Abstract
Predicting terrorist attacks by group networks is an important but difficult issue in intelligence and security informatics. Effective prediction of the behavior not only facilitates the understanding of the dynamics of organizational behaviors but also supports homeland security’s missions in prevention, preparedness, and response to terrorist acts. There are certain dynamic characteristics of terrorist groups, such as periodic features and correlations between the behavior and the network. In this paper, we propose a comprehensive framework that combines social network analysis, wavelet transform, and the pattern recognition approach to investigate the dynamics and eventually predict the attack behavior of terrorist group. Our ideas rely on social network analysis to model the terrorist group and extract relevant features for group behaviors. Next, based on wavelet transform, the group networks (features) are predicted and mutually checked from two aspects. Finally, based on the predicted network, the behavior of the group is recognized based on the correlation between the network and behavior. The Al-Qaeda data are investigated with the proposed framework to show the strength of our approaches. The results show that the proposed framework is highly accurate and is of practical value in predicting the behavior of terrorist groups.
1. Introduction
A terrorist group is fundamentally a social system. The group is formed as a unified whole by fanatics determined to inflict civilian and economic damage on specific targets in pursuit of their extremist goals [1]. Currently, as terrorist groups are becoming more international, allied, and networked, the social systems are transforming into complex sociotechnical systems. For a continuous active terrorist group, the behavior is influenced by both the interactional environment and the organizational mechanism and thus is a continuously evolving phenomenon [2]. The structure and efficiency of the group will fluctuate and finally reach a relatively stable state because of its covert nature and self-defense mechanism [3]. Even though it is as a complex system, the terrorist group is also dynamic. The dynamics result from multiple change processes, such as natural evolutionary processes including learning, birth, and aging, as well as intervention processes, such as altering the set of individuals who lead a group [4]. The relationships and interactions between terrorists at the microlevel leads to continuous development of the group behavior at the macrolevel [5]. The process in which terrorists look for and cooperate with other terrorists, which has a multitude of purposes, such as propaganda, training, defending, or sanctuary, also drives the system to change dynamically. Thus, studies on terrorist group behavior are becoming complex dynamic system problems, which require new methods for understanding the system behavior and dynamics.
At present, there is an intense interest in predicting what a terrorist group behavior will be in the future. Predicting terrorist group behavior is of great importance, especially for attack behavior. Once such behavior is predicted, we are able to monitor the dynamics of the group and detect early warning signs of the behavior change [6]. We can also have the intervention strategy and counterterrorism policy implemented before the attack is executed. Several studies on behavior prediction have been effectively employed by various researchers and research groups. Studies have suggested that although the predictors of terrorist behavior are unclear, there are still factors that can provide early warning signals of future terrorist threats [7]. These studies focus on developing a model of the behavior of the terrorist group and using that to predict what the group might do in the future. Specifically, Enders and Sandler [8] use classical time-series analysis techniques to propose a threshold autoregressive model and study both the short-run as well as the long-run swells in world terrorist activity. Raghavan et al. [9] quantitatively classify the group dynamics into Active and Inactive and use the Hidden Markov Model (HMM) to track and predict the state of terrorist groups. Subrahmanian et al. [10] introduce Temporal Probabilistic (TP) rules and machine leaning techniques to predict terrorist behaviors and major terror attacks by a Pakistani-backed terrorist group, Lashkar-e-Taiba. Furthermore, these researchers develop a Stochastic Temporal Analysis of Terrorist Events (STATE) system based on the IP rule-mining engine for predicting terrorist attacks by Indian Mujahideen [11]. Najgebauer et al. [12] propose an early warning system of semantic network analysis that is based on an ontology data model to predict terrorist action preparation activities. Xue et al. [13] propose a prediction algorithm based on context subspace (PBCS) of terrorist attacks. The proposed algorithm first extracts the context subspace according to the association between the context attributes and the behavior attributes; then, it predicts the terrorist behavior based on the extracted context subspace. Tutun et al. [14] propose an ESALLOR model to select key features for similarity function and use the similarity function to understand how terrorist groups will attack in the future.
Several of the studies focus on modeling the intraorganizational relationships into networks and applying social network analysis (SNA) to predict the group behavior. Discovering suspicious and illicit behavior in social networks has become a significant problem in SNA [15]. These studies focus on the correlation between external behavior and the internal network [16]. Correlation-based SNA studies are now being extended to more comprehensive frameworks with other techniques, offering ever-increasing power to identify characteristic patterns of terrorist group in organizational behaviors [17]. Social networks that knit terrorists and constitute terrorist groups are a resource for analysis system emergence produced by the individual interactions. There is growing evidence that strengthening of the terrorists’ connection may lead to some of the attack behaviors, and, thus, it is much easier to predict the group behavior by predicting the networks [18, 19]. Specifically, Carley [4] uses dynamic network analysis (DNA) to predict the dynamic relations among various entities such as actors, events, and resources and the impact of such dynamics on individual and group behavior. Mcdaniel and Schaefer [20] design an approach based on SNA and activity analysis to detect and predict anomalous terrorist activities. Clauset and Gleditsch [21] use group-level dynamic analysis and a simulation model to make quantitative predictions of the frequency and severity of the group attacks by taking the correlation with organization size. Desmarais and Cranmer [22] integrate a deterministic, similarity-based, and link prediction framework into a probabilistic modeling approach and show its ability to accurately forecast during a terrorist campaign and the onset of terrorist hostilities between a source and a target. McCulloh and Carley [6] apply multiagents to simulate the group dynamics in the social network and predict the potential terrorist events.
