Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.



Published on

  • Be the first to comment

  • Be the first to like this


  1. 1. 1 STRATEGIC OPTIONS FOR TERRORIST NETWORK DISRUPTION: UNDERSTANDING THE STRUCTURE AND COMPLEXITY by Stefani Fournier A Project Submitted to the Interdisciplinary Studies Program of George Mason University in Partial Fulfillment of the Requirements for the Degree of Master of Arts in Interdisciplinary Studies with a Concentration in Computational Social Science Committee: Dr. Andrew Crooks Associate Professor, Department of Computational and Data Sciences, Program Chair Dr. Clifton Sutton Associate Professor, Department of Statistics Dr. WilliamG. Kennedy Research Assistant Professor, Krasnow Institute for Advanced Study Dr. Andrew Crooks Head, Concentration in Computational Social Science Sciences Dr. Meredith Lair Director, Interdisciplinary Studies Date: Fall Semester 2015 George Mason University Fairfax, VA
  2. 2. 2 Abstract Governments spend billions of dollars every year fighting terrorism, but still terrorism remains a major national security risk. The question still remains as to what are the key strategies or combination of strategies to combat terrorism, particularly as terrorist networks constantly evolve. The need to understand the internal dynamics of terrorist organizations has been well documented since the September 11th attacks, particularly the use of social network analysis (SNA) as it provides valuable insight into covert organizations. Due to the nature of covert organizations, complete network data is impossible, but extensive research has been done on the networks, individual terrorist attributes, and the overall strategies and goals of terrorist organizations. While much work has been done to collect information and analyze the network structure and terrorist attributes, much less attention has been paid to the implementation of successful strategies to disrupt the network and particularly how implemented strategies influence networks to evolve. As terrorist networks constantly change, approaches to disrupt them must constantly adapt. It is important to build onto the network and attribute data collected to understand how particular strategies influence network structure and more importantly what strategies achieve the goals they set out to accomplish. Only by tying together the terrorist organization attributes, network structure, and how strategies influence network changes will those implementing strategy make decisions that eventually weaken terrorist influence and power. To address the issue of incomplete network data, particularly missing links, this paper utilizes several methods of machine learning to train the network to predict hidden links. Agent- based modeling is a tool that can utilize network and attribute data to enable the analysis of the effects of disruption strategies on a terrorist network. This paper presents an agent-based model to evaluate the network structural changes as disruption strategies are implemented. The focus of the model is the implementation of both kinetic and non-kinetic disruption strategies on a learned 271 al-Qaeda member network that is allowed to have varying levels of morale. The model enables the exploration of how key strategies may impact terrorist network metrics such as density, diameter, centrality, path length, the number of terrorists, and the ties between terrorists. This model is based on the al-Qaeda Attack Network available in the John Jay & ARTIS Transnational Terrorism Database.
  3. 3. 1 TABLE OF CONTENTS 1. Introduction …………………………………………………………………………… 2 1.1 Background of Terrorist Network Analysis………………………………………. 2 1.2 Understanding al-Qaeda Through SNA……………..…………………………….. 3 1.3 Previous Research Using SNA to Understand Terrorist Networks………………... 5 1.4 Previous Research Using SNA and Agent-based Modeling to Understand Terrorist Networks…………………………………………………………………………… 6 1.5 Limitations of Previous Terrorist Network Analysis………………………………. 7 2. Terrorist Network Case Study…………………………………………………………. 8 3. Training the Network…………………………………………………………………... 9 4. Strategies for Combating Terrorism…………………………………………………… 12 5. Model Framework and User Interface……………………………………………...... 14 5.1 Visual Display……………………………………………………………………………………………...15 5.2 Strategy Methodology………………………………………………………………………………….19 6. Network Metrics and Model Findings……………………………………...........…… 22 6.1 Low Morale Results………………………………………………………………... 23 6.2 Low-Average & Average Morale Results………………….……………………… 23 6.3 Average-High Morale Results…………………………………………………… . 25 6.4 High Morale Results……………………………………………………………….. 26 6.5 Overall Results………………………………………………………………………27 7. Discussion……...……………………………………………………………………….. 28 8. Conclusion………………....………………………………………………………….... 29 9. References……………………………………………………………………………… 30
  4. 4. 2 1. Introduction This project presents an agent-based model that utilizes an identified and trained al-Qaeda network and its individual terrorist attributes to better understand how implemented disruption strategies affect network structure and thus, which strategies appear to be more effective under different scenarios. To determine the effectiveness of the disruption strategies, network measurements such as density, diameter, centrality, path length, the number of terrorists, and the ties between terrorists are compared to the original network after a strategy is implemented. Each strategy is also implemented for differing levels of morale in the network to determine whether morale plays a role in the effectiveness of the strategy. The model outputs show total links, total terrorists, and the count of terrorists in each position type in the network. The network created in the agent-based model is then used to calculate network metrics. This model is a starting point for understanding network changes as four particular strategies are implemented on a given network. This paper provides an overview of the background and limitations of previous efforts used to better understand terrorist networks (Section 1), an overview of the al-Qaeda network and terrorist attributes utilized (Section 2), the methods of machine learning and results to train the network (Section 3), an overview of the strategies used for combating terrorism (Section 4), the model framework and user interface (Section 5), a comparison of network metrics between the original network and one where a strategy has been implemented to conclude model findings (Section 6), model discussion and expansion ideas (Section 7), and concluding thoughts (Section 8). 1.1 Background of Terrorist Network Analysis Social network analysis (SNA) provides a visualization of individuals (nodes) and their relationships between one another (links) to form a network structure. In addition to providing visualizations that can uncover hidden relationships or patterns and potentially motivations of behavior, SNA generates metrics that identify the importance or influence of individuals, the strength of ties, and the density and distance of the network. These metrics are useful to understanding influential people in the network and how information flows through a network. For example, shorter path lengths and distance found in more centralized networks can facilitate resources and information much easier, but less centralized networks allow for more adaptability
  5. 5. 3 from any kinds of shocks to the network, such as the removal of the leader, and this makes it more resilient. Perliger (2014, p. 49) explains, “successful networks obtain enough hierarchy (level of centrality) to ensure effective coordination and cohesive operational vision, and on the other hand, provide enough freedom and flexibility to its members and subgroups - a practice which ensures survival when some parts of the network become dysfunctional.” Terrorist networks must balance that need for effective communication and coordination with information flowing through the network with the need for security and adaptability. In addition to keeping the network secure and efficient, network members must also worry about defection. Dense networks provide an additional benefit of being able to better minimize defection as numerous links can provide a greater sense of belonging, but also a monitoring mechanism. Everton and Cunningham (2015) explain that network density is a result of terrorists recruiting through strong social ties as this provides a security benefit, but requiring too much security can isolate a network to the point of collapse, as they do not have access to necessary information and resources. SNA metrics provide a method to understand the goals of a network and structurally where weaknesses exist. Whether a network is more focused on security or efficiency will determine how adaptable a network is and what kind of disruption strategies will work against it. 1.2 Understanding al-Qaeda Through SNA While al-Qaeda began as a small guerilla organization in the 1980s, today it comprises many regional branches and affiliates across many countries. As the al-Qaeda network grew in strength and size, it also changed in structure in part because of the need to evolve and adapt to counterterrorism strategies and in part due to bin Laden’s vision of inspiring jihad globally. Figure 1 from Metzger (2014) shows the hierarchical structure of al-Qaeda in the 1990s when the primary goal was resource mobilization as a response to defending Afghanistan against the Soviets and the timeline in Figure 2 displays the evolution to a more decentralized al-Qaeda network structure. Borum and Gelles (2005) provide rationale for the evolution by noting that the American focus on al-Qaeda since 9/11 have forced core members of al-Qaeda to change functional roles in order to spread the inspirational message of jihad instead of providing tactical leadership. As terrorist networks are evolving, it only makes sense that the approach to analyze and disrupt them also adapts. Previous efforts of identifying and targeting leaders of an organization did prove to be successful against hierarchical guerrilla organizations, however, bin
