Search

Data triage is a fundamental stage of cyber defense analysis for achieving cyber situational awareness in a Security Operations Center (SOC). It has a high requirement for cyber security analysts' capabilities of information processing and expertise in cyber defense. However, the present situation is that most novice analysts who are responsible for performing data triage tasks suffer a great deal from the complexity and intensity of their tasks. To fill the gap, we propose to provide novice analysts with on-the-job suggestions by presenting the relevant data triage operations conducted by senior analysts in previous tasks. In a previous study, a tracing method has been developed to track an analyst's data triage operations. This paper mainly presents a data triage operation retrieval system that (1) models the context of a data triage analytic process, (2) uses a centroid similarity matching method to compare contexts, and (3) presents the matched traces to the novice analysts as suggestions. We have implemented and evaluated the performance of the system through both automated testing and human evaluation. The results show that the proposed retrieval system can effectively identify the relevant traces based on an analyst's current analytic process.

Although many building blocks of today’s cyber-defense solutions are already fully automatic, there is still a debate on whether next-generation cyber-defense solutions should be wholly autonomous. In this paper, we contribute to the debate in the context of Cybersecurity Operations Centers (CSOCs), which have been widely established in prominent companies and organizations to achieve cyber situational awareness. Based on the lessons we learned from a recent case study on making CSOC data triage operations more autonomous, we conclude that instead of asking whether cyber operations can be made autonomous or not, it seems more appropriate to ask the following questions: (a) How to make cyber operations more autonomous? (b) What is the right research roadmap for making cyber operations more autonomous? We also comment on what should be the current frontier in building a significantly better CSOC.

Under the Navy’s Flexible Cyber-Secure Radio (FlexCSR) program, the Naval Information Warfare Center Pacific and the Massachusetts Institute of Technology’s Lincoln Laboratory are jointly developing a unique cybersecurity solution for tactical unmanned systems (UxS): the FlexCSR Security/Cyber Module (SCM) End Cryptographic Unit (ECU). To deal with possible loss of unmanned systems that contain the device, the SCM ECU uses only publicly available Commercial National Security Algorithms and a Tactical Key Management system to generate and distribute onboard mission keys that are destroyed at mission completion or upon compromise. This also significantly reduces the logistic complexity traditionally involved with protection and loading of classified cryptographic keys. The SCM ECU is on track to be certified by the National Security Agency for protecting tactical data-in-transit up to Secret level. The FlexCSR SCM ECU is the first stand-alone cryptographic module that conforms to the United States Department of Defense (DoD) Joint Communications Architecture for Unmanned Systems, an initiative by the Office of the Secretary of Defense supporting the interoperability pillar of the DoD Unmanned Systems Integrated Roadmap. It is a credit cardsized enclosed unit that provides USB interfaces for plaintext and ciphertext, support for radio controls and management, and a software Application Programming Interface that together allow easy integration into tactical UxS communication systems. This paper gives an overview of the architecture, interfaces, usage, and development and approval schedule of the device.

Online health communities constitute a useful source of information and social support for patients. American Cancer Society’s Cancer Survivor Network (CSN), a 173,000-member community, is the largest online network for cancer patients, survivors, and caregivers. A discussion thread in CSN is often initiated by a cancer survivor seeking support from other members of CSN. Discussion threads are multi-party conversations that often provide a source of social support e.g., by bringing about a change of sentiment from negative to positive on the part of the thread originator. While previous studies regarding cancer survivors have shown that members of an online health community derive benefits from their participation in such communities, causal accounts of the factors that contribute to the observed benefits have been lacking. We introduce a novel framework to examine the temporal causality of sentiment dynamics in the CSN. We construct a Probabilistic Computation Tree Logic representation and a corresponding probabilistic Kripke structure to represent and reason about the changes in sentiments of posts in a thread over time. We use a sentiment classifier trained using machine learning on a set of posts manually tagged with sentiment labels to classify posts as expressing either positive or negative sentiment. We analyze the probabilistic Kripke structure to identify the prima facie causes of sentiment change on the part of the thread originators in the CSN forum and their significance. We find that the sentiment of replies appears to causally influence the sentiment of the thread originator. Our experiments also show that the conclusions are robust with respect to the choice of the (i) classification threshold of the sentiment classifier; (ii) and the choice of the specific sentiment classifier used. We also extend the basic framework for temporal causality analysis to incorporate the uncertainty in the states of the probabilistic Kripke structure resulting from the use of an imperfect state transducer (in our case, the sentiment classifier). Our analysis of temporal causality of CSN sentiment dynamics offers new insights that the designers, managers and moderators of an online community such as CSN can utilize to facilitate and enhance the interactions so as to better meet the social support needs of the CSN participants. The proposed methodology for analysis of temporal causality has broad applicability in a variety of settings where the dynamics of the underlying system can be modeled in terms of state variables that change in response to internal or external inputs.