Related work has yielded important insights into how the behavior of a terrorist group is predicted with different models. First, it has been established that SNA is a powerful tool capable of providing a predictive and explanatory value to the field of terrorism studies [23]. Second, time-series analysis can be used to predict the future behavior, such as autoregression and the Markov model. Some possible terrorist activities in the future could be tracked by analyzing the characteristics of previous events [24]. Third, the machine leaning and pattern recognition approach can be used to predict the future behavior once the useful features are extracted [10, 11]. However, previous studies have also left blind spots. First, these studies have relatively low accuracy and efficiency in predicting the future behavior of terrorist group. In terms of common properties of the system, terrorist behavior falls somewhere between the purely chaotic and the fully deterministic realms, which is represented as a nonlinear dynamical system, characterized by a low-order chaotic attractor [25]. As terrorist behavior is in a nonlinear and nonstationary dynamic process, traditional analysis approaches, such as traditional SNA, link analysis, and autoregressive analysis, are limited in their ability to handle the dynamic data that are needed to characterize terrorist networks [4], while several methods, such as agent based simulation, have deficiencies in setting parameter values, which produce high false positives or incorrect predictions [24]. The reason lies in the complex mechanism of terrorism: terrorism has multiple political, cultural, economic, and social facets, as well as individual psychological and ideological dimensions [26]. On the other hand, previous studies are not designed particularly for terrorist groups. Several of the specific features of the terrorist activities, such as periodicity, which terrorist group behavior has, are not taken into consideration. Consequently, research that goes beyond traditional methods and considers the dynamic characteristics of terrorist behavior needs to be improved.
Inspired by previous studies, we integrate SNA, wavelet transform, and pattern recognition approaches into a comprehensive framework. We approach the problem of predicting terrorist behavior from a network analytic perspective with the supposition that the internal structure of the group network may be a good predictor of its external behavior. We use the wavelet transform framework as the time-series predictor for group’s dynamic network from two aspects: qualitative inference and quantitative prediction. After the group network is predicted, a supervised classification and pattern recognition technique, Support Vector Machines (SVM), is used to recognize the attack behavior based on the correlation between the network and behavior.
The remainder of the paper is organized as follows. In Section 2, we provide a brief description of the problem characteristics. In Section 3, the research framework is introduced. In Section 4, the wavelet transform-based prediction method is demonstrated in detail. In Section 5, we introduce the experimental design. In Section 6, the Al-Qaeda group data are described, and the results are presented with the implications discussed. Section 7 presents the paper’s conclusions.
2. Problem Characteristics
Different from general social groups, operation-oriented terrorist groups have some specific characteristics. Only with thorough understanding of the characteristics can we effectively predict its behavior. In this section, we analyze the dynamic characteristics of the terrorist group from two aspects: the periodic features of the group and the correlation between the behavior and the network.
2.1. Periodic Features
A recent discovery in terrorism studies has highlighted that terror activities have some regularities, such as periodicity [27] and tendency [28]. Moreover, terrorist behavior has multiple time-scale characteristics in the nonlinear and nonstationary time series [29]. These regularities are results of both internal interactions and the external environment of the social system and are also a critical property of terrorist behavior.
Intuitively, terrorists’ communication patterns may change in cycles over time [6]. Terrorists tend to interact and communicate frequently with each other during the attack or at a certain time before the attack during the planning phase [30]. Terrorists and the government are in a larger complex social system. They have interactive rational choice, where adversaries (terrorists and governments) must take actions to anticipate the responses of each other [31]. To prepare for an attack, there are several steps that terrorist groups take carefully towards the ultimate operation, such as recruiting, training, and looking for financial support. During these processes, terrorists are facing intervention from the government. However, the intervention repeats and oscillates cyclically as the focus of the government goes up and down. As terrorists will trade off risk and return when choosing their targets [31], thus, the strategies of terrorist group shift dynamically to avoid being eliminated [27]. On the other hand, terrorist groups are deeply covert, and their scale usually oscillates gradually and periodically on large time-scales (years or decades). As both the scale of the terrorist group and the group behavior are periodic features, it becomes easier to predict the future trends of the network once the periodic features are obtained.
