Search

Intelligence analysts are flooded with massive amounts of data from a multitude of sources and in many formats. From this raw data they attempt to gain insight that will provide decision makers with the right information at the right time. Data quality varies from very high quality data generated by reputable sources to misleading and very low quality data generated by malicious entities. Disparate organizations and databases, global collection networks and international language differences further hamper the analyst's job. We present a web based information firewall to help counter these problems. It allows analysts to collaboratively customize web content by the creation and sharing of dynamic knowledge-based user interfaces that greatly improve data quality, and hence analyst effectiveness, through filtering, fusion and dynamic transformation techniques. Our results indicate that this approach is not only effective, but will scale to support large entities within the Intelligence Community. [ABSTRACT FROM AUTHOR]

Field proven Root Cause Analysis (RCA) from the industrial sector can assist the terrorism community in decompiling terrorist acts to further understand the mentalities that trigger such events to escalate. RCA is a disciplined thought process that is not specific to any industry or given situation, but specific to the human being. We will focus on how to logically breakdown a seemly complex event into it more manageable sub-components. [ABSTRACT FROM AUTHOR]

Terrorism and insurgency analysis depends critically on qualitative understanding, to ensure that quantitative work is on target. Key concerns include: qualitative analysis distorted by policy expectation, obstructed by compartmentalization and classification, and mistaken when drawing from the wrong history and experience. Open presentation of analytic processes allows more effective judgment of the credibility of analysis and interpretations. Data itself will not be the problem, but rather the constructs and methodologies used to assemble the data into conclusions. These challenges are at the heart of terrorist informatics. [ABSTRACT FROM AUTHOR]

To assess the type or spectrum of warfare that a terrorist group is likely to conduct in its operations, this paper proposes an indications and warning (I&W) methodology to comprehensively and systematically map all the significant indicators (as well as sub-indicators and observables) that need to be examined. [ABSTRACT FROM AUTHOR]

This forecasting methodology identifies 68 indicators of terrorism and employs proven analytic techniques in a systematic process that safeguards against 36 of the 42 common warning pitfalls that experts have identified throughout history. The complete version of this research provides: 1) a step-by-step explanation of how to forecast terrorism, 2) an evaluation of the forecasting system against the 42 common warning pitfalls that have caused warning failures in the past, and 3) recommendations for implementation. The associated CD has the website interface to this methodology to forecast terrorist attacks. This methodology could be applied to any intelligence topic (not just terrorism) by simply changing the list of indicators. The complete version of this research is available in Forecasting Terrorism: Indicators and Proven Analytic Techniques, Scarecrow Press, Inc., ISBN 0-8108-5017-6. [ABSTRACT FROM AUTHOR]

This paper presents a prototype design and implementation of secured mobile phones based on embedded fingerprint recognition systems. One is a front-end fingerprint capture sub-system and the other is a back-end fingerprint recognition system based on smart phones. The fingerprint capture sub-system is an external module which contains two parts: an ARM-Core processor LPC2106 and an Atmel Finger Sensor AT77C101B. The LPC2106 processor controls the AT77C101B sensor to capture the fingerprint image. In the fingerprint recognition system, a new fingerprint verification algorithm was implemented on internal hardwares. The performance of the proposed system, with 4.16% equal error rate (EER) was examined on Atmel fingerprints database. The average computation time on a 13 MHz CPU S1C33 (by Epson) is about 5.0 sec. [ABSTRACT FROM AUTHOR]

This paper gives an introduction to an ambitious database project currently running at the International Policy Institute for Counter-Terrorism. The project builds on an extensive database of terrorist incidents dating back to 1968 and adds both content and functionality to make these databases more accessible to researchers. The information on terrorist incidents has been supplemented with information on the organizations responsible, the individual perpetrators, front companies, and monetary sources. The content now being added to the database includes raw historical data from interviews and court documents. This information can provide valuable sociological data for researchers, including how perpetrators were recruited for each attack; their stated motivation; their socio-economic background; what influenced them to join the terrorist organization; etc. [ABSTRACT FROM AUTHOR]

