Article Versions
Export Article
Cite this article
  • Normal Style
  • MLA Style
  • APA Style
  • Chicago Style
Research Article
Open Access Peer-reviewed

Analysis of Suspects of Terrorist Incidents by Unknown Perpetrator

Qingyun Wang, Yayuan Xiao
American Journal of Applied Mathematics and Statistics. 2019, 7(5), 161-166. DOI: 10.12691/ajams-7-5-1
Received August 03, 2019; Revised September 12, 2019; Accepted September 17, 2019

Abstract

Terrorism is a common threat to humanity. An in-depth analysis of data related to terrorist attacks provides a deeper knowledge of terrorism that is valuable to counter-terrorism. In this paper, we analyzed the terrorist incident data in the United States in 1998-2017. Through cluster analysis, we speculated the possible suspects of terrorist incidents by unknown perpetrators and analyzed the credibility of those results.

1. Introduction

There have been various challenges in the study of terrorism, such as the debate on the related concepts of terrorism 1, and various criticisms of terrorism research methods since the 1980s 2, 3. On the other hand, terrorism research has made great progress in the fields of psychology 4, 5, 6, criminology 7, 8 and sociology 9, 10, but systematic analysis of the data on terrorism is rare.

With the increase in the number of terrorist attacks and the development of modern information technology, information on terrorist incidents has accumulated rapidly in recent years. However, the traditional methods of terrorism research and analysis have been difficult to effectively process and use these massive and complex data. Therefore, some scholars have begun to open up new research directions 11, 12, 13, 14, using mathematical statistics and modern information technology methods to process and systematically analyze terrorism data. These studies have overcome the shortcomings of previous studies that rely too much on past literature and lack statistical analysis and argumentation 15, 16, 17.

Meanwhile, the collection or completion of data on terrorist attacks has become more and more important, attracting more researchers' interest. The incident data of the terrorist attack is multidimensional attribute data. The more detailed and complete the information collection of terrorist attacks, the greater the contribution to counter-terrorism research. As multidimensional attribute data, for terrorist incident data, the most often missing important attribute is the possible suspect. Therefore, for a terrorist attack committed by unknown perpetrator (hereinafter referred to as an unknown terrorist incident), it is natural to ask: how can we speculate on its suspect? It is noted that different terrorist organizations have their own "organizational culture". The terrorist attacks they commit usually have certain appeals and crime patterns, for example, similar targets and methods of attack. Therefore, if we can gather a number of terrorist attacks that may be committed by the same terrorist organization or individual at different times and in different locations to unite the investigation, then we may get the answer to the above question.

There were 559 terrorist incidents in the United States in 1998-2017, of which 166 are unknown terrorist incidents. In this paper, we used the k-mode algorithm to cluster terrorist attacks with similar criminal patterns, and then used the known terrorist incident data to speculate suspects of unknown terrorist incidents. In 166 unknown terrorist incidents, we successfully speculated on the suspects of 158 incidents and made a credibility assessment of those results.

2. Methods

2.1. Data Resource and Data Processing

The data we use is from Global terrorism database (GTD: https://www.start.umd.edu/gtd/), which is an open-source database including the most information on terrorist incidents around the world from 1970 through 2017. Our work in this paper is to focus on the analysis of terrorist incident data from 1998 to 2017, which is collected from the review of more than 4,000,000 news articles and 25,000 news sources and is more complete than the data in 1970 – 1997. In the GTD, the data of each terrorist incident contains 75 coded variables collected under eight broad categories, as identified in the GTD Codebook (https://www.start.umd.edu/gtd/downloads/Codebook.pdf). Among those 75 coded variables, we selected 12 parameters associated with the suspect's main crime pattern, calling them the suspect identification parameters. These parameters record the duration of the terrorist attack, the target of the attack, the type of attack, the type of victim, whether it is claimed responsibility by an organization, the number of deaths confirmed, the degree of property loss, and whether it is transnational, etc. Therefore, for each terrorist incident in the database, there is a vector corresponding to it. See Appendix 1 for details of the components of this vector.

