Identifying terrorism-related key actors in multidimensional social networks

. Identifying terrorism-related key actors in social media is of vital signiﬁcance for law enforcement agencies and social media organizations in their eﬀort to counter terrorism-related online activities. This work proposes a novel framework for the identiﬁcation of key actors in multidimensional social networks formed by considering several diﬀerent types of user relationships/interactions in social media. The framework is based on a mechanism which maps the multidimensional network to a single-layer network, where several centrality measures can then be employed for detecting the key actors. The eﬀectiveness of the proposed framework for each centrality measure is evaluated by using well-established precision-oriented evaluation metrics against a ground truth dataset, and the experimental results indicate the promising performance of our key actor identiﬁcation framework.


Introduction
Social media have gained an important role over the past years for the everyday communication of people around the world, by overcoming the barrier of distance and allowing for the direct and instantaneous connection and exchange of information among individuals. The popular social media platforms, such as Twitter, have provided the ground for the development of online social networks among users sharing common ideas or interests. A key property of these networks is their potential to facilitate the diffusion of information among their members. However, their immense social influence has also proven very useful for terrorist groups aiming at spreading their propaganda or recruiting new members [17].
In this context, social media networks are of great interest to Law Enforcement Agencies (LEAs) and social media organizations in their efforts to counter terrorism online. Their focus is on monitoring terrorism-related activities on social networks towards the identification of their most influential members (key actors) who play a significant role in the connectivity of the entire network and facilitate the diffusion of terrorism-related information to large audiences. Such social networks, including Twitter-based networks [1], exhibit a scale-free topology [3,14] making them extremely vulnerable, in terms of their connectivity, when targeted attacks are performed on their most central nodes. As a result, the detection and potential suspension of their (terrorism-related) key actors is of vital significance for all interested stakeholders.
A social media network is formed by capturing the interactions taking place either directly between social media users, or indirectly between users and social media posts (typically published by other users). Social media platforms offer a variety of interaction types to their users, each serving a different purpose. For instance, a Twitter user may mention 1 other users within their social media posts (tweets), reply to or retweet 2 tweets of interest, and may also have a follower and/or a following relationship 3 with other users. This entails that each network user may exhibit multiple links to other users, where each connection represents a different relationship type. In this context, a social media network is defined as a multidimensional network [9,4], so as to better reflect the impact each relationship type has on the overall structure.
This work aims at detecting the most influential user accounts in a social media network which is formed by considering multiple relationship types among its users, and focuses on the particular case of terrorism-related social media networks. In particular, the main contribution of this paper is the development of a novel framework for the identification of (terrorism-related) key actors in multidimensional social networks that have the ability to represent multiple relationship types between network nodes. The key actor identification is performed based on centrality measures for detecting the social network members who play a central role for the diffusion of information. For estimating the centrality measures, the original multidimensional network is mapped to a number of different simple (single-layer ) weighted networks, each representing the original (multidimensional ) network through a different weighting scheme.
The evaluation of our framework is performed on a social media network formed by Twitter accounts based on three different types of user relationships: (i) retweets, (ii) replies, and (iii) mentions. The accounts and their relationships have been extracted from a dataset collected from Twitter using terrorismrelated Arabic keywords provided by LEAs and domain experts. We assessed the effectiveness of the proposed framework for each centrality measure by using as ground truth the suspension of the retrieved accounts by Twitter.
The remainder of the paper is structured as follows. Section 2 discusses related work. Section 3 presents the proposed multidimensional key actor detection framework. Section 4 presents the evaluation experiments and their results. Finally, Section 5 concludes this work. 1 A mention represents a simple reference to a user within a tweet. 2 A retweet is a re-post of a tweet. 3 Twitter followers are users who follow or subscribe to another user's tweets. A user's following list contains all the users they follow on Twitter, whereas their followers list contains the users who follow them.

Related work
Several research efforts have been conducted over the past few years for detecting the most influential actors of multidimensional social networks. One of the early attempts identified influential users in a Twitter-based multidimensional network composed by following, retweeting, and mentioning interactions based on three link analysis algorithms [13]. In another research effort, the influence of the Twitter users was measured based on random walks in a multidimensional network taking into account several relationship markers [18]. Furthermore, a work on a Twitter-based social network detected the most influential candidates of the European Elections 2014 based on belief functions theory after combining different interaction types [2]. Moreover, various efforts have focused on identifying key actors in terrorismrelated social networks. A survey on social network analysis in counter-terrorism provided a comparison of tools which perform key actor identification on singlelayer networks based on centrality measures [8]. Additionally, a work on key actor identification in terrorism-related social networks resulted in the development of an entropy-based centrality measure, namely Mapping Entropy Betweenness, which has shown good performance when compared with well-established centrality measures [12]. Finally, another research effort focused on uncovering key communities, i.e., social media users belonging to the same community as key actors of interest [11]. Contrary to the aforementioned research efforts, this work focuses on identifying (terrorism-related) key actors in multidimensional networks after taking into account several different types of user interactions.

Multidimensional key actor detection framework
This work employs centrality measures so as to identify the key actors in a multidimensional [9,4] terrorism-related social network. Our framework is illustrated in Figure 1, where a keyword-based search on a social media platform provides a dataset of social media posts and users. Next, a weighted multidimensional network of users is created by exploiting several relationship types derived from either user-to-user or user-to-post interactions; in the latter case, a user-to-post interaction is transformed into a user-to-user relationship based on the owner of the respective post. In the resulting network, each user is represented by a node, while an edge (n i , n j , d k , w ijk ) is created between two users n i , n j for a given relationship type (dimension) d k , if one or more interactions of the relationship type d k has been captured within the dataset, and w ijk reflects the edge weight. Then, the multidimensional network is mapped to a weighted single-layer network based on one of the proposed mapping functions. Finally, a centrality measure is applied on the derived simple network and the key actors are ranked in descending order of their respective centrality score.
In the following, we first describe the mapping of the multidimensional network to a weighted single-layer network (Section 3.1) and then present the centrality measures employed in our framework (Section 3.2).

