1. Detecting and Tracking Hostile Plans in the Hats World

2. Detection and Tracking of Plans Goals define plans, plans are then put into action which result in observations Given a stream of observations, and some behavioral model of the agent that generates those observations – What are their most likely intentions of the agent? – What kind of plan is he pursuing? Plan recognition: The problem of inferring an agent’s hidden state of plans or intentions based on their observable actions Actions Plans Observations Intentions (Goals)

3. What is the Hats Simulator? Plan recognition in a virtual domain A simulation of a society in a box with about 100,000 agents (hats) that engage in individual and collective activities. Most of the agents are benign, very few are known adversaries (terrorists) and some are covert adversaries. Hats have capabilities which are a set of elementary attributes that can be traded with other hats at meetings. Beacons are special locations or landmarks that are characterized by their vulnerabilities. When a group of adversarial agents (task-force) has the capabilities that match the beacon’s vulnerabilities the beacon is destroyed.

4. What is the Hats Simulator? Each hat belongs to one or more organizations, which are not known and must be inferred from meetings. – Each adversarial hat belongs to at least one adversarial organization. – Each benign hat belongs to at least one benign organization and no adversarial organizations. When a meeting is planned, the list of participants is drawn from the set of hats belonging to the same organization. – A meeting planned by an adversarial organization will only consist of adversarial agents. – A meeting planned by a benign organization will consist of both benign and adversarial agents.

5. Hierarchical Model for Hats The planner chooses an organization to carry out the attack and the beacon A task force is then chosen The planner sets up an elaborate sequence of meetings for each task force member to acquire a capability The generative planner chooses an organization to carry out the attack and the beacon A task force is then chosen The planner sets up an elaborate sequence of meetings for each task force member to acquire a capability

6. The Goals of Hats To find and neutralize the adversarial task force behind a beacon attack given the record of meetings between hats

7. Bayesian Framework The state of the i-th agent at time t is characterized as – Terrorist indicator: – Intention to acquire a capability: – Actual capability carried: The joint state of the system is given by

8. Hidden Markov Model Transition Matrix: – The probability that the system will be in state given that it was in the state and produced an observation Emission Model: – The probability of seeing a particular observation in a particular state

9. Bayesian Filtering Filtering distribution (joint distribution over the hidden state at time t and observations up to time t): Recursive update formula: – When a transition matrix and emission model are specified this equation can be used for state estimation

10. Bayesian Guilt by Association Model Estimates group membership of agents based on observed meetings Meetings only contain two agents State of the system: Probability of a meeting between the same type of agents: Probability of a meeting between agents of different types: Kronecker’s -function: if

11. Bayesian Guilt by Association Model Emission model: Transition matrix: Recursive update formula: