Paper ID# 901408.PDF
IMPROVED SITUATION ASSESSMENT THROUGH EARLY
DETECTION DURING A BIOTERRORIST ATTACK
BY USING DYNAMIC GRAPH MATCHING
Kedar Sambhoos & Moises Sudit Jomon Paul
CUBRC, Inc. Coles College of Business,
Information Exploitation Division Kennesaw State University,
Buffalo, NY 14225 Atlanta, GA
19 August 2009
loss and human casualties. One of the most recent and
significant man-made disasters occurred on September 11,
The detection of a bioterror agent and/or the attack is 2001, when the World Trade Center in New York City was
very important to minimize losses to lives and the attacked by terrorists. Approximately 2750 people were
economy. The current approaches to early detection of killed and another 2260 injured. The economic losses
bioterror agent/attack detection take one of two main suffered have been in the order of trillions of dollars .
approaches. The first approach focuses on the use of This was followed in September and October of 2001 by a
biosensors for detecting the attack or agent while the bioterrorist attack involving anthrax in which around 22
second approach focuses on the use of syndromic people were infected and resulted in 5 deaths .
surveillance to detect a possible attack. Studies using this Therefore the detection of a bioterror agent and/or the
approach have pointed out its strengths (reasonably early attack is very important to minimize losses to lives and the
detection of large scale outbreaks) and weaknesses (lack economy.
of sensitivity to small or isolated cases, false positives,
Many of the recent approaches on bioterror
cost etc). Therefore, recently, the use of syndromic
agent/attack detection focus on the use of biosensors for
surveillance methods for early outbreak warning has
detecting the attack or agent . However, to obtain
given way to using the methods for broader range
total coverage of a region using biosensors may not be
situational awareness activities to support public health
feasible due to cost limitations. In addition, they are far
planning and response activities.
from infallible and have a likelihood of failure associated
In this paper, we use novel dynamic graph matching with them. Other approaches focus on the use of
algorithm and gravity models to formulate a more precise syndromic surveillance to detect a possible attack.
and efficient methodology for detection. Our methodology Previous studies using this approach (: to name a
will analyze patient symptom data available at hospitals few) have pointed out its strengths (early detection) and
using dynamic graph matching algorithms. We propose a weaknesses (false positives, cost etc).
heuristic that dynamically updates the template graphs
Here we suggest a mechanism to detect the attack at
based on patient data before applying matching
the hospital level using dynamic graph matching
algorithms, a unique feature of this study. Successful
algorithm. The current project enhances the graphical
matches will be used to update counters that generate
science methodology through the development and
alerts. We have developed a heuristic that uses a gravity
utilization of dynamic matching as one of the unique
model to group hospitals in a region into clusters based
features of this study. This involves continuous scanning
on the population they serve. Hospitals grouped together
of hospital patient data and trying to find patterns with
as a cluster affect counters that are local to the
templates containing the basic symptoms of patients
population they serve and generate alarms to the Public
infected with agents such as anthrax or smallpox. One of
Health Department when they surpass the set threshold
the problems with only having a graph matching process
values. These models could be used to develop practical
that falls short to correlate findings from a network of
applications for agencies such as DHS due to its ability to
hospitals in the region is that it might delay detection. If
increase not just the likelihood of detection of a
the hospital data is grouped in a region together, it might
bioterrorism attack but also to identify with greater
however lead to a lot of false alarms. To address this, a
precision the location(s) of the attack.
clustering algorithm is proposed that uses a gravity model
INTRODUCTION to calculate degree of belonging of hospitals to specific
Man-made disasters, such as terrorist attack, industrial clusters. This grouping enables the data of hospitals in the
same cluster to be analyzed together and increases the
accidents, acts of war, can result in significant economic
1 of 6
Paper ID# 901408.PDF
probability of detection (minimizes false alarms) of an along these lines. Cohen and Lee  used a multinomial
attack, a concern raised against previous studies on logit model to predict the hospital utilization. The factors
syndromic surveillance . We use the fact that some they consider in their model and are related to the
symptoms are unique to anthrax or smallpox while others probability of hospital selection include travel time
are similar to some of the very common diseases to make between patients and hospitals, hospital attractiveness
our algorithms more robust. We create counters for each of factors, physician characteristics, and patient
these groups. When values of the counter surpass the characteristics. Hunt-McCool et al. , estimate medical
threshold values, public health officials are notified of care demand using four functional forms with each model
possible attack. Previous research on hospital capacity having the demand for physician outpatient services or
planning during bioterrorist attacks  has highlighted the inpatient hospital episodes as a dependent variable and
potential role of such counters in alerting appropriate prices, socioeconomic variables such as income, age etc,
officials. Here the aim is to formulate a comprehensive urbanization and indicators for self-reported health as
disaster plan for bioterrorist attacks. independent variables.
