Modeling and Risk Analysis of Chemical Terrorist Attacks: A Bayesian Network Method.

The chemical terrorist attack is an unconventional form of terrorism with vast scope of influence, strong concealment, high technical means and severe consequences. Chemical terrorism risk refers to the uncertainty of the effects of terrorist organisations using toxic industrial chemicals/drugs and classic chemical weapons to attack the population. There are multiple risk factors infecting chemical terrorism risk, such as the threat degree of terrorist organisations, attraction of targets, city emergency response capabilities, and police defense capabilities. We have constructed a Bayesian network of chemical terrorist attacks to conduct risk analysis. The scenario analysis and sensitivity analysis are applied to validate the model and analyse the impact of the vital factor on the risk of chemical terrorist attacks. The results show that the model can be used for simulation and risk analysis of chemical terrorist attacks. In terms of controlling the risk of chemical terrorist attack, patrol and surveillance are less critical than security checks and police investigations. Security check is the most effective approach to decrease the probability of successful attacks. Different terrorist organisations have different degrees of threat, but the impacts of which are limited to the success of the attack. Weapon types and doses are sensitive to casualties, but it is the level of emergency response capabilities that dominates the changes in casualties. Due to the limited number of defensive resources, to get the best consequence, the priority of the deployment of defensive sources should be firstly given to governmental buildings, followed by commercial areas. These findings may provide the theoretical basis and method support for the combat of the public security department and the safety prevention decision of the risk management department.


Introduction
In recent years, terrorist attacks around the world have caused not only significant losses of life and property, but also a series of public problems such as public panic and social unrest. Chemical terrorist attacks apply to different terrorist purposes, which have been more frequently used because of the characteristics of easy availability of materials, significant effects, convenient implementation and difficult rescue [1]. According to the statistics published by the US Department of Homeland Security on "Global Chemical Attacks from 1950 to 2005," there have been 423 nuclear, biological, and chemical terrorist incidents worldwide in 55 years, of which 239 were chemical terrorist attacks, accounting for 56% [2]. On average, each chemical terrorist incident resulted in 51 injuries and 7 deaths [3]. Furthermore, chemical terrorist attacks have diversified destructive capacity and pose a significant threat to human life, living environment, society, and psychology [4,5], such as the Tokyo subway sarin gas attack [6].
The above facts show that the consequences of chemical weapon attacks are often unbearable for the state, government, society, and the masses. Both industry and academic risk analysis groups have

Bayesian Network Construction
The following subsections present the methodology of Bayesian network for chemical terrorist attacks. As we discussed above, the risk of chemical terrorist attacks is affected by many factors, so it is difficult to consider all factors at a time. To solve the problem of building complex Bayesian networks, Laskey et al. [43] proposed the idea of modular construction. And we construct Bayesian networks from the perspectives of terrorist organisations, weapon, target, weather, prevention, emergency response, and consequence respectively, then combine them into a complete Bayesian network.
We use multi-source data to build Bayesian network. (1) GTD terrorist attack data. The Global Terrorism Database (GTD) is an open database containing information on global, domestic, and international terrorist attacks from 1970 to 2018, and currently has more than 190,000 cases. Each case provided information on the date, location, type of chemical weapon, number of casualties, and terrorist organisations. (2) Wikipedia and Baidu Encyclopedia. We collect keywords and search in encyclopedias, such as chemical weapons: mustard gas, sarin gas; attacks: Japanese subway sarin gas, Matsumoto sarin incident; terrorist organisation: ISIS, Taliban; (3) News reports. We use crawlers to crawl reports and news about chemical terrorist attacks on news sites such as China Caixin.com (4) Literature and reports on official government websites. All data is saved in a relational database for easy retrieval. Other city information, defense force information, and emergency response information come from the actual situation of the case studied. Except for information on public security patrols, surveillance, investigations, and security checks, as well as emergency response situations in each specific area, other information is publicly available. Figure 1 shows the steps to construct BN: (1) Determine the BN variables and their state classification based on multi-source data and expert knowledge; (2) Determine structure and probability distribution of BN. In this paper, we firstly collect questionnaire results of four experts, and take advantage of D-S (Dempster-Shafer) evidence theory [44,45] to analyse the causal relationship between BN variables. Then we determine the conditional probabilities of all nodes. (3) We perform model validation with qualitative (scenario analysis) and quantitative (sensitivity analysis and partial validation) methods [46,47]. After finishing the above steps, the BN with probabilities can be used to conduct case studies.

