Entropy and Network Centralities as Intelligent Tools for the Investigation of Terrorist Organizations

In recent years, law enforcement authorities have increasingly used mathematical tools to support criminal investigations, such as those related to terrorism. In this work, two relevant questions are discussed: “How can the different roles of members of a terrorist organization be recognized?” and “are there early signs of impending terrorist acts?” These questions are addressed using the tools of entropy and network theory, more specifically centralities (degree, betweenness, clustering) and their entropies. These tools were applied to data (physical contacts) of four real terrorist networks from different countries. The different roles of the members are clearly recognized from the values of the selected centralities. An early sign of impending terrorist acts is the evolutionary pattern of the values of the entropies of the selected centralities. These results have been confirmed in all four terrorist networks. The conclusion is expected to be useful to law enforcement authorities to identify the roles of the members of terrorist organizations as the members with high centrality and to anticipate when a terrorist attack is imminent, by observing the evolution of the entropies of the centralities.


Introduction
Law enforcement authorities (police-judiciary), which are entrusted with the tasks of preventing and detecting terrorist attacks, are particularly interested in effective methods of identifying the different roles of the members of a terrorist organization. The presence of different roles (division of tasks) within a terrorist organization is one of the four basic conditions for an organization to be classified as a terrorist/criminal organization, as accepted for example by the members of the European Union [1,2]. As terrorist acts are a real threat to the modern societies [3], the authorities need also effective methods to diagnose imminent terrorist attacks from early signs, so that the necessary preventive actions can be taken. The goal of this work is to apply the tools of entropy and network theory to address the above problems.
Many natural or artificial systems are modelled as networks: computers, telecommunications, water supply, transport, power chains, organs of the human body or cellular interaction, protein networks, networks of meteorological phenomena. Social networks in particular represent the relationships between people [10,16].

Methodology
The research questions Q1 and Q2 are addressed using selected tools of network theory, applied to the physical contact networks of four real terrorist organizations, from different countries. The selected tools of network theory are three centralities (degree, betweenness, clustering) to address Q1 and the corresponding entropies to address Q2. The centralities and entropies are described below.

Centrality Measures
Centralities are measures indicating the importance of each node, resulting from the topology of links [8,10,17,40,41,54,55]. The importance of nodes is assessed by ranked the nodes according to the values of their centralities. There are more than 100 such indicators that refer locally to each node. From centralities, global indicators are computed like centralizations, averages and entropies showing an overall assessment of the network [10,11,17]. In this article, selected local indicators are examined for undirected networks, namely, degree centrality, betweenness centrality and clustering coefficient: The degree of node i in a network of order N is the number of connections of the node i and takes values from 0 to N − 1. The value 0 indicates the absence of links and there are no self-loops. The normalized degree is the degree centrality [10,38]: where: a κλ is the κλ-element of the adjacency matrix [5][6][7]11] of the network. In the case of weighted networks, the weighted degree is known as strength: DEG

Betweenness Centrality
The betweenness of a node indicates how influential the node is by judging whether the node in question lies within the path joining pairs of other nodes [10,38] and takes values from 0 to (N − 1)(N − 2). The betweenness centrality of node κ is defined by the formula: , where σ λµ is the number of paths connecting nodes λ and µ and σ λ(κ)µ is the number of paths connecting nodes λ and µ and passing through the node κ.

Clustering Coefficient
The neighbourhood density of a node indicates the extent to which its first neighbours are linked to each other. The neighbourhood density of node i, also known as clustering coefficient of node κ [11], is calculated from the formula: , where E κ is the number of links between the first neighbours of node κ, and κ is the number of first neighbours of node κ.

Identification of Roles
The role of nodes of the network according to the selected relevant criteria is assessed by the values of the corresponding centralities. For example, in the cooperation network of the employees of a company, the nodes with high degree are the popular employees or the employees with many responsibilities. Betweenness centrality identifies the employees who act as mediators between different employees. The team players or teamworking nodes are the employees with high clustering coefficient [10,28,38,40,42,43].