Searching local graph clusters is an important problem in big network analysis. Given a query node in a graph, local clustering aims at finding a subgraph around the query node, which consists of nodes highly relevant to the query node. Existing local clustering methods are based on single networks that contain limited information. In contrast, the real data are always comprehensive and can be represented better by multiple connected networks (multi-network). To take the advantage of heterogeneity of multi-network and improve the clustering accuracy, we advance a strategy for local graph clustering based on Multi-network Random Walk with Restart (MRWR), which discovers local clusters on a target network in association with additional networks. For the proposed local clustering method, we develop a localized approximate algorithm (AMRWR) on solid theoretical basis to speed up the searching process. To the best of our knowledge, this is the first elaboration of local clustering on a target network by integrating multiple networks. Empirical evaluations show that the proposed method improves clustering accuracy by more than 10% on average with competently short running time, compared with the alternative state-of-the-art graph clustering approaches.

Unmanned Systems (UxS) present unique challenges to Cybersecurity developers due to: (1) The need to secure these systems and protect classified information in the unmanned operational environment, where the UxS are often outside the visual range and physical control of the operator. (2) They require very low Size, Weight, and Power (SWaP) consumption constraints imposed by the smaller UxS. (3) They also impose long and costly approval processes for employing Cryptographic Products, Key Management Architectures, and other High Assurance security solutions in the military operational environment. Additionally, modularizing communications architectures to take advantage of rapid technological and SWaP advancements often results in multiple classification domains, and the need to move plaintext control information between these domains, which results in a Cross Domain Solutions (CDS), requirement. This paper details work supporting High Assurance Cybersecurity engineering for UxS that includes: (1) Investigating current approved cryptographic and CDS tactical products to assess their suitability for UxS operations. Although some current products can meet the larger UxS SWaP requirements, most approved products do not meet SWaP requirements for the smaller UxS. (2) Exploring potential new technologies that have not yet reached the operational stage but show promise for meeting the smaller UxS SWaP requirements. (3) Evaluating potential solutions that will meet the three challenges of deploying High Assurance Cybersecurity solutions onboard UxS in military operations.

Cyber defense analysts are playing a critical role in Security Operations Centers (SOCs) to make sense of the immense amount of network monitoring data for detecting and responding to cyber attacks, including large-scale cyber attack campaigns involving advanced persistent threats. The network data continuously generated by multiple cyber defense systems, which may contain many false alerts, are overwhelming to the analysts. Analysts often need to make quick decisions/responses in a very short time based on their awareness of the situation at that moment. Data triage is the first and the most fundamental step performed routinely by the analysts — it filters a massive network monitoring data to identify known malicious events. Due to the high noise-to-signal ratio of network monitoring data, this steps accounts for a very significant portion of the time and attention of intrusion detection analysts. Therefore, a smart human-machine system that improves the performance of data triage operation in SOC is highly desirable. In this chapter, we describe a human-centered smart data triage system that leverages the cognitive trace of intrusion detection analysts. Our approach is based on a dynamic cyber-human system that integrates three dimensions: cyber defense analysts, network monitoring data, and attack activities. The approach leverages recorded analytic processes of intrusion detection analysts, which we refer to as “cognitive traces”. These traces of the analysts capture the examples of malicious events detected from the network monitoring data. Such traces from senior analysts provide a powerful opportunity for training junior analysts in performing data triage operations. To realize this potential, we also developed a smart retrieval framework that automatically retrieves traces of other senior analysts based on their similarity to the events already identified by a junior analyst. The traces from analysts, as demonstrated by a case study, also enable us to better understand their analytic processes in a systematic, yet minimum-reactive way. We summarize this chapter by discussing limitations of the proposed framework and the directions of future research regarding improving the data triage operations of cyber defense analysts.

