PROGRAMS IN HOMELAND SECURITY AT DIMACS

1. PROGRAMS IN HOMELAND SECURITY AT DIMACS Fred S. Roberts DIMACS Director

2. THE FOUNDING OF DIMACSTHE NSF SCIENCE AND TECHNOLOGY CENTERS PROGRAM The STC program was launched by the White House and the National Academy of Sciences in 1988 in order to increase the economic competitiveness of the U.S. NSF ran a nationwide competition. The rules: *cutting edge research *education and knowledge transfer *university-industry partnerships

3. THE FOUNDING OF DIMACS Because of the increasing importance of discrete mathematics and theoretical computer science, especially in the fields of telecommunications and computing, four institutions, Rutgers and Princeton Universities and AT&T Bell Labs and Bell Communications Research (Bellcore) each developed strong research groups in these fields. Under the leadership of Rutgers, they came together to found DIMACS and entered the STC competition. There were more than 800 preproposals; more than 300 proposals, in all fields of science; 11 winners.

4. The DIMACS Partners Today Rutgers University Princeton University AT&T Labs Bell Labs (Lucent Technologies) NEC Laboratories America Telcordia Technologies Affiliates: Avaya Labs HP Labs IBM Research Microsoft Research Stevens Institute of Technology

5. WHO IS DIMACS? • There are about 250 scientists affiliated with DIMACS and called permanent members. • Most are from the partner and affiliated organizations. • They include many of the world’s leaders in discrete mathematics and theoretical computer science and their applications. • They also include statisticians, biologists, psychologists, chemists, epidemiologists, and engineers. • None are paid by DIMACS, but they join in DIMACS projects.

6. Outline: A Selection of DIMACS Projects • Bioterrorism Sensor Location • Port of Entry Inspection Algorithms • Monitoring Message Streams • Author Identification • Computational and Mathematical Epidemiology • Adverse Event/Disease Reporting/Surveillance/Analysis • Bioterrorism Working Group • Modeling Social Responses to Bioterrorism • Predicting Disease Outbreaks from Remote Sensing and Media Data • Communication Security and Information Privacy

7. The Bioterrorism Sensor Location Problem

8. Early warning is critical in defense against terrorism • This is a crucial factor underlying the government’s plans to place networks of sensors/detectors to warn of a bioterrorist attack The BASIS System – Salt Lake City

9. Locating Sensors is not Easy • Sensors are expensive • How do we select them and where do we place them to maximize “coverage,” expedite an alarm, and keep the cost down? • Approaches that improve upon existing, ad hoc location methods could save countless lives in the case of an attack and also moneyin capital and operational costs.

10. Two Fundamental Problems • Sensor Location Problem • Choose an appropriate mix of sensors • decide where to locate them for best protection and early warning

11. Two Fundamental Problems • Pattern Interpretation Problem: When sensors set off an alarm, help public health decision makers decide • Has an attack taken place? • What additional monitoring is needed? • What was its extent and location? • What is an appropriate response?

12. The SLP: What is a Measure of Success of a Solution? • A modeling problem. • Needs to be made precise. • Many possible formulations.

13. The SLP: What is a Measure of Success of a Solution? • Identify and ameliorate false alarms. • Defending against a “worst case” attack or an “average case” attack. • Minimize time to first alarm? (Worst case? (Average case?) • Maximize “coverage” of the area. • Minimize geographical area not covered • Minimize size of population not covered • Minimize probability of missing an attack

14. The SLP: What is a Measure of Success of a Solution? • Cost: Given a mix of available sensors and a fixed budget, what mix will best accomplish our other goals?

15. The SLP: What is a Measure of Success of a Solution? • It’s hard to separate the goals. • Even a small number of sensors might detect an attack if there is no constraint on time to alarm. • Without budgetary restrictions, a lot more can be accomplished.

16. The Sensor Location Problem • Approach is to develop new algorithmic methods. • We are building on approaches to other modeling problems, seeing if they can be modified in the sensor location context. • This is a multi-criteria modeling problem and it seems hopeless to try to find “optimal solutions” • We will be happy with “efficient” algorithms that find “good” solutions

17. Algorithmic Approaches I : Greedy Algorithms

18. Greedy Algorithms • Find the most important location first and locate a sensor there. • Find second-most important location. • Etc. • Builds on earlier mathematical work at Institute for Defense Analyses (Grotte, Platt) • “Steepest ascent approach.’’ • No guarantee of “optimal” or best solution. • In practice, gets pretty close to optimal solution.

19. Algorithmic Approaches II : Variants of Classic Location and Clustering Methods

20. Algorithmic Approaches II : Variants of Classic Location and Clustering Methods • Location theory: locate facilities (sensors) to be used by users located in a region. • Cluster analysis: Given points in a metric space, partition them into groups or clusters so points within clusters are relatively close. • Clusters correspond to points covered by a facility (sensor).

21. Variants of Classic Location and Clustering Methods • k-median clustering: Given k sensors, place them so each point in the city is within x feet of a sensor. • Complications: More dimensions: location affects sensitivity, wind strength enters, sensors have different characteristics, etc. • This higher-dimensional k-median clustering problem is hard! Best-known algorithms are due to Rafail Ostrovsky.

22. Variants of Classic Location and Clustering Methods • Further complications make this even more challenging: • Different costs of different sensors • Restrictions on where we can place different sensors • Is it better to have every point within x feet of some sensor or every point within y feet of at least three sensors (y > x)? • Approximation methods due to Chuzhoy, Ostrovsky, and Rabani and to Guha, Tardos, and Shmoys are relevant.

23. Algorithmic Approaches III : Variants of Highway Sensor Network Algorithms

24. Variants of Highway Sensor Network Algorithms • Sensors located along highways and nearby pathways measure atmospheric and road conditions. • Muthukrishnan, et al. have developed very efficient algorithms for sensor location. • Based on “bichromatic clustering” and “bichromatic facility location” (color nodes corresponding to sensors red, nodes corresponding to sensor messages blue)

25. Variants of Highway Sensor Network Algorithms • These algorithms apply to situations with many more sensors than the bioterrorism sensor location problem. • As BT sensor technology changes, we can envision a myriad of miniature sensors distributed around a city, making this work all the more relevant.

26. Algorithmic Approaches IV : Building on Equipment Placing Algorithms

27. Building on Equipment Placing Algorithms • The “Node Placement Problem” is problem of determining locations or nodes to install certain types of networking equipment. • “Coverage” and cost are a major consideration. • Researchers at Telcordia Technologies have studied variations of this problem arising from broadband access technologies.

28. The Broadband Access Node Placement Problem • There are inherent range limitations that drive placement. • E.g.: customer for DSL service must be within xx feet of an assigned multiplexer. • Multiplexer = sensor. • Problem solved using dynamic programming algorithms. (Tamra Carpenter, Martin Eiger,David Shallcross, Paul Seymour)

29. The Broadband Access Node Placement Problem: Complications • Restrictions on types of equipment that can be placed at a given node. • Constraints on how far a signal from a given piece of equipment can travel. • Cost and profit maximization considerations. • Relevance of work on general integer programming, the knapsack cover problem, and local access network expansion problems.

30. The Pattern Interpretation Problem

31. The Pattern Interpretation Problem • It will be up to the Decision Maker to decide how to respond to an alarm from the sensor network.

32. The Pattern Interpretation Problem • Little has been done to develop analytical models for rapid evaluation of a positive alarm or pattern of alarms from a sensor network. • How can this pattern be used to minimize false alarms? • Given an alarm, what other surveillance measures can be used to confirm an attack, locate areas of major threat, and guide publichealth interventions?

33. The Pattern Interpretation Problem (PIP) • Close connection to the SLP. • How we interpret a pattern of alarms will affect how we place the sensors. • The same simulation models used to place the sensors can help us in tracing back from an alarm to a triggering attack.

