Enabling Public Security Text-Based Analytics: A Survey to Outline Research Directions

1. Introduction

Text mining is an area of artificial intelligence dedicated to data extraction from unstructured text to find helpful information and develop the knowledge needed to support decision-making [1,2]. Also known as knowledge discovery in textual databases, the process extracts previously unknown, understandable, potential, and practical patterns or knowledge from unstructured textual data [3,4]. Government and public agencies are aware of the relevance of using the social web, mobile services, artificial intelligence, the analytical processes enabled by their use, and the social benefits these tools bring to public administration and citizens [5]. Public health, environmental, and security surveillance, for instance, are areas that greatly benefit from the application of text mining which acts as a digital transformation vector able to assist in obtaining feedback from citizens on services [6,7,8,9]. Among other government and public administration areas, Zhang et al. [10] highlighted public security as a recipient of artificial intelligence applications, noting that there is interest in studying possible applications to improve management actions.

Specifically, about public security, Han et al. [11] commented on the importance of general data mining applications to detect and prevent crimes, such as supporting the detection of fraud, money laundering, and insurance crimes. Hashimi et al. [12] stated the advantages of using text mining to provide automatic tasks to deal with incremental amounts of data by retrieving and extracting useful information, making predictions based on the observations and statistics provided, discovering patterns from the data provided for trend detection to support public security agencies in monitoring and analyzing textual data from the social web.

Also, regarding the benefits and advantages of using text mining in matters related to public security, Tseng et al. [13] presented a method to mine terms in text collections for crime investigations in their study. Crime investigation is one of the recurrent activities in public security, involving the analysis of various types of material related to the occurrence of crimes, including texts in different formats, whether printed or digital. Criminal databases belonging to police agencies may contain numerous texts that can describe detailed relationships between data such as the type of crime, suspects, victims, and locations so text mining tools aid in relationship discovery. Considering this context, the area of cybersecurity, aimed at combating incidents that could compromise the security of users of cyber systems, has a notable participation, providing strategic plans and tools to guarantee the integrity of systems and the information that flows through them [14].

Another facet of applying text mining in public security is that it enables an understanding of human behavior, as highlighted by the study developed by Tutun et al. [15]. They dedicated their study to understanding patterns and relationships in terrorist behavior using text mining techniques. It is noticed that any human activity that can compromise public security in general and that generates textual records, for example, through social networks, chats, emails, or blogs, can be analyzed with text mining techniques [16].

This article presents the results of a survey to extract key information about text mining in the context of public security, including applications, technologies, and directions for future research. A research agenda was outlined based on the directions identified, intending to support researchers in finding research gaps to develop new studies.

The sequence of this article is organized as follows. Section 2 contains a description of the systematic literature review process applied; Section 3 presents the results of the review and the related discussions, and at the end, it outlines future research directions supporting defining a research agenda based on identified opportunities and challenges, according to three axes; Section 4 concludes the work; Section 5 brings updates considering the interval between 2021 and 2024.

2. Survey Process

Surveys (or systematic literature reviews) are processed through formally defined bibliographic research protocols [17] that provide researchers with information and insight about a subject of interest, supporting new research [18,19], and reducing the effect of publication redundancy [20]. The literature review presented in this article was performed following the guidelines defined by Kitchenham and Charters [21] in three key steps: planning, conduction, and reporting. While this process appears sequential, it involves iterative steps [21]. The two first steps are presented in the following sections, and the last one represents the results in Section 3.

2.1. Methodological Summary

All methodological information and criteria related to the systematic literature review planning and subsequent search execution are presented in Table 1.

The terms used in the Boolean condition were taken from the current Brazilian penal code (see the official Brazilian Penal Code website: http://www.planalto.gov.br/ccivil_03/decreto-lei/del2848.htm) and compared with those in (i) the American Model Penal Code – see Robinson and Dubber [22] –, and (ii) in the crime information according to the Crown Prosecution Service (see the Crown Prosecution Service website: https://www.cps.gov.uk/cps/crime-info) that covers Wales and England. Finally, Brazilian Jurisprudence (the JusBrasil portal was consulted: https://www.jusbrasil.com.br/) was also consulted, through documents in a public access portal, to further corroborate its validity in the search condition.

2.2. Review Conduction

The final search query was applied to the selected databases on June 11th, 2021, and it found 806 articles, including 485 from Scopus, 141 from Web of Science, 76 from IEEE Xplore, and 104 from ACM Digital Library. The subsequent filter eliminated 178 duplicates. The next stage consisted of screening the remaining material by reviewing titles and abstracts, resulting in the exclusion of 376 papers, leaving 252 remaining articles for the information extraction phase. Subsequently, 58 works were excluded because they were considered out of the literature review's scope. With these exclusions, the final number of findings in the literature was 194. Figure 1 represents the literature selection process with the number of works selected and excluded in each step.

The third research question (RQ3) required additional filtering for the most recent literature (published between 2018 and the first semester of 2021) to identify works with future research proposals supporting the detection of opportunities and challenges on the research themes. In this final filter, a set of 92 studies was selected, containing the desired information, supporting a research agenda on text mining in public security. The following section will present and discuss the results of the literature review.

3. Results and Discussion

This section focuses on (i) identifying the primary applications performed according to the 194 selected articles, (ii) providing a visualization of the methods, techniques, and technologies used in the context of public security, and (iii) discovering the opportunities and challenges for the development of new research. The final part of this section is devoted to comments, based on the literature presented, on the ethical issue related to the use of text mining in public security. A spreadsheet with the information extracted from all selected literature is available in a GitHub public repository (see https://github.com/victorheuer/tm_ps_literature-info). More details about the results presented in this section are presented in de Carvalho and Costa [23].

3.1. General Findings

Following the procedure presented in Section 3, general data were extracted from the 194 selected articles regarding the types of research, publication years, and keywords to enable the identification of interesting information. Figure 2 contains the distribution of these works according to the publication years from 2014 to 2021.

The largest number of works occurred in 2018 with 36 works, followed by 2019 with 35, 2017 with 34, and 2020 with 32. These four years added up to 137 works (70.10% of all selected publications). These data suggest that 2017 was a milestone year for the increase in publication numbers on topics of interest, with 47,83% more than 2016. It is important to emphasize that the final number of works for 2021 was not higher because data collection was completed in June 2020. Figure 3 shows the types of work distribution, with most being conference papers, followed by journal publications and book chapters.

Most conference papers occurred in 2017, followed by 2016 and 2020, cumulating 50 works. 2018 incurred the largest number of journal articles, followed by 2019 and 2020, cumulating 53 works. Finally, the book chapters occurred at the same number in 2018 and 2019, followed by 2016 and 2020, cumulating 16 works. The distribution of these types by year is listed in Table 2.

From the information extracted about the publication channels, it was possible to list the number of works published on text mining in public security defined according to each journal, conference, and book/series between 2014 and 2021. Table 3 contains the journals with more than one article published on the theme in the defined years.

About these findings, it is important to note that Procedia Computer Science is a journal dedicated to publishing high-quality conference proceedings. The journals in Table 3 were extracted from a list containing 64 journals.

There was an extensive list of 84 different conferences, with only five of them – the 2016 Pacific Asia Conference on Information Systems, the 2017 European Intelligence and Security Informatics Conference, the 2018 IEEE International Conference on Intelligence and Security Informatics, 22nd Americas Conference on Information Systems, 8th International Conference on Computing, Communication, and Networking Technologies – with more than one paper from the selected literature. Finally, among the seventeen books from which the selected chapters came, one of them - Advances in Intelligent Systems and Computing - contained three selected chapters, and all the others contained only one.

3.2. Application areas for text mining in public security

The first research question (RQ1) considers the application areas for text mining within the context of public security. According to what the authors made evident in their texts, the analysis of the selected studies detected nineteen different application areas. These areas and the count of related findings are listed in Table 4.

The nineteen application areas contained in Table 4 were defined according to the findings in the literature. Each journal article, conference paper, or chapter selected was manually tagged based on the primary area of application of text mining tools in public security, as per the reading of these materials, also seeking this information.

These results suggest that "Cybersecurity" is the area with most studies containing text mining applications. Following this field are "General Crime detection/prediction", "Fraud detection", as well as "Terrorism detection", "Cyberbullying detection", and "Digital/Cyber forensics", collectively representing 80.94% of the selected studies.

While the labels used to designate the corresponding topics seem simple, some areas, such as "General crime detection/prediction", "Support to Law Enforcement agencies' actions", and "Support to the Judiciary power" are more general. Others, such as "Digital/Cyber forensics", "Cyberbullying", and "Information security" are all aligned to "Cybersecurity" but remain separated to ensure more details about these areas.

