Stochastic Methods for Analyzing Violent Behavior in Social Networks

1. Yuriy V. Kostyuchenko*, Maxim Yuschenko, Viktor Pushkar, Olga Malysheva National Academy of Sciences of Ukraine, National University of Kyiv On the methodology of application of the stochastic methods of analysis of big data from social networks to control of indicators of the violent behavior Terrorism and Social Media, Swansea University Bay Campus, 25th-26th June 2019, Panel 5D: Computer-assisted methods and studies

2. Study Objectives Study aimed to the analysis and modeling of social dynamics in the crisis regions under the impact of illegal armed groups and massive information influences, including the social networks. As a methodological base of this analysis a number of algorithms for identifying the indicators of violent behavior and terrorism in social networks are proposed. Methods and algorithms for spatial and temporal regularization of initial data and the resulting distributions are proposed. Different scenarios of behavior of various groups of local population are included into proposed adaptive dynamic model, based on the combined stochastic model of Lotka-Volterra. Quantitative methods for assessing the perception and communication of risks that affect the crisis behavior under information attacks are proposed in the framework of this model. Form of the integrated risk function is proposed. For the calibration and verification of the proposed algorithms and models, data of the conflict in the Donbas, eastern Ukraine 2014-2017, were utilized. The suitable variables have been defined and the volume of the data required to monitoring and control the state of crisis areas is determined. Besides, comparative analysis with IS were made. Proposed adaptive model also can be used as an interpretation approach for analyzing data on the behavior of various groups in social networks in various crisis regions.

3. Methodology: General Approach The task of proposed approach to data analysis is to understand a group behavior and to identify the indicators of violent behavior analyzing social network data in the context of multi-source data and with interpretational behavioristic models.

4. Methodology: Data clustering approach Analysis of data by groups and its dynamics can be reducing and solved as the task of clustering of information in communication network -cohesiveness of clusters; -the distance between clusters; -mutual information (MI) - the amount of information that two random variables share; - normalized by mutual information measure (indicates high similarity between communities found). Kostyuchenko, Y. V., Yuschenko, M., & Kopachevsky, I. (2018). Stochastic approaches to analysis and modeling of multi-sources and big data in tasks of homeland security: socio-economic and socio-ecological crisis control tools.Advanced Mathematical Techniques in Science and Engineering, 57.

5. Methodology: Data classification approach - Bayes rule approach to assigns to the community of studied data - Markov random field framework to model the statistical relationships between the class labels of spatially distinct member and to provide a computationally affordable solution to the classification problem - the probability distribution of each general community label As the result of classification we obtain a dataset with all records that meet the specified condition. For example, distribution of members of community “infant participant of illegal armed groups” with age, sex, social status, accessory, spatial and temporal marks inside the general community of members of illegal armed groups’ combatants. Kostyuchenko, Y. V., Yuschenko, M., & Kopachevsky, I. (2018). Stochastic approaches to analysis and modeling of multi-sources and big data in tasks of homeland security: socio-economic and socio-ecological crisis control tools.Advanced Mathematical Techniques in Science and Engineering, 57.

6. Methodology: Data regularization algorithm - determination of investigated parameters distributions towards distributions on measured sites (step 1 of the regularization procedure) - modified kernel principal component analysis (KPCA) (step2 of the regularization) Kostyuchenko, Y. V., Yuschenko, M., Movchan, D., & Kopachevsky, I. (2017, October). Analysis of economic values of land use and land cover changes in crisis territories by satellite data: models of socio-economy and population dynamics in war. In Earth Resources and Environmental Remote Sensing/GIS Applications VIII (Vol. 10428, p. 104280C). International Society for Optics and Photonics.

7. Interpretative Models: Adaptive Social Dynamics Modified Lotka-Volterra stochastic model for competition strategy analysis - the risk perception function - risk functions - general equation of competition and mutualism models of interaction between resident and invaders communities Kostyuchenko, Y. V., Pushkar, V., Malysheva, O., & Yuschenko, M. (2019). Big Data Analysis for Terroristic Behavior Identification and Study Using Social Networks: Illegal Armed Groups During the Conflict in Donbas Region (East Ukraine). In Developments in Information Security and Cybernetic Wars (pp. 197-235). IGI Global.

8. Case Study: Donbas Armed Conflict, Ukraine By the requested hashtag over 21,500 profiles in social networks (VK, Facebook, Instagram, Twitter) in five languages (Russian, Ukrainian, English, Serbian and German) has been analyzed. Following hashtags were used: #донбасс(Donbas), #новороссия(NovoRossia), #героиновороссии(NovorossiaHeroes), #днр(dpr – Donetsk people republic), #память(Memory) After filtration procedure were collected more than 580,400 entries from 6,220,000 entries satisfied to determined criteria among the 1,880,300 profiles and groups analyzed. Kostyuchenko, Y. V., & Yuschenko, M. (2017). Methods and Tools of Big Data Analysis for Terroristic Behavior Study and Threat Identification: Illegal Armed Groups during the Conflict in Donbas Region (East Ukraine) in Period 2014-2015. InThreat Mitigation and Detection of Cyber Warfare and Terrorism Activities (pp. 52-66). IGI Global.

9. Identification of structure of illegal armed groups Detected nationality of members of illegal armed groups (A – general distribution, B – other countries distribution)

10. Child soldiers detection in the conflict zone Konstantin Kiyko, 17, Bashkortostan, Russia, KIA 2014 The age distribution of underage members of illegal armed groups in 2014 and 2015 Yevgeniy Korobov, 16, Volgograd, Russia, KIA 2014 The gender distribution of underage members of illegal armed groups in 2014 and 2015 Kostyuchenko, Y. V., & Yuschenko, M. (2017). Toward Approaches to Big Data Analysis for Terroristic Behavior Identification: Child Soldiers in Illegal Armed Groups During the Conflict in the Donbas Region (East Ukraine). International Journal of Cyber Warfare and Terrorism (IJCWT), 7(1), 1-12.

