Detecting Crime Series Based on Route Estimation and Behavioral Similarity

Full text

Detecting Crime Series Based on Route Estimation
and Behavioral Similarity
Anton Borg, Martin Boldt, Johan Eliasson
Department of Computer Science and Engineering
Blekinge Institute of Technology, Sweden
Email: {anton.borg,martin.boldt}@bth.se, johan.elisasson@student.bth.se
Abstract—A majority of crimes are committed by a minority of
offenders. Previous research has provided some support for the
theory that serial offenders leave behavioral traces on the crime
scene which could be used to link crimes to serial offenders. The
aim of this work is to investigate to what extent it is possible to
use geographic route estimations and behavioral data to detect
serial offenders. Experiments were conducted using behavioral
data from authentic burglary reports to investigate if it was
possible to find crime routes with high similarity. Further, the use
of burglary reports from serial offenders to investigate to what
extent it was possible to detect serial offender crime routes. The
result show that crime series with the same offender on average
had a higher behavioral similarity than random crime series.
Sets of crimes with high similarity, but without a known offender
would be interesting for law enforcement to investigate further.
The algorithm is also evaluated on 9crime series containing a
maximum of 20 crimes per series. The results suggest that it is
possible to detect crime series with high similarity using analysis
of both geographic routes and behavioral data recorded at crime
scenes.
Index Terms—Crime route analysis, crime linkage, residential
burglary, Behavioral analysis.
I. INTRODUCTION
In Sweden, only 3-5% of all residential burglaries were
solved during 2006-2016 [1], indicating potential for improve-
ment within the Swedish law enforcement on how to handle
burglaries. This means that between 95-97% of all residential
burglaries are never solved by the law enforcement in Sweden.
One way of trying to improve the clearance rates for burglaries
is to target serial offenders, as they are overrepresented among
all types of crimes [2].
In order for the law enforcement to efficiently target the
serial offenders, the law enforcement needs to link burglaries
to offenders. Linking two or more burglaries perpetrated by
the same offender can be achieved using different methods.
One way is to make use of forensic evidence such as DNA,
fingerprints or shoe prints. Unfortunately, forensic evidence
is present in less than 1% of crimes [2]. A complement to
forensic evidence is to use behavioral features in order to
identify serial offenders. The reason why behavioral features
can be used is because offenders often use the same behavior
when committing crimes [2], [3], [4].
The traditional way of linking crimes would have been
to have investigators do manual analysis on multiple crime
reports, trying to find patterns in order to link crimes. Manual
analysis is time consuming, cost ineffective and does not scale.
Instead much of the linkage analysis can be automated using
algorithms [5]. An algorithm could do the analyzing and assist
the investigator in making a decision on where to focus the
law enforcement’s resources. Such an algorithm can be part
of a Decision Support System (DSS). Generally, a DSS helps
and ensures a more precise decision to be made by the user
of the system [5]. In the context of the work, a DSS would do
a first analysis of reported burglaries to help the Swedish law
enforcement to focus its resources on burglaries with a high
behavioral similarity, i.e. potential linked burglaries, in order
to improve the overall efficiency of burglary investigations.
This work presents and evaluates an algorithm that identify
and prioritize series of linked burglaries (i.e. crime series)
based on behavioral similarity along custom routes and time
spans. A proof-of-concept web-based application that visual-
izes the results of the algorithm has, also, been implemented.
By using the application, it is possible for law enforcement of-
ficers to select way-points and time spans for further analysis.
The algorithm tries to find crimes along the route that have
occurred within the time span and displays a ranked list of the
most similar crimes routes based on behavioral data from the
crime scene. Swedish law enforcement is indeed interested in
such a DSS for analyzing and prioritizing crimes in the future.
A. Background
A serial offender, who is involved in two or more burglaries,
is involved in a series of burglaries. The process of identifying
or linking burglaries to a series can be done using forensic
evidence, also called ”hard” evidence. Linking could also
be done using crime scene information, also called ”soft”
evidence [6]. If there are similarities in the evidence, e.g. the
same DNA is found on multiple crime scenes, those multiple
crimes can be linked. However, hard evidence, such as DNA,
are rarely found at crime scenes. A report from the House
of Common from the United Kingdom suggests that DNA is
found in less than 1% of all crime scenes [7]. In contrast,
soft evidence is always available. Soft evidence includes both
temporal information regarding when the crime could have
been committed, as well as spatial data that specifies where the
burglary was committed. In addition to this, modus operandi
(MO) characteristics of the offender is available at the crime
scene, e.g. method of entry, place of entry, type of residence
being burgled, or if the residence had an alarm.