This chapter studies the zero-day attack path identification problem. Detecting zero-day attacks is a fundamental challenge faced by enterprise network security defense. A multi-step attack involving one or more zero-day exploits forms a zero-day attack path. This chapter describes a prototype system called ZePro, which takes a probabilistic approach for zero-day attack path identification. ZePro first constructs a network-wide system object instance graph by parsing system calls collected from all hosts in the network, and then builds a Bayesian network on top of the instance graph. The instance-graph-based Bayesian network is able to incorporate the collected intrusion evidence and infer the probabilities of object instances being infected. By connecting the instances with high probabilities, ZePro is able to generate the zero-day attack paths. This chapter evaluated the effectiveness of ZePro for zero-day attack path identification.

In this chapter, we provide an overview of Cyber Situational Awareness, an emerging research area in the broad field of cyber security, and discuss, at least at a high level, how to gain Cyber Situation Awareness. Our discussion focuses on answering the following questions: What is Cyber Situation Awareness? Why is research needed? What are the current research objectives and inspiring scientific principles? Why should one take a multidisciplinary approach? How could one take an end-to-end holistic approach? What are the future research directions?

Zero-day attacks continue to challenge the enterprise network security defense. A zero-day attack path is formed when a multi-step attack contains one or more zero-day exploits. Detecting zero-day attack paths in time could enable early disclosure of zero-day threats. In this paper, we propose a probabilistic approach to identify zero-day attack paths and implement a prototype system named ZePro. An object instance graph is first built from system calls to capture the intrusion propagation. To further reveal the zero-day attack paths hiding in the instance graph, our system constructs an instance-graph-based Bayesian network. By leveraging intrusion evidence, the Bayesian network can quantitatively compute the probabilities of object instances being infected. The object instances with high infection probabilities reveal themselves and form the zero-day attack paths. The experiment results show that our system can effectively identify zero-day attack paths.

Security Operation Centers rely on data triage to identify the true "signals" from a large volume of noisy alerts and "connect the dots" to answer certain higher-level questions about the attack activities. This work aims to automatically generate data triage automatons directly from cybersecurity analysts' operation traces. Existing methods for generating data triage automatons, including Security Information and Event Management systems (SIEMs), require event correlation rules to be generated by dedicated manual effort from expert analysts. To save analysts' workloads, we propose to "mine" data triage rules out of cybersecurity analysts' operation traces and to use these rules to construct data triage automatons. Our approach may make the cost (of data triage automaton generation) orders of magnitudes smaller. We have designed and implemented the new system and evaluated it through a human-in-the-loop case study. The case study shows that our system can use the analysts' operation traces as input and automatically generate a corresponding state machine for data triage. The operation traces were collected in our previous lab experiment. 29 professional cybersecurity analysts were recruited to analyze a set of IDS alerts and firewall logs. False positive and false negative rates were calculated to evaluate the performance of the data triage state machine by comparing with the ground truth.

