Online Child Exploitation Content Network

Indian Cyber Crime authorities identified a network distributing child exploitation material. Students will analyze distribution networks, geographic patterns, and suspect recruitment strategies.

# Aplly.xyz Case Study Submission

## Title
Online Child Exploitation Content Network

## Type
Cybercrime & Digital Forensics

## Difficulty
Intermediate

## Estimated Time
60 minutes

## Overview
Indian Cyber Crime authorities identified a network distributing child exploitation material. Students will analyze distribution networks, geographic patterns, and suspect recruitment strategies.

## Case Details

Function Focus: Cybercrime & Digital Forensics — manual reasoning, decomposition, and critical judgment (no spreadsheet or AI tool permitted in Phase 1)

Scenario:
You are the analyst at a fictional consultancy ("Praxis Advisors") tasked with answering: Online Child Exploitation Content Network. You have a clean, synthetic dataset described below. You must produce a defensible answer using structured reasoning — no tool-assisted shortcut on the first pass.

Dataset Structure:
- case_id
- platform
- content_type
- files_count
- users_involved
- countries_involved
- encryption_used
- payment_method
- anonymity_tool
- detection_date
- takedown_in_days
- suspects_arrested
- victims_identified
- tip_source
- darknet_access

Tasks:
1. Sort/segment the records to isolate suspicious entities (IPs, accounts, devices). Do this by hand first.
2. Map the connections between entities into a network; identify hubs, bridges, or high-risk clusters.
3. Correlate timestamp/event columns to reconstruct an attack or fraud timeline and locate the first-mover root source.
4. Score or rank candidate entities by risk using the dataset columns, justifying weights explicitly.
5. After your manual pass, re-run the risk ranking in a tool and reconcile any differences.

Expected Output:
A one-page incident analysis memo: suspect/entity shortlist with risk scores, network/timeline map, root-source identification.

Evaluation Criteria:
Soundness of the network/timeline reconstruction, correct risk-scoring methodology, evidence integrity reasoning.

## Data Sources

| case_id | platform | content_type | files_count | users_involved | countries_involved | encryption_used | payment_method | anonymity_tool | detection_date | takedown_in_days | suspects_arrested | victims_identified | tip_source | darknet_access |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CE001 | P2P Network | Images | 150000 | 1200 | 35 | End-to-end | Crypto | Tor | 2026-01-15 | 45 | 32 | 48 | NCMEC tip | True |
| CE002 | Encrypted Chat | Videos | 85000 | 450 | 18 | Signal | Crypto | VPN | 2026-02-20 | 30 | 12 | 15 | LEO undercover | True |
| CE003 | Dark Web Forum | Images+Videos | 220000 | 2800 | 52 | PGP | Monero | Tor+Bridges | 2026-03-10 | 60 | 55 | 85 | INTERPOL | True |
| CE004 | Social Media DM | Live streams | 50000 | 180 | 12 | Platform | Gift cards | Fake profile | 2026-01-05 | 15 | 18 | 22 | Platform report | False |
| CE005 | Cloud Storage | Images | 120000 | 350 | 22 | AES-256 | Crypto | VPN | 2025-12-01 | 90 | 20 | 30 | CERT-In | True |
| CE006 | P2P Network | Videos | 350000 | 3200 | 62 | End-to-end | Crypto | I2P | 2026-04-05 | 75 | 80 | 120 | Europol | True |
| CE007 | Messaging App | Images | 45000 | 95 | 8 | Platform | UPI | None | 2026-03-22 | 10 | 8 | 10 | Victim family | False |
| CE008 | Encrypted Cloud | All types | 280000 | 1800 | 42 | Zero-knowledge | Crypto | Tor | 2026-05-01 | 55 | 45 | 65 | FBI tip | True |
| CE009 | Live Streaming | Live streams | 95000 | 220 | 15 | HLS encrypted | Crypto | Fake ID | 2026-04-12 | 20 | 15 | 18 | NGO partner | False |
| CE010 | Dark Web Marketplace | Videos | 500000 | 4500 | 75 | PGP+Tor | Monero | Tor+Bridges | 2026-06-01 | 120 | 120 | 200 | Joint operation | True |


Full dataset: https://github.com/arora200/aplly_case_db/datasets/064-cybercrime-child-exploitation (synthetic, 15 records)

## Solution Frameworks
Network/graph analysis, log correlation, kill-chain mapping, anomaly detection, chain of custody & evidence integrity

## Solver Guidance & Tutorials
_Solver guidance added by the pipeline (tutorial links) — see `solver_guidance` field._

## What You'll Learn
- Map relationships into actionable networks
- Reconstruct attack timelines from logs
- Score risk from raw attributes

## Tags
Cybercrime, Child Exploitation, Network Analysis, Dark Web Investigation

## Registration Links
Register as Solver / Register as Evaluator