mining for causal relationships: a data-driven study of ... · mining for causal relationships: a...

Mining for Causal Relationships A Data-Driven Study ofthe Islamic State

Andrew Stanton Amanda Thart Ashish Jain Priyank Vyas Arpan Chatterjee Paulo ShakarianlowastArizona State University

Tempe AZ 85287dstanto2 althart ashishjain1 pvyas1 achatt14 shak asuedu

ABSTRACTThe Islamic State of Iraq and al-Sham (ISIS) is a dominantinsurgent group operating in Iraq and Syria that rose toprominence when it took over Mosul in June 2014 In thispaper we present a data-driven approach to analyzing thisgroup using a dataset consisting of 2200 incidents of mili-tary activity surrounding ISIS and the forces that opposeit (including Iraqi Syrian and the American-led coalition)We combine ideas from logic programming and causal rea-soning to mine for association rules for which we presentevidence of causality We present relationships that linkISIS vehicle-bourne improvised explosive device (VBIED)activity in Syria with military operations in Iraq coalitionair strikes and ISIS IED activity as well as rules that mayserve as indicators of spikes in indirect fire suicide attacksand arrests

1 INTRODUCTIONSince its rise to prominence in Iraq and Syria in June

2014 The Islamic State of Iraq and al-Sham (ISIS) ndash alsoknown as The Islamic State of Iraq and the Levant (ISIL)or simply the Islamic State has controlled numerous citiesin Sunni-dominated parts of Iraq and Syria ISIS has dis-played a high level of sophistication and discipline in its mil-itary operations in comparison to similar insurgent groupswhich perhaps may be the source of its success We havemeticulously encoded and recorded 2200 incidents of mili-tary activity conducted by ISIS and forces that oppose it(including Iraqi Syrian and the American-led coalition) ina relational database Our goal was to achieve a better un-derstanding of how this group operates - which can lead tonew strategies for mitigating ISISrsquos operations Specificallywe sought to analyze the behavior of ISIS using conceptsfrom logic programming (in particular APT logic [14 15])and causal reasoning [10 18] By combining ideas from thesefields we have been able to conduct a thorough search for

lowastPaulo Shakarian is also affiliated with ASU Center on theFuture of War

rules whose precondition consists of multiple atomic propo-sitions and we provide evidence of causality by comparingrules with the same consequence So in addition to consid-ering the probability of a rule (p) we also study a measureof its causality denoted εavg (previously introduced in [10]) ndashwhich informally can be thought of as the average increasein probability a rulersquos precondition provides when consideredwith each of the comparable rules Using this approach wehave found interesting relationships - consider the following

bull Weeks where ISIS conducts infantry operations in Iraqthat are accompanied by indirect fire are indicative ofvehicle-bourne improvised explosive device (VBIED)operations in Syria in the following week (p = 10εavg = 092)

bull Weeks in which ISIS conducts operations in Tikritand conducts a significant number of executions arefollowed by a large spike in improvised explosive de-vice (IED) usage in Iraq and Syria combined (p =10 εavg = 097)

bull Air strikes by the Syrian government are followed bymass arrests by ISIS in the following week (εavg =091 p = 067) and such massive arrests were alwaysproceeded by Syrian air strikes in our dataset

bull In the week after coalition air strikes are conductedagainst Mosul while ISIS is conducting operations inAl-Anbar province ISIS greatly increases its IED ac-tivity in Iraq (p = 067 εavg = 097) However ifthere are also significant ISIS operations occurring inSyria the increase in IED usage experienced there is(p = 067 εavg = 079)

Our findings have also led us to several interesting theoriesabout ISIS behavior that we have developed as a result ofthis data mining effort These include the following

bull ISIS may employ suicide VBIED operations in Bagh-dad prior to significant infantry operations in other lo-cations to prevent the deployment of Iraqi armypolicereinforcements

bull ISIS tends to leverage indirect fire (IDF) as a precursorto infantry operations - more in keeping with a tradi-tional military force as opposed to a primary use ofIDF for harassment purposes (as was typically seen byinsurgent groups during Operation Iraqi Freedom)

bull As we found relationships between coalition air oper-ations and an increase in ISIS usage of IEDs - and

arX

iv1

508

0119

2v1

[cs

CY

] 5

Aug

201

5

not other larger weapons systems (ie VBIEDs) thismay indicate that ISIS resorts to more distributedinsurgent-style tactics in the aftermath of such opera-tions

To our knowledge this study represents both the first publicly-available data-driven study of ISIS as well as the first com-bination of APT logic with the causality ideas of [10] Therest of the paper is organized as follows In Section 2 we de-scribe our approach and recall key concepts from APT logicand causal reasoning This is followed by a description ofour corpus of military events surrounding the actions of ISISfrom June-December 2014 in Section 3 In Section 4 we de-scribe our implementation and discuss our results Finallyrelated work is reviewed in Section 5

2 TECHNICAL APPROACH

21 APT LogicWe now present a subset of our previously-introduced

APT logic [14 15] Our focus here is on the syntax of thelanguage utilized with an alternate semantics that is basedon the rule-learning approach described in [14] This is dueto the fact that we are only concerned with learning therules in this paper and determining their level of causalityndash we leave problems relating to deduction (ie the entail-ment problem studied in [15]) to future work APT logicconsiders a two-part semantic structure threads (sequencesof events) and interpretations (probability distributions oversuch sequences) Initially we focus on a semantics restrictedto threads

We assume the existence of a set of ground atoms A whichin this case correspond with events over time and use thesymbol n to denote the size of this set We shall partitionthe ground atoms into two subsets action atoms Aact andenvironmental atoms Aenv Action atoms describe actionsof certain actors and environmental atoms describe aspectsof the environment We will use nact nenv to denote thequantity of ground atoms in AactAenv respectively Wecan connect atoms using notandor to create formulas in thenormal way A world is a subset of atoms that are consideredto be true A thread is a series of worlds each correspondingto a discrete time-point which are represented by simplenatural numbers in the range 1 tmax We shall use Th[t]to refer to the world specified by Th at time t A thread(Th) at time t satisfies a formula f (denoted Th[t] |= f) bythe following recursive definition

bull For some a isin A Th[t] |= a iff a isin Th[t]

bull For f = notf prime Th[t] |= f iff Th[t] |= f prime is false

bull For f = f primeandf primeprime Th[t] |= f iff Th[t] |= f prime and Th[t] |= f primeprime

bull For f = f prime or f primeprime Th[t] |= f iff Th[t] |= f prime or Th[t] |= f primeprime

We also note that based on how often a given formula oc-curs within a thread we can obtain a prior probability forthat formula For instance consider formula g We can com-pute its prior probability (wrt thread Th) as the fractionof time points where g is satisfied

ρ =|t|Th[t] |= g|

tmax(1)

