Intuitive visualization of the intelligence for the run-down of terrorist wire-pullers

In tuitiv e visualizat ion of the in tellig ence for the run-do wn of terro rist wi re-pullers Y oshiharu Maeno ∗ and Y ukio Ohsa w a † Octob er 25, 2018 Abstract The in vestigation of the terrorist attack is a time-critical task. The inv estigators hav e a limited time window to diagnose the organiza tional backgro u nd of the terro rists, to run do wn and arrest the wi re-p ullers, and to take an action to preven t or eradicate the terrorist attac k . The intuitiv e i nterface to visualize the intelli gence data set stim u lates the in- vestig ators’ exp erience a n d kno wledge, a n d a ids them in decision-making for an immediately effective action. This pap er presents a computational metho d to analyze the intelli gence data set on the collective actions of the p erp etrators of the attac k , and t o visualize it into th e form of a so- cial netw ork diagram which predicts the p ositions where the wire-pullers conceals themselves. 1 In tro du ction T err orist attacks cause great econo mic, so cia l and en vir onmental impacts. The disaster b y the ter rorist attacks is different from the emer gence a rising from earthquakes or hurricanes, in that ac tive non-r outine r esp onses are alwa ys nec- essary , and often p os s ible. The inv estigation of the terr orist attacks and the resp onses are, howev er, a time-critica l ta sk. The inv estig a tors ha ve a limited time windo w to diagnose the organizational background of the terr orists, to run down and arr e st the wir e-pullers, and to take an action to prevent or eradicate the attac k. The arrest of the wire- pullers is mor e likely to dismantle the terro rist organiza tion than that of the p e r p etrators. This is b ecause a limited n umber of pers o ns ca n provide the p er petr ators with financial s upp or ts and elabor ate plots, while a p erp etrato r can b e replac e d by another p erson easily . Let us show an example in the 9 /11 terro rist attack in 2001 . Mustafa A. Al-Hisawi, whose alternate name was Mustafa Al-Hawsa wi, was alleged to be ∗ Corresp onding author, Graduate Sc ho ol of Systems Managemen t, Tsukuba Univ ersity , Otsuk a Bunkyo-ku, 112-0012 T okyo, Japan. email: maeno.yoshiharu@nift y .com. † Sc ho ol of Engineering, Universit y of T oky o, Hongo Bunkyo - ku, 113-8656 T okyo, Japan. email: ohsaw a@sys.t.u-tokyo.ac.jp. 1 a wir e-puller, who had acted as a financial manager o f Al Qaeda. He had at- tempted to help ter r orists enter the United States, and provided the hijac kers of the 4 aircr afts with financial supp ort worth more than 300,00 0 dollar s, ac- cording to Wikip edia (free encyclop edia on WWW). F ur thermore, Usama bin Laden is s us pec ted to b e a wire- puller b ehind Mustafa A. Al-Hisawi and the conspirator s b ehind the hijackers. This pap er pr e sents a computationa l metho d to analyze the intelligence data set o n the collec tive a c tions of the p erp etra to rs of the terro rist attack, and to visualize it in to the form of a social net work diagram whic h predicts the po sitions where the wire-puller s conceals themselves. The intuit ive interface b etw een the int ellig ence data set and the investigator thro ugh the s o cial netw ork diag ram is exp ected to stimulate the in vestigators’ exp erie nce and knowledge, a nd to aid them in de c ision-making for an immediately effectiv e action. Ma thematically , the ob jective of the ana lysis is to solve a no de discov er y pr oblem in a co mplex net work. Two layers are assumed in this problem. The first lay er describ es the latent pattern of the communication among p ersons , which is the transmission of the influence o n decision-ma king. It is mo deled by a g raph structure, where no des are pe r sons, and links indicate the presence of communication among the per sons. The structure is a ssumed not to b e o bserv able directly . The sec ond lay er descr ib es the obser v able pattern of co llective actions of the p erso ns. It app ears as a result of the comm unica tion in the la ten t lay er. Part, or all