Intelligence analysts face a difficult problem: distinguishing extremist rhetoric from potential extremist violence. Many are content to express abuse against some target group, but only a few indicate a willingness to engage in violence. We address this problem by building a predictive model for intent, bootstrapping from a seed set of intent words, and language templates expressing intent. We design both an n-gram and attention-based deep learner for intent and use them as colearners to improve both the basis for prediction and the predictions themselves. They converge to stable predictions in a few rounds. We merge predictions of intent with predictions of abusive language to detect posts that indicate a desire for violent action. We validate the predictions by comparing them to crowd-sourced labelling. The methodology can be applied to other linguistic properties for which a plausible starting point can be defined.

Copresence networks are constructed by associating individuals who are at the same place at the same time - in our case at police-involved incidents. They generalize networks such a co-offender networks, which are becoming mainstream police and intelligence tools. Because copresence can be generated from police incident data, such networks are cheap to construct since they require no specialised surveillance - they are implicit in data that is routinely collected. We demonstrate that copresence network analytics, using graph embedding, gives a sense of the criminal landscape in a city; shows the importance of non-criminals in this landscape; and suggests targets for further in-depth attention (unusual subgroups, non-criminals who are brokers). We also show that homophily in level of criminality generally holds, but there are strong exceptions that deserve police attention. Copresence networks also arise naturally in other domains such as border protection and intelligence surveillance, so the techniques described here are also applicable in those domains.

Many corpora of intelligence interest are so large that it is impractical to read them entirely. Analysts need tools that will focus attention on significant structures and particular documents. Here we exploit singular value decomposition and word2vec as tools for this purpose, and compare them with one another in a real-world application -- a malware forum from the dark web.

BACKGROUND: Data from patients with rare diseases is often produced using different platforms and probe sets because patients are widely distributed in space and time. Aggregating such data requires a method of normalization that makes patient records comparable. RESULTS: This paper proposed DBNorm, implemented as an R package, is an algorithm that normalizes arbitrarily distributed data to a common, comparable form. Specifically, DBNorm merges data distributions by fitting functions to each of them, and using the probability of each element drawn from the fitted distribution to merge it into a global distribution. DBNorm contains state-of-the-art fitting functions including Polynomial, Fourier and Gaussian distributions, and also allows users to define their own fitting functions if required. CONCLUSIONS: The performance of DBNorm is compared with z-score, average difference, quantile normalization and ComBat on a set of datasets, including several that are publically available. The performance of these normalization methods are compared using statistics, visualization, and classification when class labels are known based on a number of self-generated and public microarray datasets. The experimental results show that DBNorm achieves better normalization results than conventional methods. Finally, the approach has the potential to be applicable outside bioinformatics analysis.

In many parts of the world there are complex, violent interactions among groups with widely varying agendas. Situational awareness is difficult because there is rarely a clear distinction between good and bad actors, and there are constantly shifting alliances and oppositions between groups. This makes it difficult for analysts to understand the ecosystem of a country and region; still more to conceive of helpful interventions. We show how to use a newly developed spectral graph embedding technique that allows social networks with edge weights that are positive (alliance) and negative (opposition) to be modelled. We show the practical application by applying the technique to countries in North-West Africa, where civil wars are commonplace and complex islamist insurgencies have been active in the past few decades. A sense of the differences among these countries becomes visible, as well as a picture of the interactions among the key groups within each country.

Semi-supervised learning makes the realistic assumptions that labelled data is typically rare, and that unlabelled data that are similar are likely to belong to the same class. Unlabelled data are assigned the labels associated with their “most similar” labelled neighbors. For graph-based semi-supervised learning, “most similar” is defined by weighted multipath path length in a graph. When classes are of different sizes, or the number of labelled nodes per class is not the same across classes, the performance of existing graph-based algorithms degrades sharply. We develop a new algorithm that creates representative nodes for each class, connects them to the labelled nodes of that class, adds negative edges between them, embeds the resulting graph using a signed graph Laplacian technique, and then predicts the unlabelled nodes using distance-based techniques in the geometry of the embedding. Its performance matches current algorithms for balanced datasets, but is much better for datasets where the classes, or the number of labelled records, differ in size.

