CADRE: continuous analysis and discovery from relational evidence

CADRE (continuous analysis and discovery from relational evidence) is a link detection system that takes in a threat pattern and partial evidence about threat cases and outputs threat hypotheses with inferred actors and events. CADRE uses a Prolog-based frame system to represent threat patterns and enforce temporal and equality constraints among pattern slots. Based on rules involving uniquely identifying slots in the pattern, CADRE triggers an initial set of threat hypotheses, and then refines these hypotheses by generating queries for unknown slots from constraints involving known slots. To evaluate hypotheses, CADRE scores each local hypothesis using a probabilistic model in order to create a consistent, high-value global hypothesis by pruning conflicting lower scoring hypotheses. In a program-wide first year evaluation using simulated threats, CADRE performed best overall among five participating link detection systems.