A Forensic Investigation of Terrorism in Nigeria: An Apriori Algorithm Approach ()
1. Introduction
The most devastating effect of terrorism in Nigeria has been the loss of lives and properties. Terrorism has increased fear, decreased life expectancy, hampered infrastructural development, and badly tarnished Nigeria’s international image [1].
The Global Conflict Tracker [2], has reported that terrorist activities have killed nearly 350,000 people in North-East Nigeria and rendered over 310,000 as refugees in internally displace persons camps in Nigeria [2]. Over the years, Boko Haram has claimed responsibility for several bombings, killings, shootings, kidnappings, and abductions across Nigeria. The car bomb incident of August 26, 2011 in Abuja, which killed 19 people, is one of the notable examples of successful terrorist attacks in Nigeria [3]. Again, on April 15, 2014, more than 250 Chibok school girls were abducted and kidnapped [3] [4]. Also, in 2020, 70 civilians were killed and many others injured by terrorist attacks in Borno state [5]. Strangely, Nigeria ranks third in the most terrorised countries in the world [6]. These huge challenges have hindered Nigeria’s economic growth, reduced life expectancy, and created huge fear in Nigerians amongst several other challenges. Therefore, there is every need to study the activities of terrorist in Nigeria and know the most terrorised areas/states in Nigeria to aid law enforcement agencies in making decisions targeted at curbing terrorism.
Association rule mining has recently been utilised to undertake analysis, correlations, associations, and insights on various terrorist datasets in order to analyze terrorist strikes all around the world [7] [8] [9]. Particularly, the Apriori algorithm which happens to be one of the association rule mining techniques has been often used due to the fact that it is well suited for unlabeled data. Moreover, the Apriori algorithm has the capability to produce comprehensive and suitable rules that describe an event under consideration based on Support and Confidence.
This can be seen in Khalifa, Taha, Taha and Hassanien [7] where they made statistical insights and association mining for terrorist attacks in Egypt. They extracted and reviewed patterns of terrorist attacks in Egypt from the Global Terrorism Database (GTD).
Recently, Iorliam, Dugeri, Akumba, and Otor [10] investigated terrorist activities in Nigeria using the Apriori algorithm on the GTD and showed that attacks in Nigeria were successful over the years. Motivated by Iorliam, Dugeri, Akumba, and Otor [10], the researchers are motivated to investigate terrorist activities in Nigeria using the Apriori algorithm on the GTD in order to understand the frequency of terrorist attacks in Nigeria for forensic investigations.
In this paper, the frequency of terrorist attacks in Nigeria is investigated for forensic purposes firstly to draw out pictorial meanings from the GTD from 1970 to 2019. Furthermore, the Apriori algorithm is used as a forensic tool to develop an association mining model for understanding the frequency of the occurrence of successful terrorist attacks in Nigeria. The algorithm formulates rules that will serve as red flags in the lead-up to terrorist attacks, while examining closely the frequency or manner in which terrorist activities occur across the States and regions of Nigeria. More so, findings will aid law enforcement agencies in the effective handling of areas with the highest attacks indicating that such areas are more porous and prone to attacks. The rest of the paper is organised as follows. Related works are described in Section 2. Section 3 describes our experiments, datasets used, and research questions. Results and discussions are presented in Section 4. Conclusion and future work are presented in Section 5.
2. Related Works
Forensic science is defined as the study of scientific knowledge and technical methods used to analyze and interpret traces, in legal and criminal process for interpretation [11] [12]. Forensic science discipline could also take advantage of monitored and properly recorded terrorist communications/patterns to assist forensic experts in performing their investigations. Agrawal and Srikant were the first researchers to introduce the Apriori algorithm [13]. It is an algorithm for frequent item set mining and association rule learning over datasets. Since the introduction of the Apriori algorithm, it has been applied to different disciplines including investigations of terrorist activities. Pandya [14], utilised the Apriori algorithm as a data mining tool to assess, examine, and define the threat level posed by the top ten most active and violent terrorist groups, and then applied machine learning algorithms to provide intelligence for counterterrorism support. The research focused on transforming terror incident related information into actionable intelligence using historical data from terrorist incidents that occurred around the world between 1970 and 2016 from the GTD [14]. In light of the inquiry into terrorist incidents, Singh, Chaudhary and Kaur [15], evaluated the terrorist activities from 1970 to 2017 on GTD. The researchers compared the performance of Gaussian Naïve Bayes, Linear Discriminant Analysis, K-Nearest Neighbour, Support Vector Machine, Logistic Regression, and Decision Tree algorithms. Their results showed that the Logistic Regression, Linear Discriminant Analysis, Gaussian Naïve Bayes, and Support Vector Machine all achieved prediction accuracies of 82%. Ghalleb and Amara [16] used the Support Vector Machine, Decision Tree, Random Forest, and K-Nearest Neighbor algorithms to forecast terrorist attacks on the GTD and ACLED datasets using Tunisia as a case study. They demonstrated that these four algorithms can effectively aid in the prevention of terrorist acts. Li, Li, Tang, and Zhang [8] used the Apriori algorithm to compare the frequency of phrases from global professional target websites to explore global cyber space security vulnerabilities. They demonstrated how the Apriori algorithm may be used to research and solve security issues in the global cyber domain. Sathyavani [17], utilising the GTD datasets predicted fear-based oppression in India using the Random Forest Algorithm, Gaussian Naive Bayes, and Decision Tree methods. The Random Forest algorithm was shown to have achieved the highest fear-based oppression prediction accuracy of 96%, according to this study. From our literature search and to our best knowledge, the use of Apriori algorithm as a forensic tool has not been applied on GTD to study terrorist activities in Nigeria.
3. Experiments
The first goal of this experiment is to investigate the Global Terrorism Database (GTD) so as to deduce terrorist targets/areas in Nigeria from 1970-2019. The second goal of this experiment is to utilise the Apriori algorithm in order to generate rules with the highest frequency that can help us understand terrorist activities in Nigeria and the most terrorised states/areas in Nigeria from the GTD.
The Apriori rules are set in Python using parameters such as observations (“iyear”, “imonth”, “extended”, “provstate”, “multiple”, “success”, “suicide”, “attacktype1_txt”, “targtype1_txt”, “targsubtype1_txt”), the minimum support of the relation (min_support) which is set to 0.1, the minimum confidence of relations (min_confidence) which is set to 0.8, the minimum lift of relations (min_lift) which is set to 0.01, and the minimum number of items in our rule (min_length) which is set to 1. Section 3.1 clearly describes these observations. Using the above parameters, the association rules are generated. For the fact that the focus of this paper is to investigate terrorist activities with the highest frequencies and the most terrorised areas in Nigeria via the Apriori algorithm, we use the Support to evaluate our proposed method. For consistency, corresponding values for the Confidence are presented in this paper as well. Suppose we have A ⇒ B, the two important evaluation factors used in this paper are described below:
1) Support: This shows the popularity of an item in a data under consideration. Mathematically, it is expressed as:
2) Confidence: This shows the probability of B happening if A has happened. Mathematically, it is expressed as:
In summary, to achieve meaningful deductions in terms of investigating terrorist activities with the highest frequencies and knowing the most terrorised areas in Nigeria using the Apriori algorithm, we expect a higher Support closer to 1 (100%).
3.1. Datasets
The Global Terrorism Database (GTD) is assembled by The National Consortium for the Study of Terrorism and Responses to Terrorism (START) [18]. It is available at: https://www.start.umd.edu/gtd and was used to evaluate the proposed method in this paper. It comprises of terrorist activities ranging from the year 1970 to 2019. This dataset has 135 columns and the key 9 features of the dataset used in this paper are described below:
1) iyear: this indicates the year an incident occurred or started
2) imonth: this indicates the month an incident occurred or started
3) extended: shows “Yes” when the duration of an incident is more than 24 hours, or as “No” otherwise
4) provstate: this shows the subnational administrative region where the incident occurred
5) multiple: when an attack is part of a multiple incident, it is reported as “Yes”, or “No” otherwise
6) success: when an incident is successful, it is reported as “Yes”, or “No” otherwise
7) suicide: when an incident is suicide, it is reported as “Yes”, or “No” otherwise
8) attacktype1/attacktype1_txt: this assigns a code (number) to a text (attack type hierarchy). For example, 1-the attacks classified in this category include Assassination, 2-Hijacking, 3-Kidnapping, 4-Barricade Incident, 5-Bombing/ Explosion, 6-Armed Assault, 7-Unarmed Assault, 8-Facility/Infrastructure Attack, and 9-Unknown
9) targtype1/targtype1_txt: this assigns a code (number) to a text (general type of target/victim). For example, 1-Business, 2-Government (General), 3-Police, 4-Military, 5-Abortion Related, 6-Airports & Aircraft, 7-Government (Diplomatic), 8-Educational Institution, 9-Food or Water Supply, 10-Journalists & Media, 11-Maritime (Includes ports and maritime facilities), 12-NGO, 13-Other, 14-Private Citizens & Property, 15-Religious Figures/Institutions, 16-Telecommunications, 17-Terrorists/Non-State Militias, 18-Tourists, 19-Transportation (Other than Aviation), 20-Unknown, 21-Utilities, 22-Violent Political Parties.
