Transcript Center for Information Modeling and Analysis

Intelligent Site Selection Models
for Asymmetric Threat Prediction
and Decision Making
Michael D. Porter
[email protected]
North Carolina State University
Donald E. Brown and C. Donald Robinson
[email protected]
[email protected]
University of Virginia
Intelligent Site Selection
Time
T1 T2
T3
T4
S3
S1
Space
Decision =
{(T1,S1),(T2,S2),(T3,S3),
(T4,S4)}
S2
S4
2/40
Intelligent Site Selection
Definition: An Intelligent Site Selection process is one in
which a group of actors judiciously select the locations and
times to initiate events according to their preferences or
perceived utility of those locations and times.
• Just observing the points in time and space isn’t enough,
because these don’t take into account the actors’
preferences
• So we introduce attribute space (N-Dimensional)
g2: Darkness
g3: Avg. Income
g4: Population
g1: Dis_Hway
.
.
.
gN: Dis_Home
3/40
Finding Patterns
Patterns emerge in Attribute Space
Time
Axis
0
t1
gp
Attribute
Space
t2 t3
t4
t5
t7
. . .
T
g1
.
..
g2
.
.
.
g(s2,t2)
g(s5,t5)
g(s4,t4)
g(s7,t7)
g(s6,t6)
g(s1,t1)
g(s3,t3)
gi
Geographic
Space
t6
s4
s2
s1 1
s6
s2
s3
s7
s5
s
Liu and Brown (2004) Int. J. Of Forecasting
4/40
Terrorist Threat Prediction Problem
• Inputs
– series of incidents or attacks of the same type in an area of
interest and over a fixed time interval,
– (optional) doctrine or subjective behavioral descriptions of
enemy operations
– Formal description of the named areas of interest and
friendly elements given by values of attributes or features
that are known or believed to be relevant to the occurrence of
the attacks or incidents
• Output:
– The likelihood that another attack or incident occurs at
specified locations within the named area of interest and
within a specified time range
5/40
Attribute Set
• To successfully model the terrorist attacks, we should attempt to
model their decision making process or preferences for attack
locations
• Thus we include covariates that are thought to influence the
terrorist site selection process (or that are associated (correlated)
with such features) in our models
• Since we usually don’t know the terrorist’s preferences we must
discover (data mining) these from previous attack locations
– Observe past attack locations and associated feature values for that location
• Examples of possible features
– Census (Socio-economic)
– Proximity (Distance to landmarks or structures)
– Military or Police Patrols (times and locations)
6/40
Spatial Choice Models
Fotheringham (1983) Env+Plan A, Xue and Brown (2003) IEEE SMC-C
• Adapt theory of random utility theory to terrorist
spatial decision making
• Alternatives are spatial locations
• The number of alternatives is very large
– Perhaps infinite in reality
• Each alternative has two components
– Spatial component: fixed spatial locations
– Attribute component: spatial alternatives’ characteristics
7/40
Hierarchical Spatial Choice
Choice Picked
Alternatives to
Evaluate Cd
Decision
Maker d
Choice Set
Alternatives – {ai}
Xue, Y. F., Brown, D. E., (2003) IEEE SMC-C
8/40
Analysis of Terrorists’ Decision Process
• A terrorist’s choice set is unknown to analysts
• We can only estimate the probability for each
alternative to be pre-evaluated P(aiCd)
– Here we will use our spatial information
• The attribute information is used to estimate the
utility of each location
• This leads us to adopt
– Fotheringham’s Competing Destinations Model
– Aka: Spatial Hierarchy Model
9/40
Spatial Hierarchy Model
• Begin with the assumption that all actors have
same preferences and same choice set C
• The probability that an alternative ai is preevaluated by any actor is P(ai C)
• Based on these assumptions, the probability
location i is selected is given by
expf V ( si ) g ¢P( si 2 C)
P( si ) = P
j expf V ( sj ) g ¢P( sj 2 C)
where,
V(si)-Utility of location si for all actors
10/40
Spatial Hierarchy Model
A function of the
attributes/covariates of
location si
A function of spatial
location only
expf V ( si ) g ¢P( si 2 C)
P( si ) = P
j expf V ( sj ) g ¢P( sj 2 C)
expf V ( si ) g = expf ¯0 +
XN
1
P( si 2 C) =
K
2
N h i= 1
X
m
Ã
¯m G( si ) g
jjs ¡ si jj
h
!