Trusted software execution, prevention of code and data tampering, authentication, and providing a secure environment for software are some of the most important security challenges in the design of embedded systems. This short paper evaluates the performance of a hardware/software co-design methodology for embedded software protection. Secure software is created using a secure compiler that inserts hidden codes into the executable code which are then validated dynamically during execution by a reconfigurable hardware component constructed from Field Programmable Gate Array (FPGA) technology. While the overall approach has been described in other papers, this paper focuses on security-performance tradeoffs and the effect of using compiler optimizations in such an approach. Our results show that the approach provides software protection with modest performance penalty and hardware overhead. [ABSTRACT FROM AUTHOR]

Investigation has been made in the total evacuation of high profile infrastructures like airport terminal, super-highrise building, racecourse and tunnels. With the recent advancement of computer technologies, a number of evacuation modelling techniques has been developed to visualize the evacuation pattern and optimize the evacuation provisions. Computer simulations enable the integration of individual human factors like age, gender, percentage of crowd, mobility impairment, walking speed and patience level into evacuation model. Other behavioural factors like shortest distance, quickest time, adjacent movement and personal space can also be computed. The simulation results can be more realistic and reliable then the traditional hand calculations or code compliance design which cannot consider the actual performance and human factors. The simulation results can be used to characterize the efficiency of total evacuation and to maximize the life safety protection, which is a major concern by general public and authorities for high-profile infrastructures. [ABSTRACT FROM AUTHOR]

The science of security informatics has become a rapidly growing field involving different branches of computer science and information technologies. Software protection, particularly for security applications, has become an important area in computer security. This paper proposes a joint compiler/hardware infrastructure - CODESSEAL - for software protection for fully encrypted execution in which both program and data are in encrypted form in memory. The processor is supplemented with an FPGA-based secure hardware component that is capable of fast encryption and decryption, and performs code integrity verification, authentication, and provides protection of the execution control flow. This paper outlines the CODESSEAL approach, the architecture, and presents preliminary performance results. [ABSTRACT FROM AUTHOR]

While some researchers have exploited the similarity between cyber attacks and epidemics we believe there is also potential to leverage considerable experience gained in other biological domains: phylogenetics, ecological niche modeling, and biomonitoring. Here we describe some new ideas for threat detection from biomonitoring, and approximate graph searching and matching for cross network aggregation. Generic anomaly aggregation systems using these methods could detect and model the inheritance and evolution of vulnerability and threats across multiple domains and time scales. [ABSTRACT FROM AUTHOR]

Managing crises requires collecting geographical intelligence and making spatial decisions through collaborative efforts among multiple, distributed agencies and task groups. Crisis management also requires close coordination among individuals and groups of individuals who need to collaboratively derive information from geospatial data and use that information in coordinated ways. However, geospatial information systems do not currently support group work and can not meet the information needs of crisis managers. This paper describes a group interface for geographical information system, featuring multimodal human input, conversational dialogues, and same-time, different place communications among teams. [ABSTRACT FROM AUTHOR]

It is important for trusted intranets to focus on network security as a whole with dynamic and formalized analysis. The qualitative and current quantitative methods have difficulties to reach the requirements. After analyzing the attacking process, a Jackson network-based model with absorbing states is proposed, where the absorbing states mean the attacks succeed or fail. We compute the steady-state joint probability distribution of network nodes, the mean time of attack data spent in network, and the probabilities from the network entry node to absorbing states. According to the analysis of the above measures, we analyze the relationship between network security and performance. [ABSTRACT FROM AUTHOR]

In this paper, we propose a "bag of system calls" representation for intrusion detection of system call sequences and describe misuse detection results with widely used machine learning techniques on University of New Mexico (UNM) and MIT Lincoln Lab (MIT LL) system call sequences with the proposed representation. With the feature representation as input, we compare the performance of several machine learning techniques and show experimental results. The results show that the machine learning techniques on simple "bag of system calls" representation of system call sequences is effective and often perform better than those approaches that use foreign contiguous subsequences for detecting intrusive behaviors of compromised processes. [ABSTRACT FROM AUTHOR]