Int. J. Environ. Res. Public Health 2020, 17, x FOR PEER REVIEW 4 of 24
The following subsections present the methodology of Bayesian network for chemical terrorist attacks. As we discussed above, the risk of chemical terrorist attacks is affected by many factors, so it is difficult to consider all factors at a time. To solve the problem of building complex Bayesian networks, Laskey et al. [43] proposed the idea of modular construction. And we construct Bayesian networks from the perspectives of terrorist organisations, weapon, target, weather, prevention, emergency response, and consequence respectively, then combine them into a complete Bayesian network.
We use multi-source data to build Bayesian network. (1) GTD terrorist attack data. The Global Terrorism Database (GTD) is an open database containing information on global, domestic, and international terrorist attacks from 1970 to 2018, and currently has more than 190,000 cases. Each case provided information on the date, location, type of chemical weapon, number of casualties, and terrorist organisations. (2) Wikipedia and Baidu Encyclopedia. We collect keywords and search in encyclopedias, such as chemical weapons: mustard gas, sarin gas; attacks: Japanese subway sarin gas, Matsumoto sarin incident; terrorist organisation: ISIS, Taliban; (3) News reports. We use crawlers to crawl reports and news about chemical terrorist attacks on news sites such as China Caixin.com (4) Literature and reports on official government websites. All data is saved in a relational database for easy retrieval. Other city information, defense force information, and emergency response information come from the actual situation of the case studied. Except for information on public security patrols, surveillance, investigations, and security checks, as well as emergency response situations in each specific area, other information is publicly available. Figure 1 shows the steps to construct BN: (1) Determine the BN variables and their state classification based on multi-source data and expert knowledge; (2) Determine structure and probability distribution of BN. In this paper, we firstly collect questionnaire results of four experts, and take advantage of D-S (Dempster-Shafer) evidence theory [44,45] to analyse the causal relationship between BN variables. Then we determine the conditional probabilities of all nodes. (3) We perform model validation with qualitative (scenario analysis) and quantitative (sensitivity analysis and partial validation) methods [46,47]. After finishing the above steps, the BN with probabilities can be used to conduct case studies.

States of the Parent and Child Nodes
In order to thoroughly analyse the risk of chemical terrorist attacks, it is necessary to understand all aspects of the threat elements. Through analysis of historical case in Global Terrorism Database (GTD) [41], a summary of terrorism news, some cases' and terrorist organisations' descriptions in Wikipedia, plus expert experience and knowledge contained in the literature, we propose 31 parent nodes (nodes 1-31) and 11 child nodes (nodes A-K). The BN nodes are shown in Table 1 and described in Appendix A. These nodes describe the attack in terms of attack subject, attack object, attack consequence, and objective conditions. However, it should be noted that in Hazard and Operability Analysis (HAZOP) and Safety Integrity Level Analysis (SIL), incident consequences are often quantified from property loss, human damage, and environmental impacts [48,49]. In a chemical weapon attack, the characteristics of chemical weapons, the dose of weapons, the method of delivery, and the mode of diffusion of chemical substances in the atmosphere have a significant impact on the environment. However, such information is lacking in the collected cases, and the focus of this article is on the overall modeling, so we do not consider environmental impact. More researches can be carried out based on the dirty bomb diffusion model [50][51][52]. Property loss includes the cost of treatment for the victims and personal property loss. However, the property loss of most attacks is difficult to quantify, we only consider the casualties as a consequence.

Determination of BN Structure
Two methods are used to build the network. The network structure between child nodes D, E, F, G, H, I, J, K is derived using expert experience, and the structure between other nodes was obtained from literature research and brainstorming of the research team. Four experts participate in the network building, and each of them has extensive hands-on experience in police information, chemical terrorist attacks, and risk assessment. We collected the professional judgments of four experts through a questionnaire survey. The experts were asked if there were influences in the pair of child nodes and assigned values. To reduce the subjectivity of expert opinions, we use D-S evidence theory to analyse the collected data. The D-S evidence theory defines a frame of discernment H and the Mass function. The Mass function needs to satisfy the following conditions: where m(A) is the Mass function of event A, which is also the basic probability function of discernment Θ, the synthesis rule of Dempster-Shafer evidence is shown in Equation (2).
where, A1, A2, . . . AN represent different states of the event, m1, m2, . . . , mN are the basic probability functions of discernment Θ, and K represents the conflict degree among m1, m2, . . . , mN, which is calculated as follows: We use the "K. Casualties" node as an example to describe how we obtain the causal relationship between nodes through expert experience. m1(1,2), . . . , m4 (1, 2) represent the probability whether the node J and the node K are related by the four experts. The value of m1 (1, 2) is (0.9, 0.1), which means that the first expert thinks "J. Whether the attack is successful" has a great influence on the "K. Casualties". The probability of a strong relationship between these two nodes is 0.9, while the probability of a weak relationship is 0.1. The four experts give their respective values. Then we calculate the weight of causality between two nodes based on equations (2) and (3). If the weight of the causal relationship between two nodes is larger than the threshold value (0.85), the relationship exists.
Based on the experience of four experts, the Bayesian network is shown in Figure 2. As a result, 11 child nodes and 31 independent parent nodes are connected through 42 causal relationships.