Note that we use the notation | middot | for the cardinality of a setOur goal in this section is for some event g to identify previ-ously occurring event c such that the conditional probabilityof g occurring given c is greater than pg In this paper weshall only look at finding APT rules where c occurs in thetime period right before g The case where multiple time pe-riods elapse between c and g is left to future work Hence weintroduce an APT rule of the following form cp g whichintuitively means that ldquoc is followed by g in one time-stepwith probability prdquo We shall refer to c as the preconditionand g as the consequence We say thread Th |= cp g iff

p =|t st Th[t] |= c and Th[t+ 1] |= g|

|t st Th[t] |= c| (2)

This alternate definition of semantics is not new it is a vari-ant of rule satisfaction with the existential frequency func-tion of [14] and also of ldquotrace semanticsrdquo used for a PCTLvariant in [9] In this paper we are focused on learning ruleswhere c is a conjunction of positive atoms and g is a singlepositive atom The number of atoms in the conjunction c isreferred to as the ldquodimensionrdquo of the rule c p g We willalso be concerned with two other measures of a given rulethe ldquonegative probabilityrdquo (used to describe the probabilisticrules of [17]) and the notion of support (a standard conceptin association rule learning) First we defineldquonegative prob-abilityrdquo ndash denoted plowast ndash for a given rule of the aforementionedformat

plowast =|t st Th[t] |= g and Th[tminus 1] 6|= c|

|t st Th[t] |= g| (3)

Simply put plowast is the number of times that the consequenceof a rule occurs without the head occurring prior We canthink of p as a measure of precision of a given rule while plowast

is more akin to a measure of recall Next we formally definethe notion of support (s) as follows

s = |t st Th[t] |= c| (4)

For a given rule r we shall use the notation pr plowastr sr re-

spectively We will also use the notation ρr to denote theprior probability of the consequence When it is obviousfrom context which rule we are referring to (as in the exper-imental results section) we will drop the subscript

22 Determining CausalityNext we describe how for a given action g we identify

potential causes based on a set of rules for which g is theconsequence In considering possible causes we must firstidentify a set of prima facie causes for g [10 18] We presentthe definition in terms of APT logic below

Definition 21 (Prima Facie Cause [10 18]) GivenAPT logic formulas c g and thread Th we say c is a primafacie cause for g wrt Th if

1 There exists time t such that Th[t] |= g (g occurs witha probability greater than zero)

2 There exists t tprime where t lt tprime such that Th[t] |= c andTh[tprime] |= g (c occurs before g)

3 For r equiv c p g where Th |= r we have p gt ρr (theprobability of the consequence occurring after the pre-condition is greater than the prior probability of theconsequence)

As we will assume the existence of a single thread Th(which is our historical corpus of data) we will often use thelanguage ldquoprima facie causal rulerdquo or ldquoPF-rulerdquo to describea rule cp g where c is a prima facie cause for g wrt Th

Next we adopt the method of [10] to determine if an APTrule is causal First in determining if a given PF-rule iscausal we must consider other related PF-rules Intuitivelya given rule r equiv c p g explains why some instances of goccur within a thread Another rule rprime equiv cprime pprime g is relatedif it also explains why some of those same instances occurFormally we say r and rprime are related if there exists t suchthat Th[t] |= c and cprime and Th[t+ 1] |= g Hence we will definerelated PF-rules (for a given rule r equiv cp g) as follows

R(r) = rprime st rprime 6equiv r and r rprime are related

Next we will look at how to compare two related rulesThe key purpose from [10] behind doing so is to study howthe probability of the rule changes in cases where both pre-conditions co-occur in comparison to the probability whereexactly one of the preconditions occurs So given rules r rprime

as defined above we have the following notation prrprime andpnotrrprime which are defined as the point probabilities that willcause the following two rules to be satisfied by Th

c and cprime prrprime g

notc and cprime pnotrrprime g

So prrprime is the probability that g occurs given both precon-ditions and pnotrrprime is the probability that g occurs given justthe precondition of the second rule and not of the first Theidea is that if prrprime minus pnotrrprime gt 0 then there is somethingabout the precondition of r that causes g to occur that isnot present in rprime Following directly from [10] we measurethe average of this quantity to determine how causal a givenrule is as follows

εavg =

sumrprimeisinR(r) prrprime minus pnotrrprime

|R(r)|

Intuitively εavg(r) measures the degree of causality exhib-ited by rule r Additionally using this same intuition wefind it useful to include a few other related measures whenexamining causality First we define εmin defined below

εmin = minrprimeisinR(r)

(prrprime minus pnotrrprime)

This tells us the ldquoleast causalrdquo comparison of r with all re-lated rules Another measure we will use is εfrac defined asfollows

εfrac(r) =|rprime st (prrprime minus pnotrrprime) ge 0|

|R(r)|

This provides a fraction of the related rules whose proba-bility remains the same or decreases if the precondition ofr is not present Hence a number closer to 1 likely indi-cates that r is more causal By using multiple causalitymeasurements we can have a better determination of moresignificant causality relationships

23 AlgorithmsNext given a thread we provide a variant of the APT-

Extract algorithm [14] that we call PF-Rule-Extract Es-sentially this algorithm generates all possible Aenv up to acertain size (specified by the argument MaxDim) and then

searches for correlation It returns rules whose precondi-tion occurs a specified number of times (a lower bound onsupport for a rule) - specified with the argument SuppLBWe make several modifications specific to our application tosupport reasoning

bull We reduce the run-time of the algorithm considerablyover APT-Extract As APT-Extract explores all possi-ble combinations of atoms up to size MaxDim it runsin time O(

(nenv

MaxDim

)) However PF-Rule-Extract only

examines combinations of atoms that occur in a giventime period ndash hence reducing run-time toO(

(maxt(nt)MaxDim

))

where nt is the number of atoms in Aenv true at timet We find in practice that maxt(nt) ltlt nenv

bull We further reduce the run-time by not considering el-ements of Aenv that occur less than the lower boundon support - as they would never appear in a rule

bull We guarantee that all rules returned by PF-Rule-Extractare PF-rules

Algorithm 1 PF-Rule-Extract

Require Thread Th sets of atoms AactAenv posi-tive natural numbers MaxDim SuppLB real numberminProb

Ensure Set of rules R

1 Set R = empty2 for g isin a isin Aact st existt where Th[t] |= a do3 preCond(g) = empty4 for t isin 1 tmax st Th[t+ 1] |= g do5 Let X be the set of all combinations of size

MaxDim (or less) of elements in Th[t]capAenv thatoccur at least SuppLB times

6 preCond(g) = preCond(g) cupX7 end for8 for c isin preCond(g) do9 Compute ρ p s as per Equations 12 and 4

10 if (s ge SuppLB)and (p gt ρ)and (p ge minProb) then11 R = R cup r12 end if13 end for14 end for15 return Set R

Note that APT-Extract allows for multiple time periodsbetween preconditions and consequences ndash PF-Rule-Extractcan also be easily modified to find rules of this sort through asimple modification of line 4 Next we provide some formalresults to show that PF-Rule-Extract finds rules that meetthe requirements of Definition 21 and show that it exploresall possible combinations up to size MaxDim that are sup-ported by the data that meet the requirement for minimumsupport even with our efficiency improvements

