A first approach to resolving ambiguity in hidden terrorist group detection in communications networks

Abstract

One of the most challenging problems in detecting terrorist groups in communications networks is that of identity ambiguity. Node identification mechanisms for modern communications networks can range from a mobile phone number to an email address, IP-address or VoIP account name, meaning that terrorist group members can easily assume a new network identification or possess multiple identifications simultaneously. To compound matters, terrorists are also known to employ sparse pseudorandom communication patterns while maintaining constant connectivity between group members. We are interested to address the issue of correctly identifying members of a hidden terrorist group after a change of identification has occurred. We propose a method we call implied connections as a first approach to resolving such ambiguity. We begin by collecting connectivity information over an m-size neighbourhood for each node in a network over a specified observation period. This information is then converted to a weighted graph of unobserved but potential relationships between nodes we call implied connections. The method of implied connections is tested on two real-life dynamic networks derived from mobile phone and Internet traffic data consisting of approximately 10,000 and 2,000,000 unique nodes respectively. For each network type we construct two graphs of implied connections to capture network characteristics of interest before and after a suspected change of identification has occurred. We then adapt a method of inexact subgraphs similarity and calculate β-signatures for both the subgraphs of implied connections of the network member with a new identity as well as potential candidates for the original network identity. As such, a β-signature is calculated as a column vector of probabilities of the next connection of a chosen network member to any other member of their m-size neighbourhood. Following calculation of the β-signatures, we find the best match between subgraphs of implied connections based on Euclidean distance as defined in the multi-dimensional space of the subgraphs members. Individuals whose subgraphs are of higher similarity, that is, have shorter a distance between their β-signatures, are considered more likely to be the same person. Our results indicate that an analysis of implied connections improves the characterisation of the relationships between nodes and substantially increases the probability of correctly identifying members of the terrorist group after an identity change has occurred.