Worms have been becoming a serious threat in web age because worms can cause huge loss due to the fast-spread property. To detect worms effectively, it is important to investigate the characteristics of worm traffic at individual source level. We model worm traffic with the multi-fractal process, and compare the multi-fractal property of worm and normal traffics at individual source level. The results show that the worm traffic possesses less multi-fractal property. [ABSTRACT FROM AUTHOR]

Intrusion detection systems rely on a wide variety of observable data to distinguish between legitimate and illegitimate activities. In this paper we investigate the use of sequences of system calls for classifying intrusions and faults induced by privileged processes in Unix Operating system. In our work we applied sequence-data mining approach in the context of intrusion detection system (IDS). This paper introduces a new similarity measure that considers both sequence as well as set similarity among sessions. Considering both order of occurrences as well as content in a session enhances the capabilities of kNN classifier significantly, especially in the context of intrusion detection. From our experiments on DARPA 1998 IDS dataset we infer that the order of occurrences plays a major role in determining the nature of the session. The objective of this work is to construct concise and accurate classifiers to detect anomalies based on sequence as well as set similarity. [ABSTRACT FROM AUTHOR]

Verification of legitimate access of documents, which is one aspect of the umbrella of problems in the Insider Threat category, is a challenging problem. This paper describes the research and prototyping of a system that takes an ontological approach, and is primarily targeted for use by the intelligence community. Our approach utilizes the notion of semantic associations and their discovery among a collection of heterogeneous documents. We highlight our contributions in (graphically) capturing the scope of the investigation assignment of an intelligence analyst by referring to classes and relationships of an ontology; in computing a measure of the relevance of documents accessed by an analyst with respect to his/her assignment; and by describing the components of our system that have provided early yet promising results, and which will be further evaluated more extensively based on domain experts and sponsor inputs. [ABSTRACT FROM AUTHOR]

The Defense Information Infrastructure (DII) connects Department of Defense (DoD) mission support, command and control, and intelligence computers and users through voice, data, imagery, video, and multimedia services, and provides information processing and value-added services. For such a critical infrastructure to effectively mitigate risk, optimize its security posture and evaluate its information assurance practices, we identify the need for a structured and comprehensive certification and accreditation (C&A) framework with appropriate tool support. In this paper, we present an active approach to provide effective tool support that automates the DoD Information Technology Security C&A Process (DITSCAP) for information networks in the DII. [ABSTRACT FROM AUTHOR]

Detecting deception is a complicated endeavor. Previous attempts at deception detection in computer-mediated communication have met with some success. This study shows how speech act profiling [1] can be used to aid deception detection in synchronous computer-mediated communication (S-CMC). Chat logs from an online group game where deception was introduced were subjected to speech act profiling analysis. The results provide some support to previous research showing greater uncertainty in deceptive S-CMC. Also shown is that deceivers in the specific task tend to engage in less strategizing than non-deceivers. [ABSTRACT FROM AUTHOR]

This paper examines various approaches to analyzing differences in patterns of deception and how deception is evaluated across cultures. The approaches are divided into bottom-up approaches, which examine the foundations of culture and how they affect deception, and top-down approaches, which refer to models of deception and how their dynamics change across cultures. Considerations of the various approaches have led to a conclusion that the most comprehensive method for modeling deception across cultures would be to synthesize the two approaches, rather than consider them as opposing schools of thought. [ABSTRACT FROM AUTHOR]

Data distortion is a critical component to preserve privacy in security-related data mining applications, such as in data mining-based terrorist analysis systems. We propose a sparsified Singular Value Decomposition (SVD) method for data distortion. We also put forth a few metrics to measure the difference between the distorted dataset and the original dataset. Our experimental results using synthetic and real world datasets show that the sparsified SVD method works well in preserving privacy as well as maintaining utility of the datasets. [ABSTRACT FROM AUTHOR]

