Terrorism group prediction using feature combination and BiGRU with self-attention mechanism

Dataset

Terrorism databases play a crucial role in understanding and countering terrorist activities, essential for developing effective security measures. Currently, the research community relies on several internationally recognized terrorism databases, listed in Table 2. These include the Global Terrorism Database (GTD), International Terrorism Attributes of Terrorist Events (ITERATE), the RAND Database of Worldwide Terrorism Incidents (RDWTI), and the Database of Terrorism in Western Europe Events Data (TWEED) (LaFree, 2019). These repositories offer invaluable insights into various terrorist incidents, encompassing locations, dates, targets, and specific characteristics. These datasets provide accurate and up-to-date information for formulating effective security plans and strategies. The absence of comprehensive and reliable datasets poses a formidable obstacle to conducting meaningful analyses of global terrorist attacks.

The GTD stands out as a premier database, featuring comprehensive data on international terrorism from the 1970s to 2020. ITERATE, curated by Edward Mickolus, covers the period from 1968 to 1977 and provides detailed insights into terrorist activities and related facets. RDWTI, maintained by the RAND Corporation, records terrorism incidents from 1968 to 2009, offering a comprehensive yet limited perspective due to its lack of updated data. TWEED focuses specifically on terrorism in Western Europe, providing detailed insights into terrorist incidents and unique variables such as state-sponsored activities, enhancing our understanding of terrorism trends in the region. As terrorism research progresses, these databases remain invaluable resources for policymakers, analysts, and researchers seeking deeper insights into global terrorism dynamics.

According to Table 1 and based on the datasets used in state-of-the-art research, the GTD stands out as the optimal choice for ML and DL research. This is due to its comprehensive coverage, regular updates, and recognition as a premier database in terrorism research (Kejriwal, 2021). Table 3 provides a sample of the dataset, illustrating these attributes for a selection of events. Key features of the GTD dataset include:

• 1)

  Detailed records of over 190,000 terrorist attacks, including more than 91,000 bombings, 20,000 assassinations, and 13,000 hostage-taking incidents since 1970 (Saidi & Trabelsi, 2022).

• 2)

  The most comprehensive unclassified database of terrorist attacks worldwide, with each case containing information on at least 45 attributes, and recent events having more than 130 attributes (Homolar & Rodríguez-Merino, 2019).

• 3)

  Data accuracy ensured by START through the review of over 4 million news articles and more than 25,000 news sources (Barnett et al., 2013).

The GTD is the premier resource for terrorism research, renowned for its comprehensive and authoritative compilation of global terrorism-related information. Developed as an open-source project by the University of Maryland, the GTD covers international terrorism from the 1970s through 2020. Its extensive data includes detailed information such as the date and location of each incident, the weapons used, the targets, the number of victims, and the responsible groups. The GTD currently contains more than 190,000 cases, making it one of the most significant databases in the field. The GTD is distinguished by its commitment to regular updates, ensuring that researchers have access to the most current information on both domestic and international terrorist acts. This dedication to data currency enhances its utility for predictive analysis and strategic planning in counter-terrorism efforts. Unlike many other event databases, the GTD offers in-depth, trustworthy, and open-source data, providing researchers with valuable insights to identify and predict terrorist acts. Each entry in the dataset includes comprehensive details about the incident, the nature of the target, the number of casualties, and specific information about the group or individual responsible for the attack.

The National Consortium for the Study of Terrorism and Response to Terrorism (START) has played a crucial role in disseminating GTD datasets to the public, thereby fostering a greater understanding of terrorist violence and encouraging participation in terrorism research and resistance efforts. This open-access approach not only facilitates academic research but also empowers policymakers, law enforcement agencies, and other stakeholders in their efforts to combat terrorism effectively.

However, when using the GTD dataset for ML and DL purposes, there are some limitations to consider. These limitations include potential biases or inconsistencies in the data due to variations in reporting and data collection methodologies. Additionally, the dataset has imbalanced categories, where certain types of attacks or regions are overrepresented or underrepresented.

Data sampling and exploratory data analysis

Data sampling is a common statistical method involving the selection, processing, and analysis of representative data subsets from larger datasets. Exploratory data analysis (EDA) is fundamental for understanding and visualizing datasets, aiming to unveil patterns, trends, and anomalies (Tariq & Aithal, 2023; Mukhiya & Ahmed, 2020). Integrating data sampling with EDA provides analysts with a powerful method for navigating and extracting insights from complex datasets. This approach allows for efficient selection of representative subsets, which facilitates focused exploration to uncover patterns and trends. In the context of the GTD, characterized by extensive records of terrorist incidents worldwide, this approach becomes indispensable.

In this study, we applied data sampling within the proposed framework to the GTD dataset to overcome challenges posed by its vast size and complexity. Our EDA covers three primary aspects: feature types, spatiotemporal distribution of terrorist attacks, and missing data rates. Firstly, we categorize features into categorical and numerical types, crucial for determining preprocessing and modelling strategies. Secondly, visualization techniques explore the spatiotemporal distribution of terrorist attacks, revealing patterns such as geographical concentration during specific time periods. Lastly, we assess missing data rates to evaluate dataset quality and completeness. Our analysis highlights attributes, particularly detailed perpetrator information, with higher rates of missing data, requiring careful handling during preprocessing to maintain integrity.

Exploratory data analysis for summary

The summary attribute in GTD is vital for understanding and extracting insights from terrorism incidents. It encompasses essential details such as the time, location, individuals involved, attack process, cause, and other relevant information related to each attack incident.

Figure 2 illustrates event summary information for specific attacks, demonstrating the richness and diversity of the dataset.

The incident summary comprises two main components: the timing of the attack and a detailed description of the attack process. The timing is recorded in the “month/day/year” format, while the attack description includes information such as the attack location, target type, casualty count, and additional details. Figure 2 illustrates the significance of the summary attribute within GTD, highlighting its provision of rich information. The summary encompasses details such as the location, timing, casualties, and the weaponry employed in the attacks. Figure 3 quantitatively presents the frequency of each word, illustrating its prominence in the dataset. Higher frequencies indicate common terms in terrorism incident summaries.

Certain frequently occurring terms in the summary attribute provide valuable insights into the nature of terrorism incidents, such as common attack types, targets. This attribute is crucial for understanding terrorism trends through text mining and NLP techniques. In this study, we applied text preprocessing methods, including tokenization and stop-word removal, to extract significant features and semantic understanding—steps that are essential for building effective predictive models and classification algorithms.

Upon analysis, the GTD dataset comprises 135 features per terrorist attack instance, encompassing 54 numerical, 23 categorical, and 58 textual features. These features provide comprehensive insights into various aspects of terrorist incidents, enhancing the dataset’s depth and analytical potential. To assess each feature’s missing data extent quantitatively, we utilize the missing data rate (Fiero et al., 2016), denoted as η. We calculate this rate using the formula:

(3) η=mn×100

In Eq. (3), m represents the number of missing values within the feature, while n represents the total number of samples in the dataset. The resulting missing data rate indicates the proportion of missing values for a given feature. This rate reflects the proportion of missing values for each feature, aiding in the analysis of data completeness. Understanding feature types and analyzing missing data distribution are critical steps in ensuring the GTD dataset’s readiness for subsequent mathematical modelling tasks. These insights guide effective preprocessing strategies and enhance the dataset’s analytical robustness. Visual analysis techniques, including pie charts, further facilitate the examination of missing data distribution. Figure 4 depicts the missing data rate distribution across the GTD dataset, revealing that approximately 56% of features contain missing values.

Temporal distribution of attacks

Analyzing the temporal distribution of terrorism attacks in the GTD offers profound insights into the evolving patterns and trends of these incidents over time. Examining the dataset allows us to discern significant temporal patterns and better understand the trajectory of terrorism. One effective method to analyze temporal distribution is through visualization, which enables observation of fluctuations in attack frequency over different time periods. Figure 5 illustrates the statistics of the number of terrorist attacks per year, offering a comprehensive overview of attack trends over time.

This visualization enables us to identify spikes or dips in attack frequency, indicating potential patterns or shifts in terrorist activities. For instance, the surge in attacks during the 1980s and 1990s, followed by a decline in the 2000s, suggests dynamic changes in terrorist strategies or counter-terrorism efforts. Furthermore, exploring the temporal distribution of attacks unveils long-term trends or shifts in terrorism dynamics. Notably, the exponential increase in global terrorist attacks from 2011 to 2014, as depicted in Fig. 5, underscores the evolving nature of terrorism and the challenges it poses to global security. The data from GTD, as illustrated in Fig. 5, reveals a staggering 200,000 recorded instances of terrorist attacks between 1970 and 2020, emphasizing the magnitude of the issue. Moreover, the rate of success in recent years, depicted in Fig. 6, underscores the expanding operations of terrorist organizations and their ability to achieve their objectives. Additionally, the rising rates of casualties and fatalities, as evidenced by Fig. 6, highlight the profound impact of terrorist crimes. This visual analysis underscores the urgency for policymakers and security agencies to adapt strategies and allocate resources effectively. By identifying trends and patterns in terrorist activities, stakeholders can enhance their understanding of evolving threats and formulate more effective counter-terrorism measures. Visual representations serve as powerful tools for policymakers, researchers, and security agencies to navigate the complexities of global terrorism.

Spatial distribution of attacks

Understanding the spatial distribution of terrorist attacks is paramount for devising effective counter-terrorism strategies. By scrutinizing the proximity of attacks to national borders and discerning patterns across neighbouring countries, we can glean insights into the international dimensions of terrorism and potential interconnections between various terrorist groups. It is noteworthy that the spatial distribution of attacks may fluctuate over time due to shifting geopolitical dynamics, conflicts, or counter-terrorism initiatives. The GTD categorizes the world into 12 regions, facilitating an analysis of attack frequencies across different areas. This segmentation enables the identification of hotspots and aids in comprehending the evolving patterns of terrorist threats. Heat maps serve as a suitable method for visualizing this analysis, offering a graphical representation of attack density or intensity across geographic regions.

Figure 7 portrays the results of the spatiotemporal distribution analysis based on the GTD dataset.

As depicted in Fig. 7, terrorist attacks are predominantly concentrated in four regions: the Middle East and North Africa, South Asia, Sub-Saharan Africa, and Southeast Asia. These regions collectively witness approximately 80% of the total global attacks. Notably, post-2014, there has been a significant decline in the number of attacks across all regions, with the Middle East and North Africa experiencing the most substantial decrease. However, Sub-Saharan Africa, a recognized hub of international terrorist activities, has not witnessed a significant decrease in attack frequency in recent years. Analyzing the spatial distribution of attacks alongside the temporal distribution provides a holistic understanding of terrorism dynamics. It enables the identification of regions with high attack concentrations, exploration of potential cross-border linkages, and detection of changes in attack patterns over time.

Correlation analysis between features

Correlation quantifies the strength and direction of a linear relationship between features (Al-Nafjan, 2022). We employed the PCC for continuous variables and NMI for categorical variables (Chen et al., 2023; Tao et al., 2023). PCC measures linear relationships among continuous variables, defined as:

(4) r=cov(X,Y)σXσY=E(XY)−E(X)E(Y)E(X2)−E2(X)E(Y2)−E2(Y)where cov(X,Y) denotes the covariance between X and Y, and σX signifies the standard deviation of X. Correlation strength ranges: 0–0.3 (low), 0.3–0.8 (moderate), and 0.8–1 (high).

NMI measures similarity between categorical variables, normalized between 0 and 1, calculated as:

(5) NMI(X,Y)=2I(X;Y)H(X)+H(Y)

For categorical features, NMI values build a correlation matrix. Steps include:

• Compute NMI for each pair: Calculate NMI for every pair of categorical features.

• Construct a correlation matrix: Use NMI values to build a matrix showing associations between categorical features.

Table 6 presents the NMI matrix, illustrating relationships among categorical features. Each cell shows NMI values, with higher values indicating stronger associations. Diagonal entries are NaN, as NMI for a feature with itself holds no meaning. The heatmap in Fig. 8 illustrates PCC between numerical features. Darker colors denote stronger correlations, while lighter shades indicate weaker ones. Notable patterns include:

• Correlations between Attack Statistics and Attack Type: Higher casualties are associated with attacks targeting civilians.

• Correlations between Attack Type and Target Nationality: Specific attack types align with certain target nationalities, indicating targeted patterns.

• Correlations between Target Characteristics and Attack Type: The target type influences the choice of attack method, revealing strategic aspects.

These observations underscore intricate relationships within terrorist attack dynamics, crucial for analysis and strategic intervention. NMI visualizes categorical feature correlations in Fig. 9, where darker hues indicate stronger associations. Key patterns include:

• Associations between Attack Type and Target Type: Certain attack types target specific entities, reflecting strategic decisions.

• Associations between Target Nationality and Weapon Type: Weapon choices correlate with target nationalities, influenced by geopolitical factors.

• Associations between Perpetrator Nationality and Region: Perpetrator origins align with attack regions, indicating regional preferences.

Imputation of missing values based on feature correlations

Upon detailed analysis of the GTD dataset, we identified significant redundancy across various features. This redundancy can be leveraged to effectively address missing values. In the preprocessing stage, we capitalized on this redundancy to impute missing values, details of which are outlined below:

• Filling in missing values for the exact date of the event:

In the GTD dataset, when the exact date of an event is unknown, the corresponding variable is recorded as 0. To tackle this issue, we conducted an in-depth analysis and found that approximately 27.76% of the missing values can be filled using two columns: the event number and the approximate date. The event number comprises a 12-digit value, with the first eight digits representing the date in the format “yyyymmdd,” and the last four digits indicating the serial number of the day (e.g., 0001, 0002, etc.,). By parsing the “dd” field in the event number, we can fill in missing values for some dates. In cases where the “dd” field is zero, we rely on the “Approximate Date” column in the dataset to populate the “Exact Date” column. If a sample does not record an approximate attack date, we fill it with special values that differ from the normal situation. For this study, we assign a value of 0 to these missing dates.

• Filling in the missing values of weapon subtypes:

In the GTD dataset, the weapon type and weapon subtype used in each terrorist attack are encoded using specific terms. The missing rates for these two features were calculated individually. The “Weapon Type” column does not have any missing values, while the “Weapon Subtype” column has a missing rate of 11.56%. A detailed analysis was conducted on these two columns, revealing that all missing values for weapon subtypes can be filled using the corresponding weapon type. The weapon types provide a general classification of the weapons used in each event, while the weapon subtypes offer more specific descriptions for most weapon types. Through analysis, it was found that certain weapon types, such as radioactive weapons, do not have corresponding weapon subtypes. For these samples, their weapon type encoding value is added to 50 and filled in the “Weapon Subtype” column. The reason for adding a constant value to the encoding value of the weapon type is to avoid any inconsistencies with the original encoding of the weapon subtype. This addition ensures that there is no conflict with the original encrypted value of the weapon subtype.

• Filling in the missing values of the number of deaths:

The death toll is a crucial measure of the severity of terrorist attacks. In the GTD dataset, the “death toll” column has a missing rate of 4.03%. Through analysis, it was found that 60.05% of the missing data can be addressed by utilizing the effective redundancy of information between the “Number of Deaths in the United States” column, the “Number of Murderer Deaths” column, and the “Number of Deaths” column in the dataset. To fill in the missing values, the data for each sample is examined. If both the “Number of Deaths in the United States” and “Number of Murderer Deaths” columns have values and the “Number of Deaths” column is missing, the available values from the former two columns are combined to assign a value to the number of deaths. If one of the above two columns is missing, the value from the non-missing column is filled into the “Number of Deaths” column. For samples where all three columns are missing, a value of −1 is assigned to the death toll. This facilitates the accurate identification of these samples by the model. To ensure non-negative values in the death count, we incremented the death toll by 1 in all instances. The same approach is applied to filling in missing values in the “Injured” column as in the “Deaths” column.

• Imputation of missing values for the victim’s nationality: The nationality of the victim is a crucial aspect recorded and coded in the GTD dataset under the “Nationality of Target/Victim” feature. However, missing values may exist for this feature.

Several approaches were considered:

• Utilize the location of the attack: If the attack location is known, infer the victim’s nationality, assuming they are primarily from the country of the attack.

• Use the nationality of the target: Assume the victims share the nationality of the target.

• Use the perpetrator’s nationality: Assume the victims share the nationality of the perpetrator.

• Utilize imputation methods: Use statistical methods to predict missing values by analyzing available data for patterns and relationships.

Through exploratory data analysis, we discovered a strong correlation between the nationality of the victims in certain samples and the country where the attack occurred. To quantify this correlation, we calculate the conditional probability-based correlation, denoted as σ. The conditional probability-based correlation σ is calculated using the formula:

(6) σ=P(B|A)=P(AB)P(A)where: P(AB) is the joint probability of events A and B occurring together. P(A) is the probability of event A occurring. This formula helps quantify the correlation between the nationality of the victims and the country where the attack occurred, aiding in the effective imputation of missing values.

Deletion of redundant features

Deleting redundant features is a critical step in ML model training. Dealing with a large number of features in a dataset can lead to the curse of dimensionality, resulting in increased model complexity and decreased generalization capability. Therefore, enhancing data processing efficiency and improving model prediction accuracy requires the elimination of invalid redundant features from the GTD dataset. The correlation between features was utilized to fill in missing values. If a feature column was used for filling, and its information was already included in the filled feature columns, then that particular column was eliminated. For instance, once the “Exact Date” column was populated with data from the “Approximate Date” column, the “Approximate Date” column could be safely removed. Similarly, if there were feature columns in the dataset containing identical information, such as the “Country code where the attack occurred” column and the “Country name where the attack occurred” column, one of them, like the “Country name where the attack occurred” column, was removed. This reduction in dimensionality resulted in improved data processing efficiency and enhanced the overall performance of the ML model.

Generation of derived features

To enhance the distinction between samples and optimize the performance of the ML model, we leverage prior knowledge to generate a range of derived features. These methods can be categorized into three categories: addition of basic features, division of basic features, and addition of binary-encoded basic features.

• Addition of basic features:

By combining the “number of dead” column and the “number of injured” column, we can generate the total number of casualties caused by terrorist attacks. Similarly, we can calculate various statistics related to the perpetrators of terrorist attacks, such as the number of casualties caused by them.

• Division of basic features:

To gain further insights, we calculate proportions by dividing specific columns. For instance, dividing the “number of murderer’s deaths” column by the “number of deaths” column allows us to determine the proportion of deaths caused by the murderers. It is important to note that we add one to the value in the “Number of Deaths” column to avoid division by zero errors. Similarly, we can calculate proportions related to the number of injuries caused by the perpetrators.

• Addition of binary-encoded basic features:

In the GTD dataset, information sources for each terrorist attack event are recorded as the first cited source, second cited source, and third cited source. To process this information, we first binary encode each citation source. A value of 1 is assigned if the citation source is present, and 0 is assigned if it is missing. By summing up the binary-encoded features from the three columns, we obtain the count of main information sources used in compiling each terrorist attack event.

Following this selective preprocessing process, the refined dataset now encompasses a total of 180,706 incidents, each characterized by a more streamlined and informative set of 59 features. Data and features determine the upper limit of the ML model. We performed data cleaning, missing value filling, correlation analysis, and other operations on the GTD dataset and finally obtained 59 features. Among them, there are 30 numerical features, 28 categorical features, and only one feature content short text (summary of the attack event). By preprocessing data samples, the noise in the original data can be effectively reduced, the data processing efficiency can be improved, and a solid foundation can be laid for the next step of modelling work.

Addressing potential biases

The GTD dataset exhibits significant data imbalance, particularly in the distribution of Gname responsible for attacks. This imbalance is evident when examining Table 7, which illustrates the distribution of Gname. Table 7 underscores the varying frequencies of attacks associated with each group. To address potential biases, we implemented two strategies to ensure the data’s integrity and representativeness in the GTD. The first strategy was applied to the entire dataset, and the second focused on the Gname attribute.

The first strategy applied during the preprocessing phase includes several steps as follows:

(i) Balanced imputation approach:

In dealing with missing values, we employed a balanced imputation approach. For numerical data, we used mean imputation for normally distributed data and median imputation for skewed data to avoid outliers. For categorical data, mode imputation or assigning a distinct ‘unknown’ category was employed. This approach helps to preserve the original distribution of the data and prevent the introduction of bias that might occur if a disproportionate number of records were filled with a non-representative value.

(ii) Critical evaluation of filled values:

We evaluated the impact of filled values by analyzing data distribution before and after imputation to ensure consistent variance and skewness. This step is crucial for maintaining the dataset’s statistical properties and ensuring that the models trained on this data do not inherit any systemic bias from the preprocessing phase.

(iii) Handling redundant features:

We employed a systematic approach to identify and remove duplicate features. This helped avoid multicollinearity, which can lead to biased or over-fitted models and improved model interpretability and generalizability.

(iv) Diverse feature selection:

To further mitigate bias, we ensured a diverse selection of features that comprehensively represented different aspects of the data. This holistic view prevents the model from overly relying on a subset of features that might be biased towards certain patterns or trends.

(v) Continuous monitoring and validation:

After preprocessing, we monitored and validated our models for bias by evaluating performance across different data subgroups.

(vi) Comprehensive sampling

The second strategy, implemented specifically on the Gname attribute, aimed to rectify the skewed distribution of incidents among the selected organizations. To achieve this, the study utilized SMOTE, a sophisticated resampling method tailored to address class imbalances (Ahmed, Hameed & Bawany, 2022). Dealing with imbalanced datasets commonly involves oversampling and undersampling methods to alter the data distribution. However, undersampling methods may result in the loss of existing sample information, while oversampling methods can lead to classifier overfitting. SMOTE-T combines oversampling and undersampling with Tomek links to reduce sample overlap. SMOTE generates new minority class samples to balance the dataset, and noisy samples are removed. The SMOTE algorithm enhances the representation of minority classes by generating synthetic samples. It operates by randomly selecting a sample from the minority class and performing linear interpolation between this sample and its m nearest neighbors within the same class. The algorithm’s basic steps are as follows:

• 1)

  Identify the m nearest minority class neighbors for a given minority class sample xi.

• 2)

  Randomly select one of these m neighbors, denoted as xj.

• 3)

  Generate a new sample through random linear interpolation between xi and xj, adding it to the minority class.

For handling samples with noise, particularly when two samples xi and xj from different classes are nearest neighbors to each other, they form a Tomek link pair. The presence of Tomek links indicates overlapping class boundaries or noise. Removing such links, specifically the majority class instance in each pair, makes the dataset’s class boundaries more distinct, enhancing the classification algorithm’s performance (Sasada et al., 2020). SMOTE generation of synthetic samples aims to achieve a more balanced class distribution, addressing the issue of under-representation. The addition of Tomek links helps to refine the dataset further by removing overlapping samples between classes, thereby improving the robustness and quality of the data for training models. This dual approach ensures a more balanced representation of classes and enhances the dataset’s cleanliness, contributing to more accurate and reliable predictive modeling. Setting a threshold of 500 incidents, we focus on terrorist organizations with significant involvement in the GTD, ensuring a substantial dataset for in-depth analysis and efficient model training. This criterion enhances predictive accuracy by concentrating on groups with enough data to establish reliable patterns and trends, while reducing noise from sporadic activities. Despite this, further refinement is needed to address the remaining imbalance in the dataset.

To address the skewed distribution of incidents, we employ SMOTE-T, a resampling method that generates synthetic samples for underrepresented classes and uses Tomek links to clean overlapping samples. This dual strategy improves the balance and quality of the dataset, enhancing model generalization and robustness. Algorithm 1 outlines the procedure for implementing SMOTE-T, addressing the residual imbalance and improving predictive modeling capabilities across different terrorist organizations.

Feature extraction with transformer-based DistilBERT

In this study, we employed the DistilBERT model for text embedding extraction. DistilBERT is a more efficient and deployable version of the BERT architecture, designed for real-world applications (Ghanadian, Nejadgholi & Al Osman, 2024; Karande et al., 2021). It retains most of BERT’s performance while being smaller and faster, making it advantageous for processing extensive textual data, such as that found in terrorism databases (Shahinmoghadam, Kahou & Motamedi, 2024). The model’s reduced complexity allows for quicker analysis without significant loss of context or accuracy. DistilBERT is particularly effective in real-time threat detection, as it can detect subtle nuances in text, crucial for accurately classifying complex terrorist event data.

This investigation capitalizes on DistilBERT for deriving text embeddings through the fine-tuning of this pre-trained model across various epochs. The model’s architecture, which maintains the efficiency and speed of BERT while minimizing its size, proves advantageous for analyzing extensive textual datasets common in terrorism research.

The ability of DistilBERT to expedite analytical processes without compromising on contextual depth or accuracy is depicted in Fig. 10, highlighting its foundation on the BERT base model (Bert-base-uncased) and delineating key distinctions from the original BERT framework:

• i)

  A reduction in parameters by 40%, making DistilBERT leaner than its BERT counterpart.

• ii)

  Enhancement of inference speed by 60%

• iii)

  Adoption of dynamic rather than static masking for inference.

• iv)

  Exclusion of next sentence prediction (NSP) and segment embedding in the training stage.

• v)

  Incorporation of six transformer layers, as opposed to the twelve found in the BERT base.

• vi)

  Reduction in training duration to 3.5 GPU days from the 12 required by the original model.

DistilBERT undergoes training using the same datasets as the BERT base, encompassing the Toronto Books Corpus and English Wikipedia (Oralbekova et al., 2023).

As illustrated in Fig. 10, modifications include substituting the original classification layer in DistilBERT with two separate layers designated for feature extraction and Gname classification. The model processes input sentences X, denoted as a series of tokens X=x1,…,xs, to yield a unified semantic vector [CLS] per sentence. Prior to token sequence processing, DistilBERT employs sub-word and word-piece tokenization techniques (Kowsher et al., 2022) to generate input embedding vectors ( S1). This tokenization assigns each token a trio of embeddings: word, segment, and positional, with special tokens [SEP] and [CLS] marking the beginning and end of sequences. Subsequently, the multi-layered RNN, leveraging a self-attention mechanism known as the lexicon encoder, aggregates these embeddings to form a cohesive contextual vector S2. The semantic embeddings S3 are derived by amalgamating the contextual vectors S2, orchestrated by the [CLS] token.

Feature extraction is facilitated through a fully connected layer, processing [CLS] token embeddings to yield a vector F with dimension d=128, thereby reducing the dimensionality from the original 768 to 128. These condensed features, d=128, are subsequently integrated with pertinent features for classification purposes, employing the GELU activation function (Xiong et al., 2023) for enhanced model efficacy, as formulated in Eq. (7).

(7) GELU(m)=m⋅Φ(m)where, m symbolizes the fully connected layer’s output, with Φ(m) representing the Gaussian distribution’s cumulative distribution function.

The concluding classification phase involves refining the model and adjusting the pre-trained weights W for the Gname identification task, framed as a multi-class classification challenge. This phase features a fully connected layer with r=2 neurons, indicative of class count, where the Softmax function assigns probabilities to class c memberships for input X. Training of the classification layer is executed through the cross-entropy loss function.

BiGRU-SA model

This model is structured into four layers: the input layer, the BiGRU layer, the self-attention layer, and the output layer, as shown in Fig. 11. Each layer plays a critical role in analyzing and inferring the intentions and characteristics of terrorist organizations based on the attack data recorded in the GTD.

The input layer serves as the initial stage, where relevant data from the GTD is fed into the model. The BiGRU layer, utilizing bidirectional gated recurrent units, processes the sequential information in both forward and backward directions, capturing dependencies from past and future states. Following this, the self-attention layer allows the model to weigh the importance of different parts of the input data and capture long-range dependencies within the sequence. Finally, the output layer produces the predicted classifications of terrorist organizations responsible for the recorded attacks in the GTD based on the processed information from the previous layers. These layers integrate to form an advanced architecture designed to effectively capture and interpret the complex temporal dynamics inherent in terrorist activity data. Details concerning each layer, their respective functions, and how they are integrated are presented as follows:

1. Input layer

The input layer employs different strategies to preprocess the collected data and transform it into a feature vector suitable for direct processing by the subsequent BiGRU layer augmented with an attention mechanism.

• DistilBERT features strategy: This strategy processes the textual features extracted by DistilBERT from the summary text. These features are encoded using DistilBERT embeddings to capture nuanced semantic information. Let T be the summary text and D(T) be the DistilBERT embeddings of T:

  (8) ET=D(T)

• This strategy integrates both textual and non-textual features. Non-textual features are first converted into textual format and then concatenated with the summary text. This combined text is then fed into DistilBERT. Let T be the summary text, N be the non-textual features converted into textual format, and D(⋅) represent DistilBERT embeddings:

  (9) ET+N=D(T⊕N)

  where ⊙ denotes the concatenation of T and N.

• Combined features strategy: In this strategy, individual features are combined after encoding categorical features through label encoding. This converts categorical data into numerical format, which is then merged with the textual features extracted by DistilBERT into a unified vector representation. Let C be the categorical features, L(C) be the label-encoded categorical features, and X be the numerical features. Let T be the summary text and D(T) be the DistilBERT embeddings of T:

  (10) LC=L(C)

  Then, combine the numerical features X, the encoded categorical features LC, and the DistilBERT embeddings ET:

  (11) Fcombined=ET⊕LC⊕X

where Fcombined is the unified vector representation combining numerical, textual, and encoded categorical data. The input layer orchestrates these diverse feature types into a coherent characteristic vector for effective processing by the subsequent BiGRU layer augmented with an attention mechanism.

2. Gated recurrent unit network:

The GRU network is an evolution of the long short-term memory (LSTM) model that simplifies the architecture by merging the input and forget gates into a single update gate u(t). This gate determines how much of the past state information should be passed to the current state. Additionally, a reset gate r(t) decides how much of the past state information should be discarded. The architecture of the unit is depicted in Fig. 12. Where, I(t) denotes the input at time t, while C(t) and H(t) are the candidate and actual hidden states at time t, respectively. The symbols Θu,Θr,Θc are the weight matrices associated with the update gate, reset gate, and candidate state, and bu,br,bc are their respective biases. The functions σ and tanh are the activation functions used, and the symbol ⊙ indicates element-wise multiplication.

The sequence of operations for computing the forward pass in a GRU is outlined below:

u(t)=σ(Θu[I(t),H(t−1)]+bu)r(t)=σ(Θr[I(t),H(t−1)]+br)C(t)=tanh⁡(Θc[I(t),r(t)⊙H(t−1)]+bc)H(t)=u(t)⊙H(t−1)+[1−u(t)]⊙C(t)

This formulation captures the essence of GRU’s operation, focusing on the update and reset mechanisms that govern the flow and transformation of information through the network over time. However, the GRU has a limitation in that it only considers historical information before the current moment and ignores any influence from future moments. This unidirectional nature hinders the model’s ability to capture the complete context of the input sequence.

To address this limitation, we can utilize the bidirectional GRU (BiGRU) structure. BiGRU is composed of two GRU networks: a forward GRU and a backward GRU. The forward GRU processes the input sequence in the normal chronological order, while the backward GRU processes the input sequence in the reverse order. This bidirectional propagation mechanism allows the output node of BiGRU at each time step to contain both historical and future information about the current moment in the input sequence.

Considering both past and future information allows BiGRU to better capture the association between forward and backward characteristics in the time-series data. This capability enables the model to process contextual information more effectively, leading to improved network performance.

In the context of predicting terrorist organizations in the GTD dataset, BiGRU can benefit from its bidirectional nature to capture both past and future events related to terrorist activities. This enhanced understanding of the temporal context can help the model uncover hidden patterns and dependencies, ultimately improving its predictive capabilities for identifying and analyzing terrorist organizations.

As depicted in Fig. 13, the hidden layer state ht at time t for the BiGRU is a combination of both forward h→t and backward h←t states. The forward state h→t is determined by the current input xt and the previous state ht−1, whereas the backward state h←t is influenced by xt and the subsequent state ht+1. This illustrates the bidirectional nature of the GRU, encapsulating past and future information for a complete temporal insight. The BiGRU computational approach, detailed in Eq. (12), systematically combines inputs from both past and future, constructing hidden layer states at each timestep to enable a detailed analysis of temporal sequences. This method underscores the BiGRU’s distinctive ability to gather and integrate temporal data from two directions, thus improving sequence modeling.

For the forward pass:

(12) h→t=σ(w1Xt+w2h→t−1)h←t=σ(w3Xt+w4h←t+1)Xt′=ϕ(w5h→t+w6h←t)

Here, Wi (for i=1 to 6) represent the weights transitioning between layers, while σ and ϕ denote distinct activation functions. This formulation ensures a nuanced capture of information from both past and future contexts, pivotal for sequence analysis in BiGRU frameworks.

3. Self-attention layer

The self-attention mechanism, also known as the scaled dot-product attention, is a technique that can be integrated with the BiGRU model to enhance its performance in capturing important information from the input sequence (Zhang et al., 2018; Kenarang, Farahani & Manthouri, 2022). The self-attention mechanism allows the model to focus on different parts of the input sequence while making predictions, enabling it to selectively attend to the most relevant features.

In our case, we implement the self-attention mechanism by introducing an attention layer between the BiGRU layer and the final output layer. This attention layer takes the hidden states from the BiGRU layer as input and computes a set of attention weights for each hidden state. These attention weights represent the importance or relevance of each hidden state in the context of the entire input sequence.

The attention weights are typically computed using a scoring function. One common approach is the dot-product scoring function, where the similarity between the hidden states and a context vector is measured by taking the dot product between them. The resulting scores are then passed through a softmax function to obtain the attention weights, ensuring that they sum to 1.

Once we have the attention weights, we compute a weighted sum of the hidden states using these weights. This weighted sum represents the attended representation of the input sequence, where the model has focused more on the important parts of the sequence. This attended representation is then passed through the final output layer to make predictions for our task of analyzing terrorist organization features.

Integrating the self-attention mechanism with the BiGRU model allows the model to dynamically and adaptively focus on the most relevant parts of the input sequence. The self-attention mechanism enables the model to capture long-range interdependencies and internal correlations within the time-series data. Incorporating the self-attention layer into the architecture allows the model to assign higher weights to important characteristics output from the BiGRU network layer. This helps the model learn the relevance and importance of each characteristic and automatically assign corresponding weights during the training process.

For instance, in predicting the likelihood of a terrorist organization’s success based on various features such as region, country, attack type, and weapon type, the self-attention mechanism can identify the most influential features and assign higher weights to them. This allows the model to focus more on the relevant features while downplaying the impact of less relevant ones. Attending to the key characteristics helps the model better understand the underlying patterns and associations, improving its predictive capabilities.

The integration of the self-attention mechanism with the BiGRU model helps the model effectively filter out unnecessary details and concentrate on crucial information for predicting terrorist organization features. Enhancing the model’s memory capacity and capturing critical dependencies, the self-attention mechanism contributes to improved performance and accuracy in predicting and analyzing characteristics of terrorist organizations in the GTD dataset.

4. Output layer:

The output layer processes information from previous layers and applies an activation function to generate final predictions or probabilities for the specified task. Typically, this layer includes one or more fully connected (dense) layers, followed by an activation function that formats the output appropriately, such as mapping it to a range or format that represents the probabilities of different classes. When the task involves classifying features of terrorist organizations, the output layer aims to produce outputs suitable for multi-class classification, categorizing organizations into various predefined groups. This functionality is achieved through the use of the Softmax Regression function, a generalization of logistic regression for multi-class classification. According to Fig. 14, the softmax function assigns probabilities to different classes. This makes it ideal for the final layer in neural network architectures designed for classification.

The operation of softmax regression consists of two main steps. First, it computes the likelihood (or evidence) that the input features belong to each class. This is done by calculating a weighted sum of the input features plus a bias term, referred to as the net input z, as shown in Fig. 14.

Softmax regression distinguishes itself by using the softmax function ϕ(⋅) instead of the sigmoid function used in logistic regression. The probability that a particular training example x(i) is assigned to class j, given the net input vector z(i) for all classes, is given by:

(13) P(y=j|z(i))=ϕ(z(i))=ez(i)∑j=1kezj(i)where, z is the net input representing the weighted sum of features x1,x2,...,xm plus a bias term b, expressed as:

(14) z=w1x1+w2x2+…+wmxm+b=∑l=1mwlxl+b=wTx+b

In this context, w is the weight vector, x is the feature vector of a single training example, and b is the bias. Each weight wl corresponds to a feature xl, with m being the total number of features. The softmax function calculates the probability that the training example x(i) belongs to class l, based on the weight vector w and the net input z(i). For each class label j=1,...,K, it computes the probability P(y=j|x(i);wj) by normalizing the exponential of the net input for each class against the sum of exponentials for all class net inputs. This ensures that the sum of probabilities for all classes equals one.

For output computation, a linear combination of input variables xs, along with a bias term, is used to determine the inputs to the softmax function, as shown below:

(15) [y1y2y3]=softmax|W1,1x1+W1,2x2+W1,3x3+b1W2,1x1+W2,2x2+W2,3x3+b2W3,1x1+W3,2x2+W3,3x3+b3|

This calculation is further optimized through matrix operations for enhanced computational efficiency:

(16) [y1y2y3]=softmax([W1,1W1,2W1,3W2,1W2,2W2,3W3,1W3,2W3,3]⋅[x1x2x3]+[b1b2b3])

Applying the softmax function transforms the computed evidence into class probabilities. Given a net input vector z, the softmax function normalizes the exponential values of the net inputs for all classes, ensuring the probabilities sum to one. This normalization allows the model to interpret the outputs as class probabilities and make predictions on the most probable class for each training sample.