2.2. Terrorist Incident Data Clustering

There is a vector space corresponding to 559 terrorist incidents from 1998 to 2017. In this section, we will divide this vector space into several clusters and the terrorist attacks in each cluster have similar crime patterns. The clustering algorithm widely used in data mining is k-means algorithm proposed by MacQueen in 1967 18 and it divide a set of n observations into several clusters as follows.

Step 1 Randomly select k cluster centers

Step 2 Calculate the distance between and for all i=1..., n, and j=1..., k.

Step 3 Assign to the cluster whose center is the nearest to and let the means of the observations in the jth cluster be the new

Step 4 Repeat Steps 2, and 3 until there is no more changes in

K-means has been successfully used in the clustering of the numerical data, even large data sets. However, it is not suitable for processing the attribute data such as the terrorist incident data in GTD. Therefore, we will use the k-modes algorithm 19, an extension of the k-means algorithm, to cluster the terrorist incident data in this paper:

Step 1 Randomly select k vectors of length 12, i.e. j=1,…, k.

Step 2 Calculate the dissimilarity score between and for all i=1..., n, and j=1..., k. In the rest of paper, we will use dis to denote their dissimilarity score, which is defined by

dis

where if and if

Step 3 Assign to the m th cluster if dis is the smallest dissimilarity score obtained in Step 2. Once the clusters are formed, let the new cluster center/centroid be where m=1,..,k; is the mode of all in the m the cluster. Step 4 Repeat Steps 2, and 3 until there is no more changes in

By running the k-mode algorithm, we divided the 559 terrorist incidents into 30 clusters as shown in the Table 1 below. Among those 30 clusters, there are suspects in all the terrorist attacks in the six clusters (clusters 25 - 30), and there are no suspects in all the terrorist attacks in the two clusters (clusters 23 and 24).

Next, we will speculate two types of the possible suspects of unknown terrorist incidents in clusters 1 – 22. Comparing the proportion of terrorist attacks committed by each suspect in the cluster, we can easily obtain the following Type I suspect (listed in the Table 2 below), i.e., the one with the highest proportion of crimes in the cluster. If more than one suspects have the same highest proportion of crimes, then we have more than one Type I suspects in the cluster.

We found that the percentage of terrorist attacks committed by different suspects is very close in some clusters. In this case, we need to have other methods to deal with the valid information that was deleted during the speculation process of the Type I suspect.

There are 50 suspects in clusters 1 - 22. Noted that there are 17 suspects only related with a single terrorist incident and 8 suspects related with 2 incidents. We remove those suspects since those incident data are not enough to characterize the suspect's crime pattern. For the rest 25 suspects, each suspect can be characterized by a vector k =1,…, 25, where is the mode of the th components of the vector representations of the terrorist attacks committed by this suspect, For each unknown terrorist incident in the th cluster, we compute dis for all suspects in the m th cluster. We speculate that the suspects with the smallest dis be the possible suspect of and call it Type II suspect of the attack. See Appendix II for the list of Type II suspects that we obtained.

3. Results

Through the methods described in the previous section, we obtained two types of possible suspects for 95.18% of unknown terrorist attacks. Due to the limited length of the article, in this section we only list a few specific terrorist attacks and their possible suspects in the Table 3 below. In the next section, we will discuss in detail the specific assessment of all potential suspects we obtained.

It should be pointed out that by the definitions, Type I suspects should be the same for all unknown terrorist incidents in each cluster; type II suspects may be different, especially in the cluster involving many suspects.

4. Discussion

We obtained the possible suspects of 158 unknown terrorist incidents in the U.S. in 1998 – 2017. In this section, we will evaluate those results and discuss the methods used in this article. For Type I suspects, the higher the proportion of known terrorist attacks committed by this Type I suspect in a cluster, the more reliable the results of the Type 1 suspects for unknown terrorist incidents in that cluster. Therefore, we think that the Type I suspects for cluster 5, 6, 12, 14, 16, 19, 21, 22 have a certain reference value since the Type I suspects in those 8 clusters committed more than 50% of all terrorist attacks in the cluster.

