Investigative Simulation: Towards Utilizing Graph Pattern Matching for Investigative Search

This paper proposes the use of graph pattern matching for investigative graph search, which is the process of searching for and prioritizing persons of interest who may exhibit part or all of a pattern of suspicious behaviors or connections. While there are a variety of applications, our principal motivation is to aid law enforcement in the detection of homegrown violent extremists. We introduce investigative simulation, which consists of several necessary extensions to the existing dual simulation graph pattern matching scheme in order to make it appropriate for intelligence analysts and law enforcement officials. Specifically, we impose a categorical label structure on nodes consistent with the nature of indicators in investigations, as well as prune or complete search results to ensure sensibility and usefulness of partial matches to analysts. Lastly, we introduce a natural top-k ranking scheme that can help analysts prioritize investigative efforts. We demonstrate performance of investigative simulation on a real-world large dataset.Comment: 8 pages, 6 figures. Paper to appear in the Fosint-SI 2016 conference proceedings in conjunction with the 2016 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining ASONAM 201

Investigative Pattern Detection Framework for Counterterrorism

Law-enforcement investigations aimed at preventing attacks by violent extremists have become increasingly important for public safety. The problem is exacerbated by the massive data volumes that need to be scanned to identify complex behaviors of extremists and groups. Automated tools are required to extract information to respond queries from analysts, continually scan new information, integrate them with past events, and then alert about emerging threats. We address challenges in investigative pattern detection and develop an Investigative Pattern Detection Framework for Counterterrorism (INSPECT). The framework integrates numerous computing tools that include machine learning techniques to identify behavioral indicators and graph pattern matching techniques to detect risk profiles/groups. INSPECT also automates multiple tasks for large-scale mining of detailed forensic biographies, forming knowledge networks, and querying for behavioral indicators and radicalization trajectories. INSPECT targets human-in-the-loop mode of investigative search and has been validated and evaluated using an evolving dataset on domestic jihadism.Comment: 9 pages, 4 figure

Graph-based, systems approach for detecting violent extremist radicalization trajectories and other latent behaviors, A

2017 Summer.Includes bibliographical references.The number and lethality of violent extremist plots motivated by the Salafi-jihadist ideology have been growing for nearly the last decade in both the U.S and Western Europe. While detecting the radicalization of violent extremists is a key component in preventing future terrorist attacks, it remains a significant challenge to law enforcement due to the issues of both scale and dynamics. Recent terrorist attack successes highlight the real possibility of missed signals from, or continued radicalization by, individuals whom the authorities had formerly investigated and even interviewed. Additionally, beyond considering just the behavioral dynamics of a person of interest is the need for investigators to consider the behaviors and activities of social ties vis-à-vis the person of interest. We undertake a fundamentally systems approach in addressing these challenges by investigating the need and feasibility of a radicalization detection system, a risk assessment assistance technology for law enforcement and intelligence agencies. The proposed system first mines public data and government databases for individuals who exhibit risk indicators for extremist violence, and then enables law enforcement to monitor those individuals at the scope and scale that is lawful, and account for the dynamic indicative behaviors of the individuals and their associates rigorously and automatically. In this thesis, we first identify the operational deficiencies of current law enforcement and intelligence agency efforts, investigate the environmental conditions and stakeholders most salient to the development and operation of the proposed system, and address both programmatic and technical risks with several initial mitigating strategies. We codify this large effort into a radicalization detection system framework. The main thrust of this effort is the investigation of the technological opportunities for the identification of individuals matching a radicalization pattern of behaviors in the proposed radicalization detection system. We frame our technical approach as a unique dynamic graph pattern matching problem, and develop a technology called INSiGHT (Investigative Search for Graph Trajectories) to help identify individuals or small groups with conforming subgraphs to a radicalization query pattern, and follow the match trajectories over time. INSiGHT is aimed at assisting law enforcement and intelligence agencies in monitoring and screening for those individuals whose behaviors indicate a significant risk for violence, and allow for the better prioritization of limited investigative resources. We demonstrated the performance of INSiGHT on a variety of datasets, to include small synthetic radicalization-specific data sets, a real behavioral dataset of time-stamped radicalization indicators of recent U.S. violent extremists, and a large, real-world BlogCatalog dataset serving as a proxy for the type of intelligence or law enforcement data networks that could be utilized to track the radicalization of violent extremists. We also extended INSiGHT by developing a non-combinatorial neighbor matching technique to enable analysts to maintain visibility of potential collective threats and conspiracies and account for the role close social ties have in an individual's radicalization. This enhancement was validated on small, synthetic radicalization-specific datasets as well as the large BlogCatalog dataset with real social network connections and tagging behaviors for over 80K accounts. The results showed that our algorithm returned whole and partial subgraph matches that enabled analysts to gain and maintain visibility on neighbors' activities. Overall, INSiGHT led to consistent, informed, and reliable assessments about those who pose a significant risk for some latent behavior in a variety of settings. Based upon these results, we maintain that INSiGHT is a feasible and useful supporting technology with the potential to optimize law enforcement investigative efforts and ultimately enable the prevention of individuals from carrying out extremist violence. Although the prime motivation of this research is the detection of violent extremist radicalization, we found that INSiGHT is applicable in detecting latent behaviors in other domains such as on-line student assessment and consumer analytics. This utility was demonstrated through experiments with real data. For on-line student assessment, we tested INSiGHT on a MOOC dataset of students and time-stamped on-line course activities to predict those students who persisted in the course. For consumer analytics, we tested the performance on a real, large proprietary consumer activities dataset from a home improvement retailer. Lastly, motivated by the desire to validate INSiGHT as a screening technology when ground truth is known, we developed a synthetic data generator of large population, time-stamped, individual-level consumer activities data consistent with an a priori project set designation (latent behavior). This contribution also sets the stage for future work in developing an analogous synthetic data generator for radicalization indicators to serve as a testbed for INSiGHT and other data mining algorithms

