When Is Information Sufficient for Action? Search with Unreliable yet Informative Intelligence

We analyze a variant of the whereabouts search problem, in which a searcher looks for a target hiding in one of n possible locations. Unlike in the classic version, our searcher does not pursue the target by actively moving from one location to the next. Instead, the searcher receives a stream of intelligence about the location of the target. At any time, the searcher can engage the location he thinks contains the target or wait for more intelligence. The searcher incurs costs when he engages the wrong location, based on insufficient intelligence, or waits too long in the hopes of gaining better situational awareness, which allows the target to either execute his plot or disappear. We formulate the searcher’s decision as an optimal stopping problem and establish conditions for optimally executing this search-and-interdict mission

A Logical Characterization of Constraint-Based Causal Discovery

We present a novel approach to constraint-based causal discovery, that takes the form of straightforward logical inference, applied to a list of simple, logical statements about causal relations that are derived directly from observed (in)dependencies. It is both sound and complete, in the sense that all invariant features of the corresponding partial ancestral graph (PAG) are identified, even in the presence of latent variables and selection bias. The approach shows that every identifiable causal relation corresponds to one of just two fundamental forms. More importantly, as the basic building blocks of the method do not rely on the detailed (graphical) structure of the corresponding PAG, it opens up a range of new opportunities, including more robust inference, detailed accountability, and application to large models

Malware in the Future? Forecasting of Analyst Detection of Cyber Events

There have been extensive efforts in government, academia, and industry to anticipate, forecast, and mitigate cyber attacks. A common approach is time-series forecasting of cyber attacks based on data from network telescopes, honeypots, and automated intrusion detection/prevention systems. This research has uncovered key insights such as systematicity in cyber attacks. Here, we propose an alternate perspective of this problem by performing forecasting of attacks that are analyst-detected and -verified occurrences of malware. We call these instances of malware cyber event data. Specifically, our dataset was analyst-detected incidents from a large operational Computer Security Service Provider (CSSP) for the U.S. Department of Defense, which rarely relies only on automated systems. Our data set consists of weekly counts of cyber events over approximately seven years. Since all cyber events were validated by analysts, our dataset is unlikely to have false positives which are often endemic in other sources of data. Further, the higher-quality data could be used for a number for resource allocation, estimation of security resources, and the development of effective risk-management strategies. We used a Bayesian State Space Model for forecasting and found that events one week ahead could be predicted. To quantify bursts, we used a Markov model. Our findings of systematicity in analyst-detected cyber attacks are consistent with previous work using other sources. The advanced information provided by a forecast may help with threat awareness by providing a probable value and range for future cyber events one week ahead. Other potential applications for cyber event forecasting include proactive allocation of resources and capabilities for cyber defense (e.g., analyst staffing and sensor configuration) in CSSPs. Enhanced threat awareness may improve cybersecurity.Comment: Revised version resubmitted to journa

Innate talents: reality or myth?

Talents that selectively facilitate the acquisition of high levels of skill are said to be present in some children but not others. The evidence for this includes biological correlates of specific abilities, certain rare abilities in autistic savants, and the seemingly spontaneous emergence of exceptional abilities in young children, but there is also contrary evidence indicating an absence of early precursors of high skill levels. An analysis of positive and negative evidence and arguments suggests that differences in early experiences, preferences, opportunities, habits, training, and practice are the real determinants of excellence