Textual analytics based on representations of documents as bags of words has been extremely successful. However, analysis that requires deeper insight into language, into author properties, or into the contexts in which documents were created requires a richer representation. Systemic nets are one such representation. The jihadist groups AQAP, ISIS, and the Taliban have all produced English magazines designed to influence Western sympathizers. Using a model of jihadi language, we construct a systemic functional net for these magazines, and contrast the structures revealed by clustering using words versus clustering using the choices implicit in systemic functional nets. We then show that the systemic functional net derived from the magazines is consistent with the structure present in two Islamist forums, and therefore reveals two different mindsets, one that is political and another that is religious, that seem widely held within the relevant communities.

Most relationships in a social network have an element of asymmetry: the strength of A's relationship to B need not be the same as B's to A; and relationships that are based on power or influence have a natural flow associated with them. It is therefore natural to model many kinds of social networks by directed graphs, with a node corresponding to each participant, and a weighted directed edge to each relationship. Spectral embeddings for directed graphs are known, but they have significant weaknesses. We design a new directed-graph embedding, show that its mathematical properties are appropriate, and demonstrate its application to some synthetic and real-world networks. As well as avoiding the weaknesses of known techniques, the new embedding also represents a property we call flow betweenness of each node, allowing for directed edge prediction.

The relationships within criminal groups are of qualitatively different kinds, and are typically not symmetric because of issues of power and influence. Social network analysis techniques have not been able to model this richness of relationships well. We develop a new technique for spectral embedding of directed graphs, and combine it with a recently developed technique for spectral embedding of graphs with typed edges. We use the combination to model two 'Ndrangheta organized crime groups, and show that structure that is otherwise not visible can be extracted.

The jihadist groups AQAP, ISIS, and the Taliban have all produced glossy English magazines designed to influence Western sympathizers. We examine these magazines empirically with respect to models of the intensity of informative, imaginative, deceptive, jihadist, and gamification language. This allows their success to be estimated and their similarities and differences to be exposed. We also develop and validate an empirical model of propaganda; according to this model Dabiq, ISIS's magazine ranks highest of the three.

Social networks are often modelled by graphs, with nodes representing individuals, and positively weighted edges representing the strength of the relationships between them. Working directly with such graphs is difficult, and it has become common to use spectral techniques that embed graphs in a geometry, and then work with the geometry instead. In a good embedding, edges that are heavily (positively) weighted, and so represent strong interactions, cause the vertices they connect to be embedded close to one another. However, in some social networks there are also antagonistic relationships that are naturally represented by negatively weighted edges. The resulting graphs are called signed graphs. Clearly an embedding of such a signed graph should place nodes connected by positively weighted edges close together, but nodes connected by negatively weighted edges far apart. Existing spectral techniques to embed signed graphs have serious drawbacks. We derive two normalized spectral analysis methods for signed graphs and show, using real-world data, that they produce robust embeddings.

The South Asian Violent Extremist Group (SAVE) dataset describes 500 interactions between 30 South Asian terrorist groups over a 20-year period. We analyze 4 types of interactions between these groups (financial, logistical, operational, and political) via 4 network-theoretic techniques: spectral decomposition and Simmelian ties in an undirected version of the network, and PageRank and betweenness centrality on directed versions of the network. We identify the major players in both the provision and the flows through this network for each type of support. Our analysis shows that the five entities most involved in providing and facilitating all forms of support are Al Qaeda, the Pakistani Inter-Services Intelligence Agency, the Taliban, Lashkar-e-Taiba, and Tehreek-e-Taliban Pakistan.

We show that the language used by U.S. presidential candidates over the past twenty years has an underlying temporal structure associated with electoral success, with the most influential language used by incumbents in their second campaign and the least by losers in a first-cycle open campaign. Influential language is characterized by increased positivity, complete absence of negativity, increased abstraction, and lack of reference to the opposing candidate(s). The way in which language use changes suggests that it is the result of changing self-perception rather than a deliberate strategy. This has implications for the language of influence as deployed by violent extremist groups, suggesting that both success at convincing an audience to participate in violent extremism and the presence of competing groups trying to make similar arguments improve the quality of the influencing language they use.

The interactions in real-world social networks change over time. Dynamic social network analysis aims to understand the structures in networks as they evolve, building on static analysis techniques but including variation. Working directly with the graphs that represent social networks is difficult, and it has become common to use spectral techniques that embed graphs in a geometry and then work with the geometry instead. We extend such spectral techniques to dynamically changing data by binding network snapshots at different times into a single directed graph structure in a way that keeps structures aligned. This global network can then be embedded. Pairwise similarity, as well as community and cluster structures can be tracked over time, and the idea of the trajectory of a node across time becomes meaningful. We illustrate the approach using a real-world dataset, the Caviar drug-trafficking network.

Bag-of-words deception detection systems outperform humans, but are still not always accurate enough to be useful. In interrogation settings, the language of questions influences the language of responses. We develop a technique to correct for such influences and apply it to question-and-answer datasets. Surprisingly, such correction is not sufficient - those being deceptive react to prompting words in qualitatively different ways to those telling the truth. Accurate detection of deception in interrogation settings therefore requires modelling word use in both questions and answers.

Inspire magazine has attracted attention from intelligence organizations because of its avowed goal of motivating lone-wolf attacks in Western countries. We examine the language patterns that it uses to see whether it succeeds on its own terms as a vehicle of influence. Some subtle and unexpected patterns are detectable. The methodology generalizes to other corpora.

We analyze the posts in the Islamic Awareness forum, using models for frequent words (content), for Salafist-Jihadist language, and for deception. These last two models each produce a single-factor ranking enabling, in each case, the most useful subset of posts to be selected for further analysis. Posts that rank highly for Salafist-Jihadist language rank low for deception, suggesting that faking extremist websites is probably an ineffective strategy. The process described here is a template for analysis of many kinds of open-source corpora where language models of what makes posts interesting are known.

Most analysis of influence looks at the mechanisms Used, and how effectively they work on the intended audience. Here we consider influence from another perspective: what do the language choices made by influencers enable us to detect about their internal mental state, strategies and assessments of success. We do this by examining the language used by the U.S. presidential candidates in the high-stakes attempt to get elected. Such candidates try to influence potential voters, but must also pay attention to the parallel attempts by their competitors to influence the same pool. We examine seven channels: persona deception, the attempt by each candidate to seem as attractive as possible, nouns, as surrogates for content; positive and negative language; and three categories that have received little attention, verbs, adverbs, and adjectives. Although the results are preliminary, several intuitive and expected hypotheses are supported, but some unexpected and surprising structures also emerge. The results provide insights into related influence scenarios where open-source data is available, for example marketing, business reporting, and intelligence.

Most real-world social network analysis treats edges (relationships) as having different intensities (weights), but the same qualitative properties. We address the problem of modelling edges of qualitatively different types that nevertheless interact with one another. For example, influence flows along friend and colleagues edges differently, but treating the two sets of different kinds of edges as independent graphs surely misses interesting and useful structure. We model the sub graph corresponding to each edge type as a layer, and show how to weight the edges connecting the layers to produce a consistent spectral embedding, including for directed graphs. This embedding can be used to compute social network properties of the combined graph, to predict edges, and to predict edge types. We illustrate with Padgett's dataset of Florentine families in the 15th Century.

The idea that Canadian-based terrorists pose a threat to the United States continues to resonate with Americans. We subject this hypothesis to empirical testing by analyzing terrorist-related activity across the Canada-US border. Drawing on 13 cases with 27 terrorist connections, the evidence substantiates the presence of cross-border interactions, but does not confirm common perceptions about America's northern border: there is no consistent threat emanating from Canada. Rather, differentials in the availability of ideas and resources drive threat vectors across the border in both directions. The bulk of violent extremists exploiting these cross-border markets of opportunity do so to propagate terrorism beyond North America.

We describe a technique that calculates the expected relationships among attributes from training data, and uses this to generate anomaly scores reflecting the intuition that a record with anomalous values for related attributes is more anomalous than one with anomalous values for unrelated attributes. The expected relations among attributes are calculated in two ways: using a data-dependent projection via singular value decomposition, and using the maximal information coefficient. Sufficiently anomalous records are displayed on a sensor dashboard, making it possible for an analyst to judge why each record has been classified as anomalous. The technique is illustrated for an intrusion detection dataset, and a set of contract descriptors.

An analyst, presented with a corpus too large to read every document, must find some selection mechanism. A model for interestingness can be used to rank the documents so that only the subset at the top of the ranking need be examined. However, in many open-source intelligence settings, such a model is not known in advance. We design three measures for ranking documents by internal variability as a weak surrogate for interestingness. Selecting those documents ranked highly by these measures selects a superset of the documents an analyst might need to read, no matter what the specific model, and reduces the size of the corpus by an order of magnitude. We also discover that many corpora contain documents that are highly variable, but not interesting, and show how to remove them.

