Multiple hypothesis tracking for the cyber domain

Stefan Schwoegler; Sam Blackman; Jared Holsopple; Michael J. Hirsch

doi:10.1117/12.893873

16 September 2011 Multiple hypothesis tracking for the cyber domain

Stefan Schwoegler, Sam Blackman, Jared Holsopple, Michael J. Hirsch

Proceedings Volume 8137, Signal and Data Processing of Small Targets 2011; 81370G (2011) https://doi.org/10.1117/12.893873
Event: SPIE Optical Engineering + Applications, 2011, San Diego, California, United States

Abstract

This paper discusses how methods used for conventional multiple hypothesis tracking (MHT) can be extended to domain-agnostic tracking of entities from non-kinematic constraints such as those imposed by cyber attacks in a potentially dense false alarm background. MHT is widely recognized as the premier method to avoid corrupting tracks with spurious data in the kinematic domain but it has not been extensively applied to other problem domains. The traditional approach is to tightly couple track maintenance (prediction, gating, filtering, probabilistic pruning, and target confirmation) with hypothesis management (clustering, incompatibility maintenance, hypothesis formation, and Nassociation pruning). However, by separating the domain specific track maintenance portion from the domain agnostic hypothesis management piece, we can begin to apply the wealth of knowledge gained from ground and air tracking solutions to the cyber (and other) domains. These realizations led to the creation of Raytheon's Multiple Hypothesis Extensible Tracking Architecture (MHETA). In this paper, we showcase MHETA for the cyber domain, plugging in a well established method, CUBRC's INFormation Engine for Real-time Decision making, (INFERD), for the association portion of the MHT. The result is a CyberMHT. We demonstrate the power of MHETA-INFERD using simulated data. Using metrics from both the tracking and cyber domains, we show that while no tracker is perfect, by applying MHETA-INFERD, advanced nonkinematic tracks can be captured in an automated way, perform better than non-MHT approaches, and decrease analyst response time to cyber threats.

Citation Download Citation

Stefan Schwoegler, Sam Blackman, Jared Holsopple, and Michael J. Hirsch "Multiple hypothesis tracking for the cyber domain", Proc. SPIE 8137, Signal and Data Processing of Small Targets 2011, 81370G (16 September 2011); https://doi.org/10.1117/12.893873

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available