These UAHuntsville scientists hope to help provide a better intelligence posture on these asymmetric threats by developing computer models that identify trends in the behaviors of the adversaries.

“One way to combat these attacks is to identify trends in the attackers’ methods, then use those trends to predict their future actions,” said UAHuntsville researcher Wes Colley said. “Some trends from these attacks show important day-to-day correlations. If we can draw inferences from those correlations, then we may be able to save lives by heightening awareness of possible events or changing the allocation of our security assets to provide more protection.”

UAHuntsville teamed with a Virginia-based company, Mymic LLC, to receive an Air Force contract for the six-month study.

A four-step process was used in this research, according to Colley. Researchers reviewed the behavior signatures of terrorists on 12,000 attacks between 2003 and mid-2007 to calculate relative probabilities of future attacks on various target types.

The four steps were: create a database of past attacks; identify trends in the attacks; determine the correlation between attacks and use analysis to calculate the probabilities of future attacks and their location.

The goal was not to try to predict exactly when and what type of attack was going to happen next, but rather, which target types were more likely to be attacked next, according to Colley. “Our research won’t predict that an attack targeting civilians at a public market will take place tomorrow at 9:30 a.m.”

Instead, he said military commanders could make choices from various options to reduce risk. “A commander with limited intelligence and security assets can concentrate resources at those locations that have higher probabilities of attack.”

This study considered two aspects of each attack: the target of the attack, and the time of the attack. Using careful statistical techniques, the team identified correlations between attacks on various target types as a function of time. For instance, if there were an attack on a government target, that somewhat increased the chance of an attack on a police target over the next several days.

Armed with this knowledge, commanders could allocate greater than usual resources to protect police assets more carefully for several days after an attack on a government target. The team also observed other significant correlations such as attacks on civilian targets with other attacks on civilian targets.

One finding that surprised Colley involved sectarian violence. He said when members of the Shiite sect would attack a Sunni, other attacks on Sunnis were likely to follow. However, the converse was not true. When Sunnis attacked Shiites, there was no greater incidence of a follow-on attack than normal. Also, there seemed to be little evidence of regular retributory attacks from one group on the other, although that dataset was too limited say for sure.

“Despite many difficulties with the dataset, we did find that our trend analysis very successfully provided enhanced predictive capability when compared to the broader attack rate,” he said. “Our concept has proven successful in identifying trends and correlations in the attacks.”

Colley said the university is seeking additional dollars to further develop the concept with more complete and reliable data. “Ultimately, we were limited by the data, which we gleaned from public Internet sources. Their information, particularly with respect to attack location, was hit-and-miss, at best. With more and better data, perhaps including classified data, we expect a dramatic improvement in the predictiveness of our method.

Note: If no author is given, the source is cited instead.

• Weapons Technology
• Energy Policy
• Engineering

• Hacking
• Information Technology
• Encryption

• Cyber security standards
• Computer insecurity
• Security engineering
• Data mining
• Malware
• Cryptography