Although terror activities often appear irrational, studies demonstrate that rational choice explanations are nevertheless useful for understanding the phenomenon of periodicity [32]. Crenshaw [33] characterizes terrorist violence as “an expression of political strategy,” and Sandler and Arce [34] suggest that the predictable responses of terrorist groups to changes in sanctions and rewards aimed at constraining their behavior are strong evidence for their rationality. However, the regularity and rationality are overlooked by researchers when predicting their future behavior, and the corresponding methods remain rare in terrorism studies.
2.2. Correlation between the Network and Behavior
The internal structure and interactions among terrorists within the group drive the behavior to change dynamically. The social network can model the internal interactive pattern of elements within the social system. Previous studies have proven that there exists a correlation between group behavior and the network [6, 35]. From the system dynamics perspective, issues within the system can lead to the dynamics of the behavior. From the dynamic network analysis perspective, adding and dropping of nodes and/or relations of the network will have positive and negative influences on the group and the overarching goals [36]. In other words, the group behavior is driven by the interactive evolution of terrorists in the network and the social network model as the group structure reacts to the interactive patterns in the system. In this paper, we are not concerned with all of the behaviors, but rather only behaviors that are highly related to terrorist events, which are regarded as attack behavior. Attack behavior is defined as one kind of terrorist behavior that occurs when the group executes a terrorist attack. For example, the terrorist attack in the United States on September 11, 2001, is regarded as an attack behavior of the Al-Qaeda terrorist group. Otherwise, the behavior is regarded as normal behavior. A correlation between the network and behavior exists; therefore, the structures of corresponding networks are different. Figure 1 gives the description of the correlation. From the figure, a group’s network with abnormal connections may lead to an attack behavior of the group, providing evidence for the “correlation.” From the perspective of system dynamics, the behavior of the system is predicted by referencing the interactive patterns of the elements within the system. After the internal structure is predicted, we can then translate them into external behavior with the pattern recognition mechanism. As we use pattern recognition to identify the attack behavior, then a group has an attack behavior if its feature set matches the abnormal pattern. Consequently, the prediction problem is transformed into a pattern classification problem with two classes of results.
3. Research Framework
Based on the characteristics of the problem, in this section, we design a behavior prediction framework, as depicted in Figure 2. The framework tightly integrates group network and group behavior with respect to both the network prediction and behavior recognition dimensions. We are not predicting the group behavior directly, but rather predicting the group behavior through the group network. By extracting behavior-related features (a measure set) from the group network and efficiently predicting the group network, we can recognize the future behavior of the group.
There are two logic flows in the framework: the behavior recognition flow and the network predicting flow. The behavior recognition flow is designed to mine the behavior pattern of the group, which is based on the correlation between the group network (GN) and group behavior (GB), as mentioned in Section 2.2. We are convinced of the importance of measuring the structural properties of evolving networks to characterize how the behavior patterns of the investigated group change over time. Therefore, the behavior prediction problem is transformed into a behavior pattern recognition problem on the basis of effective network predictions. As shown in Figure 2, we propose two classes of behavior patterns of terrorist group: Attack behavior and Normal behavior. Thus, the behavior recognition problem can be regarded as a pattern classification problem. In this paper, the extracted features of the group network are represented by a measure set (MS). Each measure presents a specific topological feature of the network and highly influences the dynamics of processes executed on the network [12]. Network measures are therefore essential in our investigation. As is shown in Figure 2, the measure set is also classified into two classes: Abnormal and Normal. Here, as there is a consistent one-to-one match between each class of the measure set and each pattern of behavior, then we can detect whether a group has an Attack behavior by matching its measure set to the patterns.
We intend to classify the group behavior through the network measures. Our objective is to develop a detection model:
Suppose there are a total of timestamps included in the time-series dataset of the terrorist group , where denotes the extracted features associated with the th network. For timestamp , the measure set can be represented as , where , denotes the th measure in the set and denotes the total number of extracted measures. denotes the behavior pattern of the terrorist group. The group behavior pattern is also known as the classification label, such that if and only if the group is determined as having an Attack behavior. In the simplest example of behavior pattern recognition, the group’s behavior is recognized with the states reflecting a normal pattern of behavior () and an abnormal pattern of behavior (). In this paper, we use the supervised classification and pattern recognition method SVM as due to its superior detection accuracy, computing efficiency, and modeling flexibility [37]. is used to assign classification labels (0/1) for the behavior pattern of the group, and equivalently,
In summary, the behavior pattern recognition problem can be expressed as follows.
Input. Time sequence of extracted measure set MS of the terrorist group network.
Output. Set of group behaviors, denoted by behavior pattern set GB.
Our framework for predicting behavior in group networks via some network measures focuses on the future behaviors of the terrorist group. We are not recognizing the current nor historical behavior, but rather efficiently identifying how the group will behave in the future. To this end, we will introduce the network predicting flow in the next section. As mentioned in Section 2.1, there is some regularities in the terrorist group dynamic process. We believe that the group networks exhibit periodicity over time, and the periodic variations can be used to predict future trends of the group network. In addition, a future measure set of the network can be predicted from the current and historical data. In this paper, we design a wavelet transform-based framework to predict the networks, which is discussed in detail in the following section.
