intelligent site selection models for asymmetric threat prediction and decision making michael d....
TRANSCRIPT
Intelligent Site Selection Models Intelligent Site Selection Models for Asymmetric Threat Prediction for Asymmetric Threat Prediction
and Decision Makingand Decision Making
Intelligent Site Selection Models Intelligent Site Selection Models for Asymmetric Threat Prediction for Asymmetric Threat Prediction
and Decision Makingand Decision Making
Michael D. [email protected]
North Carolina State University
Donald E. Brown and C. Donald Robinson
[email protected] [email protected]
University of Virginia
2/40
Intelligent Site SelectionIntelligent Site SelectionIntelligent Site SelectionIntelligent Site Selection
Time T1 T2 T3 T4
Space
S1
S3
S4S2
Decision = {(T1,S1),(T2,S2),(T3,S3), (T4,S4)}
3/40
Intelligent Site SelectionIntelligent Site SelectionIntelligent Site SelectionIntelligent Site Selection
Definition: An Intelligent Site Selection process is one in which a group of actors judiciously select the locations and times to initiate events according to their preferences or perceived utility of those locations and times.
• Just observing the points in time and space isn’t enough, because these don’t take into account the actors’ preferences
• So we introduce attribute space (N-Dimensional)
g1: Dis_Hway
g2: Darknessg3: Avg. Income
g4: Population
gN: Dis_Home
.
.
.
4/40
Finding PatternsFinding PatternsFinding PatternsFinding Patterns
1
0 t1 t2 t3 t4 t5 t6 t7 TTimeAxis
. . .
gp
...
.
..AttributeSpace
g(s1,t1)
GeographicSpace
s
s2s1 s3
s4
s2 s5
s6 s7
g(s3,t3)
g(s4,t4)
g1
g2
gi
g(s2,t2)g(s5,t5)
g(s6,t6)g(s7,t7)
Patterns emerge in Attribute Space
Liu and Brown (2004) Int. J. Of Forecasting
5/40
Terrorist Threat Prediction ProblemTerrorist Threat Prediction ProblemTerrorist Threat Prediction ProblemTerrorist Threat Prediction Problem
• Inputs– series of incidents or attacks of the same type in an area of
interest and over a fixed time interval,
– (optional) doctrine or subjective behavioral descriptions of enemy operations
– Formal description of the named areas of interest and friendly elements given by values of attributes or features that are known or believed to be relevant to the occurrence of the attacks or incidents
• Output: – The likelihood that another attack or incident occurs at
specified locations within the named area of interest and within a specified time range
6/40
Attribute SetAttribute SetAttribute SetAttribute Set
• To successfully model the terrorist attacks, we should attempt to model their decision making process or preferences for attack locations
• Thus we include covariates that are thought to influence the terrorist site selection process (or that are associated (correlated) with such features) in our models
• Since we usually don’t know the terrorist’s preferences we must discover (data mining) these from previous attack locations
– Observe past attack locations and associated feature values for that location
• Examples of possible features– Census (Socio-economic)
– Proximity (Distance to landmarks or structures)
– Military or Police Patrols (times and locations)
7/40
Spatial Choice ModelsSpatial Choice ModelsFotheringham (1983) Env+Plan A, Xue and Brown (2003) IEEE SMC-C
Spatial Choice ModelsSpatial Choice ModelsFotheringham (1983) Env+Plan A, Xue and Brown (2003) IEEE SMC-C
• Adapt theory of random utility theory to terrorist spatial decision making
• Alternatives are spatial locations
• The number of alternatives is very large– Perhaps infinite in reality
• Each alternative has two components– Spatial component: fixed spatial locations
