# Community Detection in a Web Discussion Forum During Social Unrest Events

Ao Shen, Kam-Pui Chow

► To cite this version:

Ao Shen, Kam-Pui Chow. Community Detection in a Web Discussion Forum During Social Unrest Events. 18th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2022, Virtual, United States. pp.169-185, 10.1007/978-3-031-10078-9_10. hal-05315732

HAL Id: hal-05315732

https://inria.hal.science/hal-05315732v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Chapter 10

COMMUNITY DETECTION IN A WEB
DISCUSSION FORUM DURING
SOCIAL UNREST EVENTS

Ao Shen and Kam-Pui Chow

**Abstract** Community detection, a network clustering method that identifies communities and reveals aggregated behavior, is an important topic in social network forensics. The purpose of social network forensics is to collect and analyze user information and content in social media. In recent years, much research has focused on social unrest events with the goal of accurately identifying key members in social networks. However, certain limitations exist with models that only use statistical properties of users and social networks, and do not consider the content of communications.

This chapter proposes a community detection model based on user
attributes and communication content to analyze social unrest events.
The investigation takes the form of a case study of users in a popular
Hong Kong discussion forum, which includes potential event organizers
and supporters. The results offer insights into engaging user behavior
attributes and content features to identify user communities and com-
munity structures.

**Keywords:** Social network forensics, unrest events, community detection

1. Introduction

Unrest events refer to manually-caused accidents, public health incidents and public security incidents that may result in serious social impacts and require emergency response measures [13]. Often, social unrest events escalate into conflict, violence and criminal activities [21]. Traditional crimes have been concealed with the development of the Internet [20], rendering conventional investigation methods difficult if not usable. When a social event is organized and the event details are disseminated using social media platforms, traces are buried in numerous
messages and posts. Social media forensics focuses on the extraction and analysis of user information from social media to identify, acquire and analyze user information for evidentiary purposes. Community detection, a network clustering method that identifies communities and reveals aggregation behavior, is an important topic in social network forensics. Forensic analyses of social unrest events often seek to identify key members in social networks [1, 6, 19]. Additionally, they help track protest movements, relationships between participants and community structures.

In 2019, a controversial extradition bill and police reaction to the resulting protests stirred extreme dissent in Hong Kong [22]. Massive demonstrations ensued, leading the Hong Kong Police to arrest 8,981 protesters between June 9, 2019 and May 29, 2020 [2]. Web discussion forums, anonymous and popular information dissemination platforms, became important channels for rapidly gathering and spreading information about planned protests.

This research does not focus on whether the protests were legal. Rather, it considers how law enforcement can leverage social media information related to social unrest events to maintain public safety [3]. Social media information has been well studied in disciplines such as law, sociology and psychology [5, 7, 21], but has not been studied adequately from the social network forensic perspective. Specifically, social media forensic techniques can be used to good effect to review and analyze social unrest events [17].

This research proposes a community detection model based on user attributes and communication content to conduct social network forensics and community detection during social unrest events. By examining social relationships and computing the similarities and connections between users, the model contributes to a deep understanding of user relationships and community structures. A case study involving LIHKG [11], a popular Hong Kong discussion forum, is employed to analyze the community of potential social unrest event organizers and supporters.

## 2. Related Work

Social network forensics is an emerging field of digital forensics [15]. Research has focused on the challenges and limitations of social network forensics, especially related to evidence collection and jurisdictional issues [9]. Information in social networks of particular interest in forensic investigations includes users, relationships and content [21]. Several attempts have been made to develop social media models that support the automated analyses of social network information.
Okolica et al. [16] developed a probabilistic latent semantic index model that was applied to analyze the Enron email corpus and identify potential malicious insiders who felt estranged from the organization or had hidden interests in sensitive topics. Mulazzani et al. [12] determined important data sources and methods for analyzing social network user data in digital forensic investigations. They also generated graphs to show friends and other individuals who had relationships with persons of interest.

Catanese and Fiumara [4] developed a smartphone traffic visualization tool for reasoning about the potential criminal associations of suspects. They employed traffic graphs that displayed connections between individuals based on recorded phone calls. Statistical measures were used to identify anomalous users and clustering algorithms were employed to construct user groups.

Tian et al. [19] proposed a method for analyzing relationships in the WeChat social network and constructing social network diagrams expressing user intimacy. WeChat users were clustered based on the compactness of their accounts.

