km solutions for today’s warfighter december 2003 technologies/processes panel technologies and...

KM Solutions For Today’s Warfighter December 2003 Technologies/Processes Panel

Technologies and Processes: Panel 2

Knowledge Management Solutions for Today’s Warfighter

Dr. Darren McKnight, Moderator

Entire Panel 2 Presentation isUNCLASSIFIED


PeoplePeopleProcessesProcesses

TechnologyTechnology

Panel Themes

• Show agile technologies and processes to enhance ability to solve “knowledge management” problems– Do not just throw technology at

the problem: balance technology, processes, and people

• Focus on exploitation (active) of content not management (passive) of knowledge– Proactive deterrence is key objective

• Breakdown your complex problem into simple components and address them individually

Exploit the mind in the loopRight content, to right person, at the right time – in the right way


Knowledge Management FamiliesGOAL: Enhance “Situational Awareness”

Title Functions Performance Metrics

Examples

Data Quality Needs

(Fidelity)

Speed of Response

(Urgency)

Complexity of Logic

(Exceeds One Biological CPU)

Use Storage and Retrieval Low Low Low

Learning Management Systems, resume database, etc

Re-Use Search and Collaboration Medium Medium Medium

Customer Relationship Management, Supply Chain Management, etc

Exploit Consume and Infer High High High

Decision support systems, Progressive Content Exploitation, etc.


Progressive Content Exploitation (PCE)“Content Should Have Velocity Not Position”

• Consume large amounts of content as it becomes more “useful” – Aggregated and relevant

• Content spans data, information, knowledge, and wisdom

• Exploitation is the routing/use of content and inferences from the content– Situational awareness includes context (e.g. intent, heuristics, constraints, etc.)

– Capture user requirements in the same framework as used for content consumption

CONTENT

DIRECTIVESCUESALERTSCOMMANDS

SITUATIONALAWARENESS

DATA

INFORMATION

KNOWLEDGE

KNOWLEDGE

WISDOM


PCE Architecture

Content Ingestion

(of structured content)

Content Extraction

(unstructuredto structured)

Digitization& Translation

PersistentDatabase

(Case Management, Trending, etc.)

Filtering and RankingLink AnalysisTaxonomy DevelopmentClassificationSummarizationIndexingCategorization

Inference Engine

MessageBrokering

CONTENT

Collaboration & Perceptualization(Visualization)

Content Manipulation

Content Flow Tasking


Architectural Components and Solution Sets

ConnectorFramework

ContentIngestion

ContentManipulation

PersistentDatabase

MessageBrokering

PerceptualizationVisualizationCollaboration

InferenceEngine

LinkAnalysis

Filtering

Dig

i/Tra

nsl

Uns

truc

ture

d

Stru

ctur

ed

Site Profiler

ARES AIDNORA

NeatTools

ARES (Attensity Relational Extraction Server) from AttensityNORA (Non-Obvious Relationship Awareness) from Systems Research & Development (SRD)AID (Analytic and Information-based Decisions) from Titan CorporationSDS (Seisint Data Supercomputer) from SeisintPiiE (Professional Interactive Integration Environment) from Digital HarborNeatTools from MindTelSite Profiler from Digital Sandbox, Inc.

SDS

PiiE


Performance Outcome Gap

• Decision process is subjective, ad hoc

• Data fused to create better intel/info products - serial

• Databases – waits to be passed along

• Everybody trying to solve the big problem

• Time between data creation and delivery to user is long

• Manage and distribute information

• Decision process objective, repeatable

• Content consumed to produce customized cues/alerts/directives - parallel

• Content streams – moves fast and smoothly

• Everybody trying to solve a basic problem – architecture facilitates delegation of duties

• Time between content ingestion and assimilation by end user is short

• Monitor and exploit streaming data to detect “significant events”

BEFORE AFTER


Risk-based Decision Making

Bryan S. WareChief Executive Officer

Digital Sandbox, [email protected]

December 2003

Take control of the risks that threaten your enterprise.Take control of the risks that threaten your enterprise.