We consider the problem of data stream classification, where the data arrive in a conceptually infinite stream, and the opportunity to examine each record is brief. We introduce a stream classification algorithm that is online, running in amortized O(1) time, able to handle intermittent arrival of labeled records, and able to adjust its parameters to respond to changing class boundaries (“concept drift”) in the data stream. In addition, when blocks of labeled data are short, the algorithm is able to judge internally whether the quality of models updated from them is good enough for deployment on unlabeled records, or whether further labeled records are required. Unlike most proposed stream-classification algorithms, multiple target classes can be handled. Experimental results on real and synthetic data show that accuracy is comparable to a conventional classification algorithm that sees all of the data at once and is able to make multiple passes over it.

Predictors are often regarded as black boxes that treat all incoming records exactly the same, regardless of whether or not they resemble those from which the predictor was built. This is inappropriate, especially in adversarial settings where rare but unusual records are of critical importance and some records might occur because of deliberate attempts to subvert the entire process. We suggest that any predictor can, and should, be hardened by including three extra functions that watch for different forms of anomaly: input records that are unlike those previously seen (novel records); records that imply that the predictor is not accurately modelling reality (interesting records); and trends in predictor behavior that imply that reality is changing and the predictor should be updated. Detecting such anomalies prevents silent poor predictions, and allows for responses, such as: human intervention, using a variant process for some records, or triggering a predictor update.

We show that two mainstream prediction techniques, support vector machines and decision trees, are easily subverted by inserting carefully-chosen training records. Furthermore, the relationship between the properties of the inserted record(s) and the regions for which the predictor will subsequently misclassify can be inferred, so desired misclassifications can be forced. In adversarial settings, it is plausible that manipulation of this kind will be attempted, so this has implications for the design of prediction systems and the use of off-the-shelf technology, especially as support vector machines are one of the most powerful prediction algorithms known.

In adversarial settings, records associated with those who want to conceal their existence or activities tend to be unusual because of their illicit status; but not too unusual because of efforts to make them as normal as possible. Clusters of such records will not be single outliers or even outlying clusters, but rather small clusters on the fringes of normal clusters. Such structures are undetectable by many mainstream clustering algorithms, for example those based on distance and convexity. We show that even more sophisticated clustering algorithms are easily subverted by the addition of only a few carefully chosen records. Robust clustering in adversarial settings will require the development of more sophisticated algorithms tailored to this domain.

Several models for deception in text, based on changes in usage frequency of certain classes of words, have been proposed. These are empirically derived from settings in which individuals are asked to lie or be truthful in freeform text. We consider the problem of detecting deception in testimony, where the content generated must necessarily be responsive to questions, where there is the opportunity for immediate followup if the possibility of deception is detected by the questioner, and where those who have reasons to be deceptive have time and motivation to rehearse potential answers. Using the testimony to the Gomery Commission, a situation in which many witnesses had some motivation to be deceptive, we propose and validate a model for deception in testimony. We achieve substantial (80%) agreement with media estimates of who was motivated to testify in a deceptive way.

Searching for words on a watchlist is one way in which large-scale surveillance of communication can be done, for example in intelligence and counterterrorism settings. One obvious defense is to replace words that might attract attention to a message with other, more innocuous, words. For example, the sentence the attack will be tomorrow" might be altered to the complex will be tomorrow", since 'complex' is a word whose frequency is close to that of 'attack'. Such substitutions are readily detectable by humans since they do not make sense. We address the problem of detecting such substitutions automatically, by looking for discrepancies between words and their contexts, and using only syntactic information. We define a set of measures, each of which is quite weak, but which together produce per-sentence detection rates around 90% with false positive rates around 10%. Rules for combining persentence detection into per-message detection can reduce the false positive and false negative rates for messages to practical levels. We test the approach using sentences from the Enron email and Brown corpora, representing informal and formal text respectively.

Many recent applications deal with data streams, conceptually endless sequences of data records, often arriving at high flow rates. Standard data-mining techniques typically assume that records can be accessed multiple times and so do not naturally extend to streaming data. Algorithms for mining streams must be able to extract all necessary information from records with only one, or perhaps a few, passes over the data. We present the streaming random forests algorithm, an online and incremental stream classification algorithm that extends Breiman's random forests algorithm. The streaming random forests algorithm grows multiple decision trees, and classifies unlabeled records based on the plurality of tree votes. We evaluate the classification accuracy of the streaming random forests algorithm on several datasets, and show that its accuracy is comparable to the standard random forest algorithm.