Discovering unknown adverse drug reactions (ADRs) in postmarketing surveillance as early as possible is of great importance. The current approach to postmarketing surveillance primarily relies on spontaneous reporting. It is a passive surveillance system and limited by gross underreporting (

Cognitive studies indicate that members of a high performing team often develop shared mental models to predict others' needs and coordinate their behaviors. The concept of shared mental models is especially useful in the study of human-centered collaborative systems that require humans to team with autonomous agents in complex activities. We take the position that in a mixed human-agent team, agents empowered with cognitive load models of human team members can help humans develop better shared mental models to enhance team performance. Inspired by human information processing system, we here propose a HMM-based load model for members of human-agent teams, and investigate the development of realistic cognitive load models. A cognitive experiment was conducted in team contexts to collect data about the observable secondary task performance of human participants. The data were used to train hidden Markov models (HMM) with varied numbers of hypothetical hidden states. The result indicates that the model spaces have a three-layer structure. Statistical analysis also reveals some characteristics of the models at the top-layer. This study can be used in guiding the selection of HMM-based cognitive load models for agents in human-centered multi-agent systems.

The recognition-primed decision (RPD) model is a primary naturalistic decision-making approach which seeks to explicitly recognize how human decision makers handle complex tasks and environment based on their experience. Motivated by the need for quantitative computer modeling and simulation of human decision processes in various application domains, including medicine, we have developed a general-purpose computational fuzzy RPD model that utilizes fuzzy sets, fuzzy rules, and fuzzy reasoning to represent, interpret, and compute imprecise and subjective information in every aspect of the model. Experiences acquired by solicitation with experts are stored in experience knowledge bases. New local and global similarity measures have been developed to identify the experience that is most applicable to the current situation in a specific decision-making context. Furthermore, an action evaluation strategy has been developed to select the workable course of action. The proposed fuzzy RPD model has been preliminarily validated by using it to calculate the extent of causality between a drug (Cisapride, withdrawn by the FDA from the market in 2000) and some of its adverse effects for 100 hypothetical patients. The simulated patients were created based on the profiles of over 1000 actual patients treated with the drug at our medical center before its withdrawal. The model validity was demonstrated by comparing the decisions made by the proposed model and those by two independent internists. The levels of agreement were established by the weighted Kappa statistic and the results suggested good to excellent agreement.

Discovering unknown adverse drug reactions (ADRs) in postmarketing surveillance as early as possible is highly desirable. Nevertheless, current postmarketing surveillance methods largely rely on spontaneous reports that suffer from serious underreporting, latency, and inconsistent reporting. Thus these methods are not ideal for rapidly identifying rare ADRs. The multiagent systems paradigm is an emerging and effective approach to tackling distributed problems, especially when data sources and knowledge are geographically located in different places and coordination and collaboration are necessary for decision making. In this article, we propose an active, multiagent framework for early detection of ADRs by utilizing electronic patient data distributed across many different sources and locations. In this framework, intelligent agents assist a team of experts based on the well-known human decision-making model called Recognition-Primed Decision (RPD). We generalize the RPD model to a fuzzy RPD model and utilize fuzzy logic technology to not only represent, interpret, and compute imprecise and subjective cues that are commonly encountered in the ADR problem but also to retrieve prior experiences by evaluating the extent of matching between the current situation and a past experience. We describe our preliminary multiagent system design and illustrate its potential benefits for assisting expert teams in early detection of previously unknown ADRs. © 2007 Wiley Periodicals, Inc. Int J Int Syst 22: 827–845, 2007.

Online health communities are a major source for patients and their informal caregivers in the process of gathering information and seeking social support. The Cancer Survivors Network of the American Cancer Society has many users and presents a large number of user interactions with regards to coping with cancer. Sentiment analysis is an important process in understanding members' needs and concerns and the impact of users' responses on other members. It aims to determine the participants' subjective attitude and reflect their emotions. Analyzing the sentiment of posts in online health communities enables the investigation of various factors such as what affects the sentiment change and discovery of sentiment change patterns. Since each writer has his or her own personality, and temporal emotional state, behavioral traits can be reflected in the writer's writing style. Pronouns are function-words which often convey some unique styling patterns into the texts. Drawing on a lexical approach to emotions, we conduct factor analysis on the use of pronouns in self-descriptions texts. Our analysis shows that the usage of pronouns has an effect on sentiment classification. Moreover, we evaluated the use of pronouns in our domain, and found it different than standard English usage.

