Multiple hypothesis tracking
View Patent ↗Embodiments described herein are directed to multiple hypothesis systems and methods for tracking observations that are domain agnostic and involves determining the probability that a given set of observations (i.e., a track) corresponds to a particular target, object or linked set of events. One embodiment described herein relates to cyber security tracking methods and systems.
1. A multiple hypothesis tracking method for tracking observations, the method comprising:
receiving observations associated with data signals from a plurality of domain types;
distributing each of the observations to one or more association engines, wherein each association engine is configured for a particular domain type and each association engine manages zero or more preexisting tracks of observations;
associating each of the observations with a) the one or more preexisting tracks, or b) a newly generated track to generate an updated set of tracks;
sending the updated set of tracks with track quality scores for each track to a domain agnostic hypothesis manager;
updating a track hypothesis model of the domain agnostic hypothesis manager with the updated set of tracks;
determining a probability estimate for each track in the track hypothesis model and selecting a hypothesis for each cluster of related tracks stored in the track hypothesis model that satisfies a predetermined cluster condition;
sending the probability estimate for each track in the track hypothesis model and the selected hypothesis for each cluster of tracks to the one or more association engines to update track information in the one or more association engines; and
sending the updated track information with domain specific information to an entity collector module for distribution to a recipient processor.
2. The method of claim 1 , comprising selecting a subset of the tracks from the tracks in the selected hypothesis in the domain agnostic hypothesis manager that satisfy a predetermined criterion.
3. The method of claim 2 , wherein selecting the subset of the tracks from the tracks in the domain agnostic hypothesis manager comprises selecting tracks from the hypothesis having the highest probability estimate based on observations from a plurality of domain types.
4. The method of claim 1 , wherein the track hypothesis model does not include track state data that includes domain specific data.
5. The method of claim 1 , wherein the association engines are not required to include track cluster information.
6. The method of claim 1 , wherein updating the track hypothesis model comprises updating stored probability estimates and removing tracks that are inconsistent with the selected hypothesis for each cluster of tracks.
7. The method of claim 1 , wherein updating track information in the one or more association engines comprises updating stored probability estimates and removing tracks that do not satisfy a predetermined criterion.
8. The method of claim 1 , wherein a message handling system communicates messages between the domain agnostic hypothesis manager and the one or more association engines in the absence of domain specific data.
9. A multiple hypothesis tracking system for tracking observations, the system comprising:
an observation distributor module configured to receive observations associated with data signals from a plurality of domain types;
one or more association engines each configured for a particular domain type and each comprising zero or more preexisting tracks of observations stored in a data storage device, wherein each of the one or more association engines is configured to receive each of the observations from the observation distributor module and configured to associate each of the observations with a) the one or more preexisting tracks of observations, or b) one or more newly generated tracks to generate an updated set of tracks with track quality scores for each track; and
a domain agnostic hypothesis manager for, via a processor of the system, receiving the updated set of tracks, updating a track hypothesis model of the domain agnostic hypothesis manager with the updated set of tracks, determining a probability estimate for each track in the track hypothesis model, selecting a hypothesis for each cluster of related tracks stored in the track hypothesis model that satisfies a predetermined cluster condition, and sending the probability estimate for each track in the track hypothesis model and the selected hypothesis for each cluster of tracks to the one or more association engines to update track information in the one or more association engines.
10. The system of claim 9 , comprising an entity collector module configured to receive the updated track information with domain specific information for distribution to a recipient processor.
11. The system of claim 9 , comprising a message handling system configured to communicate messages between the domain agnostic hypothesis manager and the one or more association engines in the absence of domain specific data.
12. The system of claim 9 , wherein the processor selects a subset of the tracks from the tracks in the domain agnostic hypothesis manager that satisfy a predetermined criterion.
13. The system of claim 12 , wherein selecting the subset of the tracks from the tracks in the domain agnostic hypothesis manager comprises the processor selecting tracks from the hypothesis having the highest probability estimate based on observations from a plurality of domain types.
14. The system of claim 9 , wherein the track hypothesis model does not include track state data that includes domain specific data.
15. The system of claim 9 , wherein the one or more association engines are not required to include track cluster information.
16. The system of claim 9 , wherein the domain agnostic hypothesis manager is configured to update the track hypothesis model, update stored probability estimates and remove tracks that are inconsistent with the selected hypothesis for each cluster of tracks.
17. The system of claim 9 , wherein the one or more association engines are configured to update stored probability estimates and remove tracks that do not satisfy a predetermined criterion.