Overview
• Research background
• Sample Twitter data set related to ISIS/ISIL
• K-Core Decomposition
– Central URLs
– Central Users
• Topic Detection
• Sentiment Analysis and Anomaly Detection
2

What Are We Doing?
Provide valuable intelligence results to clients using our
dynamic anomaly detection software and data mining
tools
Many possible application areas:
Social media alerting and sentiment change detection
Analysis of web trends and user activities
Pricing and market trend analysis and alerting
Network defense against cyberattacks
Insider threat detection
Fraud prevention (banking, insurance, online auctions,…)
Healthcare data mining
Paragon Science, Inc. 3

How Is It Done Today?
Existing approaches
Standard SNA metrics
Rule-based systems (transaction profiling, etc.)
Bayesian and other statistical/probabilistic models
Machine learning tools (neural nets, HMMs, etc.)
Some limitations of existing methods
Training requirements can be large for neural nets.
For rule-based systems, it is difficult to effectively predict
or define new “bad” anomalies or patterns in advance.
Many current methods are not scalable to real-world
operational requirements.

What Is New in Our Patented Approach?
• A powerful anomaly detection approach
that incorporates nonlinear time series
analysis methods
– US Patent #8738652 (1.usa.gov/1kkyVD9)
“Systems and Methods for Dynamic Anomaly Detection”
• Key questions answered:
– Which entities behave or evolve differently than others in the
data set?
– Which entities have shifted their behavior unexpectedly?

What Is New in Our Patented Approach?
(Cont’d.)
Our framework inherently captures the dynamics of
the entities under study, without having to specify in
advance normal vs. abnormal behavior.
We can simultaneously analyze the time evolution of
 Network structures
 Any associated attributes (text terms, geospatial position, etc.)
Our technique is robust with respect to missing or
erroneous data.
As result, we can
 Find key players in rapidly changing networks
 Provide early warning of viral videos and online documents
 Focus attention on the most-anomalous events or transactions

Dynamic Anomaly Detection Overview
A general approach that incorporates nonlinear time
series analysis methods
Complexity measures
Finite-time Lyapunov exponents (FTLEs)
Input data
Communications or transactional data streams
General time-dependent data sets
Key questions
Which entities behave or evolve differently than others in the
data set?
Which entities have shifted their behavior unexpectedly?

Finite-Time Lyapunov Exponents
(FTLEs)
• General dynamical system
• Flow map
– Advects points in the state
space
– Describes the time
evolution of the system

Finite-Time Lyapunov Exponents
(FTLEs)
• FTLEs characterize the amount of stretching or
contraction about a point x0 during a time interval T
– Stability
– Predictability
• Definition

Derived Jacobian Vectors
• Similarly, characteristic vectors derived from the flow
map’s Jacobian can describe the generalized
directions of the local stretching or contraction.
• Possible derivation approaches:
– Weight-based column sampling
– Singular value decomposition (SVD)
– Principal component analysis (PCA)

Paragon Science Dynamic Anomaly
Detection
Representation
of Data at t=ti
Cluster
Resolution
Feature Vector
Encoding
Outlier Detection
at t=ti
3+ Time
Intervals?
No
Yes
Clustering /
Segmentation
Dynamic Anomaly Detection
Nonlinear Time Series Analysis
FTLEs, Dynamic Thresholds, etc.
Pattern
Classification
Outlier
Detection
Domain-Specific Filtering
Threat Signatures,
Risk Profiles, etc.

ISIS-Related Twitter Analysis
Sample data set from Twitter API collected using
twittertap:
Date range: 11/30/2015 – 12/10/2015
2,541,812 tweets
7,802,210 generated links with hashtags, URLs, and user replies
Research plan
Perform k-core decomposition
Run anomaly detection software on sub-networks of nodes in
the central core to find the most influential users and most viral
URLs
Carry out community detection, topic detection, and sentiment
analysis

ISIS-Related Twitter Network
User A User B
User C
replies to
mentions
URL 1 URL 2
Hash Tag 1
Hash Tag 2
references
uses
uses
references
Link Type # Links
User links to URL 2,014,572
User mentions user 2,867,633
User references hashtag 2,699,875
User references symbol 2,636
User replies to user 215,343

K-core Decomposition
The k-core of a graph is a maximal subgraph in which
each vertex has at least degree k.
The coreness of a vertex is k if it belongs to the k-core but
not to the (k+1)-core.
The k-core decomposition is performing by recursively
removing all the vertices (along with their respective
edges) that have degrees less than k.
The k-core decomposition of a network can be very
effective in identifying the individuals within a network
who are best positioned to spread or share
information.
 M. Kitska, et al., “Identifying influential spreaders in complex networks,”
arXiv:1001.5285v1 [physics.soc-ph] (2010).
14

K-Core Decomposition of the ISIS Network
http://sourceforge.net/projects/lanet-vi/

Central Core of the ISIS Network
Users at the center
of the k-core
decomposition are
positioned well to
spread information
and influence the
network.

