Evolving a Weighted Bayesian Network for Consequence Assessment of Terrorist Attack

Over the past decade, terrorism risk has become a prominent consideration in protecting the well-being of individuals and organizations. Consequence assessment of terrorist attack has become a research hotspot in security science. Aiming at the multi-source, interactional and uncertain factors in terrorism events, we introduce Information Flow (IF) to propose an improved weighted Bayesian Network (BN) with causality-based weights. Based on the weighted BN and Rand Forest (RF), we design a data-driven and expert knowledge-based consequence assessment model of terrorist attack. Firstly, RF is applied to ﬁlter effective evaluation indicators objectively. Then, IF is adopted to calculate weights of indicators and the weighted BN is built by structure learning and parameter learning. Finally, assessment experiments are conducted with terrorist attack events recorded in Global Terrorism Database. The results show that our proposed model overcomes the shortcomings of traditional quantitative risk assessment methods in veriﬁability and ﬂexibility, and can reliably achieve quantitative assessment of terrorist attack risk under multi-source and uncertain information conditions.


I. INTRODUCTION
Terrorist attack (TA) has posed a broad threat to the peace, security and stability of the international community. Especially since the TA of September 11, 2001, TA has become the primary threat to the world order and region security, gathering greater concern from government and general public. For TA, it is far from enough to emphasize the rapid response and emergency disposal at the time of the occurrence. The focus should be on timely warning and early prevention. Consequence assessment of TA is helpful for alerting and preventing TA. How to objectively and quantitatively assess the harmfulness caused by TA has become an urgent problem to be solved for counter-terrorism departments. This research is focused on evaluating the severity degree of terrorism events, in other word, the impact of TA consequences. Therefore, we take the harm of terrorism consequences as the assessment objective, that is the consequence assessment of TA.
In the current research on TA risk assessment, the common evaluation methods can be divided into three categories: qualitative methods, semi-quantitative methods and The associate editor coordinating the review of this manuscript and approving it for publication was Tossapon Boongoen . quantitative methods [1]. The qualitative methods mainly evaluate the occurrence possibility and consequence harmfulness of TA based on expert experience and industry standards. Semi-quantitative methods combine expert knowledge with mathematical models and statistical tools for risk analysis, such as Analytic Hierarchy Process and Event Tree Analysis [2], [3]. Quantitative methods quantify indicators by identifying risk sources of TA and evaluate risk consequences, such as Fuzzy Comprehensive Evaluation, Grey Comprehensive Evaluation and Multi-attribute Decision Theory [4]- [6]. In recent years, with the data collection of TA events, some scholars have introduced data-driven methods such as Neural Network into TA risk assessment, conducting threat assessment and risk warning of TA by data mining [7].
It is known that terrorism events is different from natural disaster. TA events are planned and implemented by terrorists, which are intelligent adversaries and may adapt to the defensive measures. Therefore, the terrorism assessment shows strong uncertainty, complexity and suddenness. However, qualitative methods rely on a large amount of industry knowledge and expert experience, which is costly and difficult to verify. For consequence assessment of TA with high uncertainty and complexity, the accuracy of qualitative methods is often poor. Semi-quantitative or quantitative methods mostly use fixed linear models to calculate certain risk values, so it is difficult to characterize the uncertainty and nonlinearity of terrorism events. In conclusion, existing methods cannot solve the essential problem of TA consequence assessment: combining expert knowledge to conduct indicators fusion and uncertain reasoning of multi-source information.
