Cogility provides a model-driven architecture solution called Studio that allows users to create directly executable applications by modeling events, processes, and data integration. The models can be run like a real system without additional coding. Cogility's Intel solution is built on Studio and adds complex event processing capabilities for dynamic template matching to detect adversarial activities. It allows human-in-the-loop interaction to analyze events and take appropriate actions. The system aggregates low-level event patterns detected by machines into more useful summary events to improve situational awareness and timely decision making.

1. 1 COGILITY SOFTWARE The Leader In Model Driven Complex Event Processing Cogility’s Studio and Intel Management Solution 1

3. Formal enough to be directly executed

5. Service Oriented Architecture (SOA)

6. Data Transformation (CWM)

7. Business Process Management (BPM)

10. No additional code required

15. client capabilities

16. risk reductionadaptive feed-back Exe Model auto deploy test /demo eval COI opportunity to the direction alpha demo adaptive feed-back Each Iterative and Incremental Model Evolution follow the same structure: Exe Model auto deploy test /demo eval development

17. 7 The Vision Leading to COIN JDE Potential T-Cell C2-C-IED DCGS IED IED COIN Capabilities

18. 8 Know Adversarial Behavior and Intent Strategic Special Activities Int’l Support Strategic National Strategic Warfighter Leadership Operational Planning Timeliness of Effect Funding Tactical Recruiting TTP-R Surveillance Local Leadership Engineering Supplier Adapting Principle Success Effectiveness Overtime Production Assessment Escape Emplacement Follow-on Attack Each of the Nodes in the Network Consist of Activities which Emmitt “Signals” and Patterns that can be Detected, Analyzed and Acted Upon

19. 9 Activities can be Decomposed into Process Models

20. 10 Timeliness - Combination of Event, Request and Time Driven Processing Level 1- Tactical Exploitation Level 2-Operational Exploitation Level 3/4/5- Strategic Exploitation Months To Continuous Days To Weeks Minutes To Hours

22. However due to: intelligence gathering limitations, deception performed by the adversary, overlapping activities of various non-adversarial groups, etc., we need to model the activities of adversarial organizations as only partially observable.

23. The task at hand is therefore to develop a signal model that can be used to distinguish between suspicious pattern and real hostile activities. The model must be able to:

24. Detect potential threats in a highly cluttered environment

25. Efficiently analyze large amount of data

26. Generate hypothesis with only partial information

27. Predict missing and future information

28. Prune the search of the best fit of observations to dynamic templates.

29. We will represent the signal model as an event driven transaction model, which identifies relationships between nodes in the network to describe their structure and behavior.

32. Detect Possible Trends

33. Achieve “NRT Insight”Events Signifies the Activities they Represent Aggregate Low Level Complex Event Patterns That Machines can Detect CEP is a way of distilling the information value from a number of simple events into more useful summary level complex events improving Situational Awareness and timely decision making

35. No combinatorial issues

36. Event driven system behavior

37. Concurrently tracking multiple template matching in different dimensions

38. Pruning template space as case file progresses

39. Bottom-up aggregation of knowledge

40. Context sensitive help for human decision making

41. Human-human co-ordination built in

42. Optimize resource allocation

43. Rich modeling environment

44. Arbitrary decomposition and aggregation

45. Adapt to changes rapidly

46. Arbitrary re-combination of auto and manual templates as appropriate

48. 16 Example of UI with Dynamic Template Matching Visualization 1 3 2 4 5 2: Contextual Reports 1: Data Driven Browser 3: Low level Activity Match 4: Higher level Activity Match (triggered by Lower level) 5: Notifications and Alerts The continuous dynamic template matching with human-in-the-loop control improves situational and activity awareness and promotes timely decision making based on actionable intelligence

50. Binds data and services to dynamic business processes

51. Simplifies the development process

52. Focuses on the solution, not the build with directly executable models

53. Rapid iterative development and delivery

54. Pre-built Frameworks for Verticals (include integrated Web UI)

55. Template Matching Language for investigative problems