Suicide Bombing Forecaste
r
–
Novel Techniques to
Predict P
atterns of Suicide Bombing in Pakistan
Zeeshan ul Hassan Usmani
Interactive Group
zeeshan.usmani@iacgrp.com
Sarah Irum
Interactive Group
sarah.irum@iacgrp.com
Saad Qadeer
LUMS
13100027@lums.edu.pk
Taimur Qureshi
Interactive Group
taimur.qureshi@iacgrp.com
Keywords:
Reality Mining, Terrorism Forecast, Pattern
Matching, Data Mining, Big Data
Abstract
Terrorist activities (suicide bombings, IEDs etc.) have
plagued countries like Pakistan, Iraq, and Afghanistan for
number of years. Majority of these human and smart bombs
can take place at any time and place giving little or no
chance for law enforcement
agencies to respond or deploy
any pro

active measures. While law enforcement agencies
employ various defensive measures in order to prevent these
incidents such as deployment of forces, check points,
surveillance and proactive intelligence but still the
b
ombings are increasing with every passing day. An
effective proactive measure can be to predict the occurrence
of such events in advance so that the law enforcement
agencies can have prior clue and deploy preemptive
measures around the danger zones at spec
ific times of the
year. This paper presents
SB For
e
caster

an advanced
warning and mitigation system that uses predictive and
pattern analysis to aid the agencies.
1.
I
NTRODUCTION
A suicide attack can be defined as a politically motivated
and violent

inten
ded action, with prior intent, by one or
more individuals who choose to take their own life while
causing maximum damage to the chosen target. Suicide
bombing has become one of the most lethal, un
predictable
and favorite modus operandi of terrorist organiz
ations.
Though only 3% of all terrorist attacks around the world can
be classified as
suicide bombing attacks, these
acc
ount for
48% of the
casualties [1].
The challenging mission is to prevent terrorism. The
difficulties to prevent terrorism are suicide
bomber death
(thus leaving no traces), cheap equipment used in suicide
bombing as it is easy to acquire, organizations which recruit
suicide bombers take local people for suicide bombing.
Even suicide bombers characteristics changes from men to
women, in s
ome cases, children
which makes the
identification of suicide bomber difficult.
Despite
of all the hurdles being faced to put an end to the
terrorism
, different techniques can be used to exploit the
patterns in the behavior of terrorist organizations. The
se
patterns can be identified by using the historical data and
other statistical measures. The focus of this research is the
use of data mining algorithms to unveil the suicide bombing
patterns in Pakistan. In this paper, prediction techniques
are
presente
d which
identify high risk areas, next terrorist
attack, and terrorist organizations through injury patterns.
2.
B
ACKGROUND
This section shows first the upcoming threats of terrorist
organizations. Secondly, it shows data mining techniques for
analyzing d
ata.
Thirdly
, it presents the basic information
about the database used in our analysis.
Finally, it provides
techniques for analysis
such as GIS Maps.
2.1.
Terrorist Organizations
There are various terrorist organizations in Pakistan which
are playing their part i
n suicide bombings. First,
Tehreek

e

Taliban Pakistan (TTP)
that is
comprised
of
40 militant
commanders with a collective strength of about 25,000 and
is considered as
the most lethal of the Taliban outfits in
Pakistan’s wily regions bordering Afghanistan.
Other
terrorist organizations include Lashkar

e

Jhangvi, Abdullah
Uzam Brigade, Masud Group, Karwan e Nematullah,
Militant Commander Molvi Nazir, Al Qaeda Taliban
Linked, Tehrek e Taliban Punjab wing. Percentages of
suicide attacks from 1995 to 2011carrie
d out by these
groups are shown in Fig. 1.
Figure
1
.
Percentage of Suic
ide Attacks by Groups (1995

2011)
2.2.
Data Source
The complete dataset used in this research is made
available at a public portal (
www.PakistanBodyCount.org
).
Research is conducted for the collection of historical terrorist
events and then compiled on PBC.
Data is collected from
media reports, hospitals, and internet.
All the gathered dat
a
along with analysis of suicide bombings and drone attacks
since 1995 to date is publicly available on PB
C.
Analysis of
suicide bombings since 1995 to date is available on PBC.
Other sources like PIPS [3] and SATP [4] also contain
dataset of suicide atta
cks in Pakistan. It reported total suicide
bombing victims in terrorist attacks in Pakistan as 5229
causalities and 13661 injuries. Total suicide bombing
incidents reported by PBC are shown in Fig. 2. This data is
taken for analysis of suicide bombing atta
cks. Analysis was
conducted by using tools like C# and ArcGIS.
Figure
2
.
Suicide Bombings in Pakistan (1995

2012)
2.3.
GIS Maps
Geographical Information System (GIS) helps to analyze,
interpret, understand and visualize data. Predict
ion of
Suicide bombing patterns across Pakistan is done by GIS
Maps. These maps visualize high risk cities and risk factor of
all cities of Pakistan. Data is analyzed based on the collected
data in data collection phase and then result is shown onto
the tw
o dimensional geographical view.
This allows
presenting the results of sophisticated analysis in better way.
3.
S
TATE

OF

T
HE

A
RT
Law enforcement agencies have the need to stay a step
ahead of terrorists and thus, need to continuously predict
their activities and the target locations. While defensive
measures can provide a first layer of protection to terrorist
attacks they cannot re
ly entirely on those means and need to
be more effective. Employing proactive measures using new
predictive technologies to anticipate the actions of the
terrorists provides another effective line of defense for the
law enforcement agencies. In this paper,
we describe new
predictive techniques for the time and location of future
attacks and current threat zones.
In the predictive modeling problem that we use for
bombing incidents, we use data from past incidents and any
derived information about terrori
sts and the events to predict
the locations of future attacks. Many approaches in the
literature perform this type of predictive analysis. A lot of
them use simple spatial clustering methods using only the
coordinates, dates, and types of crimes. Such meth
ods
include the Spatial and Temporal Analysis of Crime program
(STAC) [
5
].
In [6
], Jefferis et al survey additional hotspot
methods that employ kernel density estimation and other
simpler density estimation models.
The paper by Brown et al [
7
] extends cri
me

clustering
methods by incorporating offenders’ preferences in crime
site selection. A number of researchers have investigated
spatial decision

making by criminals [
8
,
9
,
10
,
11
,
and 12
].
To summarize, this body of research suggests that the
likelihood o
f a criminal incident at a specified location is
based on past incidents of the same type and independent
spatial features [
7
].
4.
D
ATA
P
REPARATION
Collection of data plays a role throughout the complete
process of generating terror forecasts, ranging from
data
collection to generation of likelihood functions to
presentation of the forecasts. We categorized the data
preparation into following three categories.
4.1.
Data
Extraction
Information about the all incidents; suicide bombings,
planted bombs, drone attac
ks, and other possible
disturbance including firing, killings are publically
available. All the information
is
collected from printed
media, electronic media and internet.
All information
regarding terrorist events are gathered using different
means
, e.g.
saving clippings, saving internet data.
Possible attributes of data to find risk value of each
city are presented in Table 1. Risk value of city is based on
possible suicide bombing risk and disturbance.
Public data
is
used
to unveil the sense of achievem
ent of terrorists.
When media tells the people about damage, that broadcasted
fear and terror is something that terrorist take as success.
Using data that is publically available means that we can
plot what terrorist are trying to achieve.
To identify terr
orist
pattern or behavior public data is used.
TABLE I.
D
ATA
A
TTRIBUTES
No.
Variables
1
INCIDENTDATE
2
YEAR
3
DAY
4
MONTH
5
ISLAMIC_MONTH
6
BLAST_DAY_TYPE
7
HOLIDAY
8
TIME
9
HOURS
_BEFORE_LAST_BLAST
10
CITY_COORDINATES_LATITUDE
11
CITY_COORDINATES_LONGITUDE
12
PROVINCE
13
WEATHER
14
LAST_BLAST_TYPE
15
RALLY_TYPE
4.2.
Planners Psychology
Terrorists plans to spread terror and they use every
possible ways to create disturbance. There
plans can be
broadly categorize
into two categories,
“routine actions”
and
“
reactions”
. Routine action; planned attacks which they
execute according to set plans. Plans include whole lot of
workings; recruitment of bomber, transportation of
explosives, making of explosive jacket/vehicle,
planting of
bomber near target place. Such planning takes good time
from start till end and they keep executing such plans in
routine. Reactions; are attacks that terrorist organizations do
in aggression as counter attack. Whenever counter terrorism
agenc
ies attack heads of terrorism organizations, they
observe such reactions.
Usually routine actions are hard to foil then the
aggressive reactions, because routine actions are planned at
best level to avoid capture of any lead. On contrary
aggressive action
have room for error because of less
planning then routine actions. Routine actions leave there
own action patterns that can be observed. Which means if
the pattern is known in advance then routine actions is
avoidable.
5.
P
ATTERNS OF
S
UICIDE
A
TTACKS
O
CCURRED
IN
P
AKISTAN
W
e attempt to discover a pattern in the timing of the
suicide attacks that have occurred in Pakistan. This work is
along the lines done by Johnson et al for Afghanistan and
Iraq
[1]
.
In general, the act of learning causes the time taken for
co
mpleting a particular task to decrease. For a suicide
attack, we let the time interval between successive attack
days stand as the time required to perform the attack. We
therefore hypothesize that this time interval follows the
general rule
τn = τ1n