Al-Khateeb et al. [1] have studied social influence in social networks, focusing on cyber propaganda campaigns conducted by deviant groups on Twitter. They collected social network user attributes such as the numbers of friends, followers, mentions and replies, and employed a focal structure approach to identify the most influential users.

Chan et al. [6] observe that, while mob phenomena have been well-studied in sociology and public health, user classification based on social influence is most relevant in social network forensic investigations. They classified discussion forum participants based on their online behavior to detect potential flash mob organizers.

Analysis of the research literature reveals that the focus is on understanding statistical influences in social networks using graph-based or attribute-based methods. In contrast, the research described in this chapter demonstrates that post and tweet content are also essential in social network forensic investigations. Whereas classical social network analysis models only consider statistical relationships between replies, retweets, etc., the proposed model focuses on content that provides deep semantic understanding of the relationships between users in social network communities.

### 3. Community Detection Model

The proposed community detection model seeks to detect the similarities and connections between users at the statistical influence and
<figure><img src="image_3.png" /><figcaption>Figure 1. Community detection model.</figcaption></figure>

semantic homophily levels. Figure 1 presents an overview of the community detection model.

**3.1 Statistical Influence Level**

Social influence has traditionally been assessed by measuring an individual's impact on other people. This section describes how the attribute-based method and graph-based network method are employed to measure the statistical influence of users.

**User Behavior Attributes.** Weak ties usually occur between acquaintances and strangers with distant social ties and little interactions whereas strong ties occur between friends and family [18].

It is believed that weak ties build a social community structure. A discussion forum integrates weak ties so that more new information can be received from anonymous forum participants [10]. Table 1 specifies the attributes that measure the motivation and influence of each weak tie in the LIHKG Hong Kong discussion forum. The motivation indicator expresses the frequency with which a user attempts to spread information and promote an event. The influence indicator indicates the level of attention that the content posted by a user attracts other users.

**Graph-Based Community Detection.** A graph-based social network is a structured weighted graph $G = (V, E, W)$ comprising nodes $V$ and edges $E$ with weights $W$. Nodes refer to individuals or organizations whereas edges between nodes represent social relationships. When two individuals communicate with each other, the compactness between them is expressed by a weight. A social network is constructed where each node indicates a user, an edge between two nodes indicates the
<table><caption>Table 1. User attributes in the LIHKG discussion forum.</caption><thead><tr><th>Category</th><th>User Behavior Attribute</th><th>Description</th></tr></thead><tbody><tr><td>Motivation</td><td>Posts</td><td>Number of posts by user</td></tr><tr><td>Indicator</td><td>Self-replies</td><td>Number of replies by user to his/her own posts</td></tr><tr><td>Influence</td><td>Replies to others</td><td>Number of replies by user</td></tr><tr><td>Indicator</td><td>to posts by other users</td><td>Number of replies to user received from other users</td></tr><tr><td></td><td>Replies from others</td><td></td></tr></tbody></table>

post-reply relationship between the two users, and the corresponding weight is incremented for every reply posted between the users.

In order to identify communities in a social network, a breadth-first search is used to traverse the social network and visualize the community graph.

The process of community detection begins by randomly selecting a user ID in the social network and locating its corresponding node in the community graph. Next, related nodes are traced using the edges connected to the selected node and other nodes connected to the nodes are identified; all these nodes form a community. Community detection terminates when every node has been allocated to a community.

## 3.2 Semantic Homophily Level

In order to conduct social network forensics at the semantic level, the similarity and homophily between posts created by users must be analyzed.

**Content Analysis.** Content analysis is performed by extracting keywords from content using the BERT-CRF named entity recognition method [14]. The named entity recognition method converts the text of a post to a vector corresponding to the post with semantic information. The named entities (keywords) in the text are detected and classified as different entity types. The BERT-CRF method employs the BERT (bidirectional encoder representation from transformers) algorithm [8] and a CRF (conditional random field) layer [23]. The BERT pre-training language model encodes a single character to obtain the corresponding character vector with context-related semantic information. The semantic vector of the context information is input to the CRF layer for decoding. CRF is a standard sequence labeling algorithm
that is used to label entities. The BERT-CRF model is trained with the default structure of the Chinese BERT-BASE model [8], which has 12 layers of transformer blocks and 12 attention heads. The length of the pre-training word vector is 768 dimensions and the batch size is 16 with the Adam optimizer and a learning rate of 1e-5.

