PreprintPDF Available

# Space Object Pattern of Life Process Analysis

Authors:
• Acculation, Inc.
Preprints and early-stage research may not have been peer reviewed yet.

## Abstract

Objects in space from four different countries are examined from a process ecosystem perspective using explainable artificial intelligence. For all countries, objects tend to remain predominantly in the same process activity state. Process activity state transitions (movement between orbital characteristic descriptive bins) are observed, however, which suggests intentional maneuver, object degradation, or other ecosystem behaviors. Our temporal analysis based entirely on open-source data suggests quantitative differences in national behavior that are statistically significant under certain assumptions, and which support observations that describe maneuvering behavior differences as a geopolitical concern. We find that United States maneuver behavior is statistically distinguishable separately from both Russian and Chinese behavior to significant p-value within our dataset. Moreover, subsets of only a few months of our data were sufficient to detect statistically significant differences in these fleets’ behaviors. We also found evidence of serial correlation and hidden Markov states, and discuss simple techniques for detecting and mitigating serial correlation in the data. Future work is suggested which advances temporal space situational awareness.
Space Object Pattern of Life Process Analysis
Authors:
John W. Bicknell,Jr., CEO, More Cowbell Unlimited, Inc.
Paul Szymanski, President, Space Strategies Center
Werner Krebs, Ph.D., CEO, Acculation, Inc.
Abstract: Objects in space from four different countries are examined from a process ecosystem
perspective using explainable artificial intelligence. For all countries, objects tend to remain predominantly
in the same process activity state. Process activity state transitions (movement between orbital
characteristic descriptive bins) are observed, however, which suggests intentional maneuver, object
degradation, or other ecosystem behaviors. Our temporal analysis based entirely on open-source data
suggests quantitative differences in national behavior that are statistically significant under certain
assumptions, and which support observations that describe maneuvering behavior differences as a
geopolitical concern. We find that United States maneuver behavior is statistically distinguishable
separately from both Russian and Chinese behavior to significant p-value within our dataset. Moreover,
subsets of only a few months of our data were sufficient to detect statistically significant differences in
these fleets’ behaviors. We also found evidence of serial correlation and hidden Markov states, and
discuss simple techniques for detecting and mitigating serial correlation in the data. Future work is
suggested which advances temporal space situational awareness.
Key Words: Satellite, Space Situational Awareness, Process Mining
Background and Introduction
Space has long been used for national security purposes, military missions, and environmental monitoring
(Tyson and Lang 2018; Unal 2019). With the establishment of U. S. Space Force in December of 2019
and U. S. Space Command in August of 2019, space is recognized officially as a warfighting domain
(Trump 2019; Esper 2019). Although no nation has destroyed another nation’s satellite, direct-ascent
anti-satellite weaponry has been available to world powers for many years (Firth 2019). Relatively new
on-orbit assets, some innocuously identified as “space apparatus inspectors” by Russia (Task and
Purpose 2018), appear to be capable of on-orbit maneuvers which are “very troubling” (Longwell 2018).
Both state and non-state actors may leverage increasingly inexpensive and available technology which
enables cyber and information attacks in space (Rajagopalan 2019). For example, fake signals (or
spoofing) may interfere with satellite command and control systems which trick the system (Unal 2019)
and cause the system to make decisions which favor the attacker (Chotikul 1986; Thomas 2004; Bicknell
and Krebs 2019a); powerful ground or satellite-mounted lasers may dazzle satellite sensors which disrupt
operations or permanently damage equipment (Rajagopalan 2019).
Space Domain Awareness or Space Situational Awareness (SSA) is the ability to detect, track, and
characterize passive and active space objects (Blake et al. 2012). Increasing reliance on space-based
assets necessitate protection from accidental and deliberate asset destruction (Unal 2019). On-orbit
collisions threaten the space environment including critical services such as communication, weather,
banking, position, navigation, and timing (Hart et al. 2016). Satellite collisions or deliberate attacks could
cause extensive critical infrastructure disruption and chaos. Capabilities which improve SSA are,
therefore, necessary.
Many people think of processes as intentional groups of activities which serve profit seeking businesses
or mission driven government agencies. While this is true, complex processes are also emergent and
self-organizing with no human intention (Whitehead 1979; Prigogine, Nicolis, and Babloyantz 1972;
Prigogine, Stengers, and Toffler 1984; Hidalgo 2015). Processes underlie all complex naturally occurring
phenomena; indeed, the Earth is a process (Whitehead 1979). “Pattern of life” is a term of art which has
evolved independently within psychology (Wolfe 1999) and geospatial intelligence (“Pattern-of-Life
DRAFT 1 DRAFT
Analysis” 2019). In this paper, “pattern of life” means a system-level empirical understanding of space
object behavior.