In crime theory, serial offenders often use the same MO
when committing crimes [2], [4], [3]. Behavioral data, and
other soft evidence, can therefor be used as an alternative
to link crimes. However, crime linkage rests on two key
assumptions. First, the offender consistency hypothesis [8]
stating that offenders display similar behaviors across time
and place. Second, the offender specificity hypothesis [9]
describing that offenders have an approach that deviate or is
distinct from other offenders’ approaches. These assumptions
apply for offender behavior in residential burglaries [10].
In order to link burglaries using soft evidence, such evidence
must first be collected and organized. Secondly, it should
be analyzed in search for similarities that both crimes were
committed by the same offender. This analysis could be
handled either manually by investigators or automatically by
a DSS. Letting human investigators manually find patterns to
link crimes introduces difficulties in an investigation. Mainly
since human cognitive capacity is limited. Cognitive shortcuts
or ”heuristics” are used by the human brain when trying to
make a decision in complex contexts. These shortcuts may
introduce biases [11]. An investigator with biases focuses on
the information that confirms the biases instead of seeking
evidences unconditionally. Humans also have limitations in
terms of work resources. An employee in Sweden typically
works 40 hours a week. This however does not mean an
investigator can exclusively work 40 hours per week trying to
link crimes. Normally a person’s workday contains overhead,
including task such as reading and writing emails, attend
meetings, doing planning, etc.
An alternative approach is to let a DSS analyze the crimes in
search for similarities that indicates potential linkage between
crimes. Such a DSS can process a large amount of crime
scene data in a unified fashion. Which enables it to automate
part of the crime analysis work, while still allowing crime
investigators to have the final say whether certain crimes
should be linked or not, i.e. the essence of a DSS.
DSS is being used in a variety of areas within business,
government agencies and the military. The essence of a DSS
is about analyzing and organizing data in order to assist users
in making more precise and efficient decisions. Further, the
problems that DSS assist in solving can be either structured
or unstructured [12], where structured problems refer to prob-
lems that are well-structured, repetitive and easily solved.
Unstructured problems refer to problems that are new, ill-
structured and difficult to solve. A DSS is applicable on
problems containing sub problems that are both structured
and unstructured. The DSS would then handle the structured
part of the problem. It is then up to the human to handle the
unstructured part and also to make a final decision for the
whole problem.
B. Residential Burglary DSS
Since 2012, there is an ongoing research collaborations be-
tween Blekinge Institute of Technology and the Swedish police
regarding an implemented DSS, called SAMS, focusing on
residential burglaries [13]. SAMS currently supports, among
other things, the collecting of structured crime scene data
including spatial, temporal and MO characteristic. The data
is collected and inserted by police officers across Sweden.
The officers are using a standardized digital form for every
burglary crime. The standardized form makes the crime scene
data collection more unified across officers and across police
districts. This increases the quality of the data, which further
improves later analyses.
The SAMS DSS also has features for searching and com-
paring burglary reports, as well as custom-made crime analysis
methods though a plug-in framework supporting analysis com-
ponents written in Python. By facilitating search, comparisons
and analyses of burglary reports, SAMS assists its users to
decide on what burglaries the law enforcement’s resources
could be focused on. It is important to note that SAMS does
not take any decisions on its own. It is always a human
investigator who makes the final decision.
C. Aim & Scope
The aim of this study is two-fold. First, to investigate to
what extent it is possible to detect serial offenders using route
estimations and behavioral similarity. Law enforcement needs
to analyze more crime reports trying to link burglaries to
serial offender, a DSS can assist the law enforcement in that
process. Secondly, to develop a proof-of-concept web-based
analysis component for crime route analysis. Given a route,
the burglaries found along the route and in the given time span
will be visualized on a map in the web interface. The burglaries
will also be grouped in all possible combinations, and based
on MO similarity ranking allows selecting interesting crime
routes.
The scope of this study is limited in two ways. First, not
all districts in Sweden uses SAMS which limits the burglaries
to only those located in the districts where SAMS is used.
In districts where SAMS is used, the structured collection
of crime scene data is not always used. Therefore, a gap
exists between the actual burglaries reported to the Swedish
law enforcement and those burglaries that have structured
crime scene MO data, where the latter is required by SAMS.
Secondly, only a minority of these crimes contains a known
offender. Thus, the dataset consisting of linked burglaries with
structured crime scene data used in this study is of limited size.
II. RELATED WORK
The topic of linking crime using behavioral MO similarity
has been investigated [3]. The accumulated evidence published
during the past 20 some years provide a base for conducting
case linkage based on behavioral consistency and distinc-
tiveness for some offenders, some of the time, in various
crime categories and types, e.g. commercial and residential
burglary [14], [4], [15]. However, not all behaviors show the
same potential to be used for crime linkage. Further, behavioral
features can be used in order to objectively detect linked and
unlinked crime pairs [16]. The authors propose how police
can weight false positive linked crimes, stating that “a police
force may decide it is ten times more important to make correct

decisions when faced with linked crimes compared to unlinked
crimes”. Their results indicate that the spatial distance between
two burglaries is the most stable feature when it comes to
linking crimes. Other features were also included in the study,
but those other features were not as likely to link crimes as
the distance between burglaries.