of this pa tter n is assumed to b e o bserv able. T o solve the no de discov e r y problem means to discov er some clues on the cov ert no des , which pa rticipate in the communication in the latent lay er, but do no t app ear in the collective actio ns in the obser v able layer. Related w or k s ar e re viewed briefly in the section 2. A method to solve the no de discov er y problem is developed in the sec tion 3 . The section 4 demon- strates an ex ample wher e the p erp etrato rs and a wire-puller in the 9/11 terr orist attack are analy z ed. The sec tion 5 concludes this pap er. 2 Related w orks So cial netw o rk a nalysis [3] is a study of so cia l structur es, whic h are made of no des (individuals, organiza tions etc.), which are linked by one or more sp ecific t y p es o f r elationship (tr a nsmission of influence, pres ence of trust etc.). T er rorist or criminal organiz a tions have b een studied empir ically [20]. F actor ana ly sis is applied to study email ex change in Enr on, which ended in bankruptcy due to the institutionalized accounting fraud [11]. The criminal organiza tions tend to be strings of inter-linked small gro ups that lack a central lea der, but to co ordina te their activ ities alo ng logistic trails a nd thro ugh b onds of fr iends. Hyp othesis can b e built b y paying atten tion to remark able white sp ots and hard-to-fill p o- sitions in a netw ork [12]. The co nspirators in the 9/1 1 terrorist o rganizatio n are rele v an t in reducing the distance b etw een hijackers, and enhancing co mm u- nication efficiently [13]. The 9/11 terr orists’ so cial netw o rk is inv es tig ated fr om the v ie wpo int of efficiency and s ecurity trade-off [1 8]. Mor e security-oriented 2 structure a rises from longe r time-to-task of the terror is ts’ ob jectiv es . The co n- spirators improve commun ic a tion efficiency , pres e rving hijack er s’ small visibility and exp osure. Research int er ests hav e be e n extending fr om desc ribing characteristic nature, tow ard mo deling and pr e dic ting unknown pheno mena. A hidden Ma rko v mo del and a Bayesian net work ar e combined to predict the b ehavior of terro rists [22]. A link discovery and no de discovery are typical problems in prediction tasks . The link discovery predicts the existence of an unknown link b etw een t wo no des from the information on the known attributes o f the no des and the known links [9]. The Mar ko v random net work is an undirec ted gr aphical mo del similar to a Bay esian netw ork, which is used to lear n the dep endency betw een the links which share a no de [1], [6]. The link discov ery tec hniques a re combin e d with do main- sp ecific heur istics and exp ertise, and applied to many practica l problems. The Marko v random netw ork is applied to co llab orative classifica tio n o f w eb pag es [23]. P rediction of the collab or ation b etw een sc ie n tists from the published co- authorship is studied [1 5]. Inference of the fr iendship betw een p eople from the information av ailable on their web pages is studied [2]. Missing links in a hierarchical netw o rk is predicted b y estimating the parameter s o f a dendrog ram, which genera tes the observed netw ork structure [4]. The dendro g ram is a tree diagram used to illustra te the arra ngement o f the hierarchical cluster s. On the o ther hand, the no de discovery predicts the existence of a n unknown no de ar ound the known no des from the infor mation o n the colle ctive b ehavior of the netw o rk. Related works in the no de discov ery is, howev er, limited. Heur istic metho d for no de discov er y is prop osed in [16], [19]. The method is applied to analyze the c overt so cial net work foundation b e hind the ter rorism disasters [17]. Learning techniques of laten t v ariables ca n b e employ ed, once the pr esence of a no de is known. [21] studied lea rning of a structur e of a linear la tent v ariable graph. [7] studied lear ning of a structure of a dynamic probabilistic net work. But, while the accuracy of the heuristic metho d is limited, these principled ana- lytic approa ches in learning a re not