b
(1)
Where τn is the number of days between the nth and the
(n+1)th suicide attack day and τ1 and b are constants for a
particular group. Simplifying yields
log(τn) = log(τ1)
–
b(log(n))
(2)
We thus plot log(τn) vs log(n) and fit a best

fit straight
line in order to verify the suitability of this model and to
estimate τ1 and b. The next figure shows the best

fit plot for
the best

fit values of log(τ1) and b for the different regions.
Fig. 1.
Best fit plot for different regions
At the 5% significance level, a two

tailed correlation
test for sample size 7 shows that there is significant
correlation between the variables. We conclude from this
that the pattern of learning with time is exhibit
ed by
organizations throughout the country.
6.
P
REDICTION
A
LGORITHMS
The goal is to predict the threat level or likelihood of a
bombing at any point in time and date of a certain region
given its location. All the other attributes mentioned in the
previous se
ction are calculated automatically from this basic
date/time and location coordinate information. These in turn
form the input feature set (X) comprising of 15 variables of
table 1.
The predictive analysis of bombing incidents is carried
out using two di
fferent techniques, exhibiting approximately
similar performance in terms of accuracy but different in
their order of time complexity, which is discussed in the next
section. The general idea for both techniques is the same,
which consists of predicting th
e output (Y) given a set of N
input features (X). Here, the output (Y = positive) consists
of a single class meaning that the data set contains examples
where a certain bombing incident has positively occurred.
Thus, we can treat this as a one

class cla
ssification
problem
(OCC) [18
] as we did in our DTS technique of
section 3.1 or implement considering a density estimation
method as discussed in section 3.2.
6.1.
Distance
based
Threat Scoring Technique (DTS)
In this technique, we use a distance based scorin
g
measure (as in 3.1.1) in order to classify the level of threat as
high, medium or low. The concept here based on the
proximity of the new unseen feature vector to the averages of
existing bombing incidents. The more similar it is, the
likelihood of anoth
er bombing incident will be higher. This
concept has also been deployed in ou
tlier analysis techniques
[19
].
In order to increase the accuracy, we identify high

density regions where the bombing incidents are
concentrated and assign them to clusters as ex
plained in
section 3.1.2. Next, we calculate the centroid of each cluster
as:
Now, consider a new point in the feature space. We
calculate its distance from the nearest centroid as normalized
distance given by:
Thus, we obtain normalized distance scores in the range
of 0

100, which are classified as being high (above 70),
medium (40

70) and low (below 40) levels of threat.
6.2.
Distance
Measure
Due to the presence of numerical, ratio, ordered and
unordered catego
rical variables we choose a variation of the
gower distance measure as our proximity score. For numeric
data we use mahalonobis distance which is defined as:
For categorical values the following formulas are used.
Unordered
If Values of attribute is
different then:
d(x, y) = 1
Else:
d(x,y) = 0
Ordered
Ordered attributes were first normalized and then the
distance was calculated using:
Where, Range = MaxValue (X)
–
MinValue (X)
In order to calculate distance between to locations
defined by its l
atitude and longitude coordinates we used the
haversine formula defined as:
R = earth’s radius (mean radius = 6,371km)
lat = lat2− lat1
long = long2− long1
a = sin²(lat/2) + cos(lat1).cos(lat2).sin²(long/2)
c = 2.atan2(√a, √(1−a))
Distance = R.c
6.3.
Clusteri
ng
The clustering algorithm used is k
means clustering [16
],
with the distance measure described above. The general
algorithm takes K random points in the feature space and
measures the distance of all other points from them. The
points nearest of these initial points form K initial clusters
and their centroids a
re calculated. The second iteration
realigns the clusters and new centroids are discovered. This
process continues until no further changes in the clusters are
obtained or after a fixed number of iterations.
We use 40 iterations and choose the value of k
from 2 to
10. We choose the best K by maximizing the Bayesian
Information Criterion (BIC) [1
7
]:
BIC (C  X) = L (X  C)

