1. Open Sources -- Intelligence The GoodThe Bad The Ugly Challenges

2. CSCE 727 - Farkas2 Reading The Good: Rasmus Rosenqvist Petersen and Uffe Kock Wiil. 2011. Hypertext structures for investigative teams. In Proceedings of the 22nd ACM conference on Hypertext and hypermedia (HT '11). ACM, New York, NY, USA, 123-132. The Bad: C. Farkas and A. Stoica, “Correlated Data Inference in Ontology Guided XML Security Engine,” Proc. of IFIP 17th WG 11.3 working conference on Data and Application Security, 2003. The Challenges: Joseph V. Treglia and Joon S. Park. 2009. Towards trusted intelligence information sharing. In Proceedings of the ACM SIGKDD Workshop on CyberSecurity and Intelligence Informatics (CSI-KDD '09)

3. The Good: Support for Data Integration and Analysis CSCE 727 - Farkas3

4. Intelligence Analysis Law Enforcement Investigations Investigative teams: – Collect, process, analyze information related to a specific target – Disseminate findings Need automated tool to support activities CSCE 727 - Farkas4

5. Application Areas Policing – Reactive nature – Incident-driven response Counterterrorism – National security – Proactive – Covert operations Investigative journalism – “Wrong doing” of organizations, influential individuals, etc. CSCE 727 - Farkas5

6. Knowledge Management Acquisition: collect and process data – Traditional methods – Artificial Intelligence: Machine Learning Synthesis: create model of the target Sense making: extract useful information Disseminate findings: appropriate representation for the appropriate audiance CSCE 727 - Farkas6

7. Case Study Kidnapping of Daniel Pearl, Wall Street Journal bureau chief in 2002 The Perl Project, Georgetown Univeristy, http://pearlproject.georgetown.edu/press_pe arlrelease.html http://pearlproject.georgetown.edu/press_pe arlrelease.html Complex mapping of people, situations, locations, etc. to find kidnappers CSCE 727 - Farkas7

8. Technology Involved in Visualizing Information White Board – link chart – Useful to model entities, their attributes, and relationships – Complex data types (text, images, symbols, etc.) – Becomes complex – Difficult to share CSCE 727 - Farkas8

9. Computer Support – Functionality Acquisition: import, drag-drop, cut/past Synthesis: add/modify/delete entities, relations, re- structure, group, collapse/expand, brainstorming Sense-making: retracing, creating hypothesis and alternative interpretations, prediction, exploring perspectives, decision making Dissemination: storytelling, report generation CSCE 727 - Farkas9

10. Hypertext Structuring Mechanism Associative structures – extended to handle composites (supports synthesis) Spatial structure – handle emerging and dynamic structures over time Taxonomy structures – supports classification tasks Issue-based structures – support argumentation and reasoning Annotation and metadata structure – add semantics CSCE 727 - Farkas10

11. Past CSCE 727 - Farkas11 Copyright: Rasmus Rosenqvist Petersen and Uffe Kock Wiil. 2011. Hypertext structures for investigative teams. In Proceedings of the 22nd ACM conference on Hypertext and hypermedia (HT '11). ACM, New York, NY, USA, 123-132.

12. CSCE 727 - Farkas12 Copyright: Rasmus Rosenqvist Petersen and Uffe Kock Wiil. 2011. Hypertext structures for investigative teams. In Proceedings of the 22nd ACM conference on Hypertext and hypermedia (HT '11). ACM, New York, NY, USA, 123-132. With the CrimeFighter Investigator

13. What Would be Better? Automated Data Collection Semantic-based Data Integration Intelligent Data Analysis Assurance of results CSCE 727 - Farkas13

14. CSCE 727 - Farkas14 The Bad: Unauthorized Disclosure

15. Computer Science and Engineering 15 The Bad: A. Stoica and C. Farkas, “Ontology guided Security Engine,” Journal of Intelligent Information Systems, 23(3): 209-223, 2004. (http://www.cse.sc.edu/~farkas/publications /j5.pdf )http://www.cse.sc.edu/~farkas/publications /j5.pdf

16. Computer Science and Engineering 16 Semantic Web Autonomous agents Machine understandable in data semantics Computers exchange information transparently on behalf of the user Open, dynamic environment Large number of users, agents, resources Semantic tools

17. Computer Science and Engineering 17 IS INFERENCING ON THE SEMANTIC WEB CREATES A SECURITY PROBLEM?

18. Computer Science and Engineering 18 Motivation 1: Simulation Exploitation Using Open Source Information Objective: US Government would like to share a limited simulation software with friendly countries. – Can this software be used to explore the capabilities of US weaponry? – Can sufficient information be found from public sources to create such simulation? Findings: – Most of the information needed for the simulation was available on the Internet. – Needed human aid to combine available information

