Identifying intelligence links in threat networks through machine learning on explosives chemical data

Improvised Explosive Devices (IEDs) and the terrorist or threat networks that employ them pose an ongoing threat in military operations. A significant challenge is identifying the intelligence linkages and relationships between the individuals that form these threat networks. However, this information is essential if these networks are to be disrupted.

This paper presents a novel concept for identifying these network linkages that can complement the threat network understanding generated through traditional military intelligence means.

In searching for opportunities to develop additional intelligence through scientific research, it was identified that the improvised nature of IEDs introduces characteristics that may be unique to each bombmaker. Improvised devices are made by individuals (not a production factory) so their construction, components and characteristics vary based on the maker. Based on the assumption that a bombmaker will regularly make IEDs in the same way (often the way they have been trained to make them), there is the opportunity to identify matching IEDs that have been made by the same maker, creating links between a person and multiple IEDs or attacks. Similarly, there may be common construction characteristics between different bombmakers IEDs enabling linking bombmakers together through their training, construction techniques or materials.

To exploit this opportunity, this research utilises the application of data science and machine learning techniques to analyse chemical test data from recovered samples of explosives, with the aim of identifying matches and relationships between the samples. Previously, forensic chemists have demonstrated the ability to identify matches between explosive samples through detailed chemical analysis. However, this analysis was a manual and time-consuming process using advanced chemical testing techniques and could not be applied at a large scale. The use of data science aims to reduce the need for advanced testing and enable rapid analysis of large data sets.

The methodology presented combines machine learning clustering techniques with traditional chemometric techniques for analysing chemical test data. The process can be summarised as follows:

1. Data pre-processing is used to optimise the data for clustering analysis
2. Principal Component Analysis (PCA) is used to reduce the dimensionality of the data and provides a way of visualising the clustering in 2-dimensions
3. Unsupervised machine learning algorithms then assign the explosive samples into clusters
4. Evaluation (validation) of clustering results and confirmation of the number of clusters is achieved through application of internal and external evaluation indices.

The results presented demonstrate the feasibility of using this machine learning centred approach for matching samples of unknown explosives that could be made by the same bombmaker.