Multidimensional to single-layer network mapping
Given that our framework considers multidimensional social media networks, we use weighted edge-labeled multigraphs for modeling their properties. Let G = (N, E, D) denote a weighted edge-labeled undirected multigraph [4], where the set of nodes N represents the network actors, the set of labels D reflects the dimensions (i.e., relationship types) considered, and the set of edges E represents the links between the actors. This multigraph can then be represented by a set of quadruples (n i , n j , d k , w ijk ) where n i , n j ∈ N are the edge nodes, w ijk is the weight of the relationship (e.g., reflecting its strength) between these two nodes, and d k ∈ D is the edge label. A node appears in a given relationship type d k , if it is part of at least one edge labeled with d k adjacent to it, and an edge belongs to a given relationship type d k , if its label is d k . It is assumed that for any given pair of nodes n i , n j ∈ N and a label d k ∈ D, there may exist only one edge.
Given that the centrality measures employed in our framework require singlelayer networks for their computation, we propose a set of five mapping functions for transforming the weighted edge-labeled multigraph into a weighted single-layer graph. The goal of the mapping functions is to consider the multigraph structure for producing weighted single-layer equivalents capable of representing the original information captured in the multidimensional structure. The five mapping functions are applied on a weighted edge-labeled multigraph G = (N, E, D), where the weighted adjacency matrix w is projected to a 3dimensional space (i.e., w ijk represents the weight of the edge between nodes n i and n j for relationship type d k ), and produce a weighted undirected network G = (N , E ), where N = N (i.e., the multigraph and the derived single-layer network contain the same nodes) and w represents an adjacency matrix of the weighted graph (i.e., w ij is the weight of the edge between nodes n i and n j ).
The original multigraph is formed based on two different weighing schemes: (i) W S 1 considers that w ijk = 1 if node n i has interacted at least once with node n j for a given relationship type d k , whereas (ii) W S 2 considers that w ijk is equal to the number of interactions between nodes n i and n j for each relationship type (e.g., if n i has interacted 10 times with n j for a given relationship type d k , then w ijk = 10). The proposed mapping functions are listed below: Mapping function M 1 (Merged network): This mapping is applied on a weighted multigraph formed using W S 1 and produces a single-layer network where n i is linked to n j with w ij = 1, if there exists at least one edge w ijk = 1 between n i and n j in the original multigraph, regardless of relationship type d k .
Mapping function M 2 (Weighted network using relationship type): M 2 also requires a multigraph formed using W S 1 . It considers the number of the different dimensions for each edge between n i and n j , and produces a weighted single-layer network where n i is linked to n j with a weight w ij = w ij1 + w ij2 + ... + w ijm (i.e., equal to the sum of the edge weights for all the relationship types between n i and n j , where an existing relationship type for a given edge has w ijk = 1 ). This entails that w ij is equal to the number of the existing relationship types for each pair (n i , n j ) of the multigraph and cannot be greater than the actual number of the relationship types supported by the multigraph.
Mapping function M 3 (Weighted network using relationship type occurrence): M 3 is applied on a weighted multigraph following W S 2 . It considers the weight w ijk of each dimension d k for each edge between n i and n j and generates a single-layer weighted network where n i is linked to n j with a weight w ij = w ij1 + w ij2 + ... + w ijm (i.e., equal to the sum of the edge weights for all the relationship types between n i and n j , where an existing relationship type for a given edge has w ijk >= 1). The main difference between M 3 and M 2 lies in the weighting scheme used on the multigraph, which affects the edge weights in the derived single-layer network.
Mapping function M 4 (Weighted network using relationship type importance): This mapping first estimates the importance of each dimension d k in the multigraph based on two different approaches: (i) the importance of a relationship type, im k (with 0 ≤ im k ≤ 1), is a fraction of its total weight among all the multigraph edges when compared with the total weight of all the multigraph edges for all the relationship types; i.e., for each relationship type, it takes into account the number of interactions between any given pair of nodes, based on the assumption that the occurrence frequency of a relationship type within the multigraph entails a stronger link between the respective nodes, and (ii) the importance of a relationship type im k is the inverse fraction of the former approach, meaning that the most significant relationship type is the one exhibiting the less frequent occurrence within the multigraph edges, based on the assumption that the occurrence frequency of a relationship type is inversely proportional to the relationship strength. M 4 requires a weighted multigraph formed using W S 1 and generates a single-layer weighted network where n i is linked to n j with a weight w ij = im 1 ×w ij1 +im 2 ×w ij2 +...+im k ×w ijm , where an existing relationship type for a given edge on the multigraph has w ijk = 1.
Mapping function M 5 (Weighted network using relationship type importance and occurrence): This mapping function exploits the importance of each relationship type based on the two approaches presented in M 4 . M 5 is applied on a multigraph created with W S 2 and generates a single-layer weighted network where n i is linked to n j with a weight w ij = im 1 × w ij1 + im 2 × w ij2 + ... + im k × w ijm , with an existing relationship type for a given edge on the multigraph having w ijk >= 1. M 5 and M 4 are conceptually similar, however, their difference lies in the weighting scheme used on the input multigraph.