Effects of Dynamic Goals on Agent Performance

Autonomous systems are increasingly being used for complex tasks in dynamic environments. Robust automation needs to be able to establish its current goal and determine when the goal has changed. In human-machine teams autonomous goal detection is an important component of maintaining shared situational awareness between both parties. This research investigates how different categories of goals affect autonomous change detection in a dynamic environment. In order to accomplish this goal, a set of autonomous agents were developed to perform within an environment with multiple possible goals. The agents perform the environmental task while monitoring for goal changes. The experiment tests the agents over a range of goal changes to determine how detection performance is affected by the different categories of goals. Results show that detection is highly dependent on what goal is being switch to and from. The point similarity between goals is the most significant factor in evaluating the change detection time. An additional experiment improved upon the goal agent and demonstrated the importance of having the proper perception mechanics for feedback within the environment

Space exploration: The interstellar goal and Titan demonstration

Automated interstellar space exploration is reviewed. The Titan demonstration mission is discussed. Remote sensing and automated modeling are considered. Nuclear electric propulsion, main orbiting spacecraft, lander/rover, subsatellites, atmospheric probes, powered air vehicles, and a surface science network comprise mission component concepts. Machine, intelligence in space exploration is discussed

Learning about Large Scale Image Search: Lessons from Global Scale Hotel Recognition to Fight Sex Trafficking

Hotel recognition is a sub-domain of scene recognition that involves determining what hotel is seen in a photograph taken in a hotel. The hotel recognition task is a challenging computer vision task due to the properties of hotel rooms, including low visual similarity between rooms in the same hotel and high visual similarity between rooms in different hotels, particularly those from the same chain. Building accurate approaches for hotel recognition is important to investigations of human trafficking. Images of human trafficking victims are often shared by traffickers among criminal networks and posted in online advertisements. These images are often taken in hotels. Using hotel recognition approaches to determine the hotel a victim was photographed in can assist in investigations and prosecutions of human traffickers. In this dissertation, I present an application for the ongoing capture of hotel imagery by the public, a large-scale curated dataset of hotel room imagery, deep learning approaches to hotel recognition based on this imagery, a visualization approach that provides insight into what networks trained on image similarity are learning, and an approach to image search focused on specific objects in scenes. Taken together, these contributions have resulted in a first in the world system that offers a solution to answering the question, `What hotel was this photograph taken in?\u27 at a global scale

