1 / 42

Feature Selection, Prediction, and Change Detection in Terrorist/Insurgency Processes Using a Spatial Point Process Appr

Feature Selection, Prediction, and Change Detection in Terrorist/Insurgency Processes Using a Spatial Point Process Approach. Michael D. Porter and Donald E. Brown {mdp2u,brown}@virginia.edu Department of Systems and Information Engineering University of Virginia. Agenda. Problem Statement

kovit
Download Presentation

Feature Selection, Prediction, and Change Detection in Terrorist/Insurgency Processes Using a Spatial Point Process Appr

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Feature Selection, Prediction, and Change Detection in Terrorist/Insurgency Processes Using a Spatial Point Process Approach Michael D. Porter and Donald E. Brown {mdp2u,brown}@virginia.edu Department of Systems and Information Engineering University of Virginia

  2. Agenda • Problem Statement • Approach & Specification • Feature Selection (Review) • Prediction (Review) • Change Detection • IED Example /42

  3. Terrorism Against the U.S. • Terrorist attacks take many forms • suicide bombings • improvised explosive devices • hostage taking • mortar & rocket attacks • Complex attacks • The incident on the right was a suicide bombing at a police station in Iraq that occurred on February 12, 2004 & killed 47 people • How can we become proactive in addressing these threats? Hull, Bryson, “100 die in two Iraq suicide bombings,” The Age, February 12, 2004, http://www.theage.com.au/ /42

  4. Modeling Terrorism and Insurgency PREDICTION • Proactive in force deployment • Awareness of threat locations and levels • Should include terrorist decision making CHANGE DETECTION • New terrorist group • Interventions effects (arrests, patrols, etc) • New terrorist strategy/preferences /42

  5. Intelligent Site Selection Assumptions: • Terrorists judiciously plan the location of their attacks according to their preferences or perceived utility of that location • Site selection is not made by considering spatial coordinates alone • Site selection is made based on the attributes or features of each possible location • Capturing these features that are considered by the terrorist will lead to better (more accurate) models /42

  6. Criminal Ecological Theory • In criminology, ecological theories seek to describe the motivations and acts of crime based on the general features of one’s environment • Environment of criminal • Environment of crime scene • This points to the explanation that there are some features of the location of crimes which are important to criminal decision making • We extend this thought to terrorist decision making /42

  7. Feature Set • To successfully model the terrorist attacks, we should attempt to model their decision making process or preferences for attack locations • Thus we include features that are thought to influence the terrorist site selection process (or that are associated (correlated) with such features) in our models • Since we usually don’t know the terrorist’s preferences we must discover these from previous attack locations • Observe past attack locations and associated feature values for that location • Examples of possible features • Census (Socio-economic) • Proximity (Distance to landmarks or structures) • Military or Police Patrols (times and locations) /42

  8. Point Processes • A stochastic model governing the location and number of events in some set X [Cressie, 1993] • A point process P = {xi : xi X }, where the xi are the events and Xis the set over which the point process is defined • Specified by where - mean measure and  - intensity function • (Poisson) /42

  9. Spatially Defined Point Processes • For spatially defined PP, events are located in a bounded plane, A  2 • where A is the study region and the events are • In our processes, time cannot be ignored • Spatio-temporal model (full model) • Spatial model (time integrated out) • Time series model (space integrated out) Spatial Density (Preferences) Temporal Rate /42

  10. Feature Space • The feature spaceG, defines the additional attribute information relating to the locations in the study region • g(s,t)=[g1(s,t),g2(s,t),…,gp(s,t)] • G defines p other spatially defined stochastic processes • Real (perhaps discrete), ordered, or categorical valued • High Dimensional (large p) • The PP is specified conditionally on the values of the other stochastic processes • The intensity is dependent upon the feature values (s,t)  (s,t|g(s,t)) /42

  11. Feature Space Formulation • Since we condition on the value of g it is assumed that given any (s,t), the value g(s,t) can be determined • Using GIS • (s,t)=h(g(s,t)) • g is a realization of G • h is the function we want to determine • Two ways to examine model • Define the PP in feature space • Look at association between PP and random processes /42

  12. Overview of the point process model Liu and Brown 1999 /42

  13. Spatial Association / Feature Selection • Find the features that are associated with the point process • Correlated with PP, but not necessarily causal • This is preference discovery • Two procedures • Find important features • Remove redundant (correlated) features Important Features(Foxall and Baddeley 2002) • J(r)=[1-G(r)]/[1-F(r)] =Pr(event>r)/Pr(grid>r) • J®<1 suggests attraction, J>1 suggests repulsion • Feature is important if J(r) is much different than 1 for small r /42

  14. Values much lower that 1 suggest the PP is associated with feature g5 Values close to 1 suggest the PP is not associated with feature g6

  15. Removing Redundant Features • If a feature is redundant, its intensity can be explained by another feature • Rescaling Theorem • Rescale events {ei}  {ei’} so ei’ form homogeneous Poisson with rate =1 • Estimate intensity based on one feature m (perhaps the most important from the last step) • Use this to test for homogeneity of rescaled events in feature k (Let rki=gk(si) ) (Diggle, 1985 Applied Statistics) /42

  16. Redundant Features – con’t • Tests for homogeneity or uniform • K function (Cressie 1993) • Nearest Neighbor • KS • Scan Statistics /42

  17. Prediction • Build space-time prediction model (s,t+1 | g(s,t), t) where t is the history of the PP up to time t Possible assumptions: • Feature values stationary / deterministic • Implies g(s,t)=g(s) for all t • Intensity (or preferences) stationary for next time period • Implies (s,t+1)=(s,t) or f(s|t+1)=f(s|t) • Intensity is space-time separable • Implies (s,t+1)=f(s)A(t+1) • Model spatial as density and temporal as time series /42

  18. Prediction Models • Poisson/ regression • Log{(s)}=0 + 1 g1(s)+ 2 g2(s)+ . . . • Should use GAM or transformation since distribution of g is non-uniform on A • Mixed models1 • (s)=ifi(s;i) • Spatial Choice Models2 1 Liu,H. and Brown, D.E. (2004). A New Point Process Transaction Density Model for Space-Time Event Prediction. Systems, Man and Cybernetics, Part C, IEEE Transactions on, Volume 34,  Issue 3, Pg.310 - 324 2 Smith, M.A. (2005). CHOICE MODELING OF BOMBING ATTACK SITE SELECTION, Masters Thesis, Dept of Systems and Information Engineering, University of Virginia, May. /42

  19. Change Detection • Statistically detect a region, B, of change between two time periods • Detect changes between two spatial point processes • Steps • Form hypothesis test • Select an appropriate test statistic to test hypothesis • Specify how region B will be identified for testing • Establish significance testing • Evaluate the results • Method also applicable for detecting differences between two types of events or case-control studies /42

  20. Formulation: Marked Point Process Let the terrorist process be represented by P ={(si,ki)}, a marked PP on space X = AxK, A2, K={1,2} Assuming the ground process is a nonhomogeneous Poisson spatial PP and the marks are independent of each other, P can be specified by: An observation is: /42

  21. Hypothesis Test (Assuming equal time periods and no temporal trends) If unequal time periods or temporal trends, set where i is the time period i. Then under the null: * If unequal time periods and no trends, T(1 )/ T(2 )=(1)/(2), where (i) is the length of time period i. Change Detection 1) Hypothesis test 2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  22. Hypothesis Test (Assuming equal time periods and no temporal trends) Change Detection 1) Hypothesis test 2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  23. Hypothesis Test (Assuming equal time periods and no temporal trends) Change Detection 1) Hypothesis test 2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  24. Statistical Test – Generalized Likelihood Ratio { Assuming equal time periods and no temporal trends Change Detection 1) Hypothesis test 2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  25. Finding Change Region • B defines the geographical region in A where change has occurred in the intensity function of the point process • For testing the null hypothesis, (s)= Ho, we must identify the region B • We do this by searching over A for the region B* that provides the minimum value of T(,B) • Procedure of scanning for extrema regions for significance testing is termed scan process (e.g. scan statistic) Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B4) Significance test 5) Evaluate /42

  26. Scan Process • In general, scan processes are used to detect significant clusters of events while accounting for multiple hypothesis testing • Create a window, Wx of some geometry and move it over the entire region of interest (x X) and calculate some score for each window, S(Wx). • The multiple hypothesis problem is resolved by testing on the scan statistic, SS=maxxX S(Wx) • Dependent on geometry selected for W • But multiple geometries can be considered Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B4) Significance test 5) Evaluate /42

  27. Modified Scan Process for Change Detection • Here, we want to find window location and geometry producing the minimum value of the likelihood ratio statistic • Thus our scan statistic becomes SS() = minBB T(,B) = T(,B*) where B is the set of windows that we searched over • The windows are restricted to be connected sets in map and feature space (i.e. BX=AxG) • One change region • Hyper-rectangles in the real variables • No restriction on size of window Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B4) Significance test 5) Evaluate /42

  28. Approximation to scan statistic • When the number of events and/or dimensionality of G is large, searching over all possible windows is computationally prohibitive. • Instead, find good approximation to scan statistic • Search over restricted set B’ B and hope this set includes B*, or a large portion of it • Use PRIM to search for B* and thus the value of our scan statistic Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B4) Significance test 5) Evaluate /42

  29. Patient Rule Induction Method (PRIM) • Patient Rule Induction Method • PRIM handles high-dimensional and mixed data well • Find the boxes (hyper-rectangles) where the response (i.e. T) is low • Procedure is to produce a series of boxes, {Bk}, decreasing in size, by successively peeling away a subbox in such a manner that each new box Bk+1 has the lowest value for T(,Bk+1) among all possible subboxes. Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B4) Significance test 5) Evaluate /42