4. Wavelet Transform-Based Prediction Method
The key component of the framework proposed in Section 3 is to predict the group network efficiently. As a complex social system, group network prediction is quite challenging, especially for terrorist groups. Usually, the terrorist data are based on open source information. The limitations of the terrorist data make it a difficult prediction problem because we cannot be sure that all the communication and cooperation networks are included. Therefore, the best approach is not simply to predict the network from the quantitative analysis, but to combine both the qualitative and quantitative predictions. Here, we proposed an integrated method with wavelet transform for the prediction. Wavelet transform has been applied in the signal processing studies, as well as in other time-series analyses [29, 38–40]. Here, we are the first to explore the application of wavelet transform theory to better understand the structural changes in terrorist group networks. The proposed method with wavelet transform theory combines qualitative and quantitative predictions to characterize the terrorist group network in terms of its structural and functional features.
Firstly, we apply wavelet transform to obtain the periodic features of the network. Based on the wavelet transform, the nonlinear and nonstationary process of terrorist network dynamics can be decomposed into quasi-stationary by multiscale characteristics for time-series prediction. By the presence of multiscale decomposition, the advantage is automatically localized time-frequency by wavelet transform [29]. After determining both the dominant modes of variability and how those modes vary in time, we have the qualitative inference of the network trend in the future. Then, a combination of wavelet transform and Artificial Neural Network (ANN), that is, Wavelet Neural Network (WNN), is used to predict the network from the quantitative aspect. The concept of time-series predicting with a wavelet is simply predicting by using the data which are preprocessed through the wavelet transform. Finally, the predictive future networks are combined and mutually checked by both qualitative inference and quantitative prediction.
4.1. Periodic Analysis-Based Qualitative Inference
The qualitative inference can be implemented based on periodicity analysis. The application of wavelet theory in particular may provide insight into the periodic behavior of network dynamics. Given the multiple time-scale characteristics of each measure, large-scale periods may be used to characterize the future trends, while small-scale periods provide detailed characterizations of the measure change within the large-scale periods [33].
The wavelet transform of a time series is its convolution; the local base functions or wavelets can be stretched and translated with a flexible resolution in both frequency and time [38]. Choosing a proper mother wavelet is the key to wavelet transform analysis. This depends on the nature of the signal and on the type of information to be extracted from the signal. Here, the Morlet wavelet, a complex nonorthogonal continuous wavelet, is applied to analyze inherent periodicity and to qualitatively appraise the trends of MS of the network. As a complex wavelet transform, the Morlet wavelet provides a good balance between time and frequency localization and can provide both amplitude and phase simultaneously.
The Morlet function, representing a wave modulated by a Gaussian envelope, is defined as [40]where is the unit of an imaginary number and ; is the constant number. The Constant Wavelet Transformation (CWT) of time series is defined as [40, 41]where is the wavelet transform coefficient; is a signal or square integrable function; is the mother wavelet and denotes the complex conjugate function of ; is scale factor, as the length of the wavelet period, and is the time factor, as the translation time. The variation characteristics and the range of the periodic changes of the select measures at different time-scales can be analyzed based on the isograms about .
In this paper, we also introduce the wavelet variance and wavelet power spectrum to further identify the dominant and local periods. The wavelet variance is defined as the integral of any wavelet coefficient of different time-scales in the time domain. The equation of wavelet variance is defined as
The dominate time-scales of a certain time series, namely, the significant periods dominating network evolution, will be verified through tests of wavelet variance. The wavelet variance change with scale factor is represented by a wavelet variance graph. Each peak in the graph corresponds to a significant period [38]. The diagram of wavelet variance and wavelet power spectrum along with the isograms of the wavelet transform coefficient could be used to identify the periodic features efficiently. With the periodic features of the measures detected, their future trends can be qualitatively inferred.
4.2. WNN-Based Quantitative Prediction
In the quantitative prediction aspect, we use WNN for time-series prediction. WNNs are recently developed neural network models and have been successfully applied to forecasting, modeling, and function approximations [42]. WNN models combine the strengths of wavelet transform and ANNs processing to achieve strong nonlinear approximations [39]. WNNs are generally divided into the relax-type and the close-type by the different wavelet-basis functions. In this paper, we adopt the close-type WNN with a three-layer structure, as is shown in Figure 3.
The main difference between WNNs and ANNs lies in the activation functions of the hidden layer—as ANNs are with tangent sigmoids, while WNNs are with discrete wavelet functions. We select WNNs rather than ANNs because the ANNs have some potential disadvantages when applied to complex nonlinear optimization problems, including slowness in convergence and an inability to escape local optima. Furthermore, because WNNs combine the function of time-frequency localization by wavelet transform and self-studying by ANNs, the network capacity is approximate and robust [39]. In this paper, the WNN was designed with one hidden layer (Figure 3). We select Morlet as the mother wavelet function in the node activation function, as in (3).
