Inferring Intent of Attackers

Mailing address:
AI Center
SRI International
333 Ravenswood Avenue
Menlo Park, CA 94025-3493

AIC Program:  Representation and Reasoning

Identifying attacker intent enables us to both prioritize and explain the clusters for presentation to a human intelligence analyst. Our approach is successful at handling alert clusters of up to 20 events and can readily distinguish between causally incoherent false alerts clusters and real alarms. The approach becomes computationally intractable when the number of events exceeds 20 (complexity is O(2n) where n is the number of events in a cluster). Our experiments show that the approach is unsuccessful when benign background activity is as or more coherent as attack activity.

This project is a collaboration between the AIC and Teresa Lunt at PARC.

• Jarvis, P., Lunt, T., and Myers, K. Identifying Terrorist Activity with AI Plan Recognition Technology, in The Sixteenth Innovative Applications of Artificial Intelligence Conference (IAAI 04), AAAI Press, 2004.  [PDF, Details]

©2013 SRI International 333 Ravenswood Avenue, Menlo Park, CA 94025-3493
SRI International is an independent, nonprofit corporation. Privacy policy