A Global Measure for Estimating the Degree of Organization of Terrorist Networks

Khaled Dawoud� Reda Alhajj�,� Jon Rokne�

�Department of Computer Science University of Calgary

Calgary, Alberta, Canada

�Department of Computer Science Global University Beirut, Lebanon

Abstract The motivation for the study described in this paper is realizing the fact that organizational structure of a group is a key indicator in determining its strengths and weaknesses. A general knowledge of the prevalent models of terrorist organizations leads to a better understanding of their capabilities. Knowledge of the different labels and systems of classification that have been applied to groups and individuals aid us in discarding useless or irrelevant terms, and in understanding the purposes and usefulness of different terminologies. Previous studies in network analysis have mostly dealt with legal networks with transparent structures. Terrorist networks share some features with conventional (real world) networks, but they are harder to identify because they mostly hide their illicit activities. In this paper we describe a novel approach for extracting structural patterns of terrorist networks with the help of social network analysis measures and techniques. We propose a global measure for estimating the degree of organization of social networks; the measure is global in terms of being applied to the whole network as an entity and being extracted from the major well-known SNA measures. The importance of such research comes from the fact that individuals in organized intellectual networks and especially terrorist networks tend to hide their individual rules and thus there is a need to deal with such networks as a whole, discovering the degree of organization and thus its strengths and weaknesses.

1. Introduction Different systems in different fields can be represented as networks, consisting of sets of nodes or vertices linked together in pairs by edges with nontrivial topological structures [1]. In other words, the social network model is powerful enough to be successfully applied for analyzing any problem where it is possible to identify actors and links. Building a model of a network structure helps in understanding the network and discovering prominent nodes and edges. Nodes may be relevant individually or in groups forming communities. A community is a set of nodes characterized by having more connections within the group and few connections outside the group.

Recently organized terrorism expanded from the Middle and Far East to cover the developed western countries, e.g., East Europe and USA. Driven by this trend, research on the

analysis of terrorist networks has attracted special attention in the last decade, especially after the events of September 11, 2001. This raised high interest in scientific methodologies that could help in systematically fighting terrorism, e.g., [5, 6, 12, 13, 14, 15]. Researchers mostly try to build a social network model of a terrorist organization in a way to track its activities. The main target is to find out how members of the organization split into groups to plan for and conduct certain terrorist activities. The ultimate target of the governments, industry and the academia is the development of automated early warning systems with high prediction accuracy [13, 14]. The area is challenging and multidisciplinary, demanding expertise from sociology, psychology, ecology, statistics, computing, among others.

As a result of the uprising interest in the field, there is a rapidly growing amount of literature on modeling terrorist networks as graphs, an outgrowth of the existing literature concerning other types of criminal networks, e.g., [2, 3, 5, 12, 14, 15]. However, a graph model might not be the best representation of organizations such as terrorist organization and threat groups. In his recent work described in [4], Farley explains clearly that modeling terrorist networks as graphs does not give us enough information to deal with the threat. Modeling a terrorist network as a hierarchy can be a good approach to give an idea about the subgroups present in the network and also how information flows from higher ranks to lower [5]. Actually, a hierarchy is another perspective for analyzing a social network. We argue that it is necessary to consider all perspectives at once in order to produce a robust approach that could work as early warning system with high accuracy.

As part of our effort to contribute to this essential field of research, in this paper we introduce a measure to determine the importance and danger of a network structure based on social network analysis measures; a well organized network structure leads to existence of leaders and important nodes. Concentrating on the structure would lead to vital discoveries that highlight such leaders and important nodes which should be well tracked in order to avoid as much as ever possible any future terrorist activities by their groups. The proposed measure is equally important to analyze other domains that could be modeled as social network; this is well demonstrated in the conducted testing.

The remainder of the paper is organized as follows. Section 2 describes social network analysis measures. Section 3 discusses the proposed measure for analyzing

2010 International Conference on Advances in Social Networks Analysis and Mining

978-0-7695-4138-9/10 $26.00 © 2010 IEEE

DOI 10.1109/ASONAM.2010.84

421

2010 International Conference on Advances in Social Networks Analysis and Mining

978-0-7695-4138-9/10 $26.00 © 2010 IEEE

DOI 10.1109/ASONAM.2010.84

421

2010 International Conference on Advances in Social Networks Analysis and Mining

978-0-7695-4138-9/10 $26.00 © 2010 IEEE

DOI 10.1109/ASONAM.2010.84

421

organized network structure. Section 4 reports our results on different data sets of terrorist networks and non-terrorist networks. Section 5 is conclusions.

