Identifying Online Child Sexual Texts in Dark Web through Machine Learning and Deep Learning Algorithms Vuong M. Ngo1,* , Susan Mckeever2 and Christina Thorpe3 1 Information System Management Center, Ho Chi Minh City Open University, Ho Chi Minh City, Vietnam 2 School of Computer Science, Technological University Dublin, Grangegorman, Dublin 7, Ireland 3 School of Informatics and Cybersecurity, Technological University Dublin, Blanchardstown, Dublin 15, Ireland Abstract Predators often use the dark web to discuss and share Child Sexual Abuse Material (CSAM) because the dark web provides a degree of anonymity, making it more difficult for law enforcement to track the criminals involved. In most countries, CSAM is considered as forensic evidence of a crime in progress. Processing, identifying and investigating CSAM is often done manually. This is a time-consuming and emotionally challenging task. In this paper, we propose a novel model based on artificial intelligence algorithms to automatically detect CSA text messages in dark web forums. Our algorithms have achieved impressive results in detecting CSAM in dark web, with a recall rate of 89%, a precision rate of 92.3% and an accuracy rate of 87.6%. Moreover, the algorithms can predict the classification of a post in just 1 microsecond and 0.3 milliseconds on standard laptop capabilities. This makes it possible to integrate our model into social network sites or edge devices to for real-time CSAM detection. Keywords Child sexual exploitation material, CSEM, CSAM, text content, artificial intelligent, forums 1. Introduction avoid detection and hide their activities. In this context, we propose a CSAM detection intelli- In general, Child Sexual Abuse Material (CSAM) includes gence model based on both classical Machine Learning any visual, written or audio material that depicts or de- (ML) and Deep Learning (DL) techniques. Our CSAM scribes sexual abuse of children. This can include pho- detection model can be used to monitor and remove CSA tographs, videos, stories, chats, comments, drawings or texts on online platforms in real-time and with high ac- any other media1 . The production and distribution of curacy, providing better protection for children. We have CSAM has negative impacts on victims and society. Vic- also created a manually labelled dataset of CSAM and tims can live with long psychological, emotional, and non-CSAM content that can be used to train and test physical harm [1]. A high volume of CSAM is created CSAM detection algorithms. In the future, our model will and shared daily on both surface web platforms such as be able to detect perpetrator behaviours, collect forensic social network sites and dark web forums. It is not vi- evidence, and extract valuable knowledge for child agen- able for human experts to investigate, detect and prevent cies, hotlines, education programs and policy makers. CSAM manually [2]. However, automatically detecting The remainder of the paper is organised as follows. and analysing online CSA text can be extremely chal- In the Section 2 we review the related work. Section lenging and time-consuming, due to language complex- 3 presents our system architecture and the machine ity, contextual ambiguity, dynamic nature of language learning and deep learning algorithms. The evaluation and large volume of data. This is particularly the case methodology and experimental results for the system are for CSAM shared on the dark web, where privacy and shown in Section 4. Finally, we conclude and give some anonymity are prioritized. Moreover, perpetrators often future directions in Section 5. use code words, slang, or other forms of obfuscation to APWG.EU Technical Summit and Researchers Sync-Up 2023, Dublin, 2. Related Work Ireland, June 21 & 22, 2023 * Corresponding author. Research works [3], [4], [5], [6] and [7] applied deep $ Vuong.nm@ou.edu.vn (V. M. Ngo); Susan.Mckeever@tudublin.ie convolutional neural network models or deep perceptual (S. Mckeever); Christina.Thorpe@tudublin.ie (C. Thorpe) hashing algorithms with the goal of removing CSAM  0000-0002-8793-0504 (V. M. Ngo); 0000-0003-1766-2441 