Making Sense of VAST Data

We view sensemaking in threat analysis as abducing a story whose plot explains the current data and makes predictions about the future. We have developed a preliminary computational system, called STAB, that abduces stories from data. STAB abduces multiple competing hypotheses by retrieving and instantiating story plots matching the current evidence. The story plots in STAB are represented as processes with goals and states, and organized in an abstraction hierarchy. STAB analyzes the VAST-2006 dataset. Given the VAST data incrementally, STAB generates multiple explanatory hypotheses, calculates their confidence values, and generates expectations about future data.