LITERATURE REVIEW Congdon  developed gravity models for patient
flows as a function of patient demand, available resources,
The current literature on bioterror agent/attack
indices of accessibility and proximity with an aim to
detection also follows the two main approaches mentioned
reconfigure emergency services. The model is used to
earlier. The first approach focuses on the use of
study the impact on patient flows resulting from the
Autonomous Detection Systems (ADS), biosensors etc for
closure of existing sites, addition of new sites, addition of
the detection. ADS are designed to detect agents of
beds at existing sites etc. Perea-Milla et al.  show that
biologic and chemical terror in the environment and
estimation of real population i.e. the demographic structure
provide approximate real-time alerts that an agent is
and population denominators such as floating population
present . One such kind of ADS has been deployed in
or tourist load have a significant impact on the utilization
hundreds of postal distribution centers across the United
of healthcare services. They demonstrate this through an
States. Similar to ADS, a lot of research is being done in
ecological study model. In this paper we use a gravity
developing efficient biosensors. Although most of the
model to generate the distribution of demand among
existing biosensors are used for medical applications ,
hospitals in a region. We need to tie it all together in
a surge in the usage of biosensors for non-medical
regards to our paper.
monitoring and analysis is anticipated. In particular,
several biosensors have been/are being developed for the METHODOLOGY
detection and prevention of bioterrorist attacks .
We can detect bioagents either before attack takes
However, there are some limitations with biosensors. They
place or after an attack. Probability of detection before
are expensive; vulnerable to false positives (interferences);
attack depends on the accuracy of the devices like
and suffer from detection issues (collection of samples on
biosensors which is significantly less than 1. Even though
substrate); etc .
they have high probability of success, there exist cost
The second approach focuses on using models that limitations that prevent biosensors from being located
include syndromic surveillance , screening of blood everywhere especially the low risk regions like small
donors , use of human antibodies for detection  towns. Since the bioterror agents are airborne, the attack
and models focusing on the clinicians ability to detect such can be carried out in these low risk regions and with time
attacks . Syndromic surveillance, the most popular of spread to high risk regions. By the time they get detected
these techniques, attempts to fuse clinical data with other in the high risk regions because of an efficient biosensor
data such as school absenteeism, pharmacy purchase data network it might be too late since rate of infection is
and other data (from many geographic areas) to pinpoint inversely proportional to the rate of detection  and
outbreaks (say within a zip code). Though these techniques directly proportional to the losses both societal and
are very effective they suffer from limitations such as false economic. This makes need for a mechanism for early
positives and cost . The focus of our work is early detection post attack very important. The other action that
detection and we use an approach similar to syndromic could be taken if biosensors were successful is to better
surveillance. plan the hospitals to be ready for patients expected to
come in later  . The notations used here are as follows:
As pointed earlier if we group data of all the hospitals
in a region together, it might however lead to a lot of false P(D) = probability of detection of agent.
alarms. Distribution of demand for medical care in a P(D|A) = probability of detection given
region among its hospitals is a good way to address this attack.
issue. We discuss models in literature that are developed
2 of 6
Paper ID# 901408.PDF
P(D|NA) = probability of detection given no infection resulting from inhalation of Bacillus anthracis
attack (detection of agent). has a mortality rate approaching 100%.
P(Sb) = probability of success of The third form is gastrointestinal anthrax which occurs
2 to 5 days after the ingestion of undercooked infected
L = Losses (Societal + Economic)
P(I) = Probability of Infection. meat. In the initial stages the symptoms are very similar to
T = Time from attack to Detection. those of food poisoning but can worsen to include severe
stomach pain, vomiting of blood, and severe diarrhea.
P(D) = P(D|A) = P(D|NA) Oropharyngeal anthrax is the least common form of
P(D|NA) = P(Sb) anthrax. The incubation period is from 1 to 7 days. Initial
P(D|A) α 1/P(I) symptoms include fever, swollen lymph nodes in the neck,
L α P(I) α T severe throat pain, difficulty swallowing, ulcers at the base
P(Sb) < 1 of the tongue etc. In the more severe stages the breathing
SYMPTOMS can become really difficult due to swelling .