**Similarity and Homophily Computation.** The similarity and homophily between users are computed by converting the user and posts created by the user to vector representations. The user post vector is the average of the vectors of all the posts created by the user:

$$ \text{Vector(user post)} = \frac{\sum_{i=1}^{n} v_i}{n} $$

where user post represents the user who has created posts in the LIHKG forum, $n$ is the total number of posts created by the user and $v_i$ is the vector of each post created via content analysis. By incorporating the post vector in the computation of the user vector, it is possible to accurately reflect the relationships and semantic connections between users.

## 3.3 Community Structure Detection

To reflect the clustering of user communities in the social network graph, community detection engages the $k$-means algorithm to compute the relationships between users and place them in user communities. The vector associated with each user is the concatenation of the user attributes vector and user post vector. The specific user vector is computed as follows:

$$ \text{Vector(user attributes)} = [attr1, attr2, attr3, attr4], \\ \text{Vector(user)} = \text{Vector(user attributes)} \oplus \text{Vector(user post)} $$

where Vector(user attributes) is the attribute vector of the user and $attr1$, $attr2$, $attr3$ and $attr4$ represent the number of posts, number of self-replies, number of replies to others and number of replies from others to the user, respectively. The $k$-means clustering algorithm is used to cluster users and detect communities. Thus, all the users are vectorized based on their user attributes and the content they posted. Finally, the users are classified into $n$ clusters representing different types of nodes (users).

As shown in Figure 2, there are three types of nodes in a hierarchical community structure, core node (tree root), parent nodes and leaf nodes.
<figure><img src="image_4.png" /><figcaption>*Figure 2. Hierarchical community structure graph.*</figcaption></figure>

The core node and parent nodes actively send and reply to posts whereas the leaf nodes only reply to posts from their parent nodes.

# 4. Experiments and Analysis

The application of the community detection model is illustrated using a case study involving the LIHKG discussion forum.

## 4.1 Data Collection and Labeling

The experimental data used to evaluate the performance of the proposed community detection model was collected from the Current Affairs Section of the LIHKG discussion forum from August 1, 2019 to August 11, 2020. Upon consideration of the ethical issues regarding data collection and the research purpose, only posts, replies, creation times and author IDs were collected. All sensitive and personal information was eliminated.

The dataset comprised 941,114 posts and replies, most of them written in Chinese and Cantonese. The frequent social unrest events that occurred all over Hong Kong during 2019-2020 renders the dataset ideal for studying patterns and characteristics of user communities, including potential unrest event organizers and supporters. Figure 3 shows the numbers of posts in the LIHKG discussion forum over August 1, 2019 to August 11, 2020.
<figure><img src="image_5.png" /><figcaption>Figure 3. LIHKG forum posts from August 1, 2019 to August 11, 2020.</figcaption></figure>

Since no authoritative real-world forensic dataset was available for
named entity recognition, a portion of the data was labeled manually.
In particular, 11,000 posts were randomly selected from the LIHKG
forum dataset and manually assigned entity labels. Table 2 shows the
named entity descriptions and examples.

## 4.2 Statistical Influence Analysis

Other social media platforms, such as Twitter and Facebook, maintain
multiple relationships between users, including reply, forward, follow and
like. However, the only action available to LIHKG discussion forum
users is reply; this renders analysis and network generation much more
accessible. Table 3 provides five examples of user attributes.

The attribute analysis results validate an earlier study that profiled
event organizers in a Hong Kong discussion forum [17]. Some users
generated large numbers of new posts and were very active at communi-
cating with others. As a result, these users received more attention from
other users as well as large numbers of replies (e.g., user IDs 5254 and
4018 in Table 3). Other users occasionally generated posts and actively
replied to their posts, which contributed to their higher rankings; these
users rarely contacted other users (e.g., user IDs 3242 and 52284 in Ta-
ble 3). The two types of users correspond to potential event organizers
or supporters.