As cyber-attacks become more sophisticated, cyber-attack analysts are required to process large amounts of network data and to reason under uncertainty with the aim of detecting cyber-attacks. Capturing and studying the fine-grained analysts' cognitive processes helps researchers gain deep understanding of how they conduct analytical reasoning and elicit their procedure knowledge and experience to further improve their performance. However, it's very challenging to conduct cognitive task analysis studies in cyber-attack analysis. To address the problem, we propose an integrated computer-aided data collection method for cognitive task analysis (CTA) which has three building blocks: a trace representation of the fine-grained cyber-attack analysis process, a computer tool supporting process tracing and a laboratory experiment for collecting traces of analysts' cognitive processes in conducting a cyber-attack analysis task. This CTA method integrates automatic capture and situated self-reports in a novel way to avoiding distracting analysts from their work and adding much extra work load. With IRB approval, we recruited thirteen full-time professional analysts and seventeen doctoral students specialized in cyber security in our experiment. We mainly employ the qualitative data analysis method to analyze the collected traces and analysts' comments. The results of the preliminary trace analysis turn out highly promising.

This paper describes the concept of workflow merge and methods for merging business processes. We grouped merges in four categories according to the type of merge: sequential, parallel, conditional, and iterative, and describe the corresponding algorithms for performing these operations. We give results that allow us to determine whether a merge operation is sound. It is shown that to avoid invalid merges, one should choose merge points between which a sub-workflow, called a merge region, is well structured. These findings can provide useful guidance for future workflow merge research. We also raise issues of more complex merge problems, such as merge conflicts, semantic ambiguities and workflow splits.

MALLET, a multi-agent logic language for encoding teamwork, is intended to enable expression of teamwork emulating human teamwork, allowing experimentation with different levels and forms of inferred team intelligence. A consequence of this goal is that the actual teamwork behavior is determined by the level of intelligence built into the underlying system as well as the semantics of the language. In this paper, we give the design objectives, the syntax, and an operational semantics for MALLET in terms of a transition system. We show how the semantics can be used to reason about the behaviors of team-based agents. The semantics can also be used to guide the implementation of various MALLET interpreters emulating different forms of team intelligence, as well as formally study the properties of team-based agents specified in MALLET. We have explored various forms of proactive information exchange behavior embodied in human teamwork using the CAST system, which implements a built-in MALLET interpreter.

Trends & Controversies this issue grows out of a panel discussion at the 2005 AAAI Spring Symposium on Al Technologies and Homeland Security, held at Stanford University in March 2005. Robert Popp, who gave the keynote speech at the symposium, describes a DARPA initiative for dealing with the 21st-century strategic threat triad: failed states, global terrorism, and weapons of mass destruction proliferation. George Cybenko presents a philosophical/strategic viewpoint on national security. K.A. Taipale discusses policy implications of using trusted systems for counterterrorism security and how risk management, decision heuristics, and the presumption of innocence relate to such systems. Latanya Sweeney proposes privacy-aware technology (selective revelation) that allows data about people to be shared for surveillance purposes while protecting their privacy. Paul Rosenzweig points out two major changes in privacy protection in the post-9/11 era: the broadening of the approach to generating privacy policy/rules from a purely top-down process to one that includes a bottom-up component in which privacy is protected through institutional oversight, and a change from a focus on rules to a focus on results. These five articles present a snapshot of the complex interactions between information security and privacy. A comprehensive understanding of such interactions is critical for developing solutions, whether they are technological solutions, political solutions, or both.

