organization of social networks; the measure is global in terms of being applied to the ... rapidly growing amount of literature on modeling terrorist networks as graphs, an ... formed a useful part of intelligence work. As terrorists establish new ...
2010 International Conference on Advances in Social Networks Analysis and Mining
A Global Measure for Estimating the Degree of Organization of Terrorist Networks Khaled Dawoud
Reda Alhajj
,
Department of Computer Science University of Calgary Calgary, Alberta, Canada
Department of Computer Science Global University Beirut, Lebanon
analysis of terrorist networks has attracted special attention in the last decade, especially after the events of September 11, 2001. This raised high interest in scientific methodologies that could help in systematically fighting terrorism, e.g., [5, 6, 12, 13, 14, 15]. Researchers mostly try to build a social network model of a terrorist organization in a way to track its activities. The main target is to find out how members of the organization split into groups to plan for and conduct certain terrorist activities. The ultimate target of the governments, industry and the academia is the development of automated early warning systems with high prediction accuracy [13, 14]. The area is challenging and multidisciplinary, demanding expertise from sociology, psychology, ecology, statistics, computing, among others. As a result of the uprising interest in the field, there is a rapidly growing amount of literature on modeling terrorist networks as graphs, an outgrowth of the existing literature concerning other types of criminal networks, e.g., [2, 3, 5, 12, 14, 15]. However, a graph model might not be the best representation of organizations such as terrorist organization and threat groups. In his recent work described in [4], Farley explains clearly that modeling terrorist networks as graphs does not give us enough information to deal with the threat. Modeling a terrorist network as a hierarchy can be a good approach to give an idea about the subgroups present in the network and also how information flows from higher ranks to lower [5]. Actually, a hierarchy is another perspective for analyzing a social network. We argue that it is necessary to consider all perspectives at once in order to produce a robust approach that could work as early warning system with high accuracy. As part of our effort to contribute to this essential field of research, in this paper we introduce a measure to determine the importance and danger of a network structure based on social network analysis measures; a well organized network structure leads to existence of leaders and important nodes. Concentrating on the structure would lead to vital discoveries that highlight such leaders and important nodes which should be well tracked in order to avoid as much as ever possible any future terrorist activities by their groups. The proposed measure is equally important to analyze other domains that could be modeled as social network; this is well demonstrated in the conducted testing. The remainder of the paper is organized as follows. Section 2 describes social network analysis measures. Section 3 discusses the proposed measure for analyzing
Abstract The motivation for the study described in this paper is realizing the fact that organizational structure of a group is a key indicator in determining its strengths and weaknesses. A general knowledge of the prevalent models of terrorist organizations leads to a better understanding of their capabilities. Knowledge of the different labels and systems of classification that have been applied to groups and individuals aid us in discarding useless or irrelevant terms, and in understanding the purposes and usefulness of different terminologies. Previous studies in network analysis have mostly dealt with legal networks with transparent structures. Terrorist networks share some features with conventional (real world) networks, but they are harder to identify because they mostly hide their illicit activities. In this paper we describe a novel approach for extracting structural patterns of terrorist networks with the help of social network analysis measures and techniques. We propose a global measure for estimating the degree of organization of social networks; the measure is global in terms of being applied to the whole network as an entity and being extracted from the major well-known SNA measures. The importance of such research comes from the fact that individuals in organized intellectual networks and especially terrorist networks tend to hide their individual rules and thus there is a need to deal with such networks as a whole, discovering the degree of organization and thus its strengths and weaknesses.
1. Introduction Different systems in different fields can be represented as networks, consisting of sets of nodes or vertices linked together in pairs by edges with nontrivial topological structures [1]. In other words, the social network model is powerful enough to be successfully applied for analyzing any problem where it is possible to identify actors and links. Building a model of a network structure helps in understanding the network and discovering prominent nodes and edges. Nodes may be relevant individually or in groups forming communities. A community is a set of nodes characterized by having more connections within the group and few connections outside the group. Recently organized terrorism expanded from the Middle and Far East to cover the developed western countries, e.g., East Europe and USA. Driven by this trend, research on the 978-0-7695-4138-9/10 $26.00 © 2010 IEEE DOI 10.1109/ASONAM.2010.84
Jon Rokne
421
organized network structure. Section 4 reports our results on different data sets of terrorist networks and non-terrorist networks. Section 5 is conclusions.