The label "General crime detection/prediction" concerns an application area not dedicated to a specific type of crime, such as "Fraud detection" or "Drug-related crime detection." The works by Aghababaei and Makrehchi [24], Das and Das [25], Qazi and Wong [26], and Lal et al. [27] contain examples of applications in "General crime detection/prediction".

The "Support to Law Enforcement agencies' actions" application area is related to providing complete systems architecture, methodologies, and frameworks for agencies dedicated to ensuring compliance with the laws to maintain public security and social welfare. This set is composed of the works by Badii et al. [28] that proposed a system architecture to provide data analytics (including a text mining and analytics module) for supporting decision-making in law enforcement agencies; Bisio et al. [29] that proposed an approach to allow law enforcement agencies to detect events, using Twitter traffic monitoring, that compromise public security; Basilio et al. [30] that presented a methodology to extract knowledge from police reports for extracting information to support activities related to law enforcement; Behmer et al. [31] that proposed a framework to support law enforcement agencies in the investigations and analyzes of organized crime; Basilio et al. [32] that developed a method for knowledge discovery in emergency response databases based on police reports; and Hou et al. [33] that proposed the Bidirectional Encoder Representation from Transformers based on the Chinese relation extraction algorithm for public security, for security information mining.

The "Support to the Judiciary power" area refers to developing applications that aid judiciary activities since they may also be related to crime judgments and analysis or judicial reports about crimes. This set is composed of the works by Nikolić et al. [34] that proposed an e-Government service for extracting information from documents related to laws (Criminal Codes, for instance); Iftikhar et al. [35] that proposed a system to support courts' activities with text mining to extract relevant information from legal data; Pina-Sánchez et al. [36] that analyzed court sentence databases to detect ethical discrimination; Pina-Sánchez et al. [37] that proposed an approach to access data based on mining judiciary sentence records about crime available online; Xia et al. [38] that evaluated if judge gender exerted some effect over the sentences concerning rape, and Gomes and Ladeira [39] that applied an empirical evaluation of a framework for jurisprudence retrieval to ease the task of retrieval of other decisions with the same legal opinion.

The "Drug-related crimes detection and Weapons' trafficking detection" combination appears among the application areas, with only one study selected, by Al-Nabki et al. [40] that proposed a new feature replacing the use of external sources of knowledge, applying it to recognize named entities related to suspicious activities related to weapons and drug trafficking through the Tor Darknet. The distribution of the selected works by year is shown in Figure 4, highlighting cybersecurity as the area with the greatest number of selected works over seven years in the defined period.

3.3. Text mining techniques and technologies applied in public security

The selected works' methodological sections were analyzed to answer the second research question (RQ2). In this case, information extraction was performed to identify the terms referring to techniques or technologies, counting their frequencies. Techniques are all the algorithms and methods used to make text mining viable, while technologies can be understood as tools such as programming languages, code libraries, and other software that contain implementations of these techniques.

For each term, the number of occurrences represents the number of works that included a specific technique while recognizing that each work could apply more than one technique or technology. Figure 5 contains the frequency of the 20 more recurrent terms.

The terms "support vector machines", "naïve Bayes", "random forests", "decision trees", "logistic regression", "k-nearest neighbors", and "neural networks" represent machine learning techniques applied to classification problems typically related to the detection or prediction of crimes within the context of the types of applications in the security areas presented in the previous section. Of these, "support vector machines" is the most frequent technique, being a discriminative classifier [41] and one of the most effective classification algorithms for general purposes [42].

The term "naïve Bayes" refers to one of the simplest generative machine learning classifiers [43], and its algorithm is based on the Bayes Theorem with independence assumptions between the predictors [44]. It is the second machine learning technique most frequently applied by the literature selected.

The term "random forests" refers is an ensemble technique with excellent predictive performance [42] using unpruned decision trees based on bootstrap samples of the training data [45]. "Decision trees" refer to another popular technique based on a tree data structure that contains a set of nodes and edges to support decision-making [43]. Both "random forests" and "decision trees" occurred the same number of times in the selected literature.

The term "logistic regression" refers to a generalized linear regression model [42] that makes predictions using a binary or multiclass outcoming [46]. The term "k-nearest neighbors" refers to a popular technique that assigns elements to a class with their neighbors according to a similarity measure (as in cosine and Jaccard similarities, for instance) [44,47].