11/40
PCINC.97
MHINC.97
AHINC.97
ALC.TOB.PH
HOUSING.PH
APPAREL.PH
FOOD.PH
ET.PH
P.CARE.PH
TRANS.PH
MED.PH
D.CHURCH
D.PARK
D.SCHOOL
D.HOSPITAL
VACHU.DST
0.2
POP8910.DS
AGEH56.DST
CLS67.DST
POP67.DST
AGEH34.DST
MALE.DST
POP.DST
FEM.DST
RENT.DST
HUNT.DST
HH.DST
OCCHU.DST
POP45.DST
AGEH12.DST
CLS12.DST
CLS345.DST
FAM.DST
POP123.DST
MORT2.DST
MORT1.DST
OWN.DST
0.0
0.4
D.HIGHWAY
COND1.DST
0.6
Clustering Covariates
Xue, Y. F., Brown, D. E., (2003) IEEE SMC-C
12/40
Estimation of Model Parameters
• Not spatial smoothing, more like random
thinning in point processes
P ( si ) / expf V ( si ) g ¢P ( si 2 C)
• More generally, use Random Forest for
estimating utility component
13/40
Sample Realization
Probability of Evaluation
44.48
44.46
44.44
44.42
lat
44.4
44.38
44.36
44.34
44.32
Spatial Hierarchy
Model
44.48
44.3
44.46
33.22 33.24 33.26 33.28
33.3
33.32 33.34 33.36 33.38
33.4
lon
44.44
44.42
lat
44.4
44.38
44.36
44.34
44.32
44.3
33.22 33.24 33.26 33.28
33.3
33.32 33.34 33.36 33.38
lon
33.4
14/40
Examples from Iraq
0.0
0.2
0.4
0.6
0.8
1.0
Blue lines are contours of the predicted intensity of
terrorist attacks and red dots are the actual attacks
0.0
0.2
0.4
0.6
0.8
1.0
15/40
Simulation of Intelligent Site
Selection Processes for
Decision Making
16/40
What is the problem?
• Explaining locations and times for future
terrorist events is a difficult yet useful
problem to solve
• What do they think?
• Why they choose their targets?
• How can we impede their operations?
17/40
What is the point?
• To provide a means to test the effect of
differing levels of intelligence, prediction,
and action decisions
– Should we get better predictive methods
– Should we get better intelligence
– Should we make different decisions
• How do these influence the
successfulness of terrorist events?
18/40
The Scenario – Red Force
• Red force initiates incidents
• Remotely or autonomously detonated
explosive devices
• Active until detonated or decay
• The target is Blue force vehicles
19/40
The Scenario – Blue Force
• Blue force collects intelligence, predicts
red force actions, and decides which
route to send convoy
• Blue force has limited ability to clear any
active explosives in some small region
prior to convoy deployment
• Convoys will travel on the roads
regardless of threat
• The model could be applied to other
contexts as well (suicide bombings,
mortar attacks, etc.)
20/40
The Approach
• Terrorists do not act independently of
their targets’ actions
• Often the targets (like the U.S. Military)
also react to the attacks
• The dynamics of this complex system can
be modeled and simulated
21/40
The Systems Model
 blue
blue
dblue  Dblue
sred  Sred
 red
kred  Kred
kblue  Kblue
w W
 red
blue
ablue  Ablue

sblue  Sblue
INTELLIGENCE
PREDICTION
ACTION
dred  Dred
 red
sblue  Sblue
ared  Ared
sred  Sred
h
zZ
22/40
The Decision – Which Route?
Routes
44.48
44.46
44.44
2
44.42
lat
44.4
3
44.38
44.36
1
44.34
44.32
44.3
44.28
33.22 33.24 33.26 33.28
33.3
33.32 33.34 33.36 33.38
lon
33.4
23/40
The Complications – IED’s
Attacks
44.48
Route 1
Route 2
Route 3
Attacks
44.46
44.44
44.42
lat
44.4
44.38
44.36
44.34
44.32
44.3
44.28
33.22 33.24 33.26 33.28
33.3
33.32 33.34 33.36 33.38
lon
33.4
24/40
Some Help - Mitigations
Attacks
44.48
Route 1
Route 2
Route 3
Attacks
44.46
44.44
44.42
lat
44.4
44.38
44.36
44.34
44.32
44.3
44.28
33.22 33.24 33.26 33.28
33.3
33.32 33.34 33.36 33.38
lon
33.4
25/40
The Interactions – Blue vs. Red
• Before we get to the interactions, a brief
introduction to point processes …
26/40
Point Process
• Def: A point process N is a Z+ valued random
measure
– N(B) = # events in the set B
• A Poisson point process satisfies two conditions:
– Whenever B1, …, Bn are disjoint, the random variables
N(B1), … , N(Bn) are independent
– For every B and k=0,1,…
P(N(B)=k)=exp{-(B)} (B)k / k!