In the Internet age, software is one of the core components for the operation of network and it penetrates almost all aspects of industry, commerce, and daily life. Since digital documents and objects can be duplicated and distributed easily and economically cheaply and software is also a type of digital objects, software security and piracy becomes a more and more important issue. In order to prevent software from piracy and unauthorized modification, various techniques have been developed. Among them is software watermarking which protects software through embedding some secret information into software as an identifier of the ownership of copyright for this software. This paper gives a brief overview of software watermarking. It describes the taxonomy, attack models, and algorithms of software watermarking. Keyword: Software Security, Software Watermarking. [ABSTRACT FROM AUTHOR]

A method for deriving statistical indicators from the Europe Media Monitor (EMM) is described. EMM monitors world news in real time from the Internet and various News Agencies. The new method measures the intensity of news reporting for any country concerning a particular theme. Two normalised indicators are defined for each theme (j) and for each country (c). The first (Icj) is a measure of the relative importance for a given theme to that country. The second (Ijc) is a measure of the relative importance placed on that country with respect to the given theme by the world's media. The method has then been applied to news articles processed by EMM for each day during August 2003. This month was characterized by a number of serious terrorist bomb attacks visible both in the EMM data and in the derived indicators. The calculated indicators for a selection of countries are presented. Their interpretation and possible biases in the data are discussed. The data are then applied to identify candidate countries for "forgotten conflicts". These are countries with high levels of conflict but poorly reported in the world's media. [ABSTRACT FROM AUTHOR]

A robust image watermarking technique is proposed in this paper. The watermarked image is obtained by modifying the maximum singular value in each image block. The robustness of the proposed algorithm is achieved from two aspects: the stability of the maximum singular values and preprocessing before watermark extraction. Zernike moments are used to estimate the rotation angle, and the translation and scaling distortions are corrected by geometric moment methods. Experimental results show that this algorithm makes a trade-off among the imperceptibility, robustness and capacity. [ABSTRACT FROM AUTHOR]

The inherent lack of control over the Internet content resulted in proliferation of online material that can be potentially detrimental. For example, the infamous "Anarchist Cookbook" teaching how to make weapons, home made bombs, and poisons, keeps re-appearing in various places. Some websites teach how to break into computer networks to steal passwords and credit card information. Law enforcement, security experts, and public watchdogs started to locate, monitor, and act when such malevolent content surfaces on the Internet. Since the resources of law enforcement are limited, it may take some time before potentially malevolent content is located, enough for it to disseminate and cause harm. The only practical way for searching the content of the Internet, available for law enforcement, security experts, and public watchdogs is by using a search engine, such as Google, AOL, MSN, etc. We have suggested and empirically evaluated an alternative technology (automated question answering or QA) capable of locating potentially malevolent online content. We have implemented a proof-of-concept prototype that is capable of finding web pages that provide the answers to given questions (e.g. "How to build a pipe bomb?"). Using students as subjects in a controlled experiment, we have empirically established that our QA prototype finds web pages that are more likely to provide answers to given questions than simple keyword search using Google. This suggests that QA technology can be a good replacement or an addition to the traditional keyword searching for the task of locating malevolent online content and, possibly, for a more general task of interactive online information exploration. [ABSTRACT FROM AUTHOR]

To balance demand and supply of information, we propose a framework called "information supply chain" (ISC). This framework is based on supply chain management (SCM), which has been used in business management science. Both ISC and SCM aim to satisfy demand with high responsiveness and efficiency. ISC uses an information requirement planning (IRP) algorithm to reason, plan, and satisfy needers with useful information. We believe that ISC can not only unify existing information-sharing methods, but also produce new solutions that enable the right information to be delivered to the right recipients in the right way and at the right time. [ABSTRACT FROM AUTHOR]

Infectious disease informatics is a subfield of security informatics that focuses on information analysis and management issues critical to the prevention, detection, and management of naturally occurring or terrorist-engineered infectious disease outbreaks. We have developed a research prototype called BioPortal which provides an integrated environment to support cross-jurisdictional and cross-species infectious disease information sharing, integration, analysis, and reporting. This paper reports a pilot study evaluating BioPortal's usability, user satisfaction, and potential impact on practice. [ABSTRACT FROM AUTHOR]

