Abstract

Terrorism is a common threat to humanity. An in-depth analysis of data related to terrorist attacks provides a deeper knowledge of terrorism that is valuable to counter-terrorism. In this paper, we analyzed the terrorist incident data in the United States in 1998-2017. Through cluster analysis, we speculated the possible suspects of terrorist incidents by unknown perpetrators and analyzed the credibility of those results.

1. Introduction

There have been various challenges in the study of terrorism, such as the debate on the related concepts of terrorism ¹, and various criticisms of terrorism research methods since the 1980s ^{2, 3}. On the other hand, terrorism research has made great progress in the fields of psychology ^{4, 5, 6}, criminology ^{7, 8} and sociology ^{9, 10}, but systematic analysis of the data on terrorism is rare.

With the increase in the number of terrorist attacks and the development of modern information technology, information on terrorist incidents has accumulated rapidly in recent years. However, the traditional methods of terrorism research and analysis have been difficult to effectively process and use these massive and complex data. Therefore, some scholars have begun to open up new research directions ^{11, 12, 13, 14}, using mathematical statistics and modern information technology methods to process and systematically analyze terrorism data. These studies have overcome the shortcomings of previous studies that rely too much on past literature and lack statistical analysis and argumentation ^{15, 16, 17}.

Meanwhile, the collection or completion of data on terrorist attacks has become more and more important, attracting more researchers' interest. The incident data of the terrorist attack is multidimensional attribute data. The more detailed and complete the information collection of terrorist attacks, the greater the contribution to counter-terrorism research. As multidimensional attribute data, for terrorist incident data, the most often missing important attribute is the possible suspect. Therefore, for a terrorist attack committed by unknown perpetrator (hereinafter referred to as an unknown terrorist incident), it is natural to ask: how can we speculate on its suspect? It is noted that different terrorist organizations have their own "organizational culture". The terrorist attacks they commit usually have certain appeals and crime patterns, for example, similar targets and methods of attack. Therefore, if we can gather a number of terrorist attacks that may be committed by the same terrorist organization or individual at different times and in different locations to unite the investigation, then we may get the answer to the above question.

There were 559 terrorist incidents in the United States in 1998-2017, of which 166 are unknown terrorist incidents. In this paper, we used the k-mode algorithm to cluster terrorist attacks with similar criminal patterns, and then used the known terrorist incident data to speculate suspects of unknown terrorist incidents. In 166 unknown terrorist incidents, we successfully speculated on the suspects of 158 incidents and made a credibility assessment of those results.

2. Methods

The data we use is from Global terrorism database (GTD: https://www.start.umd.edu/gtd/), which is an open-source database including the most information on terrorist incidents around the world from 1970 through 2017. Our work in this paper is to focus on the analysis of terrorist incident data from 1998 to 2017, which is collected from the review of more than 4,000,000 news articles and 25,000 news sources and is more complete than the data in 1970 – 1997. In the GTD, the data of each terrorist incident contains 75 coded variables collected under eight broad categories, as identified in the GTD Codebook (https://www.start.umd.edu/gtd/downloads/Codebook.pdf). Among those 75 coded variables, we selected 12 parameters associated with the suspect's main crime pattern, calling them the suspect identification parameters. These parameters record the duration of the terrorist attack, the target of the attack, the type of attack, the type of victim, whether it is claimed responsibility by an organization, the number of deaths confirmed, the degree of property loss, and whether it is transnational, etc. Therefore, for each terrorist incident in the database, there is a vector corresponding to it. See Appendix 1 for details of the components of this vector.

There is a vector space corresponding to 559 terrorist incidents from 1998 to 2017. In this section, we will divide this vector space into several clusters and the terrorist attacks in each cluster have similar crime patterns. The clustering algorithm widely used in data mining is k-means algorithm proposed by MacQueen in 1967 ¹⁸ and it divide a set of n observations into several clusters as follows.

Step 1 Randomly select k cluster centers

Step 2 Calculate the distance between and for all i=1..., n, and j=1..., k.

Step 3 Assign to the cluster whose center is the nearest to and let the means of the observations in the jth cluster be the new

Step 4 Repeat Steps 2, and 3 until there is no more changes in

K-means has been successfully used in the clustering of the numerical data, even large data sets. However, it is not suitable for processing the attribute data such as the terrorist incident data in GTD. Therefore, we will use the k-modes algorithm ¹⁹, an extension of the k-means algorithm, to cluster the terrorist incident data in this paper:

Step 1 Randomly select k vectors of length 12, i.e. j=1,…, k.

Step 2 Calculate the dissimilarity score between and for all i=1..., n, and j=1..., k. In the rest of paper, we will use dis to denote their dissimilarity score, which is defined by

dis

where if and if

Step 3 Assign to the m th cluster if dis is the smallest dissimilarity score obtained in Step 2. Once the clusters are formed, let the new cluster center/centroid be where m=1,..,k; is the mode of all in the m the cluster. Step 4 Repeat Steps 2, and 3 until there is no more changes in

By running the k-mode algorithm, we divided the 559 terrorist incidents into 30 clusters as shown in the Table 1 below. Among those 30 clusters, there are suspects in all the terrorist attacks in the six clusters (clusters 25 - 30), and there are no suspects in all the terrorist attacks in the two clusters (clusters 23 and 24).

Next, we will speculate two types of the possible suspects of unknown terrorist incidents in clusters 1 – 22. Comparing the proportion of terrorist attacks committed by each suspect in the cluster, we can easily obtain the following Type I suspect (listed in the Table 2 below), i.e., the one with the highest proportion of crimes in the cluster. If more than one suspects have the same highest proportion of crimes, then we have more than one Type I suspects in the cluster.