from social media sites. With the exception of [3], papers (S. Mckeever); 0000-0002-2359-883X (C. Thorpe) Β© 2023 Copyright for this paper by its authors. Use permitted under Creative Commons License [4], [5], [6] and [7] used datasets from third-parties to CEUR Attribution 4.0 International (CC BY 4.0). CEUR Workshop Proceedings (CEUR-WS.org) Workshop Proceedings http://ceur-ws.org ISSN 1613-0073 train and test their models. However, these papers only 1 https://www.inhope.org/EN/articles/child-sexual-abuse-material, considered CSA images and not text. Similar to our work, https://www.hotline.ie/what-to-report/csam, https://www.rainn. research works [8], [9], [10], [11] and [12] applied ML org/news/what-child-sexual-abuse-material-csam CEUR ceur-ws.org Workshop ISSN 1613-0073 Proceedings Figure 1: The system architecture for CSAM classification algorithm and DL models to process CSA text. In [8], Naive Bayes 3. System Architecture and (NB), Support Vector Machine (SVM) and Random Forest (RF) were applied to detect online abusive and bullying Algorithms comments on Facebook and Twitter. In [9], the histogram 3.1. System Architecture gradient boosted decision trees were exploited for preda- tory chat conversation detection. In [10], Convolutional Supervised learning in classical ML and DL is a popular Neural Network (CNN) and Long Short Term Memory method for text classification based on learning patterns (LSTM) were applied for YouTube comments. In [11], from labelled training samples [18, 19]. Every supervised deepWalk model and graph embedding representations learning algorithm has its strengths and weaknesses. were used to detect abuse chat logs in French on the Therefore, to find a suitable algorithm to classify CSAM SpaceOrigin game. In [12], Logistic Regression (LR), XG- post contents, we apply the two most popular classical Boost and Multi Layer Perceptron (MLP) were exploited ML algorithms, NB and SVM, and the two most popular to detect sexual predatory chats in social networks. To DL algorithms, LSTM and BERT (Bidirectional Encoder train and test ML/DL models, the papers [8] and [11] Representations from Transformers). More details can created their own datasets and the papers [9], [10] and be found in Section 3.2. [12] used datasets of third-parties. However, these papers Figure 1 shows our system architecture used to design considered the clear web not the dark web. and implement our novel algorithm for CSAM text clas- Dark web data was also processed in [13], [14], [15], sification. In that, the Supervised Method component [16] and [17]. However, the approaches did not auto- implements NB, SVM, LSM and BERT algorithms. The matically detect CSA text on the dark web by using post algorithms tokenizes the post texts and transforms them contents and artificial intelligence. In [13], the 450 au- into vector representation using TF.IDF2 (in NB and SVM) thorised hidden service sites were manually classified. or embedding layers3 (in LSTM and BERT). In [14], the authors analysed seven popular dark web The Evaluation component is used to determine the sites to monitor the sites by using their metadata, e.g. the execution times (i.e., training time and prediction time) number of users, site names and common users in sites. and the classification performance metrics (i.e., precision, In [15], the authors statistically analysed some simple recall and accuracy) of each combination of algorithms. metadata e.g. victim ages and the number of CSAM re- To avoid overfitting, we apply 5-fold cross-validation of ports per year. In [16], K-Means algorithm was applied our dataset. Then the algorithm uses 4 folds for the train- to cluster the forum comments into the selected seven ing set and the remaining fold for the testing set. This labels, i.e. breach, financial, drug, vendor, account, prod- process is repeated until every fold serves as the testing uct and other. In [17], the authors manually analysed transcripts of 53 anonymous suspects in United Kingdom 2 https://scikit-learn.org/stable/modules/generated/sklearn.featur to understand suspects’ interaction behaviors and