At present, a large amount of historical data and realtime data have been accumulated in safety science. The rapid development of computer technology also offers a powerful computing power. Both provide a guarantee for the application of machine learning (ML) in social security risk analysis [8], [9]. The well-known ML algorithm, Bayesian Network (BN), is innovatively applied to TA risk assessment. BN has unique advantages in dealing with multi-source and uncertain information: (1) BN graphically describes the causal relationship among influencing factors of TA based on graph theory, which is convenient for researchers and decision makers to understand. So BN has the good interpretability; (2) BN is a network model based on probabilistic reasoning. In the process of reasoning, not only can the probability relationship between nodes be clearly expressed, but also the uncertainty of TA information can be quantitatively expressed; (3) BN can describe human thinking and reasoning because of the rigorous mathematical logic, which is more allpurpose and practical, different from traditional task-oriented expert system.
With the above advantages, BN has a successful application for TA risk assessment. Xue et al. [10] adopted Bayes method and change table to explore behaviors of terrorist organizations according to ideology, religious beliefs, political opinions and economic conditions. Allanach et al. [11] pointed out that BN is an effective means for TA information fusion and reasoning. Based on the Hidden Markov model, Zhan and Han [12] used the subject, object means and resources of TA to predict the occurrence. Fu et al. [13] apply BN to predict casualties and property losses caused by TA using information on attack means, political and economic purposes and the number of terrorists.
By combing the literatures about BN application in TA consequence assessment, we found two major challenges. On one hand, BN is based on the so-called Bayes' theorem with a conditional independence assumption (CIA), which ensures to improve the running efficiency of BN [14]. However, the influencing factors of TA events involve many aspects such as nature, society and politics, which are interrelated and complicated. It is obvious that the CIA is rarely true in BN application of TA consequence assessment because influencing factors are commonly correlated to each other. On the other hand, influencing factors of TA events are numerous and interrelated. Information redundancy is the most obvious defect, which will not only increase the dimension of BN and the computational costs of BN training, but also reduce the reasoning accuracy because of the invalid information. In order to reduce the complexity of BN, it is necessary to screen effective factors. At present, factor screening is mainly based on subjective expert knowledge. Quantitative and objective factors screening methods are scarce. The above two problems restrict the BN application in TA consequence assessment.
For the first problem, in order to relax the CIA of BN while retaining its simplicity and efficiency, researchers have proposed node weighting, that is to assign different weights to different nodes in BN, to mitigate BN's primary weakness [15]. Because weights enforce nodes to play different roles in probabilistic reasoning, the weighted BN will help weak the CIA and make BN still effective for strongly correlated factors. The key to weighted BN is the weight calculation, whose methods are divided into subjective weighting methods and objective weighting methods, including Delphi method, entropy weight method, coefficient of variation method [16], [17]. However, weights calculated by these methods cannot express the strength of causality between influencing factors and the TA consequences, which is just the core relationship in BN. We propose a new causalitybased weight calculation method based on Information Flow (IF), an emerging causal analysis method put forward by Liang [18], and build an improved weighted BN for TA consequence assessment. For another problem, we use another ML algorithm, Random Forest (RF) [19], to rank factors according to importance measure to screen the effective influencing factors of TA consequence, which is driven by objective data and avoids subjective randomness.
In an attempt to assess the harmfulness of TA consequences more accurately and objectively, based on millions of TA events recorded by Global Terrorism Database (GTD), we first use RF to select the effective influencing factors of TA, establish an evaluation indicator system, then calculate the weight of indicators based on causal IF and build a new weighted BN through structure learning and parameter learning. Consequence assessment of TA can be achieved through probabilistic reasoning under the condition of multi-source and uncertain information.
The remainder of the paper is organized as follows: Section 2 presents the basic theory of BN. Section 3 introduces the specific modeling techniques of the weighted BN-based consequence assessment model. The experiments and obtained results are shown in Section 4. Section 5 concludes the paper.

II. THEORY INTRODUCTION
In this section, the basic theory and modeling process of BN will be presented briefly. The conditional independence assumption (CIA) and weighted BN will also be elaborated.

