Identifying and Analyzing Patterns of Evasion HM Investigator: Shashi Shekhar (U Minnesota) Collaborators: Renee Laubscher, James Kang Kickoff Date: September 2013

Identifying and Analyzing Patterns of Evasion University of Minnesota PI: Shashi Shekhar Year of Grant: 2013 Technical Challenge Develop space-time aware methods to model evasive behavior by insurgents and other security targets. The behavior of security targets can be exploited to identify and provide intelligence about locations and schedules of target. Research Approach: We propose a method to distinguish between evasive and non-evasive behaving targets by quantifying the space-time entropy (predictability) of individuals’ movement. Also we propose a complementary algorithm which identifies “blackholes,” areas where no target movement is observed, despite predictions that such movement would occur. A list of targets found to have patterns of evasion are generated. Analyzing these evasion patterns will expose potential sighting and interception places and time-slots of targets on the list. Accomplishments/Results Develop a conceptual model to represent the spatio-temporal predictability of targets’ movement across a space. Create a conceptual model defining classes of blackhole events which will help estimate the expected continuity of observation through denied areas. Develop a conceptual model for hypothesized movement generation based on trajectory fragments. Develop a conceptual model for Denial and Deception Aware Return Periods. Potential Research Payoff Describe what impact successful research will deliver. Example: Creation of models for identifying evasive patterns. Success of predicting target movements and schedules. Building of tools embodying the new results. Collaborations and Teaming Mark Abrams, a consultant for the National Reconnaissance Office with experience in GPS deprived areas. Prof. May Yuan at the University of Oklahoma working on movement pattern analysis BI Incorporated, he makers of ankle-bracket GPS tracking devices for felons out on parole, to utilize the anonymized GPS-track datasets of offenders for research purposes. Future Efforts Explore the tools and test bed to handle new blackhole patterns, more advanced movement hypothesis and temporally correlated return periods. Contact Info PI: Shashi ShekharTM: James M. Kang Transition Opportunities Extend capabilities of Oracle Spatial to facilitate a complete workflow dataset from dataset input to actionable information.

Identifying and Analyzing Patterns of Evasion Identify the behavior of Insurgents and Security Targets by using location data. By identifying these behaviors, actionable intelligence about locations and schedules of target individuals can be provided.

Objectives Develop space-time aware methods for modeling patterns of evasive behavior by insurgents and security targets: Distinguish between evasive and non-evasive behaving targets by quantifying space-time entropy of individual’s movement. Identify Blackhole Regions where no target movement is observed despite predictions. Generate hypothesis about target location and travel routes by using trajectory fragments. Model Denial and Deception Aware Return Periods to estimate a target’s schedule to aid in interception and surveillance.

Anticipated Results Mathematical Models Develop a graph based spatio-temporal data model to represent return periods. Computer Algorithms Design new scalable data mining algorithms to find; Space-Time Entropy Blackholes Theory-Based Movement Predictions Return Periods Data Analysis Methods Develop new interest measures to quantify the proposed patterns of life. Analytical Tools Develop new software and extend capabilities of existing software to facilitate the workflow from dataset to actionable information.

Applicability “Predictability kills” In Operation Areas, soldiers are advised to avoid geo-tagging, which can reveal their location to adversaries. This advice is kept in mind by the terrorists as well. In operation areas like Afghanistan, non-evasive tribal groups operate (e.g., villagers, nomads, traders) with different patterns-of- life, or different movement patterns, than evasive terrorists.

Approach Two Phases: Identify Evasion Patterns Distinguish between evasive and non-evasive behaving targets by quantifying the space-time entropy Identify blackholes, where no target movement observed despite predictions Analyze Evasion Patterns Movement hypothesis for predicting movement in denied areas Model return periods to quantify and identify anomalous visits in target movement data. By identifying these evasive behaviors, actionable intelligence about locations and schedules of target individuals can be provided.

Science 1-4 Space-Time Entropy Discrimination Identify target groups based on historical movement patterns by using entropy measures. Shannon’s Diversity Index (SDI) Commonly used measure of entropy. Quantify predictability. SDI does not distinguish between clustered and unclustered distributions(SDI may return the same value even though the data is more concentrated). SDI is not independent of space partitioning (Depending on the partition size, SDI score may change even underlying data does not). Develop a conceptual model (which addresses the limitations of SDI) to represent the spatio-temporal predictability of target’s movement across space.

Science 2/4 Blackhole and Patterns of Evasion Detection Blackhole: Areas where no target movement is observed although target movements are predicted Identify significant mismatches between observations (expected vs. observed). Differentiate population and target evasion. Extrapolate Potential Path

Science 3/4 Theory Based Movement Hypothesis Generation Traditional Data Mining Algorithms can not be used inside blackholes due to lack of observations. Predict behavior inside blackhole. Use transportation networks Points of interest Hypothesize routes and locations based on the recorded observations. We know starting and ending points We know transportation networks We predict the most likely routes, main corridors and key locations that may be used.

Science 4/4 Return Period in Movement Datasets Model routine activities of people Easier data mining on movement datasets Easier highlighting of anomalous activities Develop a conceptual model for denial-and- deception aware return periods to quantify and identify anomalous places and visits. Challenges; Space and Time Partitioning Statistical Identification Measures for Anomalous Places and Visits An efficient algorithm to deal with spatial big data. Once in 30 days Routine Activities

Conclusion Identifying the behavior of terrorists can exploit their intentions. Insurgents and Security Targets use Denial, Deception and Evasion Techniques to mask their movement. These techniques may cause wrong operational and tactical decisions. By identifying these evasive behaviors actionable intelligence about locations and schedules of target individuals can be provided.