This study demonstrates using open source data that space objects comprise a probabilistic ecosystem
which may be understood through a temporal process lens. Ecosystem-level pattern of life processes are
discovered and elucidated for space objects from the United States, Russia, China, and Japan. Orbital
Regime (OrReg) and Radar Cross Section (RCS) ecosystem processes were chosen because activity
changes may suggest deliberate maneuver or equipment health degradation. Importantly, the technique
presented uses explainable AI, which is favored by decision makers (“Explainable Artificial Intelligence
(XAI)” 2016; “AI Black Box Horror Stories – When Transparency Was Needed More than Ever” 2019;
Gandhi 2019). Future SSA research using process technologies is suggested which advances object
identification, object taxonomy, identification and prediction of collaborative behaviors, detection of
changes in object activity, and operational health assessments.
Data and Methodology
Historical satellite operational data were provided by the Space Strategies Center. The data were
collected from the CELESTRAK website in Two-Line Element (TLE) Set format and converted into
longitudinal tables. The data used in this study record space object characteristics from over 60 countries;
however, four countries were chosen for this initial study in order to limit the scope and understand how
space object processes may differ at an ecosystem-level. Those countries are: the United States, Russia,
China, and Japan. The date range of the data was from January 2012 to June 2013; observations for
each space object were collected approximately every two weeks or twice monthly--although this was not
always the case. These data are available, upon request.
Satellites are deployed into various OrRegs according to mission requirements. These include Low Earth
Orbit (LEO), Medium Earth Orbit (MEO), Geosynchronous Orbit (GEO), and Sun Synchronous. Changes
in OrReg may indicate deliberate maneuver to a higher or lower orbit. Frictional drag from the Earth’s
atmosphere may affect OrReg and cause orbital decay. Extreme space weather may also damage
sensors and ultimately affect OrReg.
RCS measures how detectable an object is by radar. A larger RCS indicates that an object is more easily
detected (“Radar Cross-Section” 2019). The RCS may change for various reasons; for example, a
satellite door might open or a device might be extended. Publicly available RCS data are made less
precise by governments in order to mask certain activities. USSTRATCOM’s Space Situational
Awareness Sharing Program website began showing only scaled RCS values, rather than continuous
RCS measurements, in August 2014.
Process mining was conceived originally in a
business process improvement context. Data science
and management science practitioners use process
mining to speed the discovery of business process
models while improving accuracy and preparing
organizations for digital transformation (Bicknell
2019). It is a highly versatile technique with utility
beyond corporate process improvement. For
example, ISIS Terrorist bot-driven propaganda within
Twitter data, which would otherwise be difficult to
detect, were elucidated with a derived hidden Markov
model (Bicknell and Krebs 2019b). Additionally,
process models of email subject line data suggest
ways information may be used as a maneuver
DRAFT 2 DRAFT
element in a larger cyber or information operations kill chain against critical infrastructure firms (Bicknell
and Krebs 2019c).
The goal of process mining is to turn event data into insights and actions (Aalst 2016). Traditional process
mining analyses use event logs derived from organizational enterprise resource planning system logs. For
example, a talent hiring process might include the following activities: Create Job Requisition; Post Job
Announcement; Conduct Phone Screening; Conduct Phone Interview; Conduct On-site Interview; Extend
Offer; Accept Offer.
Process technologies elucidate ecosystem information flows, decision-making probabilities, and temporal
measures associated with the process. Machine-readable process outputs and models of complex natural
phenomena enable numerous applications. As the name implies, process mining AIs “mine” data and
surface (e.g. Markov or Bayesian) models of decision-making processes from various input formats with
no a priori
knowledge. Process mining is also a human-understandable, human-verifiable, and
human-explainable AI. Three pieces of information are needed to create event logs and discover
processes; additional features enrichen the analysis:
Case ID: An identifier that represents a specific execution of a process.
Activity: One of several steps performed within a process. For example, an orbital characteristic
or cyber exploit attempts.
Time Stamp: This orders the activities within each case and enables sophisticated modeling.
Figure 1 contains a trivial example where an event log is converted into a temporal process model.
Process cases 1 through 3 all contain the same activities, labeled “A” through “E.” In Case 1, the
activities happen in natural order. In Case 2, Activity “C” precedes “B.” Finally, in Case 3, Activity “D” is
repeated before concluding with Activity “E.” The discovered process accounts for these process
variations. Real world processes are significantly more complicated.
For this analysis, Country and Satellite Number were combined to create a unique Case ID for each
object on-orbit. The TLE observation date was used as the Time Stamp field. Activity fields, OrReg and
RCS, were derived by binning the Mean Motion and RCS fields respectively using cut values provided by
Space Strategies Center. Table 1 contains the OrReg and RCS bins and cut point definitions. Figure 2
depicts the partial event log for the Russian OrReg analysis.