Evaluation metrics

To assess the performance of the proposed method for predicting terrorist organizations, several evaluation metrics were employed to provide a comprehensive understanding of the model's generalization ability. The chosen metrics include accuracy (ACC), precision (Precision), sensitivity (Sn), specificity (Sp), and Matthew’s correlation coefficient (MCC). These metrics provide a detailed view of the model’s predictive capabilities (Zhuo et al., 2020).

In the context of classifying and predicting the group responsible for terrorism attacks in the GTD dataset, Sn is crucial as it measures the model’s ability to correctly identify instances where the predicted group is indeed responsible for the attack. This is particularly important for effective counterterrorism measures. Sp assesses the model’s capacity to avoid falsely attributing attacks to certain groups, which is essential for maintaining the credibility and effectiveness of the classification system (Ul Qamar et al., 2024). While ACC is widely used to measure the overall correctness of the model’s predictions, it might be misleading in cases of class imbalance, common in terrorism datasets. In such scenarios, MCC provides a balanced assessment by considering both sensitivity and specificity, offering a nuanced evaluation of the model’s performance (Wang et al., 2020).

(17) ACC=TP+TNTP+TN+FP+FN

(18) Precision=TPTP+FP

(19) Sn=TPTP+FN

(20) Sp=TNTN+FP

(21) MCC=TP×TN−FP×FN(TP+FP)(TP+FN)(TN+FP)(TN+FN)where TP represents true positives, TN represents true negatives, FP represents false positives, and FN represents false negatives. By considering these diverse metrics, we gain a comprehensive understanding of how well our model performs across various aspects of prediction, providing valuable insights into its overall effectiveness.

Experimental parameter settings

Hyperparameters significantly affect the predictive performance of neural network models. Three-fold cross-validation with random search was used to determine the optimal hyperparameters (Cheng, Wang & He, 2021; Aliper et al., 2016; Rimal & Sharma, 2023). During training, the batch size was selected from [16, 32, 64, 128, 256], the number of iterations from [10, 20, 30, 50, 100], the dropout probability from [0.1, 0.3, 0.5, 0.7], and the learning rate from [0.0001, 0.001, 0.01]. The optimized parameters for the BiGRU-SA model include a batch size of 64, 100 iterations, a dropout rate of 0.5, and a learning rate of 0.01. We conducted a comprehensive comparative analysis to assess the effectiveness of the proposed BiGRU-SA model relative to a range of both traditional and advanced machine learning classifiers. The machine learning models selected for this study included bagging, extreme gradient boosting (XGBoost), random forest (RandomForest), extra trees (ExtraTrees), decision tree (DecisionTree), and light gradient boosting machine (LightGBM) (González et al., 2020; Ashraf et al., 2022). Default parameters recommended by scikit-learn (sklearn) for multi-classification problems were applied (Terol et al., 2020; Komer, Bergstra & Eliasmith, 2019). Using default parameters ensures robust initial performance and stability across various datasets, serving as a reliable benchmark for comparative analysis (Wu et al., 2023). The deep learning models included in this study were deep neural networks (DNN), GRU, BiGRU, BiGRU-SA. The DNN architecture comprises four fully connected layers with neuron counts decreasing from 256 to 32, employing the Rectified Linear Unit (ReLU) activation function in each hidden layer (Singh & Sabrol, 2021). This comprehensive selection of classifiers, spanning both traditional ML techniques and advanced DL architectures, provides a solid benchmark for evaluating the capabilities of the BiGRU-SA model in classifying and predicting terrorist organization activities.

Experimental series 1: textual features extracted by DistilBERT

The primary objective of Experimental Series 1, as shown in Table 8, is to assess the performance of various classifiers in identifying types of Gname, focusing on features extracted through DistilBERT. Classifiers were trained and tested using textual features obtained through DistilBERT embeddings. The evaluation includes computing performance metrics such as accuracy, precision, recall, specificity, and MCC to gauge the models’ classification accuracy and predictive capability.

Experimental series 2: all features to text

Experimental Series 2, as shown in Table 9, investigates the impact of concatenating categorical and numerical features with textual features extracted from the GTD dataset. The main goal is to explore how combining different types of features influences the classification and prediction of Gname. Classifiers were trained and tested using the combined features obtained through concatenation. Similar to Series 1, the evaluation process involves computing performance metrics to assess the effectiveness of the concatenated features in improving the classification and prediction of Gname.

Experimental series 3: individual features combination

The third experimental series, as shown in Table 10, explores the combination of features extracted from each individual feature set after conversion. In this series, each feature set is converted individually into a suitable format for processing. Once converted, the features are combined to form a comprehensive feature set for analysis and classification. This series aims to assess the effectiveness of combining features derived from different aspects of the data. By converting and combining each feature set separately, we aim to capture the unique information each feature type provides and evaluate how their combination influences the classification performance.

Generalization ability of the method

This section evaluates how effectively the BiGRU-SA method generalises across various terrorist activity environments, which vary in attack frequencies and levels of organisational involvement. The analysis is grounded in the performance metrics outlined in “Data Preprocessing”, with the addition of the F1-score as a crucial metric. The F1-score, being the harmonic mean of precision and recall, adeptly balances the accuracy and completeness of the model’s predictions, making it especially valuable in contexts where the implications of false positives and negatives are significant for security measures.

The BiGRU-SA framework’s adaptability and effectiveness shine through, consistently outperforming other ML algorithms across all evaluated metrics and datasets in Table 11. The study evaluates the algorithm’s performance depicted in the curves from Figs. 17A to 17E.

In Fig. 17A, where the attack range is greater than or equal to 1,000 with 19 terrorist organizations responsible for 50,200 attacks, we would expect to see high performance across algorithms due to the large number of attacks, which likely results in a rich dataset. BiGRU-SA, in particular, would display a near-perfect curve, illustrating its proficiency in handling dense data with complex patterns, supported by the highest accuracy and precision metrics. Moving to Fig. 17B with greater than or equal to 500 attacks by 36 organizations, the performance curves might show a slight dip compared to Case 1, as the data becomes less concentrated.

