A STAB at Making Sense of VAST Data

We view sensemaking in threat analysis as abducing stories that explain the current data and make verifiable predictions about future data. We have developed a preliminary system, called STAB, that abduces multiple stories from the VAST2006 dataset. STAB uses the TMKL knowledge representation language to represent skeletal story plots as plans with goals and states, and to organize the plans in goal-plan-subgoal abstraction hierarchies. STAB abduces competing story hypotheses by retrieving and instantiating plans matching the current evidence. Given the VAST data incrementally, STAB generates multiple story hypotheses, calculates their belief values, and generates predictions about future data. Background, Motivation and Goals Making sense of vast amounts of data in intelligence analysis (Heuer 1999; Krizan 1999; Thomas & Cook 2005) generally involves the tasks of recognizing and characterizing a threat based on some initial evidence about an event or activity, generating multiple explanatory hypotheses based on the evidence, collecting and assimilating additional data, evaluating the multiple explanatory hypotheses, and selecting the most plausible hypothesis. The sensemaking task is complex because of the constantly evolving, and often unreliable and conflicting, nature of data. The evolving nature of data implies a need for ongoing monitoring and continual generation and evaluation of hypotheses so that new evidence can be accounted for as it arrives and the most confident explanation can be produced at any given time. Pirolli & Card (2005) describe an information-processing model of threat analysis based on a cognitive task analysis of human analysts as they did their jobs. They have identified two main, overlapping loops in the analyst’s problem solving, a foraging loop and a sensemaking loop. The foraging loop involves finding the right data sources; searching and filtering the information; and extracting the information. The sensemaking loop involves iterative development of a conceptualization (a hypothesis) from a stored schema that best fits the evidence, and the Copyright © 2007, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved. presentation of the knowledge product that results from this conceptualization. As Bodnar (2005) notes, the information processing in this model is both bottom-up (from data to hypotheses) and top-down (verifiable predictions made by the instantiated hypotheses). This model, however, does not identify the content and the structure of the schemas in the sensemaking loop, or describe the process by which specific schemas are conceptualized as hypotheses. The goal of our work is to help answer these questions in a manner consistent with the current cognitive accounts of intelligence analysis (Heuer 1999; Krizan 1999; Pirolli & Card 2005). We view the task of sensemaking in threat analysis as that of abducing stories that explains the current data and makes verifiable predictions about future data. We adopt the general conceptual framework for abductive reasoning described in (Bylander et. al., 1991; Goel et. al. 1995; Josephson & Josephson 1995) and use it for story abduction. We have developed a preliminary system, called STAB (for STory ABduction), that abduces multiple, competing stories from the VAST 2006 dataset. Since real intelligence data is not available in the public domain, the National Visual Analytics Center (NVAC) at the Pacific Northwest National Laboratory (PNNL) generated the VAST dataset as a substitute. This synthetic dataset pertains to illegal and unethical activities, as well as normal and typical activities, in a fictitious town in the United States. STAB abduces multiple competing story hypotheses by retrieving and instantiating skeletal story plots that match the current evidence. STAB uses the TMKL knowledge representation language (Murdock & Goel 2003, 2007) to represent a skeletal story plot as a plan with goals and states, and to organize the plan in a goal-plan-subgoal abstraction hierarchy. This knowledge representation captures both intent and causality at multiple levels of abstraction. Given the VAST data incrementally, STAB generates multiple story hypotheses, calculates their belief values, and generates predictions about future data. 1 See http://conferences.computer.org/vast/vast2006/.