Christian Mårtenson

Harvesting and analysis of weak signals for detecting lone wolf terrorists

AbstractLone wolf terrorists pose a large threat to modern society. The current ability to identify and stop these kinds of terrorists before they commit a terror act is limited since they are hard to detect using traditional methods. However, these individuals often make use of Internet to spread their beliefs and opinions, and to obtain information and knowledge to plan an attack. Therefore there is a good possibility that they leave digital traces in the form of weak signals that can be gathered, fused, and analyzed.In this article we present an analysis method that can be used to analyze extremist forums to detect digital traces of possible lone wolf terrorists. This method is conceptually demonstrated using the FOI Impactorium fusion platform. We also present a number of different technologies which can be used to harvest and analyze pieces of information from Internet that may serve as weak digital traces that can be fused using the suggested analysis method in order to discover possible lone wolf terrorists.

An information fusion demonstrator for tactical intelligence processing in network-based defense

The Swedish Defence Research Agency (FOI) has developed a concept demonstrator called the Information Fusion Demonstrator 2003 (IFD03) for demonstrating information fusion methodology suitable for a future Network Based Defense (NBD) C4ISR system. The focus of the demonstrator is on real-time tactical intelligence processing at the division level in a ground warfare scenario. The demonstrator integrates novel force aggregation, particle filtering, and sensor allocation methods to create, dynamically update, and maintain components of a tactical situation picture. This is achieved by fusing physically modelled and numerically simulated sensor reports from several different sensor types with realistic a priori information sampled from both a high-resolution terrain model and an enemy organizational and behavioral model. This represents a key step toward the goal of creating in real time a dynamic, high fidelity representation of a moving battalion-sized organization, based on sensor data as well as a priori intelligence and terrain information, employing fusion, tracking, aggregation, and resource allocation methods all built on well-founded theories of uncertainty. The motives behind this project, the fusion methods developed for the system, as well as its scenario model and simulator architecture are described. The main services of the demonstrator are discussed and early experience from using the system is shared.

Detecting Social Positions Using Simulation

Describing social positions and roles is an important topic within social network analysis. One approach is to compute a suitable equivalence relation on the nodes of the target network. One relation that is often used for this purpose is regular equivalence, or bisimulation, as it is known within the field of computer science. In this paper we consider a relation from computer science called simulation relation. Simulation creates a partial order on the set of actors in a network and we can use this order to identify actors that have characteristic properties. The simulation relation can also be used to compute simulation equivalence which is a less restrictive equivalence relation than regular equivalence but is still computable in polynomial time. This paper primarily considers weighted directed networks and we present definitions of both weighted simulation equivalence and weighted regular equivalence. Weighted networks can be used to model a number of network domains, including information flow, trust propagation, and communication channels. Many of these domains have applications within homeland security and in the military, where one wants to survey and elicit key roles within an organization. Identifying social positions can be difficult when the target organization lacks a formal structure or is partially hidden.

Using the impact matrix for predictive situational awareness

In order to manage situations efficiently, commanders need to be aware of possible future events that might occur. They also need to be aware of the relative probabilities of different events, so that they know which events to take into account when making plans of their own. In this paper, we describe a concept prototype that was developed at FOI during 2006 that helps commanders do these tasks. The impact matrix is a tool that has been used in business for risk handling. We describe the impact matrix and how it can be adapted for military use. To connect observations from soldiers and sensors to events, indicators are used as tags. Belief networks are used to connect indicators to events. Results from a preliminary experiment using a scenario based on an asymmetric conflict where a Swedish battle group is tasked with preserving peace are presented.

Analysis of Weak Signals for Detecting Lone Wolf Terrorists

Lone wolf terrorists pose a large threat to modern society. The current ability to identify and stop these kind of terrorists before they commit a terror act is limited since they are very hard to detect using traditional methods. However, these individuals often make use of Internet to spread their beliefs and opinions, and to obtain information and knowledge to plan an attack. Therefore, there is a good possibility that they leave digital traces in the form of weak signals that can be gathered, fused, and analyzed. In this work we present an analysis method that can be used to analyze extremist forums to profile possible lone wolf terrorists. This method is conceptually demonstrated using the FOI Impactorium fusion platform. We also present a number of different technologies that can be used to harvest and analyze information from Internet, serving as weak digital traces that can be fused using the suggested analysis method, in order to discover possible lone wolf terrorists.

Combining Entity Matching Techniques for Detecting Extremist Behavior on Discussion Boards

Many extremist groups and terrorists use the Web for various purposes such as exchanging and reinforcing their beliefs, making monitoring and analysis of discussion boards an important task for intelligence analysts in order to detect individuals that might pose a threat towards society. In this work we focus on how to automatically analyze discussion boards in an effective manner. More specifically, we propose a method for fusing several alias (entity) matching techniques that can be used to identify authors with multiple aliases. This is one part of a larger system, where the aim is to provide the analyst with a list of potential extremist worth investigating further.

Integrating Data Sources and Network Analysis Tools to Support the Fight Against Organized Crime

We discuss how methods from social network analysis could be combined with methodologies from database mediator technology and information fusion in order to give police and other civil security decision-makers the ability to achieve predictive situation awareness. Techniques based on these ideas have been demonstrated in the EU PASR project HiTS/ISAC.

Evaluating sensor allocations using equivalence classes of multi-target paths

We present an algorithm for evaluating sensor allocations using simulation of equivalence classes of possible futures. Our method is meant to be used for pre-planning sensor allocations, e.g., for choosing between several alternative flight-paths for UAVs, or deciding where to deploy ground sensor networks. The method can be used to choose the best sensor allocation with respect to any fusion method. In addition to the list of sensor allocations to evaluate, the algorithm requires knowledge of the terrain/road network of the region of interest. Additional doctrinal knowledge on the enemys possible goals and rules of engagement can increase the speed of the method, but is not required. Given a current situation picture, the method generates possible future paths for the objects of interest. For each considered sensor allocation, these futures are partitioned into equivalence classes. Two futures are considered equivalent with respect to a given sensor allocation if they would give rise to the same set of observations. For each such equivalence class, we run a fusion algorithm; in this paper, an emulated multi-target tracker. We use the output of this emulated filter to determine a fitness for each sensor allocation under evaluation. For small scenarios, we compare some different ways of calculating this fitness, concluding that an approximation introduced by us gives nearly the same result as an exact method. We also introduce a formulation of the studied problem and the method used to solve it using random sets, and give several directions for future work.

Detecting Emergent Conflicts through Web Mining and Visualization

An ocean of data is available on the web. From this ocean of data, information can in theory be extracted and used by analysts for detecting emergent trends (trend spotting). However, to do this manually is a daunting and nearly impossible task. We describe a semi-automatic system in which data is automatically collected from selected sources, and to which linguistic analysis is applied to extract e.g., entities and events. After combining the extracted information with human intelligence reports, the results are visualized to the user of the system who can interact with it in order to obtain a better awareness of historic as well as emergent trends. A prototype of the proposed system has been implemented and some initial results are presented in the paper.

A Tool for Generating, Structuring, and Analyzing Multiple Hypotheses in Intelligence Work

In this paper, we present an analysis tool that is developed to support the process of generating and evaluating a large set of hypotheses. The computer tool is to a large extent based on two established analytical methods, Morphological Analysis and Analysis of Competing Hypotheses, and aims to facilitate the analysis by offering support for organizing and visualizing information. In particular, the tool provides support for efficient management of links between evidence and hypotheses. By linking evidence directly to elements of a morphological chart, the analyst can work directly with sets of hypotheses and thereby significantly decrease the number of manual steps necessary to complete the analysis.