ANOMALIESBolstering Security by Detecting Hidden Anomalies

Whenever an unexpected natural or human-driven event occurs, the movement before and after that event tells a story. Most people flee the areas of natural disasters and terrorist attacks, while first responders move in. Disruptions to roads, bridges, or critical infrastructure elements create traffic and cause people to re-route. A rise in civil unrest changes the daily pattern of life as health and basic needs are prioritized over work and recreation. Often the disrupting events themselves are not directly observable, but an understanding of the surrounding movement anomalies can inform timely response and analysis.

The ability to assess these deviations from expected movement requires a deep characterization of normal activity across times of day, days of the week, weeks of the year as well as across different types of people. But while current human mobility modeling techniques can provide high-level insight into human movement for the study of disease spread or population migration, they don’t provide the complex, fine-grained modeling the Intelligence Community (IC) needs to identify more subtle anomalies with confidence. 

IARPA’s Hidden Activity Signal Trajectory Anomaly Characterization (HAYSTAC) program aims to resolve this issue by developing novel capabilities that utilize Artificial Intelligence (AI) to learn the characterization of normal movement and alert when deviations are identified.

“There is already so much geospatially-tagged data being created, and as time goes on, even more will be added,” said HAYSTAC Program Manager, Dr. Jack Cooper. “This is an unprecedented opportunity to understand how humans move, and HAYSTAC’s goal will be to build an understanding of what normal movement looks like at any given time and place.”

HAYSTAC’s primary technical challenge is the lack of datasets with ground truth to train and test anomaly detection algorithms. To address this, HAYSTAC will create large-scale microsimulations of background activity and associated movement. It will then have one group of performer teams insert specific movement activity into the simulation, while a second group of performer teams will attempt to separate inserted activity from the background activity.

By competing multiple teams against each other to either insert or identify movement that is not a natural part of the HAYSTAC simulated city, the performers will have created datasets with anomalies that are hard-to-find, but still known to the competition’s facilitators. This will help the facilitators evaluate which modeling approaches are truly the best at modeling what is normal and what is anomalous.

What this means for the IC is that HAYSTAC will provide capabilities that can be trusted to sharply capture the normal expectation of movement. “While bringing HAYSTAC to fruition will be a multi-year process, once it’s complete, we’ll have reframed how we look at activity in the world,” Dr. Cooper said. “And it won’t be a static concept of where things are on a map, but a dynamic one based on how they’re moving and what’s out of the ordinary.”