  6. 6. 4 Laden successfully adapted the organization to a more decentralized network that is able to inspire the vision of jihad from within and thus make it more difficult to detect. As enemy network structures change from the traditional hierarchical structure, more advanced analytic tools such as SNA must be used to identify central nodes and understand how information flows through a network in order to implement strategies that more effectively fight terrorist networks. Knoke (2015) supports the movement and points out that some link analysis was done prior to 9/11, but after the attacks researchers significantly changed methodology to incorporate SNA into their foundational efforts in order to better understand the al-Qaeda network, the Jemaah Islamiyah cell that was responsible for the Bali bombing, the network responsible for the Madrid train bombing, and several other networks. Figure 1 1990s Hierarchical Structure of Al-Qaeda (Source Metzger, 2014)
  7. 7. 5 Figure 2 Development of Al-Qaeda Structural Changes (Source Metzger, 2014) 1.3 Previous Research Using SNA to Understand Terrorist Networks Researchers have recognized the need for updated analytic tools when attempting to understand terrorist networks and have made use of SNA as such a tool. In addition to Krebs’ (2002) research using SNA to map the 9/11 hijackers, Sageman (2004), Koschade (2006), Magouirk et al (2008), Xu et al (2009), Medina (2012), and several others have contributed greatly to the understanding of terrorist networks, even with the acknowledgement that data on covert networks will never be complete. Particularly, previous work has given insight on the network structure of terrorist organizations and network measures that identify central and influential individuals in the network. For example, Koschade (2006) found a high density of ties (0.43) among the Jemaah Islamiyah cell that was responsible for the Bali nightclub bombing and noted a centralized network allowed for both efficiency and security. Sageman (2004) argues that terrorist networks are built upon ties of kinship and friendship. Medina (2012) found in his analysis that the Islamic terrorist network was surprisingly resilient and efficient even as two key figures identified by highest degree centrality, betweenness centrality, and closeness centrality were removed from the network. A central actor can be identified as someone who has a large
  8. 8. 6 number of ties to other actors (degree centrality), someone who lies on the shortest path between numerous pairs of actors in a network (betweenness centrality), someone who is close in terms of path distance to other actors (closeness centrality), or someone who has numerous ties to highly central actors (eigenvector centrality). The density of a network tells how well connected the nodes in a network are and thus can give an indication of how resilient the network may be when shocks occur. The diameter of a network is defined as the longest geodestic path between two nodes and can be thought of as a measure of reachability. Path distance provides an additional measure of node closeness and the clustering coefficient measures the connectivity of each node’s neighborhood. Overall, SNA has greatly attributed to the greater understanding of terrorist network structure and implementing the network into an agent-based model will allow for an understanding of network changes as particular disruption strategies are taken. 1.4 Previous Research Using SNA and Agent-based Modeling to Understand Terrorist Networks Kathleen Carley has done a great amount of work tying SNA, agent-based modeling, and terrorism together to think about networks from a dynamic perspective as strategies are being implemented. Tsvetovat and Carley (2002) use a multi-agent network simulation to conclude that targeting random members of a terrorist network doesn’t have a permanent effect on operation effectiveness as the organization recovers and restores itself to normal operation in time, but the targeting of highly central members does make the recovery time longer. Additional work tying agent-based modeling and SNA has been performed by Ko and Berry (2002) to understand what variables most effect terrorist camp enlistment. Edward MacKerrow (2003) performed research with the Defense Threat Reduction Agency (DTRA) on an effort known as the Threat Anticipation Program (TAP) to simulate terrorist networks using agent- based modeling in an effort to examine the questions related to why terrorist organizations originally form. Carley (2003, p. 6) also developed a tool called DyNet that has been made available to intelligence personnel, researchers, and military strategist in order “…to see how the networked organization was likely to evolve if left alone, how its performance could be affected by various information warfare and isolation strategies, and how robust these strategies are…” While the DyNet tool should provide the analyst the tools to understand how networks evolve, the shortcomings is that it only focuses on the removal of nodes in the network as the counterterrorism strategy. As has been demonstrated, this may work as a short-term strategy, but
  9. 9. 7 it at least needs to be combined with other strategies to achieve long-term results. Overall, previous efforts have tied SNA and agent-based modeling to better understand terrorism, but these efforts have focused on the rise of terrorist organizations and targeting central members to disrupt them. 1.5 Limitations of Previous Terrorist Network Analysis Previous efforts have collected a tremendous amount of data on individual terrorists and the relationships they have within their networks. Ressler (2006) points out the University of Arizona’s Artificial Intelligence Center’s Terrorism Knowledge Portal which makes publically available over 360,000 terrorism news articles and websites. START provides a Global Terrorism Database (GTD) that includes data on over 140,000 domestic and international terrorist attacks from 1970 to 2014 (Global Terrorism Database). Due to the nature of covert networks, however, it is nearly impossible to know and collect all persons and relationships in a network. In addition, personal attribute data may not be complete to fully utilize network information. Some researchers, such as Medina (2012) and Krebs (2002), have accepted incomplete networks in order to understand as much as possible about terrorist organizations. This approach may be sufficient if key individuals or relationships are not missing in the network. However, when implementing strategies a more complete network will increase the significance and acceptance of simulation results as missing links or nodes in a network, particularly if between or of influential individuals, is devastating to the use of network analysis for strategy implementation. Magouirk et al (2008, p. 2) notes, “A major problem facing the study of terrorism today is a lack of strong, quantitative data that is freely available…. This dearth of data unfortunately results in theoretical modeling that is often divorced from important policy questions….” While collection efforts have greatly added to the overall understanding of the organizational structure, Roberts and Everton (2011) point out that the exploration of disruption strategies is limited. Of particular importance is evidence to suggest a positive relationship between strategy, or a combination of strategies, and results for particular network structures. Some strategies may achieve a particular goal, but without understanding structural effects improper goals may be set and lead to devastating long-term results. For example, the death of Osama bin Laden was considered a major success and hopes were that the network would be disrupted. Not only did the network persevere, but the targeting of bin Laden may