In order to plot the social network in the discussion forum as a graph,
users were designated as graph nodes. If a user replied to a post by
another user, then a relationship was deemed to exist between the two
users and an edge was constructed between the two nodes. Table 4 lists
<table><caption>Table 2. Named entity descriptions and examples.</caption><thead><tr><th>Entity Type</th><th>Description</th><th>Example</th><th>Label</th></tr></thead><tbody><tr><td>Person</td><td>Name of relevant person</td><td>Carrie Lam Cheng Yuet-Ngor (Chief Executive of Hong Kong), thug</td><td>&lt;PER&gt;</td></tr><tr><td>Time</td><td>Relevant date and time</td><td>17:05, Oct 20, 2020</td><td>&lt;TIM&gt;</td></tr><tr><td>Location</td><td>Protest addresses</td><td>Hong Kong, Airport, Cheung Sha Wan Station</td><td>&lt;LOC&gt;</td></tr><tr><td>Organization</td><td>Names of relevant organizations</td><td>Hong Kong Police, Government Central Committee</td><td>&lt;ORG&gt;</td></tr><tr><td>Crime</td><td>Nouns/expressions about crimes</td><td>Assault, riot, vandalism, fire</td><td>&lt;CRI&gt;</td></tr><tr><td>Action</td><td>Relevant verbs</td><td>Sit-in, destroy, gather, commit arson</td><td>&lt;ACT&gt;</td></tr><tr><td>Tool</td><td>Hazardous tools</td><td>Metal rod, petrol bomb, fire extinguisher, arms</td><td>&lt;TOO&gt;</td></tr><tr><td>Emotion</td><td>Emotional words about protests</td><td>Hatred, love, support</td><td>&lt;EMO&gt;</td></tr><tr><td>Other</td><td>Irrelevant words</td><td>The, a, is, are</td><td>&lt;O&gt;</td></tr></tbody></table>

<table><caption>Table 3. User attribute examples.</caption><thead><tr><th>User ID</th><th>Posts</th><th>Self-Replies</th><th>Replies to Others</th><th>Replies from Others</th></tr></thead><tbody><tr><td>5254</td><td>226</td><td>1,614</td><td>771</td><td>12,285</td></tr><tr><td>4018</td><td>145</td><td>1,185</td><td>437</td><td>3,668</td></tr><tr><td>3242</td><td>127</td><td>186</td><td>6</td><td>7,697</td></tr><tr><td>52284</td><td>96</td><td>639</td><td>4</td><td>3,639</td></tr><tr><td>104878</td><td>95</td><td>146</td><td>55</td><td>6,665</td></tr></tbody></table>

some frequent user-user pairs and the corresponding numbers of replies they sent to each other.

Next, it is necessary to examine the distribution of the user-user pairs. The statistical results reveal that among the 108,841 users with 526,599 user-user pairs, only 1.26% of the pairs have more than ten connections. Thus, the focus was on the 1.26% of the pairs and a graph was constructed to present the social network corresponding to these users.
<table><caption>Table 4. Examples of frequent user-user pairs.</caption><thead><tr><td>User ID of Post</td><td>User ID of Reply</td><td>Frequency</td></tr></thead><tbody><tr><td>17665</td><td>14395</td><td>2,085</td></tr><tr><td>11834</td><td>11834</td><td>1,932</td></tr><tr><td>17665</td><td>1984</td><td>1,835</td></tr><tr><td>5254</td><td>5254</td><td>1,614</td></tr><tr><td>4531</td><td>4531</td><td>1,443</td></tr></tbody></table>

Figure 4 shows the community detection results. Clear delineations of three communities, A, B and C, exist with almost no communications involving users outside each community. Communities A, B and C have 1,736, 145, and 575 users, respectively, covering 37.1% of the pairs with more than ten connections. According to the number of users in each cluster, community A has many more users than the other two communities. However, as discussed above, the contents of posts and replies are important to community detection as well as to analyzing the semantic relationships between users. Therefore, the next section presents the results of semantic homophily analysis on the user pairs.

## 4.3 Semantic Homophily Analysis

The labeled posts were used as the training dataset for the BERT-CRF model to identify entities from the posts. The manually-labeled data was randomly split into 80% and 20% for the training and testing datasets, respectively. As mentioned above, the user vector was obtained by concatenating the user attributes vector and user post vector.

The entities extracted by BERT-CRF can be treated as keywords in the content. To illustrate the importance and indispensability of considering content in social network forensics, a preliminary user-entity network was generated for location entities. Figure 5 shows the resulting user-entity network. The gray nodes represent the location entities extracted by BERT-CRF. The black nodes correspond to users who mentioned the social unrest events related to the locations in their posts. Some locations such as Airport, PolyU (Hong Kong Polytechnic University) and CUHK (Chinese University of Hong Kong) are highlighted. The most interesting aspect of the graph is that the users who mentioned Airport were not interested in the unrest events at universities (PolyU and CUHK). Likewise, users who mentioned universities in their posts rarely mentioned unrest events at the Airport. The main reason is that,
<figure><img src="image_6.png" /><figcaption>Figure 4. Community detection results.</figcaption></figure>

during the period of the posts, all the universities in Hong Kong prohibited outsiders from entering their campuses. Therefore, it was almost impossible for outsiders to participate in campus unrest events.