The Internet which has enabled global businesses to flourish has become the very same channel for mushrooming ‘terrorist news networks.' Terrorist organizations and their sympathizers have found a cost-effective resource to advance their courses by posting high-impact Websites with short shelf-lives. Because of their evanescent nature, terrorism research communities require unrestrained access to digitally archived Websites to mine their contents and pursue various types of analyses. However, organizations that specialize in capturing, archiving, and analyzing Jihad terrorist Websites employ different, manualbased analyses techniques that are inefficient and not scalable. This study proposes the development of automated or semi-automated procedures and systematic methodologies for capturing Jihad terrorist Website data and its subsequent analyses. By analyzing the content of hyperlinked terrorist Websites and constructing visual social network maps, our study is able to generate an integrated approach to the study of Jihad terrorism, their network structure, component clusters, and cluster affinity. [ABSTRACT FROM AUTHOR]

In this paper, we investigate one-class and clustering problems by using statistical learning theory. To establish a universal framework, a unsupervised learning problem with predefined threshold η is formally described and the intuitive margin is introduced. Then, one-class and clustering problems are formulated as two specific η-unsupervised problems. By defining a specific hypothesis space in η-one-class problems, the crucial minimal sphere algorithm for regular one-class problems is proved to be a maximum margin algorithm. Furthermore, some new one-class and clustering marginal algorithms can be achieved in terms of different hypothesis spaces. Since the nature in SVMs is employed successfully, the proposed algorithms have robustness, flexibility and high performance. Since the parameters in SVMs are interpretable, our unsupervised learning framework is clear and natural. To verify the reasonability of our formulation, some synthetic and real experiments are conducted. They demonstrate that the proposed framework is not only of theoretical interest, but they also has a legitimate place in the family of practical unsupervised learning techniques. [ABSTRACT FROM AUTHOR]

The following presents a method for constructing taxonomies by utilizing the Latent Semantic Indexing (LSI) technique. The LSI technique enables representation of textual data in a vector space, facilitates access to all documents and terms by contextual queries, and allows for text comparisons. A taxonomy generator downloads collection of documents, creates document clusters, assigns titles to clusters, and organizes the clusters in a hierarchy. The nodes in the hierarchy are ordered from general to specific in the depth of the hierarchy, and from most similar to least similar in the breadth of the hierarchy. This method is capable of producing meaningful classifications in a short time. [ABSTRACT FROM AUTHOR]

Experiments were conducted to test several hypotheses on methods for improving document classification for the malicious insider threat problem within the Intelligence Community. Bag-of-words (BOW) representations of documents were compared to Natural Language Processing (NLP) based representations in both the typical and one-class classification problems using the Support Vector Machine algorithm. Results show that the NLP features significantly improved classifier performance over the BOW approach both in terms of precision and recall, while using many fewer features. The one-class algorithm using NLP features demonstrated robustness when tested on new domains. [ABSTRACT FROM AUTHOR]

Intelligence analysts are often faced with large data collections within which information relevant to their interests may be very sparse. Existing mechanisms for searching such data collections present difficulties even when the specific nature of the information being sought is known. Finding unknown information using these mechanisms is very inefficient. This paper presents an approach to this problem, based on iterative application of the technique of latent semantic indexing. In this approach, the body of existing knowledge on the analytic topic of interest is itself used as a query in discovering new relevant information. Performance of the approach is demonstrated on a collection of one million documents. The approach is shown to be highly efficient at discovering new information. [ABSTRACT FROM AUTHOR]

Identity resolution is central to fighting against crime and terrorist activities in various ways. Current information systems and technologies deployed in law enforcement agencies are neither adequate nor effective for identity resolution. In this research we conducted a case study in a local police department on problems that produce difficulties in retrieving identity information. We found that more than half (55.5%) of the suspects had either a deceptive or an erroneous counterpart existing in the police system. About 30% of the suspects had used a false identity (i.e., intentional deception), while 42% had records alike due to various types of unintentional errors. We built a taxonomy of identity problems based on our findings. [ABSTRACT FROM AUTHOR]

