The investigation of the terrorist attack is a time-critical task. The investigators have a limited time window to diagnose the organizational background of the terrorists, to run down and arrest the wire-pullers, and to take an action to prevent or eradicate the terrorist attack. The intuitive interface to visualize the intelligence data set stimulates the investigators’ experience and knowledge, and aids them in decision-making for an immediately effective action. This paper presents a computational method to analyze the intelligence data set on the collective actions of the perpetrators of the attack, and to visualize it into the form of a social network diagram which predicts the positions where the wire-pullers conceals themselves.
Social network analysis @cite_17 is a study of social structures, which are made of nodes (individuals, organizations etc.), which are linked by one or more specific types of relationship (transmission of influence, presence of trust etc.). Terrorist or criminal organizations have been studied empirically @cite_19 . Factor analysis is applied to study email exchange in Enron, which ended in bankruptcy due to the institutionalized accounting fraud @cite_20 . The criminal organizations tend to be strings of inter-linked small groups that lack a central leader, but to coordinate their activities along logistic trails and through bonds of friends. Hypothesis can be built by paying attention to remarkable white spots and hard-to-fill positions in a network @cite_12 . The conspirators in the 9 11 terrorist organization are relevant in reducing the distance between hijackers, and enhancing communication efficiently @cite_21 . The 9 11 terrorists' social network is investigated from the viewpoint of efficiency and security trade-off @cite_3 . More security-oriented structure arises from longer time-to-task of the terrorists' objectives. The conspirators improve communication efficiency, preserving hijackers' small visibility and exposure.
@cite_21 @cite_3 @cite_19 @cite_20 @cite_12 @cite_17
341170067 2492695942 1970857195 2161260361 2045317751 2109469951 307289813 1977186326 1584092895 1980216718 1903894141 2072701859 121858502 2061094040 1971788485 2123726161 2101287943 2404233270 2012557827 2164998314
Abstract : The purpose of this paper is to explore the question of how modern terrorist groups manage to survive in the face of aggressive counterterrorist operations by security forces. Al Qa'ida survives to this day, despite the destruction of their Afghanistan sanctuary, the loss of countless key personnel, and continuous pressure by the United States and their allies. Why has al Qa'ida survived? Since much of the literature on terrorism focuses on how to eliminate them, this research paper focuses on why they still endure. In other words, instead of asking, "How do we kill them," this research asks, "Why don't they die?" This research employs a dynamic network analysis approach to explore the primary research question of terrorist survival. This analysis combines aspects of traditional social network analysis with a new multi-agent model that describes how terrorist groups raise agents through the organization to positions of prominence. The key to this process is the radicalization of members based on time, connectivity, and belief intensity. The testing dataset comes from the 1998 Tanzania Embassy bombing, expressed in the form of a meta-network. After four testing program iterations, the author concludes that terrorist organizational survival is based on the internal dynamics of leader selection and growth within the group as new members advance. These findings imply a number of recommendations for counterterrorist operations and intelligence activities in order to disrupt the growth and development of new leaders. Additionally, these results imply that current Joint and Army doctrine on network analysis insufficiently addresses the dynamic processes that network diagrams are intended to depict. American military counterinsurgency and counterterrorist operations can be greatly enhanced by moving from a network analysis approach based on structure to one based on dynamics. The Internet and social media have fuelled enormous interest in social network analysis. New tools continue to be developed and used to analyse our personal connections, with particular emphasis on detecting communities or identifying key individuals in a social network. This raises privacy concerns that are likely to exacerbate in the future. With this in mind, we ask the question ‘Can individuals or groups actively manage their connections to evade social network analysis tools?’ By addressing this question, the general public may better protect their privacy, oppressed activist groups may better conceal their existence and security agencies may better understand how terrorists escape detection. We first study how an individual can evade ‘node centrality’ analysis while minimizing the negative impact that this may have on his or her influence. We prove that an optimal solution to this problem is difficult to compute. Despite this hardness, we demonstrate how even a simple heuristic, whereby attention is restricted to the individual’s immediate neighbourhood, can be surprisingly effective in practice; for example, it could easily disguise Mohamed Atta’s leading position within the World Trade Center terrorist network. We also study how a community can increase the likelihood of being overlooked by community-detection algorithms. We propose a measure of concealment—expressing how well a community is hidden—and use it to demonstrate the effectiveness of a simple heuristic, whereby members of the