A robust approach for on-line and off-line threat detection based on event tree similarity analysis

Abstract

The security of railway and mass-transit systems is increasingly dependant on the effectiveness of integrated Security Management Systems (SMS), which are meant to detect threats and to provide operators with information required for alarm verification purposes. In order to lower the false alarm rate and improve the detection reliability of threat scenarios, event correlation capabilities need to be integrated into the SMS. In this paper an existing approach based on a-priori defined event patterns is extended using a heuristic situation recognition approach which is more robust to both imperfect scenario modeling (human faults) and missed detections (sensor faults). The approach is based on similarity analysis between the event trees representing scenarios and it is effective both on-line and off-line. Applied on-line, it allows for an earlier and more fault-tolerant threat detection, since scenario matching is not required to be complete nor exact. Applied off-line, its effectiveness is twofold: first, it allows for detecting redundancies when updating the scenario repository; secondly, it enhances the post-event forensic search of suspicious behaviors not previously stored in the scenario repository. The strategy is being experimented in the context of railway protection

Turning the Hunted into the Hunter via Threat Hunting: Life Cycle, Ecosystem, Challenges and the Great Promise of AI

“…A heuristic situation recognition approach has been developed in [161] as another event detection system. The purpose of this approach is to enhance Security Management Systems and aims to eliminate the severity of consequences from human faults and sensor faults [161].…”

“…A heuristic situation recognition approach has been developed in [161] as another event detection system. The purpose of this approach is to enhance Security Management Systems and aims to eliminate the severity of consequences from human faults and sensor faults [161]. The authors in [161] explained that the approach can be used for a variety of sensor/ alarm dependent systems and can be used while on or offline.…”

Employing automatic content recognition for teaching methodology analysis in classroom videos

“…Automatic action recognition in videos is a long-standing problem in computer vision. However, thriving solutions provide desirable results in specific domains such as surveillance [ 1 ], entertainment, content-based video retrieval [ 2 ], Human-Computer Interaction and Robotics [ 3 ]. However, a general solution may not work as humans and their actions are not universal.…”

Precedence tree guided search for the efficient identification of multiple situations of interest – AND/OR graph matching

“…To overcome this information overload, graph matching has been suggested [27,16] as a method of isolating the IR answering data for more careful analyst investigation. Other techniques for information retrieval query response which have historically been applied in domains such as intelligence analysis include event tree similarity analysis [11,12,13], Bayesian networks [9], neural networks [20], Markov models [23] and query languages such as SPARQL [29]. Difficulties in identifying probabilistic graphical model topologies (dependencies) and probabilities or priors paired with computational complexity have prevented many of these techniques from being applied in the highly dynamic, big data modern intelligence analysis environment.…”