In this paper, we employed two machine learning algorithms - namely, a clustering and a neural network algorithm - to analyze the network traffic recorded from three sources. Of the three sources, two of the traffic sources were synthetic, which means the traffic was generated in a controlled environment for intrusion detection benchmarking. The main objective of the analysis is to determine the differences between synthetic and real-world traffic, however the analysis methodology detailed in this paper can be employed for general network analysis purposes. Moreover the framework, which we employed to generate one of the two synthetic traffic sources, is briefly discussed. [ABSTRACT FROM AUTHOR]

Using data that combines information from the Federal Aviation Administration, the RAND Corporation, and a newly developed database on global terrorist activity, we are able to examine trends in 1,101 attempted aerial hijackings that occurred around the world from 1931 to 2003. We have especially complete information for 828 hijackings that occurred before 1986. Using a rational choice theoretical framework, we employ econometric time-series methods to estimate the impact of several major counter hijacking interventions on the likelihood of differently motivated hijacking events and to model the predictors of successful hijackings. Some of the interventions examined use certainty-based strategies of target hardening to reduce the perceived likelihood of success while others focus on raising the perceived costs of hijacking by increasing the severity of punishment. We also assess which specific intervention strategies were most effective for deterring hijackers whose major purpose was terrorism related. We found support for the conclusion that new hijacking attempts were less likely to be undertaken when the certainty of apprehension was increased through metal detectors and law enforcement at passenger checkpoints. We also found that fewer hijackers attempted to divert airliners to Cuba once that country made it a crime to hijack flights. Our results support the contagion view that hijacking rates significantly increase after a series of hijackings closely-clustered in time. Finally, we found that policy interventions only significantly decrease the likelihood of non-terrorist-related hijackings. [ABSTRACT FROM AUTHOR]

The ability to map the contemporary terrorism research domain involves mining, analyzing, charting, and visualizing a research area according to experts, institutions, topics, publications, and social networks. As the increasing flood of new, diverse, and disorganized digital terrorism studies continues, the application of domain visualization techniques are increasingly critical for understanding the growth of scientific research, tracking the dynamics of the field, discovering potential new areas of research, and creating a big picture of the field's intellectual structure as well as challenges. In this paper, we present an overview of contemporary terrorism research by applying domain visualization techniques to the literature and author citation data from the years 1965 to 2003. The data were gathered from ten databases such as the ISI Web of Science then analyzed using an integrated knowledge mapping framework that includes selected techniques such as self-organizing map (SOM), content map analysis, and co-citation analysis. The analysis revealed (1) 42 key terrorism researchers and their institutional affiliations; (2) their influential publications; (3) a shift from focusing on terrorism as a low-intensity conflict to an emphasis on it as a strategic threat to world powers with increased focus on Osama Bin Laden; and (4) clusters of terrorism researchers who work in similar research areas as identified by co-citation and block-modeling maps. [ABSTRACT FROM AUTHOR]

One of the major problems in Intelligence analysis and counter-terrorism research is the use or, more precisely, misuse of metrics as a means to measure success. Such quantification may be admirable and necessary when dealing with rocket motors or physical phenomena but can be self-defeating and unrealistic when dealing with people and human events which, after all, are the ultimate underpinnings of terrorism, insurgency and political instability. Human behavior is notoriously hard to predict and outcomes without historical perspective difficult to assess. Measures of success that are touted as useful and accurate so often in the real world prove to be little more than intellectual snake oil. Hard quantifiable data that is meaningful is hard to come by, and so we often willingly settle for data that are easily accessible and quantifiable, hoping that our extrapolations are sufficiently accurate to guide or assess a course of action or the conduct of a conflict. [ABSTRACT FROM AUTHOR]