The term "neural networks" refers to non-linear machine learning techniques that simulate the human brain to solve problems [43,48]. These networks establish relationships between inputs and outputs, associating input data to their belonging classes through a series of hidden layers and the links between the created nodes [49].

The term "latent Dirichlet allocation" refers to a machine learning technique dedicated to topic modeling. It is a generative probabilistic model used to identify latent topics among the texts in a corpus, modeling each corpus item as a finite mixture over a latent set of topics [50,51]. Topic modeling is the process of discovering hidden topics within semantic structures that contain interrelated concepts [52,53,54].

"Term frequency-inverse document frequency" is a statistical measure applied for feature extraction and selection, which consists of reducing the original set of textual data into a new set, more readable by other techniques, such as machine learning related ones [55,56,57]. Another related term is "term frequency", simply referring to counting the frequency of words in a text, being a component of "term frequency-inverse document frequency" calculation [54]. In Figure 5, a subset of terms refers to technologies for text mining solutions, such as programming languages, code libraries, and some programs specifically developed to apply data mining.

Among the programming languages, Python is the most recurrent. For instance, Al-Nabki et al. [40] applied Python with Keras framework in a neural network architecture to recognize named entities in suspicious Darkweb domains. Birks et al. [58] also used this programming language with Gensim wrapper to identify crime clusters. Bozyiğit et al. [59] used Python with Scikit-Learn to classify cyberbullying contents using texts extracted from social media.

The "Natural Language Toolkit" and "Scikit-Learn" are libraries developed in Python, the first deals with natural language processing problems, and the second contains pre-built machine learning techniques, such as many of those presented above. The "Scikit-Learn" library includes several machine learning techniques implemented with great flexibility for applications, as demonstrated in the works by Chen et al. [60], Dong et al. [61], Martín et al. [47], and Thao et al. [48]. The "Natural Language Toolkit" contains essential functions implemented to perform preprocessing tasks (Dong et al., 2018), "named entity recognition" [25], and to apply "term frequency-inverse document frequency" [55], for example. Preprocessing tasks involve applying natural language processing techniques to treat the texts by eliminating noise that affects the analytical process and formatting the text to perform subsequent processing. Examples of these preprocessing tasks include text cleaning and normalization, removing special characters, numbers, empty or white spaces, stop words, performing case folding, stemming, and lemmatizing, tokenization, and extraction of n-grams as evidenced by the work by Aboluwarin et al. [62], Chandra et al. [63], Gil et al. [64], Martín et al. [47], and Savaliya and Philip [65].

The "R language" is the second most recurrent within this set, containing several functions like the Python language and its libraries. The work by Basilio et al. (2019), for instance, applied preprocessing tasks and topic modeling using the R language. In addition to performing preprocessing, Cichosz [42] applied machine learning classification techniques from R language packages. Aboluwarin et al. (2016) applied the R language for preprocessing and several Scikit-Learn functions, using Python, to perform classifications. Other languages were detected but did not appear as regularly as Python and R, including Java [66,67,68,69]; Perl [36,37,70]; PHP [66,71]; and C++ [72].

Distinct from these programming languages, "WEKA" and "RapidMiner" are computer programs specifically developed for machine learning and data mining purposes. WEKA is a machine learning platform that contains several implemented techniques (Alothman & Rattadilok, 2017). The research by Das and Das [73,74] used WEKA to compare it with their methodology to process and analyze online newspaper reports covering crime. Almehmadi et al. [75] used WEKA to perform preprocessing tasks over a retrieved corpus and to apply a machine learning technique (support vector machines). RapidMiner is a software dedicated to data mining with several functions for data manipulation, statistical analysis, and graphic presentation [76]. Noviantho et al. [77] and Samtani et al. [78] are examples from the selected literature using RapidMiner and WEKA, the first paper dedicated to cyberbullying classification, the second for identifying and assessing vulnerabilities in Supervisory Control and Data Acquisition (SCADA) systems.

Terms like "named entity recognition", "manual annotation", and "dictionaries", refer to natural language processing subjects. The term "named entity recognition" refers to an information extraction task for detecting named entities that are related, such as people, organizations, locations, expressions of time, and money [79,80]. "Dictionaries" are lists composed of keywords extracted from texts with descriptions of the characteristics related to a target term or word [81]. These textual data structures present the sensitivity of a text or document as defined by the experts in the field to which it is related [82]. "Manual annotation" refers to the process of creating a corpus with some labels or tags, such as in sentiments' polarities, using expert people. Petrovskiy and Chikunov [83] and Saini and Bansal [84] applied manual annotation to create corpora, which were later used to train machine learning techniques for performing classifications.

Most Frequent Techniques and Technologies by Application Area

According to each application area, a separation of the most frequent techniques and technologies was made to provide greater detail in answer to RQ2. Figure 6 contains an assembly with bar plots showing the counts for the most frequent techniques and technologies in the six areas with the most works selected (see Table 4). In this figure, there are cases where there is more than one term associated with a bar in the graph, indicating that each term has precisely the same number of occurrences as represented by the bar.

For “Cybersecurity”, the bar with four occurrences for each term involves: adaboost, named entity recognition, word clouds, and support vector machines. For “General crime detection/prediction”, the bar with two occurrences for each term involves: cluster analysis, georeferencing, logistic regression, natural language toolkit, neural networks, random forests, and rapidminer. For “Fraud detection”, the bar with two occurrences for each term involves: bagging, georeferencing, latent Dirichlet allocation, loss calculation, matlab, neural networks, risk calculation, scikit-learn, cosine similarity, and principal component analysis.

Figure 7 contains a way to visualize the combinations of terms between the six main areas according to the term extraction performed. The dots refer to terms appearing isolated, and dots connected by lines indicate term combinations. The bars on the left side are the number of occurrences among the six main areas, and the bars on the top of the plot are the counts of terms (isolated or in combination with other terms).

The term "naïve bayes" is an interesting case to exemplify the analyses that can be done with Figure 7: it appears five times among the terms listed in all areas, which determines that it is at the intersection of five areas; it also appears twice alone, once in combination with just the term “support vector machines”, once with "term frequency-inverse document frequency", and once with both the terms "r language" and "term frequency-inverse document frequency". The term “python” has similar behavior in this plot: it also appears five times, being in the intersection of five areas; twice it is isolated from other terms; once it is combined with “random forests” and “named entity recognition”; once it is combined with “term frequency-inverse document frequency” and “k-nearest neighbors”; and once it is combined with “support vector machines”, “named entity recognition” and “natural language toolkit”.

The most recurrent term is “support vector machines”, appearing six times, in other words, it is in the intersection of the six main areas. It is followed by “python”, “term frequency-inverse document frequency”, “random forests”, and “naïve bayes”. For more counts, see Figure 7.

3.4. Identifying Opportunities and Challenges for Text Mining in Public Security-Related Applications

To identify opportunities and challenges as directions for text mining in the public security field (RQ3), the conclusion sections or correlates of the selected articles were analyzed during the last filtering process to extract only those that contained proposals or directions for future developments.

This filtering identified 92 works among the 194 selected for determining directions to enhance research already developed. Identifying and extracting these directions are critical to supporting the outline of the research agenda presented in the following subsections. These directions were grouped according to the applications presented in Section 4.2, and Table 5 lists the work counts from 2018 to 2021 that included future research indications by the application area.

The following subsections outline a research agenda referring to some of the 92 selected works seeking to respond to RQ3, thus pointing out the opportunities and challenges within three axes in a more synthetic way.

3.4.1. Research Directions: Outlining a Research Agenda

The opportunities and challenges found in the literature associated with Table 5 demonstrated further research proposals from the most recent related works that outline a research agenda in three interrelated axes. The first axis consists of objectives expansions, the second incorporates methodological extensions, and the third considers scenario extensions and changes.

The interrelationship between these axes involves the influence of the objectives in determining the methodological approach to be used since it is impossible to define a methodology unless the research objectives are identified. Consequently, these two axes' definitions imply the need for changes and extensions in study scenarios, including data collection and the use of techniques and technologies, considering the target subject (public security) and its relations with other subjects of interest. Another important detail is that these relationships between the three axes are related to the need to improve the results of previous studies. Figure 8 represents the three axes in the agenda and the described interrelationship among them.

The diagram in Figure 8 also contains the detected elements presented for each axis, which will be described in the following three sections.

Objectives Expansions

The literature explored to support identifying the most recent directions for further research indicated new objectives to enhance the current research. Further analysis and experimental developments using text mining-related technologies in public security indicate the need to extend the current research to incorporate other target elements to be analyzed. The incorporation of socio-demographic and georeferencing information [59,85] and the expansion and combination of datasets [67,68,86,87] are important indications for improving the quality of classifications and predictions. New objectives in this sense may have repercussions on creating new databases, new corpora, performing data fusion, and ensuring more extensive and more diversified datasets for use with mining techniques. The refinement of categorization schemes applied to the objects of study is a natural consequence of the proper use of more extensive databases [78].

