Predictive OSINT in Cyber Peacekeeping

Abstract

Peacekeeping faces a period of renewal due to the need to analyze large amounts of different types of data regarding conflict scenarios, mitigating the informational risk involved, ensuring accountability and preserving public trust in an age of asymmetric security threats. The confluence of artificial intelligence and other dual-use technologies requires peacekeeping to foresee new challenges in the cyber domain as a new conflict scenario, to improve the security of peacekeepers and civilian populations. In this context, cyber peacekeeping can be defined, not only as peacekeeping in cyberspace but, as the application of cyber potential in any domain to preserve peace. This study addresses cyber peacekeeping from a cyber intelligence perspective, with the use of artificial intelligence in order to analyze and investigate through OSINT and Sentiment Analysis on social media, some potential instabilities and dangerous situations in critical areas. The final goal is to support organizations in investigating the society's thinking through social media and develop strategies to prevent potential anomalies, with the aim of ensuring better security in a peacekeeping mission.

keywords: cyber peacekeeping, intelligence, osint, machine learning, sentiment analysis

Introduction

Cyber intelligence is a central issue today as demonstrated, for example in Italy, by the urgent establishment of a National Cybersecurity Agency to implement measures for a safer country in the cyber domain in close connection with the Intelligence. By 2030, as declared by the United Nations, the whole world will be connected to the Internet and consequently monitored. Therefore, the cyber domain will become even more the central area of the human dimension, in all fields from economics to politics, from information to education, with an unavoidable change in the resulting geopolitical dimensions. It is no longer only those who control the sea, the land or the air who will have a geopolitical view of the world, but rather those who, through cyberspace, control people's minds that will constitute the new battlefield equipped with strategic weapons such as the misuse of social media in various dimensions such as information manipulation, deception by activists, disinformation or threats on the net. At the same time, in an increasingly militarized Internet, cyber warfare is becoming more and more prominent in future conflicts, requiring new solutions to support governments in securing their assets, and cyberspace has become the domain of choice for destabilization campaigns and hostile activities not feasible in a conventional domain.

For the UN, cyber peacekeeping is an emerging multidisciplinary research field that touches on technical, political, governmental and social domains of thought. In this respect, cyber peacekeeping can be defined, not only as decisive support to peacekeeping in cyberspace, but also as the application of cyber capabilities in any domain (Robinson et al., 2018), including the physical one, in order to preserve peace.

Despite the countless challenges for the implementation of a cyber peacekeeping force, this concept can be integrated into the existing UN peacekeeping organizational structure as a solution to address the cyber component of future conflicts in crisis areas. In addition, the new UN Peacekeeping Digital Transformation Strategy published in August 2021 (Guterres, 2021) shows the need for a data-driven approach and the use of technology, especially given the increasing data volumes, mainly due to the growing of Internet access and the use of smartphones (Dorn, 2016) in peacekeeping mission target countries, which has resulted in a technologically driven transformation of the operational setting. Important implementations in the areas of artificial intelligence and machine learning are to be added, with some promising initiatives for UN operations. For example, the MINUSMA mission in Mali uses machine learning to detect hate-speech in radio data in order to alert for potential unrest and the MONUSCO mission in Congo uses social media monitoring and artificial intelligence in order to detect the perception of the mission on the population. 

The potential of artificial intelligence tools also lies in supporting peacekeeping in conflict prediction, as demonstrated by several studies (Blair et al., 2017) in order to understand conflict dynamics and be able to design missions that are more suitable to prevent the re-emergence of new conflicts. Analysis through machine learning can also improve prevention capabilities (Duursma and Karlsrud, 2019) thus avoiding the situation of establishing a mission for the first time, or at the tactical level, allowing a more intelligent allocation of resources for daily tasks (Horowitz et al., 2018).

Advances in Natural Language Processing (NLP) are in addition as tools for translation and interpretation and improve interoperability in multinational missions and in facilitating communication with the local population. Moreover, the language processing capability offers methodologies to analyze open-source information especially from social media platforms. By accessing to different types of information and in large quantities, it is possible to equip peacekeeping missions with a better comprehension of the operational environment, as well as to provide decision-making-based contingency response as part of the intelligence cycle (Dorn, 2016). The UN, aware of the possible benefits, is making efforts to make the best use of these new technologies, e.g. the Joint Mission Analysis Centers (JMACS) aim at a more integrated and predictive data-driven approach to peacekeeping with detailed reports. Nevertheless, the shift from awareness to regulation and resource commitment at the systemic level has yet to be realized.

This study was conducted in the context of an internship period between CoESPU and the II level Master in Intelligence and ICT at University of Udine. 

The study proposes an approach to cyber peacekeeping through a cyber intelligence system that uses OSINT, NLP and Deep Learning, carrying out a Sentiment Analysis on social media in order to identify anomalies in the trend of sentiment that detect potential situations of instability especially in critical areas, theatre of peace missions. The proposed solution is a scalable and modular system that goes from the collection of data to the classification of sentiment, up to the detection of anomalies as an index of potential situations to investigate in order to improve the security of a peace mission.

The main feature of the system is its applicability to different study crisis areas, including specific reference topics. The proposed methodology has been tested on social media Twitter in the African Sub-Saharian region of Sahel, although it is applicable to different areas or intelligence missions.

Cyber Peacekeeping and OSINT

Cyber is the new domain of warfare and the topic of cyber warfare is of great interest in the media, geopolitical issues and especially in the research area.

Many organizations are contemplating how to conduct cyber warfare, but few are discussing ways to mitigate or prevent cyber conflicts. Furthermore, in the field of research the area of how to restore and maintain peace following cyber warfare remains lacking (Robinson et al., 2018). According to the International Telecommunication Union (ITU), we can define cyber peace as << a universal order of cyberspace >> built on a << healthy state of tranquility, the absence of disorder or disturbance, and violence >>. Given the deep geopolitical and cultural divisions among the cyber superpowers, such an outcome is quite unlikely. Moreover, although the term cybersecurity is commonly used in much of the West, in other countries such as Russia and China, they prefer to use the term information security since they are concerned not only with cyber-attacks but with the content being carried. In a multipolar world, this concept of information security requires multinational cooperation to hinder the dissemination of information that encourages terrorism, extremism or threatens the political, economic and social stability of other countries, as well as their spiritual and cultural environment.

Although one of the main purposes of peacekeeping is to maintain international peace and security, the current UN approach to peacekeeping cannot be directly mapped to cyberspace (Akatyev and James, 2017). Cyberspace can also be a bridge or a threat, where some basic concepts do not exactly match. Introduced around 2003 by Cahill et al., and recognized as a future research topic, the concept of Cyber peacekeeping is investigated further in 2015 by Akatyev and James, when it is defined as a framework with the intention of maintaining peace in cyber and physical spaces affected by possible threats in cyberspace, with specific roles and functions in different phases: pre-conflict, during conflict, post-conflict. Although the use of the cyber domain is a relatively new aspect of warfare, the need for cyber peacekeeping is justified primarily by the fact that individuals are spending more and more time on digital devices than anywhere else and cyberspace is becoming a new realm of human activity with many opportunities, but just as many challenges. The need also arises with regard to human rights violations. For example, a national blackout or altered water supply has the potential to threaten the right to life. Equally important is the right of every person to seek, receive and disseminate information through any means of communication. In addition, more subtle forms of cyber warfare, such as hacking or electoral manipulation, contribute to the need to maintain a cyber peace. The exact definition of cyber peacekeeping is subject to continuous debate (Bellamy and Williams, 2010). A more appropriate definition is the one according to the UN (Robinson et al., 2018): << The application of cyber capability to preserve peace, however fragile, where fighting has been stopped and to assist in the implementation of agreements reached by peacekeepers >>. When talking about cyber peacekeeping, we also have to take into account the recent UN Digital Transformation Strategy for Peacekeeping (Guterres, 2021) that establishes the data-driven approach and the use of new technologies. While scenario, trend and early warning analyses are based on data collected in peacekeeping missions, information analysts in missions have not yet been involved in systematic analysis of data from such operations, through statistical modeling, nor have they attempted to predict events using machine learning techniques. On the one hand, analysts can provide a theory, according to the Intelligence Process, of how an event is affecting a certain outcome, on the other hand, data scientists may uncover patterns that analysts are currently unaware of. Even in data collection, JMAC does not structurally collect and analyze many sources of information which, as specified by Abilova and Novosseloff (2016), could include both military, police, humanitarian, and political intelligence, as well as information from social media monitoring. In particular, the polarizing role of social media with hate-speech influences the dynamics of conflict through: incitement to violence, dissemination of disinformation, propaganda, recruitment into armed groups. In this context, OSINT and cyber intelligence on social media is crucial to combat the so-called Global War On Terror (GWOT), to analyze life models on civilian populations living in fragile countries, politically unstable or prone to outbreaks of violence (Guo et al., 2018).

OSINT is an intelligence discipline that deals with the search, collection, and analysis of information that can be found freely without violating copyright or privacy rights. In the 1980s, military and intelligence services began gathering information from secret activities, such as trying to read an enemy's mail or wiretapping phones to uncover hidden information. The attempt was then actually made by searching for freely available or officially released information.

In those years, without social media, the only sources of information were newspapers or public databases, and it was necessary to link them to make them useful. The terminology OSINT originally appeared for such spying. Today, OSINT can be categorized into several ways, depending on where the public data are located. Social Media Intelligence (SOCMINT) captures large amounts of data found in social media. SOCMINT makes it possible to understand situations occurring in the virtual dimension of social media by collecting and analyzing users' opinions.

This could also make it possible to understand the origin or causes of various phenomena by reconstructing them.

Security agencies must face new technical, conceptual, and operational challenges in dealing with the rise of this new intelligence component. In fact, the enormous amount of data, provided by social media in real time, can be a problem for analysts, making it difficult to extract useful information. One of the biggest challenges is definitely the potential for prediction of unstable situations through the analysis of unstructured data.

For this reason, the intelligence community requires new approaches to deal with social media challenges. In this direction, Sentiment Analysis, through NLP tools, allows the extraction of information from many textual sources and in particular from social media as a daily monitoring or regarding a specific event. A useful tool for preventing certain critical situations can be Sentiment Analysis and Anomaly Detection. These methodologies, by detecting opinions that differ from the norm through sentiment patterns and their temporal characteristics, can enable government organizations to intervene early or adopt the most appropriate strategies if necessary.

Model and case study

This paper proposes a modular system to investigate on Sentiment of a social media platform streaming in order to prevent some instability situation in crisis areas.

The work won't refer to a general approach to cyber peacekeeping but, mainly in physical-real context when the primary purpose is a preemptive analysis to investigate what's happening and be able to assess how dangerous an area is. Such an analysis could make it possible to predict potential problems that are not as visible in some areas affected by long-lasting social and geopolitical conflicts that bring about situations of instability and lack of security.

The goal was to create a cyber intelligence system, as reliable as possible, that would preemptively call attention to issues, social and otherwise, that can be captured by social media, including those from the local population.

At this regard, the system, whose logical architecture is shown in Fig. 1, consists of a four Layer workflow.

Collection Layer - The first layer concerns the collection of data by geographical location and possibly by topic during a specifically chosen period of time. At the same time an existing sentiment labeled social media dataset is considered to be processed in the second layer.

Classification Layer - Both dataset are preprocessed with the same Natural Language Processing steps. A Sentiment Analysis model is trained on the existing social media dataset. The model is then used through transfer learning to classify new collected data in positive and negative instances.

Grouping Layer - In this layer time series sentiment data are constructed grouping the classification in hourly sum of positives and negatives samples.

Anomaly Detection Layer - This layer is responsible of detecting anomalies in negative time series through a deep learning model specially created.

The system was tested focusing on twitter social media, creating a Sentiment Analysis model trained on an existing Twitter dataset, and classifying the collected tweets in positives and negatives. Machine learning methods were used for anomaly detection in the negative sentiment time series extracted from the tweets.

The purpose is to detect anomalous events inferred from the pattern of negative tweets in the time period under observation.

Although experiments were conducted on twitter platform data, the system could be applied to other text data source, or media. The entire workflow, in fact, was conceived as a modular and scalable architecture.

Twitter, like other social media, is a free platform where any individual can share opinions or moods about certain contexts. Through the process of opinion mining, it is possible to identify users' opinions by analyzing the sentiment contained in shared messages. Sentiment Analysis on Twitter has already been used in the literature to try to understand situations in the real world also to predict and monitor events, such as market trends, political opinions or unpredictable events (Liao et al., 2017), (Barnaghi et al., 2016). In a recent study (Vernier et al., 2019), an innovative visualization system for Twitter data mining is presented, expressly designed to report a given event in real time through image sharing on the platform.

Identifying the hidden sentiment is not an easy task and requires NLP and Machine Learning techniques. By collecting and analyzing this kind of information we can investigate the problems of a certain population especially in crisis areas, detecting certain trends in sentiment that could lead to instability and hinder peacekeeping.

The experiment was conducted with reference to the Sahel region of Africa and specifically the three borders area between Burkina Faso, Mali, and Niger. This region, called Liptako-Gourma (Fig. 2), is a Jihadi domain where groups related to al-Qaida and the Islamic State rule and mingle with local criminality.

People in the central Sahel face both attacks from armed Islamic groups and from security forces. 

There are also numerous conflicts between ethnic militias and local defense groups. Although traditional forms of media, such as radio and TV, remain very important across Africa, online forms of media, including social media, are gaining ground faster. 

In the last two decades there has been an impressive increase in the use of smart phones, so much so that in Mali there are more than 97.1 mobile phone registrations per 100 residents, with a mobile phone coverage rate of 91% (ITU Country Data, 2017), in addition there are 2.1 million social media users (Digital, 2021).

Conclusion

In conclusion, in the context of cyber peacekeeping, a Cyber Intelligence system has been proposed consisting of an OSINT analysis on social media and Machine Learning techniques using Sentiment Anomaly Detection, in order to investigate negative sentiment in a crisis area to prevent potential instability situations.

The case study concerns the analysis of twitter social media in the Sahel region comprising Mali, Niger, Burkina Faso and Northern Nigeria. Some critical aspects of this approach include: twitter accounts that are not always geo-localized, various languages used including local dialects in the text of tweets, lack of digitalization in some territories. Nevertheless, the obtained results showed that the method could be a useful tool to investigate people's feelings during the evolution of certain critical situations, also allowing to discover some users potentially to be kept under observation.

Future developments concern the use of topics as keywords in OSINT research, to contextualize the results more specifically. Further improvements can be made with the aim of automating certain steps of the process, such as data collection and translation.

References Cited 

Abilova, O. and Novosseloff, A. (2016) Demystifying Intelligence in UN Peace Operations. New York: International Peace Institute.

Akatyev, N. and James, J. I., (2015) Digital Forensics and Cyber Crime: 7th International Conference, ICDF2C 2015, Seoul, South Korea, October 6-8, 2015. Revised Selected Papers, ch. Cyber Peacekeeping, 126–139. Springer International Publishing

Akatyev, N. and James, J. I., (2017) United Nations Digital Blue Helmets as a Starting Point for Cyber Peacekeeping, ArXiv abs/1711.04502 

Barnaghi, P., Ghaffari, P. and Breslin, J.G. (2016) Opinion Mining and Sentiment Polarity on Twitter and Correlation between Events and Sentiment, 2016 IEEE Second International Conference on Big Data Computing Service and Applications (BigDataService), (2016), 52-57, doi: 10.1109/BigDataService.2016.36

Bellamy, A. and Williams, P., (2010) Understanding Peacekeeping. Polity

Blair, R.A., Blattman, C. and Hartman, A. (2017) ‘Predicting local violence: Evidence from a panel survey in Liberia,’ Journal of Peace Research, 54(2), 298-312; Perry, C (2013) ‘Machine Learning and Conflict Prediction: A Use Case,’ Stability: International Journal of Security & Development, 2, (3), 1-18.

Cahill, T., Rozinov, K. and Mule, C. (2003) “Cyber warfare peacekeeping,” in Information Assurance Workshop, 2003. IEEE Systems, Man and Cybernetics Society, 100–106

Digital (2021) Mali https://datareportal.com/reports/digital-2021-mali

Dorn, A. W. (2016) Smart Peacekeeping: Toward Tech-Enabled UN Operations,: International Peace Institute, 1.

Duursma, A. and Karlsrud, J. (2019) Predictive Peacekeeping: Strengthening Predictive Analysis in UN Peace Operations. Stability: International Journal of Security and Development, 8(1), 1. DOI: http://doi.org/10.5334/sta.663

Guo, W., Gleditsch, K. and Wilson, A. (2018) Retool AI to Forecast and Limit Wars (Nature, no. 562 October 2018, 331–333, https://www.nature.com/articles/d41586-018-07026-4).

Guterres, A. (2021) Strategy for the Digital Transformation of UN Peacekeeping, United Nations Peacekeeping un.org/peacekeeping

Horowitz, M., Scharre, P., Allen, G. C., Frederick, K., Cho, A. and Saravalle, E. (2018) Artificial Intelligence and International Security. Center for a New American Security, https://www.cnas.org/publications/reports/artificial-intelligence-and-international-security

ITU Country Data, (2017) available at: https://www.itu.int/en/ITU-D/LDCs/Documents/2017/Country Profiles/Country Profile_Mali.pdf

Liao, S., Wang, J., Yu, R., Sato, K. and Cheng, Z. (2017) CNN for situations understanding based on sentiment analysis of twitter data, Procedia Computer Science 111, 376-381, ISSN 1877-0509, https://doi.org/10.1016/j.procs.2017.06.037.

Robinson, M., Jones, K., Janicke, H. and Maglaras, L. (2018) An introduction to cyber peacekeeping, Journal of Network and Computer Applications, 114, 70-87, ISSN 1084-8045 - https://doi.org/10.1016/j.jnca.2018.04.010

Vernier, M., Farinosi, M. and Foresti, G.L. (2019) Twitter Data Mining for Situational Awareness. In M. Khosrow-Pour, D.B.A. (Ed.), Advanced Methodologies and Technologies in Network Architecture, Mobile Computing, and Data Analytics, 684-695. IGI Global. http://doi:10.4018/978-1-5225-7598-6.ch050