CN105956982A - Method of predicting act of terror based on background change - Google Patents

Abstract

The invention discloses a method for predicting terrorist behavior by using background changes. The main steps are: generating a change table and using Bayesian method to predict behavior. When generating the h-change table, the background change at the current moment is combined with the behavior change after the h period to form a record in the change table. When predicting, under the premise of inputting the background change vector, the Bayesian method calculates the classification result of the maximum probability from the change table, so as to predict the behavior after the h period. Considering that changes in the background may have a continuous impact on organizational behavior in time series, a weighted Bayesian model is established. The model implements the calculation of the probabilities of various behaviors in different change tables when the time lags are 1 to H respectively, and finally calculates the probabilities of various behaviors by weighting. In order to predict terrorist behaviors according to arbitrary background changes, the present invention utilizes the characteristics that the Bayesian method can quickly and effectively solve the classification problem of high-dimensional small samples, and improves the prediction accuracy.

Description

A Method to Predict Terrorist Behavior Using Context Changes

technical field

The invention belongs to the technology of predicting organizational behavior in data mining, and in particular relates to an algorithm for predicting terrorist behavior using a Bayesian method on an improved change table.

Background technique

Terrorist acts refer to the organized use of violence or threat of violence against non-armed persons by the perpetrators to achieve religious, political or ideological goals by placing certain objects in terror. The "9.11" incident in the United States shocked the whole world, making terrorist organizations the focus of the world and one of the factors affecting world peace. Recently, the activities of the Islamic State (ISIS) in the Middle East have intensified. The organization launched a retaliatory bomb attack in Paris, France in November 2014, causing a large number of casualties of innocent people. Terrorist attacks have once again become the main focus of attention. How to use existing information to predict the behavior of terrorist organizations has become an important topic.

Terrorist behavior prediction is a typical application of knowledge mining. It uses data mining and machine learning related technologies to conduct scientific statistical analysis of past and present terrorist organizations planning and implementing terrorist behavior, and then predicts its development trend. Terror forecasting is not to confirm the past, nor to explain the reality, but to explore the future and predict the development trend of terrorist organizations. Its purpose is to provide decision support for effective preventive measures. The reasons for terrorist attacks include political, economic and cultural factors, and various factors are intertwined, making the prediction of terrorist behavior complex. Research on the prediction of terrorist acts should not only consider information such as the time, place, and degree of influence of terrorist events, but should be based on various disciplines (computer data mining technology and sociology, criminology, etc.), comprehensively considering the information of terrorist organizations, including terrorist organizations. Political, cultural, economic and other background factors, and provide more effective support for the authorities' decision-making through the analysis of these data. Therefore, analyzing the relationship between the background knowledge of terrorist organizations and their behavior has become a research hotspot.

At present, the basic ideas of the prediction methods based on background knowledge to predict terrorist behavior are basically the same, that is, to construct an organizational behavior prediction model based on the relationship between organizational background and behavior. Specifically, these methods use the similarity between background vectors to predict the corresponding behavior vector, and then perform some calculation on the predicted behavior vector to obtain the probability of each behavior in the behavior vector, and then give a prediction based on the occurrence probability of each behavior result. However, in reality, organizations generally have anti-investigation capabilities, and attributes such as the time, place, and intensity of terrorist activities will change accordingly. Most existing models do not account for this change in organization and the resulting behavioral changes. However, the model that takes into account the changing relationship between background and behavior, although it tries to construct the changing rules between background and behavior by learning the conditions under which organizations change behavior, has many shortcomings. For example, the model can only predict behavior based on the background changes existing in the change table, and the prediction accuracy is low and the time complexity is high.

The invention provides a terrorist behavior prediction algorithm based on the change table and the Bayesian method. The algorithm can not only effectively extract the background knowledge subspace of the terrorist behavior, but also ensure the effectiveness of prediction using the extracted background subspace.