sexual e_extraction.text.TfidfVectorizer.html 3 interests. https://www.tensorflow.org/api_docs/python/tf/keras/layers/Em bedding set. The average of the recorded classification measures of five rounds are the classification performance mea- sures for the algorithm. Finally, we analyse experimental results on the data set to recommend the best algorithm for CSAM text classification in the dark web. 3.2. Machine Learning and Deep Learning NB is a specific type of probabilistic classifier that re- lies on applying Bayes’ theorem with certain simplifying assumptions. NB is widely used in natural language pro- cessing, spam filtering, and other applications where it is Figure 2: sexual abuse single words in dark web forums necessary to classify items into different categories based on probabilistic features. It assumes that the features are strongly independent to simplify computation. We used the Gaussian Naive Bayes algorithm implemented in [20], with parameters: π‘Žπ‘™π‘β„Žπ‘Ž= 1 and 𝑓 𝑖𝑑_π‘π‘Ÿπ‘–π‘œπ‘Ÿ= True. Where, π‘Žπ‘™π‘β„Žπ‘Ž is the additive smoothing parameter and 𝑓 𝑖𝑑_π‘π‘Ÿπ‘–π‘œπ‘Ÿ determines whether to learn class’ prior prob- abilities or not. SVM represents patterns as points in space and divides the data points by a clear gap. It constructs a maximum margin separator and can perform a non-linear classifi- cation by using the so-called kernel trick. We used the C-support vector classification algorithm implemented in [21], with parameters: 𝐢= 1.0, π‘˜π‘’π‘Ÿπ‘›π‘’π‘™= ’linear’, Figure 3: sexual abuse two-word-phrases in dark web forums π‘‘π‘’π‘”π‘Ÿπ‘’π‘’= 3 and π‘”π‘Žπ‘šπ‘šπ‘Ž= ’auto’. Where, 𝐢 is the reg- ularization parameter. π‘˜π‘’π‘Ÿπ‘›π‘’π‘™ is the used kernel type. π‘‘π‘’π‘”π‘Ÿπ‘’π‘’ is the degree of the polynomial kernel function 3.3. Training and Testing Datasets and π‘”π‘Žπ‘šπ‘šπ‘Ž is kernel coefficient. Our first step is to create a labelled dataset that can be LSTM is a special kind of Recurrent Neural Network used for training or fine-tuning our classifier. The la- (RNN). RNN is a type of neural network commonly belled dataset used for our study was collected and sup- used to develop natural language processing models. plied by the company Web-IQ, which provided us with RNN remembers the sequence of the data and exploits over 352,000 posts from 8 dark web forums in 2022, of data patterns and feedback loops for prediction. LSTM which approximately 221,000 were in English. was applied to avoid the long-term dependency Using a dictionary of 12,628 Sexual Abuse Phrases problem in regular RNN. We used the Bidirectional- (SAPs) extracted from THORN project4 and Web-IQ LSTM algorithm implemented in [22], with param- dark web forums5 , we were able to detect approximately eters: πΈπ‘šπ‘π‘’π‘‘π‘‘π‘–π‘›π‘”= (1000, 128, input_length=200), 177,000 English posts with no SAP and approximately π΅π‘–π‘‘π‘–π‘Ÿπ‘’π‘π‘‘π‘–π‘œπ‘›π‘Žπ‘™(LSTM(64)), π·π‘Ÿπ‘œπ‘π‘œπ‘’π‘‘(0.5) and 44,000 English posts with at least one SAP. This provides 𝐷𝑒𝑛𝑠𝑒(1, activation=’sigmoid’) us with a high level grouping of posts, but with refine- BERT is a language model using the transformer en- ment required to allow for CSAM posts that does not coder architecture to process tokens in text. BERT ap- contain any SAPs, and vice versa. Figures 2 and 3 show plies pre-training and fine-tuning. Pre-training is an the word clouds of single words and two-word-phrases unsupervised way on a general large corpus of text to related to sexual abuse, extracted from post contents in create BERT model. Fine-tuning is a supervised train- dark web forums. The size of each word in the clouds ing BERT model on a specific downstream task with represents its frequency in the forums. relatively few labels, because the general linguistic pat- From the group of 177,000 posts with no SAP, experts terns have already been learnt during pre-training. We randomly selected 2,000 non-CSAM posts and 500 CSAM used BERT algorithm implemented in [23], with pa- posts. From the group of 44,000 posts with at least one rameters: πΎπ‘’π‘Ÿπ‘Žπ‘ πΏπ‘Žπ‘¦π‘’π‘Ÿ(bert_en_uncased_preprocess_3, SAP, experts randomly selected 2,000 CSAM posts and bert_en_uncased_L-12_H-768_A-12_4), 𝐷𝑒𝑛𝑠𝑒(1, activa- 100 non-CSAM posts. Ultimately, our manually labelled tion=’sigmoid’) and π‘œπ‘π‘‘π‘–π‘šπ‘–π‘§π‘’π‘Ÿ=’adam’. 