2. Social Network Analysis (SNA) Social Network Analysis (SNA) is about mapping and measuring of relationships (and flows) between people, groups, organizations or other information/knowledge processing entities. Entities (called actors) are represented as nodes in the network along with links, with/without attribute weight ages. SNA attempts to provide both mathematical analysis and visual representation of relationships in a network. SNA is an interesting cross-fertilization of sociology, mathematics, computing, etc to the benefit of all.

The idea of applying SNA to understand networks is not new [6]. In one form or another, network analysis has been used to uncover unlawful entities and activities. It has been used for evidence mapping in fraud and criminal conspiracy cases, e.g., [7, 8, 9]. A suspect’s network can be built through relational information, including internet blogs, emails, telephone logs, travel bookings, credit card transactions, etc [2]. More recently, network methods have formed a useful part of intelligence work. As terrorists establish new relations or break existing relations with others, their position roles, and power may change accordingly. These node dynamics, resulting from relation changes, can be captured by a set of centrality measures from SNA.

2.1 Degree Measure Degree measures how active a particular node is. It is defined as the number of direct links a node a has [10]:

where n is the total number of nodes in a network, c(i, a) is a binary variable indicating whether a link exists between nodes i and a. A network member with a high degree could be the leader or “hub” in a network.

In a directed graph, degree can be classified into in-degree and out-degree to differentiate between links going into and out of a node, respectively.

2.2 Betweenness Measure Betweenness measures the extent to which a particular node lies between other nodes in a network. The betweenness of a node, say a, is defined as the number of geodesics (shortest paths between two nodes) passing through a [10]:

where gij(a) indicates whether the shortest path between two other nodes i and j passes through node a. A member with high betweenness may act as a gatekeeper or “broker” in a network for smooth communication (information passing) or flow of goods (e.g., drugs).

2.3 Closeness Measure Closeness is the sum of the length of geodesics between a particular node, say a, and all the other nodes in a network. It actually measures how far away one node is from other nodes and sometimes is called “farness” [11]:

where l(i,a) is the length of the shortest path connecting nodes i and a.

3. Process Organizational Measure The idea of our approach is shedding light on the organizational structure of networks rather than considering the importance of individuals or nodes. Though we concentrate more on terrorist networks in the testing, we run some tests to demonstrate the applicability of our measure to other networks as well. For a terrorist network to be considered dangerous or important, it must reach to certain level of organizational structure. Modern terrorist organizations have learned that they can effectively counter much larger and conventional enemies using dispersed and networked forms of warfare, striking when their target is least likely to expect it. However, on the other hand, planning a highly organized attack requires highly organized communications, which means the fact that true leaders could be hiding themselves doesn’t really affect the structure of a terrorist network.

We observed a characteristic of terrorist network structure or in general the well organized networks, which is the non-normal distribution of the three major SNA measures; degree, betweenness, and closeness among the nodes in the network. Values of these measures among the nodes tend to be clustered in groups of close values, the larger number of groups and the larger number of nodes within each group refers to the level of organization of the network. We translate this approach to a numerical value to indicate the value of organization within the network, and thus the importance and danger factor of a terrorist network. The proposed process works as follows: 1. Rank each node of the network based on specific

measure 2. Group nodes starting from the lowest values based on

closeness of values (nodes with close values are grouped together)

A = set of groups 3. Each group is given a weight, weights are given to

reflect bigger influence of groups constructed from high SNA measures values, weights can be given in many ways depends to what extinct high SNA values affects the network. In our study we assign sequential numbers, where the first group created has the lowest weight and the last one has the highest weight; weights are integer numbers starting from 1. For each (Ai), (Wi) denotes the weight of the group (Ai)