The effectiveness of the Type II suspects is based on the number of suspects involved, and the proportion of terrorist attacks respectively committed by these suspects in the entire cluster. For example, there are 15 terrorist attacks in the 22nd cluster, and only one of those attack's suspect is unknown. In other words, the percentage of suspected terrorist attacks in the entire cluster is 93.33%. Moreover, the other 14 terrorist attacks involved only 2 suspects. In this case, the results of the Type II suspects in the 22nd cluster is highly credible. On the other hand, we would like to point out that the percentage of known terrorist attacks in the entire cluster is not sufficient to measure the credibility of the Type II suspect’s derivation. For example, there are 26 terrorist attacks in the 11th cluster, and only one of those attack's suspect is unknown. However, there are 9 suspects involved in this cluster. In this case, the clustering effect is poor, and the derivation results of the Type II suspects in this cluster were less reliable. Therefore, we need to combine the percentage of known terrorist attacks and the number of suspects involved to assess the credibility of the Type II suspects' derivation results. Let be the suspects involved to derive the Type II suspects in the ith cluster (i.e., there is at least a terrorist attack in this cluster has as the suspect, and has committed at least 3 attacks in the database, for k = 1,2,…,n(i)). And where is the percentage of the terrorist attacks in the ith cluster committed by the suspect k =1,2,…, n(i). We use the following index to measure the credibility of the type II suspects' derivation results for each cluster:

where is the proportion of unknown terrorist incidents in the ith cluster. The measurements for the cluster with < 50 % are listed in the Table 4 below.

According to the values of we divide the above 18 clusters with < 50% into the three classes listed in the Table 5 below.

The unknown terrorist incidents in the first class above and their possible suspects are listed in Table 3. We can see that for the unknown incidents in the 16th cluster, Type I suspects are the same with the Type II suspects; for the ones in the 12th and 19th clusters, Type I suspects and Type II suspects are partially overlapping. It reflects the high credibility of our speculation on the suspects of those unknown attacks. On the other hand, the unknown attacks in the 5th and the 22th clusters have completely different Type I and Type II suspects. The reason for this inconsistency is that in the k-mode clustering algorithm, the condition for stopping the calculation is that is the smallest for all terrorist incidents and cluster centers rather than the minimum dissimilarity score of each and This causes that some incidents are not assigned to the cluster with the smallest dissimilarity score. In addition, in this paper, we did not directly compare the dissimilarity for each and all This is because in the database, some suspects only have involved a few terrorist attacks. For example, the Incel extremists only have three attacks in the record. These data are not sufficient to fully depict the suspect's crime pattern. Therefore, we first cluster all the terrorist incident data and then compare the dissimilarity of each and all in the cluster to which belongs. This method saves as much information as possible for all incidents.

In this paper, we use the k-mode algorithm to cluster terrorist incident data. During the clustering process, we assume that all the attributes of the incident that we use are independent. However, these attributes may actually be related to each other, such as the type of attack and the type of weapon. A possible future work is to further refine or combine the attributes of terrorist incidents and then obtain more effective clustering results. In addition, we treat each terrorist incident as an independent incident in this article. However, in real a terrorist attack may consist of multiple attacks, which means that certain terrorist incident data are relevant. For example, the famous 9/11 incident consisted of four attacks, corresponding to 4 incident data in the database. In the future, we may further sort the original data, classify incidents that may be consecutive attacks, and then analyzed and inferred to obtain better results. In this paper, we have only studied the unknown terrorist attacks in the United States. In the future, we could also study the unknown terrorist attacks in other countries. However, due to political, economic and religious differences, the characteristics of suspects may change, and the selection of suspect identification parameters may need to be modified accordingly.

Acknowledgements

This work was partly supported by Natural Science Foundation of China (41601600) and Research Project of Jiangxi Provincial Department of Education (GJJ170824, GJJ150995).