Centrality-based key actors
This section describes the seven state-of-the-art centrality measures employed for the key actor identification; for the latter two, it also expands their definitions, so that they can be applied on weighted single-layer networks.
The degree of a node is equal to the number of its adjacent nodes, i.e., the number of nodes that a node is linked to [10]. In weighted networks, the degree has been extended so as to reflect the sum of the weights of the adjacent nodes and has been defined as node strength [16]. Given a weighted undirected network G = (N, E) where N is the set of nodes and E is the set of edges, the strength of a node n i ∈ N , strength(n i ), is the sum of the weights of its adjacent edges: where w is a weighted adjacency matrix in which w ij > 0, if n i is connected to n j , and the value reflects the weight of the edge. In a weighted undirected network, the Degree Centrality (DC) of a node equals to its strength. Besides Degree Centrality which simply sums the weights of adjacent edges and is not affected by the position of a node in the network, our framework also employs Betweenness Centrality which quantifies the number of times a node acts as a bridge along the shortest path between two other nodes [10]. We define a path from n i ∈ N to n j ∈ N as a sequence of nodes and edges which begins by n i and ends in n j , such that each edge connects its preceding with its succeeding node. In a weighted undirected network, the path length is defined as the sum of the weights of all its edges, and the shortest path is the path with the minimum length connecting n i and n j . In this context, the Betweenness Centrality (BC) of a node n k is based on the number of shortest paths from node n i to node n j that pass through node n k , divided by the number of all shortest paths from node n i to node n j [6]: where σ ninj is total number of shortest paths from node n i to node n j and σ ninj (n k ) is the number of those paths that pass through n k . Our framework also employs Closeness Centrality (CC) which is based on the inverse of the average distance to all other nodes of a network [10], the Eigenvector Centrality (EC) which considers that a node is more influential if it is connected to many nodes who themselves have high scores and corresponds to the largest eigenvalue of the adjacency matrix [5], and PageRank (P R) which (motivated by estimating the importance of Web pages in the Web graph) corresponds to the principal eigenvector of the normalized adjacency matrix [7]. Furthermore, our framework employs two entropy-based centrality measures, Mapping Entropy (M E) [15] and Mapping Entropy Betweenness (M EB) [12], which take into account the neighborhood N (n k ) of a node n k for identifying the key actors. ME and MEB consider the information that is communicated through nodes which act, respectively, as a hubs or bridges, i.e. those with high values of Degree or Betweenness Centrality between any two members, respectively. We expand the definitions of ME and MEB which have been originally applied in unweighted networks [15,12], so as to also consider their computation in weighted networks. To this end, the weighted ME and MEB definitions take advantage of the Equations (1) and (2), so as to rely on the weighted computation of the Degree and the Betweenness Centrality, respectively: The

Evaluation Experiments
This section first describes and analyses the dataset used in our experimental evaluation (Section 4.1) and then presents the evaluation setup and discusses the experimental results (Section 4.2).

Dataset
Our experiments were performed on a social media network formed by data collected from Twitter within a 16-month period (February 9, 2017 to June 8, 2018) using a set of Arabic keywords related to terrorism, provided by LEAs and domain experts. The dataset consists of 65,511 tweets posted by 35,718 users. Three user interaction types were examined: retweets, replies and mentions. Moreover, two variations of a weighted multidimensional social network were developed based on the two weighting schemes of our framework, respectively, (i) a multigraph using W S 1 which consists of 33,946 retweets, 4,411 replies, and 8,062 mentions, while the total weight per relationship type is equal to the number of edges (given that all the edge weights are equal to 1), and (ii) a multigraph using W S 2 which contains the exact same number of edges per relationship type as above, while the total weight of retweets, replies and mentions is 57,541, 9,926, and 16,546, respectively (i.e., each edge is assigned a weight based on the number of interactions per relationship type for any given pair of nodes).
Next, seven weighted single-layer networks (having 35,718 nodes each) were produced after applying the proposed five mapping functions and their variations (see Section 3.1). For M 4 and M 5, the importance rate for retweets, mentions, and replies was estimated as 0.68, 0.20, and 0.12, respectively, whereas the inverse important rate was estimated as 1.47, 5.00, and 8.33, respectively.
In addition, three single-layer networks were also created (one for each relationship type), so as to be used as a baseline for our evaluation. To examine the behavior of the three baseline single-layer networks, we simulated targeted attacks on the Largest Connected Component (LCC, i.e., the largest subgraph in which any two nodes are connected to each other by paths) of each network, by sequentially removing its most central node(s) based on each of the centrality measures under consideration with the goal to determine which dissolves the network structure faster and affects its robustness.
Before initiating the attacks to the three baseline networks, we examined their scale-free property, so as to gauge their vulnerability to targeted attacks towards their central nodes. To this end, we examined the power-law behavior of the degree distribution for the networks under consideration, so as to identify the vulnerability of the LCC to targeted attacks. For the retweet-based single-layer network, the power-law exponent is estimated to be 3.288 and is statistically significant, as stated by the Kolmogorov-Smirnov hypothesis test with p-value 0.644 > 0.05, which confirms the scale-free character of the network, therefore allowing for performing targeted attacks on the most central nodes. Similarly, the reply-based network is also scale-free, with Kolmogorov-Smirnov's test pvalue 0.851 > 0.05 and a power-law exponent estimated to be 2.606. Finally, the mention-based network also complies with the scale-free assumption. The power-law exponent is estimated to be 3.0951 and is statistically significant, as confirmed by the Kolmogorov-Smirnov hypothesis test with p-value 0.524 > 0.05.
For the retweet-based network, the LCC contains 15,577 nodes and 23,105 edges; for the reply-based network, 3,221 nodes and 3,773 edges; and for the mention-based network, 3,953 nodes and 5,078 edges. Figures 2, 3, and 4 illustrate the decay of the LCC on the three networks under consideration. Betweenness Centrality achieves faster removal of the LCC nodes for all networks, while Closeness Centrality and MEB are in the second and third place, respectively. The decomposition of the reply-based network is performed relatively faster when compared with the other two networks, after taking into account both the original size of the LCC and the number of the attacks required until the network is decomposed; 52 nodes on average are removed at each iteration of the attack process on the reply-based network for the best performing centrality measure, whereas 39.53 and 22.77 nodes are removed on average on the mention-based and the retweet-based network, respectively. This entails that the Betweenness   Centrality is capable of identifying highly central nodes at earlier stages of the attack process when exploiting the reply-based interactions.