422422422

Table 1. Total degree of September 11th Rank Agent Value

1 33 1.0000

2 40 0.7000

3 46 0.5000

4 41 0.5000

5 34 0.5000

6 25 0.5000

7 15 0.5000

8 5 0.5000

9 57 0.4000

10 49 0.4000

11 53 0.4000

12 52 0.4000

13 32 0.4000

14 31 0.4000

15 47 0.4000

16 44 0.4000

17 30 0.4000

18 56 0.3000

19 54 0.3000

20 50 0.3000

Table 2. betweenness values of September 11th

Rank Agent Value

1 46 0.1097

2 33 0.0976

3 49 0.0798

4 57 0.0665

5 40 0.0602

6 44 0.0457

7 54 0.0448

8 56 0.0440

9 34 0.0440

10 53 0.0418

11 52 0.0383

12 51 0.0303

13 31 0.0282

14 55 0.0262

15 5 0.0221

16 25 0.0173

17 15 0.0160

18 50 0.0158

19 47 0.0149

20 30 0.0142 4. Multiply the weight of each group with the number of

nodes within the group to relatively express the

influence of a group. Then add values together and get one value relative to the size of the whole network

where n is number of groups, N is the total number of nodes within the network

Table 3. closeness values of September 11th

Rank Agent Value

1 8 0.0309

2 19 0.0283

3 5 0.0282

4 15 0.0279

5 48 0.0272

6 45 0.0261

7 61 0.0254

8 39 0.0251

9 58 0.0251

10 62 0.0250

11 55 0.0250

12 47 0.0247

13 56 0.0246

14 27 0.0243

15 57 0.0242

16 38 0.0241

17 49 0.0239

18 33 0.0239

19 26 0.0239

20 53 0.0238

At the end, we apply the Org function on each of the three previously mentioned SNA measures and sum the values to get our measure value for the whole network.

Org(network)=Org(betweenness)+Org(closeness)+Org(degree) A higher value of the Org measure reflects higher

organized network structure, and thus higher importance and danger terrorist network. To demonstrate its applicability and effectiveness, we applied this measure to various data sets of terrorist networks and non-terrorist networks; the results are promising as reported in Section 4.

4. Experiments In the conducted experiments, we have used three data sets, two of them for terrorist networks, namely September 11th data set, and Madrid bombing data set. September 11th data set consists of 63 nodes of actors suspected to be involved in September 11th attack, the 153 links between nodes constructed based on (communication, relatives, places belonging to, and roommates) relationships. Madrid Bombing data set consists of 67 nodes and 89 links which

423423423

constructed the same way as September 11th data set. The third data set is for non-terrorist network; it is related to World Trade of 80 countries and 998 interactions of trading activities between countries. We first applied the SNA measures for each data set, and used them to extract the proposed overall Organizational measure. By considering the network of September 11, Table 1, Table 2 and Table 3 show the top ranked nodes of the three SNA measures, in degree, betweenness, and closeness, respectively.

