activity based intelligence - esri · activity based intelligence discovery intelligence for...
TRANSCRIPT
Ben Conklin, Esri
Activity Based Intelligence Discovery Intelligence for Resolving the Unknown
Implementing ABI Workflows using ArcGIS
Activity Based Intelligence
• A set of spatiotemporal analytic methods to:
- Discover correlations
- Resolve unknowns
- Understand Networks
- Develop Knowledge
- Drive Collection
...Using diverse multi-INT data sets
Shift to Discovery
Research Search
MonitorDiscover
ABI
Known
Unknown
Kn
ow
n
Unknow
n
Locations and Targets
Beh
avio
rs a
nd
Sig
natu
res
The Intelligence Cycle
Requirements
Tasking
Collection
Processing
Exploitation
Dissemination
ABI Emphasis Traditional Emphasis
4 Pillars of ABI
ABI Pillar
SequenceNeutrality
ABI Pillar
IntegrationBefore
Exploitation
ABI Pillar
Data Neutrality
ABI Pillar
GeoreferenceTo
Discover
Application Frameworks
Real-Time Analytics
Big DataAnalytics
Geo-Enrichment
IntelligenceEnterprise
Enabling Technology
Spatial & Temporal
Data Environment
All Source Analysts
Geospatial Analysts
Foundation Intelligence
Real TimeReporting
AnalysisServices
HUMINT Analysts
Imagery Analysts
SIGINT Analysts
Who-Where-Who & Where-Who-Where
Scope the Entity/Entities of
Interest
“What is the entity or group
of entities of interest?”
Identify Relevant Locations
“Where has this entity
previously been observed?”
Examine Co-Occuring
Entities
“What other entities have
also been observed at these
locations?
Asses for Demonstrative
Correlation
“Is co-occurance indicative
of a relationshiop between
the individual entity and the
discovered entity.
Location Integrates Intelligence DataUsing a Simple Logical Model
Foundation
Observations
Imagery
Big Data
3D
Lidar
Real-Time
Creating
A Common Language
Apps Distributed
Georeference to Discover
Degree Type Basis Example
First Degree Direct Metadata GPS Location “tag” on
a still image
Indirect Content Text document stating
individual residence
Indirect Metadata Biographic profile with
a metadata tag for
residence
Second Degree Indirect Metadata/Context Synthesized from both
content and context of
data (e.g
georeferenced poem)
Georeference to Discover - Context
Data Type Focus Primary Purpose
Activity Discrete activities conducted by individual
entities
Entity resolution/identification, pattern-
of-life assessment
Context Aggregated data of any type Provides context for observed
activities and entities
Biographical Attribute information of an entity Provide information to a specific entity
such as age or name
Relational Information describing relationship between
entities
Understand and visualize the formal
and informal social networks to which
an entity belongs
Structured and Unstructured Data
Integrate Intelligence Reporting
Defense, Intel and National Security
Data Conditioning Techniques
Source Typical Extraction Activities
Text reports Entities, events, coordinates, locations
Still imagery Buildings, roads, geographic features, vehicles,
changes between frames
Motion Imagery Vehicle motion (tracks), human activities
Hyperspectral
imagery
Materials
Infrared imagery Warm objects, operating equipment
Financial transactions Account numbers, identifies, amounts
Object and Activity Extraction from Motion and Still Imagery
• Still Imagery for Long Duration Activity
- Ships in Port
- Cars in Parking Lot
• Motion Imagery for rapid activity and transactions
• Machine Learning and “Neural Networks” for advanced recognition
Activity Category Candidate Activities
Single Person Digging, loitering, picking up, throwing,
exploding/burning, carrying, shooting, launching, walking,
limping, running, kicking, smoking, gesturing
Person-person Following, meeting, gathering, moving as a group,
dispersing, shaking hands, kissing, exchanging objects,
kicking, carrying together
Person-vehicle Driving, getting in/out, loading/unloading, opening trunk,
crawling under car, breaking window, shooting/launching,
exploding/burning, dropping off, picking up
Person-facility Entering (exiting), standing, waiting at checkpoint,
evading checkpoint, climbing atop, passing thru gate,
dropping off
Vehicle Accelerating, turning, stopping, overtaking/passing,
exploding/burning, discharging, shooting, moving
together, forming into convoys, maintaining distance
Other VIP activities (convoy, parade, receiving line, troop
formation, speaking to crowds) riding animal, bicycling,
etc..
