Last week we presented work entitled, “A Systems Dynamics Model of Counterinsurgency in Southern Afghanistan” at the North American Association for Computational Social and Organization Sciences at the Center for Social Dynamics and Complexity at ASU. NAACSOS (which will be changing its name soon to the much more digestible acronym CSSS – Computational Social Science Society) is scholarly society seeking to advance social science through the application of computer simulation and other computer-based methods to the analysis of complex social systems and processes. In a break from our normal conference circuit, there were a small number of presentations focusing on global security issues. The largest percentage of papers addressed developments in agent-based modeling. In particular, the most interesting advance from this perspective involved the integration of GIS technologies and 3-D agents for visualization in agent-based models. Capturing more realistic movement of humans as agents in a model will allow for greater complexity, with particular implications for evacuation and disaster management and planning.

Our paper focusing on Southern Afghanistan was well received and fostered a lively debate. Our presentation related to our work to build a campaign design tool for counterinsurgency and stability, security, reconstruction, and transition (SSTR) operations. In this project we are researching the root causes of insurgency and instability and fusing this knowledge to doctrinal components to find vulnerability points in the insurgent system, modeling the insurgent environment for use by operational commanders in answering what-if type strategic planning and resource allocation questions in the design of campaigns. Our approach supports analysts, planners, and practitioners involved in asymmetric operations by providing operationally relevant information on the relationships between factors driving the insurgency and leverage points identified through counterinsurgency measures, helping to build a more effective campaign design for complex operations.

Integrated Feedback Loops of Instability in Southern Afghanistan:

The main questions that were raised during the presentation revolved around the utility of relying on the Counterinsurgency Field Manual, given its conceptual approach to operations. This is a familiar criticism we have heard regarding the Field Manual, which was released in 2006. Additionally, a major focus of the conference was on validation of models. Given that our model is more of a conceptual framework for critical thinking as opposed to a black box model, that our project is based on qualitative rules from peer-reviewed and authoritative sources, we offered a different approach to traditional model validation requirements.

The most relevant presentation for our work in complex operations was from the U.S. Army TRADOC Analysis Center “Cultural Geography Model Use in Support of Human in the Loop Experimentation”. This project involved developing an agent-based model of a civilian population to determine responses to government and stability force actions in a counterinsurgency environment. The population was based on data from the city of Amara in Iraq. This model was interesting in that the population was the center-of-gravity, to use Clausewitzian terms, rather than more traditional insurgency-focused representations.

An additional paper of interest involved work out of George Mason University focusing on an agent-based model of kinship relationships in Pakistan. This presentation focused on developing a model based on qualitative rules from anthropological research that informs a template for the actual computer code. While this work is still in its early stages, the goal is to enable prediction of alliance formation.

A personal highlight of the conference revolved around the presentation by Zachary Schaffer on “The Foundress’ Dilemma: An Agent-Based Model of Colony-Founding Strategy in Ants”. This research was looking at the phenomenon whereby unrelated ant foundresses (queen ants essentially that found new colonies) can form seemingly altruistic cooperatives with other foundresses in establishing new colonies. In learning about cooperative colony foundation, I was able to tour the various species of ant colonies kept at the Center for research. Satisfying my itch for an ant farm growing up, it was a fascinating experience.

]]> http://milcord.com/blog/2009/10/26/naacsos-annual-conference/feed/ http://milcord.com/blog/2009/10/26/naacsos-annual-conference/ http://feedproxy.google.com/~r/OnIntelligentSoftware/~3/-Hk4ygeVPOA/ http://milcord.com/blog/2009/10/23/phishing-websites-flux-their-way/#comments Sat, 24 Oct 2009 03:01:23 +0000 Alper Caglayan http://milcord.com/blog/2009/10/23/phishing-websites-flux-their-way/ The recent article “Tracking Devious Phishing Websites” in MIT Technology Review reports that 10 percent of phishing sites are using fast flux techniques to hide themselves. ICANN describes fast flux as ‘rapid and repeated changes to host and/or name server resource records, which result in rapidly changing the IP address to which the domain name of an Internet host or name server resolves’. Fast flux is used by botnets to conceal the Command and Control server to foil takedown. Such botnets are used in DDoS, spam, phishing, malware delivery and exfiltration. In particular, the use of fast flux increases the survival rate of a phishing botnet by about 27% as discussed in the Technology Review article.