Top URLs in the Central Core
URL Web Page Title Coreness # Links
http://www.mirror.co.uk/news/uk-news/isis-
would-love-you-bomb-
6941441#ICID=sharebar_twitter
ISIS would love you to bomb them to bring
about apocalyptic final fight, says journalist who
lived among terrorists - Jurgen Todenhofer -
Mirror Online
89 398
https://www.youtube.com/watch?
v=nVDiK3J9PKQ
How to Paralyse & Eliminate ISIS in Less Than 24
Hours - Younus AlGohar - YouTube
89 384
http://shr.gs/Um8lnCZ Jihadi BILLIONAIRES: ISIS top terror rich list“ but
how are they blowing all the dough?
89 349
https://www.youtube.com/watch?v=FS9iPz-cPlY Humanity Under Attack! What Must Be Done
Now? - Younus AlGohar - YouTube
89 331
http://is.gd/txNkng How to Paralyse & Eliminate ISIS in Less Than 24
Hours - Younus AlGohar
89 327
http://bbc.in/aggad Paris attacks: Bataclan third attacker identified -
BBC News
89 317
http://ti.me/1XPKXcx London Subway Attacker Had ISIS Images on
Phone: Officials
89 317
http://dailym.ai/1NFIp5L ISIS releases its latest video as they execute two
˜sorcerers” in Libya | Daily Mail Online
89 298
http://youtu.be/mXOSQj4xjPY Fitna-e-Khwarij - YouTube 89 259
http://www.telegraph.co.uk/news/worldnews/
northamerica/usa/12037849/
Majority-of-Americans-support-sending-ground-
troops-to-fight
Majority of Americans support sending ground
troops to fight Isil
89 255

Top 5 URLs in the Central Core
18

Top Users in the Central Core
User Coreness # Links
MailOnline 89 6255
David_Cameron 89 3330
Telegraph 89 2072
TarekFatah 89 1907
BBCWorld 89 992
younusalgohar 89 977
mehdifoundation 89 830
rafu007 89 791
TIMEWorld 89 700
niallboylan4fm 89 667

Topic Detection in the ISIS
Twitter Network
User A User B
User C
replies to
mentions
URL 1 URL 2
references
Term 1
Term 2
Term N
Term 3
Topic 1
Topic 2
Topic M
 146 Topics Detected

Title-to-Term Network for Topic Detection
21

Title-to-Term Network for Topic Detection
22

Topic 3 Communities of Users
23

Incorporating Sentiment Analysis
• Incorporate sentiment analysis scores as an input to
dynamic anomaly detection in order to track the
propagation of references to websites with particular
emotions.
• Use the LIWC (Linguistic Inquiry and Word Count) tool
to calculate the sentiment scores of the web pages.
– Prof. James Pennebaker from UT Austin (
http://liwc.wpengine.com/)
– Sample categories
• Positive emotion
• Negative emotion
• Anger
• Anxiety

Top Web Pages by Anxiety
Web Page Title URL Anxiety Score
Watch Daniel Scavino Jr.'s Vine "POTUS
on terrorism."
https://vine.co/v/i71FvOKlYgv 11.11
*WARNING: New ISIS VIDEO: Muslim
Children Execute Captives, Obama, we
will behead you, as we will do to all the
Jews | Pamela Geller
http://bit.ly/1TMcgif 6.51
The Mastermind Of The San Bernardino
Massacre Has All The Hallmarks Of An
ISIS Terrorist Attack... - Linkis.com
http://ln.is/shoebat.com/2015/
12/PGcNB
5.56
The Far-Reaching Effects of Global
Terrorism - YouTube
http://youtu.be/L_qr01yHoQs 4.85
Terrorism isn't scaring Americans;
Obama is by Andrew Malcolm -
Investors.com
http://news.investors.com/polit
ics-andrew-malcolm/120715-
784023-obama-isis-speech-no-
new-strategy.htm
4.03
57 Paris airport workers on terror watch
list, “Allahu akbar” scrawled on fuel
tank
http://www.jihadwatch.org/201
5/12/57-paris-airport-workers-
on-terror-watch-list-allahu-
akbar-scrawled-on-fuel-tank
3.03
Ian56 https://twitter.com/Ian56789:
DIA Emails: ISIS was deliberately armed
and funded by Obama & Hillary Clinton
http://ian56.blogspot.com/2015
/06/the-terrorist-threat-has-
been.html?m=1
2.94