  10. 10. 8 have led to further decentralization that makes targeting more difficult in the future. Carley (2003, p. 2) explains, “finally, and critically, this approach [SNA] does not contend with the most pressing problem – the underlying network is dynamic. Just because you isolate a key actor today does not mean that the network will be destabilized and unable to respond. Rather, it is possible, that isolating such an actor may have the same effect as cutting off the Hydra’s head; many new key actors may emerge.” Strategies should not be implemented without understanding the full effect on the network. This is a difficult task considering the varying conditions under which strategies are implemented and while predictions are never going to be completely accurate, a better understanding of broad tendencies will be beneficial. To effectively combat covert networks, an understanding of how strategic options affect the structure of a network must be considered. While some research ties SNA and agent-based modeling to discover the structural effects of the network, the focus has been on node removal and needs to be extended to other strategic options. 2. Terrorist Network Case Study This model utilizes the John Jay & ARTIS Transnational Terrorism Database (2015) to access the al-Qaeda attack network and individual attributes of terrorists. The network data provides aggregate data representing the relations of individuals associated with 23 terrorist attacks linked to al-Qaeda between 1993 and 2003. This network, seen in Figure 3 as a visualization generated in Gephi version 0.8.1, represents 271 al-Qaeda members and 1,512 social ties between the members. The provided terrorist attributes from the terrorism database used in the model include place of birth, educational achievement, occupation, whether they are a former terrorist, the specific al-Qaeda group they belong to, the country where they joined the organization, and the position they hold within the organization. There is one leader, or Emir, in the network. Three members of the religious/fatwa committee are responsible for justifying al-Qaeda actions and preaching the al-Qaeda model of Islam. Twelve members of the military committee are responsible for selecting targets for attacks and operatives for conducting them. Twenty-four members raise and spend money for al-Qaeda as part of the finance committee. The logistics committee consists of thirteen members who are devoted to executing attacks. Additionally there are 22 local leaders, 72 regional leaders, 55 general subordinates, one central leader, and 68
  11. 11. 9 members whose position is unknown. It must be understood that this data is as complete and reliable as open source data allows. The collection of a comprehensive covert dataset is understood to be impossible, but the data is deemed sufficient to understand the network structure and determine influential individual nodes. In addition to missing links or nodes, the attribute data does not provide information on every node. Figure 3 Structural overview of al-Qaeda network of 271 members and 1,512 social ties represented in a Fruchterman Reingold layout. Darker blue, larger nodes represent terrorists with higher closeness centrality while edge color provides a visualization of those members participating in the same attacks. 3. Training the Network There is an understanding when dealing with covert networks that data will usually be incomplete. As researchers gather network and attribute data, most assume it is sufficient to do
  12. 12. 10 analysis. Medina (2012) explains in his research that a comprehensive database of all Islamist terrorists is not possible, but the real goal is a database of sufficient size to conduct analysis that provides meaningful results. While it may be the case that the data is sufficient for conclusive evidence, the use of predictive learning may be able to tackle the data limitations in order to provide a more complete framework. Predictive learning, better known as the field of machine learning, is currently used by a variety of fields such as neuroscience and sociology to solve problems of varying complexity. Overall, the goal of machine learning is to use algorithms to learn from and make predictions about data. In regards to social networks, the need for machine learning is recognized particularly to solve the link prediction problem. This problem addresses predicting future links between nodes. Lichtenwalter et al (2010) explain that link prediction is important to network science and particularly security agencies as it allows them to more precisely focus their efforts on unobserved probable relationships. Given the dynamic nature of social networks and the importance of understanding those dynamics, machine learning allows for an evolution of the network by predicting edges that will be added in the future. A practical application of solving this problem is building recommendation systems that predict future connections, such as is done by Facebook and LinkedIn (Jannach et al, 2014). Related to the link prediction problem is dealing with missing links due to incomplete data as applicable to identifying missing terrorist links. Budur et al (2014) focus on finding hidden links in criminal networks and conclude from their experiments that decentralized networks have better performance in solving the link prediction problem because the machine learning model avoids over-fitting due to the lower variance. Al Hasan and Zaki (2011, p. 1) state, “There exist a variety of techniques for link prediction, ranging from feature-based classification and kernel-based methods to matrix factorization and probabilistic graphical models.” Once a specific technique has been decided upon, there are several machine learning models that can be used. For classification based on features, these models include Naïve Bayes, Neural Networks, Support Vector Machines, Multilayer Perceptron, K Nearest Neighbors, Decision Trees, Logistic Regression, Random Forest, and Boosting. While there are various techniques and models available to address the link prediction problem, the data determines which model is more applicable based on prediction performance metrics such as recall, precision, F-measure, and accuracy. Recall is the portion of actual
  13. 13. 11 positives that are predicted positive while precision is the portion of predicted positives that are actually positive. F-measure is the weighted harmonic mean of precision and recall. Accuracy is the portion of classifications that are correct. Forman (2003) points out that none of these measures alone give enough information in each situation to make an informed decision so all performance metrics are used together. This paper utilizes six different classification based machine learning methods to predict the most complete network. These methods include Random Forest (Breiman, 2001), Decision Trees (Quinlan, 1986), Support Vector Machines (Cortes and Vapnik, 1995), Boosting (Breiman, 1998), Logistic Regression (Cox, 1958), and K Nearest Neighbors (Altman, 1992). Each method predicts links based on given node attributes in addition to three proximity measures (Jaccard, Dice, and Adamic/Adar). The performance metrics of the six machine learning methods are shown in Table 1. These metrics were generated in RStudio version 0.98.1091 utilizing the randomForest package (Random Forest results), the tree package (Decision Tree results), the e1071 package (Support Vector Machine results), the gbm package (Boosted results), the glm function (Logistic results), and the knn function (K Nearest Neighbors results). Recall, precision, F-Measure, and accuracy are calculated based on the confusion matrix produced in the results. Random Forest provides the best overall results and is the chosen method to predict hidden links of the al-Qaeda network. Beginning with an al-Qaeda network of 1,512 social ties, the Random Forest algorithm predicts hidden links and expands the network out to 1,574 links. Overall, the network has 1574 links, 271 nodes, a density of 0.0108, a diameter of 8, 0.0320 degree centrality, 0.0062 betweenness centrality, 0.0018 closeness centrality, path length of 2.75, and cluster coefficient of 0.6070. KNN Logistic Boosted Radial SVM Decision Tree Random Forest Recall 61.3% 92.4% 96.4% 97.9% 100.0% 96.9% Precision 79.3% 88.7% 89.7% 89.2% 87.9% 93.5% F-Measure 69.1% 90.5% 92.9% 93.3% 93.6% 95.2% Accuracy 80.4% 94.9% 96.1% 96.5% 96.7% 97.4% Table 1 Performance results of machine learning methods calculated in RStudio
  14. 14. 12 4. Strategies for Combating Terrorism As the structure of terrorist networks evolve and adapt over time, it is important to not only fully understand their current structure, but also the long-term effects that counterterrorism strategies have on the network. Strategies that have been successful in the past on hierarchical structures may not be effective and worse yet, they may actually make the network harder to combat in the future. Xu et al (2009) argue that terrorist organizations in the past were identified as hierarchical organizations where the leader held total control and, thus, made themself vulnerable to attacks, but modern terrorist organizations have adopted a decentralized structure that spreads leadership across the organization. Understanding the limitations of strategies focused on targeting leaders in more decentralized networks will allow for a more robust set of strategies focused on understanding the effects on the network. Roberts and Everton (2011) explore two approaches to combating dark networks. The goal of a kinetic approach is to capture and kill terrorists through aggressive means. This approach is very visible and has been highly supported in the past, particularly when it was effective against hierarchical organizations. For example, the United States won the Philippine- American War with strong military force against the Philippine Army in which Gates (2002) estimates that 34,000 Filipino soldiers and up to 200,000 civilians were killed. A non-kinetic approach, on the other hand, is much more of a long-term strategy that requires cooperation and patience. The non-kinetic approach can be taken by rebuilding war-torn communities, disseminating information for the purpose of influencing behaviors (to include deception tactics that tarnish relationships), using information operations to undermine terrorist ideology, and rehabilitating detainees and their families by providing incentives to defect. Brown (2007) points out that al-Qaeda has been at war with itself from the beginning as there has been a constant battle over what the organization should be, the strategy to be implemented, and who the enemy is and this has led to two factions that differ in ideology and also provide an opportunity to turn members against one another through deception tactics. The key to defeating an enemy is understanding their weaknesses and exploiting them. If a decentralized network is capable of rebuilding itself when leaders are taken out, then other weaknesses such as network infighting, weak ideology, or low morale must be explored. Jenkins (2014) explains that network infighting within al-Qaeda has become commonplace over issues such as strategy,
  15. 15. 13 ideology, tactics, and targets and this provides an opportunity for the United States in not only creating new intelligence and propaganda, but it also lowers recruitment and increases defection. Both of the described approaches have their strengths and weaknesses and it may be the case that they need to be implemented concurrently, but applying them to the proper network structure is key to any long-term positive result. Roberts and Everton (2011) recognize great efforts to collect information on terrorist networks, but are shocked by the lack of attention paid to strategies that disrupt these networks. While the White House does offer a National Strategy for Combating Terrorism, this offers only general policy direction and doesn’t give specific strategy alternatives. To demonstrate, one of the eight overarching goals of the National Strategy for Combating Terrorism (2011, p. 8) is to “Disrupt, Degrade, Dismantle, and Defeat al-Qa’ida and its Affiliates and Adherents”, but no further details are provided as to how that is accomplished. The lack of strategy attention may be due to secrecy, but most of the focus, in terms of both published and media research, is solely on the kinetic approach. Davis and Sisson (2009) from the RAND organization have identified thirteen policy tools to achieve strategic goals: provide assistance to friendly nations for counterterrorism efforts, offer military assistance to friendly nations for counterterrorism efforts, kill or capture terrorist leadership figures, compromise terrorists’ use of technology, prevent access to conventional weapons, deny terrorist safe havens, pressure states to reduce/curb terrorist support, disrupt terrorist financial support, tarnish relationships between jihadists, partner with authoritative voices such as religious leaders to undermine terrorist ideology, impede recruitment, create incentives for members to defect, and use moderate Muslims to counter jihadist ideology. Even among several RAND experts identified by Davis and Sisson (2009) evaluating these policy tools, however, there were differing views regarding priority and effectiveness. In addition to focusing on particular strategies of disruption, Ash (1999, p. 34) explains that “…strategies must target morale to break the enemy’s will to resist.” While morale is complex because it relates to both situational and psychological factors, it is ultimately a factor of motivation (Bekerian and Levey, 2005) and overall organizational success. Terrorist leaders recognize the need to boost morale, both internally and for recruitment purposes, as they put out
  16. 16. 14 propaganda to make members motivated to fight harder. Counterterrorism strategies must also think about morale and understand how morale affects the effectiveness of disruption strategies and in turn how disruption strategies affect morale. For example, Hibbert (2006) explains if morale is high and members are motivated to fight aggressively towards their cause, actions that promote more aggressive behavior will only influence a stronger will to fight. On the other hand, if morale is low and aggressive actions are taken towards the individual, the lack of motivation may be enough to influence the individual to not fight back. The complexity of moving parts in a terrorist network make this evaluation difficult for the human mind, no matter what level of subject matter expertise the individual obtains. Thus, a more scientific evaluation that allows for computer simulation utilizing subject matter expertise is needed. This is not to say that all strategies will be feasible, but a better understanding of the effects of the different options will allow for more insightful policy decisions. Krawchuk (2005, p. 3) sums it up by saying, “…[T]he United States must know where the enemy is today, understand what he is doing and prepare for his future moves. If not, this nation will always be one step behind and is certain to suffer another tragic surprise.” 5. Model Framework and User Interface Once machine learning has provided a more complete picture of the terrorist network, research can be taken beyond the foundational case studies to apply the understanding of the network structure to devising strategies to disrupt the network. When devising strategies, however, it must be understood that both terrorist networks and the environment that they survive in change and adapt quickly. Everton and Cunningham (2011) point out that both endogenous and exogenous factors, such as recruitment and responses to counterterrorism strategies, change the environment that a terrorist network exists within and in response to the changing environment, the terrorist network structure adapts. Thus, flexible models must be created in order to account for these varying conditions. Agent-based modeling offers this flexibility, as Bonabeau (2002) explains it provides the methodology for modeling complex emergent phenomena. Given the complexity of interactions in a terrorist network, particularly when a strategy of disruption is implemented, agent-based modeling offers insight about the emergence of the network to
  17. 17. 15 evaluate under what circumstances a particular strategy is effective. Thus, the simple behavior of the agents generates the complex behavior of the dynamic network. 5.1 Visual Display To represent the synthetic network built out by the Random Forest algorithm to expose hidden links, the agent-based model was developed using NetLogo version 5.2.1 that utilizes the NW (abbreviation for network) extension. The model visual display shows the al-Qaeda network using a spring layout with circles representing network members. Those members with high betweenness centrality are represented with larger node size and node color represents the position the member holds in the organization. The Emir is represented in red, the religious committee in yellow, local leaders in brown, the logistics committee in orange, regional leaders in pink, the finance committee in blue, the central leader in violet, the military committee in green, general subordinates in white, new recruits in turquoise, and those with an unknown position in magenta. In addition to having additional links, the network visualization in NetLogo will differ from the initial visualization shown in Figure 3 due to the limited capabilities of NetLogo to manipulate graphical features. Interface monitors also capture the counts of members in each position. Attribute data for each member is stored within the model. As is reasonable in a terrorist network, the visual display shows that agents may be eliminated from the network as they are captured or killed and links may be removed from the network as relationships are tarnished or as agents are deterred from the network. In addition, agents can also be added to the network through recruitment. The outputs are monitors of total links, total nodes, counts of positions within the network, and the identification of the most central figure as defined by betweenness centrality. The model graphical user interface, shown in Figure 4, supports user interaction to import the network, adjust value settings for parameters, and select and execute the disruption strategy. The user can adjust the recruitment potential of the terrorist network (as a percentage of the entire network) by adjusting the “Recruitment-Potential-%-of-terrorist-network” slider. This parameter is defaulted to 5% in order to set the user to a low-side estimate of recruitment. Recruitment statistics for al-Qaeda are not available and opinions vary widely as to what these values are, but
  18. 18. 16 Black and Norton-Taylor (2009) argue that many believe that al-Qaeda’s failure to carry out significant attacks since the London bombings has weakened its power to recruit. The morale of the network can be set with the “Network-Morale” drop-down button to Low, Low-Average, Average, Average-High, or High. The “incentive –potential” slider allows the user to define the potential when a strategy of creating incentives is executed. The default value is set to 20% and the strategy is shown to be ineffective with a potential under 20%. Statistics for the effectiveness of incentives are not available so the 20% default is set to make the strategy minimally effective. The user imports the al-Qaeda network through the “import-network” button and executes the strategy though the “Execute Strategy” button. The user can choose one of four strategies with the “Strategies” drop-down button: target central figure (member with highest betweenness centrality), use deception tactics, undermine terrorist ideology, or create incentives. These four particular strategies are selected from the thirteen policy tools identified by Davis and Sisson (2009) because they focus on behavioral changes of communication in a terrorist network. The model’s logic and execution of strategies are summarized in Figure 5.