Contents of the invention

Based on the idea that changes in the background of an organization may lead to changes in behavior, the present invention utilizes the background knowledge of terrorists to predict their behavior. In order to predict organizational behavior under arbitrary background changes, a terrorist behavior prediction algorithm based on Bayesian method and change table is proposed according to the high-dimensional and small-sample characteristics of the data set. The improved change table stores the existing changes of background and behavior, so that the Bayesian method can conveniently collect relevant change information. For new background changes, the Bayesian method makes a comprehensive judgment based on the influence of each element in the input background change vector on different classification results, so that the purpose of predicting behavior can be achieved under any background change. In addition, for high-dimensional small-sample data, Bayesian methods can quickly and effectively predict. Finally, consider that the impact of background changes on behavior is not instantaneous, but will have a continuous impact on behavior within a certain period of time. Therefore, this method considers comprehensively predicting tissue behavior under different time lags.

The present invention utilizes the background knowledge of terrorist organization to extract the prediction method of subspace, comprises the following steps:

(1) Preprocessing of the original data set;

The original data is composed of the basic information, background knowledge and behavior activities of terrorist organizations. The background knowledge and behavior are extracted and marked as (CS(g), AS(g)) vector pairs. Its CS(g)=(C ₁ ,C ₂ ,…,C _M ) represents the background attributes in the data, and AS(g)=(A ₁ ,A ₂ ,…, _AN ) represents the behavioral attributes involved in the data . In order to obtain background subspaces of different behaviors, it is necessary to preprocess the data to form N subdatasets of (CS(g),A _j ). If g represents a terrorist organization, Tg represents the sub-dataset of organizational behavior A _j in the data set, then Tg=(x ₁ ,x ₂ ,...,x _m ) ^T , x _i =(c _i1 ,c _i2 ,. ..,c _in ,a _ij ), where _ci belongs to the background attribute set CS(g), and a _j belongs to the behavior attribute set AS(g).

(2) Generate an improved change table for each behavior to be predicted in AS(g);

The change table is a data storage structure that records the relationship between an organization's behavior and its background changes in time series, and represents the impact of background changes on behavior changes. For an integer h≥1, the record of time period i in h-change table CT ^h (g,A _j ) consists of the change of background attribute from time period ih to i-h+1 and the change of behavior attribute from i to i+1 produce. As shown in Table 1, the original data including background and behavior A _j are processed, and the h-change table CT ^h (g, A _j ) of behavior A _j shown in Table 2 is generated. The change table includes a one-step change table and a multi-step change table.

In Table 2, PA _j represents the behavior of the last period, and LA _J represents the behavior of the current time.

(3) Utilize the Bayesian method to calculate the prediction result on the generated change table;

(4) Use the multi-step weighted Bayesian model to predict separately on the change tables of different step lengths, and give the comprehensive prediction results:

1) According to the number of steps H, construct a change table CT ^h (g, A _j ) from 1 to H steps, h=1,...,H;;

2) Use the Bayesian method to predict the change data of each row in the h-change table CT ^h (g, A _j ), and obtain the predicted behavior sequence PY ^h ;

3) According to the formula r _h =Cov(PY ^h ,Y ^h )/(D(PY ^h )*D(Y ^h )) ^1/2 (where Cov(.) is the covariance, D(.) is the variance) calculation The correlation coefficient r _h between the predicted behavior sequence PY ^h and the real behavior sequence Y ^h ;

4) Is the judgment over? If not, skip to 2) and calculate the correlation coefficient of the next step; otherwise, proceed to the next step.

5) Use the formula w _h =|r _h |/Σ|r _i | to normalize the obtained correlation coefficients r ₁ , r ₂ ,...,r _H to obtain the prediction weight coefficients w ₁ , w ₂ ,... .,w _H ; Σ|r _i | means to sum the correlation coefficients, i=1,2,...H.

6) For each behavior, use Bayesian classification prediction on each step change table to calculate its objective function max _i {Σ _h (w _h *P ^h (C _i |X)/Σ _k P ^h (C _k | X))}, select the behavior that maximizes the value of the result as the classification result. Among them, C _i represents each behavior; h=1,...,H, represents the step number of the change table. The relational expression of the objective function indicates that on the 1 to H step change table, calculate the weighted proportion of the behavior C _i in the occurrence probability of all behaviors.

The prediction method in the present invention is divided into two steps: first, a corresponding change table is generated according to a specific terrorist act, and then the occurrence of the act is predicted in the generated change table.