pra ctical to handle r eal human r e lationship and comm unica tion observed in a so cia l netw or k , where m uch complexity ap- pea rs. The complexity includes bi-directio na l and cyclic influence a mong man y observed and latent no des. W e need a n efficient and a ccurate metho d to solve the no de discov er y pro blem. 3 Metho d for inference, disco v ery , and visual- ization 3.1 In telligence data set Imagine a situation where an inv es tigator diagno ses the intelligence data set for the run-down of the wire-puller b ehind the terr orist attack. Figure 1 illustrates the situation. T he pattern of the co mm unica tion among p erp etra tors and a wire- puller in the terro rist or ganization lies in the la tent lay er. It is the tra nsmission of the influence o n decision-ma king. The pattern governs tha t of the collec tive 3 Figure 1: Inv es tig ator dia gnosing the intelligence data set for the run-down of the wire-puller b ehind the terr orist a ttack. The comm unication and influence on decisio n-making among the per petr ators a nd a wire- puller in the terrorist organiza tion g ov erns the pa tter n of the collective actions (such as attending a n meeting or ev ent) of the per petr ators who ha ve prepared for the attack. The communication and influence a re assumed not to be observ able directly . Part or all o f the co llective actions ar e assumed to b e o bserv able. The intelligence data set co nsists of the secr et a gents’ r ecords on the collec tive actions of the p erp e- trators. The wir e -puller do es not app ear in the intelligence. After link inference and node disco very , the in telligence data set is visualized into a n int uitively understandable so cia l netw or k dia gram. 4 actions of the p er petr ators who hav e pr e pa red for the terror ist attack in the observ able layer. The collective actio ns a r e attending an meeting or event , for example. The int ellig ence data set consists of the secr et age nts’ reco rds on the col- lective actions of the p er p etr ators. The wire-puller, ho wev er , do es not app ear in the intelligence. The wir e -puller is refer r ed to by a cov er t no de n cvt . The inv estigator applies three too ls: (1) link inference to infer the communication betw e e n the per p etrators, (2) no de disco very to dis cov er the p osition of the wire-puller, and (3) visua lization of the r esult of the inference and discovery int o the form of a so cial netw or k dia gram. The so cial netw ork diag ram serves as an intuitiv e interface to under stand the intelligence data set. Mathematical definition of the intelligence data set is given here. In eq.(1), δ i represents the participants to single communication in the latent layer. It is a set of no des n j . δ i = { n j } . (1) It is assumed that the individual intelligence data o btained fro m the obser v- able layer is the pa ttern in eq.(1) minu s the cov er t no de n cvt . It is denoted by eq.(2). d i = δ i \{ n cvt } . (2) The whole in telligence data set is denoted by D in eq.(3). The num b er of int ellig ence data is | d | . D = { d i } (0 ≤ i ≤ | d | − 1) . (3) The intelligence data set D can be expressed by a t wo dimensional matrix of binary v aria bles. The presence, o r absence of the no de n j in the intelligence data d i is repr e s ented by eq.(4). The num be r of no de sp ecies is g iven by | n | . d ij =  1 if n j ∈ d i 0 otherwise (0 ≤ j ≤ | n | − 1) . (4) The in tellig ence data s e t is the input to the method for link inference, no de discov ery , and v isualization. The no des in an intelligence data do not nece s sarily form a cliq ue structure, where there ar e links b etw een every pair of no des. Assuming that they fo rmed a clique would r e sult in a very densely connected structure in the latent lay er. Such a sup erficial interpretation o f the intelligence data set leads to a wro ng understanding of the ter rorist o rganiza tion. T his is why we need a new computational metho d. The metho d is descr ib e d b elow. 3.2 Link inference The commun ic a tion in the latent lay er is mo deled by a graph. Strictly sp eaking, a