Attacker behavior detection in critical infrastructure

Lone-actor (LA) terrorism has been one of the rising security threats of the last decade. The LA behavior and characteristics research has produced valuable information on demographics, classifications, and warning signs. Nonetheless, commonality among these characteristics does not imply similar outcomes for different attacks and the incident-scene behavior varies. Since the security footage videos of LA attacks are not publicly available, associating incident-scene behavior to the early and preparatory attacker behavior is a challenging research field. Serious games have been utilized to evaluate mitigation strategies to a natural disaster. At GRIST Lab at Rutgers University, we design virtual games to simulate real-world conditions to observe an attacker’s reaction to incident-scene dynamics. This study aims to identify short-term target and route selection decisions of the attacker through the data obtained from a virtual game; and in turn to develop better first responder allocation strategies against LA attacks. We implement time-series clustering and classification methods to the behavior differences between an attacker and other civilians based on spatio-temporal data. The findings indicate that these methods will be instrumental in developing LA detection and capture strategies.