Practical Issues and Algorithms for Analyzing Terrorist Networks 1

Transcription

1 Practcal Issues and Algorthms for Analyzng Terror Networks 1 Tam Carpenter, George Karakoas, and Davd Shallcross Telcorda Technologes 445 South Street Morrown, NJ Keywords: socal network analyss, centralty, betweenness, path-fndng algorthms. INTRODUCTION In socal network analyss, graphs are used to model relatonshps between actors or partcpants n a socal settng. Each node or vertex n the graph represents a partcpant or actor. Each lnk or edge represents a connecton or relatonshp between two partcpants. A varety of graph algorthms have been developed to analyze the ructure of socal networks and to assess the roles or mportance of the ndvdual players. Snce the September 11 bombng of the World Trade Center, socal network analyss has emerged as a potental vehcle for modelng and analyzng the ructure of terror networks [10, 15]. There are a varety of measures to assess the mportance or centralty of each actor n a socal network [16]. The mo popular of these centralty measures requre the computaton or enumeraton of shorte paths between all pars of nodes n the graph. Such computatons can be tme consumng n large graphs. Moreover, they may become problematc even n more moderately-szed networks when changng data or what-f scenaro analyss warrant frequent recomputaton. In ths paper, we assume that terror network models may be large, dynamc and characterzed by uncertanty. The latter two propertes, n partcular, are true not only for terror networks, but are true more generally of covert networks, where there may be a delberate effort to hde llct actvty. Models of covert networks may be large, not necessarly because the networks themselves are large, but because the networks are unknown to us, so the set of actors we montor s lkely to be a superset of those that are actually engaged n llct actvty. The models are dynamc because both covert networks and our knowledge of them change over tme. Lkewse, specfc attrbutes assocated wth nodes or lnks n the network model contan uncertanty. Although socal network analyss has been used to udy covert crmnal networks n the pa (see [5] for example), these networks are not as large or as dynamc as terror networks, nor are the akes surroundng them as hgh. A prevous paper n ths sesson (see Behrens and Stephenson) descrbes a framework (called NetOperatve) to support lawmakers n ther effort to dentfy and montor terror networks. Ths framework combnes atcal technques wth deas from socal network analyss and wth effcent computatonal algorthms to support such analyss. In ths paper we focus on algorthms for computng measures of centralty. We descrbe the current be theoretcal runnng tmes for computng varous centralty measures; we dscuss the current ate-of-the-art for dynamcally updatng these measures n response to network changes; and we descrbe some practcal decomposton deas that can also beneft from mantanng dynamcally updated data ructures. In addton, we dscuss some alternatve measures of centralty that may be more robu n the face of uncertanty. CENTRALITY MEASURES To defne centralty measures more precsely, we need to eablsh some notaton. The notaton that we employ s smlar to that defned n Brandes [3]. We let G=(V, E) denote a graph wth vertex set V and edge set E. In general, edges may be ether drected or undrected. We let n represent the number of vertces n V, and we let m represent the number of edges n E. An edge e E has an assocated weght or length denoted l(e). If the graph s unweghted, l(e) s assumed to be equal to 1 for all e E. Edges may be represented as a par of ncdent vertces, so that (s, represents the edge between nodes s, t V. We let d(s, denote the shorte 1 Copyrght 2002, Telcorda Technologes, Inc. All rghts reserved.

