Search

Copyright of Handbook of Database Security is the property of Springer eBooks and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

The growing number of distributed information systems such as the internet has created a need for security in data sharing. When several autonomous parties attempt to share data, there is not necessarily any guarantee that the participants will share data truthfully. In fact, there is often a large incentive to engage in behavior that can sabotage the effectiveness of such a system. We analyze these situations in light of game theory, a mathematical model which permits us to consider behavior and choices for any autonomous party. This paper uses this theory to create a behavior enforcement method that does not need a central management system. We use a simple punishment method that is inherently available in most scenarios. Our approach is applicable to a variety of assured information sharing applications where the members of a coalition have to work together to solve a problem. [ABSTRACT FROM AUTHOR]

Role Based Access Control (RBAC) has been introduced in an effort to facilitate authorization in database systems. It introduces roles as a new layer in between users and permissions. This not only provides a well maintained access granting mechanism, but also alleviates the burden to manage multiple users. While providing comprehensive access control, current RBAC models and systems do not take into consideration the possible risks that can be incurred with role misuse. In distributed environments a large number of users are a very common case, and a considerable number of them are first time users. This fact magnifies the need to measure risk before and after granting an access. We investigate the means of managing risks in RBAC employed distributed environments and introduce a probability based novel risk model. Based on each role, we use information about user credentials, current user queries, role history log and expected utility to calculate the overall risk. By executing data mining on query logs, our scheme generates normal query clusters. It then assigns different risk levels to individual queries, depending on how far they are from the normal clusters. We employ three types of granularity to represent queries in our architecture. We present experimental results on real data sets and compare the performances of the three granularity levels. [ABSTRACT FROM AUTHOR]

A firewall is a system acting as an interface of a network to one or more external networks. It implements the security policy of the network by deciding which packets to let through based on rules defined by the network administrator. Any error in defining the rules may compromise the system security by letting unwanted traffic pass or blocking desired traffic. Manual definition of rules often results in a set that contains conflicting, redundant or overshadowed rules, resulting in anomalies in the policy. Manually detecting and resolving these anomalies is a critical but tedious and error prone task. Existing research on this problem have been focused on the analysis and detection of the anomalies in firewall policy. Previous works define the possible relations between rules and also define anomalies in terms of the relations and present algorithms to detect the anomalies by analyzing the rules. In this paper, we discuss some necessary modifications to the existing definitions of the relations. We present a new algorithm that will simultaneously detect and resolve any anomaly present in the policy rules by necessary reorder and split operations to generate a new anomaly free rule set. We also present proof of correctness of the algorithm. Then we present an algorithm to merge rules where possible in order to reduce the number of rules and hence increase efficiency of the firewall. Keywords: Packet Filters, Network Security, Firewalls, Anomalies, Security Policy. [ABSTRACT FROM AUTHOR]

Intrusion Detection Systems (IDSs) and security tools are used to monitor potential attacks in network infrastructures. The IDSs and tools trigger alerts of potential attacks in networks. However, most of these alerts are false positives. The high volumes of false positives makes manually analysis of alerts difficult and inefficient. In this paper we present a novel approach for efficient intelligent detection and response to suspect packets and benign false positives. The intelligent strategy consists of Network Quarantine Channels (NQCs) with multiple zones for isolation and interaction with the suspect packets in real-time. We propose multiple feedback methods to enhance the capability of the IDS to detect threats and benign attacks. We describe new techniques for feeding the results of the NQC to the IDS. These approaches are effective in responding to benign and attack packets. [ABSTRACT FROM AUTHOR]

Deterrence is the "holy grail" of counter-terrorism: a strategy that offers the promise of reducing or eliminating terror attacks at minimal cost. Israel's experience has shown, however, that while many tactics have been promoted as deterrents, very few have actually worked. As claimed deterrence can be used to justify retributive policies that are unjust or simply unwise, it is important to apply careful thought before implementing such policies. [ABSTRACT FROM AUTHOR]