The use of visualization tools like maps for spatial analysis of crime occurrences over time, for instance, becomes feasible using georeferenced information (see, for instance, [43,88]). From this perspective, expanding research objectives could incorporate georeferencing, when geographic information is available, providing maps as elements of visualization of some phenomenon or event occurring concerning public security. Virtually every public security application area can employ this information to improve analytics by providing more interesting dashboards and reports for related managers to make their decisions.

Incorporating socio-demographic and georeferencing information is essential for developing new experiments that can enable, for example, the understanding of where the people who express opinions through the analyzed media are located, their age groups, gender, education levels, and positioning according to social classes. Combined with the texts mined and analyzed, this information can allow managers in public security to filter specific problems and ensure decisions are more focused on the appropriate target audience.

Incorporating, in addition to text analysis, other media such as images, videos, and sound recording, in other words, multimedia analysis [49], can favor areas such as: "Digital / Cyber forensics", for assisting in investigation processes, extracting relevant information from various media related to crimes that occurred; "Support to the Judiciary power" for its ability to facilitate the analysis of evidence in multiple formats to support court decisions; "Crimes' victims support", which can provide police authorities with indications that victims of crime need protection, as they are still under some threat that has been recorded either in text or in other media; and "Terrorism detection", for providing indications of movements of suspicious groups, for example, through video analysis.

Another point that deserves to be commented on is the review of objectives incorporating the improvement of results and performance of the proposed analytical solutions are important considerations for further research indications [55,61] with implications on the methodological approaches the research should adopt, as is explored in the next section.

The performance improvement of the techniques used in text mining, in terms of metrics such as accuracy, precision, recall, and F1-score, is of great relevance for developing or improving frameworks and systems, appearing as a recurring expansion of objectives in proposals for future work. Analyzing techniques' performances allows researchers to incorporate and select different text mining approaches for a range of public security applications, making better decisions about which technique to use [25,86,89,90,91,92,93].

Methodological Extensions

As the objectives lead to the need for adaptations, changes, or extensions in the methodology applied in current research, the corresponding proposals are presented in this part, continuing the research agenda's outline. The proposal, application, and combination of different text mining techniques, algorithms, and technologies, as well as the assessment of their performance, are recurrent methodological recommendations from recent literature, as in AL-Saif and Al-Dossari [43], Alakrot et al. [94], Concepción-Sánchez et al. [95], Elkhawas and Abdelbaki [41], Husari et al. [96], Ruano-Ordás et al. [70], Zainal et al. [97], Basilio et al. [30], Iftikhar et al. [35], Mine et al. [90], Saini and Bansal [84], Sonowal and Kuppusamy [57], Lal et al. [27], and Monish and Pandey [49].

Machine learning techniques are recurrent among the methodological sets found in the selected literature, as observed in the previously listed works. Nonetheless, other groups of methods were recommended for further research developments, such as multicriteria methods for decision support in planning activities for criminal combat [30]; social network analysis to find hidden patterns of illegal activities [84]; traditional statistical methods to support the analysis of opinions about security threats using information collected via questionnaires [98]; bio-inspired algorithms to simulate security threats or risks [97]; the combination of graphs and neural networks to assist in answering key investigation questions [99].

The detection and use of different features [41,45,57], as well as the application of topic modeling ([69,83,84] and named entity recognition [35,100], are recommended to improve the quality of the methods.

The development of computer programs and the proposal of frameworks with advances for methodological enhancements were also suggestions, as these artifacts may perform the complete analytical methodology involved to support investigating security threats and making decisions about related preventive and corrective actions [89,95,96,101].

Scenario Changes and Extensions

The axis of scenario changes and extensions is directly linked to the indications in the first two axes. Therefore, it reflects the impact of determining objectives and methodological design for further research. The application in other related fields of the techniques identified or proposed in the literature is in line with the need for testing and validation for possible more generalized applications. Also, these extensions can offer a concentration of a broader range of issues related to public security and make these methods commercially accessible [102,103,104].