Orbital Regime
Cutpoint Definition
Low Earth Orbit-Low (LEO-L)
16 > Mean Motion >=15.216
Low Earth Orbit-Medium (LEO-M)
15.216 > Mean Motion >=14.89
Low Earth Orbit-High (LEO-H) or
Sun-Synchronous (LEO-S)*
14.89 > Mean Motion >= 6
Medium Earth Orbit (MEO)
6 > Mean Motion >=1.18
Geosynchronous (GEO)
1.18 > Mean Motion >=0.8
MM < 0.8**
0.8 > Mean Motion
Cutpoint Definition
DRAFT 3 DRAFT
Small
RCS < 0.1
Medium
0.1 < RCS < 1.0
Large
1.0 < RCS
*Note: Some OrReg calculations require combinations of variables, some of which were not part
of the data set (for example: Altitude or Inclination). One of these OrRegs is Low Earth Orbit
Sun-Synchronous (LEO-S). Since we could not identify uniquely objects in the LEO-S, we
bucketed LEO-H and LEO-S together as “LEO-H/S.”
** A relatively small number of objects had a Mean Motion measurement which did not align with
any other OrReg definitions. Therefore, we constructed a catch-all bin and labeled it “MM < 0.8.”
Results
Known objects on-orbit were mined for processes from OrReg and RCS perspectives for each of the four
countries, producing eight results. More Cowbell Unlimited’s cloud SaaS produces a narrative summary,
heatmap representations, plus many other descriptive statistics which enable sophisticated simulations
and follow-on analyses. See Appendices A and B for full reporting of event counts and transition
probability comparisons between countries.
DRAFT 4 DRAFT
OrReg Results Discussion
Russia had the most objects in space--almost 7,000--with calculated OrReg values, followed by the
United States with 5,135 objects, China with 4,315 objects, and Japan with 264 objects. The median
number of events per case is 37, which makes sense because the period of observation is approximately
1.5 years with approximately two observations per month. For all countries, the majority of objects are in
the Low Earth Orbit-High/Sun-Synchronous (LEO-H/S) range. Russia, however, has a larger proportion of
objects in Medium Earth Orbit (MEO), and Japan has a larger proportion of objects in Geosynchronous
(GEO) orbit, compared to other countries. Since OrReg bins are derived from continuous variables, some
transitions between activity states may be due to measures being very close to category cut points.
For all countries, objects tend to remain in the same OrReg. This finding makes sense intuitively, as it
may be challenging to maneuver objects from lower to higher altitudes, and vice versa. There are,
however, observed OrReg changes. OrReg directional changes are primarily from higher to lower
altitudes; although, some Russian and Chinese assets exhibit lower to higher altitude changes. For all
countries, most OrReg process activity changes occur as objects moving out of Low Earth Orbit-Medium
(LEO-M) into Low Earth Orbit-Low (LEO-L).
Figure 3 compares the OrReg process flows for the United States and Russia after activity re-work has
been removed. (See Appendix A for an explanation of re-work). Visual comparison of the color coded
heat maps suggests different patterns of life or ecosystem behavior. Predominantly, objects tend to
transition from higher to lower OrRegs; this could be explained by natural orbital decay. Compared to
Russia, United States space objects do not tend to maneuver into higher or geosynchronous orbits from
other OrReg process activities. Statistical differences are discussed in the Statistical Tests section of this
paper.
We hypothesized that the Russian behavior could be explained by hidden capabilities or states of their
satellites. Indeed, replacing the Markov Model by a hidden Markov model (HMM) suggests that the
LEO-H/S classification can be split into multiple bands for the Russian satellite ecosystem. One
explanation is that LEO-S would otherwise be parseable, if the dataset contained the requisite variables
for classification. We had earlier hypothesized that Russian maneuver differences might be due to
Russia’s high-latitude geography, and the resulting need for Russia to orbit communication or other
satellites in different orbits more suitable for high-latitude applications. High-latitude applications are
consistent with LEO-S orbits, but so are spy satellites. The United States also orbits a significant number
of satellites in orbits similar to Russian high-latitude orbits, so it is not clear if the need for polar orbits
DRAFT 5 DRAFT
RCS Results Discussion
As with the OrReg results, Russia had the most objects in space with calculated RCS values at 7,100.
The United States had 5,323 objects, followed by China with 4,305, and then Japan with 264. The United
States, Russia, and China’s on-orbit objects tended to have “Small” RCS values. The majority of Japan’s
objects, on the other hand, had “Large” RCS values. As mentioned previously, the RCS activity bins are
derived from continuous variables; therefore, some transitions between process states may be due to
measures being very close to category cut points.
RCS values tend to remain within the same cut-point bands. Visual inspection of the transition probability
matrices in Appendix B suggest different patterns of life or behavior. Movements between and across all
RCS ranges are observed for all countries except for Japan. The majority of the RCS process activity
movement is out of the “Medium” state into either the “Small” or “Large” states. However, jumps directly
from “Small” to “Large” and vice versa are evident.
Figure 4 compares the RCS process flows for the United States and China after activity re-work has been
removed. (See Appendix B for an explanation of re-work). Visual comparison of the color coded heat
maps suggests different patterns of life or behavior. This is especially true for process changes originating
from “Large” RCS states. Statistical differences are discussed next.