2 possble dance between vertces s and t n G. Fnally, we let σ denote the number of shorte paths between s and t n G, and we let σ (v) denote the number of such paths that nclude vertex v V. Now, we can defne two well-known [16] centralty measures that we use for lluratve purposes n subsequent dscusson. Addtonal measures and varatons are descrbed n the text by Wasserman and Fau [16] and references theren. 1 C( v) = Closeness centralty, d( v, t V B v) = ( Betweenness centralty. s t v V σ ( v) σ We note that computng closeness centralty requres computng the length of a shorte path between all pars of nodes n G. Ths requres solvng the well-known all-pars shorte-paths (APSP) problem. The current be algorthms for APSP on sparse graphs requre O(nm) operatons n unweghted graphs and 2 O ( nm + n log n) operatons n weghted graphs [9]. In dense graphs, these bounds asymptotcally become O ( n 3 ) n the wor case, but recent (more complcated) algorthms yeld somewhat better wor-case bounds [18]. Computng betweenness requres enumeratng all of the shorte paths between each par of nodes, whch s even more work. The fae algorthms for computng betweenness are provded by Brandes [3] and requre O(nm) operatons n unweghted graphs and 2 O ( nm + n log n) operatons n weghted graphs. These bounds are asymptotcally the same as those for solvng APSP n sparse graphs. Emprcal results presented n [3] for randomlygenerated, undrected, unweghted, sparse graphs sugge that betweenness n a 6000 node graph can be computed n roughly 15 mnutes on a SUN Ultra10 workaton. Soluton tmes appear to be slower for weghted graphs and wll slow consderably as n ncreases nto the tens of thousands of nodes. PRACTICAL ATTACKS ON COMPUTING CENTRALITY As n gets very large, the tme to compute the centralty measures can become prohbtve. Nonetheless, there are some practcal methods that can sometmes be exploted to make these computatons more tenable n large graphs. Thus, n addton to seekng algorthms wth mproved theoretcal runnng tmes for the underlyng problems lke APSP, we can try to explot other features characterc of our applcaton. In partcular, the sparsty of socal networks may be exploted n practcal approaches that nvolve approxmaton or decomposton. Often these rateges are employed n attacks on NP-hard optmzaton problems, but they can be appled any tme the sze of a problem makes t dffcult to solve. Gven the amount of uncertanty that we expect to encounter n models of terror networks, approxmaton methods may be partcularly attractve for these applcatons. A recent paper by Eppen and Wang [8] explots the small world phenomenon that s sad to characterze socal networks n order to develop an approxmaton algorthm for closeness centralty. An open queon s: can we develop fa approxmaton algorthms for betweenness or for the more closely related graph centralty measure [3], whch s defned as: 1 g( v) = Graph centralty. max d( v, t V More common practcal approaches nvolve decomposton. Sparse networks may have small cuts that yeld places where we can break the problem apart. (A cut n a graph s a set of vertces or edges whose removal dsconnects the graph.) A basc decomposton rategy would proceed as follows: dentfy a cut; break the problem apart at the cut; solve the smaller problems on each sde of the cut; and sew the solutons together to obtan a soluton on the entre graph. Ths rategy s often employed n attacks on NP-hard optmzaton problems. (See, for example, [4].) However, even for computatonally tractable problems, lke APSP, we mght ll use decomposton n a heurc fashon to effectvely reduce n n the runnng tme.

3 The smple example of decomposton at a small cut arses n undrected graphs where we consder breakng the problem apart at artculaton ponts. Artculaton ponts are sngle vertces whose removal dsconnects the graph. We say that two vertces are bconnected or le n the same bconnected component f there s no artculaton pont whose removal dsconnects them. If a node v s an artculaton pont, removng v breaks the graph nto (at lea) two components, whch we call S and T n Fgure 1. Any shorte path between nodes n S {} v mu nvolve only nodes n S {} v. Lkewse, shorte paths between nodes n T {} v nvolve only nodes n T {} v. Thus, n Fgure 1, shorte paths between nodes n S {} v use only gray lnks and shorte paths between nodes n T {} v use only black lnks. Paths between two nodes, s S and t T, are conructed as the concatenaton of shorte paths between s and v wth shorte paths between