ACCESS: Automated Comparison and Clustering of Entity Signatures

Available features to detect personas vary depending on the type of intelligence one is observing, and only facets of a persona are observable in each medium. New and enabling technology needs to be developed to search, capture, compare and identify disparate behaviors that may represent personas of interest. In response to this challenge, 21st Century Technologies proposed the Phase 1 Automated Comparison and Clustering of Entity SignatureS (ACCESS) effort to develop a novel similarity measure enabling comparison and detection of threat personas as they evolve over time. Our approach provided very promising results, as it was able to correlate activity patterns of known threatening entities and successfully identify over 90% of the entities in unlabeled data. For the Phase 2 effort, ACCESS will provide new and innovative tools to signals intelligence operators by providing the ability to recognize appearances of similar networks and match networks across disparate data sources, and to categorize the networks based on threat level. Our solution will improve the current operational environment by producing a similarity measure that can be used for multiple intelligence data types, so that behaviors of interest can be recognized in various scenarios and threatening entities understood in a more comprehensive manner.