RADAR: Risk Assessment of Disclosure via Automated Reasoning

ABSTRACT: We propose a comprehensive Risk Assessment of Disclosure via Automated Reasoning (RADAR) system. This system will leverage and advance various theoretical models in statistical inference (e.g., probe selection and posterior estimation) and information theory (e.g., entropy approach) to obtain a set of analytical tools for information disclosure analysis. These tools are integrated into a practical framework for agile, adaptive and yet general quantitative disclosure risk measurement for targeted applications. Our approach will apply to information disclosure, via information sharing or over malicious or accidental covert channels, with different types, formats, and security levels under various targeted applications. We will design, implement and test methods for automatic categorization of information according to the type of anticipated risk that will be quantitatively assessed. The proposed system will provide automated support for identifying, categorizing, quantifying, and reasoning of information disclosure risks by taking into account cumulative risk due to aggregated disclosure in a sequence of releases and the contextual information that enables domain-specific inference. We will develop practical software tools to automatically compute disclosure risk for each disclosure event with near real-time implementation. We will evaluate the performance of the proposed framework and the developed software tools using realistic information disclosure applications and demonstrate the effectiveness of our system for automated assessment of disclosure risk. BENEFIT: The proposed effort has tremendous application potential in military and commercial information systems to provide improved automated risk assessment for variety of information disclosure events. The proposed technology, RADAR, promises significant step toward automation of risk assessment over distributed systems with different information disclosure types and content. RADAR provides automated risk monitoring tools to strengthen privacy-preservation systems. Such tools are directly beneficial to various information systems with respect to intelligent information disclosure evaluation, information privacy and confidentiality through risk reasoning, and prevention of leaving secret data through risk aggregation. This effort also applies to commercial organizations and homeland security. An important group of commercial applications will be social networking privacy management and distributed cloud information protection, where our technologies can be used for assessing the risk of implementing new privacy rules or releasing information of the users with respect to their personal information violations and the applications"cyber security. RADAR has applications and transition opportunities in AFOSR Dynamic Data Driven Applications Systems, Information Operations and Security, Systems and Software, and Trust and Influence programs, Navy Data to Decisions (D2D) program, DARPA SMISC and xDATA programs.