References

[1]  Jackson, R. (2010). An Argument for Terrorism. Perspectives on Terrorism. Vol 2. No 2. Retrieved from http://www.terrorismanalysts.com/pt/index.php/pot/article/view/.
In article      
 
[2]  Alex P. Schmid and Albert J. Jongman, Political Terrorism: A New Guide to Actors, Authors, Concepts, Data Bases, Theories, and Literature (Amsterdam, New Brunswick: SWIDOC, Transaction Books, 1988), 179.
In article      
 
[3]  Jackson, R. (2007). The core commitments of critical terrorism studies. European Political Science. 6(3): 244-251.
In article      View Article
 
[4]  Borum, R., (2004). "Psychology of Terrorism". Mental Health Law & Policy Faculty Publications. 571.
In article      
 
[5]  Borum, R., (2010). "Understanding Terrorist Psychology". Mental Health Law & Policy Faculty Publications. 576.
In article      
 
[6]  Crenshaw, M. (2000). The Psychology of Terrorism: An Agenda for the 21st Century. Political Psychology, 21(2), 405-420.
In article      View Article
 
[7]  Mythen, G., & Walklate, S. (2006). "CRIMINOLOGY AND TERRORISM: Which Thesis? Risk Society or Governmentality?". The British Journal of Criminology, 46(3), 379-398.
In article      View Article
 
[8]  Gary LaFree Joshua D. Freilich. 2016. The Handbook of the Criminology of Terrorism. West Sussex: Wiley Blackwell.
In article      View Article
 
[9]  Hudson, R.A. (1999). The Sociology and Psychology of Terrorism: Who becomes a Terrorist and why? Washington, DC: Library of. Congress. 53.
In article      View Article
 
[10]  Turk, A. T. (2004). Sociology of Terrorism. Annual Review of Sociology, 30, 271-286.
In article      View Article
 
[11]  Stephen E. Fienberg, and Galit Shmueli. (2005). Statistical Issues and Challenges Associated with the Rapid Detection of Terrorist Outbreaks. Statistics in Medicine 24: 513-529. Statistics in medicine. 24. 513-29.
In article      View Article  PubMed
 
[12]  Brian M. Jenkins, Henry H. Willis, and Bing Han, Do Significant Terrorist Attacks Increase the Risk of Further Attacks? Initial Observations from a Statistical Analysis of Terrorist Attacks in the United States and Europe from 1970 to 2013. Santa Monica, CA: RAND Corporation, 2016.
In article      View Article
 
[13]  G. Li, J. Hu, Y. Song, Y. Yang and H. Li, "Analysis of the Terrorist Organization Alliance Network Based on Complex Network Theory," in IEEE Access, vol. 7, pp. 103854-103862, 2019.
In article      View Article
 
[14]  Vivek Kumar1, Manuel Mazzara, Maj. G.R.A. Messina, JooYoung Lee. A Conjoint Application of Data Mining Techniques for Analysis of Global Terrorist Attacks - Prevention and Prediction for Combating Terrorism.
In article      
 
[15]  Horgan, J. (1997). Issues in Terrorism Research. The Police Journal, 70(3), 193-202.
In article      View Article
 
[16]  Andrew Silke, “The Devil You Know: Continuing Problems with Research on Terrorism,” Terrorism and Political Violence 13, no. 4 (2001): 1-14.
In article      View Article
 
[17]  Bart Schuurman (2018) Research on Terrorism, 2007–2016: A Review of Data, Methods, and Authorship. Terrorism and Political Violence.
In article      View Article
 
[18]  MacQueen, J. Some methods for classification and analysis of multivariate observations. Proceedings of the Fifth Berkeley Symposium on Mathematical Statistics and Probability, Volume 1: Statistics, 281-297, University of California Press, Berkeley, Calif., 1967.
In article      
 
[19]  Huang, Z. & Ng, M. Journal of Classification (2003) 20: 257.
In article      View Article
 

Appendix 1. The suspect identification parameters

Ÿ T1=1, if the duration of an incident extended more than 24 hours. Otherwise, T1=0.

