Accuracy $=\frac{T P+T N}{T P+T N+F P+F N}$              （8）

$F-$ score $=2 \times \frac{\text { Precision } \times \text { Recall }}{\text { Precision }+ \text { Recall }}$                 （9）

Support Vector Machine (SVM) is able to classify types of law in cybercrime cases quite well. The accuracy results of the model evaluation using MI and without using MI were 95.45% and 86.36% using a dataset of 220 data. The accuracy value for testing data with and without MI feature selection were 91.42% and 85.71% from a total of 35 test data. These accuracy results are quite significant compared to previous model around 88-92%. The use of MI feature selection can increase the system accuracy because it only uses features that often appear in each class classified by the system. In the word weighting process, only the selected words will be weighted, while others will be discarded. The number of selected terms affects the accuracy results.

The amount of data used in each class for further research must be increased and the types of classes classified are not only six classes, so that all types of items can be classified. In future research, it is necessary to normalize words in the preprocessing process to change non-standard words into standard words, so that at the time of selection features there are features that have multilabel non-standard word so that it can classify data that has more than one type of article. Potential challenge in implementing these improvements is higher accuracy then before, we can consider using any language-based deep learning approach such as BERT or Indo-BERT, which in theory it will increase training time but with outperformed accuracy.