Efforts to predict emerging, new, or disruptive technologies use various analyses and data sources to derive indicators and subsequent forecasts about technological innovations, including quantitative (such as bibliometric analysis) and qualitative methods (such as expert elicitation). We describe a novel approach for harnessing a collective (crowdsourced) predictive ability available through publicly made technology-related statements by automatically determining significant convergences on technology forecasts. We evaluate our approach using a corpus of science-related articles and demonstrate that passive crowdsourcing may be a powerful source of technology-related predictive intelligence.

The increasing proliferation of social media results in users that are forced to ascertain the truthfulness of information that they encounter from unknown sources using a variety of indicators (e.g. explicit ratings, profile information, etc.). Through human-subject experimentation with an online social network-style platform, our study focuses on the determination of credibility in ego-centric networks based on subjects observing social network properties such as degree centrality and geodesic distance. Using manipulated social network graphs, we find that corroboration and degree centrality are most utilized by subjects as indicators of credibility. We discuss the implications of the use of social network graph structural properties and use principal components analysis to visualize the reduced dimensional space.

A fundamental problem in detecting threats to security by monitoring computer usage is the high number of false positives that are created when analyzing a large data set for anomalous behavior. We address the problem by modeling user behavior at multiple scales so as to allow for the identification potential insider threats from users' logged activity by tracking users' activity over time. In this work, we apply a novel method for representing user activity at multiple temporal scales to a dataset that contains malicious behavior. We report our detection results and discuss how a layered detection method may be advantageous for the discovery of specific types of malicious behavior.

Modeling behavior related to radicalization and terrorism is extremely complex. Consequently, the development of computational approaches to support an understanding of behavioral underpinnings that lead up to radicalization is a significant undertaking and necessitates either a decomposition of behavioral activity into smaller, more manageable behaviors or generalizing larger, group behavior so that only gross trends may be observed. While these approaches may suffice for particular applications, additional consideration should be given to developing more comprehensive or whole-system modeling approaches so as to inform decision-makers in making complex judgments. Specifically for those seeking to understand and stop terrorism, a number of social, cultural, and behavioral perspectives are being developed by experts worldwide. Our research seeks to develop computational methods to analyze and experiment with differing views, opinions, and perspectives of potential influences on adversarial behavior by providing the capability to `dock' or integrate models. We demonstrate how this ability allows for a multi-scale comprehension of the factors that contribute to radicalization.

This paper reports on methods and results of an applied research project by a team consisting of SAIC and four universities to develop, integrate, and evaluate new approaches to detect the weak signals characteristic of insider threats on organizations' information systems. Our system combines structural and semantic information from a real corporate database of monitored activity on their users' computers to detect independently developed red team inserts of malicious insider activities. We have developed and applied multiple algorithms for anomaly detection based on suspected scenarios of malicious insider behavior, indicators of unusual activities, high-dimensional statistical patterns, temporal sequences, and normal graph evolution. Algorithms and representations for dynamic graph processing provide the ability to scale as needed for enterprise-level deployments on real-time data streams. We have also developed a visual language for specifying combinations of features, baselines, peer groups, time periods, and algorithms to detect anomalies suggestive of instances of insider threat behavior. We defined over 100 data features in seven categories based on approximately 5.5 million actions per day from approximately 5,500 users. We have achieved area under the ROC curve values of up to 0.979 and lift values of 65 on the top 50 user-days identified on two months of real data.