Technosocial Modeling of IED Threat Scenarios and Attacks

Paul Whitney*, Sandy Thompson, Alan Brothers, Garill Coles, Cindy Henderson, Jon Young, Dave Niesen, John Madsen

March 2009
*paul.whitney@pnl.gov

PNNL-SA-65672

Outline
Topics
Representing Process and Behavior Models IED Scenario Development & Description The Bayes net General Threat Model and IED Process

Challenges, Future Research

Process Model for an IED Deployment

Technical Model for Material Diversion

Possibility Tree for Material Diversion

Diversion without detection by MC&A

Diversion from research reactor

Diversionfrom Spent Fuel Storage ...

Diversion from Fresh Fuel Storage ...

Diversion by Operational staff

Diversion by Scientific Staff

Diversion by Security Staff

Diversion by Management Staff

Diversion by Other Staff with Access

...

...

...

...

Diversion by during routine operations

Diversion during non-routine operations

Diversion during nonoperational periods by defeating key control

FreezeFrame Process Flow Diagram for Nuclear Weapons Development

Behavior Models Using Bayes Nets

Influence diagram models of group behavior.

Detecting Threatening Behavior Using Bayesian Networks Laskey et al - Proceedings of the Conference on Behavioral Representation in Modeling and Simulation, 2004.

Behavior model fragment developed for insider cyber threat

Context Tech, Math, Comp

Fault trees Event trees Possibility tree Process models Behavior models
Bayes net approach
Box and arrow models common forms of technical models in the domains were working The box-and-arrow models can be represented as Bayes nets, as can behavior models Common representation of models as Bayes nets eases the mathematical linkage significantly

P(Successful IED Attack via Particular Sequence) = P(Successful IED Attack via Particular Sequence | Attempt ) * P( Attempt)+ P(Successful IED Attack via Particular Sequence | no Attempt) * P(no Attempt)

Techno

Behavioral

IED Scenarios
Who What When Where Why How Roadside emplacements, remotely detonated (by wire, by plate, by remote control), on a person, with a vehicle, buried, letter bombs, car bombs,

Why Study IEDs? Real problem temporal/spatial variation Significant available expertise Social/behavioral is the driver! Materials/capability ubiquitous, but, rate of occurrences vary

IED Scenarios
Group X has the objective of repelling and limiting the efficiency of a well-armored occupying force in order to preserve the sanctity of their way of life from the corrupting influences of the occupying force. This group has access to a wide variety of demolitions and explosives as well as experts in employing them, having had many of their members trained in military service and universities across the world. To send a message to the occupying forces, a low-level recruit places an IED in a roadside mailbox well aligned to target a passing vehicle, on a route frequently traveled by the occupiers. After placing the device, an observer remains nearby to set off the charge at the appropriate time when a target vehicle passes the mailbox (detonation in this case done by command wire) and to also record the attack for effects analysis and future training, motivational, propaganda, and recruitment purposes.

IED Kill Chain Model From Process model to Bayes Network

Planning occurred

No planning occurred

IED Kill Chain Model with Observables

Process model in BN form enables forensics and prediction

General Threat Model Scenario Screening

Predictive aspect Used for risk/consequence

Techno Behavioral

Using the General Threat Model

Used for Scenario Ranking
Rank

Calculate

Assess Scenario inputs: Who x Motivation x Capabilities x Outcome x

Generate Candidate Scenarios

Challenges in Techno-Social Modeling

Challenge Verification and Validation Comment Data -- validate/critique/demonstrate a model Formal methods (chi-square, likelihood,)
Models in models? Formal Bayes Methods Write, argue/discuss, meet, Dynamic Bayes nets Systems dynamics models

Detailed linkage/multi-resolution Utilizing Soft and Empirical Data Multi-discipline/perspective Dynamics

Structure

Fundamental Challenge - Data

Games are also an interactive laboratory with which models and simulations can engage. They can play the role in social and organizational modeling that linear accelerators play in particle physicstestbeds built and used to perform experiments and analyze results (Carley, Moon, Schneider, and Shigiltchoff, 2005). Like linear accelerators, MMOGs are expensive to build. The costs of successful immersive game development run from $8 million for the first two years of game development for a Spartan effort like Americas Army to more than $100 million to develop a massive multiplayer online game and its infrastructure.

Context Technical, Mathematical, Computational

Box and arrow models common forms of technical models in the domains were working

Fault trees Decomposition of causes of root event of interest Event trees Begin with undesired initiator event and track outcomes thru sequence of events Possibility tree combinatorial representations of possible scenario outcomes Process models sequence of steps and actions to execute a scenario Bayes nets; Dynamic Bayes nets probabilistic relationships among variables
Behavior models General threat models