Proposition 21 Given thread Th as input PF-Rule-Extract produces a set of rules R such that each r isin R is aprima facie causal rule

Proof The first requirement for a prima facie cause ismet by line 2 of PF-Rule-Extract as the algorithm only con-siders consequences that have occurred at least once in Th ndashhence they have a prior probability greater than zero The

second requirement is met by line 4 as we only consideratoms that occurred immediately before the consequencewhen constructing the precondition Finally the third con-dition is met by the if statement at line 10 which will onlyselect rules whose probability is greater than the prior prob-ability of the consequence

Proposition 22 PF-Rule-Extract finds all PF-rules whoseprecondition is a conjunction of size MaxDim or a size con-taining fewer atoms and where both the precondition occursat least SuppLB times in Th and the probability is greaterthan minProb

Proof By Proposition 21 every consequence that couldbe used in a PF-rule is considered so we need only to con-sider the precondition Suppose that there is a PF-rulewhose precondition occurs at least SuppLB times that has asize of MaxDim or smaller Hence the precondition is com-prised of m leMaxDim atoms a1 am Clearly as thisprecondition occurs at least SuppLB times in Th each ofa1 am must also occur SuppLB times by line 5 - so thatthe precondition must be considered at that point The onlycondition that would prevent the rule from being returnedis line 10 but again clearly these are met by the statementof the proposition Hence we have a contradiction

Once we have identified the PF-rules using PF-Rule-Extractwe must then compare related rules with each other The al-gorithm PF-Rule-Compare returns the top k rules for eachconsequence Again here we take advantage of our spe-cific application to reduce the run-time of this comparisonIn particular for a given rule we need not compare it toall the rules returned by PF-Rule-Extract we only need tocompare it to those that share the consequence By sortingthe rules by consequence - a linear time operation (line 3)we are able to reduce the cost of the quadratic operationfor the rule comparisons (a brute-force method would takeO(|R|2) while this method requires O((maxg |Rg|)2 + |R|) ndashand we have observed that maxg |Rg| ltlt |R|)

Algorithm 2 PF-Rule-Compare

Require Set of rules R natural number kEnsure Set of rules Rprime

1 Set Rprime = empty2 for g isin Aact do3 Set Rg = cp g isin R4 for r isin Rg do5 Calculate εavg for rule r (Equation 5 by comparing

it to all related rules in Rg r)6 end for7 From the set Rg add the top k rules by εavg to the

set Rprime

8 end for9 return Set Rprime

3 ISIS DATASETWe collected data on 2200 military events that occurred

from June 8th through December 31st 2014 that involvedISIS and forces opposing ISIS Events were classified into oneof 159 event types - and these events were used as predicatesfor APT logic atoms We list a sampling of the predicateswe used in Table 1 Many predicates are unary because

they correspond with ISIS actions (ie armedAtk) whilethose dealing with operations by other actors (ie airOp)and predicates denoting spikes in activity (ie VBIEDSpike)accept more than one argument Nearly every predicate hasone argument that corresponds to the location in which theassociated event took place See Figure 1 for a sampling oflocations in the ISIS dataset

We obtained our data primarily from reports published bythe Institute for the Study of War (ISW) [5] and we aug-mented it with other reputable sources including MapAction[4 6] Google Maps [3] and Humanitarian Response [2] Wedevised a code-book as well as coding standards for eventsand one of our team members functioned as a quality-controlto reduce errors in human coding

Figure 1 Map illustrating cities associated with events inthe ISIS dataset

4 RESULTS AND DISCUSSION

41 Experimental SetupWe implemented our PF-Rule-Extract and PF-Rule-Compare

in Python 28x and ran it on a commodity machine equippedwith an Intel Core i5 CPU (27 GHz) with 16 GB of RAMrunning Windows 7 The time periods we utilized wereweeks - hence we had 30 time periods in our thread We had980 distinct environmental atoms (Aenv) Our action atoms(Aact) corresponded to weeks where the number of incidentsfor certain activity rose to or past one or two moving stan-dard deviations (denoted 1timesσ 2timesσ respectively computedbased on the previous 4 weeks) above the four-week movingaverage (computed based on the previous 4 weeks) We re-fer to these atoms as ldquospikesrdquo and show some sample atomsdenoting such spikes in Table 1 The spikes are designatedfor three locations Iraq Syria or both theaters combinedWe also included these spikes in the set of environmentalatoms as well (Aact sub Aenv)

We set the parameters of PF-Rule-Extract as followsMaxDim = 3 SuppLB = 3 minProb = 05 For PF-Rule-Compare we did not set a particular k value Instead weused εavg to rank the rules by causality for a given conse-quence In this paper we report the top causal rules (interms of εavg) for some of the consequences We also notethat the number of related rules provides insight into thatrulersquos significance - we discuss this quantity in our analy-sis We examine some of the top rules in terms of εavg and

Table 1 A sampling of predicate symbols used to describeevents in the ISIS Dataset

Predicate Intuition

airOp(XY ) Actor X (typically ldquoCoalitionrdquoldquoSyrian Governmentrdquo or ldquoUSrdquo)conducts an air campaign againstISIS in the vicinity of city Y

armedAtk(X) ISIS conducts an armed attack(aka infantry operation) in cityX

IED(X) ISIS conducts an attack using animprovised explosive device (IED)in city X

indirectFire(X) ISIS conducts an indirect fire oper-ation (ie mortars) near city X

VBIED(X) ISIS conducts an attack using avehicle-bourne improvised explo-sive device (VBIED or car-bomb) incity X

armedAtkSpike(XY ) There is a spike in ISIS armedattacks in country X that is Yamount over the 4-month movingaverage (Y is expressed in terms ofmoving standard deviations)

VBIEDSpike(XY ) There is a spike in ISIS VBIEDs incountry X that is Y amount overthe 4-month moving average (Y isexpressed in terms of moving stan-dard deviations)

describe the military insights that they provide Our teamincludes a former military officer with over a decade of expe-rience in military operations that includes two combat toursin Operation Iraqi Freedom In addition to εavg we also ex-amined the rulersquos probability (p) - the fraction of times theconsequence follows the precondition the negative proba-bility (plowast) - the fraction of times the consequence is notproceeded by the precondition the prior probability of theconsequence (ρ) and the additional causal measures intro-duced in this paper - εmin εfrac The relationship specifiedin the rule can be considered more significant if p gtgt ρ plowast

is closer to 0 εmin ge 0 and εavg εfrac are close to 1 Thesemeasures are discussed in more detail in Section 2

