Data Mining for Counterterrorism Dr. Bhavani Thuraisingham Program Director

1. Data Mining for Counterterrorism Dr. Bhavani Thuraisingham Program Director Information and Data Management The National Science Foundation April 12, 2002

2. Aspects of Counterterrorism • National Security Measures • Protection from Non-real-time Threats • Protection from Real-time Threats • Protection from Cyberterrorism • Cyber security • Protection from Bioterrorism Data Mining for Counterterrorism

3. Data Mining Needs for Counterterrorism: Non-real-time Data Mining • Gather data from multiple sources • Information on terrorist attacks: who, what, where, when, how • Personal and business data: place of birth, ethnic origin, religion, education, work history, finances, criminal record, relatives, friends and associates, travel history, . . . • Unstructured data: newspaper articles, video clips, speeches, emails, phone records, . . . • Integrate the data, build warehouses and federations • Develop profiles of terrorists, activities/threats • Mine the data to extract patterns of potential terrorists and predict future activities and targets • Find the “needle in the haystack” • Data integrity is essential • Techniques have to SCALE Data Mining for Counterterrorism

4. Data Mining Needs for Counterterrorism: Real-time Data Mining • Nature of data • Data arriving from sensors and other devices • Continuous data streams • Breaking news, video releases, satellite images • Some critical data may also reside in caches • Rapidly sift through the data and discard unwanted data for later use and analysis (non-real-time data mining) • Data mining techniques need to meet timing constraints • Quality of service (QoS) tradeoffs among timeliness, precision and accuracy • Presentation of results, visualization, real-time alerts and triggers Data Mining for Counterterrorism

5. Data Mining Needs for Counterterrorism: Cybersecurity • Determine nature of threats and vulnerabilities • e.g., emails, trojan horses and viruses • Classify and group the threats • Profiles of potential cyberterrorist groups and their capabilities • Data mining for intrusion detection • Real-time/ near-real-time data mining • Limit the damage before it spreads • Data mining for preventing future attacks • Forensics Data Mining for Counterterrorism

6. Data Mining Needs for Counterterrorism: Protection from Bioterrorism • Determine nature of threats • Biological weapons and agents, Chemical weapons and agents • Classify and group the threats • Identify the types of substances used • Prevention and detection mechanisms • Intelligence gathering, detecting symptoms • Determine actions to be taken to avoid fatal and dangerous situations Data Mining for Counterterrorism

7. Where are we now? • We have some tools for • building data warehouses from structured data • integrating structured heterogeneous databases • mining structured data • forming some links and associations • information retrieval tools • image processing and analysis • pattern recognition • video information processing • visualizing data • managing metadata • intrusion detection and forensics Data Mining for Counterterrorism

8. What are our challenges? • Do the tools scale for large heterogeneous databases and petabyte sized databases? • Integrating structured data with unstructured data • Extracting metadata from unstructured data • Indexing unstructured data for efficient access • Mining unstructured data • Extracting useful patterns from knowledge-directed data mining • Rapidly forming links and associations; get the big picture for real-time data mining • Detecting/preventing cyber attacks • Mining the web • Evaluating data mining algorithms • Building testbeds Data Mining for Counterterrorism

9. Privacy Concerns • Data Mining as a threat to Privacy • Data mining gives us “facts” that are not obvious to human analysts of the data • Possible threats: • Predict information about classified data and events from correlation with unclassified data and events (e.g., Pizza deliveries to the Pentagon) • What can we do? • Need technologists, lawyers, policy makers to work together • We cannot wait to address privacy concerns until it is too late • technology may move too far ahead • major privacy violation may occur • We want to protect the data as well as correlations among data items Data Mining for Counterterrorism

10. Form a Research Agenda • Immediate action (0 - 1 year) • We’ve got to know what our current capabilities are • Do the commercial tools scale? Do they work only on special data and limited cases? Do they deliver what they promise? • Need an unbiased objective study with demonstrations • At the same time, work on the big picture • What do we want? What are our end results for the foreseeable future? What are the criteria for success? How do we evaluate the data mining algorithms? What testbeds do we build? • Near-term (1 - 3 years) • Leverage current research • Fill the gaps in a goal-directed way • Long-term research (3 - 5 years and beyond) • 5-year basic research plan for data mining for counterterrorism Data Mining for Counterterrorism

11. Some Agencies Funding Research • NSF • IDM Program, ITR Program, Several interdisciplinary research programs • Trusted Computing Program • Joint programs with Intelligence Community - KDD • DARPA • EELD, DAML, etc. • NIH • Bioterrorism initiatives • Intelligence Agencies • CIA, NSA, ARDA • Much emphasis on mining and link discovery Data Mining for Counterterrorism

12. Contact Information • Dr. Bhavani Thuraisingham The National Science Foundation Suite 1115 4201 Wilson Blvd Arlington, VA 22230 Phone: 703-292-8930 Fax 703-292-9037 email: bthurais@nsf.gov Data Mining for Counterterrorism