Overview

• Decision making

• Measuring risks/making decisions

• Systematizing the process with

Enterprise Risk Management


Why risk-based decision making?

• “You want a valve that doesn’t leak and you try everything possible to develop one. But the real world provides you with a leaky valve. You have to determine how much leaking you can afford.”– Arthur Rudolph, scientist who developed Saturn 5 rocket that launched the

first Apollo mission to the moon

• The “Precautionary Principle” meets the budget constraint– Erring on the side of safety exceeds the budget threshold

– Risk is the only way to prioritize

• The Dan Geer Proposition– Provable security is never affordable

– Affordable security is never provable


How do you make hard decisions?

• Decision analysis consists of a framework and a tool kit for dealing with difficult decisions

• The overall strategy is to decompose a complicated problem into smaller chunks that can be more readily analyzed and understood

• Ultimately, one must construct a requisite decision model, that contains the essential elements of the problem and from which the decision maker can take action


What is Risk Analysis?• Society for Risk Analysis Definition of Risk Analysis:

– Risk analysis uses observations about what we know, to make predictions about what we don’t know

– Risk analysis seeks to inform, not to dictate, the complex and difficult choices among possible measures to mitigate risks

– Because decisions about risks are usually needed when knowledge is incomplete, risk analysts rely on informed judgment and on models reflecting plausible interpretations of reality


Business Strategy… an Analogy

Suppliers & Customers

Policies

Strategy

Vision

Objectives

Procedures

• Objectives must be tied to “Desired Outcomes”

• Objectives must be measurable


Threat Analog


Tactics

Goals

Ideology

Loss Mechanisms

Objectives

Attack Scenarios

We’re thinking here!

They’re thinking here!


Security Risk Management Strategy


Policies & Plans

Assets

Mission

Vulnerabilities

Countermeasures & Procedures

Exploitable Loss Mechanisms

We’re spending here

ROI comes from here


What is ERM?

Enterprise Risk Management (ERM) is:

• The systematic, ongoing analysis of threats, vulnerabilities, risks, and risk mitigation measures…– that is tied to the strategy of the organization…– allowing all stakeholders to communicate and share

information in the same language…– and leverage existing enterprise data and external

relationships


The ERM Spectrum


Digital Sandbox Technology


Summary: Systematizing the Process

• Assemble data through an enterprise architecture– People, legacy systems, and intelligence

• Apply content to quantitative methods & models– Process, methodology, and analytics

• Institutionalize through tools and communication– Everyday tools, job aides, interfaces, and information feeds

Anticipation Recognition Evaluation Control Efficiency


Enabling Threat Detection and Prevention


Founded in 2000Based on a decade of research in Computational Linguistics and

Content Extraction : Process Unstructured Content10 patents pending In-Q-Tel Portfolio companyCustomers include:

CIA NSA DIA JIVA Dept of Homeland Security Whirlpool John Deere

CompanyCompany

Attensity Corporation


The Problem

Mountains ofImportant Content

Unstructured Data Buried In Documents

and Databases


and Databases

NewswiresNewswires

Web TrafficWeb Traffic

EmailEmail

NotesNotes011010101010100101001101

011010101010100101001101

011010101010100101001101

011010101010100101001101

011010101010100101001101

011010101010100101001101

Cables

RequireStructured Data

in HighlyGranular Form



Analytical Tools


Closing the Gap



Analytical ToolsMountains of

Important Content

Newswires

Web Traffic

Email

Notes


and Databases

Unstructured Data Are Turned into

Structured Data Automatically

“Relational Facts” are extracted

– People, Locations and Actions

are Connected

Unstructured Data Are Turned into

Structured Data Automatically

“Relational Facts” are extracted

– People, Locations and Actions

are Connected

011010101010100101001101

011010101010100101001101

011010101010100101001101

011010101010100101001101

011010101010100101001101

011010101010100101001101


01101010101010010100100101101010101

01101010101010010100100101101010101

01101010101010010100100101101010101

01101010101010010100100101101010101

01101010101010010100100101101010101

01101010101010010100100101101010101

Unstructured Text Becomes “Relational Facts”