Keeping track of changing interests is a natural phenomenon as well as an interesting tracking problem because interests can emerge and diminish at different time frames. Being able to do so with a few feedback examples poses an even more important and challenging problem because existing concept drift learning algorithms that handle the task typically suffer from it. This work presents a new computational framework for extending incomplete labeled data stream (FEILDS), which extends the capability of existing algorithms for learning concept drift from a few labeled data. The system transforms the original input stream into a new stream that can be conveniently tracked by the existing learning algorithms. The experiment results reveal that FEILDS can significantly improve the performances of a Multiple Three-Descriptor Representation (MTDR) algorithm, Rocchio algorithm, and window-based concept drift learning algorithms when learning from a sparsely labeled data stream with respect to their performances without using FEILDS.

Among researchers in multi-agent systems there has been growing interest in using intelligent agents to model and simulate human teamwork behaviors. Teamwork modeling is important for training humans in gaining collaborative skills, for supporting humans in making critical decisions by proactively gathering, fusing, and sharing information, and for building coherent teams with both humans and agents working effectively on intelligence-intensive problems. Teamwork modeling is also challenging because the research has spanned diverse disciplines from business management to cognitive science, human discourse, and distributed artificial intelligence. This article presents an extensive, but not exhaustive, list of work in the field, where the taxonomy is organized along two main dimensions: team social structure and social behaviors. Along the dimension of social structure, we consider agent-only teams and mixed human–agent teams. Along the dimension of social behaviors, we consider collaborative behaviors, communicative behaviors, helping behaviors, and the underpinning of effective teamwork—shared mental models. The contribution of this article is that it presents an organizational framework for analyzing a variety of teamwork simulation systems and for further studying simulated teamwork behaviors.

Emotions are an important aspect of human intelligence and have been shown to play a significant role in the human decision-making process. Researchers in areas such as cognitive science, philosophy, and artificial intelligence have proposed a variety of models of emotions. Most of the previous models focus on an agent's reactive behavior, for which they often generate emotions according to static rules or pre-determined domain knowledge. However, throughout the history of research on emotions, memory and experience have been emphasized to have a major influence on the emotional process. In this paper, we propose a new computational model of emotions that can be incorporated into intelligent agents and other complex, interactive programs. The model uses a fuzzy-logic representation to map events and observations to emotional states. The model also includes several inductive learning algorithms for learning patterns of events, associations among objects, and expectations. We demonstrate empirically through a computer simulation of a pet that the adaptive components of the model are crucial to users' assessments of the believability of the agent's interactions.

We report a novel computer method for automatic labeling of structures in 3D MRI data sets using expert anatomical knowledge that is coded in fuzzy sets and fuzzy rules. The method first identifies major structures and then uses spatial relationships to these landmarks to recognize other structures. This labeling process simulates the iterative process that we ourselves use to locate structures in images. We demonstrate its application in three data sets, labeling brain MRI by locating the longitudinal and lateral fissures and the central sulci and then determining boundaries for the frontal lobes. Our method is adaptable to the identification of other anatomical structures.

Most of the techniques for constructing fuzzy models from data focus only on minimizing the error between the model’s output and the training data; however, these approaches may result in a fuzzy model where individual rules are misleading. The goal of our research is to develop a scheme for identifying Takagi-Sugeno-Kang (TSK) models whose individual rules approximate the training data covered by a single rule, local fitness, while the entire model approximates the whole training set, global fitness. We propose an approach that is a modification of a current method for estimating the consequence portion of a TSK model with predefined membership functions. Then we propose a method for developing membership functions which partition the input space into regions that are more easily modeled in the TSK framework to provide consistent local behavior for all the rules of the model. This approach ensures that a TSK model constructed not only approximates the input-output mapping relationship in the data, but also captures insights about the local behavior of the model.

Traditionally, fuzzy logic has been viewed in the artificial intelligence (AI) community as an approach for managing uncertainty. In the 1990s, however, fuzzy logic has emerged as a paradigm for approximating a functional mapping. This complementary modern view about the technology offers new insights about the foundation of fuzzy logic, as well as new challenges regarding the identification of fuzzy models. In this paper, we first review some of the major milestones in the history of developing fuzzy logic technology. After a short summary of major concepts in fuzzy logic, we discuss a modern view about the foundation of two types of fuzzy rules. Finally, we review some of the research in addressing various challenges regarding automated identification of fuzzy rule-based models.

