DATA MINING ON COMMUNICATION FOR IDENTIFYING TERRORISTS: A CASE STUDY

DATA MINING ON COMMUNICATION FOR IDENTIFYING TERRORISTS: A CASE STUDY

Abstract

Terrorism incidents can cause severe impacts. They have attracted a lot of attentions in recent years after 9/11 attack.  To reduce the impacts of terrorism incidents in a timely and effective manner, it is important to analyze incoming information and give explanations for decision making such as identifying participants. People’s plans, thoughts, and actions about terrorism incidents are reflected in their communications, which is helpful for intelligence analysis. The communication content is accessible through monitoring participants’ conversations and emails. Social network analysis and machine learning techniques can be applied to facilitate the analysis.

This thesis applies and compares several supervised machine learning techniques to help identify people’s roles in terrorism activities. As supervised learning techniques require much labeled data, which is time consuming and costly, we also applies semi-supervised learning techniques which make use of both labeled and unlabeled data. The challenge problem in our study is to find discriminative features which can distinguish different roles. In our study, we applies both people’s communication structure and content information.

This thesis applies Girvan-Newman (GN) algorithm to get people’s community feature based on their communication structure. GN algorithm is an unsupervised learning method which groups network data into different clusters by recursively removing the edge with the largest betweenness. The algorithm obtains the best division when the connections within communities are dense and the connections between communities are sparse.

This thesis also applies Latent Dirichlet allocation (LDA) to get participants’ topic word features based on their communication content. LDA is also an unsupervised learning method that groups a set of observations into unobserved clusters where the data is similar. LDA is generally applied for topic modeling. It assigns each document with a mixture of topics and assigns each topic with a set of words.

 

Chapter 1    Introduction

1.1. Artificial Intelligence for Terrorism

The US State Department defines terrorism as “premeditated, politically motivated violence perpetrated against noncombatant targets by sub-national groups or clandestine agents, usually intended to influence the audience” [1] . Terrorism incidents can result in severe impacts, including large-scale casualties, huge property losses, and long-lasting consequences, such as anxiety, health effects, government policies, and cultural impacts [2] . For example, the car bomb in Oklahoma City resulted in the death of 168 people, and over 220 buildings sustained damage [3] ; the bomb attack in Kenya resulted in the death of 253 people, and the property loss of $169 million; and the 9/11 attack resulted in the death of 2,996 people, and the property loss of $80 billion [4] .

Figure 1 lists the number of global terrorism incidents from 1971 to 2011. From Figure 1, we can see that there are increasing attacks from 1979 to 1992, and also from 2004 to 2011. In Figure 1, terrorism incidents are grouped by attack type, and we can see that the bombing and explosion attacks take up the largest portion of all terrorism activities.

To reduce the impact of terrorism, it is important to understand the incoming information effectively and efficiently, and provide suggestions for decision making. The process of intelligence analysis for terrorism incidents includes searching and gathering information, organizing information suitable for retrieval and analysis, analyzing information and providing suggestions, as shown in Figure 2. For the analysis step, it is important to understand continuous incoming information (e.g. important people, events, an countries), identify patterns, anomalies, relationships and causal influences, and give alternative explanations and possible outcomes for making decisions [6] . Role identification is also a pattern for analysis. If intelligence analysis could identify terrorists, then agents could devote more time and resources on these terrorists instead of all suspects.

But there may be a lot of challenges for intelligence analysis. For example, the incoming information may be large volume, incomplete, redundant, ambiguous, and unorganized. These challenges can cause analysis work to be time-consuming. In the recent years, computer-aided techniques are proposed to help intelligence analysis to understand the incoming information, by overcoming limitations in human mental machinery for perception, memory, and inference, thus it is possible for human beings to pay attention a larger amount of information [6] .

