Kevin L. Fox

SENTINEL: a multiple engine information retrieval and visualization system

We describe a prototype Information Retrieval system, SENTINEL, under development at Harris Corporations Information Systems Division. SENTINEL is a fusion of multiple information retrieval technologies, integrating n-grams, a vector space model, and a neural network training rule. One of the primary advantages of SENTINEL is its three-dimenstional visualization capability that is based fully upon the mathematical representation of information within SENTINEL. This three-dimensional visualization capability provides users with an intuitive understanding, with relevance feedback/query refinement techniques that can be better utilized, resulting in higher retrieval accuracy (precision).

An empirical study of industrial security-engineering practices

This paper presents lessons learned and observations noted about the state of security-engineering practices by three information security practitioners with different perspectives - two in industry and one in academia. All authors have more than 20-years experience in this field and two were former members of the US National Computer Security Center during the early days of the Trusted Computer System Evaluation Criteria and the strong promotion of trusted operating systems that accompanied the release of that document. In the last 20 years, it has been argued that security-engineering practices have not kept pace with the escalating threats to information systems. Much has occurred since that time - new security paradigms, failure of evaluated products to emerge into common use, new systemic threats, and an increased awareness of the risk faced by information systems. This paper presents an empirical view of lessons learned in security-engineering, experiences in applying the trade, and observations made about the successes and failures of security practices and technology. This work was sponsored in part by NSF Grant.

A perceptually-relevant model-based cyber threat prediction method for enterprise mission assurance

Cyber attacks remain elusive and are increasingly effective. Information security professionals regularly monitor network resources and cyber security websites with an interest in understanding how such threats expose their enterprises vulnerabilities and dependencies. However, information must be persistently and purposefully examined from a multitude of resources in order to establish context and situational awareness. This in turn, enables organizations to perceive, anticipate and counteract threats before they occur and helps assure their ability to accomplish their missions. Global information must be transformed into timely and local actionable knowledge. To achieve this, cyber event data coupled with knowledge of the semantic interrelationships between other location, object, agent, and event entities need to be factored to facilitate a clearer understanding of the total cyber landscape. In this work, we introduce an ontology driven framework comprising of a dynamic knowledge base, a functional and self-updating mission model, and the associated information and complex event processing capabilities. We focus the description of the system on cyber mission information needs, whereby collection, processing, management and mission model updates are based on cyber-related information from a variety of resources including commercial news, blogs, wikis, and social media sources. The result is a dynamic capability for cyber mission management that provides proactive, on demand cyber information to analysts, professionals, policy makers, and support personnel.

A game theory model for situation awareness and management

We describe a model for determining strategies for making decisions. Decision making involves a model with several possible actions, state of the world with a probability, and a metric of how well the best decision was made. The ability to perform data mining and discover patterns to automatically predict likelihood of reaction to specific events and situational awareness is enhanced from multiple social media inputs. We discuss development of a method for determining actionable information to efficiently propitiate manpower, equipment assets, or propaganda responses. Our solution combines a variety of textual content information in different formats to help with a decision process to include sources, systems, and services that control and influence a situation. Different viewpoints need to be understood that are points involved in the event. Our FeatureSEARCHTM tool is helpful for rapidly parsing text that has been extracted with an intelligent algorithm in order to evaluate the population sentiment for the targeted area. Our tool allows for calculating optimal strategies provides greater knowledge about the state of the world and increases the likelihood of a decision maker making the best decision. We discuss game theory using linear programming methods to solve for multiple possible strategies that are known. The decision makers success depends upon his ability to correctly and automatically judge the multiple psychological and rational factors. The goal of our system, called GlobalSite, is to deliver trustworthy threat analysis systems and services that understand situations, while being a vital tool for continuing mission operations information.

Industrial evaluation of a highly-accurate academic IR system

In this paper we report the results of an independent experimental evaluation of an information retrieval (IR) system developed at the Illinois Institute of Technology (IIT). The system, which is called the Advanced Information Retrieval Engine (AIRE), consists of a set of tools and utilities providing indexing, extraction, searching and visualization. We evaluated AIRE on three data sets from the Text REtrieval Conference (TREC) - TREC 8, 9 and 10. Overall, our results indicate that AIRE is a highly accurate IR system. Compared with results published by IIT, in our experiments AIRE consistently scored higher in recall. AIRE also scored higher in precision, but only for automatic tasks. In manual tasks, AIRE scored lower in precision in our experiments, but we attributed that to factors external to AIRE. Our final conclusion is that AIRE is a highly accurate IR system.

Multi-dimensional reward volumes for sensor priority strategies

We describe a model for determining strategies for making decisions for sensor prioritization strategies. We combine operations research methods and remote sensing for decision making with several possible actions, state of the world, and a mixed probability metric. We perform data mining and discover patterns to automatically enhance situational awareness from multiple sensor inputs. Our solution has been developed for a method for determining actionable information to efficiently manage remote sensing assets and use open source information. Our tool allows for calculating optimal strategies, provides greater knowledge about the state of the world, and increases the likelihood of a decision maker making the best decision. We discuss multi-dimensional game theory using linear programming methods to solve for multiple possible strategies. We discuss a new concept of reward volumes. The decision makers success depends upon his ability to correctly and automatically judge the multiple factors. The goal of our system, called GlobalSite, is to deliver trustworthy threat analysis systems and services that understand situations, while being a vital tool for continuing mission operations.

