1. Intelligent Site Selection Models for Asymmetric Threat Prediction and Decision Making Michael D. Porter porter@stat.ncsu.edu North Carolina State University Donald E. Brown and C. Donald Robinson brown@virginia.edu cdr2e@virginia.edu University of Virginia TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A A A A

2. 2/40 Intelligent Site Selection Time T 1 T 2 T 3 T 4 Space S1S1 S3S3 S4S4 S2S2 Decision = {(T 1,S 1 ),(T 2,S 2 ),(T 3,S 3 ), (T 4,S 4 )}

3. 3/40 Intelligent Site Selection Definition: An Intelligent Site Selection process is one in which a group of actors judiciously select the locations and times to initiate events according to their preferences or perceived utility of those locations and times. Just observing the points in time and space isn’t enough, because these don’t take into account the actors’ preferences So we introduce attribute space (N-Dimensional) g 1 : Dis_Hway g 2 : Darkness g 3 : Avg. Income g 4 : Population g N : Dis_Home......

4. 4/40 Finding Patterns 1 Patterns emerge in Attribute Space Liu and Brown (2004) Int. J. Of Forecasting

5. 5/40 Terrorist Threat Prediction Problem Inputs –series of incidents or attacks of the same type in an area of interest and over a fixed time interval, –(optional) doctrine or subjective behavioral descriptions of enemy operations –Formal description of the named areas of interest and friendly elements given by values of attributes or features that are known or believed to be relevant to the occurrence of the attacks or incidents Output: –The likelihood that another attack or incident occurs at specified locations within the named area of interest and within a specified time range

6. 6/40 Attribute Set To successfully model the terrorist attacks, we should attempt to model their decision making process or preferences for attack locations Thus we include covariates that are thought to influence the terrorist site selection process (or that are associated (correlated) with such features) in our models Since we usually don’t know the terrorist’s preferences we must discover (data mining) these from previous attack locations –Observe past attack locations and associated feature values for that location Examples of possible features –Census (Socio-economic) –Proximity (Distance to landmarks or structures) –Military or Police Patrols (times and locations)

7. 7/40 Spatial Choice Models Spatial Choice Models Fotheringham (1983) Env+Plan A, Xue and Brown (2003) IEEE SMC-C Adapt theory of random utility theory to terrorist spatial decision making Alternatives are spatial locations The number of alternatives is very large –Perhaps infinite in reality Each alternative has two components –Spatial component: fixed spatial locations –Attribute component: spatial alternatives ’ characteristics

8. 8/40 Choice Picked Alternatives to Evaluate C d Hierarchical Spatial Choice Alternatives – {a i } Decision Maker d Xue, Y. F., Brown, D. E., (2003) IEEE SMC-C Choice Set

9. 9/40 Analysis of Terrorists ’ Decision Process A terrorist ’ s choice set is unknown to analysts We can only estimate the probability for each alternative to be pre-evaluated P(a i  C d ) –Here we will use our spatial information The attribute information is used to estimate the utility of each location This leads us to adopt –Fotheringham ’ s Competing Destinations Model –Aka: Spatial Hierarchy Model

10. 10/40 Spatial Hierarchy Model Begin with the assumption that all actors have same preferences and same choice set C The probability that an alternative a i is pre- evaluated by any actor is P(a i  C) Based on these assumptions, the probability location i is selected is given by where, V(s i )-Utility of location s i for all actors

11. 11/40 Spatial Hierarchy Model A function of the attributes/covariates of location s i A function of spatial location only

12. 12/40 Clustering Covariates Xue, Y. F., Brown, D. E., (2003) IEEE SMC-C

13. 13/40 Estimation of Model Parameters Not spatial smoothing, more like random thinning in point processes More generally, use Random Forest for estimating utility component

14. 14/40 Sample Realization

15. 15/40 Examples from Iraq Blue lines are contours of the predicted intensity of terrorist attacks and red dots are the actual attacks

16. 16/40 Simulation of Intelligent Site Selection Processes for Decision Making

17. 17/40 What is the problem? Explaining locations and times for future terrorist events is a difficult yet useful problem to solve What do they think? Why they choose their targets? How can we impede their operations?

18. 18/40 What is the point? To provide a means to test the effect of differing levels of intelligence, prediction, and action decisions –Should we get better predictive methods –Should we get better intelligence –Should we make different decisions How do these influence the successfulness of terrorist events?