Event Type: Terrorism

Sub Type: Bomb Threat

Potential Bomber: Richard Williams

Arms Dealer: John Glover

Material: C4

Place of Purchase: Cairo

Date of Purchase: Oct. 2, 2002

Surveyed Cairo location for24-hour period with no unusualactivity. 8 known suspectspassed thru without incident. Change of shift occurred at 0800 on 10/2/02. Suspected terrorist, Richard Williams (US Embassy bombing in Nov. 2001) entered premises at 0910. Met with John Glover. Williams left premises at 0954, carrying 2 large containers. After his departure, agents determined that Richard Williams had purchased C4. Recommend analysis of potential bomb targets and continued 24-hour surveillance of whereabouts.


Linguistic Parsing Demonstration


Automatically Feed Downstream Processing

“Susan Harrissold plastic

explosives toFred Waxman

in Cairo.”

Linguistic Parse

Extract specific events / attributes

Relational Extraction Server

TerrorRelationalDatabase

Or - Automatically load into analysis tools


Content Extraction Architecture

TextFoldersDirectoriesDatabasesEmail InboxHTTP address

Knowledge EngineeringWorkbench

(KEWB)

EventDefinitions

Dictionary

Relational ExtractionServer

Content ForFollow-on Processing


Content Extraction DemonstrationFinding Events


Content Extraction Performance

SpeedSpeed Supports automated feeds to tools for link analysis and trending; Produce alerts

RobustnessRobustness Handles abbreviations, Unknown words, Semi-structured data, All Caps Message Traffic, Misspellings, Bad grammar

AccuracyAccuracy Extracts events from free-form text; Ensure consistent, repeatable extraction vs. individual interpretations


Brent JanorskeTechnical Director, Government

Systems(410) 384-7286(703) 245 -6671

[email protected]


George HargenraderDirector Intelligence and DOD Programs

Systems Research & DevelopmentLas Vegas, Nevada

SRD Copyright © 2003

Progressive Content Exploitation

“Relationship Awareness from Systems Research & Development”

Portfolio Company


The SRD Solution

Real-time Identity Management PlatformProvides real-time processing & alerts

Massively Scalable and ExtensibleSupports the ability to model “populations”

Builds an Entity-Centric ViewEntity Resolution™ finds the real “who”

Perpetual Analytics™ and SearchRelationships out to 30 degrees of separation

Provides qualified leads for the analyst!


The Mind in the Loop

Situational Awareness is about contextThe right information at the right time

• False positives will overwhelm you• False negatives will absolutely kill you

Context is about relevance to the situationBased on an Entity-Centric View

• Massive consumption of streaming content• Providing a consistent and coherent view

Relevance is about population modelingDriven by real-time Perpetual Analytics™

• More Data = More Needles• Provides active management of content

You can’t ask all the smart questions all the time !


Non-Obvious Relationship Awareness (NORA)

Coherent, real-time operational picture Across 100’s or 1,000’s of disparate data sources Full accountability, audit trail, and reconcilable

Detects obvious and non-obvious relationships Between people and organizations All data remains persistent

Generates leads in the form of alerts Suspect relationships found in real-time Real-time publish and subscribe

Required before transactional pattern analysis

Entity Resolution™ determines when two people are really the same


Priority #1: Data Integrity

Address Hygiene

Active Data Warehouse

Name Standardization

Data Quality/Enhancement

Entity Resolution

Load

Human ResourcesSystems

Internal Arrests &

Watch Lists

Customer Systems

Vendor Systems


Full Attribution and Temporal Retention

Entity #934256

NAMESSusan MillerSue Miller-ShawSue Shaw

ADDRESSES460 S. Oak Ave.4737 Cimarron Dr.POB 174541101 Princeton #31

NUMBERS(702) 555-2091(916) 342-6721012-34-56785021 1111 2391 1231

RELATIONSSpouse: John ShawRef: Martin ShayRef: Helen BryantRef: Kelly Jones


Entity Resolution

Watch List

Juan M TigarDOB: 07/12/76Alice Springs

ID Card

Joan TigarDOB: 07/12/76Wayland(901) 342-9716


Entity Resolution

Watch List


ID Card

Joan TigarDOB: 07/12/76Wayland(901) 342-9716

Public Records

Juan Miguel TigarWayland(901) 342-9716Previous: Alice Springs


Entity Resolution

Watch List


ID CardJoan TigarDOB: 07/12/76Wayland(901) 342-9716

Public Records



Entity Resolution

Watch ListJuan M TigarDOB: 07/12/76Alice Springs

ID CardJoan TigarDOB: 07/12/76Wayland(901) 342-9716

Public Records



Rules of Engagement

Cannot first mandate upgrades to all source systems– Must not disrupt front line systems; must take the source data as is

Assume and architect for “n” sources and destinations– Cannot reengineer for each new data source or destination

Should not be designed for periodic warehouse refresh loads– Too much data to continue reloading from scratch every month/quarter

Must be reconcilable to sources and destinations– Must be able to conduct audits to verify and ensure accuracy

Must be perceived as a better than source systems– Must be as timely, at least as accurate, and contain a better collective view … or

users will revert to original practices


Analytic & Information-based Decisions (AID)

Brian Crowley

The Titan Corporation

703.758.6522

[email protected]


The Decision Maker Dilemmas

• Repetitive processes

• “Content” overload

• Not necessarily all required content

Real Goal:

Spend more time on value-added problems

Real Goal:

Spend more time on value-added problems


Progressive Content Exploitation“Data Should Have Velocity Not Position”

• Situational Awareness Impacts Decisions– State of influencing factors

change

– Timeliness of notification issues

CONTENT

DIRECTIVESCUESALERTSCOMMANDS

SITUATIONALAWARENESS

DATA

INFORMATION

KNOWLEDGE

KNOWLEDGE

WISDOM

DecisionsDecisions


Basic Decision Making

• Start with a question

• Identify influencing factors

• Determine state of those factors

• Weigh factors against one another

• Decide

HOW: Build a Bayesian Belief NetworkHOW: Build a Bayesian Belief Network


Why a Bayesian Belief Network?

• Multiple Ways to Create Belief Network– Decision Trees, Neural Networks, Expert Systems,

Bayesian Networks, etc.

• Successful System Requirements– Analytic: Repeatable answer with confidence value– Accurate: Validatable– Velocity: Rapid turnaround– Precise: Rigorous content quality– Consolidation: Complex inferencing logic– Autonomous: No manual intervention required


Consistent Utilization ofCognitive Organizational Proficiencies

Step 1:

Define thePrimary Question

Step 2:

Identify theInfluencing Factors

Step 3:

Identify the Statesand RelationshipsBetween Factors

Step 4:

Consume and ExploitContent Streams

Step 5:

Monitor Changes toContent and Output

RefineOver Time


Analytic and Information-based Decisions (AID)

Bayesian Network(abbreviated risk management)

-User-configurable belief network

-Bayesian analysis of probability relationships capture response modes

-Inference model requires structured data gathering but will provide the responsivenesss andrepeatability required for a real decision support system

-Values for multiple actions may be aggregated to account for interdependencies

What is my facility’s risk level?

Mission Effect

Press

Architecture

Labeling/Signs

Org Intent

Threat Envt.

