UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

(U) Improved Fusion Algorithm System

John Merrihew

Thomas Bevan, Ph.D.

June 2016

(U) 1.0 Summary The objective of the Improved Fusion Algorithm System (IFAS) technology

demonstration program is to develop advanced stochastic risk assessment technologies

for information fusion in Associate Systems. The program is in Phase II of am OSD

SBIR and has developed approaches for detecting and localizing OPFOR Tactics,

Techniques and Procedures (TTPs) such as IED emplacement, VBIED emplacement,

Ambush and Complex Attacks. IFAS fuses data from several sources including GMTI,

GMTI MASINT, text reports and chat room conversations. IFAS demonstration systems

have successfully yielded quantified risk assessment fusion that was both transparent and

understandable for the operator.

(U) 1.1 Abstract

The objective of the Improved Fusion Algorithm System (IFAS) technology

demonstration is to develop approaches to apply advanced stochastic risk assessment

technologies that are currently in use in the financial industry by embedding them in an

Associate System. The IFAS demonstrations combined Associate System technology

that already had a robust topological GUI and net-centric presence with advanced

statistical methods. The selected application involved risk assessments for OPFOR

insurgent emplacement of Improvised Explosive Devices (IED), Vehicle Borne

Improvised Explosive Devices (VBIED) and Ambushes as well as to provide a forensics

capability for tracking IED triggermen and observers in the OPFOR IED cell. Interactive

Associate Systems have been used to support human military decision makers in many

contexts (e.g. pilots associate) but until now Associate Systems did not provide a

quantified expression of risk to the operator based on objective data. An Associate

System is a knowledge-based artificial intelligence system that analyzes data available to

the operator and makes recommendations as to alternative courses of action. Veloxiti had

previously developed an existing Associate System for Army units which provided a GUI

which displayed an Area of Interest and could display net-centric information such as the

monitoring of key words from chat rooms, and the position and disposition of ground and

air assets.

The financial industry has developed stochastic statistics to calculate the risk of

loss from holding securities or holding a particular portfolio. The most advanced

statistical approaches calculate “Conditional Value at Risk” (CVAR). The IFAS

demonstration was intended to adapt these advanced statistical approaches for risk

assessment in order to support the military operator.

IFAS provides the capability to analyze large amounts of Ground Moving Target

Indication Radar data and fuse it with other data. This would be tedious task for the

human operator. GMTI data is used to track known insurgents as well as to perform

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

MASINT analysis of speed and direction. The quantified risk and location of OPFOR

Tactics, Techniques and Procedures (TTP) is conveyed to the operator in a way that

provides transparency and understandability. Rather than use statistics variables which

are hard to intuit, a 0-200 risk assessment is provided. Transparency and

understandability are important in order for the operator to accept and have confidence

the Associate System and the algorithm results. Likewise, the risk that moving vehicles

contained triggermen or observers in the OPFOR IED cell is calculated based on distance

from the IED blast and the time since the IED blast. The CVAR risk statistics is added

together to provide a risk assessment. The risk for each vehicle is conveyed to the

operator.

IFAS technologies are suitable for not only ground applications but also airborne,

naval and littoral applications. As we move Phase III we are looking for support to

increase IFAS Technology Readiness Level (TRL) which is now estimated at TRL 6.

2.0 (U) Introduction and Objectives (U) Improvements in remote sensing technology and the increase in remote sensing

platforms have drastically increased data flows within the net centric system. These data

flows contain important operational risk information but the data far exceeds the human

capability to extract this risk information in near real time. Having the capability to

analyze these data flows would increase the operational utility of the sensor collections.

(U) In particular, ground moving target radar (GMTI) data is collected nearly

continuously across the battlefield. The primary JSTARS system has been augmented

with GMTI sensors operating various aircraft and on drone platforms. Data from GMTI

systems are used for such tasks as convoy oversight but most of the data cannot be

analyzed because of its volume. GMTI corellators are in development to provide data

streams that include all of the GMTI assets. These corellators also deconflict and track

detected target vehicle.

(U) The United States military is engaged in conflicts with insurgents in many areas

of the world. Indications are that the U.S. will have to deal with insurgent warfare into

the foreseeable future. For this reason, near real time detection and alerting of insurgent

TTPs (techniques, tactics and procedures) is of interest. Typical insurgent TTPs include

improvised explosive devices (IED) used for roadside attack, ambushes and vehicle borne

improvised explosive devices (VBIED). There are several common ambush formations

which are taught by the world’s military and used by insurgents. The V formation is the

most common with the apex of the V pointing towards direction of travel. This formation

allows vehicles and personnel to be blocked by the apex of the V with good fields of fire

for attackers. Also of interest are warnings of complex attacks that, for example, involve

both ambush and VBIED. In this case the VBIED is positioned near the apex of the V to

destroy or disable friendly vehicles that also block the direction of travel.

(U) In addition to the need for near real time warnings of insurgent TTPs, U.S. forces

would also like to improve forensics analysis which seeks to track attackers as they flee

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

from engagements. This is particularly important for insurgent attackers because they

can otherwise melt back into the local population. Some non-real time GMTI forensics

is currently conducted, but it is time consuming and takes several months for results. By

that time, attackers may have moved to other areas or other safe houses.

(U) Associate Systems Technology (AST) was developed to aid pilots to deal with the

large dataflows on modern combat aircraft. The technology can analyze available data to

provide users with findings and recommendations on alternative courses of action. For

this reason application of Associate Systems Technology could be a valuable asset to

help human operators manage land, air, water and littoral battlespaces. AST automates

Boyd’s OODA loop decision-making process as shown in Figure 1. The loop starts in the

upper right corner with “observe” in which sensor and other data is collected.

Figure 1. (U) Boyd’s OODA Loop

(U) Figure 2 shows how the OODA loop is implemented in AST systems. On the

observe-orient side to the left, sensor data is organized into belief networks which orient

the system. Once the AST system finds a belief of interest, it provides alternative plans

and feedback on actions.

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 2. (U) Implementation of Boy’s OODA loop in Associate Technology Systems

(U) The technical objectives of the IFAS Program are two fold:

Adapt stochastic methods to AST belief networks.

Demonstrate GMTI MASINT detection of insurgent TTP and forensics.

(U) Prior to IFAS, Associate Systems Technology based its belief and decision networks

on subjective opinion, whether through deterministic or Bayesian links. The goal of the

IFAS program was to adapt stochastic techniques to be used in AST networks.

Specifically, statistical approaches that have been developed in the financial industry to

assess stock price and portfolio risk to assess the risk of TTP. The stochastic approach

from the financial industry that was used is called Conditional Value at Risk or CVAR.

CVAR statistics are particularly useful for assessing values at the extremes of stock price

distributions as shown in Figure 3. This figure shows the difference between two

distributions (normal, t-distribution). The values of percentiles at the tails are sensitive to

the exact distribution involved. The IFAS program developed a statistic called Q* which

is the reciprocal of the observed percentile. This provides a useful statistic which

increases with risk and has other useful properties. For example, to adapt CVAR to

GMTI vehicle speed data where very slow vehicles may be carrying IED munitions, we

calculated the Q* score for the percentile of the observed value. As the speed of the

vehicle decreased, the risk of that vehicle carrying IED munitions decreased in terms of

Q* score.

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 3. (U) Importance of CVAR for Distribution Tails.

Figure 4 summarizes the useful properties of CVAR for AST.

Figure 4. (U) Summary of CVAR Advantages

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

The objective of the IFAS program was to demonstrate that stochastic methods could be

integrated into AST to conduct MASINT analysis of GMTI data. The goal was to use

stochastic methods to analyze speed, direction and position of vehicles as detected by

GMTI. These methods were used to detect IED, ambush, VBIED and complex attack

TTPs as well as to provide forensics intelligence. An IFAS prototype was developed and

demonstrated in two scenarios involving these TTPs. This adaptation of stochastic

methods for AST.

3.0 (U) Scenario Demonstrations

(U) In Phase I of the IFAS SBIR Phase II a prototype was constructed and demonstrated

on two scenarios so far. A third scenario on patterns of life is in progress. The two

scenarios are:

1. IED Emplacement Detection

2. Ambush, VBIED and Complex Attack Detection

3.1 (U) Scenario 1: IED Emplacement Detection

(U) This scenario involved detection of the emplacement of IEDs along roads which is a

common insurgent TTP. As shown in Figure 5, the scenario involved two road segments

where IEDs have frequently been planted. A distribution of vehicle speeds was

constructed using research findings indicating that they tend to be normally distributed.

One was a low speed average segment and one a high-speed segment. Apache

helicopters were on routing patrol in the area.