Algorithms like BiGRU-SA and random forests would still maintain a high level of accuracy, demonstrating their robustness to variations in data volume and distribution. Moving to Fig. 17C, with greater than or equal to 100 attacks from 122 organizations, the curves would start to show more variation. The increased number of organizations might introduce more noise and variability into the data, explaining why algorithms like decision trees and bagging might display more significant dips in their performance curves. Despite this, BiGRU-SA would continue to maintain a relatively high performance due to its ability to capture and prioritize relevant features. Moreover, as shown from Fig. 17D which represents an even broader range of greater than or equal to 50 attacks across 210 organizations. The performance curves would further spread, with algorithms like XGBoost and ExtraTrees showing steeper declines, as indicated by their lower accuracy and precision. This case illustrates the challenges posed by more distributed datasets with less frequent attacks per organization, making patterns harder to discern.

According to in Fig. 17E, depicting greater than or equal to five attacks by a vast number of 936 organizations, we observed the most significant dips in performance curves, especially for models like bagging and decision trees. However, BiGRU-SA’s curve would remain the highest, although with a noticeable decline compared to previous cases. The increased complexity and noise in the data with many low-frequency attack instances make it challenging for algorithms to maintain high performance. In scenarios with fewer terrorist organizations, as indicated by the performance curves in Fig. 17A through Fig. 17E, the data distribution is less sparse, which considerably benefits models like BiGRU-SA. This allows the model to identify representative patterns with greater accuracy. As such, the accuracy, precision, sensitivity, and F1-scores are notably higher. The improved signal-to-noise ratio in these cases aids the model in distinguishing relevant patterns from irrelevant data effectively, leading to enhanced predictive performance. Moreover, the simpler structure of these datasets enables the model to generalize better across various situations, capturing the underlying trends and dynamics with efficiency. The strength of the BiGRU-SA model is particularly evident in its generalization capabilities, ensuring that it maintains robust performance in diverse settings of terrorist activities. As datasets expand to include a larger number of terrorist organizations, and as the frequency of attacks per organization diminishes, a decline in the performance of all algorithms is observed. Sophisticated models, such as BiGRU-SA, which incorporate self-attention mechanisms, exhibit considerable resilience in the face of these challenges. Moreover, their ability to focus on the most salient features amid data noise and to manage the complexities and imbalances of the datasets becomes apparent. This capability is especially valuable as datasets grow more complex, underscoring the critical role of algorithm selection and its contribution to handling intricate classification tasks.

In the second scenario, the study evaluates the proposed framework’s performance using a 10-fold cross-validation approach alongside the hold-out method. Using the hold-out method, the model’s performance is assessed on data it has not encountered during the training phase. This approach offers a more accurate estimate of the model’s behaviour on new, unseen data. The hold-out method is widely utilised for model selection, hyperparameter tuning, and comparing the performance of various models. Additionally, this method gauges the model’s resilience and efficiency in addressing data imbalances, a common challenge in this field.

Table 12 further explores the performance of various models under two data split verification methods in scenarios with attack frequencies over 500, offering a detailed comparison to understand the framework’s adaptability and reliability in handling complex datasets. The 10-fold cross-validation approach is a rigorous evaluation method that simulates real-world data conditions by repeatedly splitting the available data into training and testing sets.

This process ensures the model is not simply memorising specific patterns in the training data but can genuinely learn and generalise to unseen instances. When applied to the BiGRU-SA method, the 10-fold cross-validation results solidify its potential as a valuable tool for counter-terrorism efforts.

Firstly, the BiGRU-SA method consistently outperforms other models across various evaluation metrics in both the hold-out and 10-fold cross-validation approaches (as shown in Table 12). This indicates its ability to learn robust patterns even with data fragmentation introduced by cross-validation. This is particularly impressive considering the inherent challenges of data imbalance in this domain, where the number of attacks from specific organisations might be significantly lower than others.

Secondly, focusing specifically on the 10-fold cross-validation scenario, we observe that the BiGRU-SA method maintains high accuracy, precision, recall, and F1-scores across all folds. This consistency further emphasises its ability to handle data imbalance and effectively generalise to unseen data points. The 10-fold process presents the model with various challenges through cross-validation. It throws a series of data subsets at the model, testing its ability to adapt and learn from each unique combination. The BiGRU-SA method consistently overcomes these challenges, showcasing its remarkable resilience and generalizability. These findings suggest that the proposed framework with the BiGRU-SA method is a high-performing model in controlled settings and a practical and reliable tool for real-world applications. Its ability to handle data imbalance and generalise across diverse scenarios, as demonstrated by the 10-fold cross-validation results, makes it a valuable asset in the fight against terrorism.

Comparison with existing approaches

In this section, the study comprehensively compares our framework with the BiGRU-SA model against existing methodologies as highlighted in studies (ALfatih, Li & Saadalla, 2019; Bangerter et al., 2022; Talreja et al., 2017). This comparison showcases our framework’s advancements over traditional ML techniques, referenced in Table 13. Through performance metrics analysis for varying terrorist attack scenarios and terrorism organisation numbers, the proposed framework demonstrates superior accuracy and adaptability, especially in addressing data imbalances. This comparative discussion reveals our model’s enhanced capability to predict and analyse terrorist activities more precisely, contributing significantly to counter-terrorism research. The comparison primarily focuses on accuracy and F1-score. The accuracy pinpoints the overall correctness of predictions, gauging the model’s general classification ability.

In counter-terrorism scenarios, both accuracy and identifying true positives hold immense significance. F1-score balances precision (identifying true positives) and recall (not missing true positives), offering a more nuanced performance view, especially critical for imbalanced datasets like GTD. False positives can lead to severe repercussions while missing true positives hampers prevention efforts. As shown in Table 13 the proposed model exhibits a marked improvement in accuracy and F1-score, achieving 98.6% and 96.27% respectively, surpassing other cited studies. Furthermore, the proposed model considers more terrorist organizations (36 groups) than the 20 groups analyzed in other studies, suggesting a broader application range. The higher accuracy and F1-score, combined with a broader scope of terrorist organization classification, highlight the model’s superior performance. As presented in Fig. 18 this significant improvement implies that our model generalises terrorist organisations better and correctly classifies them while minimising false positives. Furthermore, including 36 organisations in our assessment adds another validation layer to our model’s robustness. By successfully handling a more extensive and potentially more intricate dataset with potential data sparsity issues, our model demonstrates its broader applicability and adaptability to complex scenarios.