Kathleen M. Carley, Michael K. Martin, Carnegie Mellon University John P. Hancock

1. DNA of DAREDynamic Network Analysis Applied to Experiments from the Decision Architectures Research Environment Kathleen M. Carley, Michael K. Martin, Carnegie Mellon University John P. Hancock ArtisTech, Inc.

2. Challenge • Apply DNA to simulated battlefield data being generated in the DARE to produce tactically relevant insight • Apply DNA techniques to complex problems where good solutions were lacking • Adversarial communications data • Distributed embedded Intelligent Agent messaging • Working toward real-time Monitoring and Prediction • Support Army and DoD requirements in Intelligence and Net Centric Warfare problems

3. Two Case Studies • Adversarial reasoning • intercepts of simulated communications among humans • Movement in the perimeter • Automated control of Persistent Coordinated Video Surveillance (PCVS) system • simulated communications among software control agents & robots

4. Data Sources • ADA CTA Decision Architecture Research Environment (DARE) • Persistent Coordinated Video Surveillance (PCVS) experiments • Experimentally exploring the impact of automated reasoning on PCVS AlgoLink Entity/Link Simulation • User specifies organizations (types, sizes), locations, duration, frequency… • Provides a “Ground Truth” file • Designed to test intelligence tools

5. DNA Tools Assess Change, What if Analysis – Multi-agent DNA Analyze – Statistics SNA, DNA, Link Analysis Build Network -Text Mining DyNetML Meta-Network Unified Database(s)

6. Case Study 1 • AlgoLink output delivered as XML file • Log of simulated comms intercepts • Each record identified sender, receiver, comm time, comm duration, operational relevance of content, lat/lon of sender & receiver • DNA strategy = overview + zoom • Engaged subset of *ORA capabilities • Geospatial visualization, key player ID, change detection analysis, & correlation of standard and geospatial visualization. • Did not use DNA text or simulation capabilities

7. Where is the Action? Suspicious entities are fleeing Adelphi area over time course of scenario

8. How are they Organized? FOG (Fuzzy Group Clustering) shows suspicious entities organized into 5 groups w/shared members. ════════ Interstitial members are likely to contain coordinators & leaders.

9. Who are the Key Players? Drilling down… *ORA’s Key Entity Report shows 3 agents critical to operations. ════════ Narrow our focus from set of interstitial members to small group of leaders.

10. When is the Action? A planning-execution phase-shift… ════════ Organizational behavior changed in Period 2; radical difference by Period 3 Change Detection Analysis ════════ Operation most likely in Period 3…Hidden, distributed structure coordinated into centrally controlled unit at Period 3; Hiding again by Period 4 3 key players’ behavior changes at Period 3. ════════ Agent 286 engaged in extensive coordination at Period 2. Reigns of control passed to Agent 652 at Period 4

11. What Happened? Yellow = Location Red = Agent Bold Red = Key Player Period 3: Operation ════════ Large cluster of suspicious entities in Adelphi area (with 286) ════════ Cluster in apparent staging area (w/97) ════════ Cluster associated with the runner, 652

12. Who was Where, When? *ORA Trails Viz ════════ Time progresses down y-axis ════════ Geographic regions form lanes on x-axis ════════ 3 key players color-coded Period 4: Initial Surveillance ════════ Key players never in same place at same time ════════ Agents 286 & 97 (cyan & yellow) move about in their one region ════════ Agent 652 (green) moving through many regions

13. Reasonable COAs Purple = Location Red = Agent Period 6: End of Data Stream ════════ COA 1: Scour Adelphi for bomb, IED, etc. planted during ops in Period 3 ════════ COA 2: Go after dispersed suspicious entities (286 may be an easy target, but the location where 97 is hiding will yield more suspicious entities)

14. Case Study 2: Scenario ARTEMIS-PCVS System ════════ Tasking Agents control robotic surveillance assets in 1 of 4 quadrants to identify entities moving within perimeter of Blue Force compound. ════════ Scenario starts with short period of quiescence, followed by inject of many moving targets that cross Tasking Agent AORs.

15. Case Study 2: Analysis • Output from ARTEMIS-PCVS system delivered as XML file • Log of simulated communications among software agents & robots • Each record identified sender, receiver, communication time, message type • DNA strategy = converging operations • More data but structurally redundant • Goal = detect rare handoff event where Tasking Agents share robotic assets.

16. DNA Kick-start • ArtisTech manually analyzed data • Meticulous message-trace analysis & event identification • Identified message-types that indicate handoff • Identified number of handoffs • CMU CASOS employed DNA techniques in *ORA to replicate ArtisTech’s analysis

17. Which Agents were Involved? *ORA Sphere of Influence ════════ Tasking Agent 3 shares. Is positioned in network differently from others & sends/receives unique messages.

18. Psychological Validity of Newman Grouping • Per ArtisTech, agents can be partitioned • Foreground agents  substantive role • Background agents  housekeepers • Manual analysis took more than 4 hours • *ORA Newman Grouping in seconds • 28 of 29 foreground agents correctly classified • 7 of 10 background agents correctly classified • ArtisTech raters disagreed on status of 1 of the mismatched agents

19. Lessons Learned • Open collaboration between data providers & network analysts creates beneficial gap between expected & observed multi-agent system behavior • Dynamic Network Analytics foster • Understanding of emergent & reactive behavior in multi-agent simulations (V&V) • Tactical insight and development of COAs • DNA can be used to assess realism of data generation simulators

20. Next Steps • Geo-spatial anchoring capabilities • Support shifting among perspectives provided by network, trails, and map visualizations • Support locating key entities in different representations • Improve ability to correlate socio-network & geo-spatial viz • i.e., automate generation of the annotated viz that shows where key players are in social network & on map • Create capability for correlating trails viz & geo-spatial viz to give fine-grained spatio-temporal view of movement • Tactical insight wizard • Codify set of analysis & viz techniques deemed useful for generating COAs for different tactical situations • Reports would generate the entire DARE poster for example • Reports would differ in context-specific ways • e.g., depending on whether the data are intercepts of communications of among humans (study 1) or software/robot agents (study 2)

21. Future Time Frame Product Automate pre-processing for *ORA input Build & automate Tactical Insight Report DNA Monitoring of the battlefield Real-time DNA of evolving battlefield DNA based prediction • Low-hanging Fruit • Intermediate Range • Long Range