The need for systematic research into behavioural factors of individual terrorists has been highlighted by much recent work on terrorism. Many existing methods follow a hypothesistesting approach in which statistical modelling and analysis of existing data is conducted to either con rm or refute a hypothesis. However, the initial construction of hypotheses is not trivial, nor is the decision upon which of the variables are to be considered relevant for the testings. It has been argued that the lack of a methodical approach to represent, analyse, interpret and infer from existing data presents a pressing challenge to the progress of lone-actor terrorism research in particular, and the terrorism eld more generally. This paper sets a new agenda for such research. We propose the use of a logic programming approach to address the shortcomings of existing methodologies in the study of lone-actor terrorism. Our method is based on transforming characteristic and behavioural codes into a logic program and applying inductive logic programming to learn hypotheses about potentially relevant factors associated with terrorist behaviour, as well as the in uence of speci c factors on such behaviour. This paper is an exploratory study of 111 lone-actor terrorists' target selections (civilian vs. high-value targets) and the agency of their ideological orientation in determining their target choices.
An emerging consensus within terrorism studies posits analysing what terrorists
do as opposed to merely studying who they are is more instructive
In this paper, we explore a logic programming approach to representing and
reasoning about lone-actor terrorists' characteristics and behaviours. We propose an
approach for automatically generating hypotheses about lone actor terrorists with
the aim of gaining better understanding of the links between individuals'
characteristics and behaviour with respect to the outcome of their event planning. In
particular, we investigate the use of inductive logic programming (ILP) to
conduct two types of analyses: (i) identifying factors that are associated with and can
di erentiate between terrorists' target selections (i.e., learning associations ), and
(ii) capturing the in uence of speci c factors in explaining such di erences (i.e.,
learning in uences ). The approach is applied to a dataset containing antecedent
behaviours and characteristics of 111 lone actors terrorists, originally described in
In this paper, terrorism is de ned as a violent action, or threat of violent action, aimed at intimidating and coercing a government or sections of the public, typically for political, religious or ideological ends. Terrorism can involve violence against a person, damage to property, endangering a person's life other than that of the terrorist, creating a serious risk to the health or safety of the public or a section of the public. A lone-actor is either a single terrorist or an isolated dyad (a pair of individuals), operating independently of a group. Antecedent behaviour is the behaviour of the o enders leading up to their planning or conducting a terrorist act. Demographic characteristics of lone-actor terrorists include gender, education and socio-economic indicators such as employment status.
For analysis purposes, antecedent behaviour and demographic characteristics are typically represented as codes (also called variables). Each code c has a domain, denoted dom(c), of possible values. When C is a set of codes, we write dom(C ) as a shorthand for the set of domains for each c 2 C . We are interested here in codes whose domains are non-empty, nite sets of discrete values. A code is binary if its domain contains two values only, and multi-valued if it contains more than two. Boolean codes are binary codes with domain ftrue,falseg. A code can be assigned one or more values from its domain. Given a set of codes C , the function singlevalue : C ! ftrue; falseg returns true if a code takes one value only and false otherwise. Boolean codes are single valued. Given a set ID containing a unique identi er for each lone-actor, we de ne a labelling function c : ID ! 2dom(c) for each code c 2 C . Where id 2 ID is a lone-actor's identi er, c(id ) is a set of values from dom(c), giving the actual values of id 's c code. We require that c(id ) 6= ; in all cases and 8c : C (singlevalue(c) ! 8id 2 ID j c(id )j = 1). For example, the terrorist with identi er pg011 targets both civilian and high-value groups: targetgroup(pg 011) = fcivilian; hvtg. We use C to denote the set of assignment functions for each code in C . We sometimes refer to code assignments as factors. The full set of codes used in this paper is available at www.doc.ic.ac.uk/ da04/iclp15/.
Inductive logic programming (ILP)
A model I of is a stable model if I is the least Herbrand model of I where I is the de nite program I = fA B1; : : : ; Bn j A B1; : : : ; Bn ; not C1; : : : ; not Cn is the ground instance of a clause in and I does not satisfy any of the Ci g.
A logic program mantics), denoted entails an expression (under the credulous stable model sej= , i is satis ed in at least one stable model of .