Over the last 18 months, we have tracked over 280,000 fast flux domain, IP, and nameserver entities, and witnessed the fast flux infrastructures to evolve from nascent to widespread use. Our ACM paper “Behavioral Analysis of Fast Flux Service Networks” compares  the characteristics (e.g. size, lifespan, growth, etc.) of spam, phishing, and malware botnets. Figure below shows the lifespan distribution of fast flux malware (blue), phishing (green), and spam (red) botnets in our current collection. Here the x-axis scale shows the lifespan of an inactive fast flux botnet in number of days. The y-axis shows the number of inactive domains corresponding to specific lifespan measured in days.

In comparison to botnets used for spam and malware, phishing botnets live less than a week. In contrast, spam botnets live up to 90 days whereas malware botnets live up to 30 days.We suspect that phishing botnets receive the attention of brand protection takedown services as they target well-established brands. In contrast, malware delivery and spam botnets distribute their pain across the general population, thus avoiding retaliation.

Current domain and/or IP blacklist approach may be useful for malware delivery and spam botnets as they tend to stay a while. In contrast, such blacklist approaches are clearly inadequate to cope with phishing botnets with a short lifespan. As industry research by Cyveillance suggests that “the majority of the damage caused by phishing attacks is realized during the first 24 hours after an attack is launched”, near real-time detection capability of phishing botnets is imperative.

Semantic annotation defines the domain concepts and relations between concepts. Formally, an annotation is a tuple consisting of annotation (subject, object, relation, and context) as defined in “Annotation and Navigation in Semantic Wikis” by Eyal Oren et al. Our Semantic Wiki for Complex Operations uses Semantic MediaWiki, that allows annotations to a wiki page. For instance the insurgency page has the following annotation:

* has characteristic::Popular Support

Here the subject of the annotation is the ‘insurgency’ concept represented by this wiki page, ‘has characteristic’ is the annotation relation, and ‘popular support’ is the object of the annotation. While Semantic MediaWiki only allows single level annotations of wiki pages and does not formally separate the page and the concept it represents, we think it still serves as the widely adopted standardized semantics syntax necessary for semantic wiki applications to take off.

Annotation clearly introduces an additional burden on the knowledge worker. So unless the return on investment on semantic annotation provides value to the community that the wiki serves, it would be hard to expect widespread adoption. Semantic MediaWiki extensions provide such value. Again referring back to our Semantic Wiki for Complex Operations, the wiki page for each social science data set (e.g. Minorities at Risk Project Dataset, CIRI Human Rights Data Project, etc.) is annotated by using the built-in ‘category’ attribute:

Category: Dataset

That is, each social science dataset in our Complex Operations wiki is annotated to be of category dataset. Clicking on the link Dataset above gives a table that lists currently avaiable social science datasets in our wiki:

In a traditional wiki, this table needs to be manually specified by:

In contrast, semantic annotation enables us to generate this table dynamically using only one statement in Semantic MediaWiki:

{{ #ask: Category:Dataset

| ?title

| ?year }}

As this example illustrates, semantic annotation provides a significant ROI to the knowledge worker in knowledge organization. Moreover, when a researcher adds another dataset to our wiki, this table will automatically include the new dataset, thus improving knowledge maintenance.

The domain. A community of practice is is something more than a social network. “It has an identity defined by a shared domain of interest. Membership therefore implies a commitment to the domain, and therefore a shared competence that distinguishes members from other people”.

The community. “In pursuing their interest in their domain, members engage in joint activities and discussions, help each other, and share information. They build relationships that enable them to learn from each other”.

The practice. “Members of a community of practice are practitioners. They develop a shared repertoire of resources: experiences, stories, tools, ways of addressing recurring problems—in short a shared practice. This takes time and sustained interaction”.

The development of Communities of Practice is the charter of Army Knowledge Online. Here is a paper and related presentation that articulates the thrust in DoD. We are in the process of putting these ideas into practice in our Semantic Wiki for Complex Operations project.

One of the interesting sessions addressed the question: Is a workable peace-building concept possible? Gilles Carbonnier’s paper on the role of non-state actors in resource-rich fragile states in the context of the Extractive Industries Transparency Initiative. The paper defined a set of criteria such as proportionality, non-discrimination, neutrality and independence for humanitarian assistance to differentiate from development assistance. Although indicators for these metrics are sparse, the provincial distribution of economic aid can be effectively used a proxy for measuring these metrics. Thomas Biersteker’s paper on peacekeeping in theory and practice gave a nice overview of the process in building the UN Peacebuilding Commission (UNPBC), which was created to address gaps in the global response to armed conflict and conflict recurrence. The commission’s charter is to  support fragile societies recovering from the devastation of war within two years after the cessation of hostilities. Since its inception in 2005, UNPC has disbursed about $250M of funds mostly in African countries.