Statistical Tests
The OrReg Markov Transition Probability Matrix (TPM) heatmap visualizations shown in Figure 3
suggests apparently statistically significant differences between national maneuvering behavior. We
sought to further test the statistical significance of the differences. We used the PyDTMC package
(Belluzzo 2019) to compute the log-likelihood that a given event trace can be produced by a given Markov
matrix model. Following the suggestion of Chikina, Frieze, and Pegden we used Monte Carlo simulation
to generate synthetic event traces from the statistical model implied by each nation’s TPM (without
rework), and compared the band of calculated log-likelihoods with the actual event traces by the four
nations we studied. We used PyDTMC’s synthetic data and log-likelihood feature to generate the
synthetic data.
It quickly became clear that there was significant serial correlation in the data, likely due to changing
satellite populations over time. (We intend to revisit serial correlation in a future work by looking at
Durbin-Watson statistics and other autocorrelation metrics. For the purpose of this paper, we will note that
the method described herein of comparing actual event trace log-likelihood with synthetic event traces
can be used to find a time-window that reduces serial correlation to acceptable levels.) If we compared
DRAFT 6 DRAFT
the range of log-likelihoods computed for 100 sets of synthetic data with log-likelihood computed from the
actual event trace, the actual event trace would typically fall outside that band (sometimes well outside
that band) due to serial correlation.
Fortunately, this was an easy problem to fix. Initially, we divided the data’s time period into quarters, and,
at least for the United States transition matrix, the problem immediately went away. We later
experimented with larger time slices, limiting the experiment to the first 150 non-steady-state OrReg
activity transitions in the United States data set, or approximately 75% of the original 18-month time
period, and found that log-likelihood for the actual United States events within this reduced time period
calculated against the TPM model for the full time period was consistently within the bands determined
from 100 synthetic data sets of comparable length (generally within one standard deviation of the mean of
the log-likelihood bands or better). Russian events, however, were consistently outside the min-max
range of log-likelihoods over many such 100-synthetic data runs, suggesting that the null hypothesis (that
Russian data could be seen as merely random fluctuations of data that could be generated from the
United States TPM model) is false to p-value of less than 0.01.
In response to feedback, it should be noted that this Monte Carlo approach, which we adapted from the
suggestion of Chikina, Frieze, and Pegden, is extremely robust to assumptions around statistical
distributions. The statistical distribution of the synthetic data comes from the TPM itself, a discrete
categorical distribution ultimately generated from actual event data. The only statistical distribution
assumptions come in the form of the log-likelihood function implemented in the PyDTMC package.
However, we only claim to have established an upper-bound on a p-value constructed from the
discriminating power of what is a non-deterministic algorithmic examination of log-likelihood ranges from
Monte Carlo simulations of synthetic data to non-deterministically classify event data as inconsistent with
a TPM model in at least 99 out of 100 random trials. If another statistical distribution results in an alternate
log-likelihood computation that produces less discriminating log-likelihood ranges and therefore an inferior
non-deterministic classification algorithm, this is simply an inferior algorithm; our upper-bound on the
p-value remains. Similarly, substitution of a log-likelihood distribution with superior discriminating abilities,
if it exists, would, to a first approximation, simply demonstrate that our upper bound on the p-value was
too conservative, and the true p-value is even lower. (Of course, if many such non-standard log-likelihood
distributions were examined, at some point one would encounter the Texas Sharpshooter or Cherry
Picking fallacies. However, we were well aware of that issue, and for that reason limited our
experimentation to the single, standard log-likelihood calculation from a 3rd party python package).
The reverse is not true, at least not with our original naive, non-hidden Markov Model. Time-sliced
Russian data (over a subset of the 18-month period) is generally not statistically consistent with its own
non-hidden TPM model (over the entire 18 month period of our data). While serial correlation is one
explanation, we investigated this further, and found that we could improve the Russian TPM model by
splitting the LEO-H band into a second, hidden Markov state. (Attempts to further improve the Russian
TPM model with yet more hidden states did not yield noticeable improvement, and attempting to add
hidden states to the United States TPM model also did not appear to improve the model.) We speculated
that some LEO-S satellites may have been misclassified in our data as LEO-H due to similar cutoffs, and
that Russians may have significant numbers of LEO-S satellites due to their higher latitude geography, so
that LEO-S corresponds to a hidden “state” splitting the LEO-H classifications in our data. While
consideration of LEO-S may improve the Russian TPM model, most of the differences between the
United States and Russian TPMs do not involve LEO-H (or LEO-S), so misclassification of LEO-S
satellites as LEO-H would not be sufficient to explain the Russian and United States ecosystem pattern of
life differences. (The United States also orbits significant numbers of polar orbit and LEO-S satellites, so it
seems the higher latitude of Russian operations is, by itself, not sufficient to explain the differences we
observe.)
An examination of the OrReg processes of China versus the United States yielded similar results. China
is consistent with its own TPM model, but is not consistent with the United States TPM model considered
DRAFT 7 DRAFT
over the entire 18-month data set to significance of at least p-value 0.01. The reverse is also true: United
States pattern of life behavior is inconsistent with the Chinese TPM under a similar test.
