Social Network Intelligence Analysis to CombatStreet Gang Violence

Damon Paulo, Bradley Fischl, Tanya Markow, Michael Martin, Paulo ShakarianNetwork Science Center and

Dept. of Electrical Engineeringand Computer ScienceU.S. Military AcademyWest Point, NY 10996

{damon.paulo, bradley.fischl, tanya.markow, michael.martin1} @usma.edu, paulo@shakarian.net

Abstract—In this paper we introduce the Organization,Relationship, and Contact Analyzer (ORCA) that is designedto aide intelligence analysis for law enforcement operationsagainst violent street gangs. ORCA is designed to addressseveral police analytical needs concerning street gangs usingnew techniques in social network analysis. Specifically, it candetermine “degree of membership” for individuals who do notadmit to membership in a street gang, quickly identify sets ofinfluential individuals (under the tipping model), and identifycriminal ecosystems by decomposing gangs into sub-groups.We describe this software and the design decisions consideredin building an intelligence analysis tool created specifically forcountering violent street gangs as well as provide results basedon conducting analysis on real-world police data providedby a major American metropolitan police department who ispartnering with us and currently deploying this system forreal-world use.

Keywords-complex networks; social networks; criminology

I. INTRODUCTION

Violent street gangs are a major cause of criminal activityin the United States [1]. In this paper, we present a newpiece of software, Organizational, Relationship, and ContactAnalyzer (ORCA) that is designed from the ground-up toapply new techniques in social network analysis and miningto support law enforcement. In particular, we look to enableimproved intelligence analysis on criminal street gangs. Thesoftware combines techniques from logic programming, [2]viral marketing, [3], [4] and community detection [5], [6]in a usable application custom-tailored for law enforcementintelligence support. This work is inspired by recent workin law enforcement that recognizes similarities betweengang members and insurgents and identifies adaptationsthat can be made from current counter-insurgency (COIN)strategy to counter gang violence. [1], [7] Due to the strikingsimilarities between gang-violence and COIN, the authorsfrom the U.S. Military Academy (West Point) respondedto requests from a major metropolitan police department totransition recent social network mining software. As a result,several West Point cadets were able to not only conduct

research, but also gain a better understanding of a COINenvironment.

The main contribution of this paper is the ORCA softwarewhich is the first software, to our knowledge, that combinethe aforementioned techniques into a single piece of softwaredesigned for law-enforcement intelligence analysis. Thepaper is organized as follows. Section II describes ORCAand its various components while Section III provides theresults of our preliminary evaluation. Finally, related workis discussed in Section IV.

II. SYSTEM DESIGN AND IMPLEMENTATION

The police department we worked with to develop ORCAdescribed several issues concerning the intelligence analysisof street gangs. They desired a software system that couldaccomplish the following tasks.

1) Ability to ingest police arrest data and visualize net-work representations of such data. The police datain question primarily consists of arrest reports whichinclude the individual’s personal information as wellas claimed gang membership (if disclosed). This dataalso includes relationships among individuals arrestedtogether.

2) Ability to determine degree of group membership.While many gang members will disclose their gangaffiliation, some will not - likely fearing legal conse-quences. Hence, to better allocate police efforts andintelligence gathering resources, it is important toassign these unaffiliated members to a gang (with adegree of confidence).

3) Ability to identify sets of influential members. Thoughcriminal street gangs are decentralized, it is suspectedthat there are groups of individuals that can exert influ-ence throughout a given gang - encouraging criminalactivity that is more violent and risky than the norm.Identifying groups of individuals in this position of in-fluence would provide law enforcement professionalsinsight into the ability of these organizations to easilyadopt such behavior.

arX

iv:1

306.

6834

v1 [

cs.S

I] 2

8 Ju

n 20

13

Arrest record data

yCreate social network

Compute degree of membership (MANCaLogframework)

Identify core members of gangs or factions (TIP_DECOMP)

Determine gang ecosystems

y

Partition network to identify sub-groups(Louvain Algorithm)

Identify connectors

Report generation

Figure 1. Overview of components and functions of ORCA.

4) Ability to map the “ecosystem” of a given gang.Criminal street gangs tend to be highly modular orga-nizations, with identifiable sub-groups. In particular,“corner crews” - groups of individuals in a gangwho conduct illicit drug transactions on the samestreet corner - will form highly connected clustersin a social network representation of a street gang.Further, understanding the relationships among thesesub-organizations - both within a given gang andbetween different gangs provides substantial insightinto inter/intra gang dynamics as well as in identifyingindividuals that connect different organizations.

Note that all of the above described functions wereincluded in ORCA in a direct response to the needs ofthe law enforcement professionals that we have met. Theseindividuals are directly from our target user population towhom we are transitioning the software to in mid-2013.

ORCA was written in Python 2.7.3 on top of the Net-workX 1.7 library 1. In Figure 1 we show our overallscheme for the design of ORCA to address the abovechallenges. The key components we leveraged in buildingthe system included the MANCaLog framework which weused to determine degree of membership, TIP DECOMPwas leveraged to find sets of influential members, and theLouvain algorithm which we built on to map the ecosystemsof the various gangs. We describe how we designed eachmajor part throughout the remainder of this section.

Police data was ingested into the system in the form ofspreadsheet data that was derived from SQL queries froma police database. For purposes of development and ex-perimental evaluation, all personally-identifying informationwas anonymized. From this data, we utilized the “individualrecord” number of each person arrested and created a socialnetwork between two individuals that were arrested together(co-arrestees). To handle this network data structure, weutilized the Python library NetworkX mentioned earlier. Thepolice also required visualizations of these social networks

1http://networkx.github.io/documentation/latest/index.html

(which are shown later). These visualizations were alsoincluded in the context of intelligence reports automaticallygenerated by the software (which are based on the subse-quently described components).

A. Determining Degree of Membership

Analytically associating arrested individuals with a crim-inal gang is an important piece of intelligence to lawenforcement officials. Even though analysis itself is notdirect evidence against an individual, it may be used as astarting point to gather further information. Individuals whodo not admit to being in a gang may still have associates thatdo admit to membership of a certain gang. Hence, we lookedto contribute to the solution to this problem by assigningsuch individuals a degree of membership - a real number inthe interval [0, 1] that represents the confidence that the in-dividuals is in a given gang. A value of 0 may be interpretedas having no information on the individual’s affiliation witha given gang while a value of 1 would be interpreted as theindividual as having admitted to being in the gang. To assignthese degree of membership values, we utilize MANCaLog,a logic-programming based framework [2]. This frameworkconsiders a network represented as a graph G = (V,E)where V is a set of vertices and E is a set of (undirected)relationships. For a given i ∈ V , ηi = {j|(i, j) ∈ E} anddi = |ηi|. The vertices can be assigned with a label from theset L. Each label assigned to a vertex is given a value (inthe interval [0, 1] which associates that label with the vertexwith a degree of confidence. Hence, we use of networkrepresentation of the co-arrestees as the graph and the setof different gangs are the labels. Individuals who are knownto be in a certain gang are assigned a confidence value of1 for that gang and 0 for the others. Through MANCaLog,we can then assign a degree of confidence to the remainingnodes derived from rules of the following form:

grp1 ←∨i

¬〈grpi, 1〉, (grp1)ifl (1)

Intuitively, the above rule says that a node will be assignedto group 1 if it has not already been assigned to anothergroup (with a confidence of 1) and has a certain numberof neighbors who are also in group 1. A set of such rulesis referred to as a MANCaLog program and denoted P . Aprogram may also have facts of the form (〈grpi, x〉, v) whichmeans that vertex v has a degree of membership in group iwith a confidence of x.

In the above rule, the confidence value assigned to a nodebeing in group 1 is based on the influence function (ifl )which maps natural numbers to reals in the interval [0, 1].For instance, an influence function may look something likethe following:

Algorithm 1 IFL LEARNRequire: Group label g, program P

Ensure:1: Let R be an array indexed from 1 to d∗ (the maximum degree

of the network).2: for i = 1, . . . d∗ do3: Set pos = 0, tot = 04: for v ∈ V do5: Set Xv = {v′|(v′, v) ∈ E ∧ (〈g, 1〉, v′) ∈ P}6: if |Xv| ≥ i then7: tot = tot+ 18: if (〈g, 1〉, v) ∈ P then9: pos = pos+ 1

10: end if11: end if12: end for13: If i = 0, R[i] = pos/tot − 1.96 ∗ SER(pos, tot),

else R[i] = max(R[i − 1], pos/(pos + neg) − 1.96 ∗SER(pos, tot)) where SER is the standard error on thefraction of positive neighbors.

14: end for15: return R

ifl(x) =

0.0 if x = 0

0.1 if 1 ≤ x ≤ 3

0.5 if x ≥ 4

(2)

In [2], the authors showed that such confidence valuescan be assigned to all vertices in the network for all labelsin polynomial time. However, a key issue is to derive theinfluence function for the rules. We devised a simple strategyfor learning the influence function for each label (in this casegroup) and have included it as algorithm IFL LEARN.

Algorithm IFL LEARN considers one group label (g) andfinds the fraction of neighbors. We view each node as getting“signals” from its neighbors who are in that group. Foreach potential number of signals (which is between one andthe maximum in-degree of the network) Algorithm 1 belowcomputes the fraction of nodes with at least that number ofsignals who are in the group. It then computes the 95% lowerbound confidence interval based on standard error. This isused as the lower bound of the degree of membership asreturned by the function. Then, based on an assumption ofmonotonicity (based on the results of [8]), the algorithm setsthe lower bound to be the maximum between the previouslower bound and the current.

The algorithm returns a matrix R, and the resultinginfluence function is ifl(x) = R[x]. This algorithm is asimple approach to learning rules from available data and nonovelty is claimed; more complex and general approachesto rule learning are outside the scope of this paper and arethe topic of ongoing work.

B. Identifying Seed Sets

According to the law enforcement professionals we met,the idea of influence is critical to understanding the behaviorof violent street gangs. Of particular concern is the influenceof radicalizing gang members - charismatic individuals thatnot only participate in abnormally risky and violent behavior,but have the ability to encourage others to do the same.In order to identify sets of individuals who conduct suchbehavior, we consider the idea of influence spread throughthe “tipping model” [9]. In such a model, we again considera population structured as a social network (G = (V,E))where each vertex i ∈ V is adjacent to di edges. Wemodel a social contagion that spreads through the networkas follows: consider unaffected node i. If at least ddi/2e ofi’s neighbors have the contagion, then i has the contagion –otherwise it does not. A key question regarding this modelis to identify a seed set - a set of vertices in the networkthat, if initially infected, will lead to the entire populationreceiving the contagion. Identifying a seed set provides theanalyst a set of individuals that, when taken together, arevery influential to the overall network. Further, if the seedset is of minimal size, then the size of the set can be used as aproxy to measure how easily the network can be influenced.Unfortunately, a simple reduction from set cover shows thatfinding a seed set of minimal size is an NP-hard problem. [3]However, we have designed a fast heuristic algorithm thatfinds seed sets of very small size in practice. [4] Thisalgorithm is based on the idea of shell decomposition oftencited in physics literature [10], [11], [12], [13] but modifiedto ensure that the resulting set will lead to all nodes beinginfected. The algorithm, TIP DECOMP is presented in thissection.

Algorithm 2 TIP DECOMPRequire: Threshold function, θ and directed social network

G = (V,E)Ensure: V ′

1: For each vertex i, disti = bdi/2c.2: FLAG = TRUE.3: while FLAG do4: Let i be the element of V where disti is minimal.5: if disti =∞ then6: FLAG = FALSE.7: else8: Remove i from G and for each j in ηi, if distj > 0,

set distj = distj − 1. Otherwise set distj =∞.9: end if

10: end while11: return All nodes left in G.

Intuitively, the algorithm proceeds as follows (Figure 1).Given network G = (V,E),at each iteration, pick the nodefor which bdi/2c is the least but positive (or 0) and remove

Figure 2. Example of TIP DECOMP for a simple network depicted inbox A. Next to each node label (lower-case letter) is the value for bdi/2c.In the first four iterations, nodes e, f, h, and i are removed resulting in thenetwork in box B. This is followed by the removal of node j resulting inthe network in box C. In the next two iterations, nodes a and b are removed(boxes D-E respectively). Finally, node c is removed (box F). The nodes ofthe final network, consisting of d and g, have negative values for bdi/2cand become the output of the algorithm.

it. Once there are no nodes for which this quantity is positive(or 0), the algorithm outputs the remaining nodes in thenetwork.

In addition to providing the seed set for each streetgang, ORCA also provides information about influentialindividuals. The shell number for each vertex based on theprocess of shell decomposition [10] has been previouslyshown to correlate with the vertex’s influence based on thenetworked version of various epidemic models. [12]

C. Identifying Ecosystems

Another important capability for ORCA was to decom-pose street gangs into component organizations. In somecases, street gangs will not be monolithic organizations, butrather confederations of various factions - many of whichmay be ill identified by authorities. Further, to maintain agang’s lines of funding, sub-organizations known as “cornercrews” operate as an informal unit to conduct narcotics saleswithin certain parts of a given gang’s territory.

A common method to identify communities in a socialnetwork is to partition it in a way to maximize a quan-tity known as modularity. [5] We shall use the notationC = {c1, . . . , cq} to denote a partition over set V whereeach ci ∈ C is a subset of V , for any ci, cj ∈ C,ci ∩ cj = ∅ and

⋃i ci = V . For a given partition, C, the

modularity M(C) is a number in [−1, 1] . The modularityof a network partition can be used to measure the quality ofits community structure. Originally introduced by Newmanand Girvan [5], this metric measures the density of edgeswithin partitions compared to the density of edges between

partitions. A formal definition of this modularity for anundirected network is defined as follows.

Given partition C = {c1, . . . , cq}, modularity,

M(C) =1

2m

∑c∈C

∑i,j∈c

wij − Pij

where Pij =kikj

2m .The modularity of an optimal network partition can be

used to measure the quality of its community structure.Though modularity-maximization is NP-hard, the approxi-mation algorithm of Blondel et al. [6] (a.k.a. the “Louvainalgorithm”) has been shown to produce near-optimal parti-tions.2 The modularity associated with this algorithm is oftencalled the “Louvain modularity” and the associated partitionis a “Louvain partition.”

ORCA not only finds the Louvain partition, but alsoexplores the relationships among the sub-groups within andbetween gangs. For a given gang, ORCA generates a graphshowing the relationship among all sub-groups in that gangand the neighboring sub-groups from different gangs. Wecall this the “ecosystem” of a given gang. The ecosystemis of particular importance to law-enforcement officers formany reasons. One, in particular, is the issue of gangretaliation. Consider the following: in the aftermath of aviolent incident initiated by group A against group B, policeenforcement will increase patrols in the territory controlledby group B. As a result, group B will rely on an alliedorganization (group C) to conduct retaliatory action againstgroup A. Identifying the ecosystem of a given gang helpsprovide insight into organizations likely to conduct suchactivities.

Further, it identifies individuals who have connections tovarious other sub-groups. The intuition behind these indi-viduals is that they connect various organizations together.We refer to these individuals as “connectors.” Connectorsare also important to law-enforcement personnel as theyare individuals who often connect geographic disparatesub-groups of a larger gang organization. Another use forconnectors is as a liaison between gangs that cooperate. Forinstance, suppose group 1 wants to sell drugs in group 2’sterritory. An agreement is reached between the two groupsthat group 1 can conduct these sales provided it pays a taxto group 2. Hence, a liaison between the two groups maybe a facilitator in such an arrangement.

III. EVALUATION

We evaluated ORCA on a police dataset of 5418 arrestsfrom a single police district over a three period of time.There were 11, 421 relationships among the arrests. Fromthis data, ORCA assembled a social network consisting of1468 individuals (who were members in one of 18 gangs)

2Louvain modularity was computed using the implementation availablefrom CRANS at http://perso.crans.org/aynaud/communities/.

0.2

0.4

0.6

0.8

1

0 2 4 6 8

Deg

ree

of

Mem

ber

ship

Number of Neighbors

G197

G258

G422

G034

G322

Figure 3. Influence functions for five of the gangs examined by ORCA.

and 1913 relationships. ORCA was able to complete thisassembly in addition to all analysis (determining degree ofmembership, finding seed sets, and developing ecosystems)took 34.3 seconds on a commodity laptop (Windows 8, B9602.2 GHz processor with 4 GB RAM).

A. Degree of Membership

First, we examined the performance of the system inidentifying degree of membership. As stated earlier, thiswas determined using our MANCaLog framework that op-erated in two steps: learning the influence functions andthen applying the MANCaLog inference engine to computedegree of membership. Figure 3 shows a plot of the influencefunctions derived for five of the gangs. Specifically, it showsthe number of neighboring individuals in the given gang onthe x-axis compared to the computed degree of membershipfor an individual having that number of gang contacts on they-axis. We note that our degree of membership computationprovides a similar result to [8] which studies the relatedproblem of social contagion.

In the second step required to determine the degree ofmembership, the MANCaLog inference engine created logicprograms that utilized the influence functions to determinedegree of membership for individuals who did not admitto being in a gang. All of the 180 unadmitted individualsconnected to the derived social network (individuals whodid not admit to being in a gang but were arrested with atleast one other individual in the district) were assigned anon-zero degree of membership based on learned rules. Themajority of these individuals could be assigned a degreeof membership greater than 0.5 for at least one gang (seeFigure 4). We note that many of these individuals wereassigned a degree of membership to multiple gangs. Thismay primarily be due to the fact that the included arrestreports spanned a three-year time-frame - which our policecounterparts state is a relatively long period of time instreet gang culture. In such a time, gang members oftenchange allegiances and/or form new gangs. Exploring alongitudinal study where time is explicitly considered isan important direction for future work. The MANCaLogframework allows for temporal reasoning as well.

0

50

100

150

200

Nu

mb

er

of

Ind

vid

ual

s

Degree of Membership

(0.0,0.1) [0.1,0.2) [0.2,0.3) [0.3,0.4)

[0.4,0.5) [0.5,0.6) [0.6,1.0)

Figure 4. Histogram showing the number of individuals assigned a degreeof membership within a certain range.

0

10

20

30

40

50

60

G1

75

G2

58

G3

22

G3

36

G4

22

G4

65

G6

26

G6

72

G9

86

G0

34

G1

97

G2

37

G3

83

G6

51

G8

09

G8

14

G8

15

G8

46

Seed

Set

Siz

e (

% o

f To

tal)

Street Gang

GROUP A GROUP B

Figure 5. Seed size as a percentage of the total gang membership forthe 18 street gangs analyzed by ORCA organized into two different racialgroups.

B. Seed Set Identification

We also examined the seed sets found by ORCA for eachof the street gangs. These are sets of individuals who caninitiate a social cascade (under the majority threshold tippingmodel) that will cause universal adoption in the gang. Thesize of the seed set as a percentage of the population of eachgang is shown in Figure 5. The street gangs in the policedistrict we examined were racially segregated - belongingto one of two races. Police officers working in the districthave told us that gangs of Racial Group A are known fora more centralized organizational structure while gangs ofRacial Group B have adopted a decentralized model. Thesegroups are denoted in Figure 4. We were able to quantifythis observation as the gangs in Racial Group A had (onaverage) seed sets 3.86% smaller than those in Group B.

C. Finding Communities and Identifying Ecosystems

As stated earlier, law enforcement personnel have muchinterest in identifying sub-organizations of a given streetgang. ORCA tackled this problem using the Louvain algo-rithm as described in the previous section. For the 18 streetgangs examined in this study, ORCA identified subgroupsfor each in an attempt to optimize modularity. As modularityapproaches 1.0, the communities produced by the algorithmbecome more segregated. We show the modularity valuesin Figure 6. Again, we also noticed a difference in theorganizational structure based on the gang’s race (aligning

00.10.20.30.40.50.60.70.80.9

1

G1

75

G25

8

G32

2

G33

6

G42

2

G4

65

G62

6

G67

2

G98

6

G03

4

G1

97

G23

7

G38

3

G65

1

G80

9

G8

14

G81

5

G84

6

Lou

vain

Mo

du

lari

ty

Street Gang

GROUP A GROUP B

Figure 6. The modularity of the partition found with the Louvain algorithmfor each gang.

with anecdotal police observations). Gangs associated withRacial Group A (more centralized) had lower modularityscores (by an average of 11.2%) than gangs associatedwith Racial Group B (decentralized). This also correspondswith police observations that gangs affiliated with RacialGroup B tend to operate in smaller factions (where the gangorganizations server more as a confederation) as opposedto gangs affiliated with Group A (which are typically morehierarchical).

The creation of a gang’s ecosystem (as described earlier)is derived directly from the result of the Louvain parti-tion. Sub-groups identified with the partition are connectedtogether based on social links between members or bymembers who claim to be in more than one gang. Such anecosystem is shown in Figure 7. ORCA also provides an an-alytical report of an ecosystem listing all sub-group relationsand the strength of the relations (based on number of socialties between organizations) (see Figure 8). Additionally,ORCA also could identify individuals that connected variousorganizations. Example output of this feature is shown inFigure 9.

D. User Interface

Another priority in developing ORCA was to make thesoftware accessible to a variety of police personnel. Wecreated a user interface using the TKinter library version 8.53

and provided network visualizations using Matplotlib 1.2.04.As displayed in Figure 10, the users can utilize the interfaceto easily run new analysis using arrest and relationship datataken from the result of a database query. They can alsoview the reports generated by completed analyisis. When theanalysis is complete, the law enforcement personnel have theability to view a full report that is automatically generated ina portable document format (PDF) using version 1.7 of thePyFPDF library5. This is useful because it is a widely usedformat that is familiar to most users. In addition to the fullreport, the users can also view specific reports or network

3http://wiki.python.org/moin/TkInter4http://matplotlib.org/5https://code.google.com/p/pyfpdf/

Figure 7. An example ecosystem for one of the gangs analyzed by ORCA.

Figure 8. An example ecosystem analysis for one of the gangs analyzedby ORCA.

Figure 9. An example report of connectors within one of the gangsanalyzed by ORCA.

visualizations which allows them to easily view the resultsof the analysis that has been conducted. Finally, we wouldlike to note that this is a draft interface that we will refinethroughout the summer of 2013 by conducting studies in thefield as law enforcement personnel utilize the software. Weplan to incorporate the feedback that we gather into further

Figure 10. The ORCA user interface with network visualization and PDFreport output.

versions of the software so that it becomes a more usefuland usable tool.

IV. RELATED WORK

There have been several other pieces of software intro-duced for both general purpose network analysis as well asfor law enforcement. The main contribution of the softwarepresented in this paper if the ORCA software. ORCA is thatit is tailor made for specific police requirements dealing withviolent street gangs. Further, it leverage new articiial intel-lignece and data mining techniques such as MANCALogand TIP DECOMP. Although ORCA is the first attempt tocombine these techniques in a piece of intelligence analysissoftware, there have been other efforts to build softwaredesigned for social network-based intelligence analysis thatwe describe below.

Previous software designed to support law-enforcementthrough social network analysis include CrimeFighter [14]and CrimeLink [15]. However, these tools provide comple-mentary capabilities to ORCA. While ORCA is primarilydesigned for intelligence analysis with respect to streetgangs, CrimeLink is designed to support investigations whileCrimeFighter is directed more toward targeting of individ-uals in criminal organizations - rather than understandingmembership in and linkages between sub-groups. Further,neither of these software packages support degree of mem-bership, seed set identification, or the creation of ecosystems.

General-purpose social network analysis software alsoexist, including the Organization Risk Analyzer (ORA) [16],and NodeXL (an add-on to Microsoft Excel) [17]. Whilethese tools are very powerful and contain many features,they do not provide the degree of membership calculation orthe identification of seed sets as ORCA does. ORCA is alsopurposely designed for police intelligence analysts to betterunderstand street gangs, and features such as communityfinding in ORCA are designed for with this application inmind (hence the creation of ecosystems and identificationof inter-group connectors). This nuanced use of communitydetection for street gang intelligence analysis is not ready

for use “out of the box” in a general-purpose social networkanalysis package such as ORA or NodeXL.

V. CONCLUSION

In this paper we introduced ORCA - the Organizational,Relationship, and Contact Analyzer - a tool designed fromthe ground-up to support intelligence analysis to aide lawenforcement personnel in combating violent street gangs.We have shown how ORCA can meet various police analysisneeds to include determining degree for gang members ofunknown affiliation, identifying sets of influential individualsin a gang, and finding and analyzing the sub-organizationsof a gang to determine inter/intra-group relationships.

Our next step with regard to this work is to integrategeospatial and temporal elements in the analysis - partic-ularly with respect to community finding and degree ofmembership. Currently we are working closely with a majormetropolitan police department to transition ORCA for usein law enforcement. Throughout the summer of 2013, we aresending project assistants to work closely with the police inorder to identify additional police requirements that can beaddressed with techniques similar to those discussed in thispaper. Currently the police are employing this analysis forone district. There are plans to expand to other districts inlate 2013.