Our paper on rumors presented by Dr. Karen Guttieri was received well and generated several questions. Rumor - information that is unsubstantiated yet widely shared - is rife during social conflict. In this paper, we analyzed rumors reported in The Baghdad Mosquito after the United States-coalition invasion of Iraq in March 2003, and mapped rumor types against public opinion polling and timeline of events that includes both insurgency and inter-sectoral conflict. Our paper shows that rumors have the potential to develop actionable cultural intelligence. The analysis of rumors can identify specific concerns and fears of a population that explain behavior and affect local cooperation with US counterinsurgency efforts. Furthermore, rumors can be used to assess foreign public opinion and measure the effectiveness of a hearts and minds campaign. While we have focused on Iraq, the concept of incorporating rumors as an intelligence source is applicable to virtually any country as long as the content analysis and rumor remedies are tailored for the culture in which they occur.

Peter Kotzian’s paper on social norms analyzed the importance of macro and micro level variables allowing the individual to change its beliefs about whether a particular norm is still valid or not. The empirical findings based on survey data from 24 countries show that there are no effects of social trust on norm compliance. What makes people comply with norms is not blind trust but the belief, based on information, that the norm is still effective; hence, it is rational to comply. David  Westlund’s paper on rational belief changes for collective agents was an interesting formal model to study the emergent collective beliefs from the belief systems of individual agents. This model shows that the collective must believe exactly the same as at least one of its members. Dörte  Dinger’s paper analyzed partner perceptions in German-Italian bilateral relations by studying the press coverage of the incident created by Berlusconi remarks.

Let’s start with the poor design that forces the applicant to use a rich client to cram each form and attachment into a single document. I guess it must have been designed when the majority of users were using dial up. Initially this client was a PureEdge Viewer, which was a clunky application. The replacement of PureEdge was applauded in the research community. Recently, grants.gov replaced the PureEdge form with an Adobe Reader form, which is - sad to report - even worse. If you update Adobe Reader, you will lose all of the attached forms you filled. The application generates a single pdf file for submission but insists that you submit the document through the Adobe application, which does not work.

Why can’t the user upload the final document??? Why can’t grants.gov review the best practices in the government like DoD proposal submission systems and emulate it? Why can’t grants.gov develop a Web based system?

Such a poor design will generate a huge amount of customer support calls. It does. The caliber of the support folks is not capable of resolving these issues. You get canned responses like try resetting your password. If you do, you get hung up in ether because of the heavy volume of use. If you want to speak with someone who is technical, good luck. Tier 2 support takes 2-5 days response.

If we were in the minority in such criticism, it would have been unfair to call grants.gov incompetent. Alas we are not. Just look at the posts at grants.gov blog. Here are some recent posts. Here is another. Here some academic workaround suggestions from Berkeley, Ohio State, Michigan Tech, Clemson, University of Michigan. OMB Director is quoted as saying that grants.gov is a casualty of increased usage. It is sad that agencies are using a system that is light years away from state of the art to seek innovation.

Joe Watts of AGC lamented the lack of GIS support in the HSCB projects, and urged the development of HSCB map symbology for transition to the warfighter. Dr. Lisa Costa described the use of POET (Political, Operational, Economic and Technical) relationships in social network analysis, and the importance of developing a social radar for HSCB analysis. In his concluding remarks, Dr. Robert Foster challenged everyone to think about solutions for the professional training of HSCB domain.

We participated in a poster exhibition and gave three presentations: first, a general overview of our Semantic Wiki for Complex Operations project; second, the knowledge management needs of  the complex operations community; and, third, open source social science data repository for HSCB research. Our presentations were received well and generated several questions. In particular, a number of attendees expressed the suitability of our wiki supporting the training of complex operations professionals. There was also an interest in our social data repository supporting legacy data and automating the ingestion of new data.

There were too many interesting presentations to cover every one. Dr. Sean O’Brien gave an overview of his Conflict Modeling, Planning, and Outcomes Experimentation (COMPOEX) program. The precision and recall performance of the lead contractor Lockheed Martin’s system based on Ada boosting of multiple social behavior models was fairly impressive. Dr. Barry Silverman’s agent based model CountrySim - one of the models in the Lockheed Martin system - was one of the models contributing to the high performance. In terms of data collection, Prof. Mansoor Moaddel’s values and attitudes survey for Afghanistan, Iraq, Iran, Saudi Arabia, Jordan and Egypt was particularly interesting.