With only 22 non-steady-state transitions over 18 months, there was likely too little data available on
Japan in our dataset to derive statistically rigorous conclusions about its behavior versus other countries.
Interestingly, Russian data does appear statistically consistent with a Chinese TPM model over the entire
period (although the reverse is not true, which is not surprising given that Russian data is not consistent
with its own naive TPM over the entire period unless you split LEO-H into a hidden state, as previously
noted). Chinese and Russian behavior would thus appear more statistically similar to each other than to
United States behavior, at least in our dataset.
One caveat about our research is that it is based on United States government open source TLE data. A
number of assumptions about physics and satellite behavior go into the underlying methods used to
generate these government data, and our understanding is that TLE data can contain significant error and
noise. Nevertheless, the algorithms and methods used to generate TLE data are supposed to be blind to
country-of-origin; none of the algorithms used by the United States government, as publicly described,
use country-of-origin in their calculations, and the algorithm calibrations are also supposed to be
country-neutral. Thus, any error and noise in TLE data should also be country-blind. Consequently, it is
possible that our results do not demonstrate real-world pattern of life differences, but only an apparently
previously undescribed country-bias in United States government TLE data. This alone, however, would
be a significant result, as TLE data are not supposed to exhibit country-of-origin bias. Specifically,
previously unsuspected greater error in TLE data for Russian and Chinese satellites versus United States
satellites as an explanation for our results would be of concern from a SSA standpoint.
The fact that United States events are consistent with synthetic data generated from our United States
TPM model, while Russian events are statistically inconsistent with the United States model,
demonstrates that it is possible to devise statistical tests that are able to distinguish between real-world
Russian and United States maneuver behavior (or at least real-world maneuver behavior data) to strong
statistical significance. Datasets with as few as 50 non-steady-state transitions (or approximately 4.5
months of data) or less may be sufficient to consistently statistically distinguish the two countries’ pattern
of life behaviors. These results are consistent with a common-sense interpretation of the heatmap
visualizations of the OrReg TPMs for Russia and the United States (Figures 3), illustrating the power of
this explainable AI to highlight anomalies to an analyst, facilitating further analysis followed by more
rigorous statistical testing. It is also possible to distinguish statistically the United States from Chinese
maneuver behavior within our dataset, but Chinese and Russian maneuver behavior was harder to
distinguish in a statistically rigorous way in our cursory examination. United States and Chinese behavior
remain statistically distinguishable when winnowing the data down to a quarter of the events or less,
suggesting only a few months of data are needed to detect statistically different patterns of life. Both of
these countries’ maneuver behaviors are characterized by additional types of OrReg transitions (entries in
the TPM matrix) versus the United States. It is worth noting that, unlike Russia, Chinese geography is at
latitudes more similar to United States geographical latitudes, so the Chinese and United States
maneuver differences cannot be explained as easily by the need to service high-latitude geographies.
We also found evidence of serial correlation in our TLE-derived dataset, suggesting satellite behaviors
are noticeably changing over time, perhaps with the launch of newer satellite constellations with more
modern capabilities. This means some of the specifics in this paper may not continue to hold true in the
future as countries evolve their capabilities and fleets.
Conclusion and Future Work
Visual comparisons of the satellite transition probability matrices, especially after removing rework
activities, suggest different ecosystem patterns of life among the four countries. There was sufficient data
to conclude the maneuver differences between the United States and Russia and the United States and
China were statistically significant. For both OrReg and RCS, space objects tend to remain within the
DRAFT 8 DRAFT
same descriptive process activity bins. Movements into other process activities, therefore, are noteworthy
and are potentially indicators of object degradation, intentional maneuver, or other pattern of life
behaviors.
Satellites are deployed intentionally, are controlled with purpose, degrade over time, are affected by
exogenous events, and are vulnerable to attack. Future studies should be aimed at improving object
identification, object taxonomy, pattern of life behavior analysis, identification and prediction of
collaborative behaviors, detection of changes in object activity, and operational health assessments.
Possible improvements include modeling changes in orbital mechanics, such as angular momentum,
which may provide more precise maneuver analyses. More sophisticated treatment of serial correlation to
automatically size observation windows, satellite physical simulations, examination of additional countries,
and additional classification techniques including Bayesian and deep learning on additional signature data
are promising future possibilities, as well. We could also discuss this research in various strategic
contexts, such as maneuver mimicry. We are also considering automated process activity bin clustering,
as well as extending the analysis to consider the effects of event data such as space weather on
ecosystem health. Finally, space debris models using a methodology which employs Fourier transform in
Euclidean space are likely valuable.
Acknowledgement
The authors are grateful to Moriba Jah, Ph.D., Associate Professor in the Department of Aerospace
Engineering and Engineering Mechanics at the University of Texas for his invaluable comments on earlier
References
Aalst, Wil M. P. van der. 2016. Process Mining: Data Science in Action
. 2nd ed. 2016 edition. New York,
NY: Springer.