We design a time-series prediction approach based on the hypothesis that the current value of the network measure can be captured completely by certain attributes of the historical values [9]. Let , and , that is, the values of extracted measure at past timestamps. is our prediction function and is represented by WNN with its hidden layer of the Morlet wavelet. For the WNN, the input variable is and the output variable is . Finally, the predicted results are mutually checked from the two aspects of qualitative inference and quantitative prediction to obtain more reasonable results.
5. Experimental Design
5.1. Feature Extraction
In both the two flows, a key phase is to extract features from the group networks. As we use network measures (MS) as the features, this implies the very important question of how to choose the most appropriate measures for the given network, which are directly related to the behavior pattern and affect the prediction performance [12]. The extracted measures should not only help us understand the characteristics of the networks but also help us predict the group behavior. As the terrorist network data are usually of low quality, we should extract multidimensional measures (a measure set) as the input variables to adequately represent the whole network. As discussed in Section 4.2, WNNs can achieve a high accuracy with the ability to address multiple inputs and overcome the local convergence problem for nonlinear optimization problems. However, in the pattern recognition flow, too many features involved would create the problem of the curse of dimensionality [43]. The problem increases as the number of extracted features increases exponentially. To alleviate this problem, we can apply a feature selection phase that selects only discriminating and relevant features for each class [44].
It is notably challenging to determine proper measures to characterize the network. As the field is still in its formative stages, we do not yet know which specific measures best differentiate behavior patterns or change the most in the dynamic process. In previous research [6, 12, 35], measures are extracted subjectively by manual selection and may not be significant characteristics of the network.
In this paper, we initially consider using the following criteria to extract measures from the time sequence. The first criterion is Spearman’s Rank Correlation coefficient. With this criterion, measures that have top correlation coefficients with the group behavior are extracted. The second criterion is Information Entropy based selection of discriminating measures [45]. The Information Entropy of extracted measure is expressed as follows:where is the probability of a measure’s visit into each region , divided uniformly from the range of the minimum and maximum values of the measure. The value gives the total information that could be obtained from . The larger the entropy is, the more uncertainty and complexity the measure has. With (6), the measures with larger Information Entropy values are extracted. With the above two criteria for extracting measures, we are then able to perform the network prediction as well as the behavior recognition.
5.2. Measure Prediction
For the measure prediction, we apply the method proposed in Section 4 to obtain the prediction results for the MS. To demonstrate the superiority of our method, we compare the performance with several models, including ARIMA, BP, GABP, ANFIS, SVR, and RBF. To evaluate the prediction ability and efficiency of the different methods, we apply MAE and RMSE to compare the predicted and actual values, defined as where and denote the predicted and actual values of the extracted measure at timestamp , denotes the number of timestamps for the prediction, and . For each MAE and RMSE, a smaller value indicates better prediction accuracy.
5.3. Behavior Recognition and Risk Assessment
The predicted results of the extracted measures are then imported into functions (1) and (2) for future behavior recognition. To reduce the randomness of the analysis, we run the behavior pattern recognition with SVM many times and use the ratio of the times of Attack behavior () by the total times to assess the future attack risk () at timestamp , defined as
6. Results and Discussion
6.1. Data and Network Creation
We test the proposed framework on the data from the JJATT database [46]. JJATT is a transnational terrorism database on a selection of radical Islamists, their associates, and case studies on their collective behavior. We use the data from the Al-Qaeda attack series to analyze the terrorist group behaviors. The Al-Qaeda data are collected from open source. However, in theory, the data include all of the information and are as complete as reliable, open source data allow. These data are chosen primarily because Al-Qaeda is a typical terrorist group that shares representative characteristics of militant Islamist organizations. The other reason is that Al-Qaeda data include attack data to describe the terrorist events that terrorists participated in, which is useful for testing how relevant social relationships are to Attack behaviors.
Al-Qaeda data in JJATT describe the members who have directly contributed to a “core” network and relationships that core members shared. Hence, the data are useful for developing networks describing group structure and understanding the group’s behavior. Al-Qaeda data also have individual interaction information according to the time axis, which makes it possible to build the dynamic networks of the group. The data are collected by year, but in this study, we further refine the data into quarters, and the networks are constructed quarterly after preprocessing. The time domain is 1989~2003; thus the time domain is divided into 60 timestamps (–). For each timestamp, a group network is created. The network’s nodes are defined as terrorists, and edges are defined as relationships among the terrorists. Here, the edges are labeled by binary values (0/1), such that the value is equal to 1 if the two nodes are connected and is equal to 0 otherwise. In other words, the Al-Qaeda networks are undirected simple networks. Consequently, we build a time sequence of 60 networks, which are labeled with the IDs of .