The impact hysteresis h in the process of generating the change table in the present invention indicates that the change of the background attribute will affect the change of the behavior attribute after h time periods, and then use the Bayesian method to predict the terrorist behavior after h steps. And the multi-step Bayesian neutralization forecast, comprehensively consider the forecast situation under the influence of 1 to h step lag, and make the final forecast result.

The present invention mainly has the beneficial effect of following two aspects:

(1) In terms of prediction algorithm

The characteristics of high-dimensional small samples in the original data set lead to poor performance of general prediction methods. The Bayesian method to solve this problem has natural advantages and can make predictions quickly and effectively. Finally, consider that the impact of background changes on behavior is not instantaneous, but will have a continuous impact on behavior within a certain period of time. Therefore, the algorithm considers comprehensively predicting tissue behavior under different time lags. For each behavior, calculate the sum of the proportions of the probability of using Bayesian classification prediction to obtain the behavior in all classification result probabilities on each step change table, and select the behavior that maximizes the result value as the classification result.

(2) In terms of change table generation

The improved change table stores the existing changes of background and behavior, so that the Bayesian method can conveniently collect relevant change information. For new background changes, the Bayesian method uses a certain method to calibrate, and comprehensively judges the degree of influence of each element in the input background change vector on different classification results, so that the purpose of predicting behavior can be achieved under any background change. Moreover, the influence hysteresis h in the process of generating the change table indicates that the change of the background attribute will affect the change of the behavior attribute after h time periods, and then use the Bayesian method to predict the terrorist behavior after h steps.

Description of drawings

Fig. 1 is the flowchart of the weight calculation of the training module of the multi-step weighted Bayesian prediction method in the present invention.

Fig. 2 is a flow chart of predicting tissue behavior using a multi-step weighted Bayesian prediction method prediction module in the present invention.

detailed description

Taking the background data subset shown in Table 3 as an example, the algorithm flow of the present invention will be described in detail in combination with the weight calculation and behavior prediction flow in the multi-step weighted Bayesian prediction model shown in Fig. 1 and Fig. 2 .

A total of eight fields are set in Table 3, marked as Time, C1, C2, C3, C4, C5, C6 and A, where Time is marked as the time series recorded in the table, {C1, C2, C3, C4, C5 , C6}=CS(g) belongs to the attribute of background knowledge, and A belongs to the attribute of behavior. The purpose is to use the background knowledge shown in Table 3 to predict the occurrence of terrorist act A.

Specific steps are as follows:

(1) Use the data in Table 3 to generate a one-step change table, and the obtained change table is shown in Table 4.

(2) According to the Bayesian method, the change table is statistically classified, and the classification results are shown in Table 5.

In Table 5, it is necessary to calculate P(LA=0|X) and P(LA=1|X) when using Bayesian classification, and then classify the probability, and use the class label with higher probability as the classification prediction result. Among them, according to Bayes' theorem, comparing P(LA=0|X) and P(LA=1|X) is equivalent to comparing P(X|LA=0)P(LA=0) and P(X |LA=1) the size of P(LA=1). Among them, P(X|LA=0)P(LA=0) and P(X|LA=1)P(LA=1) respectively represent the probability of the behavior being 0 and the behavior being 1 under the environment change vector X probability.

The result of using the 1-step change table prediction is to predict the behavior of terrorist organizations after 1 time period. For example, suppose the current background change is: {(0,0),(1,1),(0,1),(0,0),(1,0),(1,0),0}, then The behavior of predicting the next time period is 1, that is, such terrorist activities occur.

(3) Using multi-step weighted Bayesian comprehensive forecasting, assuming that the given number of steps is 2.

① Firstly, according to the method shown in Table 2, the 1-step and 2-step change tables are established, and the results are shown in Table 4 and Table 6.

②Secondly, according to the Bayesian method, the 1-step and 2-step change tables are statistically classified, and the results are shown in Table 5 and Table 7.

③ Then, use the predicted behavior sequence and the real behavior sequence to calculate the correlation coefficient of each step, complete the normalization, and use it as the weight of the step change table prediction. The results are shown in Table 8.

④ When predicting, assume that the current background change vector X is: {(0,0),(1,1),(0,1),(0,0),(1,0),(1,0), 0}, calculate P(LA=0|X) and P(LA=1|X) in each step change table, and use P(X|LA=0)P(LA=0) and P(X| LA=1)P(LA=1) to replace, the calculation results are shown in Table 9.