## 4.4 Community Analysis and Visualization

In order to determine the community structure in the LIHKG discussion forum, an attempt was made to classify users into different groups. The community analysis involved three steps. First, the initial communities were identified by performing similarity clustering using k-means.
<figure><img src="image_7.png" /><figcaption>Figure 5. User-entity network sample.</figcaption></figure>

Next, the best number of clusters was computed based on the elbow method (four clusters in the experiment). Finally, the clustering result created during the first step was mapped to the social network. The mapping results reveal the community network and its structure.

To further analyze the user attributes and community structure, the clustering results were consolidated with community detection in the user-user network. Figure 6 shows the clustering results of communities A, B and C. The four grayscale colors represent the four clusters. Nodes with the same grayscale color are in the same cluster. Clusters 0, 1, 2 and 3 have 13, 52, 403 and 1,988 users, respectively. Figure 6 preliminarily illustrates that cluster 0 includes the core nodes in each community. User IDs 94, 1080 and 119, the core nodes in cluster 0, frequently communicated with other users. Nodes in cluster 1 are likely to be the parent nodes whereas clusters 2 and 3 comprise leaf nodes and several parent nodes that constitute the grassroots of the community. In this way, community structure can be employed to advance user analysis.

Table 5 shows the distribution of community users in each cluster. Cluster 0, the smallest cluster, includes the core users of each community. To compare the distributions of user attributes before and after adding the content analysis in the social network, the box plots in Figure 7
<figure><img src="image_8.png" /><figcaption>Figure 6. Clustering results of community structure.</figcaption></figure>

<table><caption>Table 5. Community user distributions in clusters.</caption><thead><tr><th>Community/Cluster</th><th>0</th><th>1</th><th>2</th><th>3</th><th>Total</th></tr></thead><tbody><tr><td>A</td><td>6</td><td>27</td><td>275</td><td>1,428</td><td>1,736</td></tr><tr><td>B</td><td>1</td><td>1</td><td>22</td><td>121</td><td>145</td></tr><tr><td>C</td><td>6</td><td>24</td><td>106</td><td>439</td><td>575</td></tr><tr><td>Total</td><td>13</td><td>52</td><td>403</td><td>1,988</td><td>2,456</td></tr></tbody></table>

indicate the distributions of the four user attributes in different clusters. Specifically, the four plots represent the distributions of the four user attributes in clusters 0 to 3. Compared with other clusters, cluster 0, which includes the core users in each community, has the highest median value for all four user attributes.

Therefore, it can be assumed that the core members are not only a minority community, but are also most proactive and influential at organizing or supporting social unrest events. Since the clustering algorithm is based on user attribute similarity and content similarity, the users in cluster 0 usually posted similar content in the LIHKG discussion forum. To verify that the users in cluster 0 are potential organizers or support-
<figure><img src="image_9.png" /><figcaption>Figure 7. Attribute distributions in clusters.</figcaption></figure>

ers of the unrest events, the numbers of crime, action and tool entities must be computed to evaluate if users mention the topics related to unrest events frequently. Indeed, the data analysis reveals that the users in cluster 0 posted the largest number of event-related topics (12,393), accounting for 51.2% of event-related topics.

**5. Conclusions**

User relationship analysis and community detection are important tasks in social network forensics. The community detection model described in this chapter leverages statistical data about user attributes and semantic analysis of the communications between users. By mining and analyzing user relationships and community structure, users and communities with high levels of social influence are identified from among a massive number of users. The results provide valuable clues in social network investigations and can be used proactively to prevent social unrest demonstrations from going out of control.

Future research will attempt to integrate community structure and communication content, such as adding entities in the social network as a new type of node. Additionally, research will focus on topic extraction in social networks and user communities, and apply sentiment analysis to user communities.
References

[1] S. Al-Khateeb, M. Hussain and N. Agarwal, Leveraging social network analysis and cyber forensic approaches to study cyber propaganda campaigns, in *Social Networks and Surveillance for Society*, T. Ozyer, S. Bakshi and R. Alhajj (Eds.), Springer, Cham, Switzerland, pp. 19–42, 2019.

[2] A. Arranz, Arrested Hong Kong protesters: How the numbers look one year on, *South China Morning Post*, June 11, 2020.