6.2. Results Summary
6.2.1. Feature Extraction
The Attack behaviors of Al-Qaeda refer to the verified terrorist events. For example, the event “WTC bombing in New York City, USA, on February 26, 1993” [46] is an Attack behavior of Al-Qaeda in ; therefore, . Under this rule, the 60 timestamps (–) are assigned labels of 0/1, in which 17 GNs and GBs are labeled “1” and the rest are labeled “0.” Using the measure extraction criteria from Section 5.1, we extract four significant measures of the Al-Qaeda network: Node count, Component size, Clustering coefficient, and Clique count. Table 1 shows the performance of the four extracted measures.
Figure 4 plots the trends of the extracted features. This figure intuitively illustrates the sparsely connected networks with Normal behaviors, qualitatively, compared to those with Attack behaviors. Figure 5 plots the distributions of the four measures of Attack and Normal behaviors.
(a) Node count
(b) Component size
(c) Clustering coefficient
(d) Clique count
From Figure 5, we can find that the differences are obvious between relevant features of networks with Normal and Attack behaviors. To verify that the given behaviors are caused by the given patterns of the extracted measures, we further apply Student’s -test with 95% confidence ( value < 0.05). Table 2 shows the values of the -tests performed to compare the measures between the groups with Normal and Attack behaviors.
Unexpectedly, the four measures are significantly higher in networks with Attack behaviors, relative to networks with Normal behaviors ( value < 0.05). From Figures 4 and 5 and Table 2, we can infer that when Attack behaviors happen, the extracted relevant features of Al-Qaeda networks will have some visible differences. We find that the measured differences between the two classes are statistically significant. This finding provides evidence regarding the rationality of the extracted measures.
6.2.2. Measure Prediction
(1) Qualitative Inference. As mentioned in Section 4.1, the qualitative inference of the extracted measures is implemented based on wavelet transform. First, we need to evaluate the presence and evolution of various periodicities from three aspects: wavelet transform coefficients (Figures 6(a)–6(a)), wavelet power spectrum (Figures 6(b)–6(b)), and wavelet variance (Figures 6(c)–6(c)).
(a) Wavelet transform coefficient
(b) Wavelet power spectrum
(c) Wavelet variance
We take the Node count as an example. First, from the high and low pattern of measures at different time-scales in the time-frequency structure of the wavelet coefficient in Figure 6(a), it is clear that the Node count has significant periodic features. The contours in Figure 6(a) provide information about the levels of the wavelet transform coefficient, with each one corresponding to a variation for different time periods [38]. We find that the upper contours are sparse, while the lower contours are dense, which means at the large time-scales, the range of the corresponding period is larger than that at the smaller ones. Periodic changes in Figure 6(a) indicate that there are multiple time-scale characteristics of the time series of the Node count. At the time-scale approximately 22q (quarter), there are four and a half “low-high” cycles from to . This period lasts for the entire time domain. At approximately 12q, there are three “high-low” cycles only in the time domain – and –. At approximately 8q, several “high-low” cycles occur only in the time domain –. Hence, three are three periodic variations of the Node count, where one of them is in a global period and the other two are in local periods.
Second, Figure 6(b) of the wavelet power spectrum illustrates the oscillation power of the time series at different time-scales. From this figure, we find that at approximately 22q, the power of the time series is the strongest, and the periodic feature is the most significant. The power at approximately 12q comes in second place, and its period is median significant, followed by 8q.
Third, the main periods could be determined by wavelet variance using the corresponding peak values in Figure 6(c). From the figure, we can conclude that the period at the 22q time-scale is the first significant period (or large-scale period) as it corresponds to the highest peak, denoted as ; the period at the 8q time-scale is the second significant period, denoted as ; and the period at the 8q time-scale is the third significant period, denoted as . Both the and periods are small-scale periods.
Finally, the wavelet transform coefficient curves at the three time-scales are shown in Figure 7(a). From Figure 7(a), we find that the average time of each period of , , and is 8, 6, and 3 quarters, respectively. With the same mechanism, the main periods and the average time period of the remaining three measures can be obtained, as shown in Figures 6 and 7 and Table 3.
(a) Node count
(b) Component size
(c) Clustering coefficient
(d) Clique count
With the periodic feature captured, the future trends of the extracted measures after can subsequently be inferred qualitatively. The large-scale period in Table 3 and Figure 7 is used to characterize the future trends. In Figure 7, the positive or negative wavelet coefficients reveal the high and low values of measures in the time domain. Here, we also take Node count as an example. The wavelet coefficient of the Node count in is located in a low period with an upward tendency, so the trend in subsequent timestamps will stay relatively low, before reverting to a high period in . In contrast, For the period, as the corresponding wavelet coefficients in are located in a high period with an upward tendency before , they will then turn toward a downward tendency. The period is not considered as it only lasted for –. Hence, the Node count trend in the subsequent four timestamps (–) will be relatively low with weak oscillation. The trends of the remaining three measures can also be inferred similarly. The results are shown in Table 3.
