A Generalized Benford Framework for Threat Identification in Counter-Intelligence

In this paper, we develop a framework of 'Benford models' for counter-intelligence investigations which analyze frequency data of a suspect's visits to physical locations, online websites, and communication channels. We accomplish this by establishing the Benford measure for continuous & bounded domains, generalizing the accumulated percentage differences between sites in the frequency data with the log-determinant of 'Benford Matrices,' employing an estimator to determine a 'Benford Test Statistic,' and identifying maximal values of that test statistic across all permutations of included sites in our data. This framework is intended to complement outlier analysis models by finding where hidden Benford patterns 'break' in frequency data and telling investigators which sites they should investigate.