ACKNOWLEDGMENT

The authors are supported under by the Army ResearchOffice (project 2GDATXR042) and the Office of the Sec-retary of Defense. The opinions in this paper are those ofthe authors and do not necessarily reflect the opinions of thefunders, the U.S. Military Academy, or the U.S. Army.

REFERENCES

[1] J. Bertetto, “Countering criminal street gangs: Lessons fromthe counterinsurgent battlespace,” Law Enforcement ExecutiveForum, vol. 12, no. 3, p. 43, 2012.

[2] P. Shakarian, G. I. Simari, and R. Schroeder, “MANCaLog: Alogic for multi-attribute network cascades,” in Proc. of 26thIntl. Conf. on Autonomous Agents and Multiagent Systems(AAMAS), May 2013.

[3] D. Kempe, J. Kleinberg, and E. Tardos, “Maximizing thespread of influence through a social network,” in KDD’03: Proceedings of the ninth ACM SIGKDD internationalconference on Knowledge discovery and data mining. NewYork, NY, USA: ACM, 2003, pp. 137–146.

[4] P. Shakarian and D. Paulo, “Large social networks can betargeted for viral marketing with small seed sets,” in Proc.2012 IEEE/ACM Intl. Conf. on Advances in Social NetworksAnalysis and Mining (ASONAM-12), Aug. 2012.

[5] M. E. J. Newman and M. Girvan, “Finding and evaluatingcommunity structure in networks,” Phys. Rev. E, vol. 69,no. 2, p. 026113, Feb 2004.

[6] V. Blondel, J. Guillaume, R. Lambiotte, and E. Lefebvre,“Fast unfolding of communities in large networks,” Journalof Statistical Mechanics: Theory and Experiment, vol. 2008,p. P10008, 2008.

[7] E. Goode, “Combating gang warfare with green beret tactics,”The New York Times, Apr. 2012.

[8] D. Centola, “The Spread of Behavior in an Online SocialNetwork Experiment,” Science, vol. 329, no. 5996, pp. 1194–1197, Sep. 2010.

[9] M. Granovetter, “Threshold models of collective behavior,”The American Journal of Sociology, no. 6, pp. 1420–1443.

[10] S. B. Seidman, “Network structure and minimum degree,”Social Networks, vol. 5, no. 3, pp. 269 – 287, 1983.

[11] S. Carmi, S. Havlin, S. Kirkpatrick, Y. Shavitt, and E. Shir,“From the Cover: A model of Internet topology using k-shelldecomposition,” PNAS, vol. 104, no. 27, pp. 11 150–11 154,2007. [Online]. Available: http://www.pnas.org/cgi/content/abstract/104/27/11150

[12] M. Kitsak, L. K. Gallos, S. Havlin, F. Liljeros, L. Muchnik,H. E. Stanley, and H. A. Makse, “Identification of influentialspreaders in complex networks,” Nat Phys, vol. 6, no. 11, pp.888–893, Nov. 2010.

[13] G. J. Baxter, S. N. Dorogovtsev, A. V. Goltsev, and J. F. F.Mendes, “Heterogeneous k-core versus bootstrap percolationon complex networks,” Phys. Rev. E, vol. 83, May 2011.

[14] R. Petersen, C. Rhodes, and U. Wiil, “Node removal incriminal networks,” in Intelligence and Security InformaticsConference (EISIC), 2011 European, Sep. 2011, pp. 360 –365.

[15] J. Schroeder, J. Xu, and H. Chen, “Crimelink explorer: Usingdomain knowledge to facilitate automated crime associa-tion analysis,” in Intelligence and Security Informatics, ser.Lecture Notes in Computer Science, H. Chen, R. Miranda,D. Zeng, C. Demchak, J. Schroeder, and T. Madhusudan, Eds.Springer Berlin Heidelberg, 2003, vol. 2665, pp. 168–180.

[16] K. M. Carley, “Ora: Organization risk analyzer,” CMU CA-SOS, Tech. Rep. January, 2004.

[17] D. Hansen, B. Shneiderman, and M. A. Smith, AnalyzingSocial Media Networks with NodeXL: Insights from a Con-nected World. San Francisco, CA, USA: Morgan KaufmannPublishers Inc., 2010.