Download Blackhole and Patterns of Evasion Detection

Identifying and Analyzing
Patterns of Evasion
HM0210-13-1-0005
Investigator: Shashi Shekhar (U Minnesota)
Collaborators: Renee Laubscher, James Kang
Kickoff Date: September 2013
Identifying and Analyzing Patterns of Evasion
University of Minnesota
PI: Shashi Shekhar Year of Grant: 2013
Technical Challenge
• Develop space-time aware methods to model evasive behavior by
insurgents and other security targets.
• The behavior of security targets can be exploited to identify and
provide intelligence about locations and schedules of target.
Research Approach: We propose a method to distinguish
between evasive and non-evasive behaving targets by quantifying the
space-time entropy (predictability) of individuals’ movement. Also we
propose a complementary algorithm which identifies “blackholes,”
areas where no target movement is observed, despite predictions that
such movement would occur. A list of targets found to have patterns
of evasion are generated. Analyzing these evasion patterns will expose
potential sighting and interception places and time-slots of targets on
the list.
Accomplishments/Results
Transition Opportunities
•Extend capabilities of Oracle Spatial to facilitate a complete workflow
dataset from dataset input to actionable information.
Collaborations and Teaming
• Develop a conceptual model to represent the spatio-temporal
predictability of targets’ movement across a space.
• Create a conceptual model defining classes of blackhole events
which will help estimate the expected continuity of observation
through denied areas.
• Develop a conceptual model for hypothesized movement generation
based on trajectory fragments.
• Develop a conceptual model for Denial and Deception Aware Return
Periods.
• Mark Abrams, a consultant for the National Reconnaissance Office with
experience in GPS deprived areas.
• Prof. May Yuan at the University of Oklahoma working on movement
pattern analysis
• BI Incorporated, he makers of ankle-bracket GPS tracking devices for felons
out on parole, to utilize the anonymized GPS-track datasets of offenders for
research purposes.
Potential Research Payoff
PI: Shashi Shekhar
[email protected]
612-624-8307
Describe what impact successful research will deliver. Example:
• Creation of models for identifying evasive patterns.
• Success of predicting target movements and schedules.
• Building of tools embodying the new results.
Future Efforts
• Explore the tools and test bed to handle new blackhole patterns, more
advanced movement hypothesis and temporally correlated return periods.
Contact Info
TM: James M. Kang
[email protected]
Identifying and Analyzing
Patterns of Evasion
• Identify the behavior of Insurgents and Security Targets by using
location data.
• By identifying these behaviors, actionable intelligence
about locations and schedules of target individuals can be
provided.
Objectives
• Develop space-time aware methods for modeling patterns of
evasive behavior by insurgents and security targets:
• Distinguish between evasive and non-evasive behaving targets by
quantifying space-time entropy of individual’s movement.
• Identify Blackhole Regions where no target movement is
observed despite predictions.
• Generate hypothesis about target location and travel routes by
using trajectory fragments.
• Model Denial and Deception Aware Return Periods to estimate a
target’s schedule to aid in interception and surveillance.
Anticipated Results
• Mathematical Models
• Develop a graph based spatio-temporal data model to represent return
periods.
• Computer Algorithms
• Design new scalable data mining algorithms to find;
•
•
•
•
Space-Time Entropy
Blackholes
Theory-Based Movement Predictions
Return Periods
• Data Analysis Methods
• Develop new interest measures to quantify the proposed patterns of life.
• Analytical Tools
• Develop new software and extend capabilities of existing software to
facilitate the workflow from dataset to actionable information.
Applicability
• “Predictability kills”
• In Operation Areas, soldiers are advised to
avoid geo-tagging, which can reveal their location to adversaries.
• This advice is kept in mind by the terrorists as well.
• In operation areas like Afghanistan, non-evasive tribal groups
operate (e.g., villagers, nomads, traders) with different patterns-oflife, or different movement patterns, than evasive terrorists.
Approach
• Two Phases:
• Identify Evasion Patterns
• Distinguish between evasive and non-evasive behaving targets by quantifying
the space-time entropy
• Identify blackholes, where no target movement observed despite predictions
• Analyze Evasion Patterns
• Movement hypothesis for predicting movement in denied areas
• Model return periods to quantify and identify anomalous visits in target
movement data.
• By identifying these evasive behaviors, actionable intelligence about
locations and schedules of target individuals can be provided.
Science
1-4
• Space-Time Entropy Discrimination
• Identify target groups based on historical movement patterns by
using entropy measures.
• Shannon’s Diversity Index (SDI)
• Commonly used measure of entropy.
• Quantify predictability.
• SDI does not distinguish between clustered and unclustered
distributions(SDI may return the same value even though the data is
more concentrated).
• SDI is not independent of space partitioning (Depending on the
partition size, SDI score may change even underlying data does not).
• Develop a conceptual model (which addresses the limitations of SDI) to
represent the spatio-temporal predictability of target’s movement across
space.
Science
• Blackhole and Patterns of Evasion
Detection
• Blackhole: Areas where no target movement is
observed although target movements are
predicted
• Identify significant mismatches between
observations (expected vs. observed).
• Differentiate population and target evasion.
• Extrapolate Potential Path
2/4
Science
3/4
• Theory Based Movement Hypothesis Generation
• Traditional Data Mining Algorithms can not be used inside
blackholes due to lack of observations.
• Predict behavior inside blackhole.
• Use transportation networks
• Points of interest
• Hypothesize routes and locations based on the recorded
observations.
• We know starting and ending points
• We know transportation networks
• We predict the most likely routes, main corridors and key locations
that may be used.
Science
4/4
• Return Period in Movement Datasets
Once in 30 days
• Model routine activities of people
Routine
Activities
• Easier data mining on movement datasets
• Easier highlighting of anomalous activities
• Develop a conceptual model for denial-anddeception aware return periods to quantify and
identify anomalous places and visits.
• Challenges;
• Space and Time Partitioning
• Statistical Identification Measures for Anomalous
Places and Visits
• An efficient algorithm to deal with spatial big
data.
Conclusion
• Identifying the behavior of terrorists can exploit their intentions.
• Insurgents and Security Targets use Denial, Deception and Evasion
Techniques to mask their movement.
• These techniques may cause wrong operational and tactical
decisions.
• By identifying these evasive behaviors actionable intelligence about
locations and schedules of target individuals can be provided.