“AI Black Box Horror Stories – When Transparency Was Needed More than Ever.” 2019. Open Data
Science - Your News Source for AI, Machine Learning & More
(blog). October 2, 2019.
https://opendatascience.com/ai-black-box-horror-stories-when-transparency-was-needed-more-th
an-ever/.
Belluzzo, Tommaso. 2019. PyDTMC
. Python. https://github.com/TommasoBelluzzo/PyDTMC.
Bicknell, John W. 2019. “Process Mining Technologies.” ORMS Today
46 (5).
https://doi.org/10.1287/orms.2019.05.01.
Bicknell, John W, and Werner G Krebs. 2019a. “Process Mining: The Missing Piece in Information
Warfare.” ResearchGate
, February. https://doi.org/10.13140/RG.2.2.23584.94722/1.
———. 2019b. “Detecting Botnet Signals Using Process Mining.” Manuscript submitted for publication.
———. 2019c. “Process Mining Organization Email Data and National Security Implications.” Manuscript
submitted for publication.
Blake, Travis, M. Sanchez, J. Krassner, M. Georgen, and S. Sundbeck. 2012. “Space Domain
Awareness.” DEFENSE ADVANCED RESEARCH PROJECTS AGENCY ARLINGTON VA.
Chikina, Maria, Alan Frieze, and Wesley Pegden. 2017. “Assessing Significance in a Markov Chain
without Mixing.” Proceedings of the National Academy of Sciences
114 (11): 2860–64.
https://doi.org/10.1073/pnas.1617540114.
Chotikul, Diane. 1986. “The Soviet Theory of Reflexive Control in Historical and Psychocultural
Perspective: Preliminary Study.” Monterey, California: Naval Postgraduate School.
http://nsarchive.gwu.edu/dc.html?doc=3901091-Diane-Chotikul-The-Soviet-Theory-of-Reflexive.
Esper, Mark. 2019. “Memorandum for Department of Defense Personnel: United States Space Force.”
Department of Defense.
“Explainable Artificial Intelligence (XAI).” 2016. August 10, 2016.
DRAFT 9 DRAFT
https://www.darpa.mil/program/explainable-artificial-intelligence.
Firth, Niall. 2019. “How to Fight a War in Space (and Get Away with It).” MIT Technology Review. June
26, 2019. https://www.technologyreview.com/s/613749/satellite-space-wars/.
Gandhi, Preet. 2019. “Explainable Artificial Intelligence.” January 2019.
https://www.kdnuggets.com/2019/01/explainable-ai.html.
Hart, Michael, Moriba Jah, David Gaylor, Brian Ten Eyck, Eric A. Butcher, Eliza Coral, Roberto Furfaro, et
al. 2016. “A New Approach to Space Domain Awareness at the University of Arizona.” In .
Loughborough, United Kingdom. https://doi.org/10.13140/RG.2.1.3057.1128.
Hidalgo, Cesar. 2015. Why Information Grows: The Evolution of Order, from Atoms to Economies
. Basic
Books.
Longwell, Maddy. 2018. “State Department Concerned over Russian Satellite’s Behavior.” C4ISRNET.
August 14, 2018.
https://www.c4isrnet.com/c2-comms/satellites/2018/08/14/state-department-concerned-over-russi
an-satellites-behavior/.
“Pattern-of-Life Analysis.” 2019. In Wikipedia
.
https://en.wikipedia.org/w/index.php?title=Pattern-of-life_analysis&oldid=883653321.
Prigogine, Ilya, Gregoire Nicolis, and Agnes Babloyantz. 1972. “Thermodynamics of Evolution.” Physics
Today
25 (11): 23–28. https://doi.org/10.1063/1.3071090.
Prigogine, Ilya, Isabelle Stengers, and Alvin Toffler. 1984. Order Out of Chaos
. First Edition edition. New
York, NY: Bantam. https://archive.org/details/OrderOutOfChoas.
.
Rajagopalan, Rajeswari. 2019. “Electronic and Cyber Warfare in Outer Space.” United Nations Institute
for Disarmament Research.
https://www.unidir.org/publication/electronic-and-cyber-warfare-outer-space.
Task and Purpose, Brad Howard. 2018. “The U.S. Military’s Worst Nightmare: Russia Attacking Our
Satellites.” Text. The National Interest. August 18, 2018.
https://nationalinterest.org/blog/buzz/us-military%E2%80%99s-worst-nightmare-russia-attacking-
our-satellites-28992.
Thomas, Timothy. 2004. “Russia’s Reflexive Control Theory and the Military.” The Journal of Slavic
Military Studies
17 (2): 237–56. https://doi.org/10.1080/13518040490450529.
Trump, Donald. 2019. “Remarks by President Trump at Event Establishing the U.S. Space Command.”
The White House. August 29, 2019.
https://www.whitehouse.gov/briefings-statements/remarks-president-trump-event-establishing-u-s
-space-command/.