Determination of Probability Distributions of BN Nodes
The Bayesian network probability acquisition methods mainly include the method of sample learning and the method relying on expert experience to build. The former applies to the case where there is sufficient sample data, and the latter applies to the case where the domain expert gives the node probability distribution. As we lack case data that include all nodes, we cannot perform sample learning on all nodes. So, we use GTD data and Wikipedia data to finish sample learning for the prior probabilities of parent nodes 1-16 and the conditional probability of child nodes A, B, C, D, E, I. The prior probability of the parent node 19-31 is assigned according to the actual situation of the case studied, and the conditional probability of the child nodes E, F, G, H, J, K come from expert experience.

Learning Probability Distributions Based on Samples
In order to use sample learning, we need to perform data discretisation. We recruited five programmers to discrete 330 chemical terrorist attacks cases in the GTD database. All the programmers are undergraduates from the People's Public Security University of China. After data screening and preprocessing, 287 cases were finally obtained. We use the EM algorithm [53] included in GeNIe [54] software to complete parameter learning. Since the data sets required for Bayesian network parameter learning usually have varying degrees of data loss, parameter learning becomes difficult. The EM algorithm is based on maximum likelihood to solve the parameter learning problem with hidden variables.

Learning Probability Distributions Based on Expert Experience
In Table 2, we use D-S evidence theory to analyse the probability distribution of the "H. Ability of the emergency response" node as an example. In the second round of questionnaires, we collected the conditional probability of the nodes, then processed the results using the Dempster-Shafer evidence method. Table 2. Partial probability questionnaires and weighted conditional probabilities of BN nodes.  Table 1.

Determination of Probability Distributions of BN Nodes
The Bayesian network probability acquisition methods mainly include the method of sample learning and the method relying on expert experience to build. The former applies to the case where there is sufficient sample data, and the latter applies to the case where the domain expert gives the node probability distribution. As we lack case data that include all nodes, we cannot perform sample learning on all nodes. So, we use GTD data and Wikipedia data to finish sample learning for the prior probabilities of parent nodes 1-16 and the conditional probability of child nodes A, B, C, D, E, I. The prior probability of the parent node 19-31 is assigned according to the actual situation of the case studied, and the conditional probability of the child nodes E, F, G, H, J, K come from expert experience.

Learning Probability Distributions Based on Samples
In order to use sample learning, we need to perform data discretisation. We recruited five programmers to discrete 330 chemical terrorist attacks cases in the GTD database. All the programmers are undergraduates from the People's Public Security University of China. After data screening and preprocessing, 287 cases were finally obtained. We use the EM algorithm [53] included in GeNIe [54] software to complete parameter learning. Since the data sets required for Bayesian network parameter learning usually have varying degrees of data loss, parameter learning becomes difficult. The EM algorithm is based on maximum likelihood to solve the parameter learning problem with hidden variables.

Learning Probability Distributions Based on Expert Experience
In Table 2, we use D-S evidence theory to analyse the probability distribution of the "H. Ability of the emergency response" node as an example. In the second round of questionnaires, we collected the conditional probability of the nodes, then processed the results using the Dempster-Shafer evidence method.

Model Validation
We validate the model from scenario analysis, sensitivity analysis, and partial validation.

Expert Validation of Scenarios
In this process, different hypothetical scenarios are considered. The first is the worst state, which means that all parent nodes are set to the most threatening situation. For example, we set the number of terrorist organisations to the maximum and the technical background to the high. The second is the best state. The node state settings for the two extreme conditions are shown in Table 3.
In these two extreme conditions, the three states of casualties are estimated as (minor, medium, major) = (0.24, 0.16, 0.6) and (1, 0, 0), respectively. The result means that in the worst case, the probability of "casualties" = "major" is 0.6, and in the best condition, the probability is close to 0. The worst and best probability distribution of "J. Whether the attack is successful" is (0.86, 0.14) and (0, 1). Extreme condition tests show that the Bayesian network is normal and effective.  Then, we consider four hypothetical scenarios, not just two extreme conditions. Table 4 shows the status of node "J. Whether the attack is successful" and "K. Casualties" for the four scenarios. Due to word limitations, we have not considered all possible situation.
Scenario 1 represents the most common type. We set node 1-21 to the state with the most common initial probability value and ensure that there are no contradictions in all states. Then we observe the probability distribution of the child nodes. The probability of successful attack is 46%; the probability of failure is 54%, and the difference is 8%, which illustrates that attacks are more likely to fail. Among the casualties, 69% are minor, 27% are medium, and 4% are major, which indicates that there is a higher probability of fewer casualties in the most common chemical terrorist attack.
Scenario 2 sets the weapon type to neurotoxin based on scenario 1, because neurotoxin is the most severe type of chemical weapon. We find that minor casualties fell from 69% to 61%, while major increased from 4% to 23%, which means neurotoxins are more likely to cause high mean number of injuries and fatalities [3].
Scenario 3 observes the impacts of weather condition. We set "Weather condition" to "favourable" based on scenario 1. Then the probability of successful attacks increased from 46% to 51%. Then the state is set to "unfavourable", the probability of successful attack drops from 46% to 30%, and the probability of unsuccessful attack increases from 54% to 70%. The result reflects that weather condition has some impacts in the success of the attack, which explains why many terrorists attack in weather conditions conducive to the spread of poisons. Nuclear material can spread faster and farther in favourable weather condition or environment and cause more severe consequences [52]. Similar characteristics appear in the diffusion of chemicals.
Scenarios 4 sets the highest police preventative capability based on scenario 1. This time the probability of successful attacks dropped from 46% to 24%, and the probability of unsuccessful attacks has increased from 54% to 76%, which also reflects that the police preventative ability has greatly affected the success of the attack.
All four scenarios represent different states of the Bayesian network. We consider different combinations of parameters to generate different scenarios and observe the rationality of the probability distribution in the incident result node to complete the model verification.

Sensitivity Analysis
In this paper, the sensitivity analysis method is used to measure the influence of small changes in parameters in the Bayesian network on the target probability value or distribution.
We perform a sensitivity analysis on the "Casualties" node. From Table 5, we find that when changing the "Security check" from "No" to "Yes", the probability of "Casualties" = "minor" changes the most, increasing from 66% to 90%. Similarly, if "Police Investigation" is changed from "No" to "Yes", the probability of "Casualties" = "minor" increases from 71% to 88%. When the state of the "Surveillance" changes, the probability of "Casualties" = "minor" increases from 61% to 77%. We can see different police prevention capabilities have a different impact on the casualties. Security check has the most apparent effects on the reduction of casualties. The effects of the police investigation, patrol, and surveillance have gradually declined, which is consistent with the experience of experts, because security checks often consume more defense resources and the effect are apparent. Security checks and police investigations serve as a precautionary measure, while patrol plays a deterrent role. And surveillance with early warning function have limited the reduction of casualties. Tables 5 and 6 shows the sensitivity of "Casualties" and "Whether the attack is successful" to patrol, security check, surveillance, police investigation is the same, which also accords with the three axioms of Section 3.5.3. For the state of "Casualties" = "major", when the emergency response of the hospital, fire, and police changed from "delay" to "on time", the probability dropped from 25% to 10%, and when "security check" changes from "No" to "Yes" at the same time, the probability value dropped from 10% to 5%, which shows that the combination of pre-event prevention and post-event response can more reduce casualties.
However, we should note that economic conditions are limited in many regions, so that many measures cannot directly go from 0 to 1. Therefore, we let the initial probability of the parent nodes change in the range of 10% or 20%, so that it's more practical for measure evaluation. If the values of all parent nodes change only within 10% of the prior probability distribution, for "Casualties" = "minor", "Security check", "Patrol", "Surveillance" are most sensitive to the state. The degrees are 3%, 2.2% and 2%. Similarly, we can compare inputs and outputs and find the node that have the most significant impact on casualties within a certain range of changes.
The results of the sensitivity analysis are consistent with expert judgment, which reflects the rationality of our model.

Partial Validation
In this study, we use a partial verification method based on the three axioms to validate the model. The three axioms are proposed by Jones et al. [55] and used in Kabir's work [47]: (1) If the prior probability of the parent node slightly decreases/increases, the posterior probability of the corresponding child node should also change accordingly. For example, considering the "G. Prevention ability of the police", when the prior probability of the state "Security check" = "Yes" is set from 40% to 45%, the probability of "G. Prevention ability of the police" = "High" increases from 57% to 60%, the probability of "J. Whether the attack is successful" = "No" increased from 68% to 70%. Based on this change, when the prior probability of "Wind direction" = "Upwind" increases from 15% to 25%, the probability of "F. Weather conditions" = "Unfavorable" increases from 24% to 32%, and the probability of "J. Whether the attack is successful" = "No" increases from 70% to 71 %. The process of adding each influencing node satisfies the axiom and provides partial verification of the model. We perform similar analysis on other nodes.

Case Study: Haizhou District, Lianyungang City
Lianyungang city is located in Jiangsu Province, China. Haizhou District is the political, economic, and cultural center of Lianyungang City. According to the 2016 census, 830,000 people live in Haizhou District.
In the past few decades, a large number of chemical terrorist attacks have occurred around the world, each with different characteristics and targets. For preliminary research, we selected three representative locations in Haizhou District as hypothetical targets: Suning Square, the municipal government, and Phoenix Mountain Park. Then we choose three types of terrorist organisations. Through the combination of different organisations and targets, a total of nine scenarios are observed. Since weather conditions change with specific time and scene, it is difficult to set a fixed value. We assume that terrorists will choose favorable weather conditions to launch attacks.

