Modeling and detection techniques for Counter-Terror Social Network Analysis and Intent Recognition

In this paper, we describe our approach and initial results on modeling, detection, and tracking of terrorist groups and their intents based on multimedia data. While research on automated information extraction from multimedia data has yielded significant progress in areas such as the extraction of entities, links, and events, less progress has been made in the development of automated tools for analyzing the results of information extraction to “connect the dots.” Hence, our Counter-Terror Social Network Analysis and Intent Recognition (CT-SNAIR) work focuses on development of automated techniques and tools for detection and tracking of dynamically-changing terrorist networks as well as recognition of capability and potential intent. In addition to obtaining and working with real data for algorithm development and test, we have a major focus on modeling and simulation of terrorist attacks based on real information about past attacks. We describe the development and application of a new Terror Attack Description Language (TADL), which is used as a basis for modeling and simulation of terrorist attacks. Examples are shown which illustrate the use of TADL and a companion simulator based on a Hidden Markov Model (HMM) structure to generate transactions for attack scenarios drawn from real events. We also describe our techniques for generating realistic background clutter traffic to enable experiments to estimate performance in the presence of a mix of data. An important part of our effort is to produce scenarios and corpora for use in our own research, which can be shared with a community of researchers in this area. We describe our scenario and corpus development, including specific examples from the September 2004 bombing of the Australian embassy in Jakarta and a fictitious scenario which was developed in a prior project for research in social network analysis. The scenarios can be created by subject matter experts using a graphical editing tool. Given a set of time ordered transactions between actors, we employ social network analysis (SNA) algorithms as a filtering step to divide the actors into distinct communities before determining intent. This helps reduce clutter and enhances the ability to determine activities within a specific group. For modeling and simulation purposes, we generate random networks with structures and properties similar to real-world social networks. Modeling of background traffic is an important step in generating classifiers that can separate harmless activities from suspicious activity. An algorithm for recognition of simulated potential attack scenarios in clutter based on Support Vector Machine (SVM) techniques is presented. We show performance examples, including probability of detection versus probability of false alarm tradeoffs, for a range of system parameters.

[1]  Kathleen M. Carley,et al.  Exploration of communication networks from the Enron email corpus , 2005 .

[2]  Il-Chul Moon,et al.  ORA User's Guide 2007 , 2007 .

[3]  Todd Sandler,et al.  Games and Terrorism Recent Developments , 2008 .

[4]  Richard M. Schwartz,et al.  An Algorithm that Learns What's in a Name , 1999, Machine Learning.

[5]  Gábor Csárdi,et al.  The igraph software package for complex network research , 2006 .

[6]  Mark A. Przybocki,et al.  The Automatic Content Extraction (ACE) Program – Tasks, Data, and Evaluation , 2004, LREC.

[7]  Haiying Tu,et al.  Detecting, tracking, and counteracting terrorist networks via hidden Markov models , 2004, 2004 IEEE Aerospace Conference Proceedings (IEEE Cat. No.04TH8720).

[8]  Kathleen M. Carley,et al.  Destabilizing Terrorist Networks , 1998 .

[9]  Heather Fry,et al.  A user’s guide , 2003 .

[10]  T.R. Coffman,et al.  Dynamic classification of groups through social network analysis and HMMs , 2004, 2004 IEEE Aerospace Conference Proceedings (IEEE Cat. No.04TH8720).

[11]  Krishna R. Pattipati,et al.  An Advanced System for Modeling Asymmetric Threats , 2006, 2006 IEEE International Conference on Systems, Man and Cybernetics.

[12]  Jennifer Neville,et al.  Dependency networks for relational data , 2004, Fourth IEEE International Conference on Data Mining (ICDM'04).

[13]  D. Sánchez,et al.  Automatic information extraction from the Web , 2004 .

[14]  Hector J. Levesque,et al.  Knowledge Representation and Reasoning , 2004 .

[15]  Nate Blaylock,et al.  Generating Artificial Corpora for Plan Recognition , 2005, User Modeling.

[16]  Clayton T. Morrison,et al.  The Hats Simulator , 2004, Proceedings of the 2004 Winter Simulation Conference, 2004..

[17]  Todd Sandler,et al.  Games and Terrorism , 2009 .

[18]  Krishna R. Pattipati,et al.  Hidden Markov Models and Bayesian Networks for Counter-Terrorism , 2006, Emergent Information Technologies and Enabling Policies for Counter-Terrorism.

[19]  B. Stauffer,et al.  Nine Cautionary Tales , 2006, IEEE Spectrum.

[20]  Automatic Content Extraction 2008 Evaluation Plan ( ACE 08 ) Assessment of Detection and Recognition of Entities and Relations Within and Across Documents , 2008 .

[21]  M E J Newman,et al.  Community structure in social and biological networks , 2001, Proceedings of the National Academy of Sciences of the United States of America.

[22]  John Yen,et al.  Emergent Information Technologies and Enabling Policies for Counter-Terrorism , 2006 .

[23]  M E J Newman,et al.  Modularity and community structure in networks. , 2006, Proceedings of the National Academy of Sciences of the United States of America.

[24]  Christos Faloutsos,et al.  R-MAT: A Recursive Model for Graph Mining , 2004, SDM.

[25]  William M. Campbell,et al.  Speaker Verification Using Support Vector Machines and High-Level Features , 2007, IEEE Transactions on Audio, Speech, and Language Processing.

[26]  Satnam Singh,et al.  Collaborative Tools for Counter-Terrorism Analysis , 2005, 2005 IEEE Aerospace Conference.

[27]  Jennifer Neville,et al.  Relational Dependency Networks , 2007, J. Mach. Learn. Res..

[28]  Edoardo M. Airoldi,et al.  Statistical Network Analysis: Models, Issues, and New Directions - ICML 2006 Workshop on Statistical Network Analysis, Pittsburgh, PA, USA, June 29, 2006, Revised Selected Papers , 2007, SNA@ICML.

[29]  John Yen,et al.  Emergent Information Technologies and Enabling Policies for Counter-Terrorism (IEEE Press Series on Computational Intelligence) , 2006 .