December 2002 Estimate

Forecast to November 2003

Completed Ongoing Not started

( | ~ ( , , )) ( | target + noise)( )

( | ~ ( , )) ( | noise)

P Y J Y G n p T P JJ

P Z J Z G n p P J

Process structured, linked data onmultiple entity and link types

Detect terrorist activities vialikelihood ratio on random graphs

Track, forecast & develop course of actionvia terrorist enterprise model

December 2002 Estimate

Forecast to November 2003

Completed Ongoing Not started

( | ~ ( , , )) ( | target + noise)( )

( | ~ ( , )) ( | noise)

P Y J Y G n p T P JJ

P Z J Z G n p P J

Process structured, linked data onmultiple entity and link types

Detect terrorist activities vialikelihood ratio on random graphs

Track, forecast & develop course of actionvia terrorist enterprise model

[ ][ ]

( )( )

( )1( )

cr( )

var, ;

Hi i

i V HH

XB T T d O n

X pp

-

ÎÎ

= +å ÕE( ) ( )Aut cr( ) Aut cr( )/H Hc

p

H

cr(H)

Applied MathematicsOperations ResearchSimulation ScienceComputer Science

© 2010 All Rights Reserved

Who Are We?• Small, established scientific consulting firm

– ~150 employees– Founded in 1982

• Headquarters in Reston, Virginia– 20 miles from Washington, D.C.

• Employing many mathematicians– Ph.D. and undergraduate– To solve challenging, technical problems– For clients in the Defense and Intelligence communities

Metron Proprietary – 22

© 2010 All Rights Reserved

What kind of undergraduate background is useful for working at Metron?

• Computer skills– Java or C++

• Writing skills• Mathematics

– Linear algebra– Probability and statistics– Any course that contributes to mathematical

maturity

© 2010 All Rights Reserved

Exposing Terrorist Networks• Use ideas from classical detection theory

to determine presence of terroristcells in a network

Metron Proprietary – 4

Noise Process

Signal + NoiseProcess

Likelihood Ratio: optimal statistic for deciding whether a graph J arose from signal + noise process or noise only

LH (J) =P(J | )

P(J | + )

© 2010 All Rights Reserved

Network Detection: A Sample Theorem

Metron Proprietary – 5

… …

… …m “movies”

n “actors”

Unipartite Projection: who’s acted with whom

independent links,

average of m per actor

instance

of B *

Random Collaboration Model: B

*(n,m,m)• Kevin Bacon game: connect “actors” in same “movie”• Yields realistic network model (high clustering coefficient,

etc.)

( ) ( )1

( ) 111

* 1ibv H c HH i s

r Hr HsiH n

E X bO

sX K mm

B

Theorem [Lo, Ferry]: For m, n → ∞ with constant m ,

the expected number of subgraphs of B *(n,m,m) isomorphic to H is given by

• H represents a threat activity obscured by noise model B *

• Formula used to detect whether H arises by chance or by design

Example of Theorem

Let H be

v´(H) = 8 = number of non-isolated vertices of Hr(H) = 7 = rank of H

c(H) = 2 = number of cut vertices of H

Break H into blocks at cut vertices

31 2

1

31 3s

s s

Stirling numbers

count partitions of bi blocks into s

“movies”

Ratio of expected to possible number of H ’s is

8 2

87

* 1 3 1H

H n

E XO m

X K m

B

b1= 3 b2= 2

1 ib

s

© 2010 All Rights Reserved

Pattern Analysis and Link Discovery Tool for Networks (PALADIN) Components

Metron Proprietary – 6

• Customize extraction of entities and links, with attributes, from data

• Statistical analyses of numerous social network metrics to discover entities and groups with anomalous properties

• Subgraph matching to discover threat signatures

• Connect related signatures to detect organized threat networks and activities

Entity-Link Extractor Network Anomaly Detector

Network Pattern MatcherNetwork Visualization and Exploration Tool

• Drill-down into and compare discovered networks

• Functions and features to control display layout and information fidelity

Group Detector

• Hierarchical clustering algorithms to detect groups of interconnected entities