  19. 19. 17 Figure 4 Agent-based model user interface in NetLogo
  20. 20. 18 Figure 5 Model Logic and Execution of Strategies
  21. 21. 19 5.2 Strategy Methodology The first strategy, target central figure, allows the user to test the belief of Brafman and Beckstrom (2006) that using a kinetic approach on a decentralized network will actually make the network harder to combat in the future. This strategy kills the most central (as defined by betweenness centrality) agent in the network. As a consequence of killing the most central node, potential recruits are motivated to join the network as a result of injustice. The amount of recruits to join the network is determined by the recruitment slider. These recruits then randomly create links with any member of the terrorist network because as Sageman (2004) points out, the main recruitment factor for al-Qaeda is kinship and friendship links. Thus, any member of al- Qaeda may act as a potential recruiter and it is through those previous social ties that new members join the network. In response to the killing, those agents that had links to the targeted node will be forced to make a decision on how they react to the strategy. Those agents with high morale will respond aggressively by creating links in order to cultivate relationships and take over tasks. This assumption is based on the work of Hibbert (2006) who argues that soldiers with high morale will have more confidence to defeat the enemy so they will fight harder. These actions may be self-motivated in order to advance in the organization or as a general action to make the network stronger. On the other hand, those agents without high morale will be more apprehensive about the security for themselves and the organization and will cut ties in order to make members less detectable. Byman (2006, p. 104) explains these actions by stating, “(t)o avoid elimination, the terrorists must constantly change locations, keep those locations secret, and keep their heads down, all of which reduces the flow of information in their organization and makes internal communications problematic and dangerous.” Once members have reacted to the strategy, they will adjust their morale based on the morale of all members they are linked to. The following three strategies (use deception tactics, undermine terrorist ideology, and create incentives) utilize a non-kinetic approach to disruption and incorporate four policy tools identified by Davis and Sisson (2009) from RAND. These policy tools include tarnishing relationships between jihadists by using deception tactics, partnering with authoritative voices such as religious leaders and using moderate Muslims to undermine terrorist ideology, and creating incentives for members to defect. Other RAND policy tools were not focused on because the purpose on this paper is to understand terrorist behavior within the network. Given
  22. 22. 20 the data set available, focusing on military assistance, technology, or the financial network is not applicable. The strategy of creating incentives provides incentives to those that do not have high morale, are skilled occupationally, and have an education higher than high school because their benefits of being part of a terrorist group are not as high. These individuals have the ability to get a job and money outside of the terrorist organization and aren’t in need of the training provided. In addition, these incentives are targeted towards everyone except the Emir, those in the religious committee, and those in the military committee because these individuals have a higher level of commitment to the organization as they are responsible for either the planning and implementation of attacks or spreading and justifying the ideology. With an understanding that those with fewer friends in the network will be easier to incentivize, members with fewer friends will be offered the incentives. This assumption is based on the work of Disley et al (2012) that explains the role of social ties, both as a pull from the network when social ties are greater to society and reinforcement to the network when members have more ties within the network. Of all of those members offered an incentive, only the percentage identified by the user in the “incentive-potential” slider will be removed from the network. Once members have left the network due to incentives, all remaining members will evaluate their morale based on the morale of members they are linked to. As a response to the incentive strategy, local leaders, regional leaders, central leaders, and members of the logistic committee who have an average or above average morale will try to make sure the organization feels united so they don’t lose any further members. They will do this by increasing the level of communication to lower level members. Again members will reevaluate their morale based on the morale of members they are linked to. The strategy of undermining terrorist ideology gets implemented by utilizing moderate Muslims and authoritative religious leaders to undermine terrorist ideology. These individuals each reach out to ten members of the network who have average or below average morale, are skilled occupationally, and have an education level higher than high school because their benefits of being part of a terrorist group are not as high. These individuals have the ability to get a job and money outside of the terrorist organization and aren’t in need of the training provided. These individuals implementing will avoid reaching out to the Emir, members of the military
  23. 23. 21 committee, or members of the religious committee because these individuals have a higher level of commitment to the organization as they are responsible for either the planning and implementation of attacks or spreading and justifying the ideology. Ten network members are targeted by each of the seven moderate Muslims and authoritative religious leaders in the model because the goal is to reach all of the 67 network members who have higher potential to be converted, as assumed by the level of benefit that the network provides them. Additionally, understanding that those with fewer friends in the network and those who were not previously apart of a terrorist network will be less influenced by the terrorist ideology, these individuals will be targeted. Of those members that were contacted by the moderate Muslims and religious leaders, half of them will be influenced to leave the organization. Members of the network will evaluate their morale based on the morale of members they are connected to. As a response to the undermining strategy, members of the religious committee will reach out to local leaders in order to strengthen the terrorist ideology within the network. Again, members will reevaluate their morale based on connected members. The strategy of using deception tactics identifies members with the highest betweenness centrality that have differences in group alignment, place of birth, and county in which they joined the organization in hopes of identifying members at potential odds with one another. The members with the highest betweenness centrality are chosen due to their ability to act as brokers of information in the network and thus weaken ties as they spread deceptive information. Differences in group, place of birth, and country joined identifies which members are part of different affiliates. As Jenkins (2014) points out, infighting is common amongst al-Qaeda, particularly its different affiliates and identifying these potential quarrels will increase the success of deception tactics. Once the member is identified, false information will be fed through a member of lower position connected to the target (this member identified by an airplane in the model). With an understanding that fed information may not be believable to the target, the target will only believe the information if they feel that the member feeding the information is well connected within the network so that the information can be trusted. If the target believes the message, they will cut links to other members that the message told them not to trust. If they don’t believe the message nothing will happen. Then, additionally, any member
