Spotting Suspicious Behavior

As engineers develop faster and more accurate sensors to detect and identify biological agents, government agencies are keenly aware that improved analysis of sensors, or human data can also provide early warning of bio-attacks and shape defensive strategies. To that end, the U.S. Army Medical Research Acquisition Activity awarded Dynamics Technology, Inc.*, a two-year, $729,000 SBIR Phase-II award in June 2004 to build on the success of Dynamics Technology’s Automated Anomaly Detection Processor, also known as the AADP.

AADP is an advanced signal processing technology comprised of neural net clustering, Gaussian Mixture Models and Bayesian analysis that operates on multiple and disparate data sources to identify suspicious events embedded within large, benign backgrounds. The Army contract, sponsored by and managed by the U.S. Army Medical Research and Materiel Command (USAMRMC) Telemedicine and Advanced Technology Research Center (TATRC) at Fort Detrick, Maryland, requires Dynamics Technology to develop a medical surveillance application that provides rapid detection and early warning of outbreaks of infectious disease and biological weapons attacks. The next-generation AADP will provide both military and civilian agencies with a powerful analytical tool to make effective decisions on early disease detection.

Naval Origins – Dynamics Technology is a leading provider of advanced health and environmental surveillance technology. “The AADP’s development was originally sponsored in 2000 by the Office of Naval Research for uncovering surreptitious mine-laying activities in coastal regions for battlefield defense,” said Dr. Joseph Leonelli, Vice President of Homeland Defense at Dynamics Technology. “The scenario was that potential adversaries would embed themselves in a fishing fleet and lay mines to damage American vessels,” said Dr. Leonelli. “The Navy wanted a way to detect this by monitoring the behavior of boats to determine if they were spreading mines.”

There were two major challenges while designing the automated processor, starting with acquiring the data to train the AADP. “We needed to have surveillance data to train on, and that was difficult to obtain. We actually conducted initial processor tuning and testing with high-density Los Angeles Freeway data as proof that the underlying algorithms could detect very subtle anomalies that were imperceptible to a human observer” recalled Dr. Michael Dube, Vice President of Corporate Business Development at Dynamics Technology. Dr. Dube added that, for the Navy application of AADP, Dynamics Technology made use of the extensive ship tracking system developed by the U.S. Coast Guard and a simulated covert operation involving Navy and civilian ships.

The second challenge concerned the operation of the processor. “The human operator had to be able to control the alert rate in order to dynamically manage large amounts of information from multiple sources and match alert thresholds to available prosecution assets,” said Dr. Dube. The executive revealed that Dynamics Technology embedded the details of this control in the processing chain itself.

How Anomalous Is It? – The AADP trains on tracking and surveillance data to identify typical or normal behaviors in the surveillance region. The processor uses three steps to analyze anomalies. First, a neural network-based clustering algorithm is applied to incoming data. Second, after applying the algorithm, the AADP uses Gaussian Mixture Models to characterize its output with a probability function that lets the system do the math to determine whether a new observation comes from normal behavior. The third step is to apply Bayesian analysis, which enables the system to determine the probability that the observation is anomalous based on the previous two steps. “You can use this to monitor your data stream in real time” said Dr. Leonelli. “Give it an observation of a ship moving through the water, and the AADP will tell you in real time whether that observation is anomalous or not, and how strongly anomalous it is, i.e., ‘moderate concern’ to ‘serious concern’. Users can drill down from a user interface into the processor to tell you why the ship is being flagged as anomalous,” explained Dr. Leonelli.

Non-Template Approach - The June SBIR developed from the emphasis on detecting biological terror events given the worldwide increase of terrorist acts and the emergence of unusual disease outbreaks, like the SARS epidemic. Indeed, enhancing disease surveillance is an important defense against biological warfare, whether on the battlefield or in civilian population centers. Rapid detection, identification, and early warning of outbreaks are essential to that effort. “The Army thought the AADP was a novel way of looking at the problem of early warning of biological threats,” remarked Dr. Leonelli, “specifically, because AADP is a non-template based approach, that is, it does not require previous knowledge of the event to work. This fits well with the asymmetric threats of terrorism, things that come out of the blue because they have not been fully considered previously, like using airliners as weapons. The AADP automatically identifies and alerts the analyst of suspicious events.”

Better Sensors, Better Analysis – Dynamics Technology is taking the same general purpose approach to customizing the AADP for the Army as it did for the Navy. “We can apply the processor to any kind of data coming from any type of sensor to train the AADP,” pointed out Dr. Leonelli. “For the Army, we are applying it to medical surveillance data originating from the Washington, DC area. The system will accept and aggregate inputs from a variety of sources, including biosensors and humans, to generate alerts that may not be obvious to medical personnel observing a limited number of patients. For example, medics at a clinic or hospital recording symptoms from patients may not immediately recognize the beginning of a biological weapon strike across the area.”

Dynamics Technology expects to have the bio-surveillance version of the AADP ready for the Army by next June, and its executives noted that it has sparked interest in civilian applications as well. “The Centers for Disease Control in Atlanta are looking for disease surveillance technologies for the nation to provide early warning of the outbreak of infectious diseases,” said Dr. Leonelli. “Also, the military can use the AADP for early detection of naturally occurring disease outbreaks.” Dr. Leonelli commented that as sensor and network technology improves, so will the AADP, “because greater situational awareness and understanding of infectious disease threats and their environment improves data quality and validity, which allows our processor to operate faster and with greater accuracy.”

Drivers – Dynamics Technology’s AADP system has many benefits and applications. Most notable, is its ability to analyze and exploit large amounts of data quickly and effectively. AADP is a flexible and automated surveillance system that incorporates data from a variety of sources, such as biosensors and human input, to generate greater situational awareness of the environment. The automated tool enables users to focus on the nature of the data, and then complete a follow-up with additional sensors or conduct investigations of data analomies.

Hurdles/Restraints: AADP complies with the Health Insurance Portability and Accountability Act (HIPAA) regulations by ensuring patient confidentiality. The surveillance system does not require patient labels and identifications. It has the capability to detect outbreaks of infectious diseases and biological weapons attacks simply by using patient zip codes and demographics such as age, medical conditions, and locations.

Contact Information: Dr. Joseph Leonelli, Applied Signal Technology, Inc., 1555 Wilson Blvd., Suite 703, Arlington, VA 22209-2405
Telephone: (703) 841-0990, Fax: (703) 841-8395

Dr. Michael Dube, Applied Signal Technology, Inc., 21311 Hawthorne Blvd., Suite 300, Torrance, CA 90503-5602
Telephone: (310) 543-5433, Fax: (310) 543-2117

Dr. Jim Kraiman, Senior Research Scientist and Research Manager, Applied Signal Technology, Inc., 1555 Wilson Blvd., Suite 703, Arlington, VA 22209-2405
Telephone: (703) 841-0990, Fax: (703) 841-8395

*In July 2005, Applied Signal Technology, Inc. acquired Dynamics Technology, Inc.