Terrorism Prediction Using Artificial Neural Network

Terrorism is a complex adaptive system, evolving phenomenon [1] and it is a type of collective violence which has direct negative impact on peace, normal routine of countries and societies security and also a way to generate fear in civilians using violence. [2].

Many researchers and various institutions based on analyzing terrorism incident data around the world which could help in retrieving some patterns or an important information that can contributes in choosing an appropriate action to prevent similar types of attacks. Some of them are:

(1) Hawkes Process, a process that is applied to predict terrorist attacks in Northern Ireland which considered 5000 explosions ranging between year 1970-1998. The process was used to analyze when and where the Irish Republicans Army (IRA) launched the attack, how British security forces responded [3].

(2) Social Network Analysis (SNA) whose goal was to degrade the lethality of terror network i.e. what happens when terrorist is removed from network. (i) Quantifying terror network lethality (ii) Predicting successor of removed terrorist (iii) Identifying whom to remove. And some of the activities carried out are fake account, social media fraud [4].

(3) Terrorist Group Prediction Model (TGPM) aims to predict the group involved in a specific attack or the group that is responsible for that attack which uses crime prediction model and group detection model concepts. It uses clustering and association technique which showed some fair degree of accuracy [5].

(4) Dynamic Bayesian Network used to predict the likelihood of future attacks, which acts an initial step in predicting the terrorist behavior at critical transport infrastructure facility [6].

(5) Feed forward back propagation neural network, which is used for counter terrorism to predict whether a person is terrorist or not. Data set is collected from a game called cutting corners and result showed success rate between 60 %-68 % for correctly identifying terrorist behaviour [7].

(6) Characterizing a terrorist using pattern classification and SNA which predicts whether a person is terrorist or not and resulted in 86 % accuracy [8].

(7) Both random forest classification and random forest regression are used in a prediction model for future attacks where the model achieved the accuracy of 76 %-79 % for attack type, 84 %-86 % for weapon type and 33 %-36 % for target type [9].

Artificial Neural Networks (ANNs) known as one of the popular and important efficient machine learning paradigms for classification as well as for prediction. ANNs relatively new computational tools that have found extensive utilization in solving and supporting many complex real-world applications across a diversity of business and scientific disciplines (financial, manufacturing, marketing, telecommunications, and biomedical).

The attractiveness of ANNs comes from their remarkable information processing characteristics pertinent mainly to nonlinearity, high parallelism, fault and noise tolerance, and learning and generalization capabilities [10]. ANN is more like a black box that is able to learn something and predicts various kinds of data. Various applications of ANNs can be summarized into classification or pattern recognition, prediction and optimization, modeling, associative memory, and control [11].

There have been many attempts to formally define neural networks. “A neural network is a system composed of many simple processing elements operating in parallel whose function is determined by network structure, connection strengths, and the processing performed at computing elements or nodes” –DARPA Neural Network Study [12].

The most commonly used family of neural networks for pattern classification tasks [13] is the feed-forward network, which includes multilayer perceptron and Radial-Basis Function (RBF) networks. Another popular network is the Self-Organizing Map (SOM), or Kohonen-Network [14], which is mainly used for data clustering and feature mapping.

The remainder of this research is organized as follows: Section 2 shows the details of the proposed system framework its tools, techniques as well as the used and modified metaheuristics, while section 3 explains the prediction of the terrorist groups based on using artificial neural networks as well as the data pre-processing , the classification process, the used fitness functions. In Section 4 the prediction results provided by ANN is explained in details, and finally the conclusions and future research directions are discussed in Section 5.

In this research we proposed a hybrid prediction algorithms based on using different metaheuristic algorithms such as (GWO, MFO [16], WOA [17], ALO, GA, PSO), modified metaheuristics such as (MFO2, MFO-3 proposed by Soliman, et al. [18], and (WOA-2, WOA-3) proposed by Soliman, et al. [19], developed (hybrid) algorithms such as ( Multi-objective MFO2, Multi-objective MFO3) proposed by Gh. et al, [20], and memetic (hybrid) WOA2SA, WOA3SA recently proposed by Soliman, et al.

Phase I

In each one of the implemented algorithms we integrate a feature selection approach (either wrapper approach or integrate both filter with wrapper approaches into a hybrid system) with a machine learning classification algorithm (KNN, RFs) controlled by the optimimization process that is guided by the metahuristics optimization algorithm in order to determine the minimum number of selected features that achieve highest classification accuracy (minimum classification error).

