Search

Monitoring the surveillance of large sea areas normally involves the analysis of huge quantities of heterogeneous data from multiple sources (radars, cameras, automatic identification systems, reports, etc.). The rapid identification of anomalous behavior or any threat activity in the data is an important objective for enabling homeland security. While it is worth acknowledging that many existing mining applications support identification of anomalous behavior, autonomous anomaly detection systems are rarely used in the real world. There are two main reasons: (1) the detection of anomalous behavior is normally not a well-defined and structured problem and therefore, automatic data mining approaches do not work well and (2) the difficulties that these systems have regarding the representation and employment of the prior knowledge that the users bring to their tasks. In order to overcome these limitations, we believe that human involvement in the entire discovery process is crucial. Using a visual analytics process model as a framework, we present VISAD: an interactive, visual knowledge discovery tool for supporting the detection and identification of anomalous behavior in maritime traffic data. VISAD supports the insertion of human expert knowledge in (1) the preparation of the system, (2) the establishment of the normal picture and (3) in the actual detection of rare events. For each of these three modules, VISAD implements different layers of data mining, visualization and interaction techniques. Thus, the detection procedure becomes transparent to the user, which increases his/her confidence and trust in the system and overall, in the whole discovery process.

The goal of visual analytical tools is to support the analytical reasoning process, maximizing human perceptual, understanding and reasoning capabilities in complex and dynamic situations. Visual analytics software must be built upon an understanding of the reasoning process, since it must provide appropriate interactions that allow a true discourse with the information. In order to deepen our understanding of the human analytical process and guide developers in the creation of more efficient anomaly detection systems, this paper investigates how is the human analytical process of detecting and identifying anomalous behavior in maritime traffic data. The main focus of this work is to capture the entire analysis process that an analyst goes through, from the raw data to the detection and identification of anomalous behavior. Three different sources are used in this study: a literature survey of the science of analytical reasoning, requirements specified by experts from organizations with interest in port security and user field studies conducted in different marine surveillance control centers. Furthermore, this study elaborates on how to support the human analytical process using data mining, visualization and interaction methods. The contribution of this paper is twofold: (1) within visual analytics, contribute to the science of analytical reasoning with practical understanding of users tasks in order to develop a taxonomy of interactions that support the analytical reasoning process and (2) within anomaly detection, facilitate the design of future anomaly detector systems when fully automatic approaches are not viable and human participation is needed.

Maritime surveillance systems analyze vast amounts of heterogeneous sensor data from a large number of objects. In order to support the operator while monitoring such systems, the identification of anomalous vessels or situations that might need further investigation may reduce the operator’s cognitive load. While it is worth acknowledgingthat many existing mining applications support identification of anomalous behavior, autonomous anomaly detection systems are rarely used in the real world, since the detection of anomalous behavior is normally not a welldefined problem and therefore, human expert knowledge is needed. This calls for the development of interaction components that can support the user in the detection process. In order to support the comprehension of the knowledge embedded in the system, we propose an interactive way of visualizing expert rules and normal behavioral models built from the data. The overall goal is to facilitate the validation and update of these models and signatures, supporting the insertion of human expert knowledge while improving confidence and trust in the system., KJ: fanns SAIL 2009? På publ.: "Informatics Research Centre, University of Skövde, Sweden"

Research on information fusion and situation management within the military domain, is often focused on data-driven approaches for aiding decision makers in achieving situation awareness. We have in a companion paper identified situation recognition as an important topic for further studies on knowledge-driven approaches. When developing new algorithms it is of utmost importance to have data for studying the problem at hand (as well as for evaluation purposes). This often become a problem within the military domain as there is a high level of secrecy, resulting in a lack of data, and instead one often needs to resort to artificial data. Many tools and simulation environments can be used for constructing scenarios in virtual worlds. Most of these are however data-centered, that is, their purpose is to simulate the real-world as accurately as possible, in contrast to simulating complex scenarios. In high-level information fusion we can however often assume that lower-level problems have already been solved - thus the separation of abstraction - and we should instead focus on solving problems concerning complex relationships, i.e. situations and threats. In this paper we discuss requirements that research on situation recognition puts on simulation tools. Based on these requirements we present a component-based simulator for quickly adapting the simulation environment to the needs of the research problem at hand. This is achieved by defining new components that define behaviors of entities in the simulated world.

