Actionable Intelligence: Continuous Discovery of Evidence, Hypotheses, and Arguments from Masses of Data A computational theory, methodology and system Dr. G. Tecuci, Dr. D.A. Schum, Dr. M. Boicu, Dr. D. Marcu Learning Agents Center The Volgenau School of Engineering George Mason University

Copyright 2013 Learning Agents Center, George Mason University M u l t i - I N T f u s i o n Explanatory Hypotheses Observations Likeliness of Hypotheses What is the evidence-based likeliness of each hypothesis? What evidence is entailed by each hypothesis? What hypotheses would explain these observations? Hypotheses in search of evidence Hypotheses in search of evidence Evidence in search of hypotheses Evidence in search of hypotheses New Evidence H y p o t h e s i s - d r i v e n c o l l e c t i o n Evidentiary testing of hypotheses Evidentiary testing of hypotheses Big Data Computational Theory

Big Data Discovery of Hypotheses Copyright 2013 Learning Agents Center, George Mason University Evidence in search of hypotheses Evidence in search of hypotheses road work not road work road block E 1 : Evidence of road work at Al Batha junction at 1:17am ambush preparation ambush threat road repair traffic disruption traffic deviation deceptive threat What hypotheses would explain this observation?

Discovery of Evidence road block ambush preparation Ambush threat at Al Batha highway junction around 1:17am. & Hypotheses in search of evidence Hypotheses in search of evidence Copyright 2013 Learning Agents Center, George Mason University good location route used by U.S. forces ambush cover Search for evidence that the Al Batha highway junction is on a route used by the U.S. forces. Search for evidence that there is ambush cover near the Al Batha highway junction. people move to cover deployment of terrorists people descended from vehicle vehicle departed from terrorist facility Search for evidence that people descended at the Al Batha highway junction from a vehicle short before 1:17am. Search for evidence that the vehicle that drove the people to the Al Batha highway junction short before 1:17am, departed from a terrorist facility. & & & Assuming that this hypothesis is true, what other things should be observable?

Discovery of Arguments road block ambush preparation ambush threat & Copyright 2013 Learning Agents Center, George Mason University good location route used ambush cover E 2 : AFC confirms route E 3 : brushes, trees, and ruins people move to cover deployment of terrorists people descended from vehicle vehicle departed from terrorist facility E 4 : People get off pickup truck E 5 : Pickup truck leaves abandoned rice farm & & & Evidentiary testing of hypotheses Evidentiary testing of hypotheses total belief very strong belief strong belief very strong belief strong belief We have strong belief that there is an ambush threat to the U.S. forces at the Al Batha junction. How strong is our belief that this evidence is true? Believability How strong is our belief in this link? Relevance How strong is our belief that this hypothesis is true? Inferential force total belief

(Cyber) Insider Threat Copyright 2013 Learning Agents Center, George Mason University Hypotheses in search of evidence Hypotheses in search of evidence Evidence in search of hypotheses Evidence in search of hypotheses Evidentiary testing of hypotheses Evidentiary testing of hypotheses Observation of Actions New Observable Actions Possible Insider Missions Likeliness of Insider Missions Computational Theory

Forensics Copyright 2013 Learning Agents Center, George Mason University Hypotheses in search of evidence Hypotheses in search of evidence Evidence in search of hypotheses Evidence in search of hypotheses Evidentiary testing of hypotheses Evidentiary testing of hypotheses Observations at the site of incident New potential evidence Possible causes Likeliness of causes Computational Theory

Medicine Copyright 2013 Learning Agents Center, George Mason University Hypotheses in search of evidence Hypotheses in search of evidence Evidence in search of hypotheses Evidence in search of hypotheses Evidentiary testing of hypotheses Evidentiary testing of hypotheses Patient’s complaints New tests Possible Illnesses Likeliness of Illnesses Computational Theory

Law Copyright 2013 Learning Agents Center, George Mason University Hypotheses in search of evidence Hypotheses in search of evidence Evidence in search of hypotheses Evidence in search of hypotheses Evidentiary testing of hypotheses Evidentiary testing of hypotheses Observations during fact investigation New potential evidence Possible charges or complaints Likeliness of charges Computational Theory

Natural Sciences Copyright 2013 Learning Agents Center, George Mason University Hypotheses in search of evidence Hypotheses in search of evidence Evidence in search of hypotheses Evidence in search of hypotheses Evidentiary testing of hypotheses Evidentiary testing of hypotheses Observations of Events in Nature New Observable Phenomena Possible Hypotheses or Explanations Likeliness of New or Revised Theories Computational Theory