  24. 24. 22 who believes the message will also cut links to those members that the message told them to not trust. Members will evaluate their morale based on connected members. 6. Network Metrics and Model Findings In order to generate network metrics from the final network generated by the agent-based model for each strategy, the RNetLogo package was used to allow an interface to embed the agent-based modeling platform NetLogo into the R environment. Within the R environment, the igraph library was used to allow for the calculation of various network structure properties. The algorithms utilized from igraph for this paper include density, diameter, degree centrality, betweenness centrality, eigenvector centrality, closeness centrality, path length, and cluster coefficient. Prior to calculating network metrics, however, verification of the model was performed. Verification is the process of determining that the implemented code for the model matches the intended design (North and Macal, 2007). In addition to walking through the code, verification of the model was performed by using model outputs and metrics and model visualization and plots to ensure the model was working as intended. These measures insured that the intentions of the code matched the resulted actions of the agents and thus, there were no coding errors. After conducting this verification, there is high confidence that the intentions of the model are accurately carried out in the design. To identify the network structure changes after a strategy is implemented, each strategy was executed ten times in NetLogo for each level of morale and the defaulted values of recruitment potential (5%) and incentive potential (20%). Each network metric was calculated for each run of the strategy and the averages were calculated for each specific network metric. All metrics are compared to the metrics of the original network before any strategy is implemented. As terrorist groups seek to balance efficiency and security, there is a tradeoff between having a centralized network and a decentralized network. Centralization promotes efficiency, but less centralized networks have the ability to adapt quickly and can be less vulnerable to the removal of central targets. Bin Laden was successful in adapting the
  25. 25. 23 terrorist network into a more decentralized network to promote security as can be seen by Table 2 the original density metric is 0.0108. In addition, a high cluster coefficient makes the network more resilient to defection as nodes are more connected to their neighbors and monitoring is higher. The high eigenvector centrality shows a close proximity to central actors locally, but the other low centrality scores demonstrate that there isn’t a close proximity across the network. 6.1 Low Morale Results Table 2 shows the averaged results for the four disruption strategies when the starting morale of the network is low, the recruitment potential is 5%, and the incentive potential is 20%. With a low morale across the network, the density remains very similar among all disruption strategies, but the network becomes even more decentralized and thus harder to detect when targeting central figures and creating incentives. The clustering coefficient and closeness centrality also remain similar across strategies, with the exception of the strategy of undermining terrorist ideology. This strategy increases the closeness centrality and decreases the clustering coefficient. These metrics indicate a slightly less resilient network. Overall, the best strategy when morale is low is to take advantage of the low morale and undermine terrorist ideology. This strategy will make the network slightly less resilient. Targeting central figures is the worst strategy when morale is low as it increases the number of members and makes the network more decentralized and thus even harder to detect. Given that the recruitment potential was set at only 5% when executing this strategy, higher recruitment potential would only increase the number of members added to the network when executing the strategy of targeting central figures.
  26. 26. 24 Table 2 Network metrics with Low Morale, 5% Recruitment Potential, and 20% Incentive Potential 6.2 Low-Average and Average Morale Results Table 3 shows the averaged results for the four disruption strategies when the starting morale of the network is low-average, the recruitment potential is 5%, and the incentive potential is 20%. Again the density remains similar among all disruption strategies, but the network becomes even more decentralized and harder to detect when targeting central figures. Undermining terrorist ideology proves to be the best strategy in terms of making the network less resilient as the closeness centrality increases and the clustering coefficient decreases. Under this environment, creating incentives seems to be more beneficial as the network maintains the same density, but loses nodes and links. Particularly when the incentive potential is higher, this strategy could be very effective at decreasing the size of the network. Overall, the best strategies when morale is low-average is to take advantage of the lower morale and undermine terrorist ideology and create incentives. Depending on the incentive potential, reducing the network size may be much more important than making the network less resilient. Targeting central figures again seems to be counterproductive as the size of the network increases and the network becomes more decentralized. With high recruitment potential, this strategy would be more detrimental. With almost the exact same metrics for average morale as seen in Table 4, the same conclusions can be made about the most effective disruption strategies. LOWComparison Links Nodes Density Diameter Degree Centrality Betweenness Centrality Eigenvector Centrality Path Length Cluster Coefficient Closeness Centrality Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018 UseDeceptionTactics 1466 271 0.0109 8.2000 0.0297 0.0065 0.9604 2.7673 0.6078 0.0017 UndermineTerrorist Ideology 1715 275 0.0114 8.2000 0.0312 0.0066 0.9541 2.8356 0.5229 0.0049 TargetCentral 1516 283 0.0097 8.1000 0.0311 0.0057 0.9621 2.7880 0.5848 0.0017 CreateIncentives 1515 265 0.0098 8.1000 0.0324 0.0058 0.9593 2.7050 0.6069 0.0018
  27. 27. 25 Table 3 Network metrics with Low-Average Morale, 5% Recruitment Potential, and 20% Incentive Potential Table 4 Network metrics with Average Morale, 5% Recruitment Potential, and 20% Incentive Potential 6.3 Average-High Morale Results Table 5 shows the averaged results for the four disruption strategies when the starting morale of the network is average-high, the recruitment potential is 5%, and the incentive potential is 20%. With higher morale in the network, all strategies appear to have either a neutral or negative consequence. The strategy of undermining terrorist ideology again is successful in making the network slightly less resilient, but the number of members increases so this benefit is offset. Targeting central figures pushes the network to become slightly more decentralized and also runs the risk of a higher number of recruits depending on recruitment potential. Creating incentives is much less effective under this scenario as it is much harder to turn members when they are happy with their network. For a network LOW-Average ComparisonLinks Nodes Density Diameter Degree Centrality Btwn Centrality Eigen Centrality Path Length Cluster Coefficient Closeness Centrality Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018 Use Deception Tactics 1446 271 0.0109 8.1000 0.0281 0.0067 0.9612 2.7878 0.6083 0.0018 Undermine Terrorist Ideology 1713 275 0.0114 8.3000 0.0306 0.0065 0.9558 2.8210 0.5226 0.0055 TargetCentral 1516 283 0.0097 8.3000 0.0304 0.0059 0.9617 2.8140 0.5864 0.0016 Create Incentives 1501 265 0.0108 8.2000 0.0322 0.0059 0.9600 2.6870 0.6050 0.0017 Average Comparison Links Nodes Density Diameter Degree Centrality Btwn Centrality Eigen Centrality Path Length Cluster Coefficient Closeness Centrality Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018 Use Deception Tactics 1448 271 0.0108 8.1000 0.0280 0.0066 0.9614 2.7625 0.6040 0.0017 Undermine Terrorist Ideology 1714 275 0.0114 8.2000 0.0312 0.0065 0.9554 2.8240 0.5232 0.0052 Target Central 1516 283 0.0097 8.4000 0.0304 0.0062 0.9605 2.8390 0.5890 0.0016 Create Incentives 1504 265 0.0110 8.2000 0.0318 0.0062 0.9600 2.7550 0.6096 0.0018
