2. 11/05/05SMU Homecoming1 DATA MINING AND TERRORISM Margaret H. Dunham CSE Department Southern Methodist University Dallas, Texas 75275 mhd@engr.smu.edu 11/5/05 This material is based upon work supported by the National Science Foundation under Grant No. 9820841

3. 11/05/05SMU Homecoming2 Data Mining Introductory and Advanced Topics, by Margaret H. Dunham, Prentice Hall, 2003. DILBERT reprinted by permission of United Feature Syndicate, Inc.

4. 11/05/05SMU Homecoming3 OBJECTIVE Explore the use of data mining techniques in identifying terrorists and criminals.

5. 11/05/05SMU Homecoming4 Data Mining nFinding hidden information in a database nFit data to a model nSimilar terms n Exploratory data analysis n Data driven discovery n Deductive learning n Knowledge Discovery in Databases

6. 11/05/05SMU Homecoming5 PROBLEMS nNot well defined nNot enough historical data nAlgorithms not well suited Select name From Where job = Emp “Programmer” ??? “Terrorist” http://www.fbi.gov/congress/congress02/thomas030102.htm

7. 11/05/05SMU Homecoming6 FBI FBI Strategic Focus http://edition.cnn.com/TRANSCRIPTS/0205/29/se.0 1.html “Substantially enhance analytical capabilities with personnel and technology” “Expand use of data mining, financial record analysis, and communications analysis to combat terrorism”

8. 11/05/05SMU Homecoming7

9. 11/05/05SMU Homecoming8 But it isn’t Magic nYou must know what you are looking for nYou must know how to look for you Suppose you knew that a specific cave had gold: What would you look for? How would you look for it? Might need an expert miner

10. 11/05/05SMU Homecoming9 Dallas Morning News October 7, 2005

11. 11/05/05SMU Homecoming10 http://ieeexplore.ieee.org/iel5/6/32236/01502526.pdf?tp=&arnumber=1502526&isnumber=32236

12. 11/05/05SMU Homecoming11 BIG BROTHER ? nTotal Information Awareness n http://infowar.net/tia/www.darpa.mil/iao/index.htm http://infowar.net/tia/www.darpa.mil/iao/index.htm n http://www.govtech.net/magazine/story.php?id=45918 http://www.govtech.net/magazine/story.php?id=45918 n http://ouray.cudenver.edu/~ejswenso/ethics/tia/display.php/display.p hp?id=0 http://ouray.cudenver.edu/~ejswenso/ethics/tia/display.php/display.p hp?id=0 n http://www.frontpagemagazine.com/Articles/ReadArticle.asp?ID=130 53 http://www.frontpagemagazine.com/Articles/ReadArticle.asp?ID=130 53 n http://en.wikipedia.org/wiki/Information_Awareness_Office http://en.wikipedia.org/wiki/Information_Awareness_Office nTerror Watch List n http://www.washingtontimes.com/national/20040222-122717- 6118r.htm http://www.washingtontimes.com/national/20040222-122717- 6118r.htm n http://www.businessweek.com/technology/content/may2005/tc20050 511_8047_tc_210.htm http://www.businessweek.com/technology/content/may2005/tc20050 511_8047_tc_210.htm n http://www.gao.gov/new.items/d03322.pdf http://www.gao.gov/new.items/d03322.pdf n http://www.theregister.co.uk/2004/08/19/senator_on_terror_watch/ http://www.theregister.co.uk/2004/08/19/senator_on_terror_watch/

13. 11/05/05SMU Homecoming12 “If it looks like a duck, walks like a duck, and quacks like a duck, then it’s a duck.” Description BehaviorAssociations Classification Clustering Link Analysis (Profiling) (Similarity) “If it looks like a terrorist, walks like a terrorist, and quacks like a terrorist, then it’s a terrorist.”

14. 11/05/05SMU Homecoming13

15. 11/05/05SMU Homecoming14 For a Terrorist, Similarity with What??? Distance from What??? nTypically distance from a representative of that class. nA known terrorist? nTSA n http://www.theregister.co.uk/2004/04/26/airport_securit y_failures/ http://www.theregister.co.uk/2004/04/26/airport_securit y_failures/ n http://www.heritage.org/Research/HomelandDefense/B G1683.cfm http://www.heritage.org/Research/HomelandDefense/B G1683.cfm n http://www.theregister.co.uk/2004/07/16/homeland_cap ps_scrapped/ http://www.theregister.co.uk/2004/07/16/homeland_cap ps_scrapped/ n http://en.wikipedia.org/wiki/CAPPS http://en.wikipedia.org/wiki/CAPPS

16. 11/05/05SMU Homecoming15 “Proof” that Bin Laden was involved in 9/11 nhttp://www.ccmep.org/2003_articles/Iraq/020703_powell_offers_pr oof_of_saddam.htmhttp://www.ccmep.org/2003_articles/Iraq/020703_powell_offers_pr oof_of_saddam.htm

17. 11/05/05SMU Homecoming16 Jialun Qin, Jennifer J. Xu, Daning Hu, Marc Sageman and Hsinchun Chen, “Analyzing Terrorist Networks: A Case Study of the Global Salafi Jihad Network” Lecture Notes in Computer Science, Publisher: Springer-Verlag GmbH, Volume 3495 / 2005, p. 287.

18. 11/05/05SMU Homecoming17