CADRE: Continuous Analysis and Discovery from Relational Evidence

摘要

CADRE (Continuous Analysis and Discovery Relational Evidence) is a link detection system that in a threat pattern and partial evidence about threat and outputs threat hypotheses with inferred actors events. CADRE uses a Prolog-based frame system to represent threat patterns and enforce temporal and ^quality constraints among pattern slots. Based on rules involving uniquely identifying slots in the pattern, CADRE triggers on initial set of threat hypotheses, and then refines these hypotheses by generating queries for unknown slots from constraints involving known slots. To evaluate hypotheses, CADRE scores each local hypothesis using a probabilistic model in order to create a consistent, high-value global hypothesis by pruning conflicting lower scoring hypotheses. In a program-wide first year evaluation using simulated threats, CADRE performed best overall among five participating link detection systems.