Counterterrorism is one of the major challenges to the society. In order to flight again the terrorists, it is very important to have a through understanding of the terrorism incidents. However, it is impossible for a human to read all the information related to a terrorism incident because of the large volume of information. Summarization technique is urgently required for analysis of terrorism incident. In this work, we propose a multi-document summarization system to extract the critical information from terrorism incidents. News stories of a terrorism incident are organized into a hierarchical tree structure. Fractal summarization model is employed to generate a summary for all the news stories. Experimental results show that our system can effectively extract the most important information for the incident. [ABSTRACT FROM AUTHOR]

Existing Intrusion Detection Systems (IDS) in Mobile Ad Hoc Network (MANET) environments suffer from many problems because of the inherent characteristics of the network. Limited audit data, along with the problems faced in achieving global detection and response mechanisms, creates challenges for establishing reliable IDS for MANETs. In this paper, several scenarios are investigated where a ‘friend' concept has been applied to solve MANET problems. This same concept is applied to a new IDS framework, and discussion is presented into how it can help in minimizing the problems that are faced in existing IDS. The key advantages of this two-tier IDS framework are its ability to detect intrusion at an early stage of such behaviour in the network, and its capability to minimize the impact of colluding blackmail attackers in the systems. [ABSTRACT FROM AUTHOR]

We address the problem of fairly distributing the cost of system-wide improvements to the security of a transportation infrastructure over the beneficiaries. We present a framework that models transportation links and the emergence (magnitude and frequency) and propagation of threats. The cost-distribution is based on a weighted sum that characterizes the expected reduction in the vulnerability of a site as a result of the security improvements. [ABSTRACT FROM AUTHOR]

The paradigm of robot which performs specific tasks remotely has changed into intelligent robot to perform public and individual tasks. Especially, in the robot and security industry, security guard robot provides a variety of information to the user and achieves its duty through the Web. The communication technique for these telepresence robots takes charge of the probability of various services in the robot industry. Last year, the interface for telepresence robot has developed over the Web or RF between robots, but these systems have the demerits of limited distance or geographical limit to be established to an internet link. In this paper, we propose the SG-Robot(Security Guard Robot) that can be operated and conduct surveillance of the environment around itself anytime/anywhere using CDMA networking. SG-Robot was able to solve those problems, conduct the surveillance task and communicate between multi SG-Robot and users over the CDMA2000-1x communication network efficiently. [ABSTRACT FROM AUTHOR]

Contents in extremist online forums are invaluable data sources for extremism reseach. In this study, we propose a systematic Web mining approach to collecting and monitoring extremist forums. Our proposed approach identifies extremist forums from various resources, addresses practical issues faced by researchers and experts in the extremist forum collection process. Such collection provides a foundation for quantitative forum analysis. Using the proposed approach, we created a collection of 110 U.S. domestic extremist forums containing more than 640,000 documents. The collection building results demonstrate the effectiveness and feasibility of our approach. Furthermore, the extremist forum collection we created could serve as an invaluable data source to enable a better understanding of the extremism movements. [ABSTRACT FROM AUTHOR]

In a pedestrian detection system, the application of color information can increase the detection rate; however, the detection speed will be slowed down a lot. This paper presents a fast pedestrian detection method using color information. It firstly scans a pair of sequential gray-scale frames to select candidates using both appearance and motion features; and then uses information of each color channel (RGB) to do a further confirmation with support vector machine based classifiers. Compared with pedestrian detection systems that only use gray-scale information, the system using our method has almost the same detection speed; at the same time, it also gets a better detection rate and false-positive rate. The experiment in a pedestrian detection system with a single optical camera proves the effectiveness of our method. [ABSTRACT FROM AUTHOR]

This paper presents an exploratory study of jihadi extremist groups' videos using content analysis and a multimedia coding tool to explore the types of videos, groups' modus operandi, and production features. The videos convey messages powerful enough to mobilize members, sympathizers, and even new recruits to launch attacks that will once again be captured and disseminated via the Internet. The content collection and analysis of the groups' videos can help policy makers, intelligence analysts, and researchers better understand the groups' terror campaigns and modus operandi, and help suggest counter-intelligence strategies and tactics for troop training. [ABSTRACT FROM AUTHOR]

