• Knowledge discovery integrating heterogeneous data sources, such as text, web-sites, program code, video, audio, biometrics, and speech.
• Knowledge discovery for the joint detection, monitoring or understanding of intrusion, deception, fraud and criminal activity.
• Advanced data mining approaches for spam and phishing detection, and filtering of web pages to discover illegal content.
• Active, adaptive or anticipatory knowledge discovery approaches to keep filters up to date.
• Data and graph mining of network structures and communication patterns.
• Adversarial knowledge discovery, e.g. for randomized/perturbed attacks.
• Knowledge discovery for the attack attribution problem, e.g. by the analysis of traffic, log and protocol under the umbrella of e-forensics techniques.
• Quantification of threats imposed by data mining techniques to privacy/security and possible remedies like privacy preserving multi-party data mining.
• Knowledge discovery techniques applied to malware analysis or to any contextual information related to the malware problem.

• Terrorism Informatics: terrorism knowledge portals and database, forecasting and countering terrorism, terrorism root cause analysis and social network analysis.
• Infrastructure protection: public health and bioterrorism information infrastructure, transportation and communication infrastructure, border safety, intrusion detection.
• Emergency response: disaster prevention, detection and management, communication and decision support for search and rescue.
• Criminal data mining and network analysis, intelligence-related knowledge discovery.
• Deception and intent detection, authorship analysis and identification.
• Cyber-crime detection and analysis, web-based intelligence monitoring and analysis.
• Criminal/intelligence information sharing, visualization, policy and governance.
• Enterprise risk management and information system security: fraud detection, accounting and IT auditing, corporate sentiment surveillance, market influence analytics and media intelligence.

The workshop will bring together researchers working on advanced data mining approaches for CyberSecurity as well as large-scale security applications. In addition we anticipate practitioners from large enterprises, internet service providers, law enforcement and intelligence experts, and government agencies who want to be informed about the state of the art in CyberSecurity and Intelligence Informatics. Finally the workshop may be of interest to general data mining researchers, who want to apply their techniques to this domain.