Figure 1. September 11th total degree distribution

Table 4. total degree values of Madrid bombing data set

Rank Agent Value

1 Madrid Bombings 1.0000

2 Moroccan Islamic 0.3077

3 Serhane ben 0.2308

4 Zarqa, Jordan 0.1538

5 Imad Eddin 0.1538

6 Morocco 0.1538

7 Madrid Store 0.1538

8 Jamal Zougam 0.1538

9 Spain 0.1538

10 Afghanistan 0.1538

11 Jamal Ahmidan 0.1538

12 Jose Emilio 0.1538

13 Brahim 0.1538

14 Abdennabi 0.1538

15 Abu Hafs al-Masri 0.1538

16 Takfir wal-Hijra 0.1538

17 Youssef Belhadj 0.1538

18 Al Qaeda cell in 0.0769

19 Mohamed Atta 0.0769

20 Casablanca 0.0769

Table 5 . betweenness values of Madrid bombing data set

Rank Agent Value

1 Madrid Bombings 0.0242

2 Abu Hafs al-Masri 0.0061

3 Moroccan Islamic 0.0047

4 Serhane ben 0.0035

5 Jamal Zougam 0.0030

6 Zarqa, Jordan 0.0023

7 Brahim 0.0023

8 Takfir wal-Hijra 0.0023

9 Spain 0.0005

10 Afghanistan 0.0005

11 Imad Eddin 0.0002

12 Jose Emilio 0.0002

13 Youssef Belhadj 0.0002

Table 6 . closeness values of Madrid bombing data set

Rank Agent Value

1 Abu Dujan al 0.0194

2 Jamal Ahmidan 0.0191

3 Morocco 0.0191

4 Serhane ben 0.0191

5 Madrid Store 0.0188

6 Jamal Zougam 0.0184

7 al qaeda 0.0184

8 Abu Hafs al-Masri 0.0184

9 Madrid Bombings 0.0182

10 Moroccan Islamic 0.0181

11 Lavapies, Madrid, 0.0156

12 Al Qaeda cell in 0.0154

13 Afghanistan 0.0154

14 Rachid Bendouda 0.0154

15 Zarqa, Jordan 0.0152

16 Imad Eddin 0.0152

17 Taragona Al 0.0152

18 Abdelaziz Beyaich 0.0152

19 Spain 0.0152

20 Jose Emilio 0.0152

We can notice from the top ranked nodes of each measure, the way nodes are grouped in close values. We believe this trend shows in well-organized social networks, where actors tend to have responsibilities according to their importance within the hierarchy of the network. In the tables above SNA measures of a sample of top ranked actors is not gradually decreased from the top ranked to the least, it tends more to decrease in gaps leaving group of actors having close values together. As shown in Figure 1,

424424424

we plotted values of each node of the network for total degree measure as compared to normal distribution using the ORA tool in order to show the non-normal distribution. Values plotted in this chart are values corresponding to all actors in the network. Here gaps are visually observed and the manner repeated all over the network.

Figure 2. Madrid total degree distribution

Figure 3. Total degree distribution of World Trade data set

Table 7. total degree values of word trade data set

Rank Agent Value

1 Finland 1.0000

2 Slovenia 0.8817

3 Iceland 0.4545

4 Singapore 0.3861

5 Hungary 0.3662

6 Brazil 0.3150

7 Chile 0.2793

8 Kuwait 0.2664

9 Salvador 0.2481

10 Belgium 0.2285

We applied the same measures on the Madrid Bombing data set. The obtained top ranking nodes are reported in

Table 4, Table 5 and Table 6. Further, the curves plotted in Figure 2 show the same manner of distribution; we believe this trend reflects planning and organizing in relationships in the network.

To avoid any bias in the results and to demonstrate the effectiveness of the proposed measure, we have also applied the same set of experiments on a non-terrorist network (World Trade) data set. The results of the top ranking nodes for the three measures are listed in Table 7, Table 8 and Table 9; values of SNA measures of World Trade data set are observed to gradually decrease from top ranked to least ranked value, gaps are not observed which we believe reflects no intellectual organization or planning behaviors, and the distribution curves for the three measures are plotted in Figure 3, Figure 4 and Figure 5, respectively. Comparing the distribution curves of SNA measures belonging to terrorist networks (highly organized networks) to the World Trade network demonstrates the grouping distribution of terrorist networks where it is worth noting that the distribution of the SNA measures in World Trade data set doesn’t reflect any grouping factors; this supports the idea of non-organizational structure.

Our method tends to transform the degree of organization into a numerical value as demonstrated by the values reflected in the nine tables and the curves plotted in the five figures.