Software reuse is widely believed to be a key to improving software productivity and quality in conventional software. In expert systems, much of the knowledge has been compiled (i.e., compressed and restricted into effective procedures) and this makes reusability difficult. One of the issues in modeling expert systems for enhanced reusability is capturing explicity the underlying problem solving designs. Principled knowledge representation schemes have been used to model components of complex software systems. However, the potential for applying these principled modeling techniques for explicitly capturing the problem solving designs of expert systems has not been fully explored. To overcome this omission, we use an Artificial Intelligence knowledge representation scheme for developing an ontology of the software components to facilitate their classification and retrieval. The application of our ontological approach is of both theoretical and practical significance. This method facilitates the reuse of high-level design. We illustrate the application of principled domain modeling using two real world applications of knowledge-based systems.

The fuzzy inference system proposed by Takagi, Sugeno, and Kang, known as the TSK model in fuzzy system literature, provides a powerful tool for modeling complex nonlinear systems. Unlike conventional modeling where a single model is used to describe the global behavior of a system, TSK modeling is essentially a multimodel approach in which simple submodels (typically linear models) are combined to describe the global behavior of the system. Most existing learning algorithms for identifying the TSK model are based on minimizing the square of the residual between the overall outputs of the real system and the identified model. Although these algorithms can generate a TSK model with good global performance (i.e., the model is capable of approximating the given system with arbitrary accuracy, provided that sufficient rules are used and sufficient training data are available), they cannot guarantee the resulting model to have a good local performance. Often, the submodels in the TSK model may exhibit an erratic local behavior, which is difficult to interpret. Since one of the important motivations of using the TSK model (also other fuzzy models) is to gain insights into the model, it is important to investigate the interpretability issue of the TSK model. We propose a new learning algorithm that integrates global learning and local learning in a single algorithmic framework. This algorithm uses the idea of local weighed regression and local approximation in nonparametric statistics, but remains the component of global fitting in the existing learning algorithms. The algorithm is capable of adjusting its parameters based on the user's preference, generating models with good tradeoff in terms of global fitting and local interpretation. We illustrate the performance of the proposed algorithm using a motorcycle crash modeling example.

It is a challenging task for firms to assess the importance of a patent and identify valuable patents as early as possible. Counting the number of citations received is a widely used method to assess the value of a patent. However, recently granted patents have few citations received, which makes the use of citation counts infeasible. In this paper, we propose a novel idea to evaluate the value of new or recently granted patents using recommended relevant prior patents. Our approach is to exploit trends in temporal patterns of relevant prior patents, which are highly related to patent values. We evaluate the proposed approach using two patent value evaluation tasks with a large-scale collection of U.S. patents. Experimental results show that the models created based on our idea significantly enhance those using the baseline features or patent backward citations.

Supporting counterterrorism analysts with software agents that dynamically anticipate their information requirements.

Citation counts have been widely used in a digital library for purposes such as ranking scientific publications and evaluating patents. This paper demonstrates that distinguishing different types of citations could rank better for these purposes. We differentiate patent citations along two dimensions (assignees and technologies) into four types, and propose a weighted citation approach for assessing and ranking patents. We investigate five weight learning methods and compare their performance. Our weighted citation method performs consistently better than simple citation counts, in terms of rank correlations with patent renewal status. The estimated weights on different citations are consistent with economic insights on patent citations. Our study points to an interesting and promising research line on patent citation and network analysis that has not been explored.

Cyber situation awareness is a growingly important issue as the world becomes more and more connected. Unfortunately, the amount of data produced by existing intrusion detection tools usually significantly exceeds the cognition throughput of a human analyst. In attempting to align a huge amount of information and the limited human cognitive load, we developed a systematic approach to leverage experiences of security analysts to enhance cyber situation recognition. We used a logic-based approach to efficiently capture and utilize experts' experience, which can be categorized as kind of knowledge-based intrusion detection. However, knowledge-based intrusion detