An innovative knowledge-based methodology for terrorist detection by using Web traffic content as the audit

information is presented. The proposed methodology learns the typical behavior of terrorists by

applying a data mining algorithm to the textual content of terror-related Web sites. The resulting profile is used

by the system to perform real-time detection of users suspected of being engaged in terrorist activities. The

Receiver-Operator Characteristic (ROC) analysis shows that this methodology can outperform a commandbased

intrusion detection system