In ILP, mode declarations are used as a form of language bias to reduce the
hypotheses search space. They provide a mechanism for specifying which predicates
may appear in the heads and bodies of rules and for controlling the placement and
linking of constants and variables within those clauses. A mode declaration M
is either a head or body declaration, respectively modeh(s) and modeb(s) where
s is called a schema. A schema s is a ground literal containing placemarkers. A
placemarker is either `+type' (input), ` type' (output), `#type' (ground) where
type is a constant. Given the above, an ILP task is de ned as follows where j= is
interpreted under brave induction
A nonmonotonic ILP task is a tuple hB ; E +; E ; M i where E + and E are sets of ground literals, called positive examples and negative examples respectively, B is a normal logic program, called background theory and M is a set of mode declarations de ning a hypothesis space s(M ). An inductive solution (or hypothesis), H s(M ), for E + [ E w.r.t B is a set of clauses such that:
B [ H j= e+; 8e+ 2 E + and B [ H 6j= e ; 8e 2 E
under brave induction
We sometimes write B [ H j= E where E = E + [ E as a shorthand for the two conditions above.
In this paper, we focus on the use of a learning technique rst introduced in
We rst introduce an automated mechanism for mapping characteristic and
behavioural codes into a logic program. We then describe an ILP approach for
conducting two types of analyses. The rst aims at identifying combinations of factors
that are associated with speci c observations. We call this learning associations.
The second is to understand the in uence of speci c factors when explaining these
observations. We refer to this type as learning in uences. Our focus in this paper
will be on explaining terrorists' target group selection, civilian targets vs. high-value
targets, where the latter includes targets such as government, business, schools etc.
We demonstrate the approach using a dataset of 111 individuals (of which 91 have
known target selections) and 185 codes described in
Our representation uses a sort ID for capturing the domain of unique lone-actor terrorists. It includes a unique predicate for each code c and type predicate to represent the domain of c. The number of arguments for this predicate depends on the size of the code's domain. If it is Boolean, e.g., mentalill, then, as a simpli cation, a predicate with a single argument of sort ID is introduced e.g., mentalill(id). If it is a non-Boolean variable, then a two argument predicate is introduced in which the rst argument is of sort ID and the second is of sort Dom(c). For instance, the nature of the location at which the attack occurred is encoded using a predicate location nature ID dom(location nature) where dom(location nature) = fgovernment; business; private citizens; religious; military; otherg. The language also contains a type predicate for representing dom(c). The encoding is given below.
Let ID be a set of unique identi ers for lone-actors, C a set of codes named fc1; ; cn g, D (C ) the set of C domains named fdc1; ; dcn g respectively and C their assignment functions. The logic program IDLP [ CLP [ DLP(C) [ ALP encoding of ID, C, D (C ) and C is constructed such that:
IDLP contains a fact la iden(id ) for each id 2 ID; DLP(C) contains a fact dck (j ) for each j 2 dom(ck ); for each id 2 ID and c 2 C, CLP contains a fact ck (id) where ck is a Boolean code and c(id ) = ftrueg; for each id 2 ID and c 2 C, CLP contains a fact ck (id ; j ) where jdom(ck )j 2, ck is non-Boolean, j 2 c(id ) and j 62 ffalse; unknowng; for each c 2 C, if c is non-Boolean and singlevalue(c) = true, ALP contains the clause c(I; D1); c(I; D2); D1 6= D2
Our encoding deploys a closed world assumption where unknown code values are
treated as false, as assumed in
tg(hvt). tg(citizens)...g CLP = fimprisoned(pg018). ideology(pg018, rightwing). mentalill(pg018). location nature(pg018, government).
... dryruns(pg101). ideology(pg101, single issue). f2f(pg101)...g
ALP = f ideology(I; D1); ideology(I; D2); D1 6= D2 ; g
The expressiveness of the formalism allows us to capture relationships between codes. For example, a code value both may be introduced for capturing individuals who have targeted both civilian and high-value groups, in which case dom(targetgroup) is extended with the value both and ALP is amended with the following: ftargetgroup(I; both) targetgroup(I; hvt); targetgroup(I; civilian) ; targetgroup(I; both); not targetgroup(I; hvt) ; targetgroup(I; both); not targetgroup(I; civilian) g
In the context of characteristic and behavioural analyses, a code c1 is said to be associated with another code c2 if c1 forms part of at least one explanation of the observed behaviour represented by c2. In ILP terms, identifying codes associated with an observation amounts to nding an inductive solution in which the literals corresponding to these codes appear in the body of at least one rule in the solution. In the presented approach, we do not distinguish between codes that are causes and those that are correlates. Future work will clarify the distinction.
