Hypothesis Representation for Processes and Threats

We describe novel methods for highly adaptable representation of hypotheses about the complex temporal patterns typical of processes and threats. These methods permit expression and preservation of hypotheses about normal and abnormal processes of significant subtlety and complexity. The hypotheses can capture institutional domain knowledge and facilitate sharing across the organization. A hypothesis can contain as components anomalies, mixed data types, text, missing, and partial information, and various temporal relations among groups of those components. Each component can be declared as necessary for, or sufficient to enhance or diminish a hypothesis. As new information is received daily in a data warehouse, we search for evidence, including new and previously acquired facts that may partially support a hypothesis about an undesirable situation or process. This allows us to detect yet unconsummated processes in order to provide “first alert” to emerging threats. A production system containing these methods has been delivered to a government customer.