(p / 2) * log n ;
where L (X  C) is the log

likelihood of the dataset X
according to model C, p is the number of parameters in th
e
model C, and n is the number of points in the dataset.
Figure 1: Visualization of Clustering Results
The above figure shows visualization of suicide bombing
attacks in the past 5 years defined by 15 features using 3
clusters. We have used Principle
Component Analysis
[15
]
as a dimensionality reduction technique and displayed the
result using the best two components.
6.4.
Threat Likelihood Prediction using Density
Estimation (
TLP
)
This technique uses KNN based non

parametric density
estimation in order
to predict the likelihood of a bombing
incident given input features. It is a well

known fact that
density estimation methods suffer from
the curse of
dimensionality [14
]. In order to avoid this problem we elect
certain features from the entire input feature space that play
more significant role in predicting the outcome. This feature
selection method is described in the following section.
6.5.
Feature Selection:
The object
ive of this method is to select a target feature
set p from a much larger initial feature set m. The selection
of target features is based on a selection procedure that ranks
the features according to their relevance to the prediction
task in hand. The sel
ection procedure uses a selection
criterion that is based on cohesiveness of points or events
defined by a set of features. We search for the features that
maximize these
cohesion criteria as done in [7
]. The
selection criteria used in [
7
] is as follows.
Let
be the distance between two events
i
and
j
in the
feature subspace defined by the feature subset to be
evaluated. We transform the distance
into the similarity
as follows:
=
Where
and
d
is the average inter

event distance,
where distance refers to differences in value of an
independent variable.
[7
] defines the Gini index between
these two events as:
For a data set of
n
events, the averaged Gini index below
is a
suitable measure of cohesiveness:
The smaller the value of the
index is, the higher the
level of point

pattern cohesiveness or the better the set of
features that define the point pattern. In general,
I
g can be
used in a subset selection
algorithm (e.g., forward selection
backward elimination) to yield an optimal or suboptimal
subset of features.
6.6.
KNN Density Estimation:
Once, the desired features are selected, we apply the
KNN density estimation technique
[13
]. Since KNN is non
parametri
c, it can do estimation for arbitrary distributions.
Instead of using hypercube and kernel functions, here we do
the estimation as follows
–
For estimating the density at a
point x, place a hypercube centered at x and keep increasing
its size till k neighb
ors are captured. Now estimate the
density using the formula,
Where n is the total number of V is the volume of the
hypercube. Notice that the numerator is essentially a constant
and the density is influenced by the volume. The idea is
finding k points
very quickly near high

density regions. This
means the volume of hypercube is small and the resultant
density is high. Lets say the density around a point x is very
low. Then the volume of the hypercube needed to encompass
k nearest neighbors is large and
consequently, the ratio is
low. Thus, p(x) gives the likelihood of a bombing event.
7.
P
REDICTION
T
ECHNIQUES
In proposed solution, prediction of suicide attacks are
categorized into four categories such as, high risk areas
modeling, prediction of future ter
rorist attack, prediction of
terrorist organizations through injury patterns, and
visualization of high risk areas through Geo spatial
referencing. These categories are explained in this section.
7.1.
High Risk
Areas
Modeling
Several techniques exist for crim
e prediction including
Rossmo’s formula. It gives the point of origin of a serial
criminal. Rossmo’s formula divides the map of a crime
scene into grid with i rows and j columns. Then, the
probability that the criminal is located in the box at row
i
and co
lumn j is
(2)
where f = g = 1:2, k is a scaling constant (so that P is a
probability function), T is the total number of crimes,
Ø
puts
more weight on one metric than the other, and B is the
radius of the buffer zone (and is suggested to be one