A detailed description of the other fields in the datasets is explained in LaFree, and Dugan [18] and the GTD codebook [19].
3.2. Research Questions
In this paper, we ask 3 key research questions that need to be answered:
1) What are the most frequent type of attacks in Nigeria?
2) Are terrorist in Nigeria ready to commit suicide during their attacks?
3) Are attacks in Nigeria often successful?
4. Results and Discussions
The Python programming environment read and extracted the data of interest which focuses on Nigeria, and the relevant figures are achieved. Firstly, the frequency of the top 9 types of attacks in Nigeria is presented in Figure 1.
As shown in Figure 1, between 1970 to 2019, the top three most frequent types of attacks in Nigeria are Armed Assault (45.8%), followed by Bombing/Explosion (25.0%), and Hostage Taking (Kidnapping) (12.3%). The other six types of attacks in Nigeria include Facility/Infrastructure attack (6.2%), Assassination (5.1%), Unknown (4.6%), Hostage Taking (Barricade Incident) (0.5%), Unarmed Assault (0.2%), and Hijacking (0.2%). It is clear that the most preferred method of terrorist attacks on Nigerians is via armed assault. From these statistics, the Nigerian law enforcement agencies and the government should be worried of the fact that there could be a huge influx of weaponry to terrorists or there exists a chance of an increase in illegal weaponry manufacturing factories/homes in Nigeria. This observation is similar to what Okoye [20] observed
![]()
Figure 1. Frequency of top 9 attack types in Nigeria from 1970-2019.
when the researcher performed a comparative analysis of terrorist attacks between the United States of America and Nigeria from 1980 to 2013.
Furthermore, the Apriori algorithm was used and generated relevant rules that will aid in investigating terrorist activities with the highest frequencies and in presenting the most terrorised areas/states in Nigeria. Even though, the analysis in this paper focuses on the Support values, Figure 2 shows the rules generated based on Support and Confidence values.
The Apriori algorithm described in the methodology generated 214 strong rules and 8 out of the 214 strong rules are presented in Table 1. These 8 strong rules are selected and analysed due to their high Support values (>0.50) and relevance in terms of answering the research questions posed in Section 3.2.
From Table 1, the seven rules with Support values greater than 0.50 (50%) are “Not Multiple ⇒ Not Extended, Not Suicide ⇒ Not Extended, Successful ⇒ Not Extended, Not Suicide ⇒ Not Multiple, Successful ⇒ Not Multiple, Successful ⇒ Not Suicide, and Not Multiple ⇒ Not Suicide.” Again, the eight rule with the
![]()
Table 1. Strong rules based on support values and relevance.
![]()
Figure 2. Rules generated by apriori algorithm on the Nigeria data extracted from GTD.
highest Support value targeted at answering the research questions posed in this paper is “Borno ⇒ Successful”.
The first rule “Not Multiple” ⇒ “Not Extended” shows that the frequency of attacks occurring for not more than 24 hours and the attacks not been part of a multiple incident is 0.55897 (55.8997%). Moreover, this rule shows that the probability of an attack “Not Extended” and “Not Multiple” is 0.84749 (84.749%) which is reasonably high. Even though some of these attacks do not extend for more than 24 hours, the damage they cause in terms of loose of lives and properties is unquantifiable, hence the urgent need for law enforcement agencies to curb these crimes before they may even extend to more than 24 hours.