A. THEORETICAL FOUNDATION
Bayesian Network (BN), also known as Bayesian Reliability Network, is not only a graphical expression of causal relationship among variables, but also a probabilistic reasoning technique [20]. It can be represented by a binary B =<G, θ >: VOLUME 8, 2020 set of nodes where each node represents a variable in the problem domain. E is a set of arcs, and the directed arcs indicate the causal dependency between variables.
• θ is the network parameter, that is, conditional probability distribution (CPT) of nodes. θ expresses the degree of mutual influence between nodes and presents quantitative characteristics in the knowledge domain. Assume a set of variables V = (v 1 , . . ., v n ). The mathematical basis of BN is Bayes' theorem showed by Eq.1, which is the tenet of Bayesian inference.
With definite structure and parameter, the joint probability distribution formula for Bayesian inference can be derived from Eq.1 under the conditional independence assumption (CIA) [21]: where: c is the parent node of v i . Bayesian inference is the calculation of probability distribution of a set of query variables according to exact value of evidence variables through Eq.2.
In practical application, BN modeling process includes variable definition, node selection, data processing, structure learning, parameter learning and probabilistic reasoning. Among these, structure learning and parameter learning are the most important links, that is, to determine the network topology and CPT. The methods to learn structure and CPT include subjective models and intelligent algorithms [22], [23].

B. WEIGHTED BAYESIAN NETWORK
A key foundation of BN is the conditional independence assumption (CIA), which assumes that under a given conditional node, each child node in BN is independent of other non-parent nodes. In general, if there are n binary nodes, the joint probability of all variables requires O(2 ∧ n) representation space, while only O(n · 2 ∧ m) representation space is needed with the CIA. m is the maximum number of states for a node [24]. Apparently, the CIA guarantees the operational efficiency and the speed of probabilistic reasoning of BN.
However, it's obvious that influencing factors are interrelated and do not play the same role in TA, so the CIA harms its reasoning performance when it is violated in reality. As stated in Instruction, a major way to deal with the problem is node weighting. The resulting model is called the weighted BN [25], which incorporates node weights into CPT as shown in Eq.3: where: w i is the weight of the node v i . P(v i |c) w i can be considered as the weighted CPT. The weighted BN assigns different weights to different nodes to strengthen the connection between nodes, weakening the CIA of BN and improving the reasoning accuracy. In the framework of the weighted BN, we introduce a new causal analysis theory, Information Flow (IF), to calculate the weight of nodes. Then the weight is integrated into CPT to construct a novel weighted BN with causality-based weights, which is applied to TA consequence assessment. The detailed assessment technical process is explained in the next section.

III. TERRORIST ATTACK CONSEQUENCE ASSESSMENT MODEL BASED ON AN IMPROVED WEIGHT BN
Based on Global Terrorism Database (GTD), construct an assessment system by screening effective indicators with Random Forest (RF). Then establish the weighted BN through weight calculation with IF, structure learning and parameter learning. In this section, we will give a full description of GTD and modeling technical flow.

A. GLOBAL TERRORISM DATABASE
In order to obtain details of TA events, we use the GTD (version 7), which is jointly established by the United States Anti-Terrorism Research Consortium and the University of Maryland, as the original data sets [26]. The open source database records more than 180000 TA events from 1970 to 2017, each of which contains more than 135 indicators including incident information, occurrence location and time, weapons information, number of victims and property losses, etc. GTD is famous for effective data sources, reliable quality and complete open source, which is considered as the most comprehensive database for recording global terrorist activities.
According to the type of data, the indicators describing TA events in GTD can be divided into numerical indicators such as the number of murderers and the total number of deaths, categorical indicators such as weapon types and attack types, and textual indicators such as weapon details and criminal group names. As BN is a data-driven model, we mainly use numerical indicators and category indicators to construct the assessment model.
When applying BN for consequence assessment, it is necessary to clarify the evaluation indicators (input nodes) and evaluation target (output nodes) of the network. In TA consequence assessment, the input nodes can be selected from the indicators in GTD. But for the output nodes, there are no suitable indicators in GTD. In order to express the harmfulness of TA consequences comprehensively, we integrate the three indicators of ''value of property loss'', ''total number of deaths'' and ''total number of injuries'' with different weights to obtain a ''TA risk index'', which is used as the target node to measure the severity degree of TA consequences. The indicator integration process will be explained in section IV.
What is noteworthy is that it is warranted to note the weaknesses associated with the GTD. The data from GTD are incomplete and contain a lot of noises because of records and storage. There is no doubt about pre-processing of original data in order to obtain the high-quality data for modeling, which is presented in section IV specifically.