Entropy of Centralities
Entropy of some random variable X is the average information obtained from the measurement of the n values x 1 , x 2 , . . . , x n of a variable X. Therefore, the entropy is a measure of the lack of information before more accurate measurements are made. The Boltzmann, Planck, Gibbs' entropy of statistical physics is [56,57] In this work, Shannon's entropy is used, representing the minimal average length of binary coding [58,59]: In order to compare the entropies of different variables the normalized entropy S log 2 n is computed, taking values in the interval [0, 1]. Entropy is a measure of the diversity of the values of the variables. High entropy indicates that most values are more or else equally probable, while low entropy indicates that few values are highly probable and dominate, as the other values have rather low probability. Shannon's formula is used to calculate the entropies of the three selected centralities, namely, degree, betweenness and clustering defined in Section 2.1. The degree entropy is: the probability distribution of the values of the degree centrality. The normalized degree entropy is S deg log 2 (N−1) . The betweenness entropy S B and the clustering entropy S Clu are defined in the same way. In the case of networks, centralities with high entropy indicate high diversification of roles of the nodes, while low entropy indicates that most nodes have lack roles in the network.
The additivity of Boltzmann, Planck, Gibbs' entropy reflects non-extensivity of ergodic systems close to equilibrium. This is the standard assumption of most systems of statistical mechanics and information theory [12,[59][60][61]. Other entropies like Renyi entropy have been proposed with interesting applications beyond Statistical physics [12]. The study of anomalous systems with long range interactions with metastable long lived states requires non-extensive entropies like Tsallis entropy [12,62]. The physical contact networks under investigation are assumed to be regular as there are no indications of anomalies.

Data Sets
Physical contact networks of four real terrorist organizations, from four different countries are selected. The data sets are in the public domain. The real names of the members of the organizations are encrypted. Finding such data sets is much more difficult, compared to other datasets as they are usually classified.

Terrorist Organization "Jamaah Islamiah Section of Indonesia"
The physical contacts [63] between the identified members of the Jamaah Islamiah terrorist organization were recorded by the Indonesian police from 1985 to 2007 [64]. The data include 11 time periods depicting 27 individuals (nodes). The network of physical contacts is fully connected (no disconnected nodes or groups of nodes), weighted and undirected.

Terrorist Organization "Hamburg Cell"
The physical contacts [65] between the identified members of the Hamburg Cell terrorist organization were recorded by the German and United States authorities from 1985 to 2006 [66]. The data include 15 time periods depicting 34 individuals (nodes). The network of physical contacts includes isolated nodes and is weighted and undirected.

Terrorist Organization "Al-Qaeda Section of Madrid"
The physical contacts [67] between the identified members of the al-Qaeda section of Madrid were recorded on the occasion of the terrorist attack in 2004 and were recorded by the Spanish authorities from 1985 to 2006 [68]. The data include 14 time periods in which 54 people (nodes) are depicted. The network of physical contacts includes isolated nodes and is weighted and undirected.

Terrorist Organization "Jamaah Islamiah Section of Philippines"
The physical contacts [69] between the identified members of the Jamaah Islamiah section of Philippines were recorded on the occasion of the terrorist attack of 2000 and were recorded by the Spanish authorities from 1985 to 2006 [70]. The data represent 14 time periods in which 16 atoms (nodes) are displayed. The network of physical contacts is fully connected (no disconnected nodes or groups of nodes), weighted and undirected.

Results
From the above data, the three centralities (degree, betweenness, clustering) and the corresponding entropies are computed for the networks of the four terrorist organizations.
The values of centralities indicate that some nodes are stand out nodes. The results are presented below:

Terrorist Organization "Jamaah Islamiah Section of Indonesia"
The visualization of the overall network over the period 1985-2007 is presented in Figure 1.  Table 1. The evolution of the entropies of the centralities is presented in Figure 3.

Terrorist Organization "Hamburg Cell"
The visualization of the overall network over the period 1985-2006 is presented in Figure 4.  Table 2. The evolution of the entropies of the centralities is presented in Figure 6.

Terrorist Organization "Al-Qaeda Section of Madrid"
The visualization of the overall network over the period 1985-2006 is presented in Figure 7.  Table 3. The evolution of the entropies of the centralities is presented in Figure 9.

Terrorist Organization "Jamaah Islamiah Section of Philippines"
The visualization of the overall picture of the network 1985-2007 is presented in Figure 10.  Figure 11. The protagonists for each time period are presented in Table 4. The evolution of the entropies of the centralities is presented in Figure 12.  Afterwards, all entropies decrease for the next two years, and then, they increase to some extend after 2005. The entropy of betweenness decreases faster.