Ÿ T2=1, if The violent act is aimed at attaining a political, economic, religious, or social goal. Otherwise, T2= 0.

Ÿ T3=1, if there is evidence of an intention to coerce, intimidate, or convey some other message to a larger audience (or audiences) than the immediate victims. Otherwise, T3=0.

Ÿ T4=1, if the action is outside the context of legitimate warfare activities, insofar as it targets non-combatants. Otherwise,T4=0.

Ÿ The value of T5 describes the main type of attack in the terrorist incident. The possible value of T5 is 1- 9, corresponding to nine different types of attacks: Assassination, Hijacking, Kidnapping, Barricade Incident, Bombing/Explosion, Armed Assault, Unarmed Assault, Facility/Infrastructure Attack, Unknown.

Ÿ T6=1, if the incident was a suicide attack. Otherwise, T9=0.

Ÿ The value of T7 describes the weapons used in the terrorist incident. The possible value of T7 is 1-13, corresponding to 13 different types of attacks: Biological, Chemical, Radiological, Nuclear, Firearms, Explosives, Fake Weapons, Incendiary, Melee, Vehicle, Sabotage Equipment, Other, and Unknown.

Ÿ The value of T8 describes the type of target/victim within the terrorist attack. It may have a value of 1-22, corresponding to 22 types of victims: Business, Government (general), Police, Military, Abortion related, Airports & aircraft, Government (diplomatic), Educational institution, Food or water supply, Journalists & media, Maritime, Non-governmental organizations, Other, Private citizens & property, Religious figures/institutions, Telecommunication, Terrorists/non-state militias, Tourists, Transportation (other than aviation), Unknown, Utilities, and Violent political parties.

Ÿ T9 indicates whether the information reported by sources about the Perpetrator Group Name(s) is based on speculation or dubious claims of responsibility. T9=1, if the perpetrator attribution(s) for the incident are suspected. T9=0, if the perpetrator attribution(s) for the incident are not suspected.

Ÿ T10 stores the number of total confirmed fatalities for the incident. The number includes all victims and attackers who died as a direct result of the incident.

Ÿ T11 describes the extent of the property damage. The possible value of T11 is 1 - 4, corresponding to the damage that is likely >= $ 1 billion; between 1 million and 1 billion < 1 million, or Unknown.

Ÿ The value of T12 indicates whether the terrorist incident is transnational. T12=1, if all members in the perpetrator group's nationality differs from the location of the attack or the nationality of the perpetrator group differs from the nationality of the target(s)/victim(s) or the location of the attack differs from the nationality of the target(s)/victim(s). T12=0, if The nationality of the perpetrator group, the nationality of the victim(s), and the location of the attack are the same. T12=-9 if the nationality of the perpetrator group, or the nationality of the victim(s) is unknown.

Appendix 2. Type II suspects of unknown terrorist incidents

Published with license by Science and Education Publishing, Copyright © 2019 Qingyun Wang and Yayuan Xiao

Creative CommonsThis work is licensed under a Creative Commons Attribution 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Cite this article:

Normal Style
Qingyun Wang, Yayuan Xiao. Analysis of Suspects of Terrorist Incidents by Unknown Perpetrator. American Journal of Applied Mathematics and Statistics. Vol. 7, No. 5, 2019, pp 161-166. http://pubs.sciepub.com/ajams/7/5/1
MLA Style
Wang, Qingyun, and Yayuan Xiao. "Analysis of Suspects of Terrorist Incidents by Unknown Perpetrator." American Journal of Applied Mathematics and Statistics 7.5 (2019): 161-166.
APA Style
Wang, Q. , & Xiao, Y. (2019). Analysis of Suspects of Terrorist Incidents by Unknown Perpetrator. American Journal of Applied Mathematics and Statistics, 7(5), 161-166.
Chicago Style
Wang, Qingyun, and Yayuan Xiao. "Analysis of Suspects of Terrorist Incidents by Unknown Perpetrator." American Journal of Applied Mathematics and Statistics 7, no. 5 (2019): 161-166.
Share
[1]  Jackson, R. (2010). An Argument for Terrorism. Perspectives on Terrorism. Vol 2. No 2. Retrieved from http://www.terrorismanalysts.com/pt/index.php/pot/article/view/.
In article      
 