There are four possible forms of the disease anthrax,
the most common of which is cutaneous anthrax in which
the organism enters through a break in the skin. The
Swollen Lymph Swallowing
cutaneous form begins as a bump that looks like an insect Throat Pain
bite and within days opens into a painless ulcer with a
Location: Base of
black area in the center. The patient may have fever, Level: Severe Location: Neck Level: Any Importance: 0.75
malaise and headache. Mortality of cutaneous anthrax Importance: 0.25
victims ranges from 20-25% without treatment, less than Importance: 0.25 Importance: 0.25 Importance: 0.75
one percent with treatment.
Figure 3. Template for Orpharyngeal Anthrax - Stage
Bump Malaise Headache
Swollen Lymph Swallowing Breathing
Throat Pain Fever Ulcer
Nodes Difficulty Difficulty
Importance: Importance: Importance: Level: Severe Location: Neck Level: Any
Importance: Location: Base Reason:
0.75 of Tongue Swelling
0.25 0.25 0.25 Importance:
Importance: Importance: Importance: Importance:
Figure 1. Template for Cutaneous Anthrax - Stage I. 0.25 0.25 0.75 0.75
Figure 4. Template for Orpharyngeal Anthrax - Stage
Smallpox is an infectious disease unique to humans,
Headache Malaise Fever Ulcer
caused by either of two virus variants named Variola
major and Variola minor . There are four types of
Importance: Importance: Importance:
Center: Black smallpox that a person could get a) Classical variety b)
0.5 0.5 0.25
Hemarroghic c) Malignant d) Modified. Malignant
smallpox is the most severe one and modified is the least
severe variety of smallpox.
Figure 2. Template for Cutaneous Anthrax - Stage II.
A more serious form is inhalation anthrax in which the
Hospitals could play a pivotal role in detection if the
victim breathes in the organism and develops a severe
hospital data is processed continuously to check for
respiratory disease. The signs and symptoms of
symptoms that match with those of anthrax patients. There
inhalational anthrax follow a two stage pattern. In the first
is need for robust models because the symptoms of anthrax
stage, the symptoms commonly observed are viral
and small pox patients are very similar to some very
respiratory illness, sore throat, mild fever, muscle aches,
common diseases like influenza and chickenpox
malaise etc. In the second and fulminant stage, the
respectively We achieve this by setting up counters for
symptoms observed are shortness of breath, fever, shock,
patients showing up with symptoms like those of anthrax..
meningitis, respiratory failure etc. . Systemic
Counters get updated through the use of graph matching
3 of 6
Paper ID# 901408.PDF
algorithm. Whenever a new patient data matches the
template anthrax patient data it updates the counter. If the
value of counter goes beyond a threshold it triggers an Hospital 1
alarm to public health officials about the possibility of an A B
attack. Discuss later the determination of threshold value
and its importance. The graph matching algorithm is PE
discussed in detail in . Hospital 2
GRAPH GENERATION HEURISTIC
Two patients with same symptoms but showing up at Hospital 7
hospitals at different infection stages (severity), belonging Hospital 6
to different areas of a region (different risks of attack) etc
cannot be compared to the template in the exact same Hospital 8
manner. The symptoms in the patient graphs need to be
adjusted to incorporate the impact of these factors to - A, B, C, D and E are possible points of attack
- Eight Hospitals are located in the region
reduce the possibility of false alarms. We suggest a - PA, PB etc are the probabilities of attack at points A, B respectively in the region
heuristic which is designed to achieve this objective. The
patient symptoms are given variable significance based on Figure 5. Hospital Clustering Scenario.
the stage of infection, time since attack happened, severity
DEMAND ESTIMATION MODEL
of symptoms and also based on the probability of attack of
region which patients belong to. In other words if two The allocation of demand for hospital services in a
patients come with same symptoms, we consider the region could be significantly influenced by factors having
patient coming from the region with higher probability of positive as well as negative impacts on it. In addition it is a
attack to be more severe and therefore heavily weighted. possible that multiple hospitals could serve the same
The average incubation period length is used as a standard cluster and multiple clusters get served by the same
to rate the severity of the symptoms. If the length of period hospital. Thus every hospital will have a degree of
since the patient had the symptom is almost close to the belonging or interaction level with respect to all the
average incubation period for anthrax patients we rate it clusters. This degree of belonging is pivotal for the
more severe than if it was less than the incubation period grouping of hospitals. We calculate this degree of
length. Thus a multiparameter approach is used to generate belonging uj(i) of a hospital j to a population cluster i
and modify importance of templates that are again specific using gravity models as follows.