Evaluation results
The evaluation of our framework is performed by comparing the seven centrality measures under consideration for the different generated networks, i.e., the three baseline relationship-based networks and the seven weighted networks produced through the mapping functions. In our experiments, we extract the top 100 key actors returned by the employed centrality measures and evaluate them against ground-truth which we consider to correspond to the suspension of a Twitter account. Given that the suspension process is applied when an account violates Twitter rules by exhibiting abusive behavior, including posting content related to violent threats and hate speech, we consider that the suspended accounts in our dataset are likely to have exhibited such behavior. We assess the performance of the centrality measures based both on set-based and rank-based metrics. In particular, Precision at k (P@k) is employed as a set-based metric, whereas the Mean Reciprocal Rank (MRR) and the Mean Average Precision at k (MAP@k) are used for evaluating the ranking of the returned accounts. Tables 1, 2 and 3 depict the performance of the centrality measures according to P@100, MRR, MAP@100, respectively. In terms of P@100, the retweet-based network achieves better results in identifying suspended Twitter accounts within the top 100 key actors detected by DC, BC, CC, and EC, whereas the reply-based network exhibits better performance for PR, ME, and MEB. Similar behavior is observed when taking into account MAP@100. This indicates that relying on the retweet and the reply-based interactions helps uncover a large number of suspicious accounts. On the other hand, these two baseline networks fail to include all the potential information derived after aggregating several different relationship types. With regards to the weighted networks derived by the proposed mapping functions, M 1 exhibits the best performance for P@100 and MAP@100 for almost all centrality measures, however, M 3 is the best performing network overall when combined with EC. On the other hand, given that MRR is a rank-based metric, a centrality measure that detected less key actors may have a larger MRR value, if a suspended account is encountered in the first positions within the top 100 key actors. In terms of MRR, M 1 is the top performing network, given that it manages to uncover a suspended account on the top key actor position for DC, BC, CC, and EC. The remaining mapping functions also manage to identify the first suspended account within their top 10 key actors for several centrality measures.
When examining the centrality measures of our framework, EC is the top performing metric which provides better results in terms of P@100 and MAP@100 for retweets, M 1 , and M 3 . CC and EC follow, whereas ME and MEB exhibit good performance for the reply-based network. In terms of MRR, we observe a similar pattern. EC and CC are the top performing centrality measures followed by DC and PR. In general, 12 combinations of mapping functions and centrality measures in total identify a suspended account at the top key actor position.

Conclusions
This work addressed the key actor identification task in a terrorism-related multidimensional social media network. The proposed framework employs a set of mapping functions for transforming the original multidimensional network to an equivalent weighted single-layer network, and then it applies a centrality measure for detecting the key actors on the derived network. The evaluation of our framework shows its potential to assist towards the discovery of key actors based on a number of different user interactions.