Scanning traffic is the majority of worm traffic. Gaining deep insight into worm traffic can do much help in detecting worm hosts. The distributions of vectors related with First Contact Connections (FCC) of legitimate hosts and worm hosts are analyzed. The vectors are arrival interval, request size, response size, duration and RTT. Distributions of these vectors of worm traffic show abnormalities of the lack of heavy-tailed character, which is hold by that of legitimate traffic. Besides high probability of failed FCC, arrival interval and request size can be used as additional vectors. [ABSTRACT FROM AUTHOR]

Bio-terror events are accompanied by severe uncertainty: great disparity between the best available data and models, and the actual course of events. We model this uncertainty with non-probabilistic information-gap models of uncertainty. This paper focuses on info-gaps in epidemiological models, in particular, info-gaps in the rate of infection. robustness to uncertainty is defined as a function of the required critical morbidity resulting from the attack. We show how preferences among available interventions are deduced from the robustness function. We demonstrate the irrevocable trade-off between robustness and demanded performance, and show that best-estimated performance has zero robustness. Finally, we present a theorem concerning the reversal of preferences between available interventions, and illustrate it with a numerical example. [ABSTRACT FROM AUTHOR]

This paper aims to develop a new statistical measure to identify significant correlations among multiple events with spatial and temporal components. This new measure, K(r,t), is defined by adding the temporal dimension to Ripley's K(r) function. Empirical studies show that the use of K(r,t) can lead to a more discriminating and flexible spatial-temporal data analysis framework. This measure also helps identify the causal events whose occurrences induce those of other events. [ABSTRACT FROM AUTHOR]

Venn Diagrams are used to depict relationships between subsets of a set of items. In this paper we will discuss the methods we use to render these Diagrams on a plane. Algorithms to both place members of subsets and render the curves of the Diagram will be presented. We close with discussion of results and application to chatroom conversation analysis. [ABSTRACT FROM AUTHOR]

Internet becomes more and more popular, and most companies and institutes use web services for e-business and many other purposes. As results, Internet and web services become core infrastructure for a company or an institute. With the explosion of Internet, the occurrence of cyber terrorism has grown very rapidly. It is difficult to find and close all security flaws in a computer system that is connected to a network. Internet worms take advantages of these security flaws, and attack a large number of hosts with self-propagating techniques. To study and analyze internet worms, one of the most feasible ways is to use simulations. It is quite challenging to simulate very large-scale worm attacks. In this paper, we propose a hybrid model for large-scale worm propagation simulations. Keywords: Network modeling, Internet incidents, Internet worms, simulation. [ABSTRACT FROM AUTHOR]

In this paper, we propose a new heuristic algorithm called the QIBC algorithm that improves the privacy of sensitive knowledge (as itemsets) by blocking more inference channels. We show that the existing sanitizing algorithms for such task have fundamental drawbacks. We show that previous methods remove more knowledge than necessary for unjustified reasons or heuristically attempt to remove the minimum frequent non-sensitive knowledge but leave open inference channels that lead to discovery of hidden sensitive knowledge. We formalize the refined problem and prove it is NP-hard. Finally, experimental results show the practicality of the new QIBC algorithm. [ABSTRACT FROM AUTHOR]

Worm research depends on simulation to a large degree due to worm propagation characters. In worm simulation, worm traffic generation is the base to analyze influences of worm traffic on network. The popular Random Constant Spread (RCS) model ignores the burstiness of "latency-limited" worm traffic, which will cause underestimation of the influences. According to worm scan behaviors, the Periodic Burst Scanning (PBS) model is proposed to model "latency-limited" worm traffic. Simulation results show that network performance decreases much more with PBS model than that with RCS model. [ABSTRACT FROM AUTHOR]

Today the Intelligence Community (IC) has faced increasing challenges of insider threats. It is generally accepted that the cost of insider threats exceeds that of outsider threats. Although the currently available access control approaches have a great potential for preventing insider threats, there are still critical obstacles to be solved, especially in large-scale computing environments. In this paper we discuss those requirements with respect to scalability, granularity, and context-awareness. For each requirement we discussed related problems, techniques, and basic approaches to the corresponding countermeasures. Detailed solutions and implementations are not described in this paper. [ABSTRACT FROM AUTHOR]