34. Approaching the PIP: Minimizing False Alarms

35. Approaching the PIP: Minimizing False Alarms • One approach: Redundancy. Require two or more sensors to make a detection before an alarm is considered confirmed.

36. Approaching the PIP: Minimizing False Alarms • Portal Shield: requires two positives for the same agent during a specific time period. • Redundancy II: Place two or more sensors at or near the same location. Require two proximate sensors to give off an alarm before we consider it confirmed. • Redundancy drawbacks: cost, delay in confirming an alarm.

37. Approaching the PIP: Using Decision Rules • Existing sensors come with a sensitivity level specified and sound an alarm when the number of particles collected is sufficiently high – above threshold.

38. Approaching the PIP: Using Decision Rules • Alternative decision rule: alarm if two sensors reach 90% of threshold, three reach 75% of threshold, etc. • One approach: use clustering algorithms for sounding an alarm based on a given distribution of clusters of sensors reaching a percentage of threshold.

39. Approaching the PIP: Using Decision Rules • When sensors are to be used jointly, the rules for “tuning” each sensor should be optimized to take advantage of the fact that each is part of a network. • The optimal tuning depends on the decision rule applied to reach an overall decision given the sensor inputs.

40. Approaching the PIP: Using Decision Rules • Prior work along these lines in missile detection (Cherikh and Kantor)

41. Approaching the PIP: Using Decision Rules • Most work has concentrated on the case of stochastic independence of information available at two sensors – clearly violated in BT sensor location problems. • Even with stochastic independence, finding “optimal” decision rules is nontrivial. • Recent promising approaches of Paul Kantor: study fusion of multiple methods for monitoring message streams.

42. Approaching the PIP: Spatio-Temporal Mining of Sensor Data

43. Approaching the PIP: Spatio-Temporal Mining of Sensor Data • Sensors provide observations of the state of the world localized in space and time. • Finding trends in data from individual sensors: time series data mining. • PIP: detecting general correlations in multiple time series of observations. • This has been studied in statistics, database theory, knowledge discovery, data mining. • Complications: proximity relationships based ongeography; complex chronological effects.

44. Approaching the PIP: Spatio-Temporal Mining of Sensor Data • Sensor technology is evolving rapidly. • It makes sense to consider idealized settings where data are collected continuously and communicated instantly. • Then, modern methods of spatio-temporal data mining due to Muthukrishnan and others are relevant.

45. Approaching the PIP: Triggering Other Methods of Surveillance • One type of BT surveillance cannot be considered in isolation. • Question: How can the pattern of sensor warnings guide other biosurveillance methods? • Increased syndromic surveillance? • Change threshold for alarm in syndromic surveillance? • Increased attention to E.R. visits in a certain region?

46. Approaching the PIP: Triggering Other Methods of Surveillance • Decreased threshold for alarm from subway worker absenteeism levels?

47. Approaching the PIP: Triggering Other Methods of Surveillance • If there is an initial alarm, each sensor may be read more often. • How do we pick the sensors to read more frequently? • This is “adaptive biosensor engagement.” • Methods of bichromatic combinatorial optimization may be relevant. • As for the SLP, sensors get one color, sensor messages another. • Relevance of work of Muthukrishnan.

48. Outline • Bioterrorism Sensor Location • Port of Entry Inspection Algorithms • Monitoring Message Streams • Author Identification • Computational and Mathematical Epidemiology • Adverse Event/Disease Reporting/Surveillance/Analysis • Bioterrorism Working Group • Modeling Social Responses to Bioterrorism • Predicting Disease Outbreaks from Remote Sensing and Media Data • Communication Security and Information Privacy

49. Port of Entry Inspection Algorithms In collaboration with Los Alamos National Laboratory

50. Goal: Find ways to intercept illicit nuclear materials and weapons destined for the U.S. via the maritime transportation system • Aim: Develop decision support algorithms that will help us to “optimally” intercept illicit materials and weapons • Find inspection schemes that minimize total “cost” including “cost” of false positives and false negatives Port of Entry Inspection Algorithms