Top Web Pages by Negative Emotion Ratio
Web Page Title URL Negative/
Positive
Emotion Score
Russian airstrike 'kills family in their car' as bombs
obliterate ISIS oil convoy | Daily Mail Online
http://dailym.ai/1IIU2Yz 21.9
Study: Unprecedented support for ISIS in the U.S. -
CNNPolitics.com
http://cnn.it/1XF0p61 13.3
US-led coalition not striking ISIS oil trucks despite
evidence – Russia’s General Staff” RT News
http://on.rt.com/6y9c 12.1
ISIS PARIS TERRORIST Recruited Fighters at Hungarian
Refugee Camp - YouTube
https://www.youtube.com/watch?
v=88TJBvH1zzg
11.9
U.S. rejects Russia’s claim of Turkey’s cooperation with
ISIS
http://goo.gl/Q9MWGk 11.8
Islamic State's Sinai chief said in Gaza to coordinate with
Hamas | The Times of Israel
http://bit.ly/1N6bqZa 10.0
Is ISIS Entering US Through Mexico? Amid Islamic State
Fears, Border Patrol Captures Afghan, Pakistani Men
Being Smuggled Into Country
http://bit.ly/1l9Mxo1 9.8
Why Can't White House Just Say ISIS Beheaded
Christians? - Investors.com
http://ift.tt/1zMpWNz 8.6
For the Record: How Stubborn U.S. Leaders May Be
Hurting the Fight Against ISIS on Vimeo
https://vimeo.com/147860012 8.4
Just 0.4 Percent of Syrian Refugees Admitted to U.S. Since
Paris Attacks Are Christian - Breitbart
http://www.breitbart.com/big-
government/2015/12/08/just-0-4-
percent-syrian-refugees-admitted-
u-s-since-paris-attacks-christian/
8.1

Mapping Anomalies to Source Data
Anomalies
Discrete/Continuous
Attribute Distributions
Related Source
Data
Where and
when are the
hotspots of
changes?
Which nodes
and attributes
were involved in
each
anomalous
peak?

Anomaly Detection Results for Websites
with Negative Emotions
Surge of Twitter user links to
web page with high negative
emotion score: “The ISIS
Trail of Death - NBC News”

Summary of Top 50 Negative Emotion Anomalies
32
Web Page Title Peak Start Peak End Max Change
Metric
#
Anomalies
The ISIS Trail of Death - NBC News 2015-12-08
03:36:39
2015-12-09
13:36:39
3.01 24
Russia strikes ISIS targets in Syria from
sub in Mediterranean for first time
(VIDEO) RT News
2015-12-09
07:36:39
2015-12-09
16:36:39
2.33 8
US Air Force running out of bombs to
fight ISIS | Fox News
2015-12-06
07:36:39
2015-12-06
21:36:39
2.10 2
If you keep saying Saudi Arabia is like
ISIS, you might get sued - The
Washington Post
2015-12-02
04:36:39
2015-12-07
09:36:39
2.01 11
Everyone knows what’s going on:
Istanbul residents on Turkey-ISIS oil
trade Ã¢Â€Â” RT News
2015-12-04
15:36:39
2015-12-04
16:36:39
1.96 2
Is ISIS Entering US Through Mexico?
Amid Islamic State Fears, Border Patrol
Captures Afghan, Pakistani Men Being
Smuggled Into C
2015-12-03
15:36:39
2015-12-03
15:36:39
1.91 1
Iran news in brief, 30 November 2015 -
YouTube
2015-12-01
17:36:39
2015-12-01
17:36:39
1.90 1
No Christians: All 132 Syrian Refugees
Admitted to U.S. Since Paris Attacks Are
Sunni Muslims
2015-12-01
19:36:39
2015-12-01
19:36:39
1.89 1

Most-Anomalous Negative Emotion
ISIS Web Page Shared by Twitter Users
33

Twitter Network Related to Negative Peak
34

Paragon Science, Inc. 35Paragon Science, Inc. 35
What Are the Payoffs?
• Quickly identify key influencers and trends in online
networks, incorporating sentiment analysis scores to
track the viral spreading of emotions
• Provide early warning of viral videos, anomalous web
events, or unusual network traffic
• Enable enhanced business intelligence without
having to specify normal vs. abnormal behavior in
advance

Third-Party Software Acknowledgements
 Paragon Science gratefully acknowledges the following researchers and software
providers:
 Cytoscape (http://www.cytoscape.org/)
 Lanet-vi (http://sourceforge.net/projects/lanet-vi/)
o J. Alvarez-Hamelin, et al., "Understanding Edge Connectivity in the Internet
through Core Decomposition," Internet Mathematics 7 (1): 45–66, 2011.
 LIWC (Linguistic Inquiry and Word Count) (http://liwc.wpengine.com/)
o Y.R. Tausczik and J.W. Pennebaker, “The psychological meaning of words:
LIWC and computerized text analysis methods,” Journal of Language and
Social Psychology, 29, 24-54.a, 2010.
 Louvain community detection software (
http://perso.crans.org/aynaud/communities/)
o V. Blondel, et al., “Fast Unfolding of Communities in Large Networks,”
Journal of Statistical Mechanics: Theory and Experiment, 10, P10008, 2008.
 Networkx (https://networkx.github.io/)
o A Hagberg, D Conway, "Hacking social networks using the Python
programming language (Module II - Why do SNA in NetworkX)", Sunbelt
2010: International Network for Social Network Analysis.Paragon Science, Inc. 36

Using Chaos to Disentangle an ISIS-Related Twitter Network

More Related Content

What's hot (20)

Similar to Using Chaos to Disentangle an ISIS-Related Twitter Network (20)

Recently uploaded (20)

Using Chaos to Disentangle an ISIS-Related Twitter Network