19. 19/40 The Scenario – Red Force Red force initiates incidents Remotely or autonomously detonated explosive devices Active until detonated or decay The target is Blue force vehicles

20. 20/40 The Scenario – Blue Force Blue force collects intelligence, predicts red force actions, and decides which route to send convoy Blue force has limited ability to clear any active explosives in some small region prior to convoy deployment Convoys will travel on the roads regardless of threat The model could be applied to other contexts as well (suicide bombings, mortar attacks, etc.)

21. 21/40 The Approach Terrorists do not act independently of their targets’ actions Often the targets (like the U.S. Military) also react to the attacks The dynamics of this complex system can be modeled and simulated

22. 22/40 The Systems Model INTELLIGENCE PREDICTION ACTION

23. 23/40 The Decision – Which Route? 1 2 3

24. 24/40 The Complications – IED’s

25. 25/40 Some Help - Mitigations

26. 26/40 The Interactions – Blue vs. Red Before we get to the interactions, a brief introduction to point processes …

27. 27/40 Point Process Def: A point process N is a Z + valued random measure –N(B) = # events in the set B A Poisson point process satisfies two conditions: –Whenever B 1, …, B n are disjoint, the random variables N(B 1 ), …, N(B n ) are independent –For every B and k=0,1,… P(N(B)=k)=exp{-  (B)}  (B) k / k! The mean measure  is such that E[N(B)]=  (B)= s B (b) db The non-negative intensity function thus satisfies  (db)= (b)db

28. 28/40 Point Process Models of ISS For the terrorist scenario, we assume a dynamic point process model –The intensity is random –It depends on the realizations of other stochastic processes –Conditionally a Poisson point process Results in a form of Spatial Hierarchy Model

29. 29/40 The Red Force Model Utility component: exp{V(s i )} Evaluation probability: P(s 2 C(t)) Attraction: C S ( ² ) ¸ 1 Repulsion: 0 · C M ( ² ) · 1 Inhibition: C A ( ² ) 2 {0,1}

30. 30/40 Dynamics of the Interactions

31. 31/40 Active Events

32. 32/40 Interaction with Active Events

33. 33/40 The Blue Force Model The Blue force only has knowledge of successful attacks, N S Mitigated attacks and currently active devices are unknown Blue force will use Spatial Hierarchy Models models to infer the locations of active devices Generalized Linear Model involving environmental covariates G 4, G 7, G 10 fit with Poisson regression Spatial KDE with bandwidth chosen with cross-validation The model is refit at each time period based on N s Delay of  in the information on N S

34. 34/40 Mitigation or Clearing The Blue force mitigation efforts are constrained Can only search 3 subregions per time interval Each region is about.5% of the total region Regions are selected according to which have the highest estimated intensity All active devices in a mitigated region are disarmed The Blue force does not take into account (i.e. have the knowledge) whether or not there were disarmed devices

35. 35/40 Route Selection Strategy 1: Random Strategy 2: Take route with lowest cumulative estimated intensity Strategy 3: Choose route with fewest successful attacks in last w days (e.g. w=7)

36. 36/40 Sample Realization

37. 37/40 Movie of Complex Dynamics

38. 38/40 Modifying Parameters INTELLIGENCE –Gathering locations (and attributes) of successful events »Effects of delay,  –Other insights into terrorist decision making PREDICTIONS – Spatial Hierarchy Models »Linear in covariates (for utility) »KDE (for evaluation probabilities) DECISIONS – Predictions used for mitigations (separate from convoy routing) –3 Strategies for routing »Random »Lowest predictions (after E[Mitig] effects) »Adaptive (route with least successes in past w days)

39. 39/40 Testing the Routing Strategies Mean of cumulative sum of successful attacks – with 95% intervals ----- Strategy 1 (Random) ------ Strategy 2 (Predictions) ------ Strategy 3 (Fewest Attacks)

40. 40/40 Concluding Thoughts We used Spatial Choice Models to represent terrorist decision making Showed connection with dynamic point process models Constructed systems model (and simulation) of the complex interactions between Blue Force and Red Force Now we can adjust model parameters and observe the emergent behavior of agents acting within this framework

41. Michael D. Porter porter@stat.ncsu.edu Department of Statistics North Carolina State University Intelligent Site Selection Models for Asymmetric Threat Prediction and Decision Making