Scoring Alerts from Threat Detection Technologies

We describe methods to score alerts—hypotheses about suspected impending threat events that are issued, based on incrementally presented, time-stamped evidence, before the events occur. Our threat events (and thus alerts) have significant object-oriented structure. The alert s coring methods exploit related methods to score precision, recall, and F-value for structured threat hypotheses when s uch evidence is processed by threat detection technolog ies in a batch, forensic mode. We present a (deemed-impractical) idealized approach and derivative practical variant s. The implemented approach is part of a performance evaluation laboratory (PE Lab) that we have applied during a multi- year, multi-contractor Government research program.