(2) Quantitative Prediction. WNN is then used to predict the future values of the four measures from the quantitative perspective. First, the best architecture of WNN should be observed. For the input layer, various numbers of nodes are checked in the input layer to identify the best one. As is shown in Figure 8, the number of nodes in the input layer, which leads to the lowest RMSE value, is chosen as the optimal one. As seen from this figure, when the number of nodes in the input layer of the Node count is 4, WNN yields the best results. In other words, the number of input variables in WNN for the Node count prediction is ; that is, the values of the past 4 timestamps are used in the time-series prediction. Moreover, for the hidden layer, the number of the nodes should also be appropriate—if the number is too small, WNN may not reflect the complex function relationship between input data and output value; on the contrary, a large number may create such a complex network that might lead to an output error caused by overfitting of the training sample set [39]. After several trials, the suitable nodes in the hidden layer are set as 6. Thus, the architecture of WNN for the Node count is “4-6-1.” Using the same method, the architectures of Component size, Clustering coefficient, and Clique count are also determined.
Second, to verify the superiority of our method, we apply the baseline methods to the same data to compare the results. We have the data divided into training and test samples. The data of the four measures include 60 timestamps (–). From these, 40 data timestamps are used for training for all the methods, and the remaining 20 data timestamps are used as the test dataset. After running 100 times with WNN and baseline methods, the average values of the prediction results are obtained. The MAE and RMSE of the models are presented in Table 4. We have several interesting observations which confirm our research motivation. First, the MAEs of WNN are lower than most of those of the baseline methods. Second, some baseline methods perform somehow better in RMSE. However, through a comprehensive comparison with the four measures, we find that the WNN still performs the best in RMSE. Finally, given the excellent performance of WNN in Table 4, we are convinced that the ANN with wavelet transform (WNN) has the best fitting capacity and the strongest capacity of time-series prediction in terrorist networks with nonlinear and multiple time-scale characteristics.
As the WNN has the best prediction performance, we then apply the WNN to quantitatively predict the measures in the subsequent four timestamps. We run the trained WNN 100 times, and the box plots in Figure 9 show the prediction results of the four measures with WNN.
(a) Node count
(b) Component size
(c) Clustering coefficient
(d) Clique count
Finally, we have the predictive future networks mutually checked by both qualitative inference and quantitative prediction. From Figure 9, we observe that the prediction values of the four measures by WNN are consistent with the trend we inferred qualitatively in Table 3. The actual values of Node count, Component size, Clustering coefficient, and Clique count in are 209, 16.8, 0.41, and 97, respectively. The values of Node count, Component size, and Clique count in the following four timestamps are also located in a relatively low position and have weak oscillations. Meanwhile, the values of the Clustering coefficients in the following two timestamps are located in a relatively low position and then turn to a high position in the next two timestamps. Thus, we have mutually checked the predicted trends from the two aspects of qualitative inference (Table 3) and quantitative prediction (Figure 9).
6.3. Behavior Pattern Recognition
With the measures predicted, the next step is to recognize group behavior patterns and estimate the risk of attack in the future. The combined values of the predicted values of the extracted four measures are imported into SVM. Apply function (1); the future behavior of Al-Qaeda group is recognized. After running 100 times, the risk of terrorist attack in the subsequent timestamps is estimated with function (8), as is shown in Figure 10. Risk levels are categorized based on high (), medium (), and general () thresholds. Then and are regarded as having high risk and larger probability of Attack behavior of Al-Qaeda than the rest of the timestamps; is regarded as having the median risk of terrorist attack, while is regarded as having a general risk of terrorist attack.
6.4. Discussion
The empirical study of the Al-Qaeda group shows that the proposed wavelet transform-based pattern recognition framework is of high accuracy and practical value in predicting the Attack behavior of terrorist groups.
The results show that Al-Qaeda networks with Attack behaviors have structure patterns that are different from those with Normal behaviors (Figures 4 and 5 and Table 2). We can infer that when Attack behaviors happen, the extracted relevant features of Al-Qaeda networks will have some visible differences. For instance, when the group carries out a terrorist attack, the scale of interaction between members will increase (Figure 4). As a result, the total number of nodes will grow and the Component size and Clique count will also increase (Figure 5 and Table 2). We can also infer that when Attack behaviors happen, the local information diffuses faster, and the terrorists are likely sharing information and receiving intelligence from the communicators with a more decentralized infrastructure. In summary, the frequency and proportion of measures increase when Attack behavior happens. These observations verify the basics of this study; that is, a correlation exists between the social networks and events of Al-Qaeda. The four measures and their differences are potentially useful for recognizing the behavior patterns of Al-Qaeda.