community either ‘unfriend’ certain other members or ‘befriend’ some non-members in a coordinated effort to camouflage their community. This paper addresses a method to analyse the covert social network foundation hidden behind the terrorism disaster. It is to solve a node discovery problem, which means to discover a node, which functions relevantly in a social network, but escaped from monitoring on the presence and mutual relationship of nodes. The method aims at integrating the expert investigator's prior understanding, insight on the terrorists' social network nature derived from the complex graph theory and computational data processing. The social network responsible for the 9 11 attack in 2001 is used to execute simulation experiment to evaluate the performance of the method. A consistent trade-off facing participants in any criminal network is that between organizing for efficiency or security—participants collectively pursue an objective while keeping the action leading to that goal concealed. Which side of the trade-off is prioritized depends on the objective that is pursued by the criminal group. The distinction is most salient when comparing terrorist with criminal enterprise networks. Terrorist networks are ideologically driven, while criminal enterprises pursue monetary ends. Time-to-task is shorter in the criminal enterprise and group efficiency is therefore prioritized over group security. Terrorist networks, in contrast, have longer horizons and security is prioritized over the execution of any single attack. Using Krebs’ exploratory research on networks of terrorist cells and electronic surveillance transcripts of a drug importation network, our analyses demonstrate how these opposing trade-offs emerge in criminal group structures. Social network analysis is the study of patterns of interaction between social entities. The field is attracting increasing attention from diverse disciplines including sociology, epidemiology, and behavioral ecology. An important sociological phenomenon that draws the attention of analysts is the emergence of communities, which tend to form, evolve, and dissolve gradually over a period of time. Understanding this evolution is crucial to sociologists and domain scientists, and often leads to a better appreciation of the social system under study. Therefore, it is imperative that social network visualization tools support this task. While graph-based representations are well suited for investigating structural properties of networks at a single point in time, they appear to be significantly less useful when used to analyze gradual structural changes over a period of time. In this paper, we present an interactive visualization methodology for dynamic social networks. Our technique focuses on revealing the community structure implied by the evolving interaction patterns between individuals. We apply our visualization to analyze the community structure in the US House of Representatives. We also report on a user study conducted with the participation of behavioral ecologists working with social network datasets that depict interactions between wild animals. Findings from the user study confirm that the visualization was helpful in providing answers to sociological questions as well as eliciting new observations on the social organization of the population under study. Analysis of social networks is suggested as a tool for linking micro and macro levels of sociological theory. The procedure is illustrated by elaboration of the macro implications of one aspect of small-scale interaction: the strength of dyadic ties. It is argued that the degree of overlap of two individuals' friendship networks varies directly with the strength of their tie to one another. The impact of this principle on diffusion of influence and information, mobility opportunity, and community organization is explored. Stress is laid on the cohesive power of weak ties. Most network models deal, implicitly, with strong ties, thus confining their applicability to small, well-defined groups. Emphasis on weak ties lends itself to discussion of relations between groups and to analysis of segments of social structure not easily defined in terms of primary groups. Abstract : Changes in observed social networks may signal an underlying change within an organization, and may even predict significant events or behaviors. The breakdown of a team's effectiveness, the emergence of informal leaders, or the preparation of an attack by a clandestine network may all be associated with changes in the patterns of interactions among group members. The ability to systematically, statistically, effectively and efficiently detect these changes has the potential to enable the anticipation, early warning, and faster response to both positive and negative organizational activities. By applying statistical process control techniques to social networks we can rapidly detect changes in these networks. Herein we describe this methodology and then illustrate it using four data sets. We nominate four types of dynamic network behaviors for investigation in this paper. These behaviors are not comprehensive; however, it is necessary to define a set of behaviors to focus our investigation of network change. The four behaviors we focus on are network stability, endogenous change, exogenous change, and initiated change. The first data set is the Newcomb fraternity data. The second set of data was collected on a group of mid-career U.S. Army officers in a week-long training exercise. The third data set contains the perceived connections among members of al Qaeda based on open sources, and the fourth data set is simulated using