Consequence

Likelihood

Susceptibility

Recognizable

Risk


Program Manager

Opportunity Analysis CompetitionIncumbent

Mature Requirements

Loss Leader

Technical

Number of Personnel

Current Work

Previous Work

Multiple Awards

Schedule

Contracting Office

AID Output

BidNoBidOwnTeam

Opportunity Analysis

Fiscal

Contract Size Pric ing Analysis

Focus

Win Themes

Risks

Technical Schedule

Programmatic

Competiton Assessment

Resources Available

Staffing

Program Manager

Number of Personnel

Other Key Personnel

Proposal

B and P

Proposal Team

Proposal Manager

Writers, Editors, Reviewers

Proposal Room

Management BuyIn

Customer Interaction

LoveHateTalks On OpportunityWork

Previous WorkCurrent Work

Competencies Aligned

Relevant Past Performance

Identified Discriminators

Executed Similar Contract Type

Competitor

Opportunity Analysis Competition

Resources Available Competition

Customer Interaction Competition

Competencies Aligned Competition

Opportunity

ContractDesirability

Performance Location

Incumbent

Mature Requirements

Profitability

Potentia l for Follow-on

Percent Profit

Contract Support

Contracting Office Customer FundingSpecia l Issues

Loss LeaderMultiple Awards

Primary Decision Node Influencer Node Data Stream Node Manual Input Node


Technology and Processes

• AID can produce useful insights when the planning leading up to its use has applied proper decision-making principles– Follow the “Do’s of Decision Making”

• Control the complexity of the decision• Be systematic: have a process – plan, collect, conclude,

make decision, and analyze results• Build your network using the power of threes• Be experiential: verify and validate


Work with applications in a new way. Together.

“The objective of composite applications is to improve corporate performance by improving decision making.

This is accomplished by drawing on the information already available and adding rich workflow, event, and client interface capability.”

- AMR Research

The composite application company

Company OverviewSteve Nguyen

Director, Business Development(703) 476 -7373

[email protected]

mailto:[email protected]


The Need: Getting a Handle on Multi-source Content

• Deliver improved context and situational awareness to the warfighter

• Deliver LIVE correlated information and real-time situational awareness

• Deliver a common operating picture

• Move from stovepiped processes to collaborative operations

• Deliver multi-INT feeds into a single view

Satellite image of Iraq weapons facility Video surveillance of

facility

12 hour weatherforecast

Human Intelligence

Predator feedsThreat database

Multiple audio feeds

http://story.news.yahoo.com/news?g=events/iraq/082701iraqplane&a=&tmpl=sl&ns=&l=1&e=144&a=

http://www.fas.org/news/iraq/2000/07/0041909.htm


Obstacle: Stovepipes Limit Collaboration“Competitive enterprises recognize the benefits of Internet-based computing cannot be achieved

with applications designed fundamentally as isolated and monolithic stovepipes.” -Gartner, 2002

Cost of Problem

Stovepipes

($40B in ‘01)*

Static Interface

($7B in ’01)*Source: Gartner, 2002

Limited Collaboration Results in: Poor decision making

Limited visibility to the analyst of other activities

Limited semantic interoperability between systems

Lengthy, costly, and complex enterprise integration

Traditional Integration

ADMINADMIN

DIMHRSDIMHRS GSORTSGSORTS GTNGTNISRMISRM

INTELINTEL OPSOPS LOGLOG AssetAsset

JTAV


ConnectedApplications

Black Box

Black Box

Black Box

Black Box

Black Box

Black Box

C2 INTEL Logistics

Machine to Machine(Back Office)

CompositeApplications

Interactive UI for Apps, not Docs

A B C DE F G H

I J K LM N O P

R S T UW X Y Z

A B I R A J S T C K Y Z

C2 INTEL Logistics

Human to Machine(Front Office)

Fuse Services into Seamless Apps

“Often, data in one application acts as a key to understanding the full impact of data in another.” - Gartner Group, 2002

What is Required?


Blueprint?

Interactive UI?

