1. Enterprise Model Distributed Real-Time Data Mining Advanced Statistical Theory Ranked Hypothesis Active RT Monitoring Confirmed, Rejected Adaptive RT Workflow Programming Distributed Roles, Relations, Work Orders, Flow Management Confirmed Cases

2. Workflow Active surveillance, data mining and statistical learning is a complex real-time workflow problem. The workflow needs to be explicit so that processes are repeatable. It requires Meta-data: input, output, fielding, sequencing process Ontology, threat models and data models for data interpretation and aggregation as each step Adaptive configuration of roles, relations, orders and dataflow Model based feedback to home in on high value targets Ref: Open source ontology-based reasoning on workflow www.isi.edu/ikcap/wings

3. High-Level View Network Analysis

4. Hierarchical Network Views Location Terror Event Fatalities Date Weapon Group Reason (political, religious, …) Victim types (Police, civil., gov.,…) Static View: Long-term statistics Weapon Dealer Financer Account Transactions Sales Location Sale Dates Trans. Dates Group Communication TravelSpatio-Temporal Sequence View: Intermediate-term sequence Location Toll booth events Camera events Tripwire events Ticket Counter events Sensor Network Tracking View: End-game sequence

5. Sense/Act View Location Toll booth events Camera events Tripwire events Ticket Counter events Sensor Network Tracking View: End-game sequence Resource Network View Police resources Fire-fighter resources Military Surveillance Cameras Tripwire sensors Ambulance resources Recon. Municipal Response Tasks Network reconfiguration, New data types

6. Sequence Extraction, Prediction, and Feedback Weapon Dealer Financer Account Transactions Sales Location Sale Date Trans. Date Group Common Sequence Model: Sales, bank transacts., travel, comm. pattern  event Communication Travel Spatio-Temporal Sequence View RT Monitored sequence Prediction Response Task Sequence

7. Sequence Extraction, Prediction, and Feedback Location Toll booth events Camera events Tripwire events Ticket Counter events Sensor Network Tracking View Common sequence (Tracking) Model: Sensor hits, reports, surveillance  event RT Monitored sequence Prediction Response Task Sequence

8. Putting it Together Static View Network - Network algebra (merging primitives) - Copula models (understanding dependencies) - Mining algorithms Static View Network Static View Network Space/Temp Seq. View Network Space/Temp Seq. View Network Common sequences/prefixes - Sequence extraction - Prediction models Prediction Sensor Network Sensor Network Sensor Network Response Resource Network - Real-time models

9. … Data Sensor Static Network Inference & Mining Data Repository Models Multidimensional Index Index Copula Model Fitting Real Time Dynamic Network Analysis Network Control System View Decision Making