multiagent simulation. The results indicate that this methodology is able to detect change even with the high levels of uncertainty inherent in these data sets. Sociologists since Simmel have been interested in social circles as essential features of friendship networks. Although network analysis has been increasingly used to uncover patterns among social relationships, theoretical explanations of these patterns have been inadequate. This paper presents a theory of the social organization of friendship ties. The approach is based upon Homans's concepts of activities, interactions, and sentiments and upon the concept of extra-network foci organizing social activities and interaction. The theory is contrasted with Heider's balance theory. Implications for transitivity, network bridges, and density of personal networks are discussed and presented as propositions. The focus theory is shown to help explain patterns of friendships in the 1965-66 Detroit Area Study. This paper is intended as a step toward the development of integrated theory to explain interrelationships between networks and other aspects of social structure. Implications for data analysis are discussed. Sociologists have long recognized the importance of patterns in networks of relations that connect individuals with each other. Simmel (1955) described modern society as consisting of loosely connected social circles of relationships. Granovetter (1973) has indicated the general significance of these social circles for communication, community organization, and social conflict. Various studies have supported this picture of the essential patterns in social networks, including Moreno's sociometry (1953), Milgram's "small world" experiments (1967), and Kadushin's observations (1966). Unfortunately, the study of social networks has often been carried out without concern for the origins in the larger social context. Most network analysis ends with description and labeling of patterns; and when explanations of patterns are offered, they frequently rely upon inherent tendencies within networks to become consistent, balanced, or transitive. As a consequence of such atheoretical and or self-contained network theoretical approaches, data are collected and data analysis techniques are devised for Social network analysis uses techniques from graph theory to analyze the structure of relationships among social actors such as individuals or groups. We investigate the effect of the layout of a social network on the inferences drawn by observers about the number of social groupings evident and the centrality of various actors in the network. We conducted an experiment in which eighty subjects provided answers about three drawings. The subjects were not told that the drawings were chosen from five different layouts of the same graph. We found that the layout has a significant effect on their inferences and present some initial results about the way certain Euclidean features will affect perceptions of structural features of the network. There is no “best” layout for a social network; when layouts are designed one must take into account the most important features of the network to be presented as well as the network itself. Environments such as schools, public parks and prisonsand others that contain a large number of people are typi-cally characterized by frequent and complex social interac-tions. In order to identify activities and behaviors in suchenvironments, it is necessary to understand the interactionsthat take place at a group level. To this end, this paper ad-dresses the problem of detecting and predicting suspiciousand in particular aggressive behaviors between groups ofindividuals such as gangs in prison yards. The work buildson a mature multi-camera multi-target person tracking sys-tem that operates in real-time and has the ability to han-dle crowded conditions. We consider two approaches forgrouping individuals: (i) agglomerative clustering favoredby the computer vision community, as well as (ii) decisiveclustering based on the concept of modularity, which is fa-vored by the social network analysis community. We showthe utility of such grouping analysis towards the detectionof group activities of interest. The presented algorithm isintegrated with a system operating in real-time to success-fully detect highly realistic aggressive behaviors enacted bycorrectional officers in a simulated prison environment. Wepresent results from these enactments that demonstrate theefficacy of our approach. This paper looks at the difficulty in mapping covert networks. Analyzing networks after an event is fairly easy for prosecution purposes. Mapping covert networks to prevent criminal activity is much more difficult. We examine the network surrounding the tragic events of September 11th, 2001. Through public data we are able to map a portion of the network centered around the 19 dead hijackers. This map gives us some insight into the terrorist organization, yet it is incomplete. Suggestions for further work and research are offered. The capacity to collect fingerprints of individuals in online media has revolutionized the way researchers explore human society. Social systems can be seen as a nonlinear superposition of a multitude of complex social networks, where nodes represent individuals and links capture a variety of different social relations. Much emphasis has been put on the network topology of social interactions, however, the multidimensional nature of these interactions has largely been ignored, mostly because of lack of data. Here, for the first time, we analyze a complete, multirelational, large social network of a society consisting of the 300,000 