Data mining not yet ready to take on terror cells.

• Author: Pappalardo, Joe
• Position: Security beat: homeland defense briefs

Despite advances in the science behind data mining--the use of software programs to sift through reams of data to find suspicious patterns--the practice may not be ready for full-scale use in homeland security and terrorist hunting, according to a leading expert.

Chief among the limitations is a lack of real-world examples to create the profiles that suggest dangerous activity, according to Bhavani Thuraisingham, director of the information and data management program at the National Science Foundation.

"To apply data mining, you have to learn from the past. There are not enough real training examples, so we have to come up with hypothetical examples," she said a recent conference. "The question is, can you build a model with only 10 good examples? The answer is usually no."

Another limitation cited by Thuraisingham is the complexity of building real-time mining programs that can collate massive amounts of data under time constraints. "Right now, we need humans in the loop to examine the results. Automatically, the system can not say, 'This is a false positive.'"

Real-time data mining currently is being used for credit and calling card fraud detection, but Thuraisingham said in those cases models can be crafted ahead of time, and "we still don't have a way to build models in real-time."

Other uses for data mining may include using the system to monitor data from biological sensors, medical databases and to protect networks from hackers. "This is a very new area. Before 9/11, not many people were...