Threat evaluation is the process in which threat values are assigned to detected targets, based upon the inferred capabilities and intents of the targets to inflict damage to blue force defended assets. This is a high-level information fusion process of high importance, since the calculated threat values are used as input when blue force weapon systems are allocated to the incoming targets, a process often referred to as weapon allocation. Threat values can be calculated from a number of different parameters, such as the position of the closest point of approach (CPA) with respect to blue force defended assets, time required to reach the CPA, the target's velocity, and its type. A number of algorithms for calculating threat values have been suggested throughout literature, however, criteria to evaluate the performance of such algorithms seem to be lacking. In this paper, we discuss different ways to assess the performance of threat evaluation algorithms. In specific, we describe an implemented testbed in which threat evaluation algorithms can be compared to each other, based on a survivability criterion. Survivability is measured by running the threat evaluation algorithms on simulated scenarios and using the resulting threat values as input to a weapon allocation module. Depending on how well the threat evaluation is performed, the ability of the blue force weapon systems to eliminate the incoming targets will vary (and thereby also the survivability of the defended assets). Our obtained results for two different threat evaluation algorithms are presented and analyzed.

This paper presents a first attempt to evaluate two previously proposed methods for statistical anomaly detection in sea traffic, namely the Gaussian Mixture Model (GMM) and the adaptive Kernel Density Estimator (KDE). A novel performance measure related to anomaly detection, together with an intermediate performance measure related to normalcy modeling, are proposed and evaluated using recorded AIS data of vessel traffic and simulated anomalous trajectories. The normalcy modeling evaluation indicates that KDE more accurately captures finer details of normal data. Yet, results from anomaly detection show no significant difference between the two techniques and the performance of both is considered suboptimal. Part of the explanation is that the methods are based on a rather artificial division of data into geographical cells. The paper therefore discusses other clustering approaches based on more informed features of data and more background knowledge regarding the structure and natural classes of the data.

The allocation of weapons to targets (such as missiles and hostile aircrafts) is a well-known resource allocation problem within the field of operations research. It has been proven that this problem, in general, is NP-complete. For this reason, optimal solutions to the static weapon-target allocation (WTA) problem can not be obtained in real-time for large-scale problems. We try to find the limit for how large problems that can be solved optimally in real-time by exhaustive search algorithms through running empirical experiments. We also propose a heuristic genetic algorithm for solving larger-scale problems., [CD-ROM]

Maritime situation awareness is of importance in a lot of areas – e.g. detection of weapon smuggling in military peacekeeping operations, and harbor traffic control missions for the coast guard. In this paper, we have combined the use of Self Organizing Maps with Gaussian Mixture Models, in order to enable situation awareness by detecting deviations from normal behavior in an unsupervised way. Initial results show that simple anomalies can be detected using this approach.

The use of technology to assist human decision making has been around for quite some time now. In the literature, models of both technological and human aspects of this support can be identified. However, we argue that there is a need for a unified model which synthesizes and extends existing models. In this paper, we give two perspectives on situation analysis: a technological perspective and a human perspective. These two perspectives are merged into a unified situation analysis model for semi-automatic, automatic and manual decision support (SAM)2. The unified model can be applied to decision support systems with any degree of automation. Moreover, an extension of the proposed model is developed which can be used for discussing important concepts such as common operational picture and common situation awareness.

Surveillance of large land, air or sea areas with a multitude of sensor and sensor types typically generates huge amounts of data. Human operators trying to establish individual or collective maritime situation awareness are often overloaded by this information. In order to help them cope with this information overload, we have developed a combined methodology of data visualization, interaction and mining techniques that allows filtering out anomalous vessels, by building a model over normal behavior from which the user can detect deviations. The methodology includes a set of interactive visual representations that support the insertion of the user’s knowledge and experience in the creation, validation and continuous update of the normal model. Additionally, this paper presents a software prototype that implements the suggested methodology., Best Student Paper Award.