  28. 28. 26 that is energized and has higher morale, the incentive would have to be very appealing. Finding key individuals who have a profound effect on undermining terrorist ideology or offering highly appealing incentives seem to be the only available resources for making any strategy successful when the morale is average-high. Table 5 Network metrics with Average-High Morale, 5% Recruitment Potential, and 20% Incentive Potential 6.4 High Morale Results Table 6 shows the averaged results for the four disruption strategies when the starting morale of the network is high, the recruitment potential is 5%, and the incentive potential is 20%. The strategy of undermining terrorist ideology again is successful in making the network slightly less resilient, but the number of members increases so this benefit is offset. Creating incentives again is ineffective as happy, motivated individuals are less likely to turn for an incentive. Targeting central figures, however, does show some interesting results that could be beneficial for counterterrorism efforts. Terrorist members are more confident when they have high morale and are more willing to take on aggressive behavior. Hibbert (2006, p. 37) states, “If soldiers have high morale and think they can win, they will fight harder. But if soldiers are tired, hungry, and feel they are losing the battle, they might refuse to carry on.” This behavior may be self-motivated to move up the ranks of a successful organization or group-motivated in order to improve the recognition of the organization. Regardless of the motivating factor, more confident behavior means less concern for the security of the member or the organization. As seen in Average-High ComparisonLinks Nodes Density Diameter Degree Centrality Btwn Centrality Eigen Centrality Path Length Cluster Coefficient Closeness Centrality Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018 Use Deception Tactics 1483 271 0.0108 8.1000 0.0295 0.0063 0.9613 2.7545 0.6022 0.0018 Undermine Terrorist Ideology 1744 278 0.0113 8.5000 0.0312 0.0066 0.9559 2.8581 0.5253 0.0053 TargetCentral 1516 283 0.0097 8.5000 0.0304 0.0058 0.9611 2.8190 0.5821 0.0017 Create Incentives 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018
  29. 29. 27 the results, this means a less resilient network as closeness centrality increases and the clustering coefficient decreases. In addition, the path length and diameter increase which means that it is more difficult for members to organize and plan. While the number of members in the network still increases, the increased betweenness centrality indicates that information is moving through more people in the network. With a combination of a less resilient network and more information flowing through the network due to the difficulty of organizing, authorities could take advantage of this new network structure to more easily identify plots before they happen and also arrest members who are key to operations. There is a trade-off executing this strategy in that membership in the network may increase, but information may be easier to attain about the network. The assessment must be made by those in authority as to what side is more beneficial and this will partly be determined by the recruitment potential. Table 6 Network metrics with High Morale, 5% Recruitment Potential, and 20% Incentive Potential 6.5 Overall Results The results indicate that morale of the network plays a fairly important role when deciding what strategy to implement. Recognizing when morale is lower will provide the best environment for implementing non-kinetic strategies, particularly undermining terrorist ideology and creating incentives. These strategies will make the network less resilient and potentially reduce the size of the network. However, when morale is high, executing a kinetic approach to disruption may change the network structure in such a way that High Comparison Links Nodes Density Diameter Degree Centrality Btwn Centrality Eigen Centrality Path Length Cluster Coefficient Closeness Centrality Original 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018 Use Deception Tactics 1469 271 0.0108 7.9000 0.0294 0.0063 0.9612 2.7371 0.6009 0.0017 Undermine Terrorist Ideology 1744 278 0.0113 8.1000 0.0313 0.0067 0.9554 2.8550 0.5246 0.0050 TargetCentral 1626 283 0.0102 8.6000 0.0307 0.0108 0.9613 3.2110 0.5789 0.0024 Create Incentives 1574 271 0.0108 8.0000 0.0320 0.0062 0.9597 2.7500 0.6070 0.0018
  30. 30. 28 information gathering for authorities is much easier and thus they are able to better prevent terrorist attacks. Given the changes in the network that do occur after implementing a disruption strategy, it is important to note that none of the changes are dramatic. No strategy changes the network in such a way that the organization will collapse or that the decentralized network will become centralized. The network is able to adapt quickly and adjust to strategies being implemented against it. This is the goal of decentralized networks and as seen by the model and in real life, it is an effective strategy taken by terrorist organizations to elude detection and collapse. 7. Discussion The model successfully depicts the trained al-Qaeda network attained from the John Jay & ARTIS Transnational Terrorism Database (2015) with given attributes and hidden links. Four disruption strategies identified by Davis and Sisson (2009) from RAND are successfully implemented in the model and network metrics are calculated. Given the morale identified for the network, network metrics explain the effects on the network and the potential success of each disruption strategy. The objective of the model is to compare the network structure of the original al-Qaeda network to the structure after each disruption strategy is implemented to determine the long-term effects of each strategy. Particularly, does the strategy achieve the goal it set out to accomplish? The results of the model indicate that morale of the network plays a role on the effectiveness of the strategy. Non-kinetic approaches to disruption are more effective when morale is lower and a kinetic approach influences structural changes that help authorities identify useful information when the morale is high. However, none of the disruption strategies have an effect of drastically changing the network. The al-Qaeda network is able to adapt quickly to any tactic taken against them in order to remain resilient and undetectable. This model is a starting point for understanding network changes as four particular strategies are implemented on a given network. The limitations of this model are that even after training the model important nodes, links, or attributes may still be missing, this
  31. 31. 29 model only evaluates the effectiveness of strategies on one particular network, a limited number of strategies are evaluated, and the network isn’t evaluated at different points in time, but as an aggregate of all nodes and links. In addition, this model only looks at the implementation of one strategy at a time instead of multiple strategies combined. Despite these limitations, the model is able to provide results that show the implications of four popular disruption strategies on the al-Qaeda network. More importantly, it provides a starting point to build onto the model and evaluate additional terrorist networks. Next steps to make the model more complete include allowing the disruption strategies to be executed on varying terrorist networks that have differing network structures and are of varying age, to allow multiple strategies to be executed at the same time, and to expand the availability of strategies. 8. Conclusion Combining applications of SNA and agent-based modeling allows for a model that incorporates individual terrorist behavior following disruption strategies with network metrics that identify structural changes. Importing known terrorist networks into an agent-based model enables testing various disruption strategies under varying levels of morale. The al-Qaeda network model takes a bottom-up approach to represent structural changes to the network. The model is based on al-Qaeda network data provided in the John Jay & ARTIS Transnational Terrorism Database, but it could easily be applied to any other known networks with the necessary attribute data. Additionally, this model could be expanded to explore the effects of other disruption strategies or a combination of strategies.