4 https://www.thorn.org/ 5 https://web-iq.com/solutions/osint-on-premises dataset contains 4,600 posts from the dark web, including Table 1 2,500 CSAM posts and 2,100 non-CSAM posts. Average execution time and binary classification performance of the algorithms Algorithms 4. Experiment and Results Results NB SVM LSTM BERT Training time1 0.5 1.8 32.5 4,261 4.1. Experiment Setup and Quality Prediction time1 0.001 0.27 1.01 215.3 Measures True Positive 445 421 428 415 False Positive 140 35 46 68 The algorithms were implemented using Python 3.10, True Negative 280 385 374 352 scikit-learn library 1.2.2 (for NB and SVM), keras library False Negative 55 79 72 85 1.1.2 run on top of tensorflow library 2.10.0 (for LSTM Precision 76.1% 92.3% 90.2% 86% and BERT). All experiments were run under Windows 10 Recall 89% 84.2% 85.5% 83% (64-bit) on a Dell laptop with an Intel Core i7 CPU (3.00 Accuracy 78.8% 87.6% 87.1% 83.4% GHz) and 16 GB memory. 1 second. For the purpose of measuring the quality of the pre- dicted classes of posts compared to the correct classes, we apply the most commonly used metrics namely accuracy, precision and recall ([24, 25]). The metrics are derived β€’ SVM: The training time and prediction time were from four categories in the confusion matrix: True Pos- 1.8 and 0.27 seconds, respectively. The precision itive (TP), False Positive (FP), True Negative (TN) and was 92.3%, recall was 84.2% and accuracy was False Negative (FN) as follows: 87.6%. β€’ LSTM: The training time and prediction time β€’ TP: Posts in which the algorithm predicted CSAM were 32.5 and 1.01 seconds, respectively. The pre- and the correct class was also CSAM. cision was 90.2%, recall was 85.5% and accuracy β€’ FP: Posts in which the algorithm predicted CSAM, was 87.1%. but the correct class was non-CSAM. β€’ BERT: The training time and prediction time 4,261 β€’ TN: Posts in which the algorithm predicted non- and 215.3 seconds, respectively. The precision CSAM and the correct class was non-CSAM. was 86%, recall was 83% and accuracy was 83.4%. β€’ FN: Posts in which the algorithm predicted non- The combination of the NB algorithm has the fastest CSAM, but the correct class was CSAM. execution time, taking only about 1 microsecond to de- tect a post on our laptop’s capabilities. The second best Accuracy (ACC) in binary classification is defined as a performing algorithm is SVM, which takes about 0.3 mil- ratio between the correctly classified samples to the total liseconds. These fast prediction times make our models number of samples: 𝐴𝐢𝐢 = 𝑇 𝑃 +𝐹𝑇 𝑃𝑃 +𝑇 +𝑇 𝑁 𝑁 +𝐹 𝑁 . The well-suited for processing CSA text in real-time on so- accuracy puts the same emphasis on all these factors. cial networks. Additionally, our models can run on edge However, when categorising pairs, there is usually a bias: devices with limited computational resources and power it is much easier to identify true negatives correctly, due supply. to their large number. So, we also look at the the precision In terms of classification precision, the SVM combina- 𝑃 = 𝑇 𝑃𝑇+𝐹 𝑃 𝑃 and the recall 𝑅 = 𝑇 𝑃𝑇+𝐹𝑃 𝑁 . tion performs the best with 92.3%, followed by LSTM and BERT as the second and third-best performers, respec- 4.2. Results tively. Meanwhile, the NB combination has the highest recall rate of 89%, followed by LSTM as the second-best Using the 5-fold cross-validation methodology, each ex- performer. When it comes to accuracy, SVM is the best perimental round includes a training set of 3,680 posts with 87.6% which is slightly higher than LSTM with 87.1%. (2,000 CSAM and 1,680 non-CSAM) and a testing set The BERT algorithm has long training and prediction of 920 posts (500 CSAM and 420 non-CSAM). Table 1 times, and it is not suitable for binary classification of presents the average training time, average prediction CSAM posts in dark web. time, average precision, average recall and average accu- racy of four algorithm combinations as follows: 5. Conclusion and Future