The second rule “Not Suicide ⇒ Not Extended” shows that the frequency of an attack been “Not Extended” and “Not Suicide” is 0.77751 (77.751%). Also, the probability of an attack been “Not Extended” and “Not Suicide” is 0.89469 (89.469%) which is considerably high. We can infer from this rule that attacks in Nigeria are not due to terrorist carrying out the attacks and in the process losing their lives (suicide), but mostly due to terrorist carrying out these attacks and also preserving their lives.
The third rule “Successful ⇒ Not Extended” shows that the frequency of an attack been “Not Extended” and “Successful” is 0.78521 (78.521%). Again, the probability of an attack been “Not Extended” and “Successful” is 0.90354 (90.354%) which is very high. This shows that attacks in Nigeria are often times successful and this is very worrisome.
The fourth rule “Not Suicide ⇒ Not Multiple” shows that the frequency of an attack been “Not Multiple” and “Not Suicide” is 0.60513 (60.513%). Again, the probability of an attack been “Not Multiple” and “Not Suicide” is 0.91746 (91.746%) which is very high. We can infer from this rule that many terrorists in Nigeria do not commit suicide in the process of carrying out these attacks.
The fifth rule “Successful ⇒ Not Multiple” shows that the frequency of an attack been “Not Multiple” and “Successful” is 0.58797 (58.797%). Furthermore, the probability of an attack been “Not Multiple” and “Successful” is 0.89145 (89.145%) which is relatively high. This means that most of the attacks in Nigeria are often successful, and most of these attacks are not part of a multiple incident.
The sixth rule “Successful ⇒ Not Suicide” shows that the frequency of an attack been “Not Suicide” and “Successful” is 0.83767 (83.767%). Again, the probability of an attack been “Not Suicide” and “Successful” is 0.83767 (83.767%). This again agrees to the fact that most terrorist do not want to die during their attacks and most of these attacks on Nigerians are often times successful.
The seventh rule “Not Multiple ⇒ Not Suicide” shows that the frequency of an attack been “Not Suicide” and “Not Multiple” is 0.50513 (50.513%). Also, the probability of an attack been “Not Suicide” and “Not Multiple” is 0.90367 (90.367%). This rule again confirms that terrorist in Nigeria mostly carry out their attacks without losing their lives in the cause of the attack.
With respect to knowing the state that is most affected by terrorist in Nigeria, the eight rule “Borno ⇒ Successful” shows that the frequency of attacks been “Successful” and in “Borno” is 0.29191 (29.191%). Furthermore, the probability of an attack been “Successful” and in “Borno” is 0.80479 (80.479%). From this rule, even though the frequency of attacks is 29.191%, this is reasonably high due to the fact that for each occurrence of an attack, lives and properties are lost in Borno state. Therefore, the Nigerian law enforcement agencies and the Nigerian government needs to act fast in curbing this serious menace especially in Borno state and other affected states as well.
From this analysis, the rule six “Successful ⇒ Not Suicide” has the highest frequency of 0.83767 (83.767%). This could mean that terrorist in Nigeria are less educated, older, and likely married persons with children according to Sabri and Schulze [21]. This is because suicide terrorist have the opposite qualities listed above [21]. Even though, these attacks are not suicide attacks, the loss of lives and properties is devastating and hence needs an urgent attention from law enforcement agencies and the Nigerian government. Therefore, there is an urgent need for forensic researchers/experts to deploy forensic techniques/tools in solving terrorist attacks and general crimes across the globe and Nigeria [22] [23].
5. Conclusion and Future Work
Terrorist activities have greatly affected Nigeria negatively especially in the North-East region of the country where Borno state is located. In this paper, we made meaningful deductions in terms of investigating terrorist activities with the highest frequencies and presented the most terrorised area/state in Nigeria (Borno state) using the Apriori algorithm. From the experiments, we observed that the most preferred method of terrorist attacks in Nigeria is through armed assault. Again, our experiment supported our conjecture that attacks in Nigeria are mostly successful. Also, we observed from our investigations that most terrorists in Nigeria are not suicidal. Therefore, if terrorist communications are monitored and properly recorded, this will serve as forensic evidence even in the court of law to prosecute these terrorists. It is believed that this approach will greatly reduce the frequency of terrorist attacks not only in Borno state, but also the entire Nigeria as well. The main application of this work can be used by forensic experts to assist law enforcement agencies in decision making when handling terrorist attacks in Nigeria. In the future, terrorist attacks in Nigeria will be investigated using other association mining techniques such as fp-growth algorithm.