Graph data represents relationships, connections, or affinities. Normal relationships produce repeated, and so common, substructures in graph data. We present techniques for discovering anomalous substructures in graphs, for example small cliques, nodes with unusual neighborhoods, or small unusual subgraphs, using extensions of spectral graph techniques commonly used for clustering. Although not all anomalous structure represents terrorist or criminal activity, it is plausible that all terrorist or criminal activity creates anomalous substructure in graph data. Using our techniques, unusual regions of a graph can be selected for deeper analysis.

Those who want to conceal the content of their communications can do so by replacing words that might trigger attention. For example, instead of writing "The bomb is in position", a terrorist may chose to write "The flower is in position." The substituted sentence would sound a bit "odd" for a human reader and it has been shown in prior research that such oddity is detectable by text mining approaches. However, the importance of each component in the suggested oddity detection approach has not been thoroughly investigated. Also, the approach has not been compared with such an obvious candidate for the task as Hidden Markov Models (HMM). In this work, we explore further oddity detection algorithms reported earlier, specifically those based on pointwise mutual information (PMI) and Hidden Markov Models (HMM).

{tedjw, martin, skill} @ cs.queensu.ca Computer system sizing involves estimating the amount of hardware resources needed to support a new workload not yet deployed in a production environment. In order to determine the type and quantity of resources required, a methodology is required for describing the new workload. In this paper, we discuss the sizing process for database management systems and describe an analysis for characterizing business intelligence (BI) workloads, using the TPC-H benchmark as our workload basis. The characterization yields four general classes of queries, each with different characteristics. Our approach for sizing a BI application’s database tier quantifies a new BI workload in terms of the response time goals and mix of the different query classes obtained from the characterization analysis.

We examine plausible motivations for both using and building computational grids. We find two reasons to use such grids: the existence of a workload in which tasks have deadlines, but the load varies over time; and the existence of an upper limit on cost-effective parallel systems, forcing replication when greater degrees of parallelism are required. We speculate that there may be scope for public grids, in which protecting the integrity of information is not guaranteed, but that there is much larger potential for virtual private grids within organizations. In both cases, the form of markets, execution planning, and pricing is likely to be different from the frictionless markets predicted in the literature.

The BSP cost model measures the cost of communication using a single architectural parameter, g, which measures permeability of the network to continuous traffic. Architectures such as networks of workstations pose particular problems for high-performance communication because it is hard to achieve high communication throughput, and even harder to do so predictably. Yet both of these are required for BSP to be effective. We present a technique for controlling applied communication load that achieves both. Traffic is presented to the communication network at a rate chosen to maximise throughput and minimise its variance. Significant performance improvements can be achieved compared to unstructured communication over the same transport protocols as in the case of, for example, MPI. Copyright © 1999 John Wiley & Sons, Ltd.

Hypermedia technology provides both an opportunity for universities to provide a better learning experience for their students, and a way to cope with funding reductions. Second-generation hypermedia systems makes it cost-effective to develop and deliver multimedia courseware, while permitting learning to occur within a community. We illustrate by describing our experiences developing and offering a hypermedia course in computer architecture, in which lectures were replaced by on-line courseware, using the Hyper-G system.

Concurrent programming has been viewed as an activity in which a knowledge of the target machine architecture is indispensable to building efficient software. The variety of possible parallel machines has spawned of corresponding variety of concurrent languages for programming them. This has prevented the significant use of parallelism in all but high-end numerical computation because it has not been clear which approach was best. Much of the confusion could be dispensed with if concurrent programming languages that were independent of the particular target architecture could be found. Despite some scepticism about this possibility, several such languages now exist. We survey them and discuss their merits and drawbacks. Architecture independent programming languages can be divided into two broad classes: those that are based on the PRAM model or some extension of it; and those which dispense with a need for explicit storage management and scheduling. Languages in the former class guarantees of performance but require much of the programmer; those in the latter do not provide performance guarantees but are much less demanding to use.

A methodology is presented for transforming a functional specification written in Lucid to an equivalent specification that captures its real-time properties. The enhanced specification consists of a set of equations that can be solved for several properties, including execution time and external requirements, or may simply be checked for the existence of a solution. Lucid has a set of meaning-preserving transformations, and a proof system corresponding to a behavioral semantics has been constructed. Both of these tools can be used to reason about properties of the specification. The specification is executable and can be used as a prototype for the system being specified. It is possible to express architectural constraints within the same formal framework. Thus this type of specification can be used to guide the development of new real-time systems.>

The authors present a new class of interconnection networks using combinatorial block designs. These networks are highly structured and have strong fault-tolerant properties. They also have a free parameter that allows tradeoffs to be made between performance and cost in a fairly continuous way.>