DANDE: deductive anomaly detection with program synthesis

"Deductive methods are applied to detect qualitative anomalies that mayact as predictors of terrorist attacks. Diverse online informationsources are coordinated by specifying their capabilities in a logicaltheory. Symbols in the theory are linked to procedures that canconsult the appropriate sources. Norms of expected behavior are alsoexpressed in the logical theory. An automatic inference systemcontinuously seeks contradictions in the theory, each of whichcorresponds to an anomaly. A witness-finding mechanism allows anexplanation of each anomaly to be presented to the human analyst.The same apparatus can be used to answer queries. The negation of thequery is asserted as a fact. If a contradiction to that fact isinferred, that can be used to answer the original question.If a norm is expressed too loosely, an abundance of false positiveswill suggest that it be phrased more precisely, which can be donewithout reprogramming the system. If detecting an anomaly requires asignificant amount of database operations, an SQL program will besynthesized that performs those operations.The proposed system combines software for theory composition,deductive inference, and agent brokering, unified by the Specwaresystem. Commercial applications exist for fraud detection andcorporate security. A group of proven and nascent technologies will be integrated to build theframework for constructing a family of highly automated anomaly detectionsystem