half the
mean of the nearest neighbor distance
between crimes). [2
]
Rossmo's formula incorporates two important ideas:
1.
Criminals won't trave
l too far to commit their
crimes. This is known as distance decay.
2.
There is a buffer area around the criminal's
residence where the crimes are less likely to be
committed.
Rossmo’s formula does not fit in this model because
terrorist organization has
different key factors for any
terrorist activity.
Sensitive Areas are highlighted on a simple model.
Terrorist organizations can target defense bases and
settlements, foreign diplomats, political and religious rivals,
civilian clusters, psychologically se
nsitive points, and high
value equipment and facilities. On the contrary terrorist
organizations are deterred by high security and large
distances to the target. Keeping these facts on the view risk
can be measured by following equation:
(3)
Wh
ere x and y are coordinates. Using the above equation
suicide attacks in cities of Pakistan is plotted in Fig. 5.
Fig. 2.
Predicted Suicide Attacks in Cities of Pakistan
Actual Attacks in cities of Pakistan are determined by the
data collected in data preparati
on part. Fig. 6 illustrates the
actual attacks in cities of Pakistan.
Fig. 3.
Actual Suicide Attacks in Cities of Pakistan
Comparison of both the figures (Fig 5 and Fig 6) depicts
that actual attacks occurred were exactly in the similar cities
as predicted ensu
ring the reliability and validity of the data
and system developed.
7.2.
Prediction of
Future
Terrorist Attack
This prediction technique is about devising alert and
mitigation system that allows generating the list of specific
cities with high risk on
specific dates in future. This system
is based on past incidents that are collected in data
preparation phase. The selected algorithm is applied on
historic data to generate high risk cities list. This system is
developed in C# using data mining techniques
such as
gower algorithm. High risk areas for the date of 3
rd
May
2011 are shown in Fig. 7.
Fig. 4.
High Risk Areas on May 3
rd
, 2011
In Fig. 7, Cities with different risk level are shown. Red
color indicates high probability of attack in a city, yellow
indicate
s cities with medium risk probability, and green
indicates cities with no risk probability on a certain date.
7.3.
Prediction
of Terrorist Organizations through
Injury Patterns
On the basis of medical reports collected in data
preparation phase, different inju
ry patterns are identified
which indicates different terrorist organizations. These injury
patterns are identified by using data mining techniques. In
Fig. 8, injury patterns of terrorist organizations of BLA
(Balochistan Liberation Army) and LEJ (Lashkar
e Jhangvi)
are shown.
Fig. 5.
Injury patterns of BLA and LEJ
As shown in Fig. 8, injury patterns of BLA and LEJ are
different.
In BLA attacks, 38% of injuries are on abdominal
part of the body. In LEJ, human head suffers more injuries
which is approximately 16%
of total injuries.
7.4.
Visualization
of High Risk Areas through Geo
Referencing
Graphical presentation on Map helps to analyze the
situation visually. In Fig. 9, Fig. 10 and Fig. 11 attack
patterns are clearly seen.
Fig. 6.
Ris
k Values plotted on map
Fig. 7.
Risk
Values plotted on map
Fig. 8.
Risk Values plotted on map
Terrorist organizations follow a proper pattern to attempt
suicide attacks as shown in above figures. As indicated in red
color attack patterns starts from Upper

dir and reached
Islamabad by covering all
cities between them.
8.
E
VALUATION
Based on incidents occurred in Pakistan since 1995
following results are generated for a week of April 2011.
Cities with repeated patterns suffered terrorist attack in
April 2011. Mathematical models and algorithms are
used
to get closest results. For instance Dara

Adam

Khel is
repeated in below mentioned table and had a blast on 1
st
April 2011. In the table below it can be clearly seen that
Dara