Let ID be a set of unique lone-actor identi ers, C a set of codes, and D (C ) a set of C domains. Let ct 2 C be a code representing the observed terrorist behaviour to be explained, and R = fcr jcr 2 C; cr 6= ct g be the rest of variables in the language. The ILP task is de ned with:
B = IDLP [ RLP [ DLP(R) [ DLP(fct g) [ ALP; E + includes a fact ct (id ) for each id 2 ID where ct is Boolean and ct (id ) = ftrueg, or a fact ct (id ; j ) where ct is non-Boolean and j 2 ct (id ); E includes a fact ct (id ) for each id 2 ID where ct is Boolean and ct (id ) = ffalseg, or a fact ct (id ; j ) where ct is non-Boolean, for every j 2 dom(ct ) such that j 62 ct (id ); M includes modeh(ct (+la iden)) (or modeh(ct (+la iden; #dct ))), and a pair of body declarations modeh(cr (+la iden)) (or modeh(cr (+la iden; #dcr ))) and modeb(not cr (+la iden)) (or modeb(not cr (+la iden; #dcr ))) for each cr 2 R. (hi ), is calculated as: (hi ) = jjEEh++jj
i
Note that in this type of the analysis, we do not impose any restrictions on the number of rules, within an inductive solution, in which a body literal appears to be said associated with the observation, nor on the number of observations explained by the rule in which it appear. However, to quantify the relevance of that association for a given dataset, our algorithm calculates a measure (relative signi cance value) for each hypothesis in an inductive solution as de ned below.
Let B be a background theory, E = E + [ E the set of examples, M the mode declaration and H = fh1; hn g s(M ) an inductive solution to E w.r.t B . Let tEhh+ait BE^+hibj=etehh+ei ,sfeotroefapchoseith+iiv2e eExh+ai m.Tphleesnetxhpelarienleadtivbeystihgneihycpanoctheesisofhhi i 2,dHensoutecdh
In addition to the above, we also calculate for each hypothesis a measure, we call the predictive value of a hypothesis, which is based on the number of target selections the hypothesis infers for individuals with unknown target selections.
Given an ILP task hB ; E +; E ; M i constructed using Def. 5, let H = fh1; hn g s(M ) be an inductive solution to E +[E ; w.r.t B . Let ct be the predicate appearing in E . Let jP j be the set of ct (id ) atoms where ct is Boolean, or ct (id,j ) atoms where ct is non-Boolean, with id 2 ID, j 2 dom(ct ) and ct (id) = funknowng, entailed by H [ B , such that H [ B j= p for every p 2 P . Let Phi P be the set of ct (id ), or ct (id,j ), atoms entailed by hi [ B where hi 2 H , such that B [ hi j= phi , for every phi 2 Phi . Then the predictive of hi , denoted (hi ), is calculated as: (hi ) = jPjPhijj
Our algorithm uses the Answer Set solver clingo
In our case, to learn characteristics and antecedent behaviour that are associated with speci c target selections, B includes the clauses representing code assignments and relationships for the dataset of 111 lone-actor terrorists. The positive examples include facts about the observed target selection for each individual, e.g., ftargetgroup(pg018,hvt ), targetgroup(pg101,civilian)g and the negatives includes facts about the groups that were not targeted, e.g., ftargetgroup(pg018,civilian), targetgroup(pg101,hvt )g. The total number of positive examples is 95, and the total number of negative examples is 87.
The mode declarations M includes modeh(targetgroup(+la iden, #tg )). It also comprises a total of 38 modeb declarations for codes such as crimcon, verbfam, dryruns and mentalill amongst others.
Having de ned the ILP task, we use the ILP system XHAIL
The solution shown above is not the minimal one. We have rede ned the algorithm to terminate once it has found an optimal solution within a speci ed time bound. From the table above, we see that h5 has a higher relative signi cance value than h1 since (h5) = 0 12 > (h4) = 0 04, but a lower predictive value with (h5) = 0 03 < (h4) = 0 13. From a criminological perspective, the solution demonstrates that civilian targeting is associated with individuals with a history of mental illness (h2) who engage in dry runs and have not been imprisoned, undergone training, amongst others. At the same time, we observe that mental illness alone cannot determine the target selection outcome as shown by (h55) where mental illness exhibited with other characteristics, including no university experience or religious conversion prior to the attack, explains high-value target selections. Targeting high-value groups is also associated with criminal convictions and living alone which again may speak towards capability (in terms of both criminal ingenuity and having the space to develop a bigger plot). When this criminal ingenuity is not present, it may necessitate other behaviour like virtual learning, face to face interactions with co-ideologies and the attempt to recruit others (as witnessed in h52).