Conflicts are widespread in our society owing to the scarcity of physical resources, different cultures and religions. The Chinese Wall security policy is a conflicts model originally proposed by Brewer and Nash for information access control. The rapid development of intelligence and security informatics prompts us to revisit this policy and we use granular computing based on covering rough set theory to study the problems of conflicts of interest in database access security. This new method catches the IAR(in ally with relation) more accurately. It also has potential application to issues in intelligence and security informatics such as information sharing policy and governance. [ABSTRACT FROM AUTHOR]

The proximate objective behind a bioterrorism event is to cause fear, with morbidity or mortality as secondary effects. Information technology must empower professionals to respond rapidly and effectively. This paper links detection and identification of a bioterrorism event with opportunities for information technology to aid such efforts, drawing specifically from real-world uses of technology with the Bioterrorism Preparedness and Response Program at the U.S. Centers for Disease Control and Prevention (CDC) from 2000 to the present. Information technology challenges and innovations will be highlighted, as well as lessons learned from the program's response to the anthrax attacks in 2001 and Severe Acute Respiratory Syndrome in 2003. [ABSTRACT FROM AUTHOR]

Information dissemination is of vital importance in today's information-centric world. However, controlling the flow of information across multiple security domains is a problem. Most of the current solutions rely on prior knowledge of the users for authorization, which does not scale well. Also, many information sources have dynamic access control policies, which are hard to satisfy under existing schemes. In this paper, we present Synergy, a general purpose information sharing framework that uses trust negotiation to implement scalable authorization in an open environment. Synergy provides an abstraction for the information sources and consumers to accommodate new trust-aware systems as well as legacy systems. We also present a practical disaster management application that uses this framework. [ABSTRACT FROM AUTHOR]

There are some viruses and bacteria that have been identified as bioterrorism weapons. However, there are a lot other viruses and bacteria that can be potential bioterrorism weapons. A system that can automatically suggest potential bioterrorism weapons will help laypeople to discover these suspicious viruses and bacteria. In this paper we apply instance-based learning & text mining approach to identify candidate viruses and bacteria as potential bio-terrorism weapons from biomedical literature. We first take text mining approach to identify topical terms of existed viruses (bacteria) from PubMed separately. Then, we use the term lists as instances to build matrices with the remaining viruses (bacteria) to discover how much the term lists describe the remaining viruses (bacteria). Next, we build a algorithm to rank all remaining viruses (bacteria). We suspect that the higher the ranking of the virus (bacterium) is, the more suspicious they will be potential bio-terrorism weapon. Our findings are intended as a guide to the virus and bacterium literature to support further studies that might then lead to appropriate defense and public health measures. [ABSTRACT FROM AUTHOR]

The concept of Personal Information Management (PIM) is currently a hot topic of research. Some of the ideas being discussed under this topic have a long history, and they are relevant to the work of intelligence analysts. Hence, the intelligence community should pay attention to the developments in this area. In this position paper we examine the concept of PIM, point out some issues that are relevant to intelligence work, and discuss some areas of research that PIMs should address in order to be even more relevant to the Intelligence Community. [ABSTRACT FROM AUTHOR]

Most humans cannot detect lies at a rate better than chance. Alternative methods of deception detection may increase accuracy, but are intrusive, do not offer immediate feedback, or may not be useful in all situations. Automated classification methods have been suggested as an alternative to address these issues, but few studies have tested their utility with real-world, high-stakes statements. The current paper reports preliminary results from classification of actual security police investigations collected under high stakes and proposes stages for conducting future analyses. [ABSTRACT FROM AUTHOR]

This paper examines the "Gray Web Forums" in Taiwan. We study their characteristics and develop an analysis framework for assisting investigations on forum communities. Based on the statistical data collected from online forums, we found that the relationship between a posting and its responses is highly correlated to the forum nature. In addition, hot threads extracted based on the proposed metric can be used to assist analysts in identifying illegal or inappropriate contents. Furthermore, members' roles and activities in a virtual community can be identified by member level analysis. [ABSTRACT FROM AUTHOR]