Tyson, Neil deGrasse, and Avis Lang. 2018. Accessory to War: The Unspoken Alliance Between
Astrophysics and the Military
. First Edition edition. New York: W. W. Norton & Company.
Unal, Dr Beyza. 2019. “Cybersecurity of NATO’s Space-Based Strategic Assets.”
https://www.chathamhouse.org/publication/cybersecurity-nato-s-space-based-strategic-assets.
Whitehead, Alfred North. 1979. Process and Reality
. 2nd edition. New York: Free Press.
Wolfe, W. Beran. 1999. Alfred Adler: The Pattern of Life
. Florence: Routledge.
DRAFT 10 DRAFT
Appendix A: Orbital Regime Results
Event Counts
These values represent the total number of events which flowed from process activity State A (rows) to
process activity State B (columns). The heatmap highlights relative values. Objects tend to remain in the
same OrReg, observed as values along the diagonal. Process “exits” should be interpreted as the end of
the observation period, rather than completion of a defined series of steps.
DRAFT 11 DRAFT
Orbital Regime Transition Probabilities with Re-Work Removed
These values represent the portion of events which entered State B (column) from State A (row). For
each row, the sum of transition probabilities equals 1.0. All “re-work” activities (values along the diagonal)
have been removed. This view of the process shows transitions between activities which occur after
repetitive states are removed. The heatmap highlights relative values.
DRAFT 12 DRAFT
Appendix B: RCS Results
These values represent the total number of events which flowed from process activity State A (rows) to
process activity State B (columns). The heatmap highlights relative values. Objects tend to remain in the
same RCS, observed as values along the diagonal. Process “exits” should be interpreted as the end of
the observation period, rather than completion of a defined series of steps.
DRAFT 13 DRAFT
Radar Cross Section Transition Probabilities with Re-Work Removed
These values represent the portion of events which entered State B (column) from State A (row). For
each row, the sum of transition probabilities equals 1.0. All “re-work” activities have been removed (there
are no values along the diagonal). This view of the process shows transitions between activities which
occur after repetitive states are removed. The heatmap highlights relative values.
DRAFT 14 DRAFT
ResearchGate has not been able to resolve any citations for this publication.
Article
Full-text available
Detecting and elucidating botnets is an active area of research. Using explainable, highly scalable Apache Spark-based artificial intelligence, process mining technologies are presented which illuminate bot activity within terrorist Twitter data. A derived hidden Markov model suggests that bot logic uses information camouflage in order to disguise intentions similar to World War II Nazi propagandists and Soviet-era practitioners of information warfare enhanced with reflexive control. A future effort is presented which strings together best of breed techniques into a composite classification algorithm in order to improve continually the discovery of malicious accounts, understand cross-platform weaponized botnet dynamics, and model adversarial information warfare campaigns recursively.
Technical Report
Full-text available
Abstract : From an information warfare perspective, The Cold War never ended. Moreover, the 21st Century presents vivid new security challenges related to information weaponry. For instance, Russia sowed confusion and distrust during the 2016 United States Presidential election quite effectively with micro-targeted information and disinformation campaigns. Enhanced with reflexive control, Russia’s information warfare technique combines models of decision-making processes with vectors designed to exploit process weaknesses. For decades, Russia has been perfecting their highly analytical brand of information warfare enhanced with reflexive control, which meticulously introduces into human or machine processes data which inclines the adversary toward taking an action that favors the attacker. While Russia continually advances its techniques and after effects of the 2016 attacks smolder as a cantankerous strife throughout American discourse, Western governments do not seem to appreciate powerful reflexive control concepts. This paper describes an important capability gap in the United States’ information warfare solution set. Process mining technologies enable data driven techniques for understanding societal, cultural, political, military, and critical infrastructure process weaknesses, at scale. Algorithmic process models discovered from varieties of data augment other information warfare capabilities and give the United States actionable, data-driven intelligence to steel against reflexive control attack vectors. Creative and diverse use cases are described for the Department of Defense, national security agencies, and critical national infrastructures. Full-text available from: https://morecowbellunlimited.com/wp-content/uploads/Draft-Article-Process-Mining-The-Missing-Piece-in-Information-Warfare.pdf
Article
Full-text available
We present a new statistical test to detect that a presented state of a reversible Markov chain was not chosen from a stationary distribution. In particular, given a value function for the states of the Markov chain, we would like to demonstrate rigorously that the presented state is an outlier with respect to the values, by establishing a $p$-value for observations we make about the state under the null hypothesis that it was chosen uniformly at random. A simple heuristic used in practice is to sample ranks of states from long random trajectories on the Markov chain, and compare these to the rank of the presented state; if the presented state is a $0.1\%$-outlier compared to the sampled ranks (i.e., its rank is in the bottom $0.1\%$ of sampled ranks) then this should correspond to a $p$-value of $0.001$. This test is not rigorous, however, without good bounds on the mixing time of the Markov chain, as one must argue that the observed states on the trajectory approximate the stationary distribution. Our test is the following: given the presented state in the Markov chain, take a random walk from the presented state for any number of steps. We prove that observing that the presented state is an $\varepsilon$-outlier on the walk is significant at $p=\sqrt {2\varepsilon}$, under the null hypothesis that the state was chosen from a stationary distribution. Our result assumes nothing about the structure of the Markov chain beyond reversibility, and we construct examples to show that significance at $p\approx\sqrt \varepsilon$ is essentially best possible in general. As an application of our test, we demonstrate that the congressional districting of Pennsylvania has a nonrandom Republican bias, at a significance of $p=10^{-5}$, compared with uniformly randomly chosen compact districtings.