19. Computer Science and Engineering 19 Motivation 2: Homeland Security Objective: Hide location of water reservoirs supplying military bases to limit terrorist activities. – Can location of a reservoir of a military base be found from public data on the Internet? Findings: – Location of a military base and water reservoirs of that region are available on the Web. – Needed human aid to combine available information

20. Computer Science and Engineering 20 The Inference Problem General Purpose Database: Non-confidential data + Metadata  Undesired Inferences Semantic Web: Non-confidential data + Metadata + Computational Power + Connectivity  Undesired Inferences

21. Computer Science and Engineering 21 The Inference Problem Security violation = disallowed data can be deduced from public data Given a set of confidential information, large amount of public data, and semantic relationship of public data. Is it possible to deduce the confidential information from the semantically enhanced public data?

22. Computer Science and Engineering 22 Ontology Guided XML Security Engine (Oxegin) Organizational Data Confidential Ontology Correlated Data Inf. Replicated Data Inf. Public User Oxegin Web Data Public

23. Computer Science and Engineering 23 Correlated Data Inference Finds confidential information from public data (sensitive associations) Inference guidance: –Ontology concept hierarchy –Structural similarity of public data Features of similarity –Levels of abstraction for each node –Distance of associated nodes from association root Similarity of the distances Length of the distance –Similarity of sub-trees originating from correlated nodes

24. Computer Science and Engineering 24 Associated Nodes Association similarity – Distance of each node from the association root – Difference of the distance of the nodes from the association root – Similarity of the sub-trees originating at nodes Example: Air show address fort XML document: Inference Association Graph: address fort Public Public, AC

25. Computer Science and Engineering 25 Concept Generalization Ontology concept hierarchy – Normalized weight of concepts (more specific concept, higher weight) – Concept abstraction level – Range of allowed abstractions Example: Abstraction LevelWeightNormalized weight Object[].OAL=0WGT=1 OP=1/50 waterSource :: ObjectOAL=1WGT=15OP=15/50 basin :: waterSourceOAL=2WGT=1 OP=1/50 place :: ObjectOAL=1WGT=15OP=15/50 district :: placeOAL=2WGT=1 OP=1/50 address :: placeOAL=2WGT=1 OP=15/50 base :: ObjectOAL=1WGT=15OP=15/50 fort :: baseOAL=2WGT=1 OP=1/50

26. Computer Science and Engineering 26 Correlated Inference address fort Public Water source base Confidential district basin Public Object[]. waterSource :: Object basin :: waterSource place :: Object district :: place address :: place base :: Object fort :: base ?

27. Computer Science and Engineering 27 Correlated Inference (cont.) address fort Public district basin Public Object[]. waterSource :: Object basin :: waterSource place :: Object district :: place address :: place base :: Object fort :: base

28. Computer Science and Engineering 28 Correlated Inference (cont.) address fort Public district basin Public Object[]. waterSource :: Object basin :: waterSource place :: Object district :: place address :: place base :: Object fort :: base place base Water Source Water source base Confidential

29. Computer Science and Engineering 29 Inference Removal Relational databases – Database design time: redesign database – Query processing time: modify/refuse answer Web inferences – Problems: Cannot redesign public data outside of protection domain Cannot modify/refuse answer to already published web page – Possible solutions: Withhold data: do not publish any public data, that may lead to inferences. Publish confusing data: publish data that creates confusion in contrast with existing publicly available data

30. The Ugly Challenges Technology Support CSCE 727 - Farkas30

31. Technical Influences – Interoperability Heterogenenous data – Unstructured data, semi-structured data, structured data Representation of data semantics – Schema languages, taxonomies, ontologies Policy compliance – Policy languages, expressive power, implementation CSCE 727 - Farkas31

32. Technical Influences – Availability Survivability – Response – Critical environments Open vs. protected Redundancy CSCE 727 - Farkas32

33. Technical Influences – Control Control, monitor, and manage all usage Track dissemination of information Workflow management – Policy, trust, efficiency, local vs. global properties CSCE 727 - Farkas33

34. Social Influences Trust – People and agencies Shadow network – Conflict of interest – Self-interest Criticality – The greater the threat the greater the likelihood of information sharing CSCE 727 - Farkas34

35. Legal Influences Policy Conflict and Competition – Agency policy – Agencies may compete for the same resources – need to maintain advantage Governance – No universal policy on information sharing (federal, state, local, tribal, etc.) – International law CSCE 727 - Farkas35

36. CSCE 727 - Farkas36 Next class: Propaganda and PsyopsNext class: Propaganda and Psyops