In this paper we describe SemanticSpy, a tool for tracking suspects and their activities around the globe. Using an RDF data store and a three-dimensional multimedia environment, SemanticSpy is able to bring semantic information to life. SemanticSpy utilizes a blend of semantic information and a media-rich environment that can display images, 3D models, and documents, and can play audio clips to give the user the ability to analyze information using the different types of media. We believe that this will help law enforcement officials gain insight into a suspect's behavior and give them the power to avert the next major crime or terrorist attack. Finally, we describe SemanticSpy's architecture and explain its advantages over other information environments. [ABSTRACT FROM AUTHOR]

Identity management is critical to various governmental practices ranging from providing citizens services to enforcing homeland security. The task of searching for a specific identity is difficult because multiple identity representations may exist due to issues related to unintentional errors and intentional deception. We propose a Naïve Bayes identity matching model that improves existing techniques in terms of effectiveness. Experiments show that our proposed model performs significantly better than the exact-match based technique and achieves higher precision than the record comparison technique. In addition, our model greatly reduces the efforts of manually labeling training instances by employing a semi-supervised learning approach. This training method outperforms both fully supervised and unsupervised learning. With a training dataset that only contains 30% labeled instances, our model achieves a performance comparable to that of a fully supervised learning. [ABSTRACT FROM AUTHOR]

It is quite consensual that police patrolling can be regarded as one of the best well-known practices for implementing public-safety preventive policies towards the combat of an assortment of urban crimes. However, the specification of successful police patrol routes is by no means a trivial task to pursue, mainly when one considers large demographic areas. In this work, we present the first results achieved with GAPatrol, a novel evolutionary multiagent-based simulation tool devised to assist police managers in the design of effective police patrol route strategies. One particular aspect investigated here relates to the GAPatrol's facility to automatically discover crime hotspots, that is, high-crime-density regions (or targets) that deserve to be better covered by routine patrol surveillance. In order to testify the potentialities of the novel approach in such regard, simulation results related to two scenarios of study over the same artificial urban territory are presented and discussed here. [ABSTRACT FROM AUTHOR]

Strategic intelligence involves the efforts to understand the "Big Picture" emerging from data sources. Concerning textual data, this process involves the extraction of meaning from textual information. In this paper we present a new methodology for meaning extraction from news articles. This methodology is based on the gradual construction of visual maps from processed textual information. The methodology is not a substitute for meaning-making by human agents but combines computational power with human evaluation and provides a tool for identifying emerging patterns of meaning. [ABSTRACT FROM AUTHOR]

An intelligence analyst often needs to keep track of more facts than can be held in human memory. As a result, analysts use a notebook or evidence file to record facts learned so far. In practice, the evidence file is often an electronic document into which text snippets and hand-typed notes are placed. While this kind of evidence file is easy to read and edit, it provides little help for making sense of the captured information. We describe Entity Workspace, a tool designed to be used in place of a traditional evidence file. Entity Workspace combines user interface and entity extraction technologies to build up an explicit model of important entities (people, places, organizations, phone numbers, etc.) and their relationships. Using this model, it helps the analyst find and re-find facts rapidly, notice connections between entities, and identify good documents and entities to explore next. [ABSTRACT FROM AUTHOR]

In the paper we combine a Bayesian Network model for encoding forensic evidence during a given time interval with a Hidden Markov Model (EBN-HMM) for tracking and predicting the degree of criminal activity as it evolves over time. The model is evaluated with 500 randomly produced digital forensic scenarios and two specific forensic cases. The experimental results indicate that the model fits well with expert classification of forensic data. Such initial results point out the potential of such Dynamical Bayesian Network methods for the analysis of digital forensic data. [ABSTRACT FROM AUTHOR]

Access control mechanisms are commonly used to provide control over who may access sensitive information. However, malicious users can exploit the correlation among the data and infer sensitive information from a series of seemingly innocuous data access. In this paper, we proposed a detection system that utilizes both the user's current query and past query log to determine if the current query answer can infer sensitive information. This detection system is being extended to the cases of multiple collaborative users based on the query history of all the users and their collaborative levels for specific sensitive information. [ABSTRACT FROM AUTHOR]

