A STAB at Making Sense of VAST Data

Contents

We view sensemaking in threat analysis as abducing stories that explain the current data and make verifiable predictions about future data. We have developed a preliminary system, called STAB, that abduces multiple stories from the VAST–2006 dataset. STAB uses the TMKL knowledge representation language to represent skeletal story plots as plans with goals and states, and to organize the plans in goal–plan–subgoal abstraction hierarchies. STAB abduces competing story hypotheses by retrieving and instantiating plans matching the current evidence. Given the VAST data incrementally, STAB generates multiple story hypotheses, calculates their belief values, and generates predictions about future data.