To achieve the main objective of the proposed research which is the prediction of the terrorist group (s) responsible for the terrorist attacks on Egypt during the time period (from year 1996 till year 2017), we determined the common number of features among the obtained selected features from the multiple implementations of the proposed hybrid systems.

3.1 The proposed hybrid prediction (classification) algorithm

Algorithm 1: The Proposed Hybrid Classification Algorithm

Step1: Data Pre-Processing,

Step2: Data partitioning into training and testing sets,

Step3: Then using the wrapper approach as a feature selection method guided by the classifiers (RFs, KNN) in the classification process to select the feature subset and with the help of the optimization algorithm to evaluate the selected feature subset by using the fitness function in multiple runs via different number of iterations.

Step4: Stopping Criterion (If Maximum No. of iterations >NIter, then go to Step 6; otherwise go to step3).

Step5: Results & performance analysis.

Step6: Stop.

3.1.1 Data pre-processing phase

This section explains how the terrorism data has been pre-processed to be used in the prediction. The data used is real terrorism data and describes the terrorist attacks in Middle East & North Africa especially the attacks that happened in Egypt (from year 1996 till year 2017). The data set derived from the Global Terrorism Database (GTD) [15] which is taken from an open source of the National Consortium for the Study of Terrorism and Responses to Terrorism (START):

• Initiative at University of Maryland USA.
• Broadcasts the terrorism incidents reports about the globe from 1970 to 2018.
• Since 1970 it contains the information over than 13,000 eliminations, 38,000 bombings and 4,000 kidnappings.
• GTD includes systematic data on domestic as well as international terrorist incidents that have occurred during this time period and now includes more than 170,000 cases.
• This dataset is under the supervision of counseling board of 12 terrorism research experts.

The data are required to be prepared for using in the classification process and it passed on multiple steps as explained below:

• Data Cleaning: Preprocess data in order to reduce noise and handle missing values by applying (Litwise-Deletion, Mode-Imputation) approaches.
• Data transformation (from Categorical into Numeric based on GTD coding system)

1. The features in our data are classified as (Date, Incident location, Location Details, Attack information, Weapon Information, Target/Victim information, Casualties & Consequences) features
2. For the time domain features; we applied a feature reduction where we transformed the "day, month, and year" features into an equivalent "day per year, Hijiri day per year, and an equivalent day per week ".
3. For the position or location feature we transformed it into city-latitude, and city-longitude. 
4. Due to the huge number of classes in some features in our data; we had to combine the classes in some features into groups.

After the preprocessing step, the dimension of Terrorism data on the time period from year 1996 till year 2017 became 45 (predictors/attributes or features) besides "Terrorist group name" that is considered as (response class), and the total number of attacks (records) became 813, the total set of features are described as below in Table 1.

3.1.2 Feature selection & extraction phase

A wrapper approach for feature selection and attribute reduction is used in our research study; where the attribute space consists from 46 attributes in the used time domain is explored to find an attribute (feature) subset guided by classification performance of individual attribute subsets. Hence intelligent exploration of search space is always a challenge as the single evaluation of fitness function is always time consuming. This approach may be slow since the optimization algorithm must be retrained on all candidate subsets of the attribute set and its performance must be also measured to find the attribute combination that balance between the minimum numbers of features which achieve the maximum classification accuracy (minimize the classification error)  as in the used  fitness function in Eqn.(1).

3.1.3 Classification process phase

The data used about terrorism is divided into three equal parts; one for training the classifier, the second for validation and the third for testing the model. GWO proposed by [21], WOA, the modified versions WOA2, WOA3, MFO, the modified MFO2, and MFO3 algorithms results’ are compared to some of well-known and highly efficient metaheuristics algorithms such as particle swarm optimization (PSO) and Genetic Algorithm (GA), Ant lion algorithm (ALO) as they are known with their popularity in space searching. The classification process of the terrorist groups of attacks is performed based on KNN classifier which is one of the top ten classifiers used for the classification process and is simple and commonly utilized learning algorithm, KNN is utilized in the experiments based on trial and error basis where the best choice of (K=5) is selected. 

Through the training process, every (wolf, moth, whale) position represents one attribute subset. Training set is used to evaluate the RF ensemble classifier which is compared with KNN classifier; on the validation set throughout the optimization process to guide the feature selection process. The test data are kept hidden from the optimization and is left for final evaluation.