This paper uses centrality measures from complex networks to discuss how to destabilize terrorist networks. We propose newly introduced algorithms for constructing hierarchy of covert networks, so that investigators can view the structure of terrorist networks / non-hierarchical organizations, in order to destabilize the adversaries. Based upon the degree centrality, eigenvector centrality, and dependence centrality measures, a method is proposed to construct the hierarchical structure of complex networks. It is tested on the September 11, 2001 terrorist network constructed by Valdis Krebs. In addition we also propose two new centrality measures i.e., position role index (which discovers various positions in the network, for example, leaders / gatekeepers and followers) and dependence centrality (which determines who is depending on whom in a network). The dependence centrality has a number of advantages including that this measure can assist law enforcement agencies in capturing / eradicating of node (terrorist) which may disrupt the maximum of the network. [ABSTRACT FROM AUTHOR]

Over the past four years there has been a marginal increase in research on developing advanced information technologies that can be efficiently used for national and international security in our war against terrorism. The list of wanted persons who are still free is getting larger, however, in most cases there is a database containing their face images and this can be used in the development of face recognition systems. A human face is an extremely complex object with features that can vary over time, sometimes very rapidly. This paper presents a fast intelligent face recognition system that uses essential face features averaging and a neural network to identify multi-expression faces. A real life application using this method is implemented on 180 images of 30 persons. Experimental results suggest that this simple but efficient system performs well, thus providing a fast intelligent system for recognizing faces with different expressions. [ABSTRACT FROM AUTHOR]

Security of civil aviation has become a major concern in recent years, leading to a variety of protective measures related to airport and aircraft security to be established by regional, national and international authorities. We propose a novel computational approach to checking consistency, coherence and completeness of procedural security requirements defined by aviation security guidelines. To deal with uncertainty, we use probabilistic modeling techniques, combining abstract state machine modeling with symbolic model checking. [ABSTRACT FROM AUTHOR]

While the study of terrorism has expanded dramatically since the 1970s, most analyses are limited to qualitative case studies or quantitative analyses of international incidents only—which comprise a very small proportion of all terrorist events. Until now, empirical data on both domestic and international terrorist events have not existed. We have compiled information from more than 69,000 terrorism global incidents from 1970 to 1997. Most of these data were originally collected from a private intelligence service agency using open-source data. Since we completed coding the original data in 2005, we have been continually updating and validating the data and we now call the Global Terrorism Database (GTD). We begin this paper by describing the data collection efforts and the strengths and weaknesses of relying on open-source data. We then summarize completed research projects and end by listing on-going efforts to better understand the dynamics of world-wide terrorism events. [ABSTRACT FROM AUTHOR]

This is a research note to propose the development of a combating terrorism (CbT)Combating Terrorism is the umbrella concept for anti-terrorism, which is defensive, and countering terrorism, which is offensive. insurgency resolution software that would operationalize and visualize all the processes involved in resolving terrorist-type insurgencies, including metrics for measures of success. Such a computerized CbT application is not currently available in the non-governmental, open source community, so this research note is intended to stimulate the development of such a prototype through collaboration between combating terrorism subject matter experts and software developers. When it is finally developed, the CbT software is intended to guide a user to formulate coordinated and integrated response strategies and tactics, whether at the governmental or analytical levels, to resolve a hypothetical or actual terrorist insurgency using a spectrum of possible responses. Of particular relevance to contemporary CbT concerns, the software program would also have the capability to respond to the spectrum of terrorist warfare, ranging from "conventional" low impact to "unconventional" high impact chemical, biological, radiological, and nuclear (CBRN) terrorist tactics and weaponry.Cyber warfare is another tool in the terrorist arsenal, but this threat is not discussed in the research note, although any combating terrorism tool should have the capability to address it. Once developed as an operating system, the tool's objective is to enable the user—whether in government, law enforcement, intelligence, the military, or the public policy/academic communities—to use it either as an educational and training or operational application in which structured argumentation is used to formulate all the steps and processes involved in planning and executing a CbT campaign, as well as assessing the effectiveness of previous or on-going CbT campaigns in order to draw lessons and applications for future CbT responses. [ABSTRACT FROM AUTHOR]