The previous section is concerned with nding explanations using any subset of possible codes. In this section, we are interested in learning whether an observed behaviour can be explained with respect to particular characteristics and behaviour. We refer to this type of learning as learning in uences.
A characteristic or behaviour is said to in uence the code c2 if every outcome of the observed behaviour represented by c2 can be explained in terms of the presence or absence of c1. In an ILP setting, the problem of learning in uences is expressed in terms of nding inductive solutions in which every rule within that solution contains a body literal representing that characteristic or behaviour. For instance, in the case of exploring the in uence of ideological orientation on target group selection, all hypotheses in an inductive solution must include a body literal corresponding to the individuals' ideological orientation.
Our algorithm for learning in uences comprises four steps. First the dataset is split into subgroups, according to the value assigned to the code whose in uence is being studied. Thus for a code cf , we have jdom(cf )j 2 subgroups. Note that these subgroups are not required to be mutually exclusive. For ease of reference, we use the notation df to denote the subgroup containing data for individuals whose cf value is df where the reference is obvious form the context. The second step involves applying the mapping in Def. 4 to each of the created subgroups separately. Then, a learning task hBdf ; Ed+f; Edf ; M i is de ned for each subgroup df upon which the learning system XHAIL is executed. Once Hdf is generated for each subgroup, the resulting inductive solutions undergo a post-processing procedure to generate the nal set of hypotheses. This is done by applying a transformation function de ned below to each rules in the inductive solutions.
Let be a normal logic program and b a literal. A transformation is de ned such that 0 = ( ; b) and 0 is obtained from by adding a condition b to the body of every rule in .
Given the function , we have, in the case of a Boolean code cf , the nal solution H = Ht0rue [ Hf0alse where Ht0rue = (Htrue; cf (I)), and Hf0alse = (Hfalse; not cf (I)). In the case of a non-Boolean code cf , the nal solution H = fHd0fi g where Hd0fi = (Hdfi ; cf (I; dfi )). Note that the correctness of solutions with respect to the union of the example sets is only guaranteed when the code values are independent.
In the case of learning the in uence of ideological orientation on target selection, the dataset of 111 individuals is split into three subgroups based on whether the individual's ideological orientation is rightwing, single issue or religious. In our example, the subgroups contain data for 43, 30, 38 individuals respectively. In our dataset, these groups are mutually exclusive since singlevalue (ideology )=true. The XHAIL system is then run using three independent learning tasks, one on each of the subgroups. The nal solutions are shown in Table 2. The relative signi cance and predictive values are calculated with respect to each subgroup.
Religious Ideology
hi 1 targetgroup(I,civilian)
ideo(I,religious), not virtuallearn(I ), not mentalill(I ). 10 2 targetgroup(I,civilian) ideo(I,religious), univexp(I ), verbfam(I ), not mentalill(I ). ideo(I,rightwing),verbfam(I ), not mentalill(I ), not children(I ). 8 targetgroup(I,civilian) 9 targetgroup(I,civilian)
ideo(I,single issue), crimcon(I ), livealone(I ). 10 targetgroup(I,civilian) ideo(I,single issue), f2f (I ), not otherknowledge(I ). 11 11 targetgroup(I,civilian)
ideo(I,single issue),mentalill(I ), not children(I ). 18 targetgroup(I,civilian) ideo(I,rightwing),not training(I ), not otherknowledge(I ), not children(I ). 19 targetgroup(I,civilian) ideo(I,rightwing),not warning(I ), mentalill(I ), not recruit(I ). targetgroup(I,hvt)
ideo(I,rightwing), not livealone(I ), children(I ). targetgroup(I,hvt) targetgroup(I,hvt) ideo(I,rightwing), mentalill(I ), not virtualinteract(I ), otherknowledge(I ). ideo(I,rightwing), not livealone(I ), training(I ), not f2f (I ). targetgroup(I,hvt) ideo(I,rightwing), warning(I ), mentalill(I ).