Exchange EAI / Web Svcs

Information FusionInformation Fusion Composite SchemaComposite Schema

ConsumptionConsumption Composite UIComposite UI

Automation BPM

Business Infrastructure

ITInfrastructure

Interactive UI?CollaborationCollaboration Composite WorkflowComposite Workflow

Performance App Server

CommunicationCommunication Composite ReportsComposite Reports

PeopleX

ProcessX

Information

Computational Services

Information Services

Transactions+

Performance+

Messaging

People

Plumbing

Where you need to focus: People/Info, Not PlumbingFlexible business infrastructure sits on existing IT infrastructure

http://www.cactuscorner.com/images/plumber4.gif


Application Linking and Embedding (ALE)

Business Ontology with Rich Semantics

Component-based Smart Client for J2EE

•Correlation across heterogeneous information sources

•Business logic by business analysts

•Smarts for coordination (future), traceability (past), collaboration (present)

•Allows correlated behavior

•Allows interactive, networked functionality

•Enables high performance delivery

•“Free” correlation among objects on the screen

•Applications within applications

•Allow navigating in context (w/o changing frame of reference)

Customer

DataBilling

Data

Process :

CSR

Event :

New Cust

Rule :

Over $30KCustomer

DataBilling

Data

Process :

CSR

Event :

New Cust

Rule:

Over $30K

“Ontology capabilities leading to the semantic Web will become a core technology…. By 2005, ontologies will be part of 75 percent of application integration projects….”

- Gartner Group, 2002

Key Innovations

http://www.maximage.ca/img_sm/stress_lego_sm.gif


Cisco 7500

Composite Apps Fuse Content at 2 Levels

Business Ontology

Semantic Connector Framework

Fusion Services

CustomerData

BillingData

Process :CSR

Event :New Cust

Rule :Over $30K

Smart Client:Composite UI

- Correlation- Collaboration- Context

Business Ontology:Semantic Integration

- Federated Schema- Dynamic workflow & rules- Semantic Integration

Business Ontology

Semantic Connector Framework

Fusion Services

Application Users

CustomerData

BillingData

Process :CSR

Event :New Cust

Rule :Over $30K

- J2EE and XML

- Java and XML

JDBC Apps XML Web ServicesJDBC Apps XML Web Services

Heterogeneous Apps and Datastores

AID

CAD

Search Engines

http://www.attensity.com/www/

http://www.attensity.com/www/

http://www.esri.com/index.html


Intelligence Fusion Demonstration


Dave Warner MD PhD


Grok-It Science 101• Seeking to comprehend


Neuro-Cosmology

All Realities are Virtual

---

Consciously Experienced Perceptual State Space


PERCEPTUALIZATIONPERCEPTUALIZATION

What is it?Enhanced capacity to transduce, assimilate and respond intelligently to information in an integrative-multisensory interaction

Why do we need it?Massive amounts of content requires more efficient means to perceive and infer


Apply New Visualization Techniques to Enhance Perceptualization


MILITARY

INTERNATIONALRESCUE COMMITTEE

OTHER RELIEF &BENEFIT ORGANIZATIONS

INTERACTION CARE

DOCTORSWITHOUTBORDERS

SAVE THE CHILDREN

WORLD FOODPROGRAMME

DEPT OFPEACEKEEPING

OPERATIONS

UN HIGHCOMMISSIONERFOR REFUGEES

UNICEF

OFDA / DART

COUNTRYTEAM

CMOCCMOCUNUN

NGOs&

PVOs

NGOs&

PVOs

U.S.GOVAGENCIES

U.S.GOVAGENCIES

ICRCICRC

AMERICANRED CROSSJP 3-57, IV-18

IFRC

Courtesy of LT Randy Myrick

Mission Support Where New Techniques Were Applied


Example Toroidal RepresentationExample Toroidal Representation


• Size• Location• Color• Texture• Offset• Shadow• Shape• Depth• Opacity…

Visualization Dimensions


• Next:

–- Dimensions

– Search terms

– Scaling

– Geospatial

– Key

– Performance

– More…


Apply toroidalrepresentations spatially


Apply Toroidal Representations Temporally


In the Right Way…

As more content becomes available we do not necessarily “know” more

Putting the mind in the loop• Perceptualization• People over technology

km solutions for today’s warfighter december 2003 technologies/processes panel technologies and...

Documents

routinguse of content

content situational

exploitation active

loop right content

todays warfighter

large amounts of content

knowledge management

relevant content spans