Target Information
Target A: Suning square, the most crowded shopping mall in Haizhou District. Suning square is the first choice for people to go shopping in downtown. During morning and evening rush hours, traffic jams may occur. In front of Suning Square, there is a fixed police station for patrolling and deterrence. For the convenience of people shopping, the mall does not have any security checks, but the roads and the mall have high-definition surveillance. The fire brigade of the railway station is responsible for the fire emergency response of the shopping mall. It is about 3.1 km away and takes about 11 min by car. The Lunan Police Station is 900 m away and takes 2 min by car. The emergency rescue hospital is 1.7 km away and takes ten minutes by car. Under normal circumstances, the emergency response of the police, hospitals, and fire are timely, but in the morning and evening peak traffic jams, the ability will decline. This type of target is prevalent in urban chemical terrorist attacks. The main characteristics of this type of target are high population density, large population flow, good traffic conditions, mainly located in commercial areas. Even this target has strong emergency capabilities, short response times, and fast actions, once the attack is successful, the consequences can be severe. For example, on March 20, 1995, a sarin gas attack on the Tokyo subway during the early rush hour killed 13 people, severely injured 50 people, and poisoned thousands [6].
Target B: Government of Lianyungang City. The government is located in the southeast of Haizhou District. There are many communities next to the government. The population is moderate, and the security check will be carried out from time to time. The government's police prevention capacity is almost the strongest in Lianyungang. The fire brigade is 4 km away. The police emergency response belongs to the Cangwu police station, which is 300 m away and takes 1 min by car. The hospital is 5.9 km away and takes 17 min by car. Due to the long distance and traffic jams, the emergency response of the hospital may be delayed. Attacking such targets by terrorists is very common and has a strong deterrent effect. The main characteristics are: the target has a political meaning, a moderate population density and mobility, and good traffic conditions. Police have a strong ability to combat and prevent.
Target C: Phoenix Mountain Park, a park in the suburbs with few people and bad traffic. It can be seen that in addition to the emergency response capabilities of police, the capabilities of hospitals and firefighting are not good enough, too. At the same time, in such parks, there are no effective patrol, investigation, and security measures, so the police's prevention ability is insufficient. With low attraction, such target is rarely attacked. Table 7 shows the node status of each target, and the position information of the three targets is displayed in Arcgis in Figure 3.

Terrorist Organisation Information
We assume that there are three different types of terrorist organisations, and the node status is shown in Table 8.
Organisation 1: This type of organisation is characterised by: large scale, very active, medium cultural level and technical background. Most of the chemical weapons they have are acquired through occupation. An example is the infamous and cruel ISIS terrorist organisation in Syria. There were 41 ISIS chemical terrorist attacks shown in the GTD.
Organisation 2: This type of terrorist organisation has the following characteristics: the number of people is medium, the social relations and organisational components are medium, inactive, and it is difficult for public security agencies to detect and prevent in advance; such organisations have a low cultural level and no technical background. They obtained chemical weapons through theft and invasion. What we need to pay attention to is that many small and medium-sized cities have some chemical companies. Due to the loose corporate supervision, terrorist organisations can obtain raw materials from chemical plants and launch terrorist attacks. The Bhopal disaster in India is a real case.

Terrorist Organisation Information
We assume that there are three different types of terrorist organisations, and the node status is shown in Table 8.
Organisation 1: This type of organisation is characterised by: large scale, very active, medium cultural level and technical background. Most of the chemical weapons they have are acquired through occupation. An example is the infamous and cruel ISIS terrorist organisation in Syria. There were 41 ISIS chemical terrorist attacks shown in the GTD. Organisation 2: This type of terrorist organisation has the following characteristics: the number of people is medium, the social relations and organisational components are medium, inactive, and it is difficult for public security agencies to detect and prevent in advance; such organisations have a low cultural level and no technical background. They obtained chemical weapons through theft and invasion. What we need to pay attention to is that many small and medium-sized cities have some chemical companies. Due to the loose corporate supervision, terrorist organisations can obtain raw materials from chemical plants and launch terrorist attacks. The Bhopal disaster in India is a real case. On the evening of December 2, 1984, pesticides from chemical plants were leaked in the Bhopal region of India. More than 500,000 people were exposed to methyl isocyanate [8] gas in the incident. Highly toxic substances enter the small town near the factory and its surroundings. The leak injured 558,125 people, including temporary local injuries to 38,478 people. The Indian government and local activists believe that negligent management and postponed maintenance have caused the disaster. Learning from this case, if terrorists use management loopholes to enter chemical plants easily, a similar disaster may happen.
Organisation 3: The main features are small scale, good at camouflage and hiding, high technical background, high cultural level, and having self-made chemical weapons. For example, Japan's Aum Shinrikyo, the core members of the organisation have launched two appalling chemical terrorist attacks: Matsumoto Nagano sarin gas attack and Tokyo subway sarin gas attack.