v and t. Thus, we can fnd all shorte paths by solvng a smaller problem on each sde of v, effectvely reducng n n the runnng tme. S Fgure 1: Decomposng at artculaton pont v. An attractve aspect of decomposng at artculaton ponts s that artculaton ponts and the shores nduced by ther removal are dentfed by a smple O (m) algorthm [1]. The decomposton dea can be generalzed to other types of small cuts, lke two-edge cuts, but more general cuts are more tme-consumng to dentfy and also more dffcult to reconruct solutons across. Even more general decomposton rateges may also be avalable. The tree wdth of a graph may be thought of as a measure of ts complexty, and graphs wth small tree wdth can v T be recursvely decomposed by removng small sets of nodes. Such an approach requres sophcated deas from graph theory surveyed n [2]. Emprcal udes are needed to see whether these more complcated deas yeld practcal savngs. CENTRALITY IN DYNAMIC GRAPHS In addton to beng large and sparse, terror networks, or at lea our models of them, are lkely to be dynamc through tme, wth new lnks beng added and others beng removed as we gan nformaton about the actors and ther communcatons. Thus, centralty measures may have to be recomputed as the network evolves through tme. In addton to reducng the tme spent on the ntal calculaton, we would also lke to dentfy cheap algorthms for updatng centralty measures followng a change n the network. Such algorthms can also be of use n scenaro analyss, wheren we may want to examne the effect of potental network changes. For nance, wthn a tool lke NetOperatve, an analy could examne the senstvty of the centralty measures to lkely network changes, such as the addton of a beleved lnk or the removal of a key node. Fndng effcent algorthms to update the soluton of a graph problem followng the addton or deleton of lnks s an area of ntense research n the computer scence communty, as descrbed n a recent survey by Eppen, Gall, and Italano [7]. Snce the centralty measures we consder nvolve the calculaton of shorte paths between all pars of nodes, dynamc all pars shorte path algorthms may help us avod recalculatng these paths from scratch. For example, the algorthm by Demetrescu and Italano [6] supports updates (edge deleton, nserton, and weght change) n O ( Sn log n) tme per update n drected networks wth weghts that take at mo S dfferent real values. Dynamc algorthms for computng other graph propertes that may be helpful n carryng out the centralty calculatons more effcently are also descrbed n the survey [7]. For example, the mnmum spannng tree for undrected graphs 1/ 3 can be mantaned n tme O ( n log n) per update. 2-edge connectvty can be solved n

4 1/ 2 O (n ) tme per update; 3-edge connectvty 2 / 3 can be solved n O (n ) tme per update. For k-vertex connectvty wth 2 k 4 there are algorthms wth tmes rangng from 1/ 2 2 O ( n log n) to O( nα ( n)) per update. More detals can be found n [7]. If we use a decomposton-based approach, we may, n fact, wsh to mantan data ructures that allow us to update our knowledge of cuts and shores of cuts wthout havng to fully recompute them. One of the be-uded of these problems s for fully dynamc bconnectvty [11] n undrected graphs. A fully dynamc bconnectvty algorthm mantans and updates a data ructure that allows effcent queres about the bconnected components of a dynamc graph. The algorthm descrbed by Henznger [11] performs updates n O ( m log n) tme and answers queres about whether or not two nodes are n the same bconnected component n conant tme. Further, t returns all of the nodes n a bconnected component n tme that s lnear n the sze of the output. Such an algorthm could be ntegrated wthn a larger framework for montorng dynamc socal networks. Fnally, as mentoned above algorthms to support other connectvty queres n dynamc graphs have also been the subject of recent udy [7]. (See, also [13], whch consders 2- and 3-edge connectvty wth lnk nsertons.) EXTENDING BETWEENNESS The measures of centralty that we defned prevously (along wth several other well-known measures [16]) mplctly assume that communcaton occurs along shorte paths (also called geodesc paths) n the network. In analyzng networks that model terror actvty, uncertanty n the data wll be reflected n naccuraces n shorte path computatons. Thus, not only s the length of the shorte path between a par of nodes somewhat uncertan, but the path tself may change dramatcally wth relatvely small changes n the data. Ths may