11/05/05 SMU Homecoming 1

DATA MINING AND DATA MINING AND TERRORISMTERRORISM

Margaret H. DunhamMargaret H. Dunham

CSE DepartmentCSE Department

Southern Methodist UniversitySouthern Methodist University

Dallas, Texas 75275Dallas, Texas 75275

mhd@engr.smu.edu

11/5/0511/5/05

This material is based upon work supported by the National Science Foundation under This material is based upon work supported by the National Science Foundation under Grant No. 9820841Grant No. 9820841

11/05/05 SMU Homecoming 2

Data Mining Introductory and Advanced Topics, by Margaret H. Dunham, Prentice Hall, 2003.

DILBERT reprinted by permission of United Feature Syndicate, Inc.

11/05/05 SMU Homecoming 3

OBJECTIVE

Explore the use of data mining techniques in identifying terrorists and criminals.

11/05/05 SMU Homecoming 4

Data Mining

Finding hidden information in a database Fit data to a model Similar terms

Exploratory data analysis Data driven discovery Deductive learning Knowledge Discovery in Databases

11/05/05 SMU Homecoming 5

PROBLEMS

Not well defined Not enough historical data Algorithms not well suited

Select name

From

Where job =

Emp

“Programmer”

???

“Terrorist”

http://www.fbi.gov/congress/congress02/thomas030102.htm

11/05/05 SMU Homecoming 6

FBI

FBI Strategic Focus

http://edition.cnn.com/TRANSCRIPTS/0205/29/se.01.html

“Substantially enhance analytical capabilities with personnel and technology”

“Expand use of data mining, financial record analysis, and communications analysis to combat terrorism”

11/05/05 SMU Homecoming 7

11/05/05 SMU Homecoming 8

But it isn’t Magic

You must know what you are looking for You must know how to look for you

Suppose you knew that a specific cave had gold:

• What would you look for?

• How would you look for it?

• Might need an expert miner

11/05/05 SMU Homecoming 9

Dallas Morning News

October 7, 2005

11/05/05 SMU Homecoming 10

http://ieeexplore.ieee.org/iel5/6/32236/01502526.pdf?tp=&arnumber=1502526&isnumber=32236

11/05/05 SMU Homecoming 11

BIG BROTHER ? Total Information Awareness

http://infowar.net/tia/www.darpa.mil/iao/index.htm http://www.govtech.net/magazine/story.php?id=45918 http://ouray.cudenver.edu/~ejswenso/ethics/tia/display.php/display.php?id=0 http://www.frontpagemagazine.com/Articles/ReadArticle.asp?ID=13053 http://en.wikipedia.org/wiki/Information_Awareness_Office

Terror Watch List http://www.washingtontimes.com/national/20040222-122717-6118r.htm http://www.businessweek.com/technology/content/may2005/tc20050511_80

47_tc_210.htm http://www.gao.gov/new.items/d03322.pdf http://www.theregister.co.uk/2004/08/19/senator_on_terror_watch/

11/05/05 SMU Homecoming 12

“If it looks like a duck,

walks like a duck, and

quacks like a duck, then

it’s a duck.”

Description Behavior AssociationsClassification Clustering Link Analysis (Profiling) (Similarity)

“If it looks like a terrorist,

walks like a terrorist, and

quacks like a terrorist, then

it’s a terrorist.”

11/05/05 SMU Homecoming 13

11/05/05 SMU Homecoming 14

For a Terrorist, Similarity with What??? Distance from What???

Typically distance from a representative of that class. A known terrorist? TSA

http://www.theregister.co.uk/2004/04/26/airport_security_failures/

http://www.heritage.org/Research/HomelandDefense/BG1683.cfm

http://www.theregister.co.uk/2004/07/16/homeland_capps_scrapped/

http://en.wikipedia.org/wiki/CAPPS

11/05/05 SMU Homecoming 15

“Proof” that Bin Laden was involved in 9/11

http://www.ccmep.org/2003_articles/Iraq/020703_powell_offers_pr

oof_of_saddam.htm

11/05/05 SMU Homecoming 16

Jialun Qin, Jennifer J. Xu, Daning Hu, Marc Sageman and Hsinchun Chen, “Analyzing Terrorist Networks: A Case Study of the Global Salafi Jihad Network”  Lecture Notes in Computer Science, Publisher: Springer-Verlag GmbH, Volume 3495 / 2005 , p. 287.

11/05/05 SMU Homecoming 17