[3] H. Arshad, A. Jantan and E. Omolara, Evidence collection and forensics on social networks: Research challenges and directions, *Digital Investigation*, vol. 28, pp. 126–138, 2019.

[4] S. Catanese and G. Fiumara, A visual tool for forensic analysis of mobile phone traffic, *Proceedings of the Second ACM Workshop on Multimedia in Forensics, Security and Intelligence*, pp. 71–76, 2010.

[5] J. Chan, A storm of unprecedented ferocity: The shrinking space of the right to political participation, peaceful demonstration and judicial independence in Hong Kong, *International Journal of Constitutional Law*, vol. 16(2), pp. 373–388, 2018.

[6] V. Chan, K. Chow and R. Chan, Profiling flash mob organizers in web discussion forums, in *Advances in Digital Forensics XII*, G. Peterson and S. Shenoi (Eds.), Springer, Cham, Switzerland, pp. 281–293, 2016.

[7] Y. Chen, The controversy of the Amendment of Anti-Extradition in Hong Kong – Threat to the people of Hong Kong, *HOLISTICA – Journal of Business and Public Administration*, vol. 10(3), pp. 133–142, 2019.

[8] J. Devlin, M. Chang, K. Lee and K. Toutanova, BERT: Pre-training of deep bidirectional transformers for language understanding, *Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1*, pp. 4171–4186, 2019.

[9] M. Firdaus, Forensic Analysis of Social Media Data: Research Challenges and Directions, Department of Information Security, Graduate School, Pukong National University, Busan, South Korea, 2020.

[10] M. Granovetter, The impact of social structure on economic outcomes, *Journal of Economic Perspectives*, vol. 19(1), pp. 33–50, 2005.

[11] LIHKG Discussion Forum, Hong Kong, China (lihkg.com/cate gory/1), 2016.
[12] M. Mulazzani, M. Huber and E. Weippl, Data visualization for social network forensics, in *Advances in Digital Forensics VIII*, G. Peterson and S. Shenoi (Eds.), Springer, Berlin Heidelberg, Germany, pp. 115–126 2012.

[13] S. Muthiah, B. Huang, J. Arredondo, D. Mares, L. Getoor, G. Katz and N. Ramakrishnan, Planned protest modeling in news and social media, *Proceedings of the Twenty-Ninth AAAI Conference*, pp. 3920–3927, 2015.

[14] D. Nadeau and S. Sekine, A survey of named entity recognition and classification, *Lingvisticae Investigationes*, vol. 30(1), pp. 3–26, 2007.

[15] A. Nikolaidou, M. Lazaridis, T. Semertzidis, A. Axenopoulos and P. Daras, Forensic analysis of heterogeneous social media data, *Proceedings of the Eighteenth Joint Conference on Knowledge Discovery, Knowledge Engineering and Knowledge Management*, pp. 343–350, 2019.

[16] J. Okolica, G. Peterson and R. Mills, Using PLSI-U to detect insider threats from email traffic, in *Advances in Digital Forensics II*, M. Olivier and S. Shenoi (Eds.), Springer, Boston, Massachusetts, pp. 91–103, 2006.

[17] A. Powell and C. Haynes, Social media data in digital forensic investigations, in *Digital Forensic Education*, X. Zhang and K. Choo (Eds.), Springer, Cham, Switzerland, pp. 281–303, 2020.

[18] M. Ruef, Strong ties, weak ties and islands: Structural and cultural predictors of organizational innovation, *Industrial and Corporate Change*, vol. 11(3), pp. 427–449, 2002.

[19] J. Tian, Y. Bi and J. Ma, Research on forensics of social network relationship based on big data, *Journal of Physics: Conference Series*, vol. 1584(1), article no. 012022, 2020.

[20] D. Wall, *Cybercrime – The Transformation of Crime in the Information Age*, Polity Press, Cambridge, United Kingdom, 2007.

[21] J. Wang, Hong Kong's Government faces resistance from within as dissent spreads. Organizers expect more than 1,000 civil servants to attend a rally despite the threat of consequences, *The Wall Street Journal*, August 2, 2019.

[22] Wikipedia Contributors, 2019-2020 Hong Kong protests, *Wikipedia* (en.wikipedia.org/w/index.php?title=2019%E2%80%932020_Hong_Kong_protests&oldid=1066507368), January 18, 2022.
[23] C. Wojek and B. Schiele, A dynamic conditional random field model for joint labeling of object and scene classes, *Proceedings of the Tenth European Conference on Computer Vision, Part IV*, pp. 733–747, 2008.