Three years later Bennell et al. conducted a similar study,
trying to replicate the previous study with new data [14]. They
found similar results. Again the distance between burglaries
was the best feature for linking crimes. They also added
that other types of features were feasible for linking such as
what things were stolen. 160 crimes were studied to see if
corroborating evidence could be found that different types of
soft evidence could be used to link crimes [4]. They found that
only the spatial and temporal features were feasible to link
crimes. They used three behavioral features (entry behavior,
property stolen and target selection) and their conclusion was
that none of those features, individually or combined, could
be used to link crimes for the data in the study.
Bernasco investigates repeated burglaries and found that
there is a higher probability that the same offender is respon-
sible for repeated burglaries if there is a short distance, both in
time and space, between the crimes [17]. The study includes
3,624 burglaries between 1996-2004 in and around the city
of Hague. The author also raises a warning of the differences
that exist between burglaries that are reported, compared to
burglaries that are never reported.
Iwanski et al. studies the relationship of offender’s location
of crime and the travel routes an offender takes in their average
day [18]. The authors had access to the offenders’ home and
work locations together with the location of the crimes they
were guilty of committing. Given this information simulated
possible travel routes of offenders were created to see if the
offender’s crimes could be predicted. Other than home and
work, major attractors, such as shopping centers, were used as
locations were the offender were likely to travel in between.
The authors found that the majority of crimes were located
along the simulated paths taken by the offender, indicating
that offenders commit crimes in their everyday surrounding.
Oatly et al. makes a very comprehensive description of the
challenges of detecting, linking and preventing burglary [19].
They describe the lack of standardized data collection and
how much of the existing data only can be found in free-
text, making it hard to apply data mining techniques on
the data. They also talk about how different type of visual
representations of data can aid investigator in decision making.
The visual representation can be charts (e.g. pie or bar charts)
or information on maps such as Geographical Information
System (GIS). Visual representation is important because of
the volume of data an investigator should manage when finding
inter-crime patterns. They conclude by saying how important
it is for DSS to be grounded in forensic psychology and
criminology.
Boldt et al. investigates the possibility of filtering erroneous
crime links based on travel time between crimes using web-
based direction services, such as Google maps [20]. A filtering
method was designed, implemented and evaluated using two
data sets of residential burglaries, one with known links
between crimes, and one with estimated links based on soft
MO evidence. The route-based filtering method was compared
to a traditional Euclidean straight-line-based filtering method.
The results showed that roughly 4 % of the crimes linked by
soft MO evidence could be filtered using the proposed method.
Compared to the Euclidean method, the proposed route-based
filtering method removed 79 % more erroneous crimes thus
proving more suitable for the problem at hand.
Previous studies have shown that spatial and temporal
features are promising to use for linking crimes. Further,
behavioral MO features can assist in crime linkage of resi-
dential burglaries. This paper will investigate crime linkage
when taking into account both crime MO similarity as well as
geographical routes between crimes using Google Maps online
direction service. Previous studies have shown that criminals
tend to commit crimes along roads they are familiar with. In
our study, we will use route and time span as search parameters
to find burglary sets. This has, to our knowledge, never been
investigated before. The burglary sets will then be analyzed
for similarities in behavioral MO data trying to detect serial
offenders.
III. ALGORITHM
The developed algorithm can be divided into the following
two steps. First, the algorithm discovers possible routes given a
set of way-points. Second, the algorithm prioritizes the crimes
based on their similarity. The result of the algorithm is a list of
all possible crimes per route together with a prioritized lists of
crimes based on their similarity. See Algorithm 1 for a detailed
description of the algorithm.
The algorithm takes in a start time, end time, ordered list
of way-points and a radius as arguments. Given the list of
way-points, the algorithm gets the quickest route between the
way-points using Google Maps API. Google Map API returns
the quickest route in the form of a list of coordinates which is
placed consecutively along the route. The algorithm then steps
through all coordinates along the route and for each coordinate
search the database for crimes that is both within the time-span
and that is within the radius of the coordinate on the route.
All discovered burglaries are placed in a set, later referred to
as a burglary set, for analysis.