11. Child soldiers detection in the conflict zone Almas Makhmudov, 18, Bashkortostan, Russia, KIA 2015 Distribution of social status and origin of underage members of illegal armed groups in 2014 and 2015 Andriy “Ros”, 14, with friends in camp of IAG “Vostok”, 2014 Distribution of citizenship of underage members of illegal armed groups in 2014 and 2015

12. Identification of Drivers of Violent Behavior The warnames of 32,000 fighters were analyzed as the signs to their identity, which may be considered as the driver of the violent behavior

13. Comparative Analysis of Composition of Illegal armed groups in Syria and Ukraine Using proposed tools about 700 fighters of IS and L/DNR has been interviewed. The similarity of their narratives was found: the structural, figurative and lexical similarity of stories, told by the participants of the IS and L/DPR. This testifies to the similarity of the internal logic of the conflict, to the common driving forces of terrorism on a global scale. Also some important conclusions on the composition of the terroristic groups can be made. Distribution of respondents by country of origin/citizenship Kostyuchenko, Y., Yuschenko, M., & Artemenko, I. (2018). On Experience of Social Networks Exploration for Comparative Analysis of Narratives of Foreign Members of Armed Groups: IS and L/DPR in Syria and Ukraine in 2015-2016. International Journal of Cyber Warfare and Terrorism (IJCWT), 8(2), 17-31.

14. Comparative Analysis of Syria and Ukraine Conflicts Distribution of respondents by age: a) IS, b) L/DPR Distribution of respondents by role: a) IS, b) L/DPR

15. Conclusions & Discussion The multisource data including social network and other big data should be involved into consideration. It requires development of special methodology. These approaches and algorithms should be focused on wide range of data, including issues of group behavior. However, the specific of big data requires application of correct techniques of data collection, processing and analysis. In this context, it is important not only to correctly collect and filter the data, but also to apply the regularization procedure, which will provide regular spatially-temporally distributed data, mutually verified, with controlled reliability. For data filtering and classification has been proposed an approach based on the Bayes rule for minimum classification error in terms of maximum-a-posterior decision task in Markov random field model representation of multi-temporal, multi-source data. As the result of classification we obtain a dataset with all records that meet the specified condition. For collected, filtered and classified data regularization it has been proposed non-linear kernel-based principal component algorithm (KPCA) based method, modified according to specific of data. Using this algorithm was obtained regularized spatial-temporal distributions of investigating parameters over the whole observation period with rectified reliability and controlled uncertainty, prepared for the interpretation. Thus, application of the proposed method resulting to distribution, which cannot be obtained by another way, at least during the active conflict. We can recognize a calculated data as unique, reliable, and meaningful and has a sense as evidence, rather than fragmentary information from unknown and unconfirmed sources.

16. Conclusions & Discussion First of all, the analyzed war in the Donbas can not be described as an internal or civil conflict in Ukraine in any case. It should be analyzed as a form of aggression of Russia against Ukraine, and thus should be interpreted as a special form of asymmetric conflict (Münkler, 2005) with using of hybrid instruments (Schroefl, Kaufman, 2014) between Ukraine and Russia (Kofman, Rojansky, 2015). This is evidenced by the resources supply: more than 80% of the financial, and more than 60% of military, technical and human resources of illegal armed groups is supplied by Russia. The external character of the conflict is confirmed by distribution of detected losses of illegal armed groups, more than 60% of which are citizens of Russia and Russian military personnel. It may be noted, that the conflict has no clearly expressed ethnic or linguistic attributes. There are weak indicators of socio-cultural differences, expressed in the patterns of behavior and perception of threats, detected also in land-use features. The biggest indicator of conflict driver is the logistics parameters: the conflict zone extends to 35-40 km along and around the roots of delivery from the territory of Russian Federation the resources for illegal armed groups. The propaganda should be recognized as an instrument of aggression. Propaganda is a way to recruiting local population to collaboration with hybrid occupational forces. Study shows that involvement of children into illegal armed groups is usual practice in the studied conflict: in the framework of the conflict in Donbas, the practice of using children as soldiers and military personnel widely used – both by Russian military troops and Russian supported illegal armed groups mixed from Russian mercenaries and local collaborators. Mass systematic use of persons under 18 as soldiers and military personnel during the conflict proves that we are dealing with a classic terrorist organization, controlled, managed and supported by Russia. Taking into account the nature of modern conflict, the most important task of data analysis and interpretation is the comprehensive and equi-resistance protection of civil population. The task of the conflict solving without further escalation, fighting intensifying, with losses minimization, and with improvement of security and living standards, requires the understanding of parameters of the conflict and the social dynamics of the region. The proposed methodology and the set of interlinked algorithms of data processing are directed to the solving of this task.

17. Acknowledgement The authors are deeply grateful to colleagues from the American Statistical Association (ASA), Canadian Network for Research on Terrorism Security and Society (TSAS), and National Academy of Sciences of Ukraine for their critical and constructive comments and suggestions that resulted in important improvements to the study. Particular thanks authors express to colleagues from International Institute for Applied Systems Analysis (IIASA, Vienna, Austria) and Pylyp Orlyk Institute for Democracy (Kiev, Ukraine) for continuous support of this activity, as well as for the provided data and fruitful discussions resulted to improvement of methodology.