odd players of a massive multiplayer online game. We extract networks of six different types of one-to-one interactions between the players. Three of them carry a positive connotation (friendship, communication, trade), three a negative (enmity, armed aggression, punishment). We first analyze these types of networks as separate entities and find that negative interactions differ from positive interactions by their lower reciprocity, weaker clustering, and fatter-tail degree distribution. We then explore how the interdependence of different network types determines the organization of the social system. In particular, we study correlations and overlap between different types of links and demonstrate the tendency of individuals to play different roles in different networks. As a demonstration of the power of the approach, we present the first empirical large-scale verification of the long-standing structural balance theory, by focusing on the specific multiplex network of friendship and enmity relations. It is undoubtedly cliche to say that we are in the Age of Big Data Analytics or Data Science; every computing and IT publication you find talks about Big Data and companies no longer are interested in software engineers and analysts but instead they are looking for Data Scientists! In spite of the excessive use of the term, the truth of the matter is that data has never been more available and the increase in computation power allows for more sophisticated tools to identify patterns in the data and on the networks that governs these systems (complex networks). Crime is not different, the open data phenomena has spread to thousand of cities in the world, which are making data about crime activity available for any citizen to look at. Furthermore, new criminology studies argue that criminals typically commit crimes in areas in which they are familiar, usually close to home. Using this information we propose a new model based on networks to build links between crimes in close physical proximity. We show that the structure of the criminal activity can be partially represented by this spatial network of sites. In this paper we describe this process and the analysis of the networks we have constructed to find patterns in the underlying structure of criminal activity. Social network analysis and mining has been highly influenced by the online social web sites, telecom consumer data and instant messaging systems and has widely analyzed the presence of dense communities using graph theory and machine learning techniques. Mobile social network analysis is the mapping and measuring of interactions and flows between people, groups, and organizations based on the usage of their mobile communication services. Community identification and mining is one of the recent major directions in social network analysis. In this paper we find the communities in the network based on a modularity factor. Then we propose a graph theory-based algorithm for further split of communities resulting in smaller sized and closely knit sub-units, to drill down and understand consumer behavior in a comprehensive manner. These sub-units are then analyzed and labeled based on their group behavior pattern. The analysis is done using two approaches:—rule-based, and cluster-based, for comparison and the able usage of information for suitable labeling of groups. Moreover, we measured and analyzed the uniqueness of the structural properties for each small unit; it is another quick and dynamic way to assign suitable labels for each distinct group. We have mapped the behavior-based labeling with unique structural properties of each group. It reduces considerably the time taken for processing and identifying smaller sub-communities for effective targeted marketing. The efficiency of the employed algorithms was evaluated on a large telecom dataset in three different stages of our work. This paper reports on the development of social network analysis, tracing its origins in classical sociology and its more recent formulation in social scientific and mathematical work. It is argued that the concept of social network provides a powerful model for social structure, and that a number of important formal methods of social network analysis can be discerned. Social network analysis has been used in studies of kinship structure, social mobility, science citations, contacts among members of deviant groups, corporate power, international trade exploitation, class structure, and many other areas. A review of the formal models proposed in graph theory, multidimensional scaling, and algebraic topology is followed by extended illustrations of social network analysis in the study of community structure and interlocking directorships. We empirically analyze five online communities: Friendster, Livejournal, Facebook, Orkut, and Myspace, to study how social networks decline. We define social resilience as the ability of a community to withstand changes. We do not argue about the cause of such changes, but concentrate on their impact. Changes may cause users to leave, which may trigger further leaves of others who lost connection to their friends. This may lead to cascades of users leaving. A social network is said to be resilient if the size of such cascades can be limited. To quantify resilience, we use the k-core analysis, to identify subsets of the network in which all users have at least k friends. These connections generate benefits (b) for each user, which have to outweigh the costs (c) of being a member of the network. If this difference is not positive, users leave. After all cascades, the remaining network is the k-core of the original network determined by