The analysis of burglaries in the burglary set involves
prioritization, based on similarity, for all combinations of
routes within the burglary set. The similarity is calculated
using Jaccard index [21]. Using Jaccard index is in line
with previous studies [4] that has also used Jaccard index
to measure behavioral similarity in binary data. The Jaccard
index is calculated as followed:
Jaccard index(A, B) = |A∩B|
|A∪B|(1)
Aand Brepresent finite sets of boolean MO features for
individual crimes. For every combination of crime route a
similarity is being calculated. The similarity is being calculated

input : Start time
input : End time
input : Ordered list of waypoints
input : Radius
output: Average Jaccard index for every possible
combination of crime route
route_coordinates ←
GoogleMapAPICall(waypoints);
burglaries_set ←empty list ;
for coordinate in route_coordinates do
burglaries_set ←burglaries_set+
GetBurglaries(start,end,coordinate,
radius);
end
r←2;
while r≤length of burglaries_set do
for unique_crime_list in
Combination(burglaries_set,r)do
jcc_index_sum = 0 ;
for crime_pair in
Combination(burglaries_set,2)do
jcc_index_sum ←jcc_index_sum+
GetJccIndex(crime_pair);
end
InsertAverageJccIndex(jcc_index_sum,
unique_crime_list)
end
r←r+ 1 ;
end
Algorithm 1: Calculate Jaccard index for all possible com-
bination of crime routes within a set of burglaries.
by taking the average Jaccard index of all combinations of two
pair crimes in the current crime route.
A. Algorithm Specifics
All MO features are stored using one of three values; True,
False or N/A. True is being used when the MO feature is
present. False is being used when the MO feature is not being
present and N/A is being used when there is an uncertainty
if the MO feature should be True or False. To handle MO
features, only MO features that are present as True or False
in all burglaries within a set of burglaries are being used to
calculate the Jaccard index.
Google Map’s API is used to find a route between two or
more way-points. Other methods could have been used, but
Google Map’s API is popular and able to quickly get a route
given two or more way-points. Further, it is also free up to
2,500 requests per day.
The Combination function in the algorithm takes two argu-
ments. A list, burglaries_set, and an integer r. The function
then returns all subsets (order does not matter) with length r
of the list burglaries_set.
InsertAverageJccIndex is a function in Algorithm 1 that
saves the suggested possible crime list and the mean Jaccard
index for the crimes in the suggested list, i.e. how similar,
based on the MO features the crime series is. As such, the
algorithm produces suggested routes that span from two (2) to
ncrimes in the suggest routes, with associated Jaccard index.
IV. MET HO D
A total of two experiments are used to evaluate the al-
gorithm proposed in Section III. The two experiments try
to detect routes with a similarity between crimes distinct
from an average group of samples. The second experiment
also uses labeled data described in the next subsection. The
second experiment will also measure the accuracy achieved
by the algorithm trying to detect serial offender routes. Both
experiments skip tasks with more than 20 burglaries due to
the computational cost imposed by such sequences. Further,
there are no crime chains with a known offender that consists
of more than 14 crimes.
The algorithm takes a total of four arguments. The first two
arguments are start time and end time. The third argument is a
set of way-point (route) and the last argument is radius search
size. The first three arguments are experiment specific, and
presented in Section IV-B.
The last argument, radius, is fixed for all experiments. 2km
will be used as the radius of the search area, meaning only
crimes closer than 2km from a route will be included in
the algorithm. Previous studies [18] have suggested that most
crimes can be found in less than 1km from commonly used
roads. However, that study was concerning with city areas. Our
burglary data is both in cities and on the countryside, hence
the larger radius search space.
In the experiments, the goal is to investigate whether it
is possible to detect routes with a similarity between crimes
distinct from an average group of samples. This is done on
both unlabeled data and labeled data. This is explained further
in Section IV-D.
The second experiment will also measure the accuracy
achieved with the proposed algorithm, when used to detect
serial offender routes.
A. Dataset
The dataset used in both experiments originate from the
database of burglary reports in SAMS. In SAMS, there exist
one database post per inserted burglary report. The inserted
burglary reports contain MO features for the current burglary.
A total of 78 MO features exists. All MO features has one
of three values: True, False or N/A. There are MO features
are divided into 9MO categories. As such, a number of MO
features are present under each category. The specific MO
categories are listed in Table I.
The labeled dataset consists of 9 crime series that contains
at least 3 crimes where the offender is known and linked to the
crimes using physical evidence. When using labeled data, each
crime series will be considered a separate task. The number of
series is limited as there is a requirement of a series consisting
of a minimum of 3crimes. This will allow the creation of a
task for the algorithm to work on, with a given timespan and

Category Features
Type of residential area 5
Alarm 4
Object description 8
Plaintiff 16
Access objects 16
Identified search 3
Goods 14
Trace evidence 8
Other 4
TABLE I: Categories of MO features
Routes between cities across counties Distance (km)
Malmö - Göteborg 271
Karlskrona - Växjö - Jönköping 226
Karlskrona - Växjö - Halmstad 239
Karlskrona - Kristianstad - Halmstad 265
Routes between cities in the same county Distance (km)
Lund - Malmö 19
Karlskrona - Kalmar 89
Karlskrona - Karlshamn 56
Karlskrona - Hässleholm 141
Routes between a small village and a
closely located city Distance (km)
Karlskrona - Jämjö 20
Kristianstad - Åhus 18
Skurup - Ystad 20
Routes between small villages Distance (km)
Dalby - Sjöbo 25
Älmhult - Tingsryd 60
TABLE II: Interesting route alternatives being recommended
from the Swedish police.
a given start and end location for a route. The task’s start
location and start time will be set to the location and start
time for the chronologically first burglary committed by the
current offender. The task’s end location and end time will be
set to the location and end time of the chronologically last
burglary committed by the offender.
