Developing Automated Intelligence Collection Plans from Probabilistic Behavior Estimates

Modern warfare is intensely information centric with vast amounts of data transmitted around the battlespace. Within this environment, it is critical to provide predictive and timely intelligence for planning and execution of operations. Due to the changing nature of the asymmetric battles, the intelligence analysis and collection operations are integral part of one another. However, current technologies and tactics, techniques, and procedures (TTPs) decompose these two types of activities, resulting oftentimes in disjointed solutions. For example, information collection planning is often done without accounting for the results of the intelligence analysis, and collected information does not get immediately incorporated to update intelligence estimates. This may result in collecting information that is not critical to situation understanding and delays in changing the situation estimates. In this paper, we describe a decision support tool for intelligence analysts and collection planners integrating automated behavior pattern identification with intelligence collection planning in a close-loop solution. This technology promises to provide warfighters with a comprehensive, accurate, and costeffective solution for intelligence gathering, analysis, and operations planning. Motivation: Integrating Disruption and Collection Plans with Intelligence Estimates Due to the changing nature of the asymmetric battles, the intelligence analysis and collection are integral part of one another. However, current technologies and tactics, techniques, and procedures (TTPs) decompose these two types of activities, resulting oftentimes in disjointed solutions. For example, information collection planning is often done without accounting for the results of the intelligence analysis, and collected information does not get immediately incorporated t update intelligence estimates. This may result in collecting information that is not critical to situation understanding and delays in changing the situation estimates. Figure 1: Collection, reasoning, and planning in a close-loop workflow of operational and strategic decision making The collection, reasoning and planning are three elements in the close-loop workflow of operational and strategic decision making (Figure 1). First, the intelligence collections can be conducted with varied sensors 1 [email protected]; phone 781-935-3966x267; fax 781-935-4385; www.aptima.com 1 14th ICCRTS-2009 “C2 and Agility” and produce data in different formats. This data will have large information gaps: missing events, errors in classifying what events and actors are, ambiguous information, and irrelevant data. Second, the intelligence analysis processes observed data through reasoning to identify actors and behavior patterns. Finally, current estimates of possible patterns can be used to identify information elements that are most critical to current situation understanding. This criticality means that collection of such data may improve the current understanding of the situation by disambiguating between multiple hypotheses that may currently seem equally likely. To develop efficient automated decision support systems that can reason about environment and design collection actions, we need to establish tight dependencies between various decision phases. This can be done by establishing direct input-output data flow and feedback between decision phases. Method: Integrating Collection Planning with Behavior Pattern Recognition Under a project called Contextualized Pattern Recognition (CoPR) sponsored by the Air Force Research Lab (AFRL), Aptima Inc. is currently developing a decision support system (Figure 2) for intelligence analysts and collection planners to find structures and patterns in all-source multi-scale data and identify critical information collection requirements. This technology probabilistically maps hypothesized adversarial behavior signatures against observed actor activity and interaction networks. The mappings are used to identify information for intelligence collection that disambiguates current predictions and improves situation understanding. We envision the CoPR system as a multi-user collaborative decision support tool, which must enable the following three types of uses (Figure 2): Figure 2: CoPR system workflow Use 1: Hypotheses Generation. The CoPR system will allow analysts and commanders to define the hypotheses in the form of potential adversarial activity patterns (which we call behavior signatures) that may take place and/or are of interest to the users. This functionality allows different users to define their own distinct hypotheses, share them with other users, and refine them and their estimates over time as more intelligence becomes available that either confirms or contradicts the hypotheses. The activity patterns are represented in the form of the networks consisting of possible hostile operations, their profiles, and temporal and relational dependencies among these operations. Thus, the structure of the activity patterns is natural for modeling decision and action steps defining how the adversaries might achieve their objectives. Use 2: Adversarial Analyses. As hypothesized hostile behavior signatures are defined, CoPR will analyze available intelligence to estimate which of these hypotheses are likely to be present. That is, CoPR will automatically identify, given observed events, which adversarial operations are taking place, where they