42 Algorithm EfficiencyIn Section 2 we described some performance improve-

ments that we utilized in PF-Rule-Extract (which is basedon APT-Extract [14]) that are specific to this applicationThe first performance improvement was the reduction in thenumber of atoms used to generate the preconditions (whichwere conjunctions of atoms of up to size 3 in our experi-ments) First we limited the number of atoms to be usedin such combinations based on the weeks in which they oc-curred Even though we had 980 environmental atoms nomore than 93 occurred during any given week (this is thevalue maxt(nt) from Section 2) Further by eliminatingatoms that occurred less than the SuppLB from consider-

ation this lowered it further to 49 atoms per week at themost This directly leads to fewer combinations of atomsgenerated for the precondition A comparison is shown inTable 2 Note that the values for APT-Extract are exactwhile the remaining are upper bounds Again this sub-stantial multiple-order-of-magnitude savings in the numberof rules explored is a result of the relative sparseness of ourdataset and the fact that our preconditions consisted of con-junctions of positive atoms This efficiency is primarily whatenabled us to find and compare rules in a matter of minuteson a commodity system

Table 2 Improvement in Algorithm EfficiencyTechnique Atoms Combinations

ExploredAPT-Extract [14] 980 182 122 025maxt(nt) 93 8 853 042maxt(nt) and consider 49 1 296 834only atoms that occur morethan SuppLB times

43 ISIS Military TacticsIn this section we investigate rules that provide insight

into ISISrsquos military tactics ndash in particular we found inter-esting and potentially casual relationships that provide in-sight into their infantry operations use of terror tactics (ieVBIEDs) and decisions to employ roadside bombs and tolaunch suicide operations

Table 3 Causal Rules for Spikes in Armed Attacks (Iraqand Syria Combined)

No Precondition εavg p plowast

1 indirectFire(Baiji)and 081 067 050

armedAtk(Balad)


armedAtk(Balad)and

VBIED(Baghdad)

Armed Attacks The prior probability of large spikes(2 times σ) (see figure 2) for ISIS armed attacks for Iraq andSyria was 0154 However for our two most causal rulesfor this spike (Table 3) we derived this probability as 067Such spikes likely indicate major infantry operations by theIslamic State Rule 1 states that indirect fire at Baiji (at-tributed to ISIS) along with an armed attack in Balad leadsto a spike in armed attacks by the group in the next weekwhile rule 2 mirrors rule 1 but adds VBIED activity in Bagh-dad as part of the precondition We note the relatively highplowast (05 in this case) which indicates that each spike in armedattacks of this type are not necessarily proceeded by this pre-condition despite the relatively high value for εavg hintingat causality (each of these rules was compared with 265 re-lated rules and had εfrac = 1 and εmin = 0 ndash showing littleindication of a related rule being more causal) We believethat the strong causality and the high value for plowast indicatethat these rules may well be ldquotoken causesrdquo ndash causes for aspecific event - in this case we think it is likely ISIS offensive

operations in Baiji This makes sense as a common militarytactic is to prepare the battlefield with indirect fire (which itseems ISIS did in the prior week) It is unclear if the VBIEDincidents in Baghdad are related due to the co-occurrenceThat said it is notable that VBIED operations are oftenused as ldquoterrorrdquo tactics as opposed to part of a sustainedoperation If so this may have been part of a preparatoryphase (that included indirect fire in Baiji) and the purposeof the VBIED events in Baghdad was to prevent additionalIraqi Security Force deployment from Baghdad to Baiji Wenote in one case supporting this rule (on July 25th 2014)that ISIS also conducted IED attacks on power-lines thatsupport Baghdad - which may have also been designed tohinder deployment of reinforcements Here it is also im-portant to note the ongoing Infantry operations in Balad(specified in the precondition) - which would consume ISISresources and perhaps make it more difficult to respond tofurther deployment of government security forces Thoughthis is likely a token cause this may be indicative of ISIStactics when preparing to concentrate force on certain ob-jectives (in this case Baiji) while maintaining ongoing op-erations (Balad) as a spike in armed attacks likely indi-cates a surge of light infantry-style soldiers into the area (amanpower-intensive operation)

Figure 2 ISIS Spikes in Armed Attacks in Iraq andSyria per Week

0

5

10

15

20

25

30

35

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Armed AttacksMoving Average + 2σ

Nu

mber

of

Even

ts

Week

Spikes in VBIED Incidents VBIED incidents have beena common terror tactic used by religious Sunni extremistinsurgent groups in Iraq in the past ndash including Al Qaedain Iraq Ansar al Sunnah Ansar al Islam and now ISISWe found two relationships that are potentially causal forspikes in VBIED activity in Iraq and Syria combined shownin Table 4

Table 4 Causal Rules for Spikes in VBIED Incidents inIraq and Syria Combined


3 armedAtk(Balad)and 095 100 025

indirectFire(Baiji)

Rule 3 states that if infantry operations in Balad accom-panied by indirect fire operations in Baiji occur we shouldexpect a major (2 times σ) spike in VBIED activity (see fig-ure 3) by ISIS (Iraq and Syria combined) We believe thisrule provides further evidence of the use of VBIEDs to pull

security forces away from other parts of the operational the-ater It is interesting to note that the negative probabilityis only 025 - which means that most of the VBIED spikeswe observed were related to operations in Balad and BaijiThis highlights the strategic importance of these two citiesto ISIS Baiji is home to a major oil refinery while Balad isnear a major Iraqi air base We also found solid evidence ofcausality for this rule - based on 209 related rules we foundεmin = 05 which means adding a second precondition tothis rule increases the probability of the second rule by atleast 05

Figure 3 Spikes in ISIS VBIED Activity in Iraq andSyria per Week

0

2

4

6

8

10

12

14

16

18

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs

Moving Average + 2σ

Nu

mb

er o

f E

ven

tsWeek

Spikes in IED Incidents Improvised explosive device(IED) incidents have been a common tactic used by Iraqi in-surgents throughout the US-led Operation Iraqi FreedomThough the IED comprises a smaller weapons system nor-mally employed by local insurgent cells spikes in such ac-tivity could be meaningful For instance it may indicateaction ordered by a strategic-level command that is beingcarried out on the city level or it may indicate improvedlogistic support to provide local cells the necessary muni-tions to carry out such operations in larger numbers Suchspikes only occur with a prior probability of 019 In Table 5we show a rather strong precondition for such attacks thatconsist of infantry operations in Tikrit and a spike in exe-cutions In this Table rule 4 states that infantry operationsin Tikrit when accompanied by a spike in executions leadto a spike (1times σ) (see figure 4) in Iraq and Syria combined- with a probability of 10 - much higher than the prior ofthe consequence With εavg of 097 (based on a compari-son with 1180 other rules) this relationship appears highlycausal (εfrac = 10 εmin = 00) although 40 of 1times σ IEDspikes were not accounted for by this precondition

Table 5 Causal Rules for Spikes in IED Incidents in Iraqand Syria Combined


4 armedAtk(T ikrit)and 097 100 040

executionSpike(Total 2σ)

44 Relationships between Iraqi and Syrian The-aters

ISIS has clearly leveraged itself as a force operating inboth Iraq and Syria and the identification of relationships

