Homeland Security What Can Mathematics Do?

1. Homeland Security What Can Mathematics Do? Fred Roberts Chair, Rutgers University Homeland Security Research Initiative Director, DIMACS Center

2. Dealing with terrorism requires detailed planning of preventive measures and responses. Both require precise reasoning and extensive analysis.

3. Experimentation or field trials are often prohibitively expensive or unethical and do not always lead to fundamental understanding. Therefore, mathematical modeling becomes an important experimental and analytical tool.

4. Mathematical models have become important tools in preparing plans for defense against terrorist attacks, especially when combined with powerful, modern computer methods for analyzing and/or simulating the models.

5. What Can Math Models Do For Us?

6. What Can Math Models Do For Us? Sharpen our understanding of fundamental processes Compare alternative policies and interventions Help make decisions. Prepare responses to terrorist attacks. Provide a guide for training exercises and scenario development. Guide risk assessment. Predict future trends.

7. OUTLINE • Examples of Homeland Security Research at Rutgers that Use Mathematics • Examples of Research Projects I am Involved in • One Example in Detail

8. OUTLINE • Examples of Homeland Security Research at Rutgers that Use Mathematics • Examples of Research Projects I am Involved in • One Example in Detail

9. TRANSPORTATION AND BORDER SECURITY Pattern recognition for machine-assisted baggage searches The Math: Linear algebra: “Pattern” defined as a vector Border security: decision support software The Math: Computer models

10. TRANSPORTATION AND BORDER SECURITY Statistical analysis of flight/aircraft inspections The Math: Statistics Port-of-entry inspection algorithms The Math: Statistics + “combinatorial optimization”

11. TRANSPORTATION AND BORDER SECURITY Vessel tracking for homeland defense The Math: geometry + calculus

12. COMMUNICATION SECURITY Resource-efficient security protocols for providing data confidentiality and authentication in cellular, ad hoc, and wireless local area networks The Math: Network Analysis Number theory: Cryptography

13. COMMUNICATION SECURITY Exploiting analogies between computer viruses and biological viruses The Math: Differential equations, dynamical systems

14. COMMUNICATION SECURITY Information privacy: Identity theft Privacy of health care data The Math: Number theory (cryptography), Statistics

15. FOOD AND WATER SUPPLY SECURITY Using economic weapons to protect against agroterrorism The Math: “Game Theory” Optimization

16. SURVEILLANCE/DETECTION Detecting a bioterrorist attack using “syndromic surveillance” The Math: Statistics, Data Mining, Discrete Math Anthrax bacillus

17. SURVEILLANCE/DETECTION Weapons detection and identification (dirty bombs, plastic explosives) The Math: Linear algebra, Statistics, “Data Mining” (computer science)

18. SURVEILLANCE/DETECTION Biometrics Face, gait, voice, iris recognition Non-verbal behavior detection (lying or telling the truth?) (applications to interrogation) The Math: Optimization, linear algebra, statistics

19. RESPONDING TO AN ATTACK Exposure/Toxicology Modeling dose received Rapid risk and exposure characterization The Math: Differential Equations, Probability

20. RESPONDING TO AN ATTACK Simulating evacuation of complex transportation facilities The Math: Computer simulation

21. RESPONDING TO AN ATTACK Emergency Communications Rapid networking at emergency locations Rapid “telecollaboration” The Math: discrete math, network analysis

22. OUTLINE • Examples of Homeland Security Research at Rutgers that Use Mathematics • Examples of Research Projects I am Involved in • One Example in Detail

23. The Bioterrorism Sensor Location Problem

24. Early warning is critical • This is a crucial factor underlying government’s plans to place networks of sensors/detectors to warn of a bioterrorist attack The BASIS System

25. Two Fundamental Problems • Sensor Location Problem (SLP): • Choose an appropriate mix of sensors • decide where to locate them for best protection and early warning

26. Two Fundamental Problems • Pattern Interpretation Problem (PIP): When sensors set off an alarm, help public health decision makers decide • Has an attack taken place? • What additional monitoring is needed? • What was its extent and location? • What is an appropriate response?

27. The Sensor Location Problem: Algorithmic Tools

28. Algorithmic Approaches I : Greedy Algorithms

29. Greedy Algorithms • Find the most important location first and locate a sensor there. • Find second-most important location. • Etc. • Builds on earlier work at Institute for Defense Analyses (Grotte, Platt) • “Steepest ascent approach.’’ • No guarantee of optimality. • In practice, gets pretty close to optimal solution.

30. Algorithmic Approaches II : Variants of Classic Facility Location Theory Methods

31. Location Theory • Where to locate facilities to best serve “users” • Often deal with a network with vertices, edges, and distances along edges • Users u1, u2, …, un located at vertices • One approach: locate the facility at vertex x chosen so that is minimized.

32. 1 a f 1 1 e b 1 1 c d 1 Location Theory 1’s represent distances along edges

33. 1 a f 1 1 e b 1 1 c d 1 u1 u2 u3 x=a: d(x,ui)=1+1+2=4 x=b: d(x,ui)=2+0+1=3 x=c: d(x,ui)=3+1+0=4 x=d: d(x,ui)=2+2+1=5 x=e: d(x,ui)=1+3+2=6 x=f: d(x,ui)=0+2+3=5 x=b is optimal

34. Algorithmic Approaches II : Variants of Classic Location Theory Methods: Complications • We don’t have a network with vertices and edges; we have points in a city • Sensors can only be at certain locations (size, weight, power source, hiding place) • We need to place more than one sensor • Instead of “users,” we have places where potential attacks take place. • Potential attacks take place with certain probabilities. • Wind, buildings, mountains, etc. add complications.

35. The Pattern Interpretation Problem

36. The Pattern Interpretation Problem • It will be up to the Decision Maker to decide how to respond to an alarm from the sensor network.

37. Approaching the PIP: Minimizing False Alarms

38. Approaching the PIP: Minimizing False Alarms • One approach: Redundancy. Require two or more sensors to make a detection before an alarm is considered confirmed • Require same sensor to register two alarms: Portal Shield requires two positives for the same agent during a specific time period.

39. Approaching the PIP: Minimizing False Alarms • Redundancy II: Place two or more sensors at or near the same location. Require two proximate sensors to give off an alarm before we consider it confirmed. • Redundancy drawbacks: cost, delay in confirming an alarm.

40. Approaching the PIP: Using Decision Rules • Existing sensors come with a sensitivity level specified and sound an alarm when the number of particles collected is sufficiently high – above threshold.

41. Approaching the PIP: Using Decision Rules • Let f(x) = number of particles collected at sensor x in the past 24 hours. Sound an alarm if f(x) > T. • Alternative decision rule: alarm if two sensors reach 90% of threshold, three reach 75% of threshold, etc. Alarm if: f(x) > T for some x, or if f(x1) > .9T and f(x2) > .9T for some x1,x2, or if f(x1) > .75T and f(x2) > .75T and f(x3) > .75T for some x1,x2,x3.

42. Monitoring Message Streams: Algorithmic Methods for Automatic Processing of Messages

43. Objective: Monitor huge communication streams, in particular, streams of textualized communication, to automatically detect pattern changes and "significant" events Motivation: monitoring email traffic, news, communiques, faxes, voice intercepts (with speech recogntion)

44. Technical Approaches: • Given stream of text in any language. • Decide whether "events" are present in the flow of messages. • Event: new topic or topic with unusual level of activity. • Initial Problem: Retrospectiveor“Supervised” Event Identification: Classification into pre-existing classes. Given example messages on events/topics of interest, algorithm detects instances in the stream.

45. More Complex Problem: Prospective Detection or “Unsupervised” Filtering • Classes change - new classes or change meaning • A difficult problem in statistics • Recent new C.S. approaches “Semi-supervised Learning”: • Algorithm suggests a possible new event/topic • Human analyst labels it; determines its significance

46. The Approach: “Bag of Words” • List all the words of interest that may arise in the messages being studied: w1, w2,…,wn • Bag of words vector b has k as the ith entry if word wi appears k times in the message. • Sometimes, use “bag of bits”: Vector of 0’s and 1’s; count 1 if word wi appears in the message, 0 otherwise.

47. The Approach: “Bag of Words” • Key idea: how close are two such vectors? • Known messages have been classified into different groups: group 1, group 2, … • A message comes in. Which group should we put it in? Or is it “new”? • You look at the bag of words vector associated with the incoming message and see if “fits” closely to typical vectors associated with a given group.

48. The Approach: “Bag of Words” • Your performance can improve over time. • You “learn” how to classify better. • Typically you do this “automatically” and try to program a machine to “learn” from past data.

49. “Bag of Words” Example Words: w1 = bomb, w2 = attack, w3 = strike w4 = train, w5 = plane, w6 = subway w7 = New York, w8 = Los Angeles, w9 = Madrid, w10 = Tokyo, w11 = London w12 = January, w13 = March

50. “Bag of Words” Message 1: Strike Madrid trains on March 1. Strike Tokyo subway on March 2. Strike New York trains on March 11. Bag of words b1 = (0,0,3,2,0,1,1,0,1,1,0,0,3) w1 = bomb, w2 = attack, w3 = strike w4 = train, w5 = plane, w6 = subway w7 = New York, w8 = Los Angeles, w9 = Madrid, w10 = Tokyo, w11 = London w12 = January, w13 = March