We found that the percentage of terrorist attacks committed by different suspects is very close in some clusters. In this case, we need to have other methods to deal with the valid information that was deleted during the speculation process of the Type I suspect.

There are 50 suspects in clusters 1 - 22. Noted that there are 17 suspects only related with a single terrorist incident and 8 suspects related with 2 incidents. We remove those suspects since those incident data are not enough to characterize the suspect's crime pattern. For the rest 25 suspects, each suspect can be characterized by a vector k =1,…, 25, where is the mode of the th components of the vector representations of the terrorist attacks committed by this suspect, For each unknown terrorist incident in the th cluster, we compute dis for all suspects in the m th cluster. We speculate that the suspects with the smallest dis be the possible suspect of and call it Type II suspect of the attack. See Appendix II for the list of Type II suspects that we obtained.

3. Results

Through the methods described in the previous section, we obtained two types of possible suspects for 95.18% of unknown terrorist attacks. Due to the limited length of the article, in this section we only list a few specific terrorist attacks and their possible suspects in the Table 3 below. In the next section, we will discuss in detail the specific assessment of all potential suspects we obtained.

It should be pointed out that by the definitions, Type I suspects should be the same for all unknown terrorist incidents in each cluster; type II suspects may be different, especially in the cluster involving many suspects.

4. Discussion

We obtained the possible suspects of 158 unknown terrorist incidents in the U.S. in 1998 – 2017. In this section, we will evaluate those results and discuss the methods used in this article. For Type I suspects, the higher the proportion of known terrorist attacks committed by this Type I suspect in a cluster, the more reliable the results of the Type 1 suspects for unknown terrorist incidents in that cluster. Therefore, we think that the Type I suspects for cluster 5, 6, 12, 14, 16, 19, 21, 22 have a certain reference value since the Type I suspects in those 8 clusters committed more than 50% of all terrorist attacks in the cluster.

The effectiveness of the Type II suspects is based on the number of suspects involved, and the proportion of terrorist attacks respectively committed by these suspects in the entire cluster. For example, there are 15 terrorist attacks in the 22nd cluster, and only one of those attack's suspect is unknown. In other words, the percentage of suspected terrorist attacks in the entire cluster is 93.33%. Moreover, the other 14 terrorist attacks involved only 2 suspects. In this case, the results of the Type II suspects in the 22nd cluster is highly credible. On the other hand, we would like to point out that the percentage of known terrorist attacks in the entire cluster is not sufficient to measure the credibility of the Type II suspect’s derivation. For example, there are 26 terrorist attacks in the 11th cluster, and only one of those attack's suspect is unknown. However, there are 9 suspects involved in this cluster. In this case, the clustering effect is poor, and the derivation results of the Type II suspects in this cluster were less reliable. Therefore, we need to combine the percentage of known terrorist attacks and the number of suspects involved to assess the credibility of the Type II suspects' derivation results. Let be the suspects involved to derive the Type II suspects in the ith cluster (i.e., there is at least a terrorist attack in this cluster has as the suspect, and has committed at least 3 attacks in the database, for k = 1,2,…,n(i)). And where is the percentage of the terrorist attacks in the ith cluster committed by the suspect k =1,2,…, n(i). We use the following index to measure the credibility of the type II suspects' derivation results for each cluster:

where is the proportion of unknown terrorist incidents in the ith cluster. The measurements for the cluster with < 50 % are listed in the Table 4 below.

According to the values of we divide the above 18 clusters with < 50% into the three classes listed in the Table 5 below.

The unknown terrorist incidents in the first class above and their possible suspects are listed in Table 3. We can see that for the unknown incidents in the 16th cluster, Type I suspects are the same with the Type II suspects; for the ones in the 12th and 19th clusters, Type I suspects and Type II suspects are partially overlapping. It reflects the high credibility of our speculation on the suspects of those unknown attacks. On the other hand, the unknown attacks in the 5th and the 22th clusters have completely different Type I and Type II suspects. The reason for this inconsistency is that in the k-mode clustering algorithm, the condition for stopping the calculation is that is the smallest for all terrorist incidents and cluster centers rather than the minimum dissimilarity score of each and This causes that some incidents are not assigned to the cluster with the smallest dissimilarity score. In addition, in this paper, we did not directly compare the dissimilarity for each and all This is because in the database, some suspects only have involved a few terrorist attacks. For example, the Incel extremists only have three attacks in the record. These data are not sufficient to fully depict the suspect's crime pattern. Therefore, we first cluster all the terrorist incident data and then compare the dissimilarity of each and all in the cluster to which belongs. This method saves as much information as possible for all incidents.

In this paper, we use the k-mode algorithm to cluster terrorist incident data. During the clustering process, we assume that all the attributes of the incident that we use are independent. However, these attributes may actually be related to each other, such as the type of attack and the type of weapon. A possible future work is to further refine or combine the attributes of terrorist incidents and then obtain more effective clustering results. In addition, we treat each terrorist incident as an independent incident in this article. However, in real a terrorist attack may consist of multiple attacks, which means that certain terrorist incident data are relevant. For example, the famous 9/11 incident consisted of four attacks, corresponding to 4 incident data in the database. In the future, we may further sort the original data, classify incidents that may be consecutive attacks, and then analyzed and inferred to obtain better results. In this paper, we have only studied the unknown terrorist attacks in the United States. In the future, we could also study the unknown terrorist attacks in other countries. However, due to political, economic and religious differences, the characteristics of suspects may change, and the selection of suspect identification parameters may need to be modified accordingly.

Acknowledgements

This work was partly supported by Natural Science Foundation of China (41601600) and Research Project of Jiangxi Provincial Department of Education (GJJ170824, GJJ150995).

References