Work β€’ NB: The training time and prediction time were 0.5 and 0.001 seconds, respectively. The precision We proposed and implemented a novel algorithm based was 76.1%, recall was 89% and accuracy was 78.8%. on machine learning and natural language processing to automatically detect and classify CSAM text post con- tent in dark web. In the experimental evaluation on the dataset of 4,600 CSAM and non-CSAM posts with 5-fold 445 (2021) 81–104. doi:10.1016/j.neucom.202 cross-validation, the combination of NB algorithm per- 1.02.056. formed the best in terms of classification recall and ex- [4] E. Guerra, B. G. Westlake, Detecting child sexual ecution time. On the other hand, the SVM combination abuse images: traits of child sexual exploitation performed the best in terms of classification precision hosting and displaying websites, Child Abuse & and accuracy, and was the second-best in execution time. Neglect 122 (2021) 105336. doi:10.1016/j.chia The choice of NB and SVM depends on the specific goals bu.2021.105336. and requirements of the CSAM classification task. NB is [5] P. Vitorino, S. Avila, M. Perez, A. Rocha, Leveraging maximize the number of true positives which could be deep neural networks to fight child pornography in useful identifying and removing CSAM posts from on- the age of social media, Journal of Visual Communi- line platforms to protect potential victims. On the other cation and Image Representation 50 (2018) 303–313. hand, SVM is minimize false positives which could be doi:10.1016/j.jvcir.2017.12.005. useful for identifying CSAM posts to extract information [6] C. Laranjeira, J. Macedo, S. Avila, J. Santos, See- about potential predators and victims for investigative ing without looking: Analysis pipeline for child purposes. sexual abuse datasets, in: the 2022 ACM Confer- As part of our future work, functional APIs will be ence on Fairness, Accountability, and Transparency implemented to create a user-friendly web application. (FAccT’22), ACM, 2022, p. 2189–2205. doi:10.114 Furthermore, we aim to leverage the metadata associated 5/3531146.3534636. with CSAM posts to identify the characteristics, conver- [7] L. Struppek, D. Hintersdorf, D. Neider, K. Kersting, sation and behaviours of perpetrators. This information Learning to break deep perceptual hashing: The use can be valuable in developing more effective models for case neuralhash, in: the 2022 ACM Conference on preventing and addressing CSA text on social media plat- Fairness, Accountability, and Transparency, 2022, forms. We also will recognise named entities in CSA text pp. 58–69. doi:10.1145/3531146.3533073. to supply important concepts for ML models [26]. [8] M. M. Islam, M. A. Uddin, L. Islam, A. Akter, S. Sharmin, U. K. Acharjee, Cyberbullying detec- tion on social networks using machine learning Acknowledgments approaches, in: the 2020 IEEE Asia-Pacific Confer- ence on Computer Science and Data Engineering The paper is an extension of the long abstract [27] being (CSDE), IEEE, 2020, pp. 1–6. doi:10.1109/CSDE50 part of the N-Light project which is funded by the Safe 874.2020.9411601. Online Initiative of End Violence and the Tech Coalition [9] P. R. Borj, K. Raja, P. Bours, Detecting sexual preda- through the Tech Coalition Safe Online Research Fund tory chats by perturbed data and balanced ensem- (Grant number: 21-EVAC-0008-Technological University bles, in: the 2021 International Conference of the Dublin). Dr. Vuong Ngo has conducted the research Biometrics Special Interest Group (BIOSIG), IEEE, while serving as a data scientist at TU Dublin. 2021, pp. 1–5. doi:10.1109/BIOSIG52210.2021 .9548303. References [10] M. Akhter, Z. Jiangbin, I. Naqvi, M. AbdelMajeed, T. Zia, Abusive language detection from social me- [1] V. M. Ngo, C. Thorpe, C. N. Dang, S. Mckeever, dia comments using conventional machine learning Investigation, detection and prevention of online and deep learning approaches, Multimedia Systems child sexual abuse materials: A comprehensive sur- (2021) 1–16. doi:10.1007/s00530-021-00784 vey, in: the 16th IEEE International Conference -8. on Computing and Communication Technologies [11] N. Cecillon, V. Labatut, R. Dufour, G. Linares, Graph (RIVF-2022), IEEE, 2022, pp. 707–713. doi:https: embeddings for abusive language detection, SN //doi.org/10.1109/RIVF55975.2022.100 Computer Science 2 (2021) 1–15. doi:10.1007/s4 13853. 