B. Routes and Time Span
For the unlabeled data, Swedish law enforcement officers
have suggested routes that are considered interesting to inves-
tigate. The routes are presented in Table II. The reason behind
the chosen routes was to have a variation of routes. The routes
cover routes between cities across counties, routes between
cities in the same county, routes between a small village and
near-by city, and routes between small villages.
The data for a whole year is, further divided into time spans.
A time span is one week, i.e. from Monday 00:00 to Sunday
23:59. 52 time spans will be used starting from Monday the
6th January 2014 as this was the first full week in 2014. The
motivation for choosing 2014 was because that year contained
most crime reports.
C. Evaluation Metrics
The jaccard similarity of crimes are used as a measurement,
as described in Equation 1. For each burglary set, the algorithm
will try all possible combinations of crime routes, creating
new burglary subsets. Subsets will have the length kwhere
2≤k≤nwhere nis the length of the original burglary set.
Two values will be calculated for all burglary subsets with
length kwithin an experiment. The similarity, and standard
deviation, of the top 5 most similar crime routes of all burglary
subsets is used to evaluate the recommended crime series.
I.e. for each route, the algorithm suggest a set of crime-lists,
ranked by similarity, and the most similar are suggested for
further analysis. The top 5 is used as per recommendations
from the Swedish police with domain expertise. This is
denoted as Avg Top 5 henceforth. The crime route with the
highest similarity of all burglary subsets is also presented. This
is denoted as Max henceforth. Further, the average similarity
over all burglary sets (not considering set length) will also be
presented and used as a baseline.
In experiment 2, precision, recall, and F1-score are used.
To calculate these scores, True Positive (TP), True Negative
(TN), False Positive (FP), False Negative (FN) are used. TP is
a burglary committed by the current offender and the burglary
is found in the burglary set. TN is a burglary that is not
committed by the current offender and the burglary is not
found in the burglary set. FP is a burglary not committed by
the current offender and the burglary is found in the burglary
set. FN is a burglary committed by the current offender and
the burglary is not found in the burglary set.
Precision is the percentage of selected burglaries that are
correct. It ranges between 0−1, where 0indicates that a only
irrelevant crimes where found (i.e. no TP) and 1indicates that
only relevant crimes where found (i.e. no FP). Precision is
calculated as:
precision =T P
T P +F P (2)
Recall is the percentage of correct burglaries that are se-
lected. It ranges between 0−1, where 0indicates that no
relevant crimes where found (i.e. NO TP) and 1indicates
that all relevant crimes where found (i.e. no FN). Recall is
calculated as:
recall =T P
T P +F N (3)
F1-score is often used when TN abounds [22]. This makes
the F1-score useful when TN are not relevant. F1-score is
calculated as:
F1= 2 ·precision ·recall
precision +recall (4)
D. Experiment 1
Experiment 1 investigates if it is possible to detect inter-
esting crime routes distinct from an average group of crime
samples in unlabeled data. As such, what is evaluated are the
output from the algorithm, i.e. do the suggested routes have a
higher similarity than a random set of crimes.

To do this, the unlabeled data from the data set described
in Section IV-A, the routes and the time span described in
Section IV-B are used. The unlabeled data consists of all
crimes available. This will result in examine 13 routes over 52
weeks each, generating a total of 676 tasks. Experiment 1 will
be measured using similarity as described in Section IV-C.
E. Experiment 2
Further, labeled data will also be used to investigate the
ability to detect routes. The approach is similar to experiment
1. But, instead of looking at specific routes and weeks as time
spans, the labeled data will instead be used to build the tasks.
There exits 9 crime series where the offender is known and has
perpetrated more than 3 crimes. When using labeled data, each
crime series will be considered a separate task. The number of
series is limited as there is a requirement of a series consisting
of a minimum of 3crimes. This will allow the creation of a
task for the algorithm to work on, with a given timespan and
a given start and end location for a route. The task’s start
location and start time will be set to the location and start
time for the chronologically first burglary committed by the
current offender. The task’s end location and end time will
be set to the location and end time of the chronologically
last burglary committed by the offender. The tasks are then
run using all (both labeled and unlabeled) data. Experiment
2 also evaluates the accuracy of the algorithm. For the 9
series, the detection performance achieved using the algorithm
to detect serial offender crime routes is investigated. Due to
the low number of series this is not generalizable. However,
the experiment is still relevant as it gives an indication of the
operational benefit for law enforcement agencies. For each
series the precision, recall, and F1-score is used to evaluate
the performance, as described in Section IV-C.