The surveillance of large sea areas often generates huge amounts of multidimensional data. Exploring, analyzing and finding anomalous behavior within this data is a complex task. Confident decisions upon the abnormality of a particular vessel behavior require a certain level of situation awareness that may be difficult to achieve when the operator is overloaded by the available information. Based on a visual analytics process model, we present a novel system that supports the acquisition of situation awareness and the involvement of the user in the anomaly detection process using two layers of interactive visualizations. The system uses an interactive data mining module that supports the insertion of the user's knowledge and experience in the creation, validation and continuous update of the normal model of the environment.

Threat evaluation is the process in which threat values are assigned to detected targets, based upon the inferred capabilities and intents of the targets to inflict damage to blue force defended assets. This is a high-level information fusion process of high importance, since the calculated threat values are used as input when blue force weapon systems are allocated to the incoming targets, a process often referred to as weapon allocation. Threat values can be calculated from a number of different parameters, such as the position of the closest point of approach (CPA) with respect to blue force defended assets, time required to reach the CPA, the target’s velocity, and its type. A number of algorithms for calculating threat values have been suggested throughout literature, however, criteria to evaluate the performance of such algorithms seem to be lacking. In this paper, we discuss different ways to assess the performance of threat evaluation algorithms. In specific, we describe how threat evaluation algorithms can be compared to each other, using a survivability criterion. Survivability is measured by running the threat evaluation algorithms on simulated scenarios and using the resulting threat values as input to a weapon allocation module. Depending on how well the threat evaluation is performed, the ability of the blue force weapon systems to eliminate the incoming targets will vary (and thereby also the survivability of the defended assets).

SOMWeb is an online collaboration system based on Semantic Web technologies, which is used for knowledge sharing and dissemination within an oral medicine community in Sweden. Based on a previous study of the use of SOMWeb, general patterns of interaction and communicative activities involved in community collaboration have been identified. The patterns for one such activity, distance consultation, are described and modeled using techniques from the Pragmatic Web. It is also shown how patterns could inform system design

Data mining has been used very frequently to extract hidden information from large databases. This paper suggests the use of decision trees for continuously extracting the clinical reasoning in the form of medical expert’s actions that is inherent in large number of EMRs (Electronic Medical records). In this way the extracted data could be used to teach students of oral medicine a number of orderly processes for dealing with patients who represent with different problems within the practice context over time.

Att praktisera evidensbaserad odontologi innebär att integrera expertisen hos individuella kliniker med bästa vetenskapliga evidens från externa kunskapskällor.

In this paper, a precise description of the threat evaluation process is presented. This is followed by a review describing which parameters that have been suggested for threat evaluation in an air surveillance context throughout the literature, together with an overview of different algorithms for threat evaluation. Grounded in the findings from the literature review, a threat evaluation system have been developed. The system is based on a Bayesian network approach, making it possible to handle imperfect observations. The structure of the Bayesian network is described in detail. Finally, an analysis of the system’s performance as applied to a synthetic scenario is presented., 10.1109/ICIF.2008.4632368

In this paper we describe a data mining approach for detection of anomalous vessel behaviour. The suggested approach is based on Bayesian networks which have two important advantages compared to opaque machine learning techniques such as neural networks: (1) possibility to easily include expert knowledge into the model, and (2) possibility for humans to understand and interpret the learned model. Our approach is implemented and tested on synthetic data, where initial results show that it can be used for detection of single-object anomalies such as speeding.

We present a research program for identifying, modeling, and making use of generic pragmatic patterns for clinical knowledge management that support evidence-based medicine (EBM). Part of this program is SOMWeb, a system based on Semantic Web technologies, which is used for knowledge sharing and dissemination within an oral medicine community. A study of the use of SOMWeb has been conducted as the first step in the elicitation of important contextual factors and communicative activities involved in knowledge sharing processes in oral medicine. One such activity, community discussion activation, is described using consultation patterns together with the collaboration patterns of [5]. The general need for context-aware health information systems and the prospective use of approaches within Pragmatic Web in the pursuit of EBM are also discussed.