to the patient. Based on the heuristic the templates would
vary for according to the various infections. A detail Uj(i) = ZijAj
description of these infections is given in “Methodology” where,
section. Zij = Population at cluster j that goes to hospital i
Aj = Probability of attack at j
CLUSTERING OF HOSPITALS
One of the issues with only having a graph matching; We estimate Zij using a multinomial logit regression
that does not correlate findings from network of hospitals model. We use an approach that is similar to that used by
in the region is that it might delay detection. In addition if . The percentage of demand of population cluster i that
we group data of all the hospitals in a region together, it goes to hospital j can therefore be estimated as follows
might lead to a lot of false alarms. In this study we propose exp ������������
a heuristic that group’s hospitals that serve the same ���� ���� = ���� =
1 + ���� exp ������������
demand clusters. This grouping enables the data of
hospitals in the same cluster to be analyzed together and ����
increases the probability of detection (minimizes false
������������ = �������� + ������������ ������������
alarms) of an attack. In order to achieve this we first divide
a region into k clusters using a k-means clustering
Zij = f(Size/Capacity of hospital, travel time, category of
algorithm. Then we determine share of cluster demand that
hospital (trauma, surgical, etc), number of physicians
goes to each hospital using gravity modeling. Specifically with admission privileges to hospital, quality of care)
we use multinomial logit model. Then the outputs of this P(Yj = i) = Probability that cluster j will select hospital I or
model are used to group hospitals via a heuristic. This
proportion of cluster j population served by
problem scenario is described in Figure 5. hospital i
4 of 6
Paper ID# 901408.PDF
 Milanovich, F. (1998) Reducing the threat of
We use the empirical models developed by Paul et al. biological weapons, in Science and Technology
 to determine capacities of the hospitals. The last Review, pp. 4-9.
factor that we consider in our model i.e. quality of care is
modeled by using indicators like hospital mortality rate,  Stoto, M.A., Schonlau, M. and Mariano, L.T. (2004)
hospital complication rate which are good measures of syndromic surveillance: Is it worth the effort?
health outcomes in a hospital. The multinomial logit chance,17, 19-24.
models determine the market share for each hospital.
 Williams, S.C.P. (2007) Study questions using
As patients arrive in the hospital along with other syndromic surveillance for anthrax, in Stanford
details, their address info (cluster that they belong to) is Report.
recorded. If graph matching algorithm indicates that
patient has symptoms similar to anthrax, counters specific  Paul, J.A. and Hariharan, G. (2007) Hospital
to the cluster are updated provided that they belong to the capacity planning for efficient disaster mitigation
same cluster and they show up at the hospitals that are during a bioterrorist attack, in Winter Simulation,
grouped for that particular cluster. When counter values Washington DC.
surpass the threshold value, the public health officials are
notified of a possible attack.  CDC (2004) Responding to Detection of
CONCLUSIONS Aerosolized Bacillus anthracis by Autonomous
Detection Systems in the Workplace. MMWR,53.
Our research addresses an area of great importance in
bioterrorism planning and detection using a wide array of  Sugawara, T., Ohkusa, Y., Sugiura, H., Kodama, K.,
decision tools and techniques. It has practical applications Horie, T., Kikuchi, K., Taniguchi, K. and Okabe, N.
to agencies such as DHS due to its ability to increase not (2007) Construction of Automatic Syndromic
just the likelihood of detection of a bioterrorism attack but Surveillance For Early Detection of Bioterrorism
also to identify with greater precision the location(s) of the Attack in Proceedings of the iHEA 2007 6th World
attack. The potential applications of our proposed research Congress: Explorations in Health Economics Paper
extends well beyond bioterrorism. Most recent case of City.
possible pandemic is the outbreak of Swine flu  in the
northern American sub-continent causing more than 100  Paquette, L. (2004) Bioterrorism in medical and
deaths in Mexico and a worldwide spreading concern. The healthcare administration / Laure Paquette, New
models we develop can be used with little modification for York :.
such pandemics and epidemics like SARS, bird flu etc. It
can also be used to better identify regions that need special  Gooding, J.J. (2006) Biosensor technology for
attention/resources with respect to prevention and detecting biological warfare agents: Recent progress
intervention efforts for chronic disease, HIV/AIDS. We and future trends. Analytica Chimica Acta,559, 137-
plan to complete multiple research papers for publication 151.
and presentation in national conferences. As future work,
we will develop specific applications for use in  Sansen, W.M. (1986) Critical and emerging issues
bioterrorism planning and detection by local and national in biosensors, IEEE, New York, NY, USA, pp. 52-
agencies such as DHS. 53.
