1. Predictive Analysis of Massive Streaming Graphs
David A. Bader (PI)
Georgia Institute of Technology
Atlanta, Georgia
Problem Statement and Objective:
Develop methods using streaming graph framework (STINGER) to support update of quantitatively predictive metrics
Move beyond current methods investigating historical data and building models on what has already been seen
Problem Focus 1: Provide unclassified pre-event security reports to local and state law enforcement based upon streaming analysis of open source and public data sets. Working with DHS, NYPD, and FBI, focus on public events (e.g. concerts, sporting events) and financial district of New York City.
Problem Focus 2: Provide Coast Guard with additional cyber-analytic tools based upon streaming graph analysis for identifying, tracking, and giving attribution to, cyber-threats.
Methodology and Data Requirements:
Add capabilities to STINGER to be able to use graph-based analysis and quantitatively measured results across a range of applications
Per-vertex graph metrics, machine learning, complex analytics (i.e. community membership)
In Problem Focus 1, we plan that all data will be open source and publicly available (e.g. public Tweets)
In Problem Focus 2, we plan that data will be sensitive network traffic and housed with Coast Guard. We will use synthetic and surrogate data sets for development and testing, and transition the cyber-analytic codes to the component.
Impact Statement and Relevance to DHS
Roles and Responsibilities:
STINGER metrics will be able to predict events and correct for what actually occurs in a security context
STINGER will support faster than real-time prediction with high-performance computing methods for real-world problems
PI Bader plans to work with co-investigators Jason Riedy, Umit Catalyurek, and Polo Chau (Georgia Tech) and Megan Cream (Spelman College)
Multiple Engagements with DHS components:
Dr. Kay Mereish: DHS I&A, NYPD, FBI, DHS Nebraska Ave Compound
LCDR Ryan Lamb: Coast Guard
Laura Laybourn: DHS NPPD
Timeline and Deliverables:
30 days: Initial task work plan submitted (by October 20)
60 days: Firm engagement with specific components outlined here
90 days: Report on specific engagement with components, articulation of problem, methodology and data requirements, and transition plans
Year 1: Reports evaluating existing analytics and new methods using per-vertex metrics
Year 2: Reports evaluating new methods for predictive modeling, documentation to show development and plication of these methods using STINGER