  32. 32. 30 References Al Hasan, Mohammad, Vineet Chaoji, Saeed Salem, and Mohammed Zaki. "Link Prediction Using Supervised Learning." : In Proc. of SDM 06 Workshop on Link Analysis, Counterterrorism and Security (2006). Ash, Eric. “Terror Targeting: The Morale of the Story.” Aerospace Power Journal. (1999). <>. Altman, N.S. “An Introduction to Kernel and Nearest-Neighbor Nonparametric Regression.” The American Statistician. 46.3. (1992):175-185. Bekerian, Debra Anne., and A. B Levey. Applied Psychology: Putting Theory Into Practice. Oxford: Oxford University Press, (2005):144-146. Black, Ian, and Richard Norton-Taylor. “Al-Qaida faces recruitment crisis, anti-terrorism experts say.” The Guardian. 10 September. (2009). Bonabeau, Eric. “Agent-based modeling: Methods and techniques for simulating human systems.” Proceedings of the National Academy of Sciences of the United States of America. 99.3. (2002):7280-7287. Borum, Randy, and Michael Gelles. "Al-Qaeda's Operational Evolution: Behavioral and Organizational Perspectives." Mental Health Law & Policy Faculty Publications. (2005). <>. Brafman, Ori., and Rod Beckstrom. The Starfish and the Spider: The Unstoppable Power of Leaderless Organizations. New York, NY, Penguin Books Ltd. (2006). Breiman, Leo. “Arcing Classifier.” The Annals of Statistics. 26.3. (1998):801-849. Breiman, Leo. “Random Forests.” Machine Learning. 45.1. (2001): 5-32. Brown, Vahid. “Cracks in the Foundation: Leadership Schisms in Al-Qa’ida from 1989-2006.” Combating Terrorism Center at West Point (2007). Budur, Emrah, Seungmin Lee, and Vein S. Kong. "Structural Analysis of Criminal Network and Predicting Hidden Links Using Machine Learning." (2014). 09 Dec. 2014. Byman, Daniel. “Do Targeted Killings Work?” Foreign Affairs. 85.2. (2006). Carley, Kathleen M. "Dynamic Network Analysis." Committee on Human Factors, National Research Council (2003): 133-45. Cortes, Corinna, and Vladimir Vapnik. “Support-Vector Networks.” Machine Learning. 20.3. (1995): 273-297.
  33. 33. 31 Cox, David R. “The Regression Analysis of Binary Sequences.” J Roy Stat Soc B 20:215-242. (1958). Davis, Lynn E., and Melanie Sisson. A Strategic Planning Approach: Defining Alternative Counterterrorism Strategies as an Illustration. Santa Monica, CA: RAND, (2009). Disley, Emma, Kristin Weed, Anais Reding, Lindsay Clutterbuck, and Richard Warnes. Individual disengagement from Al Qa’ida-influenced terrorist groups: A Rapid Evidence Assessment to inform policy and practice in preventing terrorism. Santa Monica, CA: RAND, (2012). Everton, Sean F., and Dan Cunningham. “Dark Network Resilience in a Hostile Environment: Optimizing Centralization and Density.” Criminology, Criminal Justice Law, & Society. 16.1 (2015): 1-20. Everton, Sean F., and Dan Cunningham. “Terrorist Network Adaptation to a Changing Environment.” Crime and Networks, edited by Carlo Morselli. 287-308. New York: Routledge. (2011). Forman, George. “An Extensive Empirical Study of Feature Selection Metrics for Text Classification.” Journal of Machine Learning Research. 3:1289-1305. (2003). Gates, John M. The U.S. Army and Irregular Warfare. Electronic edition (2002). Available at Global Terrorism Database. University of Maryland, 03 July 2015. <>. Hibbert, Adam. In the Trenches in World War I (On the Front Line). Raintree. (2006). Jannach, Dietmar, Jill Freyne, Werner Geyer, Ido Guy, Andreas Hotho, and Bamshad Mobasher. “The Sixth ACM RecSys Workshop on Recommender Systems and the Social Web.” 8th ACM Conference on Recommender Systems. New York, NY, USA. (2014). Jenkins, Brian Michael. Brothers Killings Brothers: The Current Infighting Will Test al Qaeda’s Brand. Santa Monica, CA: RAND, (2014). John Jay & ARTIS Transnational Terrorism Database. 03 July 2015. <>. Knoke, David. “Emerging Trends in Social Network Analysis of Terrorism and Counterterrorism.” Emerging Trends in the Social and Behavior Sciences. Online (2015). <>. Ko, Teresa H., and Nina M. Berry. "Agent-Based Modeling with Social Networks for Terrorist Recruitment." The Association for the Advancement of Artificial Intelligence. (2002).
  34. 34. 32 Koschade, Stuart. "A Social Network Analysis of Jemaah Islamiyah: The Applications to Counterterrorism and Intelligence." Studies in Conflict & Terrorism 29.6 (2006): 559-75. Krawchuk, Fred T. "Combating Terrorism: A Joint Interagency Approach." Landpower Essay 05.1 (2005). Krebs, Valdis E. "Uncloaking Terrorist Networks." First Monday 7.4 (2002). <>. Lichtenwalter, Ryan N., Jake T. Lussier, and Nitesh V. Chawla. “New Perspectives and Methods in Link Prediction.” 16th ACM SIGKDD International Conference. Washington, DC, USA. July 25-28. (2010). MacKerrow, Edward P. "Understanding Why: Dissecting Radical Islamist Terrorism with Agent-Based Simulation." Los Alamos Science 28 (2003): 184-91. Magouirk, Justin, Scott Atran, and Marc Sageman. “Connecting Terrorist Networks.” Studies in Conflict & Terrorism 31: 1-16. (2008). Medina, Richard M. "Social Network Analysis: A Case Study of the Islamist Terrorist Network." Security Journal 27.1 (2012): 97-121. Metzger, Tobias. “Social Movement Theory and Terrorism: Explaining the Development of Al- Qaeda.” Student Pulse 6.09 (2014). < movement-theory-and-terrorism-explaining-the-development-of-al-qaeda>. National Strategy for Combating Terrorism. Washington, D.C.: Executive Office of the President, (2011). <>. North, Michael J., and Charles M. Macal. Managing Business Complexity: Discovering Strategic Solutions with Agent-based Modelling and Simulation. Oxford University Press, New York, NY. (2007). Perliger, Arie. “Terrorist Networks’ Productivity and Durability: A Comparative Multi-level Analysis.” Perspectives on Terrorism 8.4 (2014). Quinlan, J.R. “Induction of Decision Trees.” Machine Learning. 1.1. (1986):81-106. Ressler, Steve. "Social Network Analysis as an Approach to Combat Terrorism: Past, Present, and Future Research." Homeland Security Affairs 2 (2006). <>. Roberts, Nancy, and Sean F. Everton. "Strategies for Combating Dark Networks." Journal of Social Structure 12.2 (2011). <>.
  35. 35. 33 Sageman, Marc. Understanding Terror Networks. Philadelphia: U of Pennsylvania, (2004). Tsvetovat, Maksim, and Kathleen Carley. "Knowing the Enemy: A Simulation of Terrorist Organizations and Counter-Terrorism Strategies." Carnegie Mellon University. (2002). <>. Xu, Jie, Daning Hu, and Hsinchun Chen. "The Dynamics of Terrorist Networks: Understanding the Survival Mechanisms of Global Salafi Jihad." Journal of Homeland Security and Emergency Management 6.1 (2009):1-33.