In this thesis, we conduct research work on identifying participants by predicting their roles. So after identifying participants’ roles, analysts can put time and resources to terrorists instead of all people, which can help shoulder analysts’ work. Our approach use communications between people, because people’s plans, thoughts, and actions are reflected in their communications [7] .  Also, the communication data between terrorism participants’ are accessible by monitoring their conversations, phone calls and emails [8-10] .

 

1.2. Role Prediction

When intelligence agents gather information of participants in terrorism incidents, the identity of participants may be unclear. It may not be clear to intelligence agents that whether the participants are counter terrorism agents, terrorists, or civilians. If the roles of the participants involved in terrorism activities are identified, then intelligence agents can track the information source and pay attentions to the participants they are interested in. In this thesis, we divide people’s roles into three categories: agent, civilian, and terrorist.

There are two approaches to analyze communication information. The first approach is to analyze communication structure. For example, we can construct a social network based on participants’ communications, and then detect important nodes as important participants in the terrorism incidents, or analyze community structure of the social network to detect the relationships between participants. The disadvantages of this approach is: First, because this approach is unsupervised learning, after we detect important participants or community structure, we cannot automatically label participants or communities. Second, this approach assumes that communications between participants with the same roles are dense, while communications between participants with different roles are sparse. But in practice, communications between participants with different roles may be dense, too. For example, counter terrorism agents and terrorists may have a lot of communications during investigations and interrogations. In these scenarios, it is difficult to distinguish participants with different roles only using communication structure information.

The second approach is to analyze communication content, in other words, semantics. Text content contain rich information of participants’ thoughts and plans. Assume communication content of different roles are distinguishable from each other, then we can apply this feature to facilitate role prediction. Because communication content we use is in the form of text, we can apply text analysis approaches to extract important semantic features. Thus, we can apply machine learning techniques to conduct role classification. SVM, Native Bayes, Random Forest, Adaboosting, and Ensemble techniques are popular supervised learning approaches. But supervised learning approaches require a lot of labeled data, which is time consuming and costly as we may not have much labeled data in practice, and need manually label data. So we can also apply semi-supervised learning techniques, which make use of both labeled and unlabeled data for training.

In this thesis, we propose to classify people based on their communications, involve communication based network and the content of the communication. The question is , based on both what people say and whom they talk to , can we identify their roles? For network analysis, we construct communication social network, detect community structure, and then assign roles to communities. For content analysis, we assume communication content of different roles are distinguishable from each other, then we can apply this information for role prediction. Then, we apply both communication structure and content information for role prediction. The hypothesis is the more communications between participants, and the more topic words they share, it is more likely that these participants have the same role in terrorism incidents. The challenge here is to find discriminative community features and topic word features.

The selection of features is crucial for learning performance. In this thesis, we generate participants’ community features by applying GN algorithm on both unweighted and weighted communication social networks. Also, we apply LDA on participants’ conversations to obtain topics, and then extract top words from each topic to obtain topic word features. The reason is the union of words with high probability in each topic are seen as discriminative features for documents [11] . Then we construct and compare three feature vectors: feature vector containing topic word features, feature vector containing community feature in unweighted network and topic word features, feature vector containing community feature in weighted network and topic word features. By comparison, we can see whether word features can be used for role prediction, and whether community feature can help improve prediction performance.

Role prediction has a broad application. For example, role based access control is important in business security models that different accesses are given to different roles [12] . It is helpful to automatically assign accesses based on people’s roles and privileges. For marketing, role prediction can help with automatic advertising. It is helpful to send different types of advertisements to participants with different roles. For example, sending job advertisements to job-seekers, while sending bookstore advertisements to students. This approach is feasible, for example, if marketing people can get people’s communications from emails, or from social network websites like Facebook and Twitter. Then they can apply this approach to help identify people’s roles and send corresponding advertisements.