2979-020-00413-7. [2] H. Lee, T. Ermakova, V. Ververis, B. Fabian, Detect- [12] C. H. Ngejane, J. H. Eloff, T. J. Sefara, V. N. Marivate, ing child sexual abuse material: A comprehensive Digital forensics supported by machine learning survey, Forensic Science International: Digital In- for the detection of online sexual predatory chats, vestigation 34 (2020) 301022. doi:10.1016/j.fs Forensic science international: Digital investigation idi.2020.301022. 36 (2021) 301109. doi:10.1016/j.fsidi.2021.3 [3] A. Gangwar, V. GonzΓ‘lez-Castro, E. Alegre, E. Fi- 01109. dalgo, Attm-cnn: Attention and metric learning [13] G. Owen, N. Savage, The tor dark net, Chatham based cnn for pornography, age and child sexual House (2015). abuse (csa) detection in images, Neurocomputing [14] M. SchΓ€fer, M. Fuchs, M. Strohmeier, M. Engel, M. Liechti, V. Lenders, Blackwidow: Monitoring (Eds.), Linking Theory and Practice of Digital Li- the dark web for cyber security information, in: the braries, LNCS, vol. 12866, Springer, 2021, pp. 60–65. 11th International Conference on Cyber Conflict doi:https://doi.org/10.1007/978-3-030 (CyCon), volume 900, 2019, pp. 1–21. doi:10.239 -86324-1_7. 19/CYCON.2019.8756845. [27] S. Mckeever, C. Thorpe, V. M. Ngo, Determining [15] E. Kokolaki, E. Daskalaki, K. Psaroudaki, child sexual abuse posts based on artificial intelli- M. Christodoulaki, P. Fragopoulou, Investi- gence, in: the 2023 International Society for the gating the dynamics of illegal online activity: The Prevention of Child Abuse & Neglect Congress power of reporting, dark web, and related legisla- (ISPCAN-2023), Edinburgh, Scotland, UK, Septem- tion, Computer Law & Security Review 38 (2020) ber 24-27, 2023, 2023, pp. 1–4. doi:https://doi. 105440. doi:10.1016/j.clsr.2020.105440. org/10.21427/S3GQ-3536. [16] S. Nazah, S. Huda, J. H. Abawajy, M. M. Hassan, An unsupervised model for identifying and characteriz- ing dark web forums, IEEE Access 9 (2021) 112871– 112892. doi:10.1109/ACCESS.2021.3103319. [17] J. Woodhams, J. A. Kloess, B. Jose, C. E. Hamilton- Giachritsis, Characteristics and behaviors of anony- mous users of dark web platforms suspected of child sexual offenses, Frontiers in Psychology 12 (2021) 623668. doi:10.3389/fpsyg.2021.623668. [18] T. Tran, L. Nguyen, V. Ngo, Machine learning based english sentiment analysis, Journal of Science and Technology 52(4D) (2014) 142–155. doi:https:// doi.org/10.48550/arXiv.1905.06643. [19] S. J. Russell, P. Norvig, Artificial Intelligence: A Modern Approach (4th Edition), Pearson, 2022. [20] Scikit-learn, Multinomial naive bayes, https://scik it-learn.org/stable/modules/generated/sklearn.na ive_bayes.MultinomialNB.html#sklearn.naive_b ayes.MultinomialNB, 2023. Version 1.2.2, accessed April 01, 2023. [21] Scikit-learn, C-support vector classification, https: //scikit-learn.org/stable/modules/generated/sklear n.svm.SVC.html, 2023. Version 1.2.2, accessed April 01, 2023. [22] Keras, Long short term memory, https://www.te nsorflow.org/api_docs/python/tf/keras/layers/LS TM, 2023. Version 1.1.2, accessed April 01, 2023. [23] Keras, Text classsification with bert, https://www. tensorflow.org/text/tutorials/classify_text_with_ bert, 2023. Version 1.1.2, accessed April 01, 2023. [24] V. M. Ngo, T. V. T. Duong, T. B. T. Nguyen, P. T. Nguyen, O. Conlan, An efficient classification algo- rithm for traditional textile patterns from different cultures based on structures, Journal on Computing and Cultural Heritage (JOCCH) 14(4) (2021) 1–22. doi:https://doi.org/10.1145/3465381. [25] A. Tharwat, Classification assessment methods, Applied Computing and Informatics 17(1) (2021) 168–192. doi:https://doi.org/10.1016/j.ac i.2018.08.003. [26] V. M. Ngo, G. Munnelly, F. Orlandi, P. Crooks, D. O’Sullivan, O. Conlan, A semantic search en- gine for historical handwritten document images, in: G. Berget, M. M. Hall, D. Brenn, S. Kumpulainen