11.11 Incremental Composites

To outline the visionary capabilities of this EVS, picture the following scenario: An investigative analyst identifies a group of suspects as possible perpetrators. The EVS searches the multiple government and commercial databases that it has direct access to and develops some working hypotheses about what makes these individuals similar to one another and different from most other people in the general population. Next, the EVS profiles other individuals with very similar patterns of behavior and data attributes and asks the analyst if these persons are possible perpetrators. The analyst examines the records of the individuals and finds that only a few of the selected group are in fact criminals; the analyst communicates this information to the EVS.

The EVS proceeds, moving on to test information in more expensive databases and asking the analyst a few, more refined questions. Finally, EVS generates a diagnostic procedure for identifying possible perpetrators. The analyst looks at the rules and sees that the EVS has discovered a set of signatures in calling patterns and financial transactions that had not previously been associated with this type of crime. The diagnostic procedure is set up to run as a background job, looking through the databases. Whenever the EVS finds someone suspicious, it initiates more active diagnosis, perhaps asking additional questions from investigators or calling for additional data collection. Through this incremental learning process, the EVS refines its profiling process under the tutelage of human experts refining new rules continuously.

For example, in profiling, say, a suspected smuggler, the EVS might first check internal government databases, such as citizenship, type of license, travel data, or passport. If those data had certain values, then the procedure would call for gathering more external and expensive data, such as financial, real estate, and credit information. In this context, a profile can include several data dimensions such as behavior, property, nationality, planes, financial transactions, cartels, cells, bombs, targets, and criminal records. These objects are mapped graphically, as we found out in Chapter 3 on link analysis, as are properties and relations for these profiles:

      entity_narco-trafficker(Antonio_Diaz),      last_seen (Antonio_Diaz,Juarez_6/12/2001),      ownership(Antonio_Diaz,LadiesBar,                KentuckyClub,Submarine),      citizen(Antonio_Diaz,Mexico),                bank-transfer(Antonio_Diaz,                BofA_account-00801287,MexCom_account-004453,                $1,500,000,11/10/2002).

Such representations are crucial for profiling via an EVS, but they add significantly to the complexity of learning. In a conventional attribute-vector representation, all of the possibly relevant attributes are enumerated and the set of possible hypotheses is large, but clearly circumscribed. In a relational representation, arbitrarily long chains of information and complicated networks of relationships may be relevant for learning and profiling.

The EVS will be required to capture complex, time-varying patterns and features of individuals. Existing data mining technologies can be divided into two general types: local neural networks and machine-learning algorithms. Local search algorithms, such as neural networks, start with an initial random pattern representation and incrementally make adjustments to recognize signatures in the data, while machine-learning algorithms start with a null pattern and gradually refine, elaborate, and segment a data set to improve its predictive power. The EVS will require a mixture of both of these top-down and bottom-up algorithms to discover complex patterns. In the end, the EVS will combine the best features of human knowledge and data mining algorithms and their brute-force ability to crunch data for converging on a profile solution.