graph, a diagram, and a ma p are defined differently . A gra ph is an a bstract mathematical entit y , which consists of a set whose elements a re no des , and a 5 set o f pair s of no des. A diag ram is a 2 dimensio nal expression of a graph, which is the dra wing o f the web of the links interconnecting at the no des. In a map, faces a re r elev ant, which are determined by the links and their intersections. A net work refer s to either a gr aph, or a diagr a m. The map is not used in this pap er. The nodes in the graph represent pe r sons, and the links represent the transmission of influence. The links betw een the no des which app eared in the int ellig ence data set is inferred with the maximum likeliho o d estimation (MLE). A par ametric form is defined to describ e the link to po logy . The probability where the influence tra nsmits from an initiating no de n j to a resp onder no de n k is r j k . T he influence tr ansmits to m ultiple resp onder s independently in pa rallel. It is similar to the degr e e of collab ora tion probability in trust mo deling [14]. Eq.(5) gives constra ints o n r j k . 0 ≤ r j k ≤ 1 , r j j = 1 (0 ≤ j, k ≤ | n | − 1) . (5) The quantit y f j is the probability where the no de n j bec omes an initiator. The para meters r j k and f j are denoted by r collectiv ely . It is the target to estimate from the o bserv ation data set. r = { r j k } ∪ { f j } (0 ≤ i, j ≤ | n | − 1 ) . (6) The log arithmic likeliho o d function [5 ] is defined b y eq.(7). In sta tistics, a likelihoo d function is a conditiona l pr o bability function of the o bs erv ation given the pa rameters of a statistica l mo del. It plays a key ro le in statistica l inference such as B ayes’ Law. The proba bilit y wher e D occ urs for g iven r is denoted by p ( D | r ). L ( r ) = lo g( p ( D | r )) . (7) The individual obser v atio ns are assumed to b e indep endent. E q.(7) be comes eq.(8). L ( r ) = log( | d |− 1 Y i =0 p ( d i | r )) = | d |− 1 X i =0 log( p ( d i | r )) . (8) The quantit y f k | ij in eq.(9) is the proba bility wher e the pres ence o r absence of the no de n k as a resp onder to the s tim ula ting no de n j coincides with the observ ation d i . f k | ij =  r j k if d ik = 1 for g iven i and j 1 − r j k otherwise . (9) Eq.(9) is equiv alent to eq.(10) since the v alue of d ik is either 0 or 1. f k | ij = d ik r j k + (1 − d ik )(1 − r j k ) . (10) The proba bility p ( D | r ) in eq.(8) is expressed by eq.(1 1). 6 p ( d i | r ) = | n |− 1 X j =0 d ij f j Y 0 ≤ k ≤ | n | − 1 k 6 = j f k | ij . (11) The loga rithmic likeliho o d function is expre ssed by eq.(12). L ( r ) = | d |− 1 X i =0 log( | n |− 1 X j =0 d ij f j | n |− 1 Y k =0 { 1 − d ik + (2 d ik − 1) r j k } ) . (12) The max ima l likeliho o d estimator ˆ r is obtained by solving e q.(13). It rep- resents the inferred top olo gy of the netw ork. ˆ r = arg max r L ( r ) . (13) Lagra ng e m ultiplier s can be used to solve eq.(13) ana lytically . But, a t present, computational o ptimization is suitable to solve a larg e-scale proble m. The hill climbing metho d is a simple incremental optimization technique. Un- suitable selection o f the initia l condition may lea d to the sub-optimal so lutions. Adv anced meta-heuris tic algo rithms such a s simulated annealing , or genetic a l- gorithm [1 0] may be emplo yed to av oid sub-optimal solutions. It is not within the scop e of this pap er to explo r e the computational tec hnique to solve eq .(13). The details of the alg orithm implementation are no t describ ed here. 3.3 No de Discov ery The clues on the cov e r t no de in the latent layer are discov er ed after the top ol- ogy of the links b etw een the no des, whic h app eared in the intelligence data set, is infer red with the maximum likelihoo d estimation (MLE) in 3.2. The degr ee of s us piciousness ( s ( d i )) is a ssigned to the individua l intelligence da ta d i . It is defined as the likeliness where the cov er t no de would a pp ea r in the intelligence data, if it b ecame ov ert, or if the wire-puller were observ able. The degr ee of suspiciousness is ev aluated b y eq.