Adam

Khel is shown in high risk area for the whole
week where as the actual
attack was occurred on 1
st
day of
the week only.
The next Fig shows number of attacks, cities of attack
and damage that was caused due to suicide attacks from Jan
2011 to Jul 2011.
Fig. 9.
Statistics and Damage of Suicide attacks from Jan 2011 to Jul 2011
TABLE II.
R
ESU
LT OF
W
EEK OF
A
PRIL
Date
(April,
2011)
Cities
1
Hangu
, Charsadda, Dara Adam Khel,
Kohat
2
Hangu,Peshawar,Noshehra
,Charsadda,
Mardan
,Dara Adam Khel,
Malakand
,Swabi,
Kohat,Lakki marwat
3
Peshawar, Noshehra,Mardan,
Dara Adam Khel,
Malakand,
Swabi,
Kohat,Lakki marwat
4
Hangu,Bannu,Peshawar,Noshehra,
Charsadda,
Mardan
,Dara Adam Khel,
Malakand
,Swabi,
Kohat
…
…
7
Hangu, Peshawar,
Dara Adam Khel,
Kohat
According to the statistics total 19 attacks occurred
from Jan 2011 to Jul 2011 out of which 15
attacks were
predicted while 4 were missed by the presented technique.
Total accuracy of the presented technique for forecasting
suicide bombing attacks is 78.94%.
9.
C
ONCLUSION AND
F
UTURE
W
ORK
Technology combined with human intelligence turns out
to be the
most powerful weapon of present times. In order to
make the best use of technology and to reap maximum
benefit out of it, all we have to do is “trust it” and “use it” in
right way.
In order to achieve more effectiveness with the system we
plan to predict
incidents happening in a 1 km square radius.
We are also in the process of gathering more variables
describing the locations such as its proximity to important
places, properties of locations/building hit by previous
bombings, political events that occurre
d as a prelude to the
attack etc.
References
[1]
Pape, R. A., “Dying to Win: The Strategic Logic of Suicide
Terrorism”, Random House, 2005
[2]
www.Pakistanbodycount.org
[3]
http
://www.pips.org.pk/
[4]
http://www.satp.org/
[5]
Jefferis, E. (1998). “A multi

method exploration of crime hot
spots”. Presentation at the Annual Meeting of the Academy of
Criminal Justice Sciences, Albuquerque, NM, March 10
–
14
,
1998
[6]
Block, C. (1995). “STAC hot

spot areas: A statistical tool for
law enforcement decisions”. In Block, C. R., Dabdoub, M., &
Fregly, S. (Eds.), Crime analysis through computer mapping.
Washington, DC: Police Executive Research Forum, p. 20036
[7]
Hua Liua
, Donald E. Brown (2003). “Criminal incident
prediction using a point

pattern

based density model”.
International Journal of Forecasting 19 (2003) 603
–
622
[8]
Amir, M. (1971). “Patterns in forcible rape”. Chicago:
University of Chicago Press
[9]
Baldwin, J., &
Bottoms, A. (1976). “
The urban criminal
:
A
study in Sheffield”
. London: Tavistock Publications
[10]
Brantingham, P., & Brantingham, P. (1984). “Patterns in
crime”. New York: Macmillan Publishing
[11]
LeBeau, J. L. (1987). “The journey to rape: Geographic
distance an
d the rapist’s methods of approaching the victim”.
Journal of Police Science and Administration, 15, 129
–
136
[12]
Levine, N. (1998). ‘‘Hot Spot’ analysis using CrimeStat
kernel density interpolation”. Presentation at the Annual
Meeting of the Academy of Crimina
l Justice Sciences,
Albuquerque, NM, March 10
–
14, 1998.
[13]
K. Fukunaga and L.D. Hostetler. “Optimization of k

nearest
neighbor density estimates”. IEEE Transactions on
Information Theory, 19:320
–
326, 1973.
[14]
Richard Ernest Bellman (2003). “
Dynamic Programming
”
.
Courier Dover Publications.
ISBN
978

0

486

42809

3
.
[15]
Abdi. H., & Williams, L.J.
(2010). "Principal component
analysis".
Wiley Interdisciplinary Reviews: Computational
Statistics,
2
: 433
–
459.
[16]
Kmeans: Lloyd., S. P. (1982).
"
Least squares quantization in
PCM"
.
IEEE Transactions on Information Theory
[17]
G. Schwarz, “Estimating the dimension of a model”
, The
Annals of Statistics, vol. 6, pp 461

464, 1978.
[18]
Tax, D. “One class classification”. PhD Thesis, Delft
University of Technology (2001)
[19]
K.S. Killourhy and R.A. Maxion, "Comparing Anomaly

Detection Algorithms for Keystroke Dynamics." Proc.
Int.
Conf. D
ependable Systems & Networks (DSN

09)
Comments 0
Log in to post a comment