2.3 Closeness Measure Closeness is the sum of the length of geodesics between a particular node, say a, and all the other nodes in a network. It actually measures how far away one node is from other nodes and sometimes is called “farness” [11]:
2. Social Network Analysis (SNA) Social Network Analysis (SNA) is about mapping and measuring of relationships (and flows) between people, groups, organizations or other information/knowledge processing entities. Entities (called actors) are represented as nodes in the network along with links, with/without attribute weight ages. SNA attempts to provide both mathematical analysis and visual representation of relationships in a network. SNA is an interesting crossfertilization of sociology, mathematics, computing, etc to the benefit of all. The idea of applying SNA to understand networks is not new [6]. In one form or another, network analysis has been used to uncover unlawful entities and activities. It has been used for evidence mapping in fraud and criminal conspiracy cases, e.g., [7, 8, 9]. A suspect’s network can be built through relational information, including internet blogs, emails, telephone logs, travel bookings, credit card transactions, etc [2]. More recently, network methods have formed a useful part of intelligence work. As terrorists establish new relations or break existing relations with others, their position roles, and power may change accordingly. These node dynamics, resulting from relation changes, can be captured by a set of centrality measures from SNA.
where l(i,a) is the length of the shortest path connecting nodes i and a.
3. Process Organizational Measure The idea of our approach is shedding light on the organizational structure of networks rather than considering the importance of individuals or nodes. Though we concentrate more on terrorist networks in the testing, we run some tests to demonstrate the applicability of our measure to other networks as well. For a terrorist network to be considered dangerous or important, it must reach to certain level of organizational structure. Modern terrorist organizations have learned that they can effectively counter much larger and conventional enemies using dispersed and networked forms of warfare, striking when their target is least likely to expect it. However, on the other hand, planning a highly organized attack requires highly organized communications, which means the fact that true leaders could be hiding themselves doesn’t really affect the structure of a terrorist network. We observed a characteristic of terrorist network structure or in general the well organized networks, which is the non-normal distribution of the three major SNA measures; degree, betweenness, and closeness among the nodes in the network. Values of these measures among the nodes tend to be clustered in groups of close values, the larger number of groups and the larger number of nodes within each group refers to the level of organization of the network. We translate this approach to a numerical value to indicate the value of organization within the network, and thus the importance and danger factor of a terrorist network. The proposed process works as follows: 1. Rank each node of the network based on specific measure 2. Group nodes starting from the lowest values based on closeness of values (nodes with close values are grouped together) A = set of groups 3. Each group is given a weight, weights are given to reflect bigger influence of groups constructed from high SNA measures values, weights can be given in many ways depends to what extinct high SNA values affects the network. In our study we assign sequential numbers, where the first group created has the lowest weight and the last one has the highest weight; weights are integer numbers starting from 1. For each (Ai), (Wi) denotes the weight of the group (Ai)
2.1 Degree Measure Degree measures how active a particular node is. It is defined as the number of direct links a node a has [10]:
where n is the total number of nodes in a network, c(i, a) is a binary variable indicating whether a link exists between nodes i and a. A network member with a high degree could be the leader or “hub” in a network. In a directed graph, degree can be classified into indegree and out-degree to differentiate between links going into and out of a node, respectively.