Results
We set evidence for each of the nine scenarios (Table 9), and then, to observe and discuss the distribution of node states. In Figure 4, we show the node status of target A in the Bayesian network.
From Figure 5a, we can see the probability of "I. Threat of the terrorist organisation." Organisation 1: (Large, Medium, Small) is (0.44, 0.28, 0.28); Organisation 2: (Large, Medium, Small) is (0.08, 0.7, 0.22), Organisation 3: (Large, Medium, Small) is (0.2, 0.59, 0.21). Although Organisation 3 has a small number of people and is not very active, it is more threatening than Organisation 2 because of its high level of technology and the ability to independently manufacture chemical weapons. That means in chemical weapons attacks, terrorist organisations with self-manufacturing capabilities are more threatened. Organisation 1 has a large number of people, a large influence, and is extremely active. Although it does not have chemical weapon manufacturing technology, it can transport and launch weapons. We must cut off its acquisition of weapon manufacturing technology or high-level talents. Otherwise, the threat will be even greater.
From Figure 5b-d, the attractions of different targets are quite different. The attraction of Target A and B is higher, and the attraction of Target C is very low. At the same time, it can be obtained from Figure 5c that police investigation and security check have an important impact on the police's defense capabilities. The same conclusion also emerges in the defense methods for controlling the risk of urban dirty bomb attacks. Compared with patrol and surveillance, security inspections are more important and effective [56]. Because Target A lacks "Police investigation" and does not have "security check", the probability of "High" in node G dropped from 0.98 to 0.13. The combination of different prevention methods has an impact on the overall risk level. For example, when patrol, police investigation, surveillance, and security check are all at high levels, the police have a strong ability to combat and prevent. In Figure 6, the probability of successful attacks is reduced by nearly 40 percentage points compared with only have detection and monitoring measures (0.58-0.18, 0.46-0.05, 0.51-0.09). Compared with the non-preventive measures, the probability of successful terrorist attacks is reduced with nearly 60 percentage points (0.75-0.18, 0.74-0.05, 0.75-0.09). If there are only the two most common measures for patrol and monitoring and deterrence, it still can reduce the probability of successful attacks by at least 15 percentage points. In real life, due to limited defense resources and limited terrorist attack resources, the network can be used to evaluate the most effective and comprehensive prevention measures to reduce the overall level of risk.        Figure 6 shows the probability distribution of "J. Whether the attack is successful". Scenario 5 has the highest probability of failure, reaching 0.95. That's because scenario 5 indicates that terrorist organisation 2 attacks the government. From Figure 5c, we find the government's defense and emergency capabilities are strong. At the same time, the threat degree of Organisation 2 is low, so it is understandable to get such result. The probability of failure is low in scenario 7, 8, and 9, where the lowest one is 25%. Since Target C is in an open area, the probability of effective early warning is low, so the attack is more likely to succeed [56]. We can infer that terrorist organisations with different threat levels have a limit impact on the success of the attack, while the police prevention in different locations has a more significant impact. Figure 7 shows the probability distribution of "K. Casualties." The impact of emergency response capabilities on casualties are more significant than terrorist organisations of different threat levels. One of the reasons is that node I is not directly connected to node K. However, rather than reducing the direct casualties, emergency response is more significant in conducting rescue operations, reducing disasters such as continuous chemical pollution caused by chemical substances, moving casualties from contaminated environment to well-ventilated area to give first aid [1], and reducing the possibility of secondary attacks [40,56]. These measures ultimately reduced casualties. At the same time, among Scenario 1, 2, and 3, the probability of minor casualties in Scenario 2 is the highest, because Organisation 2 has the lowest threat. Finally, we conclude that the probability of an attack failure is negatively related to casualties, which is clearly consistent with common sense.
Then we consider the impact of different chemical weapon types, doses, delivery methods on casualties. We use scenario 3 as an example. Scenario 3 represents Organisation 3 attack the Target A. When we changed the chemical weapon type to neurotoxin, the state "minor" dropped from 0.59 to 0.57, the state "major" increases from 0.19 to 0.24. The lowest casualties are corrosive poisons and uncertain types, with "minor" is 0.59 and "major" is 0.18. This means that neurotoxic agents are more dangerous, while corrosive agents are less dangerous. When the release method is explosive dispersion, the "minor" is 0.57 and the "major" is 0.24, which is the most dangerous of all delivery methods. When the chemical weapon dose is set to the maximum, the "minor" is 0.57 and the "major" is 0.24; when the dose is set to be small, the "minor" is 0.59, and the "major" is 0.2. In the simulation of dirty bomb incidents, it is very important to predict the concentration of radioactive materials in the environment of an emergency [50,57]. This is also important in chemical terrorist attacks. When we set the weapon danger to "high," the "minor" dropped from 0.59 to 0.49, and the "major" rose from 0.19 to 0.49. It can be seen that the danger level of weapon has a strong impact on casualties. When we set the weapon danger to low, the "minor" rises from 0.59 to 0.68 and the "major" drops from 0.19 to 0.1. We do not repeat other similar analysis.
in Scenario 2 is the highest, because Organisation 2 has the lowest threat. Finally, we conclude that the probability of an attack failure is negatively related to casualties, which is clearly consistent with common sense.
Then we consider the impact of different chemical weapon types, doses, delivery methods on casualties. We use scenario 3 as an example. Scenario 3 represents Organisation 3 attack the Target A. When we changed the chemical weapon type to neurotoxin, the state "minor" dropped from 0.59 to 0.57, the state "major" increases from 0.19 to 0.24. The lowest casualties are corrosive poisons and uncertain types, with "minor" is 0.59 and "major" is 0.18. This means that neurotoxic agents are more dangerous, while corrosive agents are less dangerous. When the release method is explosive dispersion, the "minor" is 0.57 and the "major" is 0.24, which is the most dangerous of all delivery methods. When the chemical weapon dose is set to the maximum, the "minor" is 0.57 and the "major" is 0.24; when the dose is set to be small, the "minor" is 0.59, and the "major" is 0.2. In the simulation of dirty bomb incidents, it is very important to predict the concentration of radioactive materials in the environment of an emergency [50,57]. This is also important in chemical terrorist attacks. When we set the weapon danger to "high," the "minor" dropped from 0.59 to 0.49, and the "major" rose from 0.19 to 0.49. It can be seen that the danger level of weapon has a strong impact on casualties. When we set the weapon danger to low, the "minor" rises from 0.59 to 0.68 and the "major" drops from 0.19 to 0.1. We do not repeat other similar analysis.  Threat (or risk) assessment for different scenarios is significant. Olama found that when the likelihood of an attack is low/high, and the consequence of attack is low/high, the threat assessment is low/high as well [42]. So, we can infer from Figures 6 and 7 that the threats of scenario 7, 8, 9 are the highest, while the threats of scenario 4, 5, 6 are the lowest. The assumption is not consistent with the actual situation. Because when setting the node status, we focus on exploring the police's defense capabilities and the role of emergency response capabilities, so that we take the extreme state of "yes or no". Scenario 1, 2, 3 are more likely to happen in reality. As Target B is attractive, and the defense has some loopholes, the terrorist is more likely to receive the maximum return. While the attraction of Target C is low, the probability of a terrorist attack is rather low. The situation explains a game of attack resources and defense resources [58,59]. Moreover, Cox [60] pointed out the limitations of several important risk analysis methods based on the formula: "Risk = Threat × Vulnerability × Consequence." The two-level (or few-level) hierarchical optimisation models appear valuable as practical approaches to antiterrorism risk analysis and protect critical targets.
What's more, the reference [38] found that under the threat of nuclear or biological weapons terrorist attacks, if the defender wants to protect the target, the priority of the protected target should be Government Buildings, Symbolic Buildings, Urban Populations, Low value target. Such a priority allows the defender to get the highest benefit while minimizing the probability of successful attacks. Threat (or risk) assessment for different scenarios is significant. Olama found that when the likelihood of an attack is low/high, and the consequence of attack is low/high, the threat assessment is low/high as well [42]. So, we can infer from Figures 6 and 7 that the threats of scenario 7, 8, 9 are the highest, while the threats of scenario 4, 5, 6 are the lowest. The assumption is not consistent with the actual situation. Because when setting the node status, we focus on exploring the police's defense capabilities and the role of emergency response capabilities, so that we take the extreme state of "yes or no". Scenario 1, 2, 3 are more likely to happen in reality. As Target B is attractive, and the defense has some loopholes, the terrorist is more likely to receive the maximum return. While the attraction of Target C is low, the probability of a terrorist attack is rather low. The situation explains a game of attack resources and defense resources [58,59]. Moreover, Cox [60] pointed out the limitations of several important risk analysis methods based on the formula: "Risk = Threat × Vulnerability × Consequence." The two-level (or few-level) hierarchical optimisation models appear valuable as practical approaches to antiterrorism risk analysis and protect critical targets.
What's more, the reference [38] found that under the threat of nuclear or biological weapons terrorist attacks, if the defender wants to protect the target, the priority of the protected target should be Government Buildings, Symbolic Buildings, Urban Populations, Low value target. Such a priority allows the defender to get the highest benefit while minimizing the probability of successful attacks. This finding is consistent with the defensive power setting of three targets. Among the targets, the government's defensive strength is the strongest; the downtown shopping mall is the second; and the suburban defensive strength is the worst. Moreover, we can see in Figures 6 and 7 that the probability of a successful attack on government and the casualties are the smallest. The probability of a successful attack on Suning square is medium, and the park has the largest probability of a successful attack and casualties.

