Graph analysis can capture relationships between network entities and can be used to identify and rank anomalous hosts, users, or applications from various types of cyber logs. It is often the case that the data in the logs can be represented as a bipartite graph (e.g. internal IP-external IP, user-application, or client-server). State-of-the-art graph based anomaly detection often generalizes across all types of graphs - namely bipartite and non-bipartite. This confounds the interpretation and use of specific graph features such as degree, page rank, and eigencentrality that can provide a security analyst with situational awareness and even insights to potential attacks on enterprise scale networks. Furthermore, graph algorithms applied to data collected from large, distributed enterprise scale networks require accompanying methods that allow them to scale to the data collected. In this paper, we provide a novel, scalable, directional graph projection framework that operates on cyber logs that can be represented as bipartite graphs. We also present methodologies to further narrow returned results to anomalous/outlier cases that may be indicative of a cyber security event. This framework computes directional graph projections and identifies a set of interpretable graph features that describe anomalies within each partite.

Data from cyber logs can often be represented as a bipartite graph (e.g. internal IP-external IP, user-application, or client-server). State-of-the-art graph based anomaly detection often generalizes across all types of graphs - namely bipartite and non-bipartite. This confounds the interpretation and use of specific graph features such as degree, page rank, and eigencentrality that can provide a security analyst with rapid situational awareness of their network. Furthermore, graph algorithms applied to data collected from large, distributed enterprise scale networks require accompanying methods that allow them to scale to the data collected. In this paper, we provide a novel, scalable, directional graph projection framework that operates on cyber logs that can be represented as bipartite graphs. This framework computes directional graph projections and identifies a set of interpretable graph features that describe anomalies within each partite.

In this paper, we introduce a collaborative learning problem that is applicable in multi-agent data mining using heterogeneous computing resources in environments with limited control, resource failures, and communication bottlenecks. Specifically, we consider the scenario in which multiple agents collect noisy and overlapping information regarding an entity, such as a network attribute, which might correspond to multiple models. The agents are unable to share the entire information due to communication bottlenecks and other strategic issues; instead, the agents share their “local estimate” about the entity. The objective is to obtain the best estimate of the true value of the entity based on the local estimates shared by the agents. First, we derive a centralized solution where the locally processed information from each agent is assumed available at a central node. Then, we develop a distributed solution to the problem that is suitable to environments with limited control, resource failures, and communication bottlenecks.

In this paper we present probabilistic graph fusion algorithms to support information fusion and reasoning over multi-source text media. Our methods resolve misinformation by combining knowledge similarity analysis and conflict identification with source characterization. For experimental purposes, we used the dataset of the articles about current military conflict in Eastern Ukraine. We show that automated knowledge fusion and conflict detection is feasible and high accuracy of detection can be obtained. However, to correctly classify mismatched knowledge fragments as misinformation versus additionally reported facts, the knowledge reliability and credibility must be assessed. Since the true knowledge must be reported by many reliable sources, we compute knowledge frequency and source reliability by incorporating knowledge provenance and analyzing historical consistency between the knowledge reported by the sources in our dataset.

In this paper, we employ a Hidden Markov Random Field (HMRF) model and a novel algorithm for the Quadratic Assignment Problem (QAP) to discover the attributes of and relationships among organizational members, assets, mission areas, and mission tasks. The problem is one of identifying the mapping between the hypothesized nodes of a command and control (C2) organization and tracked individuals and resources. The HMRF formulation allows the computation of the posteriori energy function quantifying the belief that the observed data graph has been generated by a particular organizational graph (model graph). The experimental results demonstrate that the HMRF probabilistic model and the m-best assignment-based search algorithm can accurately identify the different organizational structures and achieve correct node mappings among various organizational members. The algorithm itself can be employed for solving general QAPs as well.

A new Markov decision problem (MDP)-based method for managing goal attainment (GA), which is the process of planning and controlling actions that are related to the achievement of a set of defined goals in the presence of resource and time constraints, is proposed. Specifically, we address the problem as one of optimally selecting a sequence of actions to transform the system and/or its environment from an initial state to a desired state. We begin with a method of explicitly mapping an action-GA graph to an MDP graph and developing a dynamic programming (DP) recursion to solve the MDP problem. For larger problems having exponential complexity with respect to the number of goals, we propose guided search algorithms such as AO*, AOepsiv*, and greedy search techniques, whose search power rests on the efficiency of their heuristic evaluation functions (HEFs). Our contribution in this part stems from the introduction of a new problem-specific HEF to aid the search process. We demonstrate reductions in the computational costs of the proposed techniques through performance comparison with standard DP techniques. We conclude this paper with a method to address situations in which alternative strategies (e.g., second best) are required. The new extended AO* algorithm identifies alternative control sequences for attaining the organizational goals.