– Attribute component: spatial alternatives’ characteristics
8/40
Choice Picked
Alternatives to Evaluate Cd
Hierarchical Spatial ChoiceHierarchical Spatial ChoiceHierarchical Spatial ChoiceHierarchical Spatial Choice
Alternatives – {ai}
Decision Maker d
Xue, Y. F., Brown, D. E., (2003) IEEE SMC-C
Choice Set
9/40
Analysis of Terrorists’ Decision ProcessAnalysis of Terrorists’ Decision ProcessAnalysis of Terrorists’ Decision ProcessAnalysis of Terrorists’ Decision Process
• A terrorist’s choice set is unknown to analysts
• We can only estimate the probability for each alternative to be pre-evaluated P(aiCd)– Here we will use our spatial information
• The attribute information is used to estimate the utility of each location
• This leads us to adopt– Fotheringham’s Competing Destinations Model
– Aka: Spatial Hierarchy Model
10/40
Spatial Hierarchy ModelSpatial Hierarchy ModelSpatial Hierarchy ModelSpatial Hierarchy Model
• Begin with the assumption that all actors have same preferences and same choice set C
• The probability that an alternative ai is pre-evaluated by any actor is P(ai C)
• Based on these assumptions, the probability location i is selected is given by
where,
V(si)-Utility of location si for all actors
P (si) =expf V (si)g¢P (si 2 C)
Pj expf V (sj )g¢P (sj 2 C)
11/40
Spatial Hierarchy ModelSpatial Hierarchy ModelSpatial Hierarchy ModelSpatial Hierarchy Model
P (si) =expf V (si)g¢P (si 2 C)
Pj expf V (sj )g¢P (sj 2 C)
A function of the attributes/covariates of
location si
A function of spatial location only
expf V (si)g = expf ¯0 +X
m¯mG(si)g
P (si 2 C) =1
N h2
NX
i=1K
Ãjjs ¡ si jj
h
!
12/40
Clustering CovariatesClustering CovariatesClustering CovariatesClustering Covariates
MH
INC
.97
AH
INC
.97P
CIN
C.9
7
PO
P.D
ST
FA
M.D
ST
HH
.DS
T
MA
LE
.DS
T
FE
M.D
ST
HU
NT.
DS
T
OC
CH
U.D
ST
VA
CH
U.D
ST
MO
RT
1.D
STM
OR
T2
.DS
T
CO
ND
1.D
ST
OW
N.D
ST
RE
NT.
DS
T
PO
P1
23
.DS
T
PO
P4
5.D
ST
PO
P6
7.D
ST
PO
P8
91
0.D
S
AG
EH
12
.DS
T
AG
EH
34
.DS
T
AG
EH
56
.DS
T
CL
S1
2.D
ST
CL
S3
45
.DS
T
CL
S6
7.D
ST
AL
C.T
OB
.PH
AP
PA
RE
L.P
H
ET.
PH
FO
OD
.PH
ME
D.P
H
HO
US
ING
.PH
P.C
AR
E.P
HT
RA
NS
.PH
D.S
CH
OO
L
D.H
IGH
WA
Y
D.H
OS
PIT
AL
D.C
HU
RC
HD
.PA
RK
0.0
0.2
0.4
0.6
Xue, Y. F., Brown, D. E., (2003) IEEE SMC-C
13/40
Estimation of Model ParametersEstimation of Model ParametersEstimation of Model ParametersEstimation of Model Parameters
• Not spatial smoothing, more like random thinning in point processes
• More generally, use Random Forest for estimating utility component
P (si) / expf V (si)g¢P (si 2 C)
14/40
Sample RealizationSample RealizationSample RealizationSample Realization
lon
lat
Probability of Evaluation
33.22 33.24 33.26 33.28 33.3 33.32 33.34 33.36 33.38 33.4
44.3
44.32
44.34
44.36
44.38
44.4
44.42
44.44
44.46
44.48
lon
lat
Spatial Hierarchy Model
33.22 33.24 33.26 33.28 33.3 33.32 33.34 33.36 33.38 33.4
44.3
44.32
44.34
44.36
44.38
44.4
44.42
44.44
44.46
44.48
15/40
Examples from IraqExamples from IraqExamples from IraqExamples from Iraq
0.0 0.2 0.4 0.6 0.8 1.0
0.0
0.2
0.4
0.6
0.8
1.0
Blue lines are contours of the predicted intensity of terrorist attacks and red dots are the actual attacks
16/40
Simulation of Intelligent Site Simulation of Intelligent Site Selection Processes for Selection Processes for
Decision MakingDecision Making
Simulation of Intelligent Site Simulation of Intelligent Site Selection Processes for Selection Processes for
Decision MakingDecision Making
17/40
What is the problem?What is the problem?What is the problem?What is the problem?
• Explaining locations and times for future terrorist events is a difficult yet useful problem to solve
• What do they think?