The results also show that measures of the Al-Qaeda network share similar features with some natural phenomena in periodicity and that the wavelet transform-based method can recognize the periodicity effectively. Wavelet transform can identify the main periods of the time series from different time-scales (Figures 6 and 7). The nonlinear and nonstationary dynamic processes of terrorist group network measures are decomposed into quasi-stationary by multiscale characteristics by wavelet transform. Based on the periodic analysis, future trends (upward or downward trend) can be inferred from the qualitative aspect. On the other hand, WNN can quantitatively predict the future trends based on the wavelet transform. The results show that WNN can address the time-series prediction problem with a strong nonlinear approximation ability after being well trained with historical data (Table 4 and Figure 9). The results suggest that wavelet transform with periodic and prediction components is a meaningful approach and tool in the prediction for terrorist networks. The power of this kind of analysis lies in the fact that the quantitative analysis along with qualitative inference can provide more faithful results than empirical or qualitative analysis. Moreover, with predicted measures and SVM, the behavior pattern recognition can provide a quantitative estimation of future risk (Figure 10). In summary, with the proposed framework, we can monitor the dynamics and further predict the Attack behavior of terrorist groups with high accuracy and efficiency.
By glancing at the framework in Figure 2, one might initially guess that the computational complexity would be relatively high since it involves many techniques, such as SNA, wavelet transform methods, and SVM. However, the feature extraction, measure prediction, and behavior recognition phases are implemented sequentially one after the other. To be clear, the time complexities for each technique are summarized in Table 5 [47, 48]. Fortunately, the networks of terrorist groups have not reached the level of complex networks. Assume there are edges and nodes. The range of is generally between 1 and 1000, with an average size of 840 [49]. Moreover, the core networks are even smaller [50, 51], with a range of nodes between 43 and 228 in our study. The Al-Qaeda networks are also sparse networks with and . Thus, the total complexity for predicting terrorist group behavior by our wavelet transform-based pattern recognition is within acceptable range.
The Al-Qaeda study suggests that our proposed framework is able to perform well even when the information is incomplete. In general, one challenge in terrorism studies is that it lacks terrorist data in depth due to confidentiality, and some data just do not exist. In our study, the Al-Qaeda data are collected from open source, and inevitably, they are incomplete representations of the relationships in the real-world terrorist group. The limitations of the terrorist data make it difficult to predict the behaviors because we cannot be sure that we included all communication and cooperation networks. However, even using this dataset, we are able to systematically predict the networks and behaviors, which highlights the value of the proposed models.
7. Conclusions
The steep rise in global terror necessitates deeper scientific understanding of the terrorist group and its behavior. Nowadays, preventing terrorist attacks before they happen is extremely important in counterterrorism. Governments need to understand how terrorist groups behave with terrorist attack in the future. In this paper, we proposed and applied a wavelet transform-based pattern recognition framework to investigate the dynamics and eventually predict the Attack behavior of terrorist group.
Specifically, the terrorist group is first modeled as social networks, and the relevant measures are extracted with the proposed criteria. Second, a wavelet transform-based prediction method is established to predict the extracted measures. Next, the Attack behavior of the group is recognized by behavior pattern recognition with SVM. Empirical research of Al-Qaeda data demonstrates that the proposed framework is a meaningful approach and tool in the prediction of terrorist group behavior.
In summary, we make the following contributions in this paper. We analyze the dynamic characteristics of the terrorist group from two aspects: the periodicity of a group network and the correlation between the behavior and the network. We design an effective wavelet transform-based pattern recognition framework that combines SNA, wavelet transform methods, and the pattern recognition approach to predict the Attack behavior of the terrorist group. We propose a novel network prediction method with wavelet transform from two aspects: period analysis-based qualitative inference and WNN-based quantitative prediction. To our knowledge, this may be the first study to apply the theory of wavelet transform as associated with terrorist behaviors.
In light of the results and discussion presented up to now, the proposed framework enables us to derive several conclusions. The terrorist networks have shown some periodic features during the dynamic process, and the features can be used to predict the future behaviors based on the correlation between the network and behavior. The prediction framework we proposed performs well with the periodicity and correlation considered. Wavelet transform-based prediction methods can effectively predict the networks of terrorist group from both the qualitative and quantitative aspects.
In conclusion, this study helps to elucidate the dynamics of terrorist groups using a wavelet transform-based pattern recognition framework. Such a framework tightly integrates the group network and behavior with respect to both the network prediction and behavior recognition dimensions. The approach used in this study provides analysts with greater analytical power and facilitates assessing dynamic, complex, and nonlinear sociotechnical systems. This paper also provides an effective method for predicting collective behavior in other extreme incidents, emergency, and security study domains. Overall, predicting terrorism is so challenging that the added mathematical methods are likely to enhance our understanding of the dynamic characteristics of its behaviors.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This research is supported by the National Natural Science Foundation of China, nos. 71473263 and 71704184.