Download terr - Southern Methodist University

DATA MINING AND
TERRORISM
Margaret H. Dunham
CSE Department
Southern Methodist University
Dallas, Texas 75275
[email protected]
11/5/05
11/05/05
This material is based upon work supported by the National Science Foundation under
SMU Homecoming
Grant No. 9820841
1
Data Mining Introductory and Advanced Topics, by Margaret H. Dunham, Prentice Hall, 2003.
DILBERT reprinted by permission of United Feature Syndicate, Inc.
11/05/05
SMU Homecoming
2
OBJECTIVE
Explore the use of data mining
techniques in identifying terrorists and
criminals.
11/05/05
SMU Homecoming
3
Data Mining
 Finding hidden information in a database
 Fit data to a model
 Similar terms
 Exploratory data analysis
 Data driven discovery
 Deductive learning
 Knowledge Discovery in Databases
11/05/05
SMU Homecoming
4
PROBLEMS
 Not well defined
 Not enough historical data
 Algorithms not well suited
http://www.fbi.gov/congress/congress02/thomas030102.htm
Select name
Emp
From ???
Where job = “Terrorist”
“Programmer”
11/05/05
SMU Homecoming
5
FBI
FBI Strategic Focus
http://edition.cnn.com/TRANSCRIPTS/0205/29/se.0
1.html
“Substantially enhance analytical capabilities with
personnel and technology”
“Expand use of data mining, financial record
analysis, and communications analysis to
combat terrorism”
11/05/05
SMU Homecoming
6
11/05/05
SMU Homecoming
7
But it isn’t Magic
 You must know what you are looking for
 You must know how to look for you
Suppose you knew that a specific cave had
gold:
• What would you look for?
• How would you look for it?
• Might need an expert miner
11/05/05
SMU Homecoming
8
Dallas Morning News
October 7, 2005
11/05/05
SMU Homecoming
9
11/05/05
SMU Homecoming
10
http://ieeexplore.ieee.org/iel5/6/32236/01502526.pdf?tp=&arnumber=1502526&isnumber=32236
BIG BROTHER ?
 Total Information Awareness

http://infowar.net/tia/www.darpa.mil/iao/index.htm

http://www.govtech.net/magazine/story.php?id=45918

http://ouray.cudenver.edu/~ejswenso/ethics/tia/display.php/display.ph
p?id=0

http://www.frontpagemagazine.com/Articles/ReadArticle.asp?ID=130
53

http://en.wikipedia.org/wiki/Information_Awareness_Office
 Terror Watch List

http://www.washingtontimes.com/national/20040222-1227176118r.htm

http://www.businessweek.com/technology/content/may2005/tc20050
511_8047_tc_210.htm

http://www.gao.gov/new.items/d03322.pdf

http://www.theregister.co.uk/2004/08/19/senator_on_terror_watch/
11/05/05
SMU Homecoming
11
“If it looks like a terrorist,
duck,
walks like a terrorist,
duck, andand
quacks like a terrorist,
duck, then
then
it’s a terrorist.”
duck.”
Description
Behavior
Classification Clustering
(Profiling)
(Similarity)
11/05/05
SMU Homecoming
Associations
Link Analysis
12
11/05/05
SMU Homecoming
13
For a Terrorist, Similarity with What???
Distance from What???
 Typically distance from a representative of that class.
 A known terrorist?
 TSA

http://www.theregister.co.uk/2004/04/26/airport_security
_failures/

http://www.heritage.org/Research/HomelandDefense/B
G1683.cfm

http://www.theregister.co.uk/2004/07/16/homeland_cap
ps_scrapped/

http://en.wikipedia.org/wiki/CAPPS
11/05/05
SMU Homecoming
14
“Proof” that Bin Laden was
involved in 9/11
 http://www.ccmep.org/2003_articles/Iraq/020703_powell_offers_pr
oof_of_saddam.htm
11/05/05
SMU Homecoming
15
11/05/05
SMU Homecoming
Jialun Qin, Jennifer J. Xu, Daning Hu,
Marc Sageman and Hsinchun Chen,
“Analyzing Terrorist Networks: A Case Study
of the Global Salafi Jihad Network” Lecture
Notes in Computer Science,
16
Publisher: Springer-Verlag GmbH, Volume
3495 / 2005 , p. 287.
11/05/05
SMU Homecoming
17