B. ASSESSMENT TECHNICAL FLOW
Based on GTD, the TA risk index is obtained by indicators fusion, used as the target node. RF is applied to rank indicators according to importance measure for screening out the most effective indicators, used as evaluation nodes. Then the weighted BN is established through weight calculation with causal IF, structure learning and parameter learning. Evaluation indicators of TA consequence are input, and calculate the probability distribution of the harmfulness with network reasoning. The technical process of the TA consequence assessment is outlined in FIGURE 1. The following section provides a more concrete elaboration of several key links.

C. INDICATOR SELECTION WITH RANDOM FOREST
Random Forest (RF) is a non-parametric ensemble classifier based on decision tree, which can effectively deal with high-dimensional variables. RF can achieve variable filtering (dimension reduction) by yielding variable importance measure [27]. The basic idea of variable screen is that when noise is added to a related variable, the classification accuracy of RF will be reduced. The more significant the reduction is, the more important the variable is. Since the indicators of TA are too complex and constitute the relationship of mutual influence, we use this idea to screen the most influential indicators. The importance of indicators is measured by the decrease in average accuracy [28] as shown in Eq.4.
where: MDA is the decrease in average accuracy;V is evaluation indicators; n is the number of decision trees; errOOB is the out-of-pocket data error; errOOB t is the average out-ofpocket data error. The indicators with greater MDA are more important.

D. STRUCTURE AND PARAMETER LEARNING
The construction of BN includes structure learning and parameter learning. In structure learning, the selected evaluation indicators are defined as BN nodes. Considering the complexity of the TA consequence assessment, we manually build the network structure based on expert knowledge [29].
In parameter learning, we adopt EM algorithm to learn probability distribution. First, initialize the probability distribution of each node. Then, modify the initial probability distribution based on training samples to find maximum likelihood estimate of each parameter. EM algorithm has two steps [30]: • E step: Infer the distribution P(Z |X , θ t ) of hidden variables Z from the current θ t and observed variables X , and calculate the expectation of logarithm likelihood • M step: Find the maximized expectation of parameters.  Information flow (IF) is a real physical notion recently rigorized by Liang [31] to express causality between two variables (or events) in a quantitative way, where causality is measured by the information transfer rate from one variable's series to another. IF can realize the formalization and quantification in causal analysis.
Following Liang, given two series X 1 and X 2 , the maximum likelihood estimation of the rate of the IF from X 2 to X 1 is: where: C ij denotes the covariance between X i and X j , and C i,d j is determined as follows. LetẊ j be the finite-difference approximation of dX j dt using the Euler forward scheme: With k = 1 or k = 2 (The details about how to determine k are referred to Ref. [31]) and d being the step. C i,d j in Eq.5 is the covariance between X i andẊ j .
In order to quantify the relative importance of a detected causality, Liang [32] developed an approach to normalize the IF: where: H * 1 represents the phase space expansion along the X 1 direction; H noise 1 represents the random effect. The IF of indicators can be calculated according to Eq.7 to Eq.9, then the weight can be obtained by normalizing IF: Indicators with the maximum IF are considered to be highly predictive indicators, thus they are assigned greater weights. We incorporate the causality-based weight into CPT to construct the weighted CPT P(v i |c) w i . So far, the weighted BN is complete.

F. PROBABILISTIC REASONING
After constructing the weighted BN, input the priori evidence of evaluation indicators and calculate the posterior probability of target node by reasoning. Then determine the risk level of TA consequences according to posterior probability distribution. Bayesian reasoning algorithm includes exact algorithm and approximate algorithm. Approximate algorithm is usually applied to large-scale network structure to deal with excessive computation. Considering the scale of network in this research, we apply the exact algorithm, joint tree inference algorithm [33], for accurate reasoning. The mathematical basis of weighted probabilistic reasoning has been shown in Eq.3.

IV. TA CONSEQUENCE ASSESSMENT EXPERIMENT
In this section, we will apply the improved weighted BN for consequence assessment. Firstly, assessment experiments of TA are conducted to test the validity of the model. Then we also conduct the probabilistic assessment of the TA harmfulness in twelve regions around the world and analyze the distribution of global terrorist attacks. We run this program using FULL-BNT Tool-Box (v.1.0.4) under MATLAB.

