Modeling behavior related to radicalization and terrorism is extremely complex. Consequently, the development of computational approaches to support an understanding of behavioral underpinnings that lead up to radicalization is a significant undertaking and necessitates either a decomposition of behavioral activity into smaller, more manageable behaviors or generalizing larger, group behavior so that only gross trends may be observed. While these approaches may suffice for particular applications, additional consideration should be given to developing more comprehensive or whole-system modeling approaches so as to inform decision-makers in making complex judgments. Specifically for those seeking to understand and stop terrorism, a number of social, cultural, and behavioral perspectives are being developed by experts worldwide. Our research seeks to develop computational methods to analyze and experiment with differing views, opinions, and perspectives of potential influences on adversarial behavior by providing the capability to `dock' or integrate models. We demonstrate how this ability allows for a multi-scale comprehension of the factors that contribute to radicalization.

This paper reports on methods and results of an applied research project by a team consisting of SAIC and four universities to develop, integrate, and evaluate new approaches to detect the weak signals characteristic of insider threats on organizations' information systems. Our system combines structural and semantic information from a real corporate database of monitored activity on their users' computers to detect independently developed red team inserts of malicious insider activities. We have developed and applied multiple algorithms for anomaly detection based on suspected scenarios of malicious insider behavior, indicators of unusual activities, high-dimensional statistical patterns, temporal sequences, and normal graph evolution. Algorithms and representations for dynamic graph processing provide the ability to scale as needed for enterprise-level deployments on real-time data streams. We have also developed a visual language for specifying combinations of features, baselines, peer groups, time periods, and algorithms to detect anomalies suggestive of instances of insider threat behavior. We defined over 100 data features in seven categories based on approximately 5.5 million actions per day from approximately 5,500 users. We have achieved area under the ROC curve values of up to 0.979 and lift values of 65 on the top 50 user-days identified on two months of real data.

Stochastic or Markov games serve as reasonable models for a variety of domains from biology to computer security, and are appealing due to their versatility. In this paper we address the problem of finding the complete set of correlated equilibria for general-sum stochastic games with perfect information. We present QPACE — an algorithm orders of magnitude more efficient than previous approaches while maintaining a guarantee of convergence and bounded error. Finally, we validate our claims and demonstrate the limits of our algorithm with extensive empirical tests.