• Why they choose their targets?
• How can we impede their operations?
18/40
What is the point?What is the point?What is the point?What is the point?
• To provide a means to test the effect of differing levels of intelligence, prediction, and action decisions
– Should we get better predictive methods
– Should we get better intelligence
– Should we make different decisions
• How do these influence the successfulness of terrorist events?
19/40
The Scenario – Red ForceThe Scenario – Red ForceThe Scenario – Red ForceThe Scenario – Red Force
• Red force initiates incidents
• Remotely or autonomously detonated explosive devices
• Active until detonated or decay
• The target is Blue force vehicles
20/40
The Scenario – Blue ForceThe Scenario – Blue ForceThe Scenario – Blue ForceThe Scenario – Blue Force
• Blue force collects intelligence, predicts red force actions, and decides which route to send convoy
• Blue force has limited ability to clear any active explosives in some small region prior to convoy deployment
• Convoys will travel on the roads regardless of threat
• The model could be applied to other contexts as well (suicide bombings, mortar attacks, etc.)
21/40
The ApproachThe ApproachThe ApproachThe Approach
• Terrorists do not act independently of their targets’ actions
• Often the targets (like the U.S. Military) also react to the attacks
• The dynamics of this complex system can be modeled and simulated
22/40
red
red
red
blue
blue
blue
h
red reds Sblue blues S
blue bluek K red redk K
blue bluea A red reda A
blue blues Sred reds S
blue blued D red redd D
w W
z Z
The Systems ModelThe Systems ModelThe Systems ModelThe Systems Model
INTELLIGENCEPREDICTIONACTION
23/40
33.22 33.24 33.26 33.28 33.3 33.32 33.34 33.36 33.38 33.444.28
44.3
44.32
44.34
44.36
44.38
44.4
44.42
44.44
44.46
44.48
lon
lat
Routes
The Decision – Which Route?The Decision – Which Route?The Decision – Which Route?The Decision – Which Route?
1
2
3
24/40
33.22 33.24 33.26 33.28 33.3 33.32 33.34 33.36 33.38 33.444.28
44.3
44.32
44.34
44.36
44.38
44.4
44.42
44.44
44.46
44.48
lon
lat
Attacks
Route 1
Route 2Route 3
Attacks
The Complications – IED’sThe Complications – IED’sThe Complications – IED’sThe Complications – IED’s
25/40
33.22 33.24 33.26 33.28 33.3 33.32 33.34 33.36 33.38 33.444.28
44.3
44.32
44.34
44.36
44.38
44.4
44.42
44.44
44.46
44.48
lon
lat
Attacks
Route 1
Route 2Route 3
Attacks
Some Help - MitigationsSome Help - MitigationsSome Help - MitigationsSome Help - Mitigations
26/40
The Interactions – Blue vs. Red The Interactions – Blue vs. Red The Interactions – Blue vs. Red The Interactions – Blue vs. Red
• Before we get to the interactions, a brief introduction to point processes …
27/40
Point ProcessPoint ProcessPoint ProcessPoint Process
• Def: A point process N is a Z+ valued random measure
– N(B) = # events in the set B
• A Poisson point process satisfies two conditions:– Whenever B1, …, Bn are disjoint, the random variables N(B1),
… , N(Bn) are independent
– For every B and k=0,1,…
P(N(B)=k)=exp{-(B)} (B)k / k!