V. RESULTS
A. Experiment 1
The results from experiment 1 are presented in table III,
which shows that the average similarity for all burglary sets
were 0.687 (0.038). These results indicate that the algorithm
is capable of detecting burglaries with a higher similarity,
based on MO features, compared to random crime routes
containing 2−15 burglaries within a crime route. Crime routes
including 16−20 burglaries have on average a similarity index
lower than 0.687. The crime routes with highest similarity are
significantly higher than the top 5 crime routes.
B. Experiment 2
The similarity results of the series in experiment 2 can
be seen in Table IV. Experiment 2 has similar results as
experiment 1. There are, however, fewer tasks for experiment
2 than for experiment 1, because of the limited number of
labeled data (i.e. known offenders) in SAMS. Both Avg top 5
and Average is generally slightly higher than experiment 1’s
corresponding values. However, the Max value is lower for
experiment 2 than for experiment 1.
Length Top 5 average similarity Highest
2 0.767 (0.025) 1.000
3 0.760 (0.011) 0.906
4 0.751 (0.007) 0.888
5 0.740 (0.005) 0.845
6 0.732 (0.003) 0.824
7 0.727 (0.003) 0.810
8 0.720 (0.002) 0.798
9 0.716 (0.002) 0.789
10 0.710 (0.002) 0.778
11 0.707 (0.002) 0.770
12 0.704 (0.002) 0.763
13 0.699 (0.001) 0.757
14 0.695 (0.001) 0.750
15 0.693 (0.001) 0.742
16 0.685 (0.001) 0.736
17 0.686 (0.002) 0.727
18 0.686 (0.001) 0.717
19 0.684 (0.001) 0.709
20 0.681 (0.000) 0.701
Average similary: 0.687 (0.038)
TABLE III: Results for experiment 1 regarding route analysis
on unlabeled data. Column Length is the burglary subset
length, Top 5 avg. similarity is the average Jaccard index of
the five crime routes with the highest scores, while Highest is
the single highest route.
Length Top 5 average similarity Highest
2 0.757 (0.035) 0.854
3 0.751 (0.006) 0.819
4 0.753 (0.009) 0.810
5 0.742 (0.006) 0.787
6 0.734 (0.001) 0.769
7 0.742 (0.001) 0.758
8 0.734 (0.002) 0.750
9 0.727 (0.002) 0.744
10 0.719 (0.003) 0.739
11 0.714 (0.001) 0.732
12 0.725 (0.001) 0.726
13 0.719 (0.001) 0.721
14 0.715 (0.001) 0.716
15 0.710 (0.001) 0.711
16 0.706 (0.001) 0.707
17 0.701 (0.001) 0.702
18 0.696 (0.001) 0.698
19 0.688 (0.002) 0.693
20 0.684 (0.000) 0.684
Average: 0.710 (0.021)
TABLE IV: Results for experiment 2 regarding route analysis
on labeled data.
The series detection performance calculated on the labeled
data is presented in Table V. The algorithm was used to detect
series of crimes based on labeled data. The algorithm were
able to do this with a mean precision of 0.615(0.347), a mean
recall of 0.555(0.188), and a mean F1-score of 0.532(0.184).

Series number
Series length
Route length
TP
FP
FN
Precision
Recall
F1-score
1 4 6 2 4 2 0.333 0.500 0.400
2 4 6 2 4 2 0.333 0.500 0.400
3 4 11 4 7 0 0.364 1.000 0.533
4 4 3 3 0 1 1.000 0.750 0.857
5 6 3 3 0 3 1.000 0.500 0.667
6 6 3 3 0 3 1.000 0.500 0.667
7 6 3 3 0 3 1.000 0.500 0.667
8 13 20 5 15 8 0.250 0.385 0.303
9 14 20 5 15 9 0.250 0.357 0.294
0.615 0.555 0.532
(0.347) (0.188) (0.184)
TABLE V: The detection performance for the 9 crime series
in experiment 2. Series length indicates the complete series
length and Route length the estimated series length.
VI. DISCUSSION
The results presented in Section V indicates that the algo-
rithm is able to suggest crime routes that are distinct from
random crime series. The comparison between labeled and
unlabeled data for Max and Average top 5 is discussed.