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 5. (U) First Scenario Overview

(U) As shown in Figure 6, a potential IED emplacement was indicated along one of the

road segments because a slow moving vehicle was detected, indicating that it was heavily

laden and might be stopping. The speed of the vehicle was much slower than the

average speed and the Q* was 2000, indicating that this was a rare occurrence of high

risk.

Since GMTI coverage is not always continuous, a vehicle going this slow is likely to be

one that is stopping. IFAS then provided the operator with the option of vectoring one of

the Apaches to look at that potential IED location. After the vehicle started moving again

from its stopped location, it was tracked to a safe house for intelligence purposes.

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 6. (U) Red Alert for Slow or Stopped Vehicle Indicating Possible IED

Emplacement

3.2 (U) Scenario 2: Ambush, VBIED, Complex Attack Scenario

(U) The second scenario involved detection of Ambush, VBIED emplacement and

Complex Attack TTPs. In this scenario, a blue force convoy carrying U.S. State

Department officials is returning to the consulate in a city. Insurgents are notified of

convoy departure and are dispatched to set up a complex attack at a frequently used

location on the convoy return road.

(U) Figure 7 shows what normal vehicle looks like in the city. In accordance with Pub 1,

yellow flowers indicate a moving vehicle and the green surround indicating that they are

probably friendly vehicles.

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 7. (U) Normal Traffic Pattern in the City

(U) From previous forensics and intelligence work the locations of insurgent safe houses

are known and there is known to be separate teams for ambush and VBIED attack. The

VBIED attacker unit is also known to have a VBIED transport/emplacement, triggerman

and observer elements. Figure 8 shows the first insurgent (red circle around detected

moving vehicle) on the move to the known attack site (orange square).

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 8. (U) First Insurgent Vehicle on the Move.

Figure 9 provides a screenshot later in scenario two in which more insurgents emerge

from known safe houses and are tracked.

(U) Figure 9 More Insurgents Deploying But Being Tracked

(U) Figure 10 shows that the blue force convoy is approaching the city from the upper

right of the figure image. The convoy is going to the consulate which is in the Southwest

quadrant of the city. The planned route of the convoy takes them down the road and

through the heart of the city. The right hand side of the figure shows that alerts have

been triggered for both the ambush team and the VBIED team approaching the attack

point.

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 10. (U) Convoy Approaching from the Northeast and Attack Alerts

In Figure 11 is a zoom in of the area around the attack point. The purple arrow indicates

presence of an ambush team. The alert is based on stochastic methods which fit the

shape of the ambush formation using best-fit regression calculation both for position and

angle. The measurements are subjected to CVAR analysis to determine their risk which

triggers the alert.

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 11. (U) Ambush Alert Triggered

(U) Figure 12 shows the VBIED alert which was triggered by CVAR analysis from the

actual and doctrinal positions of the VBIED, triggerman and observer. Statistical models

of the doctrinal locations and Q* calculate as the risk of the vehicle being a triggerman or

an observer.

Figure 12. (U) VBIED Alert Triggered

(U) Figure 13 shows that a complex attack alert has been triggered because of the

coincident ambush and VBIED alerts. The Blue Force convoy has been notified and has

slowed to determine what to do. IFAS advises the operator that the convoy should divert.

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

Figure 13. (U) Complex Attack Alert and Position of Blue Force Convoy

(U) Figure 14 shows the Blue Force convoy diverting to approach the city from the

Southwest. The insurgents have scattered to the East but are being tracked for forensic

purposes.

Figure 14. (U) Convoy Diversion and Insurgents Scattering

UNCLASSIFIED Distribution authorized to US Government

agencies and their contractors.

UNCLASSIFIED

4.0 (U) Summary and Conclusions

(U) The IFAS program has advanced the state-of-the-art in Associate Systems

Technology which will permit analysis of large data flows. IFAS has successfully

adapted stochastic methods from the financial industry and elsewhere to provide a risk

statistic Q* which is compatible with existing Associate Systems Technology. IFAS

demonstrated the utility of this approach through prototype development in important

operational scenarios. This demonstration includes simultaneous multiple TTPs with

multiple vehicles included in each scenario.

(U) IFAS technologies are suitable for not only ground applications but also airborne,

naval and littoral applications. As we move Phase III we are looking for financial support

to increase the IFAS Technology Readiness Level (TRL) which is now estimated at TRL

6.