Figure 4 Spikes in ISIS IEDs in Iraq and Syria perWeek

0

1

2

3

4

5

6

7

8

9

10

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs Moving Average + σ

Week

Nu

mb

er o

f E

ven

ts

between incidents in relation to the two theaters may in-dicate some sophisticated operational coordination on theirpart We have found some evidence of these cross-theaterrelationships with regard to suicide operations in Iraq (po-tentially affected by other events in Syria) and VBIED op-erations in Syria (potentially affected by other operations inIraq)

VBIED Spikes in Syria Table 6 shows our most causalrules whose consequence is a 1timesσ spike (over the four-monthmoving average) (see figures 5 6) in ISIS VBIED events inSyria Rule 5 provides a precondition of a spike in armedattacks in Iraq that includes a major spike in indirect fireactivity while rule 6 has the same precondition but includesan additional VBIED event in Baghdad We believe thatthe spike in armed attacks indicates major ISIS operationsin Iraq and the inclusion of indirect fire events also indicatesthat ISIS soldiers specializing in weapon systems such asmortars may also be concentrated in Iraqi operations Takentogether this may indicate a shift in ISIS resources towardIraq - which may mean that operations have shifted awayfrom Syria Hence VBIED attacks which once preparedare less manpower-intensive nevertheless provide a show-of-force in the secondary theater We also note that theprobability of these rules (100) is significantly higher thanthe prior of these spikes (019) and that the causality value isalso high for each of the 983 related rules as the probabilityeither remains the same or increases when considering oneof these preconditions (in other words εfrac = 1 and εmin =0)

Figure 5 Spikes in ISIS VBIEDs in Syria per Week

0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs

Moving Average + σ

Nu

mber

of

Even

ts

Week

Figure 6 Comparison of ISIS Armed Attacks andVBIEDs in Syria per Week

0

1

2

3

4

5

6

7

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Armed Attacks VBIEDs

Nu

mb

er o

f E

ven

ts

Week

Table 6 Causal Rules for Spikes in VBIED Operations inSyria


5 armedAtkSpike(Iraq σ)and 092 100 020

indirFireSpike(Iraq 2σ)


indirFireSpike(Iraq 2σ)and

VBIED(Baghdad)

Operations Shifting to Syria In rules 5 and 6 of Ta-ble 6 we saw how increased operations in Iraq led to theuse of VBIEDs in Syria ndash perhaps due to a focus on moremanpower-heavy operations in Iraq Interestingly rule 7shown in Table 7 indicates that less manpower-intensiveoperations in Iraq that have a terror component seem tohave a causal relationship (based on εavg = 097 εfrac =10 εmin = 05 found by comparing to 95 related rules) withsignificant indirect fire operations in Syria (that occur with aprior probability of 008) As discussed earlier indirect fire isnormally used to ldquoprepare the battlefieldrdquo for infantry oper-ations so this rule may be indicative of a shift in manpowertoward Syria - and the use of a VBIED tactic in Baghdad(less manpower-intensive but very sensational) seems to al-ways proceed a major (2timesσ over the moving average) spikein indirect fire activity in Syria in our data (hence a negativeprobability of 00)

Table 7 Causal Rules for Spikes in Indirect Fire Opera-tions in Syria


7 IED(Baghdad)and 097 067 000

VBIED(Ramadi)

45 ISIS Activities Related to Opposition AirStrikes

Reaction to Syrian Government Air Strikes Rule 8shown in Table 8 tells us that a 2 times σ spike in arrests (seefigure 7) was always (plowast = 00) proceeded by an air strikeconducted by the Syrian government The prior probability

Table 8 Causal Rules for Spikes in Arrests (Iraq and SyriaCombined)


8 airStrike(SyrianGovDamascus) 091 067 000

for such a spike in arrests is 008 Further we found evidenceof causality - the actions of the Syrian government raised theprobability of each of 33 related rules by at least 05 Onepotential reason to explain why arrests follow Syrian air op-erations is that unlike western nations Syria generally lacksadvanced technical intelligence-gathering capabilities to de-termine targets and Syria likely relies on extensive humanintelligence networks - especially within Iraq and Syria Suc-cessful targeting from the air by the Syrian government maythen indicate that ISISrsquos counter-intelligence efforts (activi-ties designed to locate spies within its ranks) may have failedand so the organization perhaps then decides to conductmassive arrests

Figure 7 Spikes in ISIS Arrests in Iraq and Syriaper Week

0

05

1

15

2

25

3

35

4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Arrests


Nu

mb

er o

f E

ven

ts

Week

Table 9 Causal Rules for Major Spikes in Suicide Opera-tions in Iraq


9 airStrike(IraqGovtBaiji)and 071 067 060

armedAtk(Balad)and

VBIED(Baghdad)

Reaction to Iraqi Government Air Strikes In Table 9rule 9 tells us that a 2times σ spike (see figure 8) in suicide op-erations in Iraq is related to a precondition involving Iraqiaerial operations in Baiji ISIS infantry operations in Baladand a VBIED in Baghdad The rule shows that these spikesin suicide operations are 35 times more likely with this pre-condition Though εavg is lower than some of the other rulespresented thus far it has a value for εmin of 03 - the mini-mum increase in probability afforded to any of the 82 relatedrules to which we add the precondition of rule 9 The pre-condition indicates that ISIS may have recently expended aVBIED (expensive in terms of equipment) while it has on-going infantry operations in Balad (expensive in terms of

personnel) - hence it may seek a more economical attack(in terms of both manpower and equipment) that still hasa significant terror component - and it would appear that asuicide attack provides a viable option to respond to suchair strikes

Figure 8 Spikes in ISIS Suicide Operations in Iraqper Week

0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Suicide Attacks


Week

Nu

mb

er o

f E

ven

ts

Table 10 Causal Rules for Major Spikes in IED Operationsin Iraq


10 airStrike(CoalitionMosul)and 097 067 033

armedAtk(Fallujah)

Table 11 Causal Rules for Major Spikes in IED Operationsin Syria



armedAtk(Ramadi)and

armedAtkSpike(Syria σ)

Reaction to Air Strikes by the US-led coalitionRules 10 (εfrac = 10 εmin = 05 562 related rules) and11 (εfrac = 10 εmin = 038 81 related rules) - shown inTables 10 and 11 - illustrate two different outcomes fromcoalition air operations in Mosul In both cases ISIS hasactive operations in the Al-Anbar province ndash both Ramadiand Fallujah have similar demographics Hence the majordifference is that the precondition of rule 11 also includessignificant infantry operations in Syria So even thoughboth rules result in an increase in IED activity (2timesσ aboveaverage a spike that in both cases occurs with a prior prob-ability of 012) (see figures 9 10) - the increase occurs in Iraqfor rule 10 and Syria for rule 11 It may be the case thatISIS is increasing IED activity in response to coalition airstrikes in the location of their main effort Further the rel-atively low negative probability (033) along with relativelyhigh values for εmin may indicate that coalition air strikesin Mosul are likely viewed as important factors contributingto ISIS decisions to increase IED activity We may also notethat the use of IED activity in the aftermath of coalition

air strikes could also be due to the size of the weapon AnIED can be fairly small easily disassembled and stored inan innocuous location - hence it is weapon system that thecoalition cannot sense and target from the air

Figure 9 Spikes in ISIS IEDs in Iraq per Week

0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs Moving Average + 2σ

Week

Nu

mb

er o

f E

ven

ts

Figure 10 Spikes in ISIS IEDs in Syria per Week

0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week

5 RELATED WORKTo the best of our knowledge this paper represents the

first purely data-driven study of ISIS and it is also the firstto combine the causality framework of [10] with APT-LogicHowever there has been a wealth of research conductedwhere rule-based systems have been applied to terrorist andinsurgent groups as well as other work on modeling insur-gent actions Here we review this related work and alsodiscuss other approaches to causal reasoning

Rule-based systems Previously there has been a vari-ety of research on modeling the actions of terrorist and in-surgent groups Perhaps most well-known is the StochasticOpponent Modeling Agents (SOMA) [11 12] which was de-veloped with the goal of better understanding different cul-tural groups along with their behaviors This is also based ona rule-based framework known as action-probabilistic (AP)rules [8] which is a predecessor of APT-logic used in thispaper [14 15] The SOMA system produces a probabilisticlogic representation for understanding group behaviors andreasoning about the types of actions a group may take In re-cent years this system has been used to better understandterror groups like Hamas [12] and Hezbollah [11] throughprobabilistic rules However it can also be used with cul-tural religious and political groups - as it has been demon-

strated with other groups in the Minorities at Risk Orga-nizational Behavior (MAROB) dataset [1] The work onSOMA was followed by an adoption of APT-Logic [14 15]which extended AP-rules with a temporal component APTlogic was also applied to the groups of the MAROB datasetas well as Shirsquoite Iraqi insurgent groups circa 2007 (presentduring the American-led Operation Iraqi Freedom) [15] 1Perhaps most significantly APT-Logic was applied to an-other dataset for the study of the terror groups Lashkar-e-Taiba (LeT) and Indian Mujahideen (IM) in two compre-hensive volumes that discuss the policy implications of thebehavioral rules learned in these cases [17 16] The mainsimilarity between the previous work leveraging SOMA AP-rules andor APT-logic and this paper is that both leverageprobabilistic rule learning However all of the aforemen-tioned rule-learning approaches only discover correlationswhile this work is focused on rules that are not only of highprobability but also have a likely casual relationship Wealso note that none of this previous work studies ISIS butrather other terrorist and insurgent groups

Analysis of insurgent military tactics We also notethat the previous rule-learning approaches to understandingterrorist and insurgent behavior have primarily focused onanalyzing political events and how they affect the actions ofgroups such as LeT and IM However with the exceptionof some of the work on APT-Logic which studies ShirsquoiteIraqi insurgents [14] the aforementioned work is generallynot focused on tactical military operations - unlike this pa-per However there have been other techniques introducedin the literature that have been designed to better accountfor ground action Previously a statistical-based approachleveraged leaked classified data [19] 2 to predict trends of vi-olent activity during the American-led Operation EnduringFreedom in Afghanistan However this work was primarilyfocused on prediction and not identifying causal relation-ships of interest to analysis as in this work We also notethat this work does not rely on the use of leaked classifieddata but rather on open-source information Another inter-esting approach is the model-based approach of [7] in whichsubject matter experts create models of insurgent behaviorusing a combination of fuzzy cognitive maps and complexnetworks to run simulations and study ldquowhat-ifrdquo scenariosHowever unlike this paper the work of [7] is not as data-driven an approach

Causal reasoning The comparison of rules by εavg as ameasure of causality was first introduced in [10] and furtherstudied in [9] It draws on the philosophical ideas of [18]However this work has primarily looked at preconditions assingle atomic propositions Further it did not explore theissue of efficiency As we look to identify rules whose pre-condition consists of more than one atomic proposition weintroduce a rule-learning approach Further moving beyondprevious rule-learning approaches such as that introduced in[8] and [14] we show practical techniques to improve efficien-cies of such algorithms Further we also improve upon theefficiency of computing εavg - a practical issue not discussedin [10 9] We note that neither this previous work on causal-

1ISIS is a Sunni group and did not exist in its present formin 20072Resulting from WikiLeaks in 2010

ity nor APT-logic makes independence assumptions Thisdiffers substantially from earlier work on causality such as[13] which relies on graphical models that make relativelystrong independence assumptions Our goal was to avoidsuch structures in order to provide a more purely data-drivenapproach A key aspect of this work as opposed to previ-ous studies on causality is that we leverage the intuitionsof APT logic and AP rules in which the rule-learning algo-rithm searches for combinations of atomic propositions thatare related to a given consequence

6 CONCLUSIONIn this paper we conducted a data-driven study on the in-

surgent group ISIS using a combination of APT-logic rulelearning and causal reasoning to identify cause-and-effectbehavior rules concerning the grouprsquos actions We believeour approach is of significant utility for both military deci-sion making and the creation of policy In the future welook to extend this work in several ways first we look tocreate non-ground rules that generalize some of the precon-ditions further This would allow us to understand the cir-cumstances in which ISIS conducts general operations (asopposed to operations specific to a given city or to a geo-graphic area) We also look to study more complex temporalrelationships ndash possibly using a more fine-grain resolution fortime and studying rules where the cause is followed by theeffect in more than one unit of time We also look to leverageadditional variables about the environment including dataabout weather information (including social media opera-tions) and the political situation to find more interestingrelationships

7 REFERENCES[1] V Asal C Johnson and J Wilkenfeld Ethnopolitical

violence and terrorism in the middle east In J JHewitt J Wilkenfeld and T R Gurr editors Peaceand Conflict 2008 Paradigm Publishers 2007

[2] Districts of iraq United Nations Office for theCoordination of Humanitarian Affairs 2014httpwwwhumanitarianresponseinfooperationsiraqsearchsearch=governorate+district

[3] Google maps Google Inc 2014httpswwwgooglecommaps

[4] Iraq - district reference maps MapAction 2014httpwwwmapactionorgcomponentsearchsearchword=iraq+mapampordering=newestampsearchphrase=allamplimit=100ampareas[0]=maps

[5] Situation reports Institute for the Study of War2014 httpunderstandingwarorg

[6] Syria Governorate and district reference mapsMapAction 2014 httpwwwmapactionorgdistrict-reference-maps-of-syriahtml

[7] P Giabbanelli Modelling the spatial and socialdynamics of insurgency Security Informatics 322014

[8] S Khuller M V Martinez D Nau A Sliva G ISimari and V S Subrahmanian Computing mostprobable worlds of action probabilistic logic programsscalable estimation for 1030000 worlds Annals ofMathematics and Artificial Intelligence51(2-4)295ndash331 2007

[9] S Kleinberg A logic for causal inference in time serieswith discrete and continuous variables In IJCAI 2011Proceedings of the 22nd International Joint Conferenceon Artificial Intelligence Barcelona Catalonia SpainJuly 16-22 2011 pages 943ndash950 2011

