Dynamic classification of groups through social network analysis and HMMs

Social network analysis (SNA) represents interpersonal communications as directed graphs. SNA metrics quantify different aspects of a group´s communication patterns. The goal of our work is to identify terrorist communications based on their atypical SNA metric values. The social structure of terrorist groups and other illicit organizations are distinguishable from normal groups by the fact that their metric values evolve differently over time. We employ hidden Markov models (HMMs) to identify groups with suspicious evolutions. The entire history of the social structure is used, instead of just viewing the structure at a single point in time. We motivate and present results from a case study using a simulation of suspicious groups communicating in a normal background population. We achieved 96% classification accuracy on novel synthetic data using two 35-state univariate HMMs trained to model normal and suspicious evolutions of the characteristic path length metric.