Matching social network biometrics using geo-analytical behavioral modeling

Social patterns and graphical representation of geospatial activity is important for describing a persons typical behavior. We discuss a framework using social media and GPS smart phone to track an individual and establish normal activity with a network biometric. An individuals daily routine may include visiting many locations - home, work, shopping, entertainment and other destinations. All of these activities pose a routine or status quo of expected behavior. What has always been difficult, however, is predicting a change to the status quo, or predicting unusual behavior. We propose taking the knowledge of location information over a relatively long period of time and marrying that with modern analytical capabilities. The result is a biometric that can be fused and correlated with anothers behavioral biometric to determine relationships. Our solution is based on the analytical environment to support the ingestion of many data sources and the integration of analytical algorithms such as feature extraction, crowd source analysis, open source data mining, trends, pattern analysis and linear game theory optimization. Our framework consists of a hierarchy of data, space, time, and knowledge entities. We exploit such statistics to predict behavior or activity based on past observations. We use multivariate mutual information as a measure to compare behavioral biometrics.

Optimal multi-dimensional fusion model for sensor allocation and accuracy assessment

I We describe a multi-dimensional model for fusion of activity based intelligence (ABI) hypothesis-driven evidence through optimal sensor management. We determine decision-making strategies based upon ability to perform data mining and pattern discovery utilizing open source, actionable information to prepare for specific events or situations from multiple information sources. Our solution is based on an analytical framework using game theory to support ingestion of data sources (evidence); integration of analytical algorithms for feature extraction, crowd source analysis, open source data mining, trends, and pattern analysis and linear game theory optimization to support multiple hypothesis analysis. This solution may also save money by offering a Pareto efficient, repeatable process for resource management. We combine operations research methods and remote sensing for decision-making with several possible actions, state of world, and a mixed pro bability metric. Our tool allows for calculating optimal strategies, provides greater knowledge about remote sensing access times and increases likelihood of a decision-maker making best decision. We fuse evidence using Dempsters Rule and Nash Equilibrium (NE) for allocation of demands by sensor modality. We discuss a method for calculating optimal detector to determine accuracy of resource allocation. By calculating all NE possibilities per period, optimization of sensor allocation is achieved for overall higher system efficiency. We model impact of decision-making on accuracy by adding more dimensions to decision-making process as sensitivity analysis. Future work is to implement the design on a distributed processing platform to support real-world-sized scenarios and simulations.

Multi-disciplinary ontological geo-analytical incident modeling

Cultural patterns and representations of crime areas are important in geo-analytics. We discuss a multi-disciplinary ontology that provides an analytical, architectural framework to apply a broad spectrum of analytical capabilities to changes the world faces on a daily basis to determine an optimal allocation of resources for continuous enrichment of Foundation GEOINT content. All of these changes such as food shortages, weather, environmental hazards, traffic congestion, economic crises, political unrest, un-employment, and specifically crime, pose a constant struggle in societies to maintain status quo. What has always been difficult to predict is change to status quo, or predicting regions at risk or undergoing stress. We propose taking knowledge of a location and society, and marrying that with modern analytical capabilities, including linear game theory, to pit forces of maintaining status quo against forces within society that desire to force a drastic change. The result is a probabilistic output of potential outcomes that can be further analyzed to predict most likely and most dangerous outcomes. Our solution is based on analytical environment to support ingestion of many data sources and integration of analytical algorithms such as feature extraction, crowd source analysis, open source data mining, trends, pattern analysis and linear game theory optimization. Our framework consists of a hierarchy of data, space, time and knowledge entities. We exploit such crime statistics to predict crime activity based on past observations. We also show simulations based on minimum mean squared error (mmse) and pseudo estimators of crime activity.

Bayesian Fusion of Back Projected Probabilities BFBP: Co-occurrence Descriptors for Tracking in Complex Environments

Among the multitude of probabilistic tracking techniques, the Continuously Adaptive Mean Shift CAMSHIFT algorithm has been one of the most popular. Though several modifications have been proposed to the original formulation of CAMSHIFT, limitations still exist. In particular the algorithm underperforms when tracking textured and patterned objects. In this paper we generalize CAMSHIFT for the purposes of tracking such objects in non-stationary backgrounds. Our extension introduces a novel object modeling technique, while retaining a probabilistic back projection stage similar to the original CAMSHIFT algorithm, but with considerably more discriminative power. The object modeling now evolves beyond a single probability distribution to a more generalized joint density function on localized color patterns. In our framework, multiple co-occurrence density functions are estimated using information from several color channel combinations and these distributions are combined using an intuitive Bayesian approach. We validate our approach on several aerial tracking scenarios and demonstrate its improved performance over the original CAMSHIFT algorithm and one of its most successful variants.