Case-Based Behavior Signatures for Prediction of Adversary Behavior

We propose the development of a software system to assist analysts with the process of characterizing, monitoring, and predicting adversary behavior. We adopt a case-based approach to the representation of behavior signatures. Based on a variety of possible activities and processes, created by analysts with a visual tool and maintained as a library of cases, the system will monitor intelligence streams for recognizable activity. The representation of a signature, which relates actors to collections of these cases, will be sensitive to the novel attributes of asymmetric adversaries, including decentralized, networked organizations, and non-attritional effects-based operations. Case representation will allow the use of case-based reasoning algorithms to form partial matches to observed activity, providing threat classification and prediction with a quantifiable level of certainty. Furthermore, relationships between cases can yield patterns of broader scope than individual acts: operational cycles, attack campaigns, patterns of methods or targets, and trajectories of adaptation. We will demonstrate the feasibility of the approach on a selected domain.