This paper presents a multi-perspective vision-based analysis of people and vehicle activities for the enhancement of situational awareness. Multiple perspectives provide a useful invariant feature of object in image, i.e., the footage area on the ground. Moving objects are detected in image domain, and tracking results of the objects are represented in projection domain using planar homography. Spatio-temporal relationships between human and vehicle tracks are categorized to safe or unsafe situation depending on site context such as walkway and driveway locations. Semantic-level information of the situation is achieved with the anticipation of possible directions of near-future tracks using piecewise velocity history. Crowd density is estimated from the footage in homography plane. Experimental data show promising results. Our framework can be applied to broad range of situational awareness for emergency response, disaster prevention, human interactions in structured environments, and crowd movement analysis in wide-view areas. [ABSTRACT FROM AUTHOR]

In recent years, terrorist groups have used the WWW to spread their ideologies, disseminate propaganda, and recruit members. Studying the terrorist websites may help us understand the characteristics of these websites and predict terrorist activities. In this paper, we propose to apply network topological analysis methods on systematically collected the terrorist website data and to study the structural characteristics at the Web page level. We conducted a case study using the methods on three collections of Middle-Eastern, US domestic, and Latin-American terrorist websites. We found that these three networks have the small-world and scale-free characteristics. We also found that smaller size websites which share same interests tend to make stronger inter-website linkage relationships. [ABSTRACT FROM AUTHOR]

The Venue-Specific Threat Assessment model has been used by researchers at ICT to estimate the "attractiveness" of specific facilities to terrorist organizations. This paper will explore some of the issues that must be addressed in order to make this threat assessment model more widely applicable. In particular, we will examine the considerations used to generate one of the most crucial components of the model: the threat indices used for determining the dangers posed by terrorist organizations. [ABSTRACT FROM AUTHOR]

In the Internet era, enterprises want to use personal information of their own or other enterprises' subscribers, and even provide it to other enterprises for their profit. On the other hand, subscribers to Internet enterprises expect their privacy to be securely protected. Therefore, a conflict between enterprises and subscribers can arise in using personal information for the enterprises' benefits. In this paper, we introduce a privacy policy model and propose a policy-based privacy authorization system. The privacy policy model is used for authoring privacy policies and the privacy authorization system renders the authorization decision based on the privacy policies. In the proposed system, policies for enterprises and subscribers are described in XACML, an XML-based OASIS standard language for access control policies. In addition, we show the details of how the procedure of the privacy authorization and conflict resolution is processed in the proposed system. [ABSTRACT FROM AUTHOR]

For many government agencies, measuring effectiveness has proven to be extremely problematic. There are several reasons for this, but the manner in which government agencies have implemented the Government Performance and Results Act (GPRA) has not helped. Rather than create a rich suite of appropriate data to support decision-making at all levels of the organization, most agencies have been content to report a small number of high-level outcome measures whose relationship to more effective management is unclear. Despite clear requirements for measures of different types and at every level from specific program activities and products up to societal outcomes, existing GPRA guidance actually encourages agencies to misinterpret what is required. As a result, GPRA performance reporting is now little more than an exercise in satisfying checklist requirements. This paper presents a new approach for developing agency and program appropriate measurement and data schemas to support decision-making at every level of an organization. The approach presented integrates a number of existing management tools, such as Program Logic Models and Activity-Based Costing, and adds a new concept - Outcome-Oriented Activity Impact Measures. Several anti-terrorism functions are used to illustrate the concepts presented. A fundamental premise underlying this approach is that government agencies and programs impact societal outcomes only by performing activities for which there is an expectation of beneficial impact. The paper does not tell any agency what to measure. Rather, it provides a sound approach through which agency managers can identify measures of effectiveness and other data appropriate to their specific programs. [ABSTRACT FROM AUTHOR]