Conclusions
In this study, we use the idea of module construction to make the complex issues simplified. The critical nodes are integrated into a comprehensive Bayesian network to estimate the dangerous level of the chemical weapon, target attraction, weather condition, prevention ability of the police, ability of the emergency response, threat of the terrorist organisation, whether the attack is successful and casualties. In order to adequately estimate the impact of each parent node, we analyse case data, combining expert knowledge to identify key nodes and determine status values. Based on expert knowledge, we construct Bayesian network. The probability distribution of the network is obtained using the EM algorithm and expert experience. We perform different scenario analysis to predict the possible impacts and consequences. Sensitivity analysis is used to identify crucial and influential nodes and their impact on the consequences of an attack. In order to prove the validity and applicability of the proposed method, a case study of Lianyungang City is further carried out. By performing nine different scenarios in the case study, the feasibility and correctness of the model has been verified.
The models and procedures in this article can be used to complete similar terrorist attack modeling and risk analysis in other regions. However, the model structure and probability distribution need to be changed based on regional differences. Furthermore, the risk analysis conclusions from this article can be used by government to effectively allocate defense resources and minimise the risk of chemical terrorist attacks. Because of the graphical nature of Bayesian network, it is easy for public safety officials to understand the interactions between key factors and to add new evidence to infer risks and threats. Users can further improve the performance of the proposed model based on specific weather conditions, more detailed emergencies, and other relevant information.
This article still has some limitations. First, the chemical weapon terrorist attack model and analysis method proposed in this paper lack the knowledge base support, which may affect the practicality of our model. If we can combine the personnel information system and geographic information system or use a knowledge graph that integrates multi-source knowledge, the practicality of the model will be significantly enhanced. Another limitation is the risk assessment of terrorist attacks. This article does not obtain specific attack risk indicators or values. If a precise method is used to calculate the risk value, it can better support decision-making. For future research, this Bayesian network model can be integrated with a knowledge graph or knowledge base to develop a risk assessment system. We will consider using game theory to assess the level of attraction of targets to support decision-making. Another possible research direction is to develop a plan support system [61,62] based on our proposed BN model and conduct a comprehensive analysis of the system's objectivity, rationality, understandability, and usefulness.