 Buckeridge, D.L., Owens, D.K., Switzer, P., Frank,
 Wikipedia. September 11, 2001 attacks. 2001 J. and Musen, M.A. (2006) Evaluating Detection of
Available from: an Inhalational Anthrax Outbreak. Emerging
http://en.wikipedia.org/wiki/September_11,_2001_a Infectious Diseases, 12, 1942-1949.
 Kaplan, E.H., Patton, C.A., FitzGerald, W.P. and
 Wikipedia. 2001 anthrax attacks. 2001 Available Wein, L.M. (2003) Detecting Bioterror Attacks by
from: Screening Blood Donors: A Best-Case Analysis.
http://en.wikipedia.org/wiki/2001_anthrax_attacks Emerging Infectious Diseases,9, 909-914.
 Block, S.M. (2001) The growing threat of biological  Zhou, B., Wirsching, P. and Janda, K.D. (2002)
weapons. American Scientist, 89, 28-37. Human antibodies against spores of the genus
5 of 6
Paper ID# 901408.PDF
Bacillus: A model study for detection of and  Sudit, M., Nagi, R., Stotz, A. and Sambhoos, K.
protection against anthrax and the bioterrorist threat. (2006) A Graph-Based Framework for Fusion: From
PNAS, 99, 5241-5246. Hypothesis Generation to Forensics, in Proceedings
of the The 9th International Conference on
 Adamou, C., Cooper, G.F., Wong, W.-K., Dowling, Information Fusion, City.
J.N. and Hogan, W.R. (2006) Advances in Disease
Surveillance 1-3.  Defence journal (1998) Anthrax as a weapon of
terrorism and difficulties presented in response to its
 Hunt-McCool, J., Kiker, B.f. and Chung, Y. (1994) use, in Special report.
Estimates of the demand for medical care under
different functional forms. JOURNAL OF  Stevens, L.M. (2001) Antrax. Anthrax,286, 2626.
APPLIED ECONOMETRICS,9, 201-218.
 Tasota, F.J., Henker, R.A. and Hoffman, L.A.
 Perea-Milla, E., Pons, S.M., Rivas-Ruiz1, F., (2002) Anthrax as a biological weapon: An old
Gallofre, A., Jurado, E.N., Ales, M.A.N., Jimenez- disease that poses a new threat. Critical Care Nurse,
Puente, A., Fernandez-Nieto, F., Cerda, J.C.M., 22, 21-36.
Carrasco, M., Martin, L., Cano, D.L., Gutierrez,
G.E., Macías, R.C. and Garcia-Ruiz1, J.A. (2007)  Lee, H.L. and Cohen, M.A. (1985) A Multinomial
Estimation of the real population and its impact on Logit Model for the Spatial Distribution of Hospital
the utilisation of healthcare services in Utilization Journal of Business & Economic
Mediterranean resort regions: an ecological study. Statistics,3, 159-168
BMC Health Services Research,7:13.
 Paul, J.A., George, S.K., Yi, P. and Lin, L. (2006)
 Congdon, P. (2001) The development of gravity Transient modeling in simulation of hospital
models for hospital patient flows under system operations for emergency response. Prehospital and
change: A bayesian modelling approach. Health Disaster Medicine, 21, 223-236.
Care Management Science,4, 289-304.
 Sabelnikov A, Zhukov V, Kempf R. Probability of
 K. Sambhoos, R. Nagi, M. Sudit, and A. Stotz, real-time detection versus probability of infection
“Enhancements to high level data fusion using for aerosolized biowarfare agents: A model study.
graph matching and state space search,” Submitted Biosensors and Bioelectronics. 2006; 21:2070-7.
to Information Fusion, An International Journal on
Multi-Sensor, Multi-Source Information Fusion,  WebMD. Anthrax - Symptoms. 2006 Available
2008. from: http://www.webmd.com/cold-and-
 Sambhoos, K. (2007) Graph matching applications
in high level information fusion, Ph.D. Dissertation  Ryan KJ, Ray CG. Sherris Medical Microbiology.
in Industrial Engineering at State University of New 4th edition ed: McGraw Hill 2004.
York at Buffalo.
 Wikipedia. Swine influenza. Available from:
6 of 6