Table 8. betweenness values of word trade data set

Rank Agent Value

1 Rep. 0.1124

2 Iceland 0.0784

3 Finland 0.0649

4 Mexico 0.0610

5 Ecuador 0.0501

6 Slovenia 0.0477

7 Of 0.0400

8 Singapore 0.0356

9 Moldava. 0.0322

10 Hungary 0.0279

Table 9. closeness values of word trade data set

Rank Agent Value

1 Finland 0.9744

2 Hungary 0.9268

3 Slovenia 0.9157

4 Singapore 0.8444

5 Chile 0.7917

6 Salvador 0.7835

7 Iceland 0.7755

8 Belgium 0.7037

9 Rep. 0.7037

10 Kuwait 0.7037

425425425

Figure 4. betweenness distribution of World Trade data set

Figure 5. closeness distribution of World Trade data set

Table 10. organization values

Data set Total Degree Organization

value

Betweenness Organization

value

Closeness organization

value

Total organization

value

September 11th

2.66 3.0625 1.548 7.27

Madrid Bombing

1.338 1.769 1.321 4.42

World trade 1.55 0.757 1.67 3.97

The values of the proposed organization measure are

shown in Table 10 for the three networks used in the tests. The results show higher values for groups-based organized networks, which are the two terrorist networks. September 11th total value is significantly the highest; this reflects the degree of organization the network did reach to, and as a result became more and more seriously dangerous. Value of organization based on betweenness is the most affected one as well; this can make it the dominated factor. Our measure would be helpful in detecting highly organized terrorist networks and as a result preventing possible terror attacks. Further, our approach is different than other approaches studying the structure of networks; we focus on terrorist networks’ structure in which we believe the redundancy of

connectivity and communication levels plays a vital role in composing serious well organized terrorist networks.

5. Conclusions A clear understanding of network structures and individual roles can help law enforcement and intelligence agencies to develop effective strategies in order to prevent future terrorist attacks. More organized terrorist network structure is considered to be more important and more dangerous. SNA is widely used in terms of discovering important agents; the growing awareness of terrorists makes it more difficult to discover important agents, since they tend to hide themselves. We argue that a measure of degree of organization of the whole network without concentrating on discovering certain individuals would help in discovering and predicting terrorist networks. Using SNA measures to extract a measure referring to the degree of organization of the whole network is the technique we used. We tested our measure on three different networks to validate the proposed approach for predicting the organizational structure of a network; the measure had higher value in terrorist networks and low value relatively in the world trade network which is less organized.

References [1] Strogatz S. H., “Exploring Complex Networks,” Nature, 410,

pp.268-276, 2002. [2] Krebs V., “Mapping Terrorist Networks,” Connections, 24(3),

2002. [3] Klerks P., “The Network Paradigm Applied to Criminal

Organizations,” Connections, 24 (3), 2001. [4] Farely D. J., “Breaking Al Qaeda Cells: A Mathematical

analysis of counterterrorism Operations,” Studies in Conflict Terrorism. 26, pp.399–411, 2003.

[5] Shaikh M.A. and Wang J., “Discovering hierarchical structure in terrorist networks,” Proceedings of the International Conference on Emerging Technologies, pp.238-244 Nov. 2006.

[6] Sparrow, M.K., “The application of network analysis to criminal intelligence: An assessment of the prospects,” Social Networks, 13, pp.251-274, 1991.

[7] Baker, W.E. and Faulkner, R.R., “The social organization of conspiracy: Illegal networks in the heavy electrical equipment industry,” American Sociological Review, 58(6) 837-860, 1993.

[8] Criminal Network Analysis Training Course. Defense Intelligence Agency, 2000.

[9] Klerks, P., “The network paradigm applied to criminal organizations,” Connections, 24 (3) , 2001.

[10] Jialun Q., Xu J.J., Daning H., Sageman M. and Chen H., “Analyzing Terrorist Networks: A Case Study of the Global Salafi Jihad Network,” Proceedings ofIEEE International Conference on Intelligence and Security Informatics, Atlanta GA, pp. 287-304, 2005.

[11] Baker, W. E. and Faulkner, R. R., “The Social Organization of Conspiracy: Illegal Networks in the Heavy Electrical Equipment Industry,” American Sociological Review, 58(12) (1993) 837-860.

426426426

[12] Xu J. and Chen H., “CrimeNet Explorer: A framework for criminal network knowledge discovery,” ACM Transactions on Information Systems, Vol. 23(2), pp.201-226, 2005.

[13] Memon, N., Wiil, U.K., Alhajj, R., Atzenbeck, C. and Harkiolakis, N., “Harvesting Covert Networks: The Case Study of the iMiner Database,” Journal of Networking and Virtual Organisations, 2010.

[14] Memon, N., Wiil, U. K., and Qureshi, A. R., “Design and Development of an Early Warning System to Prevent Terrorist Attacks,” Proceedings of the International Conference on Artificial Intelligence and Neural Networks, pp.222-226, 2009.

[15] Tsvetovat, M., and Carley K. M., “Structural Knowledge and Success of Anti-terrorist Activity: The Downside of Structural Equivalence,” Journal of Social Structures, 6(2), 2005.

427427427