2.2 Betweenness Measure Betweenness measures the extent to which a particular node lies between other nodes in a network. The betweenness of a node, say a, is defined as the number of geodesics (shortest paths between two nodes) passing through a [10]:
where gij(a) indicates whether the shortest path between two other nodes i and j passes through node a. A member with high betweenness may act as a gatekeeper or “broker” in a network for smooth communication (information passing) or flow of goods (e.g., drugs). 422
Table 1. Total degree of September 11th Rank
Agent
Value
1
33
1.0000
2
40
0.7000
3
46
0.5000
4
41
0.5000
5
34
0.5000
6
25
0.5000
7
15
0.5000
8
5
0.5000
9
57
0.4000
10
49
0.4000
11
53
0.4000
12
52
0.4000
13
32
0.4000
14 15 16
31 47 44
influence of a group. Then add values together and get one value relative to the size of the whole network
where n is number of groups, N is the total number of nodes within the network
Table 3. closeness values of September 11th
0.4000 0.4000 0.4000
17
30
0.4000
18
56
0.3000
19
54
0.3000
20
50
0.3000
Table 2. betweenness values of September 11th Rank
Agent
Value
Rank
Agent
Value
1
8
0.0309
2
19
0.0283
3
5
0.0282
4
15
0.0279
5
48
0.0272
6
45
0.0261
7
61
0.0254
8
39
0.0251
9
58
0.0251
10
62
0.0250
11
55
0.0250
12
47
0.0247
13
56
0.0246
14
27
0.0243
15
57
0.0242
16
38
0.0241
1
46
0.1097
17
49
0.0239
2
33
0.0976
18
33
0.0239
3
49
0.0798
19
26
0.0239
4
57
0.0665
20
53
0.0238
5
40
0.0602
6
44
0.0457
7
54
0.0448
8
56
0.0440
At the end, we apply the Org function on each of the three previously mentioned SNA measures and sum the values to get our measure value for the whole network.
9
34
0.0440
Org(network)=Org(betweenness)+Org(closeness)+Org(degree)
10
53
0.0418
11
52
0.0383
12
51
0.0303
13
31
0.0282
14
55
0.0262
A higher value of the Org measure reflects higher organized network structure, and thus higher importance and danger terrorist network. To demonstrate its applicability and effectiveness, we applied this measure to various data sets of terrorist networks and non-terrorist networks; the results are promising as reported in Section 4.
15
5
0.0221
16
25
0.0173
17
15
0.0160
18
50
0.0158
19
47
0.0149
20
30
0.0142
4. Experiments In the conducted experiments, we have used three data sets, two of them for terrorist networks, namely September 11th data set, and Madrid bombing data set. September 11th data set consists of 63 nodes of actors suspected to be involved in September 11th attack, the 153 links between nodes constructed based on (communication, relatives, places belonging to, and roommates) relationships. Madrid Bombing data set consists of 67 nodes and 89 links which
4. Multiply the weight of each group with the number of nodes within the group to relatively express the
423
Table 5 . betweenness values of Madrid bombing data set
constructed the same way as September 11th data set. The third data set is for non-terrorist network; it is related to World Trade of 80 countries and 998 interactions of trading activities between countries. We first applied the SNA measures for each data set, and used them to extract the proposed overall Organizational measure. By considering the network of September 11, Table 1, Table 2 and Table 3 show the top ranked nodes of the three SNA measures, in degree, betweenness, and closeness, respectively.
Rank
Agent
Value
1
Madrid Bombings
0.0242
2
Abu Hafs al-Masri
0.0061
3
Moroccan Islamic
0.0047
4
Serhane ben
0.0035
5
Jamal Zougam
0.0030
6
Zarqa, Jordan
0.0023
7
Brahim
0.0023
8
Takfir wal-Hijra
0.0023
9
Spain
0.0005
10
Afghanistan
0.0005
11
Imad Eddin
0.0002
12
Jose Emilio
0.0002
13
Youssef Belhadj
0.0002
Table 6 . closeness values of Madrid bombing data set
Figure 1. September 11th total degree distribution Table 4. total degree values of Madrid bombing data set
Rank
Agent
Value
1
Abu Dujan al
0.0194
2
Jamal Ahmidan
0.0191
3
Morocco
0.0191
4
Serhane ben
0.0191
5
Madrid Store
0.0188
6
Jamal Zougam
0.0184 0.0184
Rank
Agent
Value
7
al qaeda
1
Madrid Bombings
1.0000
8