 

1.3. Related Research

Some approaches are proposed to identify terrorist groups by analyzing terrorism communication structure. Krebs et al. and Liebowitz apply community discovery approaches to identify terrorists. As mentioned by Newman and Girvan, community discovery technique can provide invaluable help in understanding the structure of networks. Communities may represent social groupings, such as interest and background [13] . In unweighted network, edges indicates connections between nodes, while in weighted network, edges indicates the frequency count of communications between nodes. Newman and Girvan proposed the GN algorithm to detect communities in social networks. GN algorithm recursively removes edge with highest betweenness to obtain communities, as edge betweenness favors edges lie between communities. This approach also proposed to use modularity as the stop criterion of this recursively approach.

Large modularity is obtained when connections within communities are dense while connections between communities are sparse. When the largest modularity is obtained, it is considered to obtain the best network division by GN algorithm. But as a unsupervised learning approach, this approach has limitations as we mentioned in Section 1.2.

Shaikh et al. and Qin et al. apply centrality measurements to identify terrorist roles, such as leaders, brokers, and outliers. For social network analysis, centrality is used to measure the relative importance of vertex within the network. Both Shaikh et al. and Qin et al. consider that the vertices with high centrality are more likely to be leaders, and the vertices with low centrality are more likely to be outliers. The approach also has limitations, because it only identifies the relative importance of participants in terrorism incidents, while it provides no information about participants’ roles.

Some approaches are proposed to analyze terrorism content. Yang et al. proposed to apply LDA to discover terrorists’ topics from dark websites. LDA is a generative probabilistic approach to model topics from documents. LDA models each document as a mixture of topics, and each topic as a distribution of words.

Orebaugh and Allnutt proposed to identify terrorist groups by applying authorship analysis. Authorship analysis is the process of examining the characteristics of a document to find or validate the document’s author, such as analyzing the total number of words, the length of a sentence, and the character usage frequency.

Several approaches are proposed to detect topic and roles using both data structure and content. McCallum et al. proposed to discover social roles by studying the topic distributions based on message links between actors. Rosen-Zvi et al. proposed to discover authors and topics at the same time, by extending LDA so that each author is associated with a multinomial distribution over topics, and each topic is associated with a multinomial distribution over words. A document with multiple authors is modeled as a distribution over topics that is a mixture of the distributions associated with the authors.

In this thesis, we propose a different approach. We will focus on constructing feature vectors containing both communication structure and communication content information. As we discussed in the previous section, communication content may contain information which can distinguish different roles. Also, the more communications between participants, and the more communication content they share, it is more likely that they belong to the same roles.

After we construct feature vectors, we apply different supervised learning approaches, such as SVM, Naive Bayes, Random Forest, Adaboosting, and Ensemble. As supervised learning approaches requires a lot of labeled data, which is time-consuming and costly, we also apply semi-supervised learning approaches. Semi-supervised approaches make use of both labeled and unlabeled data, usually a small amount of labeled data and a large amount of unlabeled data. The difference between various semi-supervised approaches is the way of realizing the assumption of consistency. Zhou et al. and Zhu et al. proposed two popular semi-supervised learning approaches. Both approaches iteratively spread every point’s label information to its neighbors until a global stable state is achieved. Zhou et al. applies normalized Laplacian in the regularizer of cost function while Zhu et al. applies standard Laplacian in the regularizer of cost function.

 

1.4. Research Questions

The goal of this thesis research is to predict participants’ roles based on their communications. As we mentioned before, only applying communication structure over conversations may not provide enough information for classification. So we also include the communication content information to help predict participants’ roles. And we use topic words to represent communication content information. We propose several research questions listed as follows:

        Q1. Are participants with different roles have distinguishable topic word distribution?

        Q2. Are the topic word information help predict participants’ roles?

         Q3. Are the community information help improve actor role prediction?

In order to see whether topic word features are useful for role prediction, we need to know whether each role has a distinguish word distribution first. If so, we need to choose suitable machine learning methods to see how these word features can be useful for role prediction. Also, we want to know whether adding communication structure information could help improve classification performance.

DATA MINING ON COMMUNICATION FOR IDENTIFYING TERRORISTS: A CASE STUDY

Sharing is caring!