the cost-to-benefit (c b) ratio. By analysing the cumulative distribution of k-cores we are able to calculate the number of users remaining in each community. This allows us to infer the impact of the c b ratio on the resilience of these online communities. We find that the different online communities have different k-core distributions. Consequently, similar changes in the c b ratio have a different impact on the amount of active users. Further, our resilience analysis shows that the topology of a social network alone cannot explain its success of failure. As a case study, we focus on the evolution of Friendster. We identify time periods when new users entering the network observed an insufficient c b ratio. This measure can be seen as a precursor of the later collapse of the community. Our analysis can be applied to estimate the impact of changes in the user interface, which may temporarily increase the c b ratio, thus posing a threat for the community to shrink, or even to collapse. While the Web has become a worldwide platform for communication, terrorists share their ideology and communicate with members on the “Dark Web”—the reverse side of the Web used by terrorists. Currently, the problems of information overload and difficulty to obtain a comprehensive picture of terrorist activities hinder effective and efficient analysis of terrorist information on the Web. To improve understanding of terrorist activities, we have developed a novel methodology for collecting and analyzing Dark Web information. The methodology incorporates information collection, analysis, and visualization techniques, and exploits various Web information sources. We applied it to collecting and analyzing information of 39 Jihad Web sites and developed visualization of their site contents, relationships, and activity levels. An expert evaluation showed that the methodology is very useful and promising, having a high potential to assist in investigation and understanding of terrorist activities by producing results that could potentially help guide both policymaking and intelligence research. © 2008 Wiley Periodicals, Inc. Many data sets can be represented naturally as collections of linked objects. For example, document collections can be represented as documents (nodes) connected by citations and hypertext references (links). Similarly, organizations can be represented as people (nodes) connected by reporting relationships, social relationships, and communication patterns (links). This type of data representation is facilitated by the growing availability of object-oriented databases and hypertext systems. The analysis of such data, often called link analysis, is becoming increasingly important in such diverse fields as law enforcement, fraud detection, epidemiology, and information retrieval. One important class of techniques for link analysis involves inductive inference — the construction of predictive relationships from linked data. For example, researchers in information retrieval might construct models to predict whether a particular WWW document is a homepage based on features of other documents to which it is connected (e.g., pages listing publications or family photos). Similarly, law enforcement agents might construct models to predict whether a person is a potential money-launderer based on bank deposits, international travel, business connections, and the arrest records of known associates. Constructing such predictive relationships is an essential part of link analysis. Despite growing data analysis opportunities, relatively little work examines the unique statistical challenges of inductive inference in linked data. This paper examines three such challenges: 1) statistical dependence caused by linked instances; 2) bias introduced by sampling density; and 3) multiple comparisons intensified by feature combinatorics. In general, current systems A major problem in social network analysis and link discovery is the discovery of hidden organizational structure and selection of interesting influential members based on low-level, incomplete and noisy evidence data. To address such a challenge, we exploit an information theoretic model that combines information theory with statistical techniques from area of text mining and natural language processing. The Entropy model identifies the most interesting and important nodes in a graph. We show how entropy models on graphs are relevant to study of information flow in an organization. We review the results of two different experiments which are based on entropy models. The first version of this model has been successfully tested and evaluated on the Enron email dataset. To comprehend the multipartite organization of large-scale biological and social systems, we introduce an information theoretic approach that reveals community structure in weighted and directed networks. We use the probability flow of random walks on a network as a proxy for information flows in the real system and decompose the network into modules by compressing a description of the probability flow. The result is a map that both simplifies and highlights the regularities in the structure and their relationships. We illustrate the method by making a map of scientific communication as captured in the citation patterns of >6,000 journals. We discover a multicentric organization with fields that vary dramatically in size and degree of integration into the network of science. Along the backbone of the network—including physics, chemistry, molecular biology, and medicine—information flows bidirectionally, but the map reveals a directional pattern of citation from the applied fields to the basic sciences.