This paper describes the development of the Conceptual Model of Counter Terrorist Operations or the CMCTO. The CMCTO is a top down decomposition of the functions that are performed in the Counter Terrorist Domain. The models first decomposes the domain into Functions directed toward terrorists; Functions directed toward victims; and, Functions of support. Each of these functions is further decomposed to varying levels. The paper also includes a comprehensive review of the literature and of the process used. [ABSTRACT FROM AUTHOR]

It is very important for us to understand the functions and structures of terrorist networks to win the battle against terror. However, previous studies of terrorist network structure have generated little actionable results. This is mainly due to the difficulty in collecting and accessing reliable data and the lack of advanced network analysis methodologies in the field. To address these problems, we employed several advance network analysis techniques ranging from social network analysis to Web structural mining on a Global Salafi Jihad network dataset collected through a large scale empirical study. Our study demonstrated the effectiveness and usefulness of advanced network techniques in terrorist network analysis domain. We also introduced the Web structural mining technique into the terrorist network analysis field which, to the best our knowledge, has never been used in this domain. More importantly, the results from our analysis provide not only insights for terrorism research community but also empirical implications that may help law-reinforcement, intelligence, and security communities to make our nation safer. [ABSTRACT FROM AUTHOR]

To effectively resolve the violent challenges presented by terrorist groups to the security and well-being of their state adversaries, it is crucial to develop an appropriate understanding of all the root causes underlying such conflicts because terrorist insurgencies do not emerge in a political, socio-economic, religious or even psychological vacuum. It could be argued, in fact, that the root causes underlying an insurgency are the initial components driving the terrorist life cycle (TLC) and the terrorist attack cycle (TAC). The TLC refers to why and how terrorist groups are formed, led and organized, the nature of their grievances, motivations, strategies and demands vis-a-vis their adversaries, and the linkages that terrorist groups form with their supporting constituency. These components of the TLC, in turn, affect the TAC—a group's modus operandi, how they conduct the spectrum of operations, ranging from non-violent to violent activities, and their choice of weaponry and targeting. [ABSTRACT FROM AUTHOR]

This paper presents an improved speaker verification technique that is especially appropriate for surveillance scenarios. The main idea is a meta-learning scheme aimed at improving fusion of low- and high-level speech information. While some existing systems fuse several classifier outputs, the proposed method uses a selective fusion scheme that takes into account conveying channel, speaking style and speaker stress as estimated on the test utterance. Moreover, we show that simultaneously employing multi-resolution versions of regular classifiers boosts fusion performance. The proposed selective fusion method aided by multi-resolution classifiers decreases error rate by 30% over ordinary fusion. [ABSTRACT FROM AUTHOR]

This work identifies the limitations of n-way data analysis techniques in multidimensional stream data, such as Internet chatroom communications data, and establishes a link between data collection and performance of these techniques. Its contributions are twofold. First, it extends data analysis to multiple dimensions by constructing n-way data arrays known as high order tensors. Chatroom tensors are generated by a simulator which collects and models actual communication data. The accuracy of the model is determined by the Kolmogorov-Smirnov goodness-of-fit test which compares the simulation data with the observed (real) data. Second, a detailed computational comparison is performed to test several data analysis techniques including svd [1], and multiway techniques including Tucker1, Tucker3 [2], and Parafac [3]. [ABSTRACT FROM AUTHOR]

The Terrorist Detection System (TDS) is aimed at tracking down suspected terrorists by analyzing the content of information they access. TDS operates in two modes: a training mode and a detection mode. During the training mode TDS is provided with Web pages accessed by a normal group of users and computes their typical interests. During the detection mode TDS performs real-time monitoring of the traffic emanating from the monitored group of users, analyzes the content of the Web pages accessed, and issues an alarm if the access information is not within the typical interests of the group. In this paper we present an advanced version of TDS (ATDS), where the detection algorithm was enhanced to improve the performance of the basic TDS system. ATDS was implemented and evaluated in a network environment of 38 users comparing it to the performance of the basic TDS. Behavior of suspected terrorists was simulated by accessing terror related sites. The evaluation included also sensitivity analysis aimed at calibrating the settings of ATDS parameters to maximize its performance. Results are encouraging. ATDS outperformed TDS significantly and was able to reach very high detection rates when optimally tuned. [ABSTRACT FROM AUTHOR]