A. Max
The comparison of the best performance, for different crime
series lengths, when using labeled and unlabeled data is
visualized in Fig. 1. The Figure shows the Max for both
experiment 1 and experiment 2. Experiment 1, with unlabeled
data, finds more Max values than experiment 2, with labeled
data. This could be because experiment 1 has more data to
work with than experiment 2. This shows potential for the
algorithm to work unconditionally on unlabeled data trying
to find similar crime routes. The relatively high values for
Max indicates that there is burglary subset that might been
committed by the same offender, but has not yet been solved.
Those burglary subsets with relatively high similarity can be
specially interesting for the law enforcement to investigate
further.
B. Average Top 5 Similarity
The performance comparison for the top five routes (i.e.
the five routes with the highest similarity), for different crime
series lengths, when using labeled and unlabeled data is
visualized in Fig. 2. The Figure shows the Avg top 5 for both
experiment 1 and experiment 2. What is interesting to note
is the Avg top 5 results for experiment 2 is slightly higher
than the Avg top 5 experiment 1. That could be because of the
labeled data used for experiment 2, which probably included
more series with more burglaries from the same offender, than
experiment 1.
However, burglary subset length of 2 and 3 has a higher
Avg top 5 in experiment 1 with the unlabeled data. Since the
Fig. 1: The max detected Jaccard index for different burgle
subset length. Green represent unlabeled data (exp. 1) and red
represents labeled data (exp. 2).
Fig. 2: The average top 5 detected jaccard index for different
burgle subset length.
clearance rate for burglaries in Sweden is below 5% yearly,
it can be that our algorithm is picking up small unsolved
burglary series with the same offender. Once the burglary
subset length gets higher than 3, experiment 2 has a higher
Avg top 5 similarity. The reason to why the algorithm finds
higher Avg top 5 for experiment 2 when the burglary subset
length is higher than 3 could be because of how we select
the timespan for experiment 1 and experiment 2. Experiment
1 uses only one week as a time frame whereas experiment 2
uses the first and last known burglaries as start and end for
the timespan, which often is longer than one week. It could be
that a serial offender doesn’t commit more than 2-3 burglaries
under one week.
When the subset length of burglaries gets over 6 the
difference in Avg top 5 gets significantly higher for experiment
2. Again, further strengthens the theory that crime series with
the same offender has a higher similarity than a random crime
route.
In Table III and Table IV the Average Jaccard index for
both Experiment 1 and Experiment 2 are 0.687 (0.038)
and 0.709 (0.021) respectively. Again, Experiment 2 has, on

average, a higher similarity among crime routes. In order to
quantify the effect size difference between the results from
Experiment 1 and 2 we calculated Cohen’s d. The effect
size in terms of Cohen’s dis 0.749, which translates to a
large difference. This indicates that the algorithm is better
suited to identify crime routes with higher similarity for crime
routes that law enforcement agencies already know are used
by criminals.
The results, however, suggest that it is possible to detect
crime series with high similarity using analysis of both geo-
graphic routes and behavioral data recorded at crime scenes.
C. Detection Performance
For the labeled routes in Experiment 2 (Table V), 9 crime
series were studied to see how well the algorithm were able
to detect them. This was done using the first and last crime
(chronologically) as the start and end points in the route. It
should be noted that no analysis has been conducted to see if
the series should be divided into multiple sub-series. Either
because the crimes have been conducted over two distinct
time periods, because the crimes have been committed in two
distinct different directions (different routes), or a combination
(i.e. the offender has been active during different time spans
on different locations). In the latter case, the algorithm can’t
be expected to detect all the crimes in the series. This could
explain some of the FN, and the somewhat low F1-score.
Further, the suggested FP could also have been committed
by the same perpetrator. But law enforcement has not been
able to link the crime to the same perpetrator.
VII. CONCLUSIONS
The algorithm is able to find a subset of burglaries with
a similarity between the burglaries distinct from a random
groups of burglary samples. It has also been shown that the
similarity between groups of burglaries are often higher when
the same offender figures in two or more burglaries within the
group. This is interesting since it strengthens the theory that
burglaries with the same offender has a higher similarity than
average.
This is interesting for the police in their work of analyzing
burglaries. Instead of manually search and analyze combi-
nations of burglaries to find interesting burglaries to focus
resources on, they instead can let an application do the initial
work for them. By having an application search, analyze and
present interesting burglaries the police can make a decision on
whether to investigate the burglaries further, or not. Having an
application automatically do the initial work of analyzing and
linking burglaries will decrease the time and decrease the bias
for law enforcement officers when analyzing burglaries. This
would enable law enforcement to prioritize which burglaries
to investigate.