Risk factors and indicators for engagement in violent extremism

Research on terrorism is increasingly empirical and a number of significant advancements have been made. One such evolution is the emergent understanding of risk factors and indicators for engagement in violent extremism. Beyond contributing to academic knowledge, this has important real-world implications. Notably, the development of terrorism risk assessment tools, as well as behavioural threat assessment in counterterrorism. This thesis makes a unique contribution to the literature in two key ways. First, there is a general consensus that no single, stable profile of a terrorist exists. Relying on profiles of static risk factors to inform judgements of risk and/or threat may therefore be problematic, particularly given the observed multi- and equi-finality. One way forward may be to identify configurations of risk factors and tie these to the theorised causal mechanisms they speak to. Second, there has been little attempt to measure the prevalence of potential risk factors for violent extremism in a general population, i.e. base rates. Establishing general population base rates will help develop more scientifically rigorous putative risk factors, increase transparency in the provision of evidence, minimise potential bias in decision-making, improve risk communication, and allow for risk assessments based on Bayesian principles. This thesis consists of four empirical chapters. First, I inductively disaggregate dynamic person-exposure patterns (PEPs) of risk factors in 125 cases of lone-actor terrorism. Further analysis articulates four configurations of individual-level susceptibilities which interact differentially with situational, and exposure factors. The PEP typology ties patterns of risk factors to theorised causal mechanisms specified by a previously designed Risk Analysis Framework (RAF). This may be more stable grounds for risk assessment however than relying on the presence or absence of single factors. However, with no knowledge of base rates, the relevance of seemingly pertinent risk factors remains unclear. However, how to develop base rates is of equal concern. Hence, second, I develop the Base Rate Survey and compare two survey questioning designs, direct questioning and the Unmatched Count Technique (UCT). Under the conditions described, direct questioning yields the most appropriate estimates. Third, I compare the base rates generated via direct questioning to those observed across a sample of lone-actor terrorists. Lone-actor terrorists demonstrated more propensity, situational, and exposure risk factors, suggesting these offenders may differ from the general population in measurable ways. Finally, moving beyond examining the prevalence rates of single factors, I collect a second sample in order to model the relations among these risk factors as a complex, dynamic system. To do so, the Base Rate Survey: UK is distributed to a representative sample of 1,500 participants from the UK. I introduce psychometric network modelling to terrorism studies which visualises the interactions among risk factors as a complex system via network graphs

A neural network model of adaptively timed reinforcement learning and hippocampal dynamics

A neural model is described of how adaptively timed reinforcement learning occurs. The adaptive timing circuit is suggested to exist in the hippocampus, and to involve convergence of dentate granule cells on CA3 pyramidal cells, and NMDA receptors. This circuit forms part of a model neural system for the coordinated control of recognition learning, reinforcement learning, and motor learning, whose properties clarify how an animal can learn to acquire a delayed reward. Behavioral and neural data are summarized in support of each processing stage of the system. The relevant anatomical sites are in thalamus, neocortex, hippocampus, hypothalamus, amygdala, and cerebellum. Cerebellar influences on motor learning are distinguished from hippocampal influences on adaptive timing of reinforcement learning. The model simulates how damage to the hippocampal formation disrupts adaptive timing, eliminates attentional blocking, and causes symptoms of medial temporal amnesia. It suggests how normal acquisition of subcortical emotional conditioning can occur after cortical ablation, even though extinction of emotional conditioning is retarded by cortical ablation. The model simulates how increasing the duration of an unconditioned stimulus increases the amplitude of emotional conditioning, but does not change adaptive timing; and how an increase in the intensity of a conditioned stimulus "speeds up the clock", but an increase in the intensity of an unconditioned stimulus does not. Computer simulations of the model fit parametric conditioning data, including a Weber law property and an inverted U property. Both primary and secondary adaptively timed conditioning are simulated, as are data concerning conditioning using multiple interstimulus intervals (ISIs), gradually or abruptly changing ISis, partial reinforcement, and multiple stimuli that lead to time-averaging of responses. Neurobiologically testable predictions are made to facilitate further tests of the model.Air Force Office of Scientific Research (90-0175, 90-0128); Defense Advanced Research Projects Agency (90-0083); National Science Foundation (IRI-87-16960); Office of Naval Research (N00014-91-J-4100

Human-Centered Approach to Technology to Combat Human Trafficking

Human trafficking is a serious crime that continues to plague the United States. With the rise of computing technologies, the internet has become one of the main mediums through which this crime is facilitated. Fortunately, these online activities leave traces which are invaluable to law enforcement agencies trying to stop human trafficking. However, identifying and intervening with these cases is still a challenging task. The sheer volume of online activity makes it difficult for law enforcement to efficiently identify any potential leads. To compound this issue, traffickers are constantly changing their techniques online to evade detection. Thus, there is a need for tools to efficiently sift through all this online data and narrow down the number of potential leads that a law enforcement agency can deal with. While some tools and prior research do exist for this purpose, none of these tools adequately address law enforcement user needs for information visualizations and spatiotemporal analysis. Thus to address these gaps, this thesis contributes an empirical study of technology and human trafficking. Through in-depth qualitative interviews, systemic literature analysis, and a user-centered design study, this research outlines the challenges and design considerations for developing sociotechnical tools for anti-trafficking efforts. This work further contributes to the greater understanding of the prosecution efforts within the anti-trafficking domain and concludes with the development of a visual analytics prototype that incorporates these design considerations.Ph.D