be especally problematc for measures lke betweenness, that depend on knowng the precse dentty of nodes n geodesc paths. The small example n Fgure 2 llurates how the betweenness centralty measure can be vulnerable to even mnor data changes. w Fgure 2: Sample network where B( = 0. Wth the gven edge lengths, the defnton of betweenness yelds B(=0, even though node w appears to be relatvely central. Notce that f the actual length of all bg edges s 1.3 nead of, w becomes the central actor n ths network, and B(=4. Examples lke ths motvate us to look for more robu varatons of the betweenness measure. For ths reason, we propose a varaton on the betweenness centralty measure, called -betweenness. Before we gve the formal defnton of ths new measure and an algorthm to compute t, we gve a few more prelmnary defntons. Fr, a smple path between nodes s and t s a path connectng s and t that vsts no node more than once. A smple path P from s to t wll be called an -shorte path f length(p) (1+)d(s,. We let σ denote the number of shorte paths between s and t n G, and we let σ (v) denote the number of such paths that nclude vertex v V. We defne the -betweenness E(v,) as follows: σ ( v) E ( v, ) = -Betweenness centralty. s v t V σ Notce that n the example gven above, wth =0.1 (.e. we count paths whose length doesn t exceed that of the shorte path by more than 10%), E(w,0.1)=2. Snce the calculaton of -betweenness nvolves approxmate shorte paths, t s more complcated and tme-consumng than the calculaton of betweenness. Furthermore, when

5 we consder paths that may be longer than the shorte path, we mu take care to exclude paths contanng loops. Paths contanng loops seem to be unlkely communcaton paths and are thus explctly excluded. In ths algorthm, we assure that the paths computed are smple by enforcng that d(s,<2l(e) for all edges e and all pars s t. In partcular, f l s the length of the shorte edge and D s the maxmum shorte path dance between a par of nodes n G, then l < 2. D Now, we gve a raghtforward algorthm to compute -betweenness. Let Γ ( = { u V : ( u, E} be the nodes that are drectly connected to t, and let w Γ (. We calculate the number of -shorte paths from s to t that go through the edge (w,. Notce that any path P from s to w wth length(p) (1+δ)d(s,, (1 + ) d ( s, ( d( s, + l( w, ) where δ =, d( s, can be extended wth edge (w, to a path from s to t, whose length s at mo (1+)d(s,. Moreover, δ 0 mples that only the w s that satsfy ( 1 + ) d ( s, l( w, + d ( s, can produce such paths. It s obvous that, f we calculate δ for all neghbors w of t that satsfy the la condton, σ can be computed as follows: δ σ σ. = Assumng that we have already calculated the shorte path lengths (by, say, the method n [9]), σ can be computed recursvely, searchng from t n a breadth-fr fashon. In order to calculate σ (v), we ore all ntermedate δ results σ sw. Then t s easy to retreve the number of paths that pass through v. The runnng tme of ths algorthm can be prohbtvely hgh when the network s not acyclc. However, t s concevable that the condton ( 1 + ) d ( s, l( w, + d( s, together wth the rapd convergence of δ s to 0 may keep the space and tme requrements of the algorthm manageable. Ths s certanly a pont for further nvegaton. sw An algorthm for -betweenness can also be mplemented based on a varant of a k-shorte paths algorthm, for computng the k shorte acyclc paths between a par of nodes. Gven a graph wth weghts on the edges, a par of vertces s and t, and an nteger k, such an algorthm computes the shorte s-t path, the second shorte s-t path, up to the kth shorte s-t path. Several algorthms, ncludng those by Katoh, Ibarak, and Mne [12] and Yen [17], compute these paths n order, so that we don t have to decde on k n advance, but rather can proceed untl we generate a path of length greater than (1+)d(s,. At ths pont we have generated all of the -shorte s-t paths, and we can easly determne both σ and σ (v) for all vertces v. The tme to do ths n undrected graphs usng the algorthm n [12] s O(( σ + 1) c( n, m)), where c(n,m) s the tme to compute a shorte-path tree from a sngle vertex n a graph wth n vertces and m edges. Ths algorthm works for arbtrary nonnegatve. Underlyng the defnton of -betweenness s the assumpton that our betweenness measure wll be more able n the presence of uncertan data f we base t on a larger set of good paths. As such, we could also conruct a betweenness varant based upon the k-shorte smple paths. However, we prefer the -betweenness measure because t s more senstve to the relatve qualty of the paths for each par of nodes. These more robu measures are predcated on the assumpton that communcaton ll occurs along geodesc paths n the network, but we don t necessarly know those paths because of uncertanty n the data. Stephenson and Zelen [14] ntroduced another measure of centralty, called nformaton centralty, that weghs all paths between a par of nodes. Ther thnkng s that all paths carry nformaton. Moreover, crcutous paths may be preferred when actors wsh to hde ther communcatons. Ths measure also has the robuness of consderng multple paths and may be very well-suted to analyzng terror networks where delberate efforts are made to obfuscate communcaton. FUTURE DIRECTIONS We have descrbed both theoretcal and practcal avenues of research for computng centralty n covert networks. Perhaps the mo compellng

6 theoretcal queons are whether runnng tmes for dynamc APSP can be mproved for sparse networks and whether such algorthms can be extended to computng betweenness. Gven the amount of uncertanty that we expect n models of terror networks, fndng fa approxmaton algorthms for betweenness and other centralty measures s also of ntere. From a practcal andpont, t s of ntere to see whch types of small cuts we fnd n real networks, whether socal networks have small tree wdth, whether decomposton to explot these features speeds centralty computaton, and whether more robu measures of centralty are needed. Reference L [1] Aho, J. Hopcroft, and J. Ullman. Data Structures and Algorthms. Addson- Wesley, Readng, MA, [2] D. Benock and M. Langon. Algorthmc mplcatons of the graph mnor theorem. In Network Models, Chapter 8, M. Ball, T. Magnant, C. Monma, and G. Nemhauser, eds., Elsever Scence, Amerdam, [3] U. Brandes. A faer algorthm for betweenness centralty. To appear n Journal of Mathematcal Socology. [4] G. Cornuejols, D. Naddef, and W. Pulleyblank. The travellng salesman problem n graphs wth 3-edge cutsets, J. ACM, 32, pp , [5] R. Davs. Socal network analyss: An ad n conspracy nvegatons. FBI Law Enforcement Bulletn, 50(12), pp , 1981 [6] C. Demetrescu and G. Italano. Fully dynamc all pars shorte paths wth real edge weghts. Proceedngs of the 42 nd IEEE Symposum on Foundatons of Computer Scence, pp , Las Vegas, [7] D. Eppen, Z. Gall, and G. Italano. Dynamc graph algorthms. In Algorthms and Theoretcal Computng Handbook, Chapter 8, M. J. Atallah, ed., CRC Press, [8] D. Eppen and J. Wang. Fa approxmaton of centralty. Proceedngs of the 12 th ACM Symposum on Dscrete Algorthms, pp , Washngton, [9] M. Fredman and R. Tarjan. Fbonacc heaps and ther uses n mproved network optmzaton algorthms. J. ACM, 34, [10] J. Garreau. Dsconnect the dots: maybe we can t cut off terror s head but we can take out ts nodes. Washngton Po Onlne, September 16, [11] M. Henznger. Improved data ructures for fully dynamc bconnectvty. SIAM Journal on Computng, 29, pp , [12] N. Katoh, T. Ibarak, and H. Mne. An effcent algorthm for K shorte smple paths. Networks 12(4), pp , [13] H. La Poutre. Mantenance of 2- and 3- edge-connected components of graphs II. SIAM Journal on Computng, 29, pp , [14] K. Stephenson and M. Zelen. Rethnkng centralty: Methods and examples. Socal Networks, 11, pp. 1-37, [15] T. Stewart. Sx degrees of Mohammad Atta. Busness 2.0, December, [16] S. Wasserman and K. Fau. Socal Network Analyss: Methods and Applcatons. Cambrdge Unversty Press, [17] J. Y. Yen. Fndng the K shorte loopless paths n a network. Management Scence 17, pp , [18] U. Zwck. All pars shorte paths usng brdgng sets and rectangular matrx multplcaton. Onlne techncal report. Bography Tam Carpenter receved her Ph.D. n Operatons Research from Prnceton Unversty n Upon completon, she joned Bellcore (now Telcorda Technologes) and s drector of the Network Optmzaton and Algorthms Research Group. She conducts research n communcaton network optmzaton. George Karakoas receved hs Dploma n Computer Engneerng and Informatcs from the Unversty of Patras n He got hs Ph.D. n Computer Scence from Prnceton Unversty n In 2000, he joned Telcorda Technologes. Hs research nteres nclude the desgn and analyss of approxmaton algorthms, computatonal complexty, and practcal applcatons of theory. Davd Shallcross receved hs Ph.D. n Operatons Research from Cornell Unversty n After podoctoral postons at Yale Unversty and at IBM, he joned Bellcore (now Telcorda Technologes) n Hs work has been n combnatoral and network optmzaton.