For future work, three initial interesting aspects should be
considered: First, the radius value that was used in this work,
2 km, is a fixed value. As a future work, it could be interesting
to look at other radius values, e.g. dynamic values based on
area parameters such as population density. Second, to see if
certain type of routes performs better than other, or if certain
type of time spans performs better than other, is also a topic
for future work. Third, it could also be interesting to replicate
this study with more labeled data, which could confirm the
current results, or shed light on new interesting findings.
REFERENCES
[1] “Residential burglary - brå,” http://www.bra.se/bra/bra-in-
english/home/crime-and-statistics/residential-burglary.html, accessed:
2016-06-06.
[2] M. Tonkin, J. Woodhams, R. Bull, J. W. Bond, and E. J. Palmer, “Linking
different types of crime using geographical and temporal proximity,”
Criminal Justice and Behavior, vol. 38, no. 11, pp. 1069–1088, 2011.
[3] J. Woodhams, C. R. Hollin, and R. Bull, “The psychology of linking
crimes: A review of the evidence,” 2007.
[4] L. Markson, J. Woodhams, and J. W. Bond, “Linking serial residential
Burglary: Comparing the utility of Modus operandi behaviours, geo-
graphical proximity, and temporal proximity,” Journal of Investigative
Psychology and Offender Profiling, 2010.
[5] J. P. Shim, M. Warkentin, J. F. Courtney, D. J. Power, R. Sharda, and
C. Carlsson, “Past, present, and future of decision support technology,”
Decision Support Systems, vol. 33, no. 2, pp. 111–126, 2002.
[6] G. Oatley, B. Ewart, and J. Zeleznikow, “Decision support systems for
police: Lessons from the application of data mining techniques to ”soft”
forensic evidence,” Artificial Intelligence and Law, vol. 14, no. 1-2, pp.
35–100, 2006.
[7] H. of Commons, “Forensic science on trail, seventh report of session,”
2005.
[8] D. Canter, “Psychology of offender profiling,” in Handbook of psychol-
ogy in legal contexts, 1st ed., R. Bull and D. Carson, Eds. Chichester,
UK: John Wiley and Sons, 2000, pp. 343–355.
[9] L. Pervin, Current Controversies and Issues in Personality. New York:
John Wiley and Sons, 2002.
[10] R. Wright and S. Decker, Burglars on the job. Boston, MA: North-
eastern University Press, 1994.
[11] D. J. Power, “Understanding Data-Driven Decision Support Systems,”
Information Systems Management, vol. 25, no. 2, pp. 149–154, 2008.
[12] H. A. Simon, “The new science of management decision.” 1960.
[13] A. Borg, M. Boldt, N. Lavesson, U. Melander, and V. Boeva, “Detect-
ing serial residential burglaries using clustering,” Expert Systems with
Applications, vol. 41, no. 11, pp. 5252–5266, 2014.
[14] C. Bennell and N. J. Jones, “Between a ROC and a Hard Place: A
Method for Linking Serial Burglaries by Modus Operandi,” 2005.
[15] M. Tonkin and J. Woodhams, “The feasibility of using crime scene
behaviour to detect versatile serial offenders: An empirical test of
behavioural consistency, distinctiveness, and discrimination accuracy,”
Legal and Criminological Psychology, vol. 22, no. 1, pp. 99–115, 2017.
[Online]. Available: http://dx.doi.org/10.1111/lcrp.12085
[16] C. Bennell and D. V. Canter, “Linking commercial burglaries by modus
operandi: tests using regression and ROC analysis.” Science & justice
: journal of the Forensic Science Society, vol. 42, no. 3, pp. 153–164,
2002.
[17] W. Bernasco, “Them Again?: Same-Offender Involvement in Repeat and
Near Repeat Burglaries,” European Journal of Criminology, vol. 5, no. 4,
pp. 411–431, 2008.
[18] N. Iwanski, R. Frank, V. Dabbaghian, A. Reid, and P. Brantingham,
“Analyzing an offender’s journey to crime: A Criminal Movement Model
(CriMM),” Proceedings - 2011 European Intelligence and Security
Informatics Conference, EISIC 2011, pp. 70–77, 2011.
[19] G. Oatley, B. Ewart, and J. Zeleznikow, “Decision support systems for
police: Lessons from the application of data mining techniques to "soft"
forensic evidence,” Artificial Intelligence and Law, 2006.
[20] M. Boldt and J. Bala, “Filtering estimated crime series based
on route calculations on spatio-temporal data,” in 2016 European
Intelligence and Security Informatics Conference, EISIC 2016, Uppsala,
Sweden, August 17-19, 2016, 2016, pp. 92–95. [Online]. Available:
http://dx.doi.org/10.1109/EISIC.2016.024
[21] P. Jaccard, Distribution de la Flore Alpine: dans le Bassin des dranses
et dans quelques régions voisines. Rouge, 1901.
[22] P. Flach, Machine learning: the art and science of algorithms that make
sense of data. Cambridge University Press, 2012.