DATA MINING AND TERRORISM

1. DATA MINING AND TERRORISM Margaret H. Dunham CSE Department Southern Methodist University Dallas, Texas 75275 mhd@engr.smu.edu 11/5/05 This material is based upon work supported by the National Science Foundation under Grant No. 9820841 SMU Homecoming

2. Data Mining Introductory and Advanced Topics, by Margaret H. Dunham, Prentice Hall, 2003. DILBERT reprinted by permission of United Feature Syndicate, Inc. SMU Homecoming

3. OBJECTIVE Explore the use of data mining techniques in identifying terrorists and criminals. SMU Homecoming

4. Data Mining • Finding hidden information in a database • Fit data to a model • Similar terms • Exploratory data analysis • Data driven discovery • Deductive learning • Knowledge Discovery in Databases SMU Homecoming

5. PROBLEMS • Not well defined • Not enough historical data • Algorithms not well suited http://www.fbi.gov/congress/congress02/thomas030102.htm Select name From Where job = Emp “Programmer” ??? “Terrorist” SMU Homecoming

6. FBI FBI Strategic Focus http://edition.cnn.com/TRANSCRIPTS/0205/29/se.01.html “Substantially enhance analytical capabilities with personnel and technology” “Expand use of data mining, financial record analysis, and communications analysis to combat terrorism” SMU Homecoming

7. SMU Homecoming

8. But it isn’t Magic • You must know what you are looking for • You must know how to look for you Suppose you knew that a specific cave had gold: • What would you look for? • How would you look for it? • Might need an expert miner SMU Homecoming

9. Dallas Morning News October 7, 2005 SMU Homecoming

10. SMU Homecoming http://ieeexplore.ieee.org/iel5/6/32236/01502526.pdf?tp=&arnumber=1502526&isnumber=32236

11. BIG BROTHER ? • Total Information Awareness • http://infowar.net/tia/www.darpa.mil/iao/index.htm • http://www.govtech.net/magazine/story.php?id=45918 • http://ouray.cudenver.edu/~ejswenso/ethics/tia/display.php/display.php?id=0 • http://www.frontpagemagazine.com/Articles/ReadArticle.asp?ID=13053 • http://en.wikipedia.org/wiki/Information_Awareness_Office • Terror Watch List • http://www.washingtontimes.com/national/20040222-122717-6118r.htm • http://www.businessweek.com/technology/content/may2005/tc20050511_8047_tc_210.htm • http://www.gao.gov/new.items/d03322.pdf • http://www.theregister.co.uk/2004/08/19/senator_on_terror_watch/ SMU Homecoming

12. Description Behavior Associations “If it looks like a terrorist, walks like a terrorist, and quacks like a terrorist, then it’s a terrorist.” “If it looks like a duck, walks like a duck, and quacks like a duck, then it’s a duck.” Classification Clustering Link Analysis (Profiling) (Similarity) SMU Homecoming

13. SMU Homecoming

14. For a Terrorist, Similarity with What??? Distance from What??? • Typically distance from a representative of that class. • A known terrorist? • TSA • http://www.theregister.co.uk/2004/04/26/airport_security_failures/ • http://www.heritage.org/Research/HomelandDefense/BG1683.cfm • http://www.theregister.co.uk/2004/07/16/homeland_capps_scrapped/ • http://en.wikipedia.org/wiki/CAPPS SMU Homecoming

15. “Proof” that Bin Laden was involved in 9/11 • http://www.ccmep.org/2003_articles/Iraq/020703_powell_offers_proof_of_saddam.htm SMU Homecoming

16. Jialun Qin, Jennifer J. Xu, Daning Hu, Marc Sageman and Hsinchun Chen, “Analyzing Terrorist Networks: A Case Study of the Global Salafi Jihad Network”  Lecture Notes in Computer Science, Publisher: Springer-Verlag GmbH, Volume 3495 / 2005 , p. 287. SMU Homecoming

17. Thank You SMU Homecoming