  30. PRIM – con’t • Define the subboxes • xj(k) is the k–quantile of the xj values for the data within the current box Bk • k (0,1) dictates the size of the subboxes • The optimal subbox for peeling becomes (For catagorical variables) Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B4) Significance test 5) Evaluate /42

  31. PRIM – con’t • This creates a new box Bk+1 = Bk-bk* • Continue peeling until T can no longer be decreased beyond minimum at step k • After peeling procedure, pasting step can further improve box • Add subbox in similar manner as peeling • To help find global minimum, allow variable k and run PRIM for J iterations • Produces • Leads to test of significance of for change in region Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B4) Significance test 5) Evaluate /42

  32. Significance – Monte Carlo Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  33. Simulated Example • Examine region A on unit square • Six features identified: G=[g1,g2,…,g6] • Features {g1,g2,g3,g6} are proximity to nearest landmark • Features {g4,g5} are values of some variable recorded at census tract level • Group of insurgents operating in region A • 1(s)=exp{-cys2-c1g1(s)+c5g5(s)}/C1 • cy=0.5, c1=100, c5=1,C1=15.5 • E[N(A)]=100 • Random attacks with intensity r=15 • New group active in 2 • 2(s)=I(g2(s)0.10,g3(s)0.05, g4(s)0.30)/C2 • I is indicator function and C2=12 • E[N2(A)]=35 Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  34. Simulated Feature Values Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  35. Procedure • Thus, (s,k=1)= 1(s)+ r for 1 and (s,k=2)= 1(s)+ r + 1(s) for 2 • Let (1)=(2) so under null, (s)=1 everywhere in A • Generate 100 realizations of the PP and for each apply PRIM with k [0.05,0.15] • For each original observation J=500 iterations were performed • For each realization of the simulated PP, 99 simulations under H0 are created by random labeling with f(k=i|s)=0.50 and p-values are calculated • Results in set Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  36. Measures • Let Ei be the events from insurgency group i, with random events assigned to group 1 • (R2,R4) – region where change occurs • (R1,R3) – events that constitute change Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  37. Results ROC PD-Prob to Detect Detection declared if Change Detection 1) Hypothesis test2) Test statistic 3) Identify region B 4) Significance test 5) Evaluate /42

  38. IED Attacks in Iraq • Major method of attacking U.S. forces in Iraq • Responsible for more U.S. deaths than any other attack mode • Inexpensive, easy to deploy, and deadly • Picture on right shows U.S. troops with IED on March 15, 2004 Picture from http://www.middle-east-online.com/english/?id=9250 /42

  39. IED Change Region • N1=151 events, N2=91 events • |1|=|2| • J=500, M=999 Monte Carlo /42

  40. IED Change Region - con’t • Region B* contains 48 events from 1 and 0 events from 2 • PRIM peeled 16 times on 14 features • B* composes approx. 21% of the total area of A • Estimated p-value is 0.001 so reject null and conclude change has occurred in region B* /42

  41. Conclusions • Modeling terrorist processes is difficult yet important • Point process approach provides small scale analysis • Including terrorist decision making process leads to better models • Non-model based change detection method can detect presence of new terrorist group or changing terrorist attack strategies /42

  42. Background: Recent papers modeling criminal or terrorist attacks • Y. Xue and D.E. Brown, “Spatial Analysis with Preference Specification for Latent Decision Makers for Criminal Event Prediction,” Decision Support Systems, forthcoming. • Porter, M.D. and Brown, D.E., “Detecting Local Regions of Change in High-Dimensional Criminal or Terrorist Point Processes”, forthcoming • Porter, M.D. and Brown, D.E., “Finding Changing Crime Regions: Use of High Dimensional Geographic Feature Space and Classification Trees”. Proceedings of the Eight Crime Mapping Research Conference, Sept. 7-10, 2005 Savannah, GA. • Smith, M.A., “Choice Modeling of Bombing Attack Site Selection,” Masters Thesis, Dept of Sys. and Info Engineering, University of Virginia, May 2005. • H. Liu and D.E. Brown, “A New Point Process Transition Density Model for Space-Time Event Prediction,” IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews,Vol.34, No.3, 2004, pp. 310-324. • D.E. Brown, J. Dalton, and H. Hoyle, “Spatial Forecast Methods for Terrorist Events in Urban Environments,” Second NSF/NIJ Symposium on Intelligence and Security Informatics, Tucson, AZ, June 2004, pp. 426-435. • Liu, H. and D.E. Brown, “Criminal Incident Prediction Using a Point-pattern Based Density Model” Int. Journal of Forecasting, vol. 19 (4), 2003, pp. 603-622. • Xue, Y. and D.E. Brown, “A Decision Model for Spatial Site Selection by Criminals: A Foundation for Law Enforcement Decision Support,” IEEE Transactions on System, Man, and Cybernetics, Part C: Applications and Reviews, Vol. 33, No. 1, February 2003, pp. 78-85. /42

More Related