1.  H cr(H ) Applied Mathematics Operations Research Simulation Science Computer Science

2. © 2010 All Rights Reserved Who Are We? Small, established scientific consulting firm – ~150 employees – Founded in 1982 Headquarters in Reston, Virginia – 20 miles from Washington, D.C. Employing many mathematicians – Ph.D. and undergraduate – To solve challenging, technical problems – For clients in the Defense and Intelligence communities Metron Proprietary – 2 2

3. © 2010 All Rights Reserved What kind of undergraduate background is useful for working at Metron? Computer skills – Java or C++ Writing skills Mathematics – Linear algebra – Probability and statistics – Any course that contributes to mathematical maturity

4. © 2010 All Rights Reserved Exposing Terrorist Networks Use ideas from classical detection theory to determine presence of terrorist cells in a network Metron Proprietary – 4 Noise Process Signal + Noise Process Likelihood Ratio: optimal statistic for deciding whether a graph J arose from signal + noise process or noise only  H (J) = P(J | ) P(J | + )

5. © 2010 All Rights Reserved Network Detection: A Sample Theorem Metron Proprietary – 5 …… …… m “ movies” n “ actors” Unipartite Projection: who’s acted with whom independent links, average of m per actor instance of B * Random Collaboration Model: B * (n,m, m) Kevin Bacon game: connect “actors” in same “movie” Yields realistic network model (high clustering coefficient, etc.) Theorem [Lo, Ferry]: For m, n → ∞ with constant m, the expected number of subgraphs of B * (n,m, m) isomorphic to H is given by H represents a threat activity obscured by noise model B * Formula used to detect whether H arises by chance or by design Example of Theorem Let H be v´(H) = 8 = number of non-isolated vertices of H r(H) = 7 = rank of H c(H) = 2 = number of cut vertices of H Break H into blocks at cut vertices Stirling numbers count partitions of b i blocks into s “movies” Ratio of expected to possible number of H ’s is b 1 = 3b 2 = 2

6. © 2010 All Rights Reserved Pattern Analysis and Link Discovery Tool for Networks (PALADIN) Components Metron Proprietary – 6 Customize extraction of entities and links, with attributes, from data Statistical analyses of numerous social network metrics to discover entities and groups with anomalous properties Subgraph matching to discover threat signatures Connect related signatures to detect organized threat networks and activities Entity-Link Extractor Network Anomaly Detector Network Pattern Matcher Network Visualization and Exploration Tool Drill-down into and compare discovered networks Functions and features to control display layout and information fidelity Group Detector Hierarchical clustering algorithms to detect groups of interconnected entities