This article describes the modeling of clinical examinations in oral medicine using OWL. Based on experiences from our previous work and knowledge model, requirements for an ontology for examinations in oral medicine are identified. OWL can be used to address most, but not all, of the requirements. We found a lack of guidance for several design choices and for development of OWL ontologies at different levels of sophistication. However, using OWL gives us the ability to come back and refine the knowledge model after initial deployment.

To support knowledge sharing between practitioners of oral medicine throughout Sweden, the SOMWeb system for community collaboration has been constructed, based on Semantic Web technologies. A large function of the system is to support the discussion of difficult and interesting cases at a monthly telephone conference. From our observations of these meetings, a the users’ responses to a questionnaire, and discussions with users, we find that many of the improvements that can be made to enable further use of the system relate to adding the use of context. Some initial thoughts on what would be relevant to represent in relation to context are given, such as the experience of the practitioner, the reason for adding a case to the system, and the current activity of the user. The long-term aims of this work is to identify aspects of context relevant to online communities of practice in healthcare, and to investigate how these contexts can be modeled using Semantic Web technologies.

This paper describes how Semantic Web technologies have been used in an online community for knowledge sharing between clinicians in oral medicine in Sweden. The main purpose of this community is to serve as repository of interesting and difficult cases, and as a support for monthly teleconferences. All information regarding users, meetings, news, and cases is stored in RDF. The community was built using the Struts framework and Jena was used for interacting with RDF.

Prediction of the enemy's intention is a main issue of threat analysis, and, hence, will be an important part of the C2-systems of tomorrow. A technique that can be useful for this kind of predictions is Bayesian networks (BNs). We have developed a BN for prediction of the enemy's tactical intention, and the implemented BN has been integrated into a ground target simulation framework. The general problem of how to find appropriate prior distributions for BNs has been addressed by developing a tool for data collection, which may make it easier to come up with appropriate prior distributions, by learning conditional probability tables from collected cases, i.e. parameter learning, ISBN: 0-9721844-6-5

In a net-based society, clinicians can come together for cooperative work and distance learning around a common medical material. This requires suitable techniques for cooperative knowledge management and user interfaces that are adapted to both the group as a whole and to individuals. To support distributed management and sharing of clinical knowledge, we propose the development of an intelligent web community for clinicians within oral medicine. This virtual meeting place will support the ongoing work on developing a digital knowledge base, providing a foundation for a more evidence-based oral medicine. The presented system is founded on the use and development of web services and standards for knowledge modelling and knowledge-based systems. The work is conducted within the frame of a well-established cooperation between oral medicine and computer science.

Medical ontologies like GALEN, the FMA or SNOMED represent a kind of “100% certain” medical knowledge which is not inherent to all medical sub-domains. Clinical radiology uses computerized imaging techniques to make the human body visible and interprets the imaging findings in a clinical context delivering a textual report. For clinical radiology few standardized vocabularies are available. We examined the definitions given in the glossary of terms for thoracic radiology published by the Fleischner Society. We further classified these terms with regard to their definitions in terms of (a) describing visible structures on the image itself, (b) referring to ontological entities of the body (anatomical or pathological), and (c) terms imposing knowledge on structures visible on the image, epistemologically representing ontological entities of the body. Each ontological/epistemological definition was rated on a scale of vague/weak-sound/strong and put in context with the evaluation comments for the use of the terms given in the glossary itself. The result of this distinction shows that clinical radiology uses many terms referring to ontological entities valid for representation in a medical ontology. However, many epistemological terms exist in the terminology which impose epistemological knowledge on ontological entities. The analysis of the evaluation comments reveals that terms classified as sound (ontologically) and strong (epistemologically) are evaluated higher than terms bearing vague or weak definitions. On the basis of this, we argue that the distinction between ontological and epistemological definitions is necessary in order to construct epistemologically-sensitive application ontologies for medical sub-domains, like clinical radiology, where knowledge is fragmented in terms of description, inferred from a description, concluded on the basis of imaging, or other additional information with varying degrees of certainty.