ABI Lexicon
Vehicle Start• Activity
• Events and Transactions
- Physical and logical
• Context and Biographical
• Relational
Date 03-MAR-2012
TIME 1540Z
Location X,Y
Type 4D Sedan
Color RED
Start
Vehicle Stop
Date 03-MAR-2012
TIME 1840Z
Location X,Y
Type 4D Sedan
Color RED
Stop
Disambiguation and Durability
• Entities are observed through proxies
• High Durability – Biometrics
• Low Durability – Vehicle
• Indexing – Entity to Proxy Resolution
Entity A
Height
Birthplace
Vehicle
Name
Telephone
New Analytic Workflow
Real Time Analysis
Batch Analysis
Raw Feeds Alerts & Forecasts
ArcGIS Enterprise 10.6 Slide
Portal
Apps
DesktopAPIs
ArcGIS Enterprise
Enterprise Data Management, Analysis, and Mapping
. . . Enabling Organizations to Take GIS to Scale
ArcGIS Enterprise
Data Management,
Mapping, and
Geoprocessing
Real Time
Image Management
& Raster Analytics
Big Data
Access and Management
GeoEvent
Server
GeoAnalytics
Server
Image
Server
GIS
Server
Portal
Modular and Massively Scalable
• Specialized Servers
• Independently Scalable
• Flexible
Deployable On-Premisesand In the Cloud
Real Time Slide
GeoEvent
Server
Real-Time
Data
Situational
Awareness
Analytics Alerting
GeoAnalytics
Server
Real-Time Analytics | Integrating Sensor Networks and the IoT
Supporting Real-Time GIS Applications . . .
• High-Velocity Data Streams
• Monitoring and Alerting
Improvements
• Scalability
• Availability
• Cloud IoT Connectors
Working with Real-Time DataMaking features come alive
• Import your feature layer’s schema as a GeoEvent Definition
• Connect an output to your feature service
• Configure an input to receive real-time data
• Author and publish a GeoEvent Service
• Visualize your real-time features
Applying real-time analyticsGeoEvent Services
• A GeoEvent Service defines the flow of GeoEvents,
- The Filtering and Processing steps to perform
- what input(s) to apply them to
- and what output(s) to send the results to
Applying Real-Time AnalyticsGeoEvent Processing
• You can perform continuous analytics on GeoEvents as they are received using a processor.
You can create
your own
processors.
GeoEvent Extension
Inp
uts
Ou
tpu
ts
GeoEvent Services
Buffer Creator
Convex Hull Creator
Difference Creator
Envelope Creator
Field Calculator
Field Enricher
Field Mapper
GeoTagger
Incident Detector
Intersector
Projector
Simplifier
Symmetric Difference
Track Gap Detector
Field Reducer Union Creator
Ou
t o
f th
e B
ox
Add XYZ
Esri
Gallery
Bearing
Ellipse
Event Volume Control
Extent Enricher
Field Grouper
GeoNames Lookup
Range Fan
Reverse Geocoder
Service Area Creator
Symbol Lookup
Track Idle Detector
Unit Converter
Visibility
Motion Calculator Query Report
Location SourcesSensed
Location
Volunteer
Location
Observed
Location
Stay
Location
• Locations where individuals spend time
• Includes Key Attributes for pattern analysis.
• Can be used at different scales
- Individual
- Neighborhood
- Regional
Attribute Description
Geometry Polygon and Point
IndividualID ID for individual at Stay Location
LocationID Unique ID for location
PreviousLocationID ID for Previous Location reported,
blank if no locationID
StartTime UTC Time of location at start
EndTime UTC Time of location of
departure or last report at stay
location
Duration Duration at Stay Location
LocationSource Source Data for stay location id
Source Source data for the reported
location
Stay Locations
Known Location InformationSensed
Location
Volunteer
Location
Observed
Location
Stay
Location
Suspicious
Places Stay
Locations
Monitored
Locations
Suspicious Places
• Predefined Locations for monitoring
- Home, Work, Meeting Areas
- Key POIs (Place of Worship, Restaurants, Internet Café)
Attribute Description
Geometry Polygon
LocationID Unique ID for location
LocationName Common name for the location
LocationCategory General Category for the
Location
LocationActivity Type of activity typically observed
at location
LocationModel Discrete,Semi-Discrete, Non-
Discrete
LocationSignificance A subjective numerical value
LocationSource Source of information for the
suspicious Location
DiscretenessLocation A (Movie Theater)
Show MoviesUsed for Community
MeetingsClosed Sundays
Entity Class
“Ticketholders and
Guests”
Entity Class
“Community Meeting
Attendees”
Entity Class
“Underground Cinema
Club”
Value Description Example Location
Discrete Locations restricted to a highly limited entity network that provide
highly diagnostic proxy observations
Private residence
Semi-discrete Locations that maintain some degree of access control but still
have many potential proxy-entity relationships
Restricted military installation; sporting
event; office place
Non-discrete A location not unique to any one entity or network of entities at a
given time; therefore a location that has somewhat less value for
disambiguation
Public market, square, or park
Location CaptureSensed
Location
Volunteer
Location
Observed
Location
Stay
Location
Suspicious
Places Stay
Location
Monitored
Locations
GeoEvent processingNotify about the absence of events
• A Track Gap Detector processor
- Detects the absence of events and alerts about the situation.
• A Track Idle Detector processor
- Detects the lack of movement even while events are received and alerts about the situation.
trackId V10987
gap true
lastReceived 1405176855553
geometry -116.93…, 33.93…
trackId V10987
gap true
lastReceived 1405176855553
geometry -116.93…, 33.93…
GapClosed
GapDetected
SuspectID V10987
Date 1405176845553
Geometry -116.93…, 33.93…
SuspectID V10987
Date 1405176855553
geometry -116.93…, 33.93…
trackId V10987
gap true
lastReceived 1405176855553
geometry -116.93…, 33.93…
trackId V10987
gap true
lastReceived 1405176855553
Geometry -116.93…, 33.93…
trackId V10987
gap false
lastReceived 1405176915553
geometry -117.123…, 36.064…
SuspectID V10987
Date 1405176915553
geometry -116.93…, 33.93…
SuspectID V10987
Date 1405176925553
geometry -116.93…, 33.93…
SuspectID V10987
Date 1405176935553
geometry -116.93…, 33.93…
SuspectID V10987
Date 1405176945553
Geometry -117.123…, 36.064…
Stay Location TaggingSensed
Location
Volunteer
Location
Observed
Location
Stay
Location
Suspicious
Places Stay
Location
Monitored
Locations
GeoEvent ProcessingEnrich a GeoEvent with new fields
• A Cache Aware Field Calculator processor
- Uses information for the Previous Track to calculate values on the current event
- Tracks are based on Individual ID
- Allows for calculation of Previous Location and Duration Tracking
Event
Previous
Event Details
IndividualID V10987
Date 1405176845553
LocationID House
geometry -117.123…, 36.064…
IndividualID V10987
Date 1405176845553
LocationID Work
geometry -117.123…,
36.064…
PreviousLocationID Work
geometry -117.123…,
36.064…
Field Calculator
Cache-Aware
Operations Dashboard
Movement Patterns
Defense, Intel and National Security
Alerts
Standard Reports
Tailored Reports
Visualization
Query/Drill Down
Statistical Analysis
Forecasting
Anticipatory Analytics
Something Happened
What Happened?
Where? How Many? How Often?
Where? How Many? How Often?
What are the specific causes?
Why did it happen?
What might happen?
When, where and how likely is it to happen?
Analytic Effort Required
De
cis
ion
Ad
va
nta
ge
Ga
ine
d
GeoEnrichment of Observations
Defense, Intel and National Security
Cultural Data
Landscape Data
Social Data
Observations
Big Data 10.6 SlideBig Data Spatial Analytics | Faster and Massively Scalable
Faster (10x+)
Power Outages(50+ Million)
Density
Imagery
Lidar: Bare Earth
Hot Spots
Riparian AreasSpace-Time Cube
Lidar: First Return
. . . Accessible from ArcGIS Pro and Python APILeveraging Distributed Computing and Parallel Processing
Image ServerLarge Imagery Collection
Raster AnalyticsFeature Analytics
GeoAnalytics ServerLarge Observation Collections
Insights Slide
Spatial / BI
GIS
• SQL Server
• Oracle
• SAP HANA
• Teradata
DBMSs• Excel
• CSV
Local
Exploratory Data Analysis and Visualization
• Self-Service
• Visual, Intuitive, Responsive
• Access Data from Across
Your Organization
Available with ArcGIS Online & Enterprise
New Charts
Link Analysis
Charts and Maps
Visual Models
Spatial and
Tabular Analysis
Insights for ArcGIS
Data Exploration
Defense, Intel and National Security
4 Pillars of ABI
ABI Pillar
SequenceNeutrality
ABI Pillar
IntegrationBefore
Exploitation
ABI Pillar
Data Neutrality
ABI Pillar
GeoreferenceTo
Discover
Application Frameworks
Real-Time Analytics
Big DataAnalytics
Geo-Enrichment
IntelligenceEnterprise
Enabling Technology
Print Your Certificate of AttendancePrint stations located in the 140 Concourse
Tuesday Wednesday12:30 pm – 6:30 pm GIS Solutions Expo Hall B
5:00 pm – 6:30 pm GIS Solutions Expo SocialHall B
10:30 am – 5:15 pm GIS Solutions Expo Hall B
6:30 pm – 9:00 pm Networking ReceptionSmithsonian National Portrait Gallery
Download the Esri Events
app and find your eventSelect the session
you attended
Scroll down to find the
feedback section
Complete answers
and select “Submit”
Please Take Our Survey in the Esri Events App
Header for
Demo SlideSupporting Text