View
215
Download
0
Category
Tags:
Preview:
Citation preview
December 2002 Estimate
Forecast to November 2003
Completed Ongoing Not started
( | ~ ( , , )) ( | target + noise)( )
( | ~ ( , )) ( | noise)
P Y J Y G n p T P JJ
P Z J Z G n p P J
Process structured, linked data onmultiple entity and link types
Detect terrorist activities vialikelihood ratio on random graphs
Track, forecast & develop course of actionvia terrorist enterprise model
December 2002 Estimate
Forecast to November 2003
Completed Ongoing Not started
( | ~ ( , , )) ( | target + noise)( )
( | ~ ( , )) ( | noise)
P Y J Y G n p T P JJ
P Z J Z G n p P J
Process structured, linked data onmultiple entity and link types
Detect terrorist activities vialikelihood ratio on random graphs
Track, forecast & develop course of actionvia terrorist enterprise model
[ ][ ]
( )( )
( )1( )
cr( )
var, ;
Hi i
i V HH
XB T T d O n
X pp
-
ÎÎ
= +å ÕE( ) ( )Aut cr( ) Aut cr( )/H Hc
p
H
cr(H)
Applied MathematicsOperations ResearchSimulation ScienceComputer Science
© 2010 All Rights Reserved
Who Are We?• Small, established scientific consulting firm
– ~150 employees– Founded in 1982
• Headquarters in Reston, Virginia– 20 miles from Washington, D.C.
• Employing many mathematicians– Ph.D. and undergraduate– To solve challenging, technical problems– For clients in the Defense and Intelligence communities
Metron Proprietary – 22
© 2010 All Rights Reserved
What kind of undergraduate background is useful for working at Metron?
• Computer skills– Java or C++
• Writing skills• Mathematics
– Linear algebra– Probability and statistics– Any course that contributes to mathematical
maturity
© 2010 All Rights Reserved
Exposing Terrorist Networks• Use ideas from classical detection theory
to determine presence of terroristcells in a network
Metron Proprietary – 4
Noise Process
Signal + NoiseProcess
Likelihood Ratio: optimal statistic for deciding whether a graph J arose from signal + noise process or noise only
LH (J) =P(J | )
P(J | + )
© 2010 All Rights Reserved
Network Detection: A Sample Theorem
Metron Proprietary – 5
… …
… …m “movies”
n “actors”
Unipartite Projection: who’s acted with whom
independent links,
average of m per actor
instance
of B *
Random Collaboration Model: B
*(n,m,m)• Kevin Bacon game: connect “actors” in same “movie”• Yields realistic network model (high clustering coefficient,
etc.)
( ) ( )1
( ) 111
* 1ibv H c HH i s
r Hr HsiH n
E X bO
sX K mm
B
Theorem [Lo, Ferry]: For m, n → ∞ with constant m ,
the expected number of subgraphs of B *(n,m,m) isomorphic to H is given by
• H represents a threat activity obscured by noise model B *
• Formula used to detect whether H arises by chance or by design
Example of Theorem
Let H be
v´(H) = 8 = number of non-isolated vertices of Hr(H) = 7 = rank of H
c(H) = 2 = number of cut vertices of H
Break H into blocks at cut vertices
31 2
1
31 3s
s s
Stirling numbers
count partitions of bi blocks into s
“movies”
Ratio of expected to possible number of H ’s is
8 2
87
* 1 3 1H
H n
E XO m
X K m
B
b1= 3 b2= 2
1 ib
s
© 2010 All Rights Reserved
Pattern Analysis and Link Discovery Tool for Networks (PALADIN) Components
Metron Proprietary – 6
• Customize extraction of entities and links, with attributes, from data
• Statistical analyses of numerous social network metrics to discover entities and groups with anomalous properties
• Subgraph matching to discover threat signatures
• Connect related signatures to detect organized threat networks and activities
Entity-Link Extractor Network Anomaly Detector
Network Pattern MatcherNetwork Visualization and Exploration Tool
• Drill-down into and compare discovered networks
• Functions and features to control display layout and information fidelity
Group Detector
• Hierarchical clustering algorithms to detect groups of interconnected entities
Recommended