Artemis Triage Child Pornography Tool
Developers: Chris Boehnen, Ph.D.;
Ryan Kerekes, Ph.D.;
Imaging, Signals, and Machine Learning Group
Measurement Science and System Engineering Division
Oak Ridge National Laboratory
Oak Ridge, TN 37831
Sponsored by the National Institute of Justice
What is Artemis Triage?
Artemis is a free software tool for use by law enforcement to automatically scan computers for child pornographic images and videos. Developed by researchers at Oak Ridge National Laboratory (ORNL) and the University of North Carolina Wilmington, Artemis combines image analysis technology, hash matching, and keyword searches to automatically identify images and videos that are likely to contain child pornography. The tool is designed to drastically reduce the amount of time an officer must spend searching a suspect’s hard drive for illegal material.
The developers of Artemis have worked in close cooperation with police officers Mel Pierce and Tom Evans of the Knoxville Police Department (KPD) Internet Crimes Against Children (ICAC) unit. This partnership has enabled us to tailor Artemis to the specific needs of police officers who are fighting the battle against child exploitation on a daily basis. KPD has successfully used Artemis in dozens of cases to efficiently scan suspect hard drives and make subsequent arrests.
How does Artemis work?
The Artemis tool first locates all the image and video files residing on a suspect hard drive. For each image and video, the tool computes a score based on several primary factors
- Skin content
- Presence of faces
- Age of Faces
- Hash Values
- Filename keywords
- Image Size
If the hash value matches an entry in a list of known illegal files, the image is automatically flagged. Otherwise, it is given a “pornography likelihood score” between 0 and 100 based on the first three criteria. After completing a scan, the tool generates a report in HTML format that lists the drive’s most suspicious files in order of this pornographic likelihood score. By browsing this ranked list instead of an arbitrarily ordered collection of the drive’s content (as provided by most forensic software tools), officers can determine the presence of child pornography in a fraction of the time. Officers using the tool estimates it saves them on average of a day and a half per examination and allows for an immediate arrest on site.
What are the system requirements?
Currently, Artemis supports Windows XP, Vista, and 7. No installation or additional libraries are required, making Artemis suitable to run from a thumb drive in the field. Artemis will run on a single-core machine, but drastic speedup can be achieved on systems with multiple cores (e.g., Intel Core 2 Duo).
What is the status and availability of Artemis?
Artemis Version 1 is currently released. Artemis is and will remain free of charge to all U.S. law enforcement agencies once this testing is complete. Distribution outside of Law enforcement requires express written consent per the licensing agreement. The next major stable release of Artemis will be in the early Fall of 2011. Artemis Version 2 is under development at ORNL and will include a variety of additional functionality, including face age estimation, pornographic feature detection, improved video analysis, and SQL database support. Although we are unable to provide technical support for Artemis, we nonetheless encourage feedback from active users, and we will make every effort to incorporate suggestions and fix bugs as we continue to develop the tool.
Individuals from the following organizations contributed to the development of Artemis Triage:
The Face Aging Group
Knoxville Police Department
U.S. Immigration and Customs Enforcement (ICE) Cyber Crimes Center
The National Association to PROTECT Children
Oak Ridge National Laboratory (ORNL)
Measurement Science and System Engineering Division
Portions of the Artemis Triage project was made possible with a grant from the National Institute of Justice.