Step 1 (Data Process and Indicator Selection):
As we all know, the indicators data in GTD is irregular, multi-source and incomplete, which cannot be directly used for BN training. Therefore, the data needs to be preprocessed: , which is used to describe the harmfulness of TA consequences according to the property loss and casualties. It should be pointed out that the weights are generated by expert marking. The index is numerical indicator, whose range is from 0 to 1. The larger the value, the greater the damage of terrorist attack. 3) As BN is better at processing discrete data, indicators of TA evets are required to be discretized. For numerical indicators, we use the natural breakpoint method [34] for discretization. For categorical indicators, we use consecutive numbers to indicate each category according to Ref. [35]. For example, Attacktype takes values 1, 2, 4, 6, and 7, and discretizes them into 1, 2, 3, 4, and 5.
Finally, 7000 TA events with complete and discrete data are extracted from GTD. The first 6000 for model training and the last 1000 for model validation.
We adopt RF to rank the initial indicators according to importance measure. The default number of trees (500) is used. The relative importance of the twenty indicators relative to the TA risk index is shown in FIGURE 2. We select the top seven effective indicators as BN nodes.   TABLE 3 shows discrete data sets for this experiment.
Step 2 (Construction of the Weighted BN): {ex, cr, su, at, ta, np, we} are defined as evaluation nodes and Tr is defined as the target node. FIGURE 3 shows the BN structure. Based on the training samples, the EM algorithm is used to learn the CPT of network nodes, and the weights of evaluation nodes are calculated with IF to construct the weighted CPT . TABLE 4 shows the IF-based weights and  TABLE 5 shows the weighted CPT of node ex. Step

(Probabilistic Reasoning and Consequence Assessment):
Based on the above network structure and weighted CPTs, the test samples of evaluation nodes are input, and the joint node inference mechanism as showed in Eq.3 is used to perform probabilistic reasoning to obtain the posterior probability distribution of the target node. Then classify the level of the TA according to the maximum probability. We use the Netica platform for assessment visualization. All test samples are input for probabilistic reasoning, and the posterior probability distribution and assessment results of TA consequences are concluded in TABLE 6. TABLE 6 shows each level's posterior probability of every TA event (Tr). Then we take the level with the biggest probability as the assessing level and compare with the actual level. To investigate the performance of our proposed model quantitatively, accuracy rate is employed as the evaluation criteria. The accuracy rate of the assessing level of TA is 89.26%.
To further illustrate the validity of our proposed assessment model, we also adopt the traditional BN and BP neural network to conduct comparative experiments. In modeling with traditional BN, the accuracy rate of the assessing level of TA is only 84.12% without consideration of node weighting. It follows that node weighting in BN has a beneficial effect on assessing accuracy. In modeling with BP neural network, seven effective indicators are input factors and the TA risk index is the output factor. The number of network layers is three. The accuracy rate is 82.07%. Most importantly, the output of BP neural network is a certain value, which   cannot reflect the uncertainty of TA risk. By contrast, the BN assessment results are presented in the form of probability distribution, capable of taking into consideration the uncertainty of input data and expressing the confidence level of the results.