• The mean measure is such that E[N(B)]=(B)=sB (b) db
• The non-negative intensity function thus satisfies (db)=(b)db
28/40
Point Process Models of ISSPoint Process Models of ISSPoint Process Models of ISSPoint Process Models of ISS
• For the terrorist scenario, we assume a dynamic point process model
– The intensity is random
– It depends on the realizations of other stochastic processes
– Conditionally a Poisson point process
• Results in a form of Spatial Hierarchy Model
29/40
The Red Force ModelThe Red Force ModelThe Red Force ModelThe Red Force Model
Utility component:
exp{V(si)}
Evaluation probability:P(s 2 C(t))
¸(t; s) = h(G(t;s))
2
64
NS(t)Y
i=1cS(s;xi)
NM (t)Y
j =1cM (s;xj )
NA (t)Y
k=1cA (s;sk)
3
75
² xi = (ti; si)² G(t;s) is high-dimensional,mixed valued, space-time process² h(¢) represents the in°uenceof the exogenous covariates
² NS(t) is the number of Successful attacks² NM (t) is the number of M itigated attacks² NA(t) is the number of Active events
Attraction:
CS(²) ¸ 1
Repulsion:
0 · CM(²) · 1Inhibition:
CA(²) 2 {0,1}
30/40
Dynamics of the InteractionsDynamics of the InteractionsDynamics of the InteractionsDynamics of the Interactions
31/40
Active EventsActive EventsActive EventsActive Events
32/40
Interaction with Active EventsInteraction with Active EventsInteraction with Active EventsInteraction with Active Events
33/40
The Blue Force ModelThe Blue Force ModelThe Blue Force ModelThe Blue Force Model
• The Blue force only has knowledge of successful attacks, NS
• Mitigated attacks and currently active devices are unknown
• Blue force will use Spatial Hierarchy Models models to infer the locations of active devices
• Generalized Linear Model involving environmental covariates G4, G7, G10 fit with Poisson regression
• Spatial KDE with bandwidth chosen with cross-validation
• The model is refit at each time period based on Ns
• Delay of in the information on NSb̧(t; s) = expf ¯0 +
3X
m=1¯mGJ m(t; s)g¢
2
64
1NS(t ¡ ±)h2
NS(t¡ ±)X
i=1K
Ãjjs ¡ si jj
h
!3
75
34/40
Mitigation or ClearingMitigation or ClearingMitigation or ClearingMitigation or Clearing
• The Blue force mitigation efforts are constrained
• Can only search 3 subregions per time interval
• Each region is about .5% of the total region
• Regions are selected according to which have the highest estimated intensity
• All active devices in a mitigated region are disarmed
• The Blue force does not take into account (i.e. have the knowledge) whether or not there were disarmed devices
35/40
Route SelectionRoute SelectionRoute SelectionRoute Selection
• Strategy 1: Random
• Strategy 2: Take route with lowest cumulative estimated intensity
• Strategy 3: Choose route with fewest successful attacks in last w days (e.g. w=7)
Route=
arg mini
ÃZ
s2Roadi
b̧(t; s) ds
!
i 2 f 1;2;3g
36/40
Sample RealizationSample RealizationSample RealizationSample Realization
37/40
Movie of Complex DynamicsMovie of Complex DynamicsMovie of Complex DynamicsMovie of Complex Dynamics
38/40
Modifying ParametersModifying ParametersModifying ParametersModifying Parameters
• INTELLIGENCE– Gathering locations (and attributes) of successful events
» Effects of delay, – Other insights into terrorist decision making
• PREDICTIONS – Spatial Hierarchy Models
» Linear in covariates (for utility)» KDE (for evaluation probabilities)
• DECISIONS– Predictions used for mitigations (separate from convoy routing)– 3 Strategies for routing
» Random» Lowest predictions (after E[Mitig] effects)» Adaptive (route with least successes in past w days)
39/40
Testing the Routing StrategiesTesting the Routing StrategiesTesting the Routing StrategiesTesting the Routing Strategies
0 10 20 30 40 50 60 70 80 90 1000
50
100
150
200
250
300
Time
# S
ucce
ssfu
l Atta
cks
Cumulative Sum of Successful Attacks
Mean of cumulative sum of successful attacks – with 95% intervals
----- Strategy 1 (Random)
------ Strategy 2 (Predictions)
------ Strategy 3 (Fewest Attacks)
40/40
Concluding ThoughtsConcluding ThoughtsConcluding ThoughtsConcluding Thoughts
• We used Spatial Choice Models to represent terrorist decision making
• Showed connection with dynamic point process models
• Constructed systems model (and simulation) of the complex interactions between Blue Force and Red Force
• Now we can adjust model parameters and observe the emergent behavior of agents acting within this framework
Michael D. [email protected]
Department of StatisticsNorth Carolina State University
Intelligent Site Selection Models Intelligent Site Selection Models for Asymmetric Threat Prediction for Asymmetric Threat Prediction
and Decision Makingand Decision Making
Intelligent Site Selection Models Intelligent Site Selection Models for Asymmetric Threat Prediction for Asymmetric Threat Prediction
and Decision Makingand Decision Making