Conflicts of Interest:
The authors declare no conflict of interest.

1.
Religious background. This node comes from the religious types of terrorist organisations recorded in the GTD data that have carried out chemical terrorist attacks, which is divided into five categories. The state "unknown" means individuals or unknown organisations launched the attack [38,42].

2.
Region of the perpetrator. This node refers to the region of the attacker. By reviewing literature and historical cases, we divide the node into eight categories [3,39].

3.
Number of members. The number of terrorist organisations is an important indicator of their influence. We divide the number of organisations into four categories [39,40].

4.
Average educational level. The average education level is divided into three categories: high, medium and low. Low means that members are mostly below primary school level, high means members include many college diplomas, doctorates, or researchers. The medium means the members have a high school education level [42]. 5.
Technical background. There are three technical backgrounds, high, medium and low. The technical background is whether there is background knowledge related to chemistry and weapon manufacturing. With this kind of knowledge, the organisation is more dangerous [42].

6.
Social relations and organisational components. High-impact terrorist organisations generally have complex social relationships. Moreover, it is easier to launch attacks through complex social relations and more difficult to prevent. We manually assign the specific values by looking up information about terrorist organisations in Wikipedia and related news [42]. 7.
Whether they have been reported recently. We look at similar terrorist attacks or attacks of the same organisation in the GTD. If the time interval is within one month, then the organisation has been reported and needs to be vigilant. 8.
Whether they ever launched chemical attack. We check in the GTD to see if any attacks were carried out using similar means in similar locations, or if a terrorist organisation has repeatedly carried out chemical terrorist attacks. 9.
Whether they made a statement or threat. Some terrorist organisations will threaten and intimidate before the attack, causing people to panic. Terrorist organisations that make such statements are often more active. 10. Source of chemical weapon. We have summarised six ways through the literature, including self-made, obtained from the occupied inventory, and purchased from the black market. We obtain such information from relevant reports and Wikipedia [38,42]. 11. Whether they have technical support. We look for information on terrorist organisations on the Internet and perform manual evaluations and assignments [38]. 12. Whether they have the capabilities of storing and transporting the chemical weapon. We manually assign values based on GTD and Wikipedia data. 13. Whether they have the ability to launch the chemical attack. We manually assign values based on GTD and Wikipedia data, such as the ordinary attacks that the terrorist organisation has launched [38].
• I. Threat of the terrorist organisation. The threat degree is mainly affected by the influence, the active degree, and the difficulty of acquiring weapons of the terrorist organisations. The degree of threat of different terrorist organisations has an impact on the success of the attack [38,42]. • J. Whether the attack is successful. We divide the states of the node into "yes" and "no". The node reflects the likelihood of a successful attack [39,40,42]. • K. Casualties. Casualties are essential indicators for assessing the consequences of a chemical weapons attack. We have summarised three types of casualties in chemical terrorist attacks based on the "Safety Production Incident Report", "Chinese Investigation and Handling Rules": "less than ten people died or less than 50 people were injured", "11 to 30 people died or 51 To 100 injuries "and" more than 30 dead or more than 100 injured" [38,39,42,56].