CDR Dylan Schmorrow put the state of the art in human social culture behavior models into perspective by comparing the HSCB models to models for weather and economic forecasting. The maturity of weather forecasting models is higher than those for economic forecasting. On this scale, CDR Schmorrow positioned HSCB modeling on the x-axis while hoping the HSCB program serving as a catalyst to ignite HSCB modeling into a steady march towards maturity.

As a research assistant for The Inheritance: The World Obama Confronts and the Challenges to American Power, a book by David E. Sanger, Chief Washington Correspondent for The New York Times, I had the opportunity to dive deep into issues ranging from Chinese military modernization to cyber-security to the Iranian nuclear program. My research took me into the Pakistani nuclear establishment and the militant threat emanating from the tribal areas to the post-invasion environment in Afghanistan and the personalities shaping the debate on counterinsurgency in the post-9/11 world. 

The democratization of technology involving nuclear materials, cyber-attacks, and biological agents, has provided non-state actors access to weapons that were previously the purview of states. The multifaceted nature of these complex issues will require greater interagency cooperation and knowledge transfer, in particular in the civil-military field. Securing the homeland from the threat of radiological weapons will require a robust intelligence effort abroad to root out shadowy networks dealing in such materials, such as those of A.Q. Khan, increased focus on securing at-risk facilities in Russia and the former Soviet states through initiatives like Cooperative Threat Reduction, and increasing collaboration between the scientific community and government entities such as the Domestic Nuclear Detection Office to bring cutting edge research and technology to the detection of radioactive materials crossing our borders. 

In the cyber-security realm, bolstering public-private partnerships between government entities such as the military and intelligence community, and corporations, financial institutions, and public utilities, often the targets of cyber-attacks, will be important in developing detection and response capabilities and formulating comprehensive rules of engagement. In addition to the military component of COIN operations, civilian teams specializing in security-sector reform, judicial and political affairs, economic development, and infrastructure, will be operating in the battlespace to bolster host government legitimacy, the center of gravity in the campaign. Given the shared responsibilities in the civil-military field on these issues, fostering knowledge integration and cooperation between the various branches of government, military, and civilian stakeholders is of paramount importance to ensuring unity of effort. 

The Inheritance is a researched-backed analysis of the challenges we currently face, a legacy of the opportunities missed after 9/11.  While I may be biased because of my involvement with the book, I strongly recommend it to anyone interested in understanding the challenges confronting Obama and the complexities of the geopolitical environment. 

A logistics contractor posed the question: “I love your risk based route planning system. I wish we had a system like this. Most logistics material are carried by private subcontractors like us (under contract to a Prime like Mersk) in Pakistan and Afghanistan. Even if the Army has this system, it won’t do us any good.” It was an interesting question that shined a light on the lack of information sharing between DoD and second /third tier military contractors in the supply chain, and generated a nice discussion among attendees.

Another interesting question on our presentation was the concern about the predictability of a route. Minimal distance routes are deterministic and pose a security risk because they can easily be determined by the adversary. In contrast, minimal risk route is not deterministic (changes with events on the field), which gives a better protection against predictability by the adversary. The risk surface (computed per road segment) changes with every incident, intel report, weather, traffic, etc., which, in turn, affects the route minimal risk route.

Another question: “If a bridge is blown down the road, how long does it take the Urban Resolve data set to update itself? ” This is an issue that even commercial COTS GPS tools struggle with random events like road closings due to construction. Our current solution gives a manual workaround for such conditions by letting the user define an intermediate way point and  dragging the route away from the bridge. Crowd-sourcing can also help address this issue by arming users with power to dynamically update road availability by adding road blocks on their GPS units.  Crowd sourcing also brings about data integrity issues in that user specified changes would not be put into the database as every soldier would have a different viewpoint.

There were several other interesting presentations and exhibitions. Dr. Irene Petrick’s talk on Digital Natives and 4′th Generation Warfare generated an active interaction with the audience.  She presented survey results that compare the value systems of Traditionals, Baby Boomers, Gen X and Gen Y, articulated where Digital Natives can add value to warfighting, and pose challenges organizational management. On the gadget front, Safe Ports demoed an eye scanner  based on infrared so it even recognizes you through your sun glasses.

About Milcord: Since 2003 Milcord has been delivering knowledge management technologies and solutions for a range of applications including cyber defense, human and social modeling, geospatial intelligence, and information management. Milcord’s federal customers include Air Force Research Laboratory, Office of Naval Research, Army Research Labs, Army Geospatial Center, Office of Secretary of Defense, Department of Energy, and NASA.  For more information see www.milcord.com.