Since the September 11th terror attack at New York in 2001, the frequency of terror attacks around the world has been increasing and it draws more attention of the public. On January 20 of 2006, CNN reported that al Qaeda leader Osama bin Laden had released a tape claiming that a series of terror attacks were planned in US. These attacks and messages from terrorists are threatening everyone in the world. As an intelligence officer or a citizen in any countries, we are interested in the development of the terror attacks around us. We can easily extract hundreds or thousands of news stories of any terror attack incidents from newswires such as CNN.com but the volume of information is too large to capture the information we need. Information retrieval techniques such as Topic Detection and Tracking are able to organize the news stories as events within a topic of terror attack. However, they are incapable to present the complex evolution relationships between the events. We are interested to learn what the major events but also how they develop within the topic of a terror attack. It is beneficial to identify the starting and ending events, the seminal events and the evolution of these events. In this work, we propose to utilize the temporal relationship, event similarity, temporal proximity and document distributional proximity to identify the event evolution relationships between events in a terror attack incident. An event evolution graph is utilized to present the underlying structure of events for efficient browsing and extracting information. Case study and experiment are presented to illustrate and show the performance of our proposing technique. Keywords: Security informatics, topic detection and tracking, event evolution. [ABSTRACT FROM AUTHOR]

Analysis of terrorist social networks is essential for discovering knowledge about the structure of terrorist organizations. Such knowledge is important for developing effective combating strategies against terrorism. Visualization of a network with the support of social network analysis techniques greatly facilitates the inspection of the network global structure. However, its usefulness becomes limited when the size and complexity of the network increase. In this work, we develop two interactive visualization techniques for complex terrorist social networks: fisheye views and fractal views. Both techniques facilitate the exploration of complex networks by allowing a user to select one or more focus points and dynamically adjusting the graphical layout and abstraction level to enhance the view of regions of interest. Combining the two techniques can effectively help an investigator to recognize patterns previously unreadable in the normal display due to the network complexity. Case studies are presented to illustrate how such visualization tools are capable to extract the hidden relationships among terrorists in the network through user interactions. Experiment was conducted to evaluate the performance of the visualization techniques. Keywords: Terrorist social networks, social network analysis, information visualization, fisheye views, fractal views. [ABSTRACT FROM AUTHOR]

Following work of Stroud and Saeger, we investigate the formulation of the port of entry inspection algorithm problem as a problem of finding an optimal binary decision tree for an appropriate Boolean decision function. We report on an experimental analysis of the robustness of the conclusions of the Stroud-Saeger analysis and show that the optimal inspection strategy is remarkably insensitive to variations in the parameters needed to apply the Stroud-Saeger method. [ABSTRACT FROM AUTHOR]

The Department of Homeland Security monitors vehicles entering and leaving the country at land ports of entry. Some vehicles are targeted to search for drugs and other contraband. Customs and Border Protection agents believe that vehicles involved in illegal activity operate in groups. If the criminal links of one vehicle are known then their border crossing patterns can be used to identify other partner vehicles. We perform this association analysis by using mutual information (MI) to identify pairs of vehicles that are potentially involved in criminal activity. Domain experts also suggest that criminal vehicles may cross at certain times of the day to evade inspection. We propose to modify the mutual information formulation to include this heuristic by using cross-jurisdictional criminal data from border-area jurisdictions. We find that the modified MI with time heuristics performs better than classical MI in identifying potentially criminal vehicles. [ABSTRACT FROM AUTHOR]

Grid computing is a kind of important paradigm for networked applications and information technology. Many critical infrastructure applications of our daily life are built on gird systems. Then, survivability becomes a necessary property of grid computing. In dynamic and complex network environment, grid systems face different kinds of attacks, failures and accidents that appear frequently. And At the same time new challenges for survivability arise with characteristics of grid system. To resolve them, we focus on continuous providing of critical mission, which determines survivability of the whole grid system. We utilize PVA, methods of conservation biology, for viability analysis of critical mission and some parameters, which are helpful for predicating viability. Hence, we can achieve survivability of grid system using results of viability. [ABSTRACT FROM AUTHOR]