Twiner

We currently lack the ability to holistically and autonomously look across all three layers of cyberspace (persona, logical and physical) and identify interesting patterns, which would give us an edge in understanding complex activities in and through cyberspace. To address this challenge, Soar Technology (SoarTech) and the GeorgiaTech Research Institute (GTRI) propose Twiner, an intelligent system that aggregates very large sets of heterogeneous data, correlates them to detect causal relationships and displays both the data and its relationships in a way that enables novel cyberspace operations. Our goal is to allow users to find interesting entities and events and, by selecting them, to see how they are intertwined with others, thereby creating a dynamic, multi-layer map of cyberspace. Twiner will require us to develop novel anomaly detection and large-scale correlation techniques for which our machine learning (ML) expertise is ideally suited. However, since these deductive ML techniques alone are insufficient to establish causation, we will pair them with an abductive reasoning engine. Abductive reasoning starts from a set of observations and finds the likeliest explanation for them using behavioral models. Twiner’s engine will use Soar cognitive agents and a custom model library.