Abu Hafs al-Masri
0.0184
2
Moroccan Islamic
0.3077
9
Madrid Bombings
0.0182
3
Serhane ben
0.2308
10
Moroccan Islamic
0.0181
4
Zarqa, Jordan
0.1538
11
Lavapies, Madrid,
0.0156
5
Imad Eddin
0.1538
12
Al Qaeda cell in
0.0154
6
Morocco
0.1538
13
Afghanistan
0.0154
7
Madrid Store
0.1538
14
Rachid Bendouda
0.0154
8
Jamal Zougam
0.1538
15
Zarqa, Jordan
0.0152
9
Spain
0.1538
16
Imad Eddin
0.0152
10
Afghanistan
0.1538
17
Taragona Al
0.0152
11
Jamal Ahmidan
0.1538
18
Abdelaziz Beyaich 0.0152
12
Jose Emilio
0.1538
19
Spain
0.0152
13
Brahim
0.1538
20
Jose Emilio
0.0152
14
Abdennabi
0.1538
15
Abu Hafs al-Masri
0.1538
16
Takfir wal-Hijra
0.1538
17
Youssef Belhadj
0.1538
18
Al Qaeda cell in
0.0769
19
Mohamed Atta
0.0769
20
Casablanca
0.0769
We can notice from the top ranked nodes of each measure, the way nodes are grouped in close values. We believe this trend shows in well-organized social networks, where actors tend to have responsibilities according to their importance within the hierarchy of the network. In the tables above SNA measures of a sample of top ranked actors is not gradually decreased from the top ranked to the least, it tends more to decrease in gaps leaving group of actors having close values together. As shown in Figure 1,
424
Table 4, Table 5 and Table 6. Further, the curves plotted in Figure 2 show the same manner of distribution; we believe this trend reflects planning and organizing in relationships in the network. To avoid any bias in the results and to demonstrate the effectiveness of the proposed measure, we have also applied the same set of experiments on a non-terrorist network (World Trade) data set. The results of the top ranking nodes for the three measures are listed in Table 7, Table 8 and Table 9; values of SNA measures of World Trade data set are observed to gradually decrease from top ranked to least ranked value, gaps are not observed which we believe reflects no intellectual organization or planning behaviors, and the distribution curves for the three measures are plotted in Figure 3, Figure 4 and Figure 5, respectively. Comparing the distribution curves of SNA measures belonging to terrorist networks (highly organized networks) to the World Trade network demonstrates the grouping distribution of terrorist networks where it is worth noting that the distribution of the SNA measures in World Trade data set doesn’t reflect any grouping factors; this supports the idea of non-organizational structure. Our method tends to transform the degree of organization into a numerical value as demonstrated by the values reflected in the nine tables and the curves plotted in the five figures.
we plotted values of each node of the network for total degree measure as compared to normal distribution using the ORA tool in order to show the non-normal distribution. Values plotted in this chart are values corresponding to all actors in the network. Here gaps are visually observed and the manner repeated all over the network.
Figure 2. Madrid total degree distribution
Table 8. betweenness values of word trade data set Rank
Figure 3. Total degree distribution of World Trade data set Table 7. total degree values of word trade data set Rank
Agent
1
Finland
1.0000
2
Slovenia
0.8817
3
Iceland
0.4545
4
Singapore
0.3861
5
Hungary
0.3662
6
Brazil
0.3150
7
Chile
0.2793
8
Kuwait
0.2664
9
Salvador
0.2481
10
Belgium
0.2285
Agent
Value
1
Rep.
0.1124
2
Iceland
0.0784
3
Finland
0.0649
4
Mexico
0.0610
5
Ecuador
0.0501
6
Slovenia
0.0477
7
Of
0.0400
8
Singapore
0.0356
9
Moldava.
0.0322
10
Hungary
0.0279
Table 9. closeness values of word trade data set
Value
We applied the same measures on the Madrid Bombing data set. The obtained top ranking nodes are reported in 425
Rank
Agent
Value
1
Finland
0.9744
2
Hungary
0.9268
3
Slovenia
0.9157
4
Singapore
0.8444
5
Chile
0.7917
6
Salvador
0.7835
7
Iceland
0.7755
8
Belgium
0.7037
9
Rep.
0.7037
10
Kuwait
0.7037
connectivity and communication levels plays a vital role in composing serious well organized terrorist networks.