[2]  Alex P. Schmid and Albert J. Jongman, Political Terrorism: A New Guide to Actors, Authors, Concepts, Data Bases, Theories, and Literature (Amsterdam, New Brunswick: SWIDOC, Transaction Books, 1988), 179.
In article      
 
[3]  Jackson, R. (2007). The core commitments of critical terrorism studies. European Political Science. 6(3): 244-251.
In article      View Article
 
[4]  Borum, R., (2004). "Psychology of Terrorism". Mental Health Law & Policy Faculty Publications. 571.
In article      
 
[5]  Borum, R., (2010). "Understanding Terrorist Psychology". Mental Health Law & Policy Faculty Publications. 576.
In article      
 
[6]  Crenshaw, M. (2000). The Psychology of Terrorism: An Agenda for the 21st Century. Political Psychology, 21(2), 405-420.
In article      View Article
 
[7]  Mythen, G., & Walklate, S. (2006). "CRIMINOLOGY AND TERRORISM: Which Thesis? Risk Society or Governmentality?". The British Journal of Criminology, 46(3), 379-398.
In article      View Article
 
[8]  Gary LaFree Joshua D. Freilich. 2016. The Handbook of the Criminology of Terrorism. West Sussex: Wiley Blackwell.
In article      View Article
 
[9]  Hudson, R.A. (1999). The Sociology and Psychology of Terrorism: Who becomes a Terrorist and why? Washington, DC: Library of. Congress. 53.
In article      View Article
 
[10]  Turk, A. T. (2004). Sociology of Terrorism. Annual Review of Sociology, 30, 271-286.
In article      View Article
 
[11]  Stephen E. Fienberg, and Galit Shmueli. (2005). Statistical Issues and Challenges Associated with the Rapid Detection of Terrorist Outbreaks. Statistics in Medicine 24: 513-529. Statistics in medicine. 24. 513-29.
In article      View Article  PubMed
 
[12]  Brian M. Jenkins, Henry H. Willis, and Bing Han, Do Significant Terrorist Attacks Increase the Risk of Further Attacks? Initial Observations from a Statistical Analysis of Terrorist Attacks in the United States and Europe from 1970 to 2013. Santa Monica, CA: RAND Corporation, 2016.
In article      View Article
 
[13]  G. Li, J. Hu, Y. Song, Y. Yang and H. Li, "Analysis of the Terrorist Organization Alliance Network Based on Complex Network Theory," in IEEE Access, vol. 7, pp. 103854-103862, 2019.
In article      View Article
 
[14]  Vivek Kumar1, Manuel Mazzara, Maj. G.R.A. Messina, JooYoung Lee. A Conjoint Application of Data Mining Techniques for Analysis of Global Terrorist Attacks - Prevention and Prediction for Combating Terrorism.
In article      
 
[15]  Horgan, J. (1997). Issues in Terrorism Research. The Police Journal, 70(3), 193-202.
In article      View Article
 
[16]  Andrew Silke, “The Devil You Know: Continuing Problems with Research on Terrorism,” Terrorism and Political Violence 13, no. 4 (2001): 1-14.
In article      View Article
 
[17]  Bart Schuurman (2018) Research on Terrorism, 2007–2016: A Review of Data, Methods, and Authorship. Terrorism and Political Violence.
In article      View Article
 
[18]  MacQueen, J. Some methods for classification and analysis of multivariate observations. Proceedings of the Fifth Berkeley Symposium on Mathematical Statistics and Probability, Volume 1: Statistics, 281-297, University of California Press, Berkeley, Calif., 1967.
In article      
 
[19]  Huang, Z. & Ng, M. Journal of Classification (2003) 20: 257.
In article      View Article