B. EXPERIMENT II: GLOBAL TERRORIST ATTACK RISK ZONING
According to GTD, the world is divided into twelve regions, as shown in TABLE 7. We perform the risk zoning of global TA through the consequence assessment of the harmfulness of TA events in each region. The severity degree of TA consequences represents the TA risk in this experiment.
Step 1 (Data Process: Imputation of Missing Values): We still select the seven effective indicators for the experiment. For the risk zoning of global terrorist attack, it is necessary to conduct TA consequence assessments with the weighted BN in each region respectively, which requires large-scale data for network training. Therefore, in Experiment II, we fill in samples with missing data instead of elimination.
Special value filling methods, average filling methods, regression filling methods, maximum expectation filling methods are common imputation methods of missing data [36]. In order to make full use of the correlation among indicators, we adopt the generalized regression neural network (GRNN) to fill the missing data of the seven indicators. The structure of GRNN consists of four layers: input layer, pattern layer, summation layer and output layer. GRNN's theoretical basis is nonlinear regression analysis. Firstly, based on the complete samples in Experiment I, the GRNN between the to-be-interpolated indicator and the remaining six indicators is established respectively. Then use each mapping relationship to perform data interpolation on the seven indicators. After the data imputation, we also use the steps described in Experiment I to construct the TA risk index and discretize the data. Finally, 15000 TA samples are obtained.
Step 2 ( TA Consequence Probabilistic Assessment): 15000 TA events are classified according to twelve regions, and each TA event's information of evaluation nodes in each region is input into the weighted BN for probabilistic reasoning. Take the average of probability distribution of the TA risk index in each region. The average posterior probability distribution of the TA risk index are shown in TABLE 8. Table 8 shows the posterior probability distributions of output node ''Tr'' in different regions. Each level of Tr has a probability. And the level with the biggest probability is determined as the assessing level.    According to the probability distribution of the TA risk index, the TA risk in twelve regions can be divided into five levels using natural breakpoint method: Middle East & North Africa and South Asia are at the Level 1, whose TA are the most dangerous; Western Europe and Eastern Europe are at the Level 2; Southeast Asia and Sub-Saharan Africa

V. CONCLUSION
In the era of artificial intelligence, our research focuses on the application of BN in the consequence assessment of terrorist attack. After literature review, we conclude two shortcomings in the application of BN: (1) the strong correlation between the influencing factors violates the conditional independence assumption (CIA) in BN; (2) how to objectively screen effective evaluation indicators from a large number of indicators. Aiming at the above two problems, we introduce RF and causal IF to propose a new weighted BN. From the perspective of entirety, the weighted BN-based consequence assessment model of terrorist attack is designed, combining objective data and expert knowledge. Firstly, RF is applied to filter effective evaluation indicators objectively. Then, IF is VOLUME 8, 2020 adopted to calculate weights of indicators and the weighted BN is built by structure learning and parameter learning. Finally, assessment experiments are conducted with terrorist attack events recorded by GTD to verify the proposed model's feasibility and performance.
The experiment results show that the weighted BN based on IF has higher evaluation accuracy and more reliable interpretability than the traditional BN and BP neural network. The weighted BN is more beneficial in dealing with evaluation indicators with complex interrelationships, mining and expressing the causal relationship among indicators quantitatively and intuitively. Reasoning based on probability distribution makes the assessment process more rigorous, and the results can fully reflect the uncertainty of TA risk. Besides, BN is a machine learning algorithm, whose application includes model training and model testing based on objective data. By contrast, common assessing models, such as Fuzzy Comprehensive Evaluation, Grey Comprehensive Evaluation and Multi-attribute Decision Theory, need expert experience and have no testing process. All in all, the model proposed in this paper overcomes the deficiencies of the traditional quantitative risk assessment method in verifiability and flexibility. Our model can combine the expert knowledge and objective data to achieve quantitative assessment of TA consequence under uncertain conditions, which is highly accurate and reliability.
However, in our proposed risk assessment model, the structure of BN is completely constructed according to expert knowledge, which has strong subjectivity. In addition, the number of evaluation indicators screened is relatively limited. It does not fully reflect the interactions of threat, vulnerability, or consequence. In actual work, we can analyze the TA risk based on the quantitative results of this model, combined with social, economic, political and other factors, so as to obtain more accurate and effective conclusions.
MING LI is currently pursuing the Ph.D. degree with the National University of Defense Technology, Nanjing, Jiangsu, China. He has published more than ten peer reviewed articles and his research works has been published in the International Journal of Disaster Risk Science and IEEE ACCESS. His current research interests include Bayesian networks and machine learning algorithm designs.
REN ZHANG received the B.S. degree in meteorology from the Chengdu Meteorological Institute, in 1983, the M.S. degree from the Air Force Meteorological Institute, in 1990, and the Ph.D. degree in meteorology from Nanjing University, in 2000. He is currently working as a Professor and a Ph.D. Research Supervisor with the National University of Defense Technology. He has authored 2 books and more than 80 articles. His research interests include marine weather and climate, air-sea interaction, and marine information processing.