Unique total Table 2: Hypothesis for target selection for three ideological orientation groups. 46 12
The rst part of Table 2 highlights a number of interesting facets related to a religious-inspired individual's choice. The presence (or lack thereof) of mental health problems helps shape target choice toward civilians or high-value targets respectively depending on whether the individual has university experience or not (see solution h2 and solution h5.) The lack of university experience (and perhaps the skills associated with overcoming complex tasks) can be mitigating for when targeting high-value targets by the presence of a criminal past and the nous that may develop through prior antecedent o ending; see solution h2. The second part in the table that refers to single-issue ideology indicates the need to disaggregate across ideological domains. Whereas the con uence of criminal histories and living alone appeared in Table 1 to suggest a close relationship with high-value targeting, the opposite is true for those individuals inspired by single issues (animal rights, environmentalists) and may be a direct re ection of di erent targeting norms within these movements (see solution h9). In the absence of criminal histories, gaining training from a wider group appears to be a relevant substitute (see solution h15). The last part of the table referring to rightwing ideologies confounds some expectations in the wider literature as it highlights the presence of mental health problems (solution h21) in terms of attacking high-value targets compared to civilian targets (the latter of which are presumably easier to plan).
In our approach, we focused on learning rules that capture associations between
behaviour and in uence of speci c behaviour when explaining terrorists' target
selection. The performance of the learning algorithm used depended on the size of M
amongst other factors such as the size of the examples. Experiments showed that it
decreased when a larger M was considered. The performance of the algorithm for
same M size was higher in the case of learning in uences than it was when
learning associations, as expected given the examples size was smaller. Furthermore, we
found that we were able to nd a more optimal solution for learning in uences
than we did for associations for the xed time-frame we gave (which was set to
360 minutes) for the same observation (56 rules in the case of learning
associations compared to 23 when learning in uences). The choice of codes to use in M
in the presented work was in uenced by variables that are commonly investigated
in existing literature. Furthermore, the optimization was driven by the total
number of literals appearing in an inductive solution in some cases resulting in more
hypotheses with small potential signi cance values as opposed to fewer hypotheses
with higher potential signi cance. The learning association approach is similar in
essence to task discovery in data-mining, e.g.,
To evaluate our approach, we compared our results against those produced
using standard methods deployed in terrorism studies, rather than performed cross
validation over our small sample set. In particular, we conducted a Smallest Space
Analysis (SSA), shown in Fig. 1, of the antecedent behaviour and their relationship
to one another for the full dataset of 111 individuals. Such analyses focus upon
variable co-occurrence. Prominent examples include
The results visually illustrate some of the key ndings produced in Table 1. The SSA output also helps demonstrate which of the \not" behaviour rarely co-occur with the present behaviour and which are speci c to that combination of factors. As per h1, other knowledge is situated very far from criminal convictions, history of violence, children indicated that this particular behaviour rarely co-occurs with these other factors. However, the SSA output demonstrates a relatively close relationship between other knowledge and face-to-face interactions. h1 however shows these rarely co-occur when these other factors are also absent. The SSA output also helps illustrate the degree to which the \not" behaviour co-occur. Returning to h1, children rarely co-occur with a history of violence. The types of hypotheses that the SSA struggles with are those that are purely made up of \not" occurrences because what underpins the SSA is the co-occurrence of two variables. To illustrate, h3 is very di cult to comprehend using the SSA.
The aim of this paper is to examine the applicability of ILP for the purpose of generating relevant hypothesis about terrorists' behaviour. The ndings reported in the previous sections collectively show how ILP not only provides the ability to derive new insights but it is also clearly bene cial in outlining the explanatory power of rules. Whilst the SSA approach outlines the many di use relationships between a sizeable number of variables, it is very di cult to focus on the most relevant ones. The clusters that tend to emerge through identi cation by research teams tend to be quite subjective - more art than science - and are therefore subject to potential bias. The SSAs also tend to drag commonly occurring variables into the centre of the model whilst non-common variables are pushed to the extremes. The ILP approach, we believe, has the power to delineate which relationships are highly relevant and more immediately usable.
Our ongoing and future work includes distinguishing between causal and noncausal factors when generating solutions, prioritizing hypotheses with causal explanations and higher relative signi cance values, and applications to other criminological problems such as serial crimes. We plan to conduct further investigation into prioritizing and optimizing the selection of the body literals when constructing hypotheses, one possibility is by using the results from SSA or information gain theory . We also intended to investigate the use of probabilistic learning and methods capable of handling noise and uncertainty in this setting.