(14), wher e g ( x ) is a monotonically decreas - ing function of the v ar iable x . Larger v alue in eq.(14) means more suspicious int ellig ence data. s ( d i ) ∝ g ( p ( d i | ˆ r )) . (14) Ranking of the intelligence data can b e c alculated from the v alue o f eq.(14). The k -th most suspicious intelligence data is g iven by d σ ( k ) in eq .(15). The degree of s uspiciousness o f d σ ( j ) ( s ( d σ ( j ) )) is larger than that of d σ ( k ) ( s ( d σ ( k ) )) for any j < k . σ ( k ) = arg max i 6 = σ ( j ) j < k s ( d i ) (0 ≤ k ≤ | d | − 1) . (15) 7 The degr ee of sus picio usness ( s ( n j )) can a lso b e as signed to the individual no des n j . More suspicious node is more likely to be the neig hbor node of the cov ert no de. O r, it is more likely to b e the p erp etrato r who is a sso ciated with the wir e -puller closely . The deg ree of suspiciousness s ( n j ) ca n b e ev alua ted by accumulating the degree of sus pic io usness of the intelligence data ( s ( d i )), where the no de a ppe ars, as in eq.(16). The function w ( k ) is an appr o priate weigh t function. s ( n j ) ∝ P | d |− 1 k =0 w ( k ) B ( n j ∈ d σ ( k ) ) P | d |− 1 k =0 B ( n j ∈ d k ) . (16) The Bo olea n function in eq.(16) is defined b y eq .(17). B ( x ) =  1 if prop osition x is T rue 0 otherwise . (17) Alternatively , muc h simpler means to disc ov er the sus picio us no des may b e taken. The s uspicious no des ar e the neighbor no des n nbr , which app ear in the most suspicious intelligence da ta d σ (0) . It is denoted by eq.(18). { n nbr } ∈ d σ (0) . (18) 3.4 So cial net work visualization The output of the link inference and no de discovery is drawn as a s o cial netw o rk diagram, which predicts the p osition of the covert no de n cvt with the suspicio us neighbor no des n nbr . The link to p o logy is relev ant in the so cial net work diag ram. But, the a bs olute p osition o f the no des, the distance b etw een the no des, the direction along the v ertica l a nd horizontal axes ar e no t relev ant. The p ositio n of the no des is determined b y the employ ed graph dr awing algor ithm. F or example, the spring mo del [8] is p opular. The mo del conv erts the strength of the relatio nship acro s s the link b etw een tw o nodes in to Ho o ke’s constant of the spring, which is pla c ed be tw ee n the no des imag ina rily , and calculates the equilibrium p o sition of the no des . A t fir st, the s o cial netw ork of the no des which app eared in the intelligence data set is drawn. The communication in the latent lay er is present betw een the no des n j and n k , if the maximal likelihoo d estimator ˆ r j k is la rger than 0. The estimato r ˆ r j k approaches to either 1 or 0, in most ca ses. The link is drawn if ˆ r j k > r thr , b ecaus e s tr ong r elationship is of interest to the in vestigator. The threshold r thr may b e 0 .9 o r lar ger. Next, the suspicious no des n nbr in eq.(18) are a dded into the so cial netw or k diagr am with the discovered cov ert no de n cvt . The iden tity of the cov er t no de n CVT is not known at this s tage of inv estig ation. The covert node is , therefor e, represented by an unlab eled (unnamed) no de. The links be t ween the covert no de and the suspicio us neighbor no des ar e drawn. The par ameter ˆ f j , which is the probability where the node n j bec omes an initiator of communication, is not visualized into the top ology of the so cial net- work diagra m. If it is necessar y to indica te the v alue g raphically , the lar geness 8 T able 1: The 19 p e rp etrators who are resp onsible fo r hijacking the 4 commercial flights (num b e r : AA11, AA77, UA93, and UA175) in the 9/ 11 terr orist attack, and app ear in a sa mple in tellig e nce data set. Flight Hijack er AA11 Ab dul A Al-Omar i, Moha med Att a , Satam Suqami, W a il Alshehri, W aleed Alshehri AA77 Ha ni Hanjour, Khalid Al-Mihdhar , Ma jed Mo qed, Naw af Alhazmi, Salern Alhazmi UA93 Ahmed Al-Haznawi, Ahmed Alnami, Saeed Alghamdi, Ziad Ja rrah UA175 Ahmed Alghamdi, F ayez Ahmed, Hamza Algha mdi, Marwan Al-Shehhi, Mohand Alshehri of the v alue ca n b e enco ded int o the color , o r la rgeness of the sy m b o l of the no de. 4 Visualization of the 9/11 terrorists An exa mple of visua lizing the intelligence data set is demonstrated. The intelli- gence da ta set is the re cords on the co llective a ctions of the p er petr ators o f the 9/11 terr orist attack in 20 0 1. The 19 p erp etr a tors a re listed in T able 1, who ar e resp onsible for hijacking the 4 commercial flig h ts in the 9/11 terr orist attack (n umber : American Airlines AA11 (Bo eing 7 67 from B oston to Lo s Angele s ), AA77 (Bo eing 757 from W ashing to n to Los Angeles), United Air lines AA175 (Bo eing 767 fro m Bosto n to Los Angeles ), and UA93 (Bo eing 7 5 7 from Newark to San F r ancisco)), and app ear in a sample intelligence data s et. The intelligence data s et is listed in T able 2. The data set is not real, but is generated for the purp os e o f computer sim ulation. The intelligence da ta se t is the input to the method to genera te a so cial netw ork diag ram, which pr edicts the po sitions where the wire-pullers conceals themselves. The resulting so cial net work dia gram is shown in Figure 2. It visualize s the inferred links betw een the no des, and the node disco vered from the sample intelligence data set in T able 2 . The no des repres ent the 1 9 p erp etrator s. The links represent the transmission o f influence betw ee n the p er petr ators in the latent layer. They gov ern the pattern of the collective actions in the obse r v able lay er, w hich were recorded in the int ellig ence da ta set. The p erp etrators in a n int ellig ence data do not for m a simple clique structure, actually . F or example, if the 8 node s in d 9 formed a clique structure, the no dal degree of the no des would be 7. The actual no dal degre e is muc h sma lle r than 7. T he net work is muc h less densely connected than it would be if the per pe trators in a sing le intelligence data formed a clique str ucture. The metho d r eveals the less densely co nnected top ology of the ter r orist organiz a tion. 9 T able 2: Sa mple intelligence data set on the p erp etrator s in T a ble 1, which is the input to the metho d (eq.(3) in 3.1) to generate a so cial netw or k diag ram. Data Participan t to a co lle ctive a ction d 0 { Ab dul A Al-Omar i, F a yez Ahmed, Hani Hanjour, Marwan Al-Shehhi, Mohamed Att a , Salern Alhazmi, Ziad Jarr ah } d 1 { Ab dul A Al-Omar i, Ha ni Hanjour, Marwan Al-Shehhi, Mohamed Att a , Naw af Alhazmi, Ziad Ja rrah } d 2 { Ab dul A Al-Omar i, Ma rwan Al-Shehhi, Mohamed Atta, W aleed Alshehri } d 3 { Ab dul A Al-Omar i, Sa tam Suqami, W ail Alshehri, W a leed Alshehri } d 4 { Ahmed Alghamdi, Ahmed Al- Ha znawi, Ahmed Alnami, Hamza Alg hamdi, Mohand Alshehri, Naw a f Alhazmi, Sa eed Alghamdi } d 5 { Ahmed Alghamdi, Hamza Alghamdi } d 6 { Ahmed Al-Haznawi, Ahmed Alna mi, Hamza Alghamdi, Naw af Alhazmi, Saeed Alghamdi } d 7 { Ahmed Al-Haznawi, Hamza Alghamdi, Saeed Alghamdi, Zia d Ja rrah } d 8 { Ahmed Al-Haznawi, Hani Hanjour , Marwan Al-Shehhi, Mo hamed At ta , Salern Alhazmi, Zia d J arra h } d 9 { Ahmed Alnami, Hamza Algha mdi, Ha ni Hanjour, Khalid Al-Mihdhar , Mohamed Att a , Naw af Alhazmi, Saeed Alg hamdi, Salern Alhazmi } d 10 { Ahmed Alnami, Hamza Algha mdi, Nawaf Alhazmi, Saee d Alg hamdi } d 11 { F ayez Ahmed, Hamza Alghamdi, Moha nd Alshehr i } d 12 { F ayez Ahmed, Marwan Al-Shehhi, Mohamed At ta , W aleed Alshehr i } d 13 { F ayez Ahmed, Marwan Al-Shehhi, Mohand Alshehri } d 14 { Hani Hanjour, Khalid Al-Mihdhar , Ma jed Mo qed, Marwan Al-Shehhi, Mohamed Att a , Naw af Alhazmi, Ziad Jar rah } d 15 { Hani Hanjour, Khalid Al-Mihdhar , Naw af Alhazmi } d 16 { Hani Hanjour, Ma jed Mo qed } d 17 { Marwan Al-Shehhi, Nawaf Alhazmi, Salern Alhazmi, Zia d Jarra h } d 18 { Satam Suqami, W a il Alshehri, W aleed Alshehri } d 19 { Satam Suqami, W a il Alshehri, W aleed Alshehri } 10 Figure 2: So cial netw ork diagram which visualizes the links b etw een the no des, and the no de discovered fr o m the sample intelligence data set in T a ble 2. The no des represe nt the 19 p erp etra tors. The links re pr esent the transmissio n of influence b etw een the p erp etrators , whic h governs the pattern of the collective actions which were reco r ded in the in telligence data set. The discov ered no de, which is not la b eled in the figure, indicates the p ositio n where the wire - puller is most likely to conce al himself. The no de has 4 links (red broken lines) to F ay ez Ahmed, Moha med Atta, Marwan Al-Shehhi, a nd W a leed Alshehr i. They are the keystone neig hbors for the r un-down and arr est of the wire-puller . The wire-puller in the figur e turns out to b e Mustafa A. Al-Hisawi in [1 3]. 