Conference Paper
Full-text available
As the spacefaring community is well aware, the increasingly rapid proliferation of man-made objects in space, whether active satellites or debris, threatens the safe and secure operation of spacecraft and requires that we change the way we conduct business in space. The introduction of appropriate protocols and procedures to regulate the use of space is predicated on the availability of quantifiable and timely information regarding the behavior of resident space objects (RSO): the basis of space domain awareness (SDA). Yet despite five decades of space operations, and a growing global dependence on the services provided by space-based platforms, the population of Earth orbiting space objects is still neither rigorously nor comprehensively quantified, and the behaviors of these objects, whether directed by human agency or governed by interaction with the space environment, are inadequately characterized. In response to these challenges, the University of Arizona (UA) has recently established the Space Object Behavioral Sciences (SOBS) Division of its Defense and Security Research Institute (DSRI) with a mandate to carry out research, education, and operational support to spacecraft operators. The SOBS Division builds on UA's heritage as a world leader in space science. By way of examples, UA, with a total research portfolio exceeding $600M per year, operates more than 20 astronomical telescopes on two continents, leads NASA's$800M OSIRIS-REx asteroid sample return mission, and has been deeply engaged in every US mission to Mars without exception. Key goals of the SOBS Division are to develop a capability to predict RSO behavior, extending SDA beyond its present paradigm of catalog maintenance and forensic analysis, and to arrive at a comprehensive physical understanding of non-gravitational forces that affect the motions of RSOs. Without seeking to provide a universal solution to global SDA needs, SOBS nonetheless concentrates resources to advance the state-of-the-art in astrodynamic research toward those ends. Solutions to these problems require multidisciplinary engagement that combines space surveillance data with other information, including space object databases and space environmental data, to help decision-making processes predict, detect, and quantify threatening and hazardous space domain activity. To that end, the division engages and integrates talent and resources from across the UA, including the Colleges of Science, Engineering, Optical Sciences, and Agriculture & Life Sciences. As activity ramps up over approximately the next three years, the SOBS Division will directly support the creation of timely knowledge of the space environment by drawing on a worldwide network of sensors processed through existing UA cyberinfrastructure. In addition, the SOBS Division will also provide a real-world training ground for current and future workers in the field through certificate programs and postgraduate degrees.
Article
Business and government leaders are hearing more and more about process mining. So, what is process mining? If you’ve asked yourself that question, you’ve come to the right place. This article defines process mining and how it works, describes the “right” way to adopt it within your organization, suggests where the industry is heading with some bleeding-edge possibilities, and concludes with the assertion that process technologies will become ubiquitous. Welcome to the growing world of process mining. Submitted to INFORMS ORMS Today for Volume 46, Number 5, October 2019 The full text of the article is here: https://doi.org/10.1287/orms.2019.05.01
Article
Reflexive control is a subject that has been studied in the Soviet Union and Russia for nearly 40 years. The theory has both military and civilian uses. This article describes both the theory and practice of reflexive control, focusing on recent developments. The concept is close in meaning to the US concept of perception management.
Article
In the ongoing 'information war' between the United States and the Soviet Union, a new method of exerting influence has captured the recent attention and interest of Western Sovietologists and military and political analysts. This new method is the Soviet theory of reflexive control, which, briefly stated, can be defined as, 'a means of conveying to a partner or an opponent specially prepared information to incline him to voluntarily make the predetermined decision.' Several authoritative studies have been published which describe in depth and in detail the scientific and mathematical components of reflexive control, and its various military and technical applications. However, less attention has been devoted to an examination of the underlying historical and psychocultural factors which may have contributed to the development of this particular orientation toward decision making. The present research effort represents an attempt to narrow this gap in our understanding of the evolution and significance of the theory of reflexive control, and to develop a psychohistorical framework within which the theory may come to be better understood by Western analysts of Soviet affairs.
DRAFT 8 DRAFT "AI Black Box Horror Stories -When Transparency Was Needed More than Ever
• Wil M P Aalst
• Van Der
Aalst, Wil M. P. van der. 2016. Process Mining: Data Science in Action. 2nd ed. 2016 edition. New York, NY: Springer. DRAFT 8 DRAFT "AI Black Box Horror Stories -When Transparency Was Needed More than Ever." 2019. Open Data Science -Your News Source for AI, Machine Learning & More (blog). October 2, 2019. https://opendatascience.com/ai-black-box-horror-stories-when-transparency-was-needed-more-th an-ever/.