• The mean measure  is such that
E[N(B)]=(B)=sB (b) db
• The non-negative intensity function thus satisfies
(db)=(b)db
27/40
Point Process Models of ISS
• For the terrorist scenario, we assume a dynamic
point process model
– The intensity  is random
– It depends on the realizations of other stochastic processes
– Conditionally a Poisson point process
• Results in a form of Spatial Hierarchy Model
28/40
The Red Force Model
Attraction:
CS(²) ¸ 1
Repulsion:
0 · CM(²) · 1
2
Inhibition:
CA(²) 2 {0,1}
3
NY
NM
( t)
NY
S ( t)
A ( t)
Y
¸ ( t; s) = h( G( t; s) ) 64
cS ( s; x i )
cM ( s; x j )
cA ( s; sk ) 75
i= 1
j= 1
k= 1
Utility
component:
exp{V(si)}
Evaluation probability:
P(s 2 C(t))
² x i = ( t i ; si )
² N S( t) is t he number of Successful at t acks
² G( t; s) is high-dimensional,
² N M ( t) is t he number of M it igat ed at t acks
mixed valued, space-t ime process ² N A ( t) is t he number of Act ive event s
² h( ¢) represent s t he in° uence
of t he exogenous covariat es
29/40
Dynamics of the Interactions
30/40
Active Events
31/40
Interaction with Active Events
32/40
The Blue Force Model
• The Blue force only has knowledge of successful attacks, NS
• Mitigated attacks and currently active devices are unknown
• Blue force will use Spatial Hierarchy Models models to infer the
locations of active devices
• Generalized Linear Model involving environmental covariates G4, G7,
G10 fit with Poisson regression
• Spatial KDE with bandwidth chosen with cross-validation
• The model is refit at each time period based on Ns
• Delay of  in the information on NS
X3
¸b ( t; s) = expf ¯ 0 +
¯ m G J m ( t; s) g¢
2 m= 1
3
Ã
!
N SX
( t¡ ±)
1
jjs ¡ si jj 7
6
K
4
5
2
N S ( t ¡ ±) h
h
i= 1
33/40
Mitigation or Clearing
•
•
•
•
The Blue force mitigation efforts are constrained
Can only search 3 subregions per time interval
Each region is about .5% of the total region
Regions are selected according to which have
the highest estimated intensity
• All active devices in a mitigated region are
disarmed
• The Blue force does not take into account (i.e.
have the knowledge) whether or not there were
disarmed devices
34/40
Route Selection
• Strategy 1: Random
• Strategy 2: Take route with lowest cumulative
estimated intensity
Rout e=
ÃZ
arg m in
i
s2 Roadi
!
¸b ( t; s) ds
i 2 f 1; 2; 3g
• Strategy 3: Choose route with fewest successful
attacks in last w days (e.g. w=7)
35/40
Sample Realization
36/40
Movie of Complex Dynamics
37/40
Modifying Parameters
• INTELLIGENCE
– Gathering locations (and attributes) of successful events
» Effects of delay, 
– Other insights into terrorist decision making
• PREDICTIONS
– Spatial Hierarchy Models
» Linear in covariates (for utility)
» KDE (for evaluation probabilities)
• DECISIONS
– Predictions used for mitigations (separate from convoy routing)
– 3 Strategies for routing
» Random
» Lowest predictions (after E[Mitig] effects)
» Adaptive (route with least successes in past w days)
38/40
Testing the Routing Strategies
Mean of cumulative sum of successful attacks – with 95% intervals
Cumulative Sum of Successful Attacks
300
----- Strategy 1 (Random)
------ Strategy 2 (Predictions)
# Successful Attacks
250
------ Strategy 3 (Fewest Attacks)
200
150
100
50
0
0
10
20
30
40
50
Time
60
70
80
90
100
39/40
Concluding Thoughts
• We used Spatial Choice Models to represent
terrorist decision making
• Showed connection with dynamic point process
models
• Constructed systems model (and simulation) of
the complex interactions between Blue Force
and Red Force
• Now we can adjust model parameters and
observe the emergent behavior of agents acting
within this framework
40/40
Intelligent Site Selection Models
for Asymmetric Threat Prediction
and Decision Making
Michael D. Porter
[email protected]
Department of Statistics
North Carolina State University