Table 1. Terrorism dataset features of time period (1996 till 2017) for Egypt

3.1.4 Fitness function

Fitness function is important for metaheuristic algorithms, it is used evaluate the quality of each selected subset. fitness evaluation is designed to combine the accuracy of classifier with the length of feature subset. A fitness function combines both the classification error (classification accuracy) and the number of selected features and hence achieve that balance between the classification performance and the reduction size.

There are two fitness functions used in our research study to evaluate the individual search agents ACC fitness which evaluate the accuracy of the model, and ACCSZ which evaluate the selected feature size that achieve the minimum classification error. The fitness function that is used in our optimization algorithms to evaluate individual search agents is shown as follows:

Minimize $\operatorname{ACCSZ}$ Fitness $\propto \gamma_{T}(C)+\beta \frac{|T|}{|D|}$ (1)

where, $\gamma_{T}(C)$: is the error rate for the classifier used in which $\gamma_{T}(C)=1-\operatorname{CCR}(\mathrm{C})$, T: is the size (length) of selected feature subset, D: Total number of features in the data set. 

α, β: Parameters or (constants) corresponding to the importance of classification performance and subset length and so can control the quality of the classification. 

α ∈ [0, 1] and β = 1 – α.

Maximize $\quad$ ACC Fitness $=\mathrm{CCR}(\mathrm{C})$

$\mathrm{CCR}(\mathrm{C})=\mathrm{N} \mathrm{C} / \mathrm{N}$ (2)

where, CCR(C): is the classification performance measure that represents the correct classification ratio. N_C is the number of correctly classified data instances and N is the total number of instances in the data set.

The random weights which represented by the terms α and β are used to balance the trade-off between exploration and exploitation. Through the training process, every agent position that represented research by the (Grey-wolf, moth, whale, antlion) position represents one feature subset. The training set is used to train the prediction model through optimization and hence evaluate the used classification algorithm (RFs, KNN) on the validation set during the optimization to guide the feature selection process, while in the validation set the performance of the predicted model is assessed during the optimization process. The final evaluation of the selected features is performed in the testing set. The proposed optimization algorithms are used to find the minimum number of features that maximize the prediction performance (minimizes classification error). Each feature in the search space is represented as an individual dimension, each dimension ranges from 0 to 1 and hence requires an intelligent searching method to find the optimal feature set in the huge search space that optimizes a given fitness function. 

The global and optimizer-specific parameters setting is showed in Table 2. the values of the parameters are set either according to domains specific-knowledge as the α; β parameters of the fitness function in Eq. (1), or based on the trial and error on small simulations which is common in the literature as the rest of the parameters.

Table 2. Parameter setting for experiments

3.1.5 Performance measures

In order to compare between the optimization algorithms that used separately in the proposed hybrid prediction model, we used a set of statistical measures that evaluate the performance of the model by calculating the mean, best, worst fitness, as well as the measures of error such as the mean test error, also there are the measures of the speed of the model as the execution time, and other important measures as the specificity, sensitivity, Fisher average, Wilixicon and T-Test for the different optimizers.

Phase II

We used the common selected features from Phase I as an input into a Two Layer Feedforward Neural Network, then the predicted terrorist group will be compared with the actual terrorist group to determine the prediction accuracy.

1. Different Activation functions used in the Neural Network for the Hidden Layer such as "Tansig"," radbas", "logsig", "purelin" " Sigmoid".
2. We Implemented the NN prediction model using different numbers of neurons in the hidden layer such as 15, 20, 25, 30 neurons.
3. The performance measure that used for evaluation is the Mean Square Error (MSE).
4. The Input data matrix dimension are 15 common selected features, and 818 records (terrorist attack).
5. The target matrix dimension are 24 terrorist groups set as the matrix rows, and 818 as the matrix columns.

3.2 Common selected features

By the end of Phase I; the set of common selected features among the implemented proposed algorithms are determined from the different experimentations and used for the input in the neural network training as explained in Figure 2.

3.3 Network training

The input data are divided into training, validation, testing. The input terrorism data matrix is a numeric matrix where; the number of records represented by the common selected features (obtained from Phase I of the proposed prediction system) and the number of columns represent the total number of instances or the terrorist attacks. The network trained on the first two third of the input data, and the testing will be performed on the last third of the data.