Solutions to Detect and Analyze Online Radicalization : A Survey

Online Radicalization (also called Cyber-Terrorism or Extremism or Cyber-Racism or Cyber- Hate) is widespread and has become a major and growing concern to the society, governments and law enforcement agencies around the world. Research shows that various platforms on the Internet (low barrier to publish content, allows anonymity, provides exposure to millions of users and a potential of a very quick and widespread diffusion of message) such as YouTube (a popular video sharing website), Twitter (an online micro-blogging service), Facebook (a popular social networking website), online discussion forums and blogosphere are being misused for malicious intent. Such platforms are being used to form hate groups, racist communities, spread extremist agenda, incite anger or violence, promote radicalization, recruit members and create virtual organi- zations and communities. Automatic detection of online radicalization is a technically challenging problem because of the vast amount of the data, unstructured and noisy user-generated content, dynamically changing content and adversary behavior. There are several solutions proposed in the literature aiming to combat and counter cyber-hate and cyber-extremism. In this survey, we review solutions to detect and analyze online radicalization. We review 40 papers published at 12 venues from June 2003 to November 2011. We present a novel classification scheme to classify these papers. We analyze these techniques, perform trend analysis, discuss limitations of existing techniques and find out research gaps

Analyzing covert social network foundation behind terrorism disaster

This paper addresses a method to analyze the covert social network foundation hidden behind the terrorism disaster. It is to solve a node discovery problem, which means to discover a node, which functions relevantly in a social network, but escaped from monitoring on the presence and mutual relationship of nodes. The method aims at integrating the expert investigator's prior understanding, insight on the terrorists' social network nature derived from the complex graph theory, and computational data processing. The social network responsible for the 9/11 attack in 2001 is used to execute simulation experiment to evaluate the performance of the method.Comment: 17pages, 10 figures, submitted to Int. J. Services Science

Online Human-Bot Interactions: Detection, Estimation, and Characterization

Increasing evidence suggests that a growing amount of social media content is generated by autonomous entities known as social bots. In this work we present a framework to detect such entities on Twitter. We leverage more than a thousand features extracted from public data and meta-data about users: friends, tweet content and sentiment, network patterns, and activity time series. We benchmark the classification framework by using a publicly available dataset of Twitter bots. This training data is enriched by a manually annotated collection of active Twitter users that include both humans and bots of varying sophistication. Our models yield high accuracy and agreement with each other and can detect bots of different nature. Our estimates suggest that between 9% and 15% of active Twitter accounts are bots. Characterizing ties among accounts, we observe that simple bots tend to interact with bots that exhibit more human-like behaviors. Analysis of content flows reveals retweet and mention strategies adopted by bots to interact with different target groups. Using clustering analysis, we characterize several subclasses of accounts, including spammers, self promoters, and accounts that post content from connected applications.Comment: Accepted paper for ICWSM'17, 10 pages, 8 figures, 1 tabl

A Broad Evaluation of the Tor English Content Ecosystem

Tor is among most well-known dark net in the world. It has noble uses, including as a platform for free speech and information dissemination under the guise of true anonymity, but may be culturally better known as a conduit for criminal activity and as a platform to market illicit goods and data. Past studies on the content of Tor support this notion, but were carried out by targeting popular domains likely to contain illicit content. A survey of past studies may thus not yield a complete evaluation of the content and use of Tor. This work addresses this gap by presenting a broad evaluation of the content of the English Tor ecosystem. We perform a comprehensive crawl of the Tor dark web and, through topic and network analysis, characterize the types of information and services hosted across a broad swath of Tor domains and their hyperlink relational structure. We recover nine domain types defined by the information or service they host and, among other findings, unveil how some types of domains intentionally silo themselves from the rest of Tor. We also present measurements that (regrettably) suggest how marketplaces of illegal drugs and services do emerge as the dominant type of Tor domain. Our study is the product of crawling over 1 million pages from 20,000 Tor seed addresses, yielding a collection of over 150,000 Tor pages. We make a dataset of the intend to make the domain structure publicly available as a dataset at https://github.com/wsu-wacs/TorEnglishContent.Comment: 11 page

Node discovery in a networked organization

In this paper, I present a method to solve a node discovery problem in a networked organization. Covert nodes refer to the nodes which are not observable directly. They affect social interactions, but do not appear in the surveillance logs which record the participants of the social interactions. Discovering the covert nodes is defined as identifying the suspicious logs where the covert nodes would appear if the covert nodes became overt. A mathematical model is developed for the maximal likelihood estimation of the network behind the social interactions and for the identification of the suspicious logs. Precision, recall, and F measure characteristics are demonstrated with the dataset generated from a real organization and the computationally synthesized datasets. The performance is close to the theoretical limit for any covert nodes in the networks of any topologies and sizes if the ratio of the number of observation to the number of possible communication patterns is large

Social Media Exploitation by Covert Networks: A Case Study of ISIS

Social media has quickly become a dominant mode of professional and personal communication. Unfortunately, groups who intend to perform illegal and/or harmful activities (such as gangs, criminal groups, and terrorist groups) also use it. These covert networks use social media to foster membership, communicate among followers and non-followers, and obtain ideological and financial support. This exploitation of social media has serious political, cultural, and societal repercussions that go beyond stolen identities, hacked systems, or loss of productivity. There are literal life-and-death consequences of the actions of the groups behind these covert networks. However, through tracking and analyzing social media content, government agencies (in particular those in the intelligence community) can mitigate this threat by uncovering these covert networks, their communication, and their plans. This paper introduces common social media analysis techniques and the current approaches of analyzing covert networks. A case study of the Syrian conflict, with particular attention on ISIS, highlights this exploitation and the process of using social media analysis for intelligence gathering. The results of the case study show that covert networks are resilient and continually adapt their social media use and presence to stay ahead of the intelligence community

Locating People of Interest in Social Networks

By representing relationships between social entities as a network, researchers can analyze them using a variety of powerful techniques. One key problem in social network analysis literature is identifying certain individuals (key players, most influential nodes) in a network. We consider the same problem in this dissertation, with the constraint that the individuals we are interested in identifying (People of Interest) are not necessarily the most important nodes in terms of the network structure. We propose an algorithm to find POIs, algorithms to collect data to find POIs, a framework to model POI behavior and an algorithm to predict POIs with guaranteed error rates. First, we propose a multi-objective optimization algorithm to find individuals who are expected to become stars in the future (rising stars), considering dynamic network data and multiple data types. Our algorithm outperforms the state of the art algorithm to find rising stars in academic data. Second, we propose two algorithms to collect data in a network crawling setting to locate POIs in dark networks. We consider potential errors that adversarial POIs can introduce to data collection process to hinder the analysis. We test and present our results on several real-world networks, and show that the proposed algorithms achieve up to a 340% improvement over the next best strategy. Next,We introduce the Adversarial Social Network Analysis game framework to model adversarial behavior of POIs towards a data collector in social networks. We run behavior experiments in Amazon Mechanical Turk and demonstrate the validity of the framework to study adversarial behavior by showing, 1) Participants understand their role, 2) Participants understand their objective in a game and, 3) Participants act as members of the adversarial group. Last, we show that node classification algorithms can be used to predict POIs in social networks. We then demonstrate how to utilize conformal prediction framework [103] to obtain guaranteed error bounds in POI prediction. Experimental results show that the Conformal Prediction framework can provide up to a 30% improvement in node classification algorithm accuracy while maintaining guaranteed error bounds on predictions