[10] S Kleinberg and B Mishra The temporal logic ofcausal structures In UAI 2009 Proceedings of theTwenty-Fifth Conference on Uncertainty in ArtificialIntelligence Montreal QC Canada June 18-212009 pages 303ndash312 2009

[11] A Mannes M Michael A Pate A Sliva V SSubrahmanian and J Wilkenfeld Stochasticopponent modeling agents A case study withHezbollah First International Workshop on SocialComputing Behavioral Modeling and PredictionApril 2008

[12] A Mannes A Sliva V S Subrahmanian andJ Wilkenfeld Stochastic opponent modeling agentsA case study with Hamas Proceedings of the SecondInternational Conference on Computational CulturalDynamics (ICCCD) September 2008

[13] J Pearl Causality Models Reasoning and InferenceCambridge University Press 2000

[14] P Shakarian A Parker G I Simari and V SSubrahmanian Annotated probabilistic temporallogic ACM Transactions on Computational Logic2011

[15] P Shakarian G I Simari and V S SubrahmanianAnnotated probabilistic temporal logic Approximatefixpoint implementation ACM Transactions onComputational Logic 2012

[16] V S Subrahmanian A Mannes A Roul and R KRaghavan Indian Mujahideen - ComputationalAnalysis and Public Policy volume 1 of TerrorismSecurity and Computation Springer 2013

[17] V S Subrahmanian A Mannes A SlivaJ Shakarian and J P Dickerson ComputationalAnalysis of Terrorist Groups Lashkar-e-TaibaSpringer 2013

[18] P Suppes A probabilistic theory of causalityNorth-Holland Pub Co 1970

[19] A Zammit-Mangion M Dewar V Kadirkamanathanand G Sanguinetti Point process modelling of theafghan war diary Proceedings of the NationalAcademy of Sciences 109(31)12414ndash12419 2012

1 Introduction

2 Technical Approach

21 APT Logic

22 Determining Causality

23 Algorithms

3 ISIS Dataset

4 Results and Discussion

41 Experimental Setup

42 Algorithm Efficiency

43 ISIS Military Tactics

44 Relationships between Iraqi and Syrian Theaters

45 ISIS Activities Related to Opposition Air Strikes

5 Related Work

6 Conclusion

7 References

not other larger weapons systems (ie VBIEDs) thismay indicate that ISIS resorts to more distributedinsurgent-style tactics in the aftermath of such opera-tions

To our knowledge this study represents both the first publicly-available data-driven study of ISIS as well as the first com-bination of APT logic with the causality ideas of [10] Therest of the paper is organized as follows In Section 2 we de-scribe our approach and recall key concepts from APT logicand causal reasoning This is followed by a description ofour corpus of military events surrounding the actions of ISISfrom June-December 2014 in Section 3 In Section 4 we de-scribe our implementation and discuss our results Finallyrelated work is reviewed in Section 5

2 TECHNICAL APPROACH

21 APT LogicWe now present a subset of our previously-introduced

APT logic [14 15] Our focus here is on the syntax of thelanguage utilized with an alternate semantics that is basedon the rule-learning approach described in [14] This is dueto the fact that we are only concerned with learning therules in this paper and determining their level of causalityndash we leave problems relating to deduction (ie the entail-ment problem studied in [15]) to future work APT logicconsiders a two-part semantic structure threads (sequencesof events) and interpretations (probability distributions oversuch sequences) Initially we focus on a semantics restrictedto threads

We assume the existence of a set of ground atoms A whichin this case correspond with events over time and use thesymbol n to denote the size of this set We shall partitionthe ground atoms into two subsets action atoms Aact andenvironmental atoms Aenv Action atoms describe actionsof certain actors and environmental atoms describe aspectsof the environment We will use nact nenv to denote thequantity of ground atoms in AactAenv respectively Wecan connect atoms using notandor to create formulas in thenormal way A world is a subset of atoms that are consideredto be true A thread is a series of worlds each correspondingto a discrete time-point which are represented by simplenatural numbers in the range 1 tmax We shall use Th[t]to refer to the world specified by Th at time t A thread(Th) at time t satisfies a formula f (denoted Th[t] |= f) bythe following recursive definition

bull For some a isin A Th[t] |= a iff a isin Th[t]

bull For f = notf prime Th[t] |= f iff Th[t] |= f prime is false

bull For f = f primeandf primeprime Th[t] |= f iff Th[t] |= f prime and Th[t] |= f primeprime

bull For f = f prime or f primeprime Th[t] |= f iff Th[t] |= f prime or Th[t] |= f primeprime

We also note that based on how often a given formula oc-curs within a thread we can obtain a prior probability forthat formula For instance consider formula g We can com-pute its prior probability (wrt thread Th) as the fractionof time points where g is satisfied

ρ =|t|Th[t] |= g|

tmax(1)

Note that we use the notation | middot | for the cardinality of a setOur goal in this section is for some event g to identify previ-ously occurring event c such that the conditional probabilityof g occurring given c is greater than pg In this paper weshall only look at finding APT rules where c occurs in thetime period right before g The case where multiple time pe-riods elapse between c and g is left to future work Hence weintroduce an APT rule of the following form cp g whichintuitively means that ldquoc is followed by g in one time-stepwith probability prdquo We shall refer to c as the preconditionand g as the consequence We say thread Th |= cp g iff

p =|t st Th[t] |= c and Th[t+ 1] |= g|

|t st Th[t] |= c| (2)

This alternate definition of semantics is not new it is a vari-ant of rule satisfaction with the existential frequency func-tion of [14] and also of ldquotrace semanticsrdquo used for a PCTLvariant in [9] In this paper we are focused on learning ruleswhere c is a conjunction of positive atoms and g is a singlepositive atom The number of atoms in the conjunction c isreferred to as the ldquodimensionrdquo of the rule c p g We willalso be concerned with two other measures of a given rulethe ldquonegative probabilityrdquo (used to describe the probabilisticrules of [17]) and the notion of support (a standard conceptin association rule learning) First we defineldquonegative prob-abilityrdquo ndash denoted plowast ndash for a given rule of the aforementionedformat

plowast =|t st Th[t] |= g and Th[tminus 1] 6|= c|

|t st Th[t] |= g| (3)

Simply put plowast is the number of times that the consequenceof a rule occurs without the head occurring prior We canthink of p as a measure of precision of a given rule while plowast

is more akin to a measure of recall Next we formally definethe notion of support (s) as follows

s = |t st Th[t] |= c| (4)

For a given rule r we shall use the notation pr plowastr sr re-

spectively We will also use the notation ρr to denote theprior probability of the consequence When it is obviousfrom context which rule we are referring to (as in the exper-imental results section) we will drop the subscript

22 Determining CausalityNext we describe how for a given action g we identify

potential causes based on a set of rules for which g is theconsequence In considering possible causes we must firstidentify a set of prima facie causes for g [10 18] We presentthe definition in terms of APT logic below