11 The discov er ed no de n cvt , which is no t lab eled (named) in the figur e, indi- cates the positio n where the wire -puller is mo st likely to conceal himself. The no de has links (red broken lines) to the 4 neig h b or node s : F ayez Ahmed, Mo- hamed A tta, Marwan Al-Shehhi, and W aleed Alshe hr i. The neigh b or no des are n nbr ∈ d 12 , b ecause d σ (0) = d 12 is the most suspicious intelligence data . Mohamed Atta and W ale e d Alshehri hijacked the flight AA11, which flew into the Nor th T ower of the W o rld T rade Center. Moha med Att a was the lea der of the hijackers. W aleed Alshehr i assis ted Mohammed Att a . F ayez Ahmed and Marwan Al-Shehhi hijack ed the flig ht UA175, which flew into the So uth T o wer. Marwan Al-Shehhi, who tra ine d at a pilot sc ho o l with Mohammed Atta, flew the air craft. F ay ez Ahmed w a s a lso a pilo t. The wire- puller was a link age b e- t ween the 2 flights which were us e d a s weap on to the financial la ndma rk o f the United States. They a r e the keystone neig h b o r s to inv es tigate to unr av el who is the wire-puller , o r what is b ehind the ter rorist attack. The ties b etw een the p ers ons conce rned are revealed by [13]. They include the 19 p erp etrators , cons pirators, and susp ects. The tie strength is estimated by the amount of time together b y a pair of terrorists . Those living tog ether, attending the same s cho ol, or the same tr aining would have s trong ties. Those trav eling together, a nd participa ting in meetings tog ether would have ties of mo derate streng th. Finally , those who were recor de d a s having a financia l trans- action tog ether, o r par ticipating in an o cca sional meeting would hav e weak ties. Publicly av a ilable data is used as such intelligence data set. By comparing with the ties in [13], the wire - puller in Figure 2 turns out to b e Mustafa A. Al-Hisawi. He is b elieved to b e a financial manager o f Al Qaeda , and to give F ay e z Ahmed a credit card as a financ ia l suppo rt for the attack. Remind that this r esult is for demonstration purp ose. The ob jective is to demonstrate how the in tuitive visualization can help the inv es tig ator diagno s e the intelligence data set, r ather than to uncov er the r eal r ole of Mus ta fa A. Al-Hisawi, or Usama bin La den in the 9/1 1 terr orist attack. 5 Conclusion This pa pe r presented a computatio nal metho d to analyze the in telligence data set on the co llective actions of the p erp etrator s of the terro rist a tta ck, and to vi- sualize it into the for m of a s o cial netw ork diagra m, which pr edicts the p ositio ns where the wir e-pullers co nceals themselves. This will help the inv estigato r s, w ho hav e a limited time window to diag nose the or ganizationa l background of the terroris ts, to run down and arrest the wire-pullers , and to ta ke an a ction to preven t or er adicate the ter r orist a ttack. The in tuitive int er face to vis ualize the int ellig ence data set will stimulate the inv estig a tors’ e x per ience and knowledge, and aids them in decisio n-making for an immediately effective action. The imp orta nt asp ect of the presented metho d is that the diagnosis of the inv estigator illustrated in Fig ure 1 can b e r e pea ted many times. The inv estiga tor can predict the p osition of Mus ta fa A. Al-Hisawi from the intelligence da ta set on the 1 9 p erp etrato rs. Then, once the wire- puller is identified as Musta fa A. 12 Al-Hisawi, the in tellig ence data set on Mustafa A. Al-Hisawi should b e co llected and added to the diagnos is . Similarly , the inv estiga tor can predict the pos ition of the 21 st p ers on a gain from the intelligence da ta set on the 19 p erp etra tors and Mustafa A. Al-Hisawi. The metho d pr ovides the investigator with the intuitiv ely comprehensible direction o f p o tentially fruitful inv estigation from what is already known tow ard what is not, but c an be known. References [1] C. Anderson, S. W asserman, and B. Cro uch, A p ∗ primer, Logit mo dels for so cial netw or ks, So cial N et works 21 , 37-6 6 (1999). [2] L. A. Adamic, and E. Adar, F riends and neighbor s on the web, So cial Networks 25 , 211 -228 (2 003). [3] P . J. Carring ton, J. Scott, and S. W asser man eds., Mo dels And Metho ds In S o cial Network Analysi s . Cambridge University Pr e ss (20 05). [4] A. Cla uset, C. Mo o re, and M. E. J. Newman, Hierar chical structure and the predictio n o f missing links in netw o rks, Natu r e 453 , 98-101 (2008). [5] R. O . Duda, P . E. Har t, a nd D. G. Stork, Pattern classific ation . Wiley- Int er science (2000 ). [6] O. F rank, and D. Stra uss, Ma r ko v gr aphs, Journal of t he Americ a n Statistic al Asso ciation 81 , 83 2-842 (19 86). [7] N. F r iedman, K. Murphy , and S. Russell, Learning the structure o f dy- namic probabilistic netw orks, in Pr o c e e dings of the Annual Confer enc e on Unc ertainty in Artificial Intel ligenc e , Madis o n (1998). [8] T. M. J. F r uch terman, and E. M. Reingo ld, Graph drawing by force- directed placement, Softwar e - Pr actic e and Exp erienc e 1 8 , 1 129-1 164 (1991). [9] L. Geto or, and C. P . Diehl, Link mining: a survey , A CM SIGKDD Explor ations 7 , 3-12 (200 5). [10] T. Hastie, R. Tibshirani, a nd J. F riedma n, The elements of statisti- c al le arning - Data mining, infer enc e, and pr e diction . Springer-V erlag (2001). [11] P . S. K eila, and D. B. Skillicorn, Structur e in the Enr on email data set, Journal of Computational & Mathematic al Or ganization The ory 11 , 183-1 99 (2006). 13 [12] P . Klerks, The netw ork paradigm applied to criminal or ganizations, Conne ctions 24 , 53-6 5 (20 02). [13] V. E. Krebs, Mapping net works of terror ist cells , Conne ctions 24 , 43 - 52 (2002). [14] N. Lavra˘ c, P . Ljubi ˘ c, T. Urban˘ ci˘ c, G. Papa, M. Jermol, a nd S. Boll- halter, T r ust mo deling for net worked orga nizations us ing re puta tion and collab oration estimates, I EEE T r ansactions on Systems, Man, & Cyb ernetics Part C 37 , 42 9-439 (20 07). [15] D. Lib en-Now ell, and J. M. Kleinberg , The link predic tio n problem for so cial ne tw o rks, Jo urnal o f America n So ciety of Information Science and T ec hnology 58 , 101 9-103 1 (200 7). [16] Y. Maeno, and Y. Ohsawa, Human-co mputer interactive annealing for discov ering invisible dark even ts, IEEE T r ansactio n s on Indust rial Ele c- tr onics 54 , 118 4-119 2 (200 7). [17] Y. Ma eno, and Y. Ohsawa, Analyzing cov ert so cial net work foundation behind terroris m disaster , in pr ess, Int ernational Journal of Servic es Scienc es (2008 ) (av ailable e-pr int h ttp:// arxiv.o r g/abs/ 0710.4231 ). [18] C. Morselli, C. Giguere, and K. Petit, The efficiency/secur ity trade-o ff in criminal netw or ks, So cial N etworks 29 , 143- 153 (2007 ). [19] Y. Ohsawa, Data crysta llization: chance discov er y extended for dea ling with unobser v able even ts, New Mathematics and Natur al Computation 1 , 373 -392 (200 5). [20] M. Sag e ma n, Understanding terr or networks . Universit y of Pennsylv a- nia Press (20 04). [21] R. Silv a, R. Scheines, C. Glymo ur, and P . Spirtes , Learning the struc- ture of linear latent v ariable mo dels, J ou rn al of Machine L e arning R e- se ar ch 7 , 191 -246 (200 6). [22] S. Singh, J. Allanach, T. Haiying , K. Pattipati, and P . Willett, Sto chas- tic mo deling of a terr orist even t v ia the ASAM system, in Pr o c e e dings of the IEEE International Confer enc e on Systems, Man & Cyb ernetics , Hague (2004 ). [23] B. T ask ar , M. F. W ong, P . Abb e e l, and D. Koller, Link predictio n in relational data, in Pr o c e e dings of the Neur al Information Pr o c essi n g Systems Confer enc e , V a nc o uver (2003). 14