5. Conclusions A clear understanding of network structures and individual roles can help law enforcement and intelligence agencies to develop effective strategies in order to prevent future terrorist attacks. More organized terrorist network structure is considered to be more important and more dangerous. SNA is widely used in terms of discovering important agents; the growing awareness of terrorists makes it more difficult to discover important agents, since they tend to hide themselves. We argue that a measure of degree of organization of the whole network without concentrating on discovering certain individuals would help in discovering and predicting terrorist networks. Using SNA measures to extract a measure referring to the degree of organization of the whole network is the technique we used. We tested our measure on three different networks to validate the proposed approach for predicting the organizational structure of a network; the measure had higher value in terrorist networks and low value relatively in the world trade network which is less organized.
Figure 4. betweenness distribution of World Trade data set
References [1] Strogatz S. H., “Exploring Complex Networks,” Nature, 410, pp.268-276, 2002. [2] Krebs V., “Mapping Terrorist Networks,” Connections, 24(3), 2002. [3] Klerks P., “The Network Paradigm Applied to Criminal Organizations,” Connections, 24 (3), 2001. [4] Farely D. J., “Breaking Al Qaeda Cells: A Mathematical analysis of counterterrorism Operations,” Studies in Conflict Terrorism. 26, pp.399–411, 2003. [5] Shaikh M.A. and Wang J., “Discovering hierarchical structure in terrorist networks,” Proceedings of the International Conference on Emerging Technologies, pp.238-244 Nov. 2006. [6] Sparrow, M.K., “The application of network analysis to criminal intelligence: An assessment of the prospects,” Social Networks, 13, pp.251-274, 1991. [7] Baker, W.E. and Faulkner, R.R., “The social organization of conspiracy: Illegal networks in the heavy electrical equipment industry,” American Sociological Review, 58(6) 837-860, 1993. [8] Criminal Network Analysis Training Course. Defense Intelligence Agency, 2000. [9] Klerks, P., “The network paradigm applied to criminal organizations,” Connections, 24 (3) , 2001. [10] Jialun Q., Xu J.J., Daning H., Sageman M. and Chen H., “Analyzing Terrorist Networks: A Case Study of the Global Salafi Jihad Network,” Proceedings ofIEEE International Conference on Intelligence and Security Informatics, Atlanta GA, pp. 287-304, 2005. [11] Baker, W. E. and Faulkner, R. R., “The Social Organization of Conspiracy: Illegal Networks in the Heavy Electrical Equipment Industry,” American Sociological Review, 58(12) (1993) 837-860.
Figure 5. closeness distribution of World Trade data set Table 10. organization values Data set
Total Degree Betweenness Closeness Total Organization Organization organization organization value value value value
September 11th
2.66
3.0625
1.548
7.27
Madrid Bombing
1.338
1.769
1.321
4.42
World trade
1.55
0.757
1.67
3.97
The values of the proposed organization measure are shown in Table 10 for the three networks used in the tests. The results show higher values for groups-based organized networks, which are the two terrorist networks. September 11th total value is significantly the highest; this reflects the degree of organization the network did reach to, and as a result became more and more seriously dangerous. Value of organization based on betweenness is the most affected one as well; this can make it the dominated factor. Our measure would be helpful in detecting highly organized terrorist networks and as a result preventing possible terror attacks. Further, our approach is different than other approaches studying the structure of networks; we focus on terrorist networks’ structure in which we believe the redundancy of 426
[14] Memon, N., Wiil, U. K., and Qureshi, A. R., “Design and Development of an Early Warning System to Prevent Terrorist Attacks,” Proceedings of the International Conference on Artificial Intelligence and Neural Networks, pp.222-226, 2009. [15] Tsvetovat, M., and Carley K. M., “Structural Knowledge and Success of Anti-terrorist Activity: The Downside of Structural Equivalence,” Journal of Social Structures, 6(2), 2005.
[12] Xu J. and Chen H., “CrimeNet Explorer: A framework for criminal network knowledge discovery,” ACM Transactions on Information Systems, Vol. 23(2), pp.201-226, 2005. [13] Memon, N., Wiil, U.K., Alhajj, R., Atzenbeck, C. and Harkiolakis, N., “Harvesting Covert Networks: The Case Study of the iMiner Database,” Journal of Networking and Virtual Organisations, 2010.
427
