Detecting, tracking, and counteracting terrorist networks via hidden Markov models

In reaction to the tragic events of September 11th 2001, DARPA made plans to develop a terrorism information awareness system with an eye to the detection and interdiction of terrorist activities. Under this program and in conjunction with Aptima, Inc., the University of Connecticut is developing its adaptive safety analysis and monitoring (ASAM) tool for assisting US intelligence analysts with: 1) identifying terrorist threats; 2) predicting possible terrorist actions; and 3) elucidating ways to counteract terrorist activities. The focus of this paper, and an important part of the ASAM tool, is modeling and detecting terrorist networks using hidden Markov models (HMMs). The HMMs used in the ASAM tool model the time evolution of suspicious patterns within the information space gathered from sources such as financial institutions, intelligence reports, newspapers, emails, etc. Here we report our software's ability to detect multiple terrorist networks within the same observation space, distinguish transaction "signatures" of terrorist activity from the ambient background of transactions of benign origin, and incorporate information relating to terrorist activity, timing and sequence.