Predictive Analysis of Massive Streaming Graphs David A. Bader (PI) Georgia Institute of Technology Atlanta, Georgia Problem Statement and Objective: Develop methods using streaming graph framework (STINGER) to support update of quantitatively predictive metrics Move beyond current methods investigating historical data and building models on what has already been seen Problem Focus 1: Provide unclassified pre-event security reports to local and state law enforcement based upon streaming analysis of open source and public data sets. Working with DHS, NYPD, and FBI, focus on public events (e.g. concerts, sporting events) and financial district of New York City. Problem Focus 2: Provide Coast Guard with additional cyber-analytic tools based upon streaming graph analysis for identifying, tracking, and giving attribution to, cyber-threats. Methodology and Data Requirements: Add capabilities to STINGER to be able to use graph-based analysis and quantitatively measured results across a range of applications Per-vertex graph metrics, machine learning, complex analytics (i.e. community membership) In Problem Focus 1, we plan that all data will be open source and publicly available (e.g. public Tweets) In Problem Focus 2, we plan that data will be sensitive network traffic and housed with Coast Guard. We will use synthetic and surrogate data sets for development and testing, and transition the cyber-analytic codes to the component. Impact Statement and Relevance to DHS Roles and Responsibilities: STINGER metrics will be able to predict events and correct for what actually occurs in a security context STINGER will support faster than real-time prediction with high-performance computing methods for real-world problems PI Bader plans to work with co-investigators Jason Riedy, Umit Catalyurek, and Polo Chau (Georgia Tech) and Megan Cream (Spelman College) Multiple Engagements with DHS components: Dr. Kay Mereish: DHS I&A, NYPD, FBI, DHS Nebraska Ave Compound LCDR Ryan Lamb: Coast Guard Laura Laybourn: DHS NPPD Timeline and Deliverables: 30 days: Initial task work plan submitted (by October 20) 60 days: Firm engagement with specific components outlined here 90 days: Report on specific engagement with components, articulation of problem, methodology and data requirements, and transition plans Year 1: Reports evaluating existing analytics and new methods using per-vertex metrics Year 2: Reports evaluating new methods for predictive modeling, documentation to show development and plication of these methods using STINGER