Different Roles of the Members of Terrorist Organizations
The different roles of the members of all four terrorist organizations ("Jamaah Islamiah section of Indonesia", "Hamburg Cell", "al-Qaeda section of Madrid", "Jamaah Islamiah section of Philippines") are clearly recognized from the values of the selected centralities. About 5-10% protagonists (nodes with high centralities) stand out in the four overall networks (Figures 2, 5, 8 and 11). The members assume different roles in the time periods studied (Tables 1-4). The mediators of the four organizations share a common temporal pattern (Tables 1-4): Betweenness is decreasing to zero after a certain point in time. The rapid fall of betweenness centrality occurs shortly after a significant terrorist action [66,68,[70][71][72][73]. An exception appears in the "Jamaah Islamiah section of Philippines" organization, as the mediators resume some value after the rapid fall (Table 4). This re-emergence of mediators coincides with their attempt to start another terrorist action [70].

Early Signs of Impending Terrorist Acts
An early sign of impending terrorist acts for all four terrorist organizations ("Jamaah Islamiah section of Indonesia", "Hamburg Cell", "al-Qaeda section of Madrid", "Jamaah Islamiah section of Philippines") is clearly recognized from the evolution of the values of the entropies of the selected centralities (Figures 3, 6, 9 and 12). The entropies are increasing up to a certain point in time, and then, rapid decrease follows. This indicates that in periods of high entropy, many members acquire roles, while the roles are reserved for a few members only in periods of low entropy. These results are interpreted from real terrorist events: "Jamaah Islamiah section of Indonesia": The entropies of the centralities increase after 2002 and peak in 2004 (Figure 3), when the organization carries out its top strikes (2002Bali, 2003Marriott hotel, 2004 Australian embassy) [71][72][73].
"Hamburg Cell": Two peaks of the entropies of the centralities appear in 1996 and 1998. A plateau of high entropies appears in the period 1998 to 2001. All entropies decrease rapidly after 2001 ( Figure 6). The first peak (1996) coincides with the original planning of the attack on the twin towers (suggestion of Khalid Shaikh Mohammed to Bin Laden). The second peak (1998) coincides with the relocation to Hamburg of Mohamed Atta, Marwan al-Shehhi, and Ramzi bin al-Shibh, who were three of the hijackers on 9/11 (twin towers). The rapid decrease immediately after 2001, occurs immediately after the events of 9/11, in which members of the "Hamburg Cell" actively participated [66].
"Al-Qaeda section of Madrid": The entropies of the centralities peak in 2003 (Figure 9), just before the major terrorist attack on the Madrid train in early 2004 [68].
"Jamaah Islamiah section of Philippines": There is a high plateau of the values of entropies from 2000 to 2001. Afterwards, all entropies decrease for the next two years, and then, they increase to some extend after 2005 ( Figure 12). The big bombing events happened in the change of the year 2000, immediately after the fall of entropies. The increase of the entropies after 2005 coincides with their attempt to start another terrorist action [70].

Conclusions
The research questions Q1 and Q2 have been addressed as follows: The different roles of the members are clearly recognized from the values of the selected centralities (Section 5.1). An early sign of impending terrorist acts is the evolutionary pattern of the values of the entropies of the selected centralities (Section 5.2). These results have been confirmed (Section 5) by the real data (Section 3) from four real terrorist organizations in different countries.
Monitoring the three centralities (degree, betweenness, clustering) enables the law enforcement authorities to identify the roles of the members of terrorist organizations as the members with high centrality. Restricting the observation to the members with high centralities implies effective cost reduction. The recognition of distinct roles is one of the necessary requirements for the characterization of an organization as criminal-terrorist by the European Union [1,2].
Monitoring the evolution of entropies of the selected centralities (degree, betweenness, clustering) provides an early sign of impending terrorist acts. The observation of high entropies of the centralities is clearly an early sign, as in periods of high entropy, many members of the organization acquire roles in the network. This is clearly an additional input to law enforcement authorities for the prevention and suppression of terrorist strikes. In periods of high entropy, the authorities should be in high readiness. Law enforcement authorities have data from daily monitoring; therefore, they are able to assess events with much finer resolution, compared with the annual data used in this work, and draw more accurate conclusions. However, the methodology of the analysis is the same. Finally, it is tempting to observe the qualitative analogy of the temporal evolution of entropies (Figures 3,6,9 and 12) with the evolution of readiness potentials [74].