When LA=0, Σ _h (w _h *P ^h (C _i |X)/Σ _k P ^h (C _k |X))＝0.027*0.5+0.0610*0.5＝0.044;

When LA=1, Σ _h (w _h *P ^h (C _i |X)/Σ _k P ^h (C _k |X))＝0.9730*0.5+0.9390*0.5＝0.956;

Because 0.044 is less than 0.956, the predicted result is LA=1, that is, terrorist activities occur.

The series of detailed descriptions listed above are only specific descriptions for feasible implementations of the present invention, and they are not intended to limit the protection scope of the present invention. Any equivalent implementation or implementation that does not depart from the technical spirit of the present invention All changes should be included within the protection scope of the present invention.

Claims (4)

1. A method for predicting acts of terrorism utilizing background changes, characterized in that utilizing the change linkages between backgrounds and behaviors to predict organizational behavior, comprising the steps of: (1) Preprocessing of the original data set; the original data is composed of the basic information, background knowledge and behavior activities of terrorist organizations, the background knowledge and behavior are extracted, and they are marked as (CS(g), AS(g)) Vector pair; where CS(g)=(C ₁ ,C ₂ ,…,C _M ) represents the background attributes in the data, AS(g)=(A ₁ ,A ₂ ,…,A _N ) represents the data related to behavioral attributes; In order to obtain the background subspace of different behaviors, it is necessary to preprocess the original data to form N subdatasets of (CS(g),A _j ); (2) For each behavior to be predicted in AS(g), an improved change table is generated; the improved change table is a data storage structure that records the relationship between the organization's behavior in time series and its background change, representing the background The impact of the change on the behavior change, its storage content includes the existing changes of the background and behavior; the change table includes a one-step change table and a multi-step change table. (3) Using the Bayesian method, calculate the prediction results on the generated 1-step or multi-step change table; (4) Use the multi-step weighted Bayesian model to predict separately on the change table from step 1 to step H, and give a comprehensive prediction result. 2. a kind of method utilizing background change to predict terrorist behavior according to claim 1, is characterized in that, the method for generating change table in described step (2) comprises: for integer h>1, h-change table CT ^h Records for time period i in (g,A _j ) are produced by changes in background attributes from time period ih to i−h+1 and behavioral attributes from i to i+1. 3. a kind of method utilizing background change to predict terrorist behavior according to claim 1, is characterized in that, the realization of described step (3) comprises: the change table is carried out statistical classification, calculates P(LA _j |X), Then according to the size of the behavior probability, the class label with higher probability is used as the classification result; where X represents the environmental change vector, and LA represents the behavior at the current time. 4. a kind of method utilizing background change to predict terrorist act according to claim 1, is characterized in that, the realization of step (4) comprises the steps: 1) According to the number of steps H, construct a change table CT ^h (g, A _j ) from 1 to H steps, h=1,...,H; 2) Use the change data of each row in the h-change table CT ^h (g, A _j ) to predict using the Bayesian method to obtain the predicted behavior sequence PY ^h ; 3) According to r _h ＝Cov(PY ^h ,Y ^h )/(D(PY ^h )*D(Y ^h )) ^1/2 ; where Cov(.) is the covariance, D(.) is the variance, calculate the forecast The correlation coefficient r _h between the behavior sequence PY ^h and the real behavior sequence Y ^h ; 4) Judging whether it is over, if not, skip to 2) and calculate the correlation coefficient of the next step; otherwise, proceed to the next step. 5) Use the formula w _h =|r _h |/Σ|r _i | to normalize the obtained correlation coefficients r ₁ , r ₂ ,...,r _H to obtain the prediction weight coefficients w ₁ , w ₂ ,... .,w _H ; 6) For each behavior, use Bayesian classification prediction on each step change table to calculate its objective function max _i {Σ _h (w _h *P ^h (C _i |X)/Σ _k P ^h (C _k | X))}, select the behavior that maximizes the value of the result as the classification result; where, C _i represents each behavior; h=1,...,H, represents the number of steps in the change table; the relational expression of the objective function represents respectively On the 1 to H step change table, calculate the weighted proportion of behavior C _i in the occurrence probability of all behaviors.