Information extracted from other areas, such as clinical registers, that may be combined with police reports of sexual or domestic violence [42,67,68,87] or from managerial and financial reports to support the detection of fraud [49,105,106,107] are necessary for the enrichment of the analytical process. Combining clinical and police reports can help health professionals understand the causes of trauma that generate psychological illness in victims, supporting a more adjusted treatment, and the police to understand sexual or domestic violence patterns to prevent the occurrence or recurrence of related situations. In fraud detection, the development of more in-depth analyses depends on specific documents that make it possible to combine an adequate number of fraudsters' action patterns to ensure better accuracy.

Another direction suggested is concerning the language and location shifts of future work by analyzing alternative languages from the ones used initially in current studies and understanding how local cultures leave their mark on a language that impacts text analysis. The language change effects are interesting for analysis because they can corroborate the power and breadth of the application of the techniques identified or proposed in the reviewed literature, demonstrating the general applicability (or not) of the methods or tools under evaluation [105,108,109,110,111,112].

Giacalone et al. [113] suggested that exploring scenarios with more data is an important trend in the context of Big Data that allows the development of systems using real-time processing over the data massively generated on social media. Monish and Pandey [49] commented on using other data formats, such as video and images, and Cichosz [42] mentioned the need to incorporate non-textual attributes to the analysis for extracting from social media streams, reinforcing the importance of Big Data scenarios variety.

The analysis of Table 4 (in Section 4.2) covering text mining applications in public security suggests another insight for scenario expansions. Eleven application areas exist with four or fewer occurrences in the selected works, and these fewer occurrences highlight research opportunities in these areas using new techniques or technologies in addition to those employed in the selected works. Among these eleven, even greater emphasis may be applied to the existing gaps for research related to software piracy detection, violence against woman analysis, armed conflict solution, weapon trafficking detection, and civil unrest detection, as each was represented with only two or one related work.

4. Conclusion

The systematic literature review explored literature on text mining in public security to extract information about primary application areas and the most recurrent technologies, opportunities, and challenges. From a total of 194 selected works, 98 most recent contributions from 2018 and 2020 were identified to support outlining a research agenda with general trends to researchers intending to develop new studies about the reported themes.

The detection of nineteen types of applications for text mining in public security enabled the exploration with comments about these works’ distributions among the types and the periods of publication, with the recent period of 2017 to 2020 containing a peak in the number of works. The analysis of techniques and technologies supported discovering the 20 most recurrent terms related to techniques of various types, from programming languages and other computer programs dedicated to or containing text mining functions and information extraction approaches. Another interesting discovery is related to the techniques and technologies intersections and combinations among the six areas with the greatest numbers of works in the selections, demonstrating how recurrent some of these elements are for more research and practice.

The research agenda outlined three axes of objective expansions, methodological extensions, and scenario changes and extensions. The first identified general directions about future work recommended by the related literature focused on accomplishing additional details to an existing objective, such as using more data and sources for improving the results of previous analyses and experiments. The second indicated improvements in methodologies, including some combinations of techniques, to compare them and choose the most suitable method for the occasion. In addition, this extension can guarantee the development of frameworks and software containing the best analytical approaches dedicated to public security. The third axis corroborated the need to expand the applications of the methodologies to other related fields by validating them and reinforcing their effectiveness, as well as indicating an existing trend toward Big Data to enable real-time analysis based on data streaming of the social web and the use of other unstructured data formats in addition to texts.

5. Update

The analysis developed and reported in the previous sections focused on a period covering 2014 to the beginning of 2021. Seeking an update on the topics involved, an additional search was carried out to now cover the complete period from January 2021 to February 2024. The additional search returned the following values, in general: in the Scopus database, 161 results; in Web of Science, 88 results; in IEEE Xplore, 57 results; in ACM Digital Library, 300 results. The overall total was therefore 606 results.

These results were joined using Mendeley software, and a database with 577 entries was composed, considering that the software already makes some duplicities joining into one entry. Among this database were detected 156 full conference proceedings that were removed, resulting in 421 entries. However, a total of 51 remaining duplicities were detected and removed, resulting in 370 unique entries.

A screening was applied on titles and abstracts to remove materials out of the research scope. The elimination of out-of-scope articles resulted in a final number of 170 entries, however, three of them were already included in the previous database, with texts from the beginning of 2021 (see [59,107,114]). So, the final number of new works from 2021 to 2024 is 167, distributed as follows: 58 in 2021 (see [115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172]); 61 in 2022 (see [173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233]; 38 in 2023 (see [234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271]); and 10 in 2024 (see [272,273,274,275,276,277,278,279,280,281]).