InformationFusionwithEntropyandConditionals.pptVIP

Using Maximum Entropy for Rapid Cyber Warfare Deduction and Inference - A Demonstration DARPA IAS Joint PI Meeting 17-23 July 2000 Philip Calabrese, Ph.D. SSC SD The Complexity Problem Need: To calculate logical probabilistic solutions for cyber warfare situations as we do for numerical problems Roadblock: The complexity of uncertain information stands in the way of standard probability calculations arising from even simple situations Solution: The maximum entropy principle defeats ignorance-generated complexity quickly yields the most likely probability distribution Relative (Conditional) Entropy The relative entropy function for probability distribution P given a priori probability distribution Q: H(P,Q) = Si pi log pi/qi pi is the probability according to P of the ith outcome and qi is the a priori probability according to Q of the ith outcome The most likely probability distribution P, given a priori distribution Q is the one that minimizes H or maximizes - Si pi log pi/qi Maximum Entropy Methods Rigorously Bayesian Manages Missing Information Defeats Information Complexity Scalable to Large, Real-World Problems Easily Updated with New Information Easily Incorporates Expert Knowledge Output Easily Interpreted Demonstration of SPIRIT Vincennes Incident (A tense situation) Airplane detected heading straight toward own ship Track origin is an Iraqi dual-use airfield No response to IFF interrogation Distance closing to missile attack range Track elevation is increasing Is this likely to be an attack? Three Cyber Intrusion Sensors Sensors 1, 2 3 respectively monitor a cyber-system for Anomalous Behavior, Misuse and Specification Violations Sensors 1, 2 3 detect 70%, 80% 45% respectively of such Incidents False Alarm Rates for Sensors 1, 2 3 are 0.20, 0.02 and 0.0 respectively Estimate the Combined Detection Rate and Error Rate given such an Incident in the Monitored Area Assume a 10% overall Incident Rate Cyber Terrorism Example Variables Weapons (m