The knowledge of the principles and goals under which an adversary organization operates is required to predict its future activities. To implement successful counter-actions, additional knowledge of the specifics of the organizational structures, such as command, communication, control, and information access networks, as well as responsibility distribution among members of the organization, is required. In this paper, we employ a Hidden Markov Random Field (HMRF) model and a graph matching algorithm to discover the attributes of and relationships among organizational members, assets, environment areas, and mission tasks. We focus on identifying the mapping between hypothesized nodes of enemy command organization and tracked individuals and resources. This also allows us to compute the posterior energy function quantifying the belief that the observed data has been generated by a particular organization. The experiment results show that our probabilistic model and the Simulated Annealing search algorithm can accurately identify the different organizational structures and achieve correct node mappings among organizational members.

A fast optimal algorithm based on the branch-and-bound (BBD) method is proposed for the joint detection of binary symbols of K users in a synchronous code-division multiple-access channel with Gaussian noise. Relationships between the proposed algorithms (depth-first BBD and fast BBD) and both the decorrelating decision-feedback (DF) detector and sphere-decoding algorithm are clearly drawn. It turns out that decorrelating DF detector corresponds to a "one-pass" depth-first BBD; sphere decoding is, in fact, a type of depth-first BBD, but one that can be improved considerably via tight upper bounds and user ordering, as in the fast BBD. A fast "any-time" suboptimal algorithm is also available by simply picking the "current-best" solution in the BBD method. Theoretical results are given on the computational complexity and the performance of the "current-best" suboptimal solution.

In Parts I and II of this paper, we presented a three-phase iterative optimization process to design normative organizations. Such organizations are mission-based in that they are organized to perform a given task and then are dissolved. The objectives of the present paper are to 1) define and classify the processes of strategy and structural adaptation in organizations in response to mission and environmental changes, 2) extend our three-phase design methodology to construct robust and adaptive organizations, and 3) analyze the effects of mission parameters on their performance. We investigate the performance of organizations through internal workload and external coordination measures for individual DMs, as well as workload distribution as the overall organizational measure.

The group decision feedback (GDF) detector is studied in this letter. Given the maximum group size, a grouping algorithm is proposed. It is shown that the proposed grouping algorithm maximizes the symmetric energy of the multiuser detection system. Furthermore, based on a set of lower bounds on asymptotic group effective energy (AGEE) of the GDF detector, it is shown that the proposed grouping algorithm, in fact, maximizes the AGEE lower bound for every group of users. The theoretical analysis of the grouping algorithm enables the offline estimation of the computational cost and the performance of a GDF detector. The computational complexity of a GDF detector is exponential in the largest size of the groups. Simulation results are presented to verify the theoretical conclusions. The results from this letter can be applied to the decision feedback detector by setting the maximum group size to one.

This paper presents a design methodology for synthesizing organizations to execute complex missions efficiently. It focuses on devising mission planning strategies to optimally achieve mission goals while optimally utilizing organization's resources. Effective planning is often the key to successful completion of the mission, and conversely, mission failure can often be traced back to poor planning. Details on subsequent phases of the design process to construct the mission-driven human organizations are discussed in a companion paper.

For pt.I. see ibid., p. 346-59. This paper presents a multiobjective structural optimization process of designing an organization to execute a specific mission. We provide mathematical formulations for optimization problems arising in Phases II and III of our organizational design process and polynomial algorithms to solve the corresponding problems. Our organizational design methodology applies specific optimization techniques at different phases of the design, efficiently matching the structure of a mission (in particular, the one defined by the courses of action obtained from mission planning) to that of an organization. It allows an analyst to obtain an acceptable tradeoff among multiple mission and design objectives, as well as between computational complexity and solution efficiency (desired degree of suboptimality).

The objectives of this paper are to (i) define and classify the processes of strategy and structural adaptation in organizations in response to mission and environmental changes, (ii) apply our modified design methodology to construct robust, adaptive, and flexible (both robust and adaptive) organizations; and (iii) analyze the effects of mission parameters on their performance. We investigate the performance of organizations through dynamic metrics, which include a performance based congruence measure, as well as DM activity and task workload measures as functions of time.

A class of coordinate descent methods is proposed for the joint detection of binary symbols of K users in a synchronous correlated waveform multiple-access (CWMA) channel with Gaussian noise. We consider the detection problem as one of optimizing a quadratic objective function with binary constraints on decision variables. The proposed coordinate descent methods, while still maintaining a low computational complexity, are shown to provide as much as two orders of magnitude improvement in the probability of error, especially in situations where the existing methods do not perform well. The paper concludes with a discussion of how the proposed methods can be further improved.

Presents a classification of the optimization problems arising in the normative design of organizations to execute specific missions. The use of specific optimization algorithms for different phases of the design process leads to an efficient matching between the mission structure and that of an organization and its resources/constraints. It allows an analyst to obtain an acceptable trade-off among multiple objectives and constraints, as well as between computational complexity and solution efficiency (desired degree of sub-optimality).