Master of Science

1
DATA MINING AND TERRORISM

Margaret H. Dunham CSE Department Southern
Methodist University Dallas, Texas
75275 mhd_at_engr.smu.edu 11/5/05 This material is
based upon work supported by the National Science
Foundation under Grant No. 9820841

2
Data Mining Introductory and Advanced Topics, by
Margaret H. Dunham, Prentice Hall, 2003. DILBERT
reprinted by permission of United Feature
Syndicate, Inc.
3
OBJECTIVE

• Explore the use of data mining techniques in
  identifying terrorists and criminals.

4
Data Mining

• Finding hidden information in a database
• Fit data to a model
• Similar terms
• Exploratory data analysis
• Data driven discovery
• Deductive learning
• Knowledge Discovery in Databases

5
PROBLEMS

• Not well defined
• Not enough historical data
• Algorithms not well suited

http//www.fbi.gov/congress/congress02/thomas03010
2.htm
Select name From Where job
Emp Programmer
??? Terrorist
6
FBI

• FBI Strategic Focus
• http//edition.cnn.com/TRANSCRIPTS/0205/29/se.01.h
  tml
• Substantially enhance analytical capabilities
  with personnel and technology
• Expand use of data mining, financial record
  analysis, and communications analysis to combat
  terrorism

7
(No Transcript)
8
But it isnt Magic

• You must know what you are looking for
• You must know how to look for you

• Suppose you knew that a specific cave had gold
• What would you look for?
• How would you look for it?
• Might need an expert miner

9
Dallas Morning News October 7, 2005
10
http//ieeexplore.ieee.org/iel5/6/32236/01502526.p
df?tparnumber1502526isnumber32236
11
BIG BROTHER ?

• Total Information Awareness
• http//infowar.net/tia/www.darpa.mil/iao/index.htm
  
• http//www.govtech.net/magazine/story.php?id45918
  
• http//ouray.cudenver.edu/ejswenso/ethics/tia/dis
  play.php/display.php?id0
• http//www.frontpagemagazine.com/Articles/ReadArti
  cle.asp?ID13053
• http//en.wikipedia.org/wiki/Information_Awareness
  _Office
• Terror Watch List
• http//www.washingtontimes.com/national/20040222-1
  22717-6118r.htm
• http//www.businessweek.com/technology/content/may
  2005/tc20050511_8047_tc_210.htm
• http//www.gao.gov/new.items/d03322.pdf
• http//www.theregister.co.uk/2004/08/19/senator_on
  _terror_watch/

12
If it looks like a duck,
walks like a duck, and quacks
like a duck, then its a duck.
If it looks like a terrorist,
walks like a terrorist, and
quacks like a terrorist, then its
a terrorist.
Classification Clustering Link Analysis
(Profiling) (Similarity)
13
(No Transcript)
14
For a Terrorist, Similarity with What??? Distance
from What???

• Typically distance from a representative of that
  class.
• A known terrorist?
• TSA
• http//www.theregister.co.uk/2004/04/26/airport_se
  curity_failures/
• http//www.heritage.org/Research/HomelandDefense/B
  G1683.cfm
• http//www.theregister.co.uk/2004/07/16/homeland_c
  apps_scrapped/
• http//en.wikipedia.org/wiki/CAPPS

15

• http//www.ccmep.org/2003_articles/Iraq/020703_pow
  ell_offers_proof_of_saddam.htm

16
Jialun Qin, Jennifer J. Xu, Daning Hu,
Marc Sageman and Hsinchun Chen, Analyzing
Terrorist Networks A Case Study of the Global
Salafi Jihad Network  Lecture Notes in Computer
Science, Publisher Springer-Verlag GmbH, Volume
3495 / 2005 , p. 287.
17

• Thank You