Keyword filtering is a commonly used way to select, from a set of intercepted messages, those that need further scrutiny. An obvious countermeasure is to replace words that might be on a keyword list by others. We show that this strategy itself creates a signature in the altered messages that makes them readily detectable using several forms of matrix decomposition. Not only can unusual messages be detected, but sets of related messages can be detected as conversations, even when their endpoints have been obscured (by using transient email addresses, stolen cell phones and so on). [ABSTRACT FROM AUTHOR]

The area of alert fusion for strengthening information assurance in systems is a promising research area that has recently begun to attract attention. Increased demands for "more trustworthy" systems and the fact that a single sensor cannot detect all types of misuse/anomalies have prompted most modern information systems deployed in distributed environments to employ multiple, diverse sensors. Therefore, the outputs of the sensors must be fused in an effective and intelligent manner in order to provide an overall view of the status of such systems. A unified architecture for intelligent alert fusion will essentially combine alert prioritization, alert clustering and alert correlation. In this paper, we address the alert correlation aspect of sensor data fusion in distributed environments. A causal knowledge based inference technique with fuzzy cognitive modeling is used to correlate alerts by discovering causal relationships in alert data. Keywords: Network security, intelligent alert fusion, alert correlation, fuzzy cognitive modeling. [ABSTRACT FROM AUTHOR]

Text authored by an unidentified assailant can offer valuable clues to the assailant's identity. In this paper, we show that stylistic text features can be exploited to determine an anonymous author's native language with high accuracy. [ABSTRACT FROM AUTHOR]

This research initiative is an initial investigation into a novel approach for deriving indicators of deception from video-taped interaction. The team utilized two-dimensional spatial inputs extracted from video to construct a set of discrete and inter-relational features. The features for thirty-eight video interactions were then analyzed using discriminant analysis. Additionally, features were used to build a multivariate regression model. Through this exploratory study, the team established the validity of the approach, and identified a number of promising features, opening the door for further investigation. [ABSTRACT FROM AUTHOR]

The advent and rapid proliferation of internet communication has allowed the realization of numerous security issues. The anonymous nature of online mediums such as email, web sites, and forums provides an attractive communication method for criminal activity. Increased globalization and the boundless nature of the internet have further amplified these concerns due to the addition of a multilingual dimension. The world's social and political climate has caused Arabic to draw a great deal of attention. In this study we apply authorship identification techniques to Arabic web forum messages. Our research uses lexical, syntactic, structural, and content-specific writing style features for authorship identification. We address some of the problematic characteristics of Arabic in route to the development of an Arabic language model that provides a respectable level of classification accuracy for authorship discrimination. We also run experiments to evaluate the effectiveness of different feature types and classification techniques on our dataset. [ABSTRACT FROM AUTHOR]

In today's globally networked society, there is a dual demand on both information sharing and information protection. A typical scenario is that two parties wish to integrate their private databases to achieve a common goal beneficial to both, provided that their privacy requirements are satisfied. In this paper, we consider the goal of building a classifier over the integrated data while satisfying the k-anonymity privacy requirement. The k-anonymity requirement states that domain values are generalized so that each value of some specified attributes identifies at least k records. The generalization process must not leak more specific information other than the final integrated data. We present a practical and efficient solution to this problem. [ABSTRACT FROM AUTHOR]

Today's "low-intensity" conflicts do not involve victory or defeat in the conventional sense; instead, each side attempts to achieve a psycho-political victory by influencing people's thoughts and feelings about the issues in dispute. Casualty statistics are an important element in forming these thoughts and feelings; in turn, a robust incident and casualty database can be an important tool in coming to an accurate understanding of complex conflicts with multiple actors and incident types. For a casualty database to produce meaningful, informative, and accurate results, it must have a rich array of well-defined categories to which to assign incidents and casualty data. It must also be conceived, designed, and administered with a strict adherence to accuracy rather than advocacy as a primary goal. [ABSTRACT FROM AUTHOR]