Definition 21 (Prima Facie Cause [10 18]) GivenAPT logic formulas c g and thread Th we say c is a primafacie cause for g wrt Th if

1 There exists time t such that Th[t] |= g (g occurs witha probability greater than zero)

2 There exists t tprime where t lt tprime such that Th[t] |= c andTh[tprime] |= g (c occurs before g)

3 For r equiv c p g where Th |= r we have p gt ρr (theprobability of the consequence occurring after the pre-condition is greater than the prior probability of theconsequence)









εavg =


|R(r)|






|R(r)|






(nenv

MaxDim



(maxt(nt)MaxDim

))






















set Rprime












Predicate Intuition




















armedAtk(Balad)


armedAtk(Balad)and

VBIED(Baghdad)




0

5

10

15

20

25

30

35

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mber

of

Even

ts

Week





indirectFire(Baiji)




0

2

4

6

8

10

12

14

16

18

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs


Nu

mb

er o

f E

ven

tsWeek









0

1

2

3

4

5

6

7

8

9

10

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs

Moving Average + σ

Nu

mber

of

Even

ts

Week


0

1

2

3

4

5

6

7

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mb

er o

f E

ven

ts

Week







VBIED(Baghdad)





VBIED(Ramadi)








0

05

1

15

2

25

3

35

4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Arrests


Nu

mb

er o

f E

ven

ts

Week




armedAtk(Balad)and

VBIED(Baghdad)




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Suicide Attacks


Week

Nu

mb

er o

f E

ven

ts




armedAtk(Fallujah)




armedAtk(Ramadi)and





0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts


0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week































1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References









εavg =


|R(r)|






|R(r)|






(nenv

MaxDim



(maxt(nt)MaxDim

))






















set Rprime












Predicate Intuition




















armedAtk(Balad)


armedAtk(Balad)and

VBIED(Baghdad)




0

5

10

15

20

25

30

35

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mber

of

Even

ts

Week





indirectFire(Baiji)




0

2

4

6

8

10

12

14

16

18

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs


Nu

mb

er o

f E

ven

tsWeek









0

1

2

3

4

5

6

7

8

9

10

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs

Moving Average + σ

Nu

mber

of

Even

ts

Week


0

1

2

3

4

5

6

7

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mb

er o

f E

ven

ts

Week







VBIED(Baghdad)





VBIED(Ramadi)








0

05

1

15

2

25

3

35

4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Arrests


Nu

mb

er o

f E

ven

ts

Week




armedAtk(Balad)and

VBIED(Baghdad)




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Suicide Attacks


Week

Nu

mb

er o

f E

ven

ts




armedAtk(Fallujah)




armedAtk(Ramadi)and





0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts


0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week































1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References









set Rprime












Predicate Intuition




















armedAtk(Balad)


armedAtk(Balad)and

VBIED(Baghdad)




0

5

10

15

20

25

30

35

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mber

of

Even

ts

Week





indirectFire(Baiji)




0

2

4

6

8

10

12

14

16

18

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs


Nu

mb

er o

f E

ven

tsWeek









0

1

2

3

4

5

6

7

8

9

10

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs

Moving Average + σ

Nu

mber

of

Even

ts

Week


0

1

2

3

4

5

6

7

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mb

er o

f E

ven

ts

Week







VBIED(Baghdad)





VBIED(Ramadi)








0

05

1

15

2

25

3

35

4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Arrests


Nu

mb

er o

f E

ven

ts

Week




armedAtk(Balad)and

VBIED(Baghdad)




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Suicide Attacks


Week

Nu

mb

er o

f E

ven

ts




armedAtk(Fallujah)




armedAtk(Ramadi)and





0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts


0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week































1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References


Predicate Intuition




















armedAtk(Balad)


armedAtk(Balad)and

VBIED(Baghdad)




0

5

10

15

20

25

30

35

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mber

of

Even

ts

Week





indirectFire(Baiji)




0

2

4

6

8

10

12

14

16

18

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs


Nu

mb

er o

f E

ven

tsWeek









0

1

2

3

4

5

6

7

8

9

10

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs

Moving Average + σ

Nu

mber

of

Even

ts

Week


0

1

2

3

4

5

6

7

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mb

er o

f E

ven

ts

Week







VBIED(Baghdad)





VBIED(Ramadi)








0

05

1

15

2

25

3

35

4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Arrests


Nu

mb

er o

f E

ven

ts

Week




armedAtk(Balad)and

VBIED(Baghdad)




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Suicide Attacks


Week

Nu

mb

er o

f E

ven

ts




armedAtk(Fallujah)




armedAtk(Ramadi)and





0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts


0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week































1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References



0

5

10

15

20

25

30

35

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mber

of

Even

ts

Week





indirectFire(Baiji)




0

2

4

6

8

10

12

14

16

18

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs


Nu

mb

er o

f E

ven

tsWeek









0

1

2

3

4

5

6

7

8

9

10

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs

Moving Average + σ

Nu

mber

of

Even

ts

Week


0

1

2

3

4

5

6

7

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mb

er o

f E

ven

ts

Week







VBIED(Baghdad)





VBIED(Ramadi)








0

05

1

15

2

25

3

35

4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Arrests


Nu

mb

er o

f E

ven

ts

Week




armedAtk(Balad)and

VBIED(Baghdad)




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Suicide Attacks


Week

Nu

mb

er o

f E

ven

ts




armedAtk(Fallujah)




armedAtk(Ramadi)and





0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts


0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week































1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References


0

1

2

3

4

5

6

7

8

9

10

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

VBIEDs

Moving Average + σ

Nu

mber

of

Even

ts

Week


0

1

2

3

4

5

6

7

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Nu

mb

er o

f E

ven

ts

Week







VBIED(Baghdad)





VBIED(Ramadi)








0

05

1

15

2

25

3

35

4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Arrests


Nu

mb

er o

f E

ven

ts

Week




armedAtk(Balad)and

VBIED(Baghdad)




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Suicide Attacks


Week

Nu

mb

er o

f E

ven

ts




armedAtk(Fallujah)




armedAtk(Ramadi)and





0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts


0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week































1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References






0

05

1

15

2

25

3

35

4

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Arrests


Nu

mb

er o

f E

ven

ts

Week




armedAtk(Balad)and

VBIED(Baghdad)




0

05

1

15

2

25

3

35

4

45

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

Suicide Attacks


Week

Nu

mb

er o

f E

ven

ts




armedAtk(Fallujah)




armedAtk(Ramadi)and





0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts


0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week































1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References



0

2

4

6

8

10

12

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29


Week

Nu

mb

er o

f E

ven

ts


0

05

1

15

2

25

3

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29

IEDs


Nu

mb

er o

f E

ven

ts

Week































1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References
























1 Introduction


21 APT Logic


23 Algorithms

3 ISIS Dataset







5 Related Work

6 Conclusion

7 References

mining for causal relationships: a data-driven study of ... · mining for causal relationships: a...

Documents