Predicting terrorists attacks by parsing social media traffic
Connecting state and local government leaders
By monitoring the use of selected hashtags on social networks, researchers were able to track activity of ad hoc groups of extremists without having access to the individuals’ profiles.
Tracking terrorists can be like playing a whack-a-mole. As soon as the terrorists learn that their cell phone calls are monitored or their encrypted emails or social medial posts have been intercepted and cracked, they go dark, then re-emerge with a new identity.
Researchers at the University of Miami, however, have come up with an analytic tool that may be difficult for targeted groups to evade. By monitoring the use of selected hashtags on a social network -- such as #isis, #isn, #hkilafah -- the researchers were able to identify and track activity of ad hoc groups of extremists without having access to the individuals’ profiles.
Searching for groups using hashtags is critical, said Stefan Wuchty, UM computer scientist and leader of the project, because hashtags, unlike individual profiles, are publicly accessible and persistent. “Every social media platform -- no matter whether it is Twitter or Facebook -- has an API that will allow people like us to actually retrieve public domain data,” he noted.
For its research, the team used data from VKontakte, a Russian social networking service that is popular in Europe and that -- unlike Facebook and many other social networking sites -- does not delete pro-ISIS posts.
Having isolated a set of relevant hashtags, the team was able to generate a point map showing aggregated groups of individual users whose posts included a given hashtag and the relationship of those groups to each other. Then Russian-speaking students from UM’s international studies program checked the postings to see if they were pro- or anti-ISIS. “If it is anti-ISIS we discard it,” Wuchty said. “If it is pro-ISIS we keep it.”
According to the article published by the team in the June issue of Science magazine, “New Online Ecology of Adversarial Aggregates: ISIS and Beyond,” by measuring the flow of postings to and among such aggregates, the likelihood of imminent activity by a terrorist group, or even “lone-wolf” followers of a group, can be estimated. "Our findings suggest that instead of having to analyze the online activities of many millions of individual potential actors worldwide, interested parties can shift their focus to aggregates, of which there will typically be only a few hundred," the team wrote.
And according to Wuchty, it’s the patterns of connections found in the social network, rather than the content of the postings, that are the most revealing. “What was most interesting for us is the dynamics with which the groups appear,” Wuchty said. “Right before there is an event in the real world, we see an acceleration of those groups popping out of the woodwork like mushrooms. That can be used in order to predict pretty reliably the onset of an event a couple of days away.”
Of course, because Wuchty’s team isn’t connecting the data to individual users, intelligence agencies would need to take to the further step of identifying likely perpetrators before they could take preventive action. But simply being aware that an event is about to take place is valuable information.
Wuchty said that publication of the paper last month has generated some interest from agencies. “We are right now looking for funding so that we can actually analyze this whole heap of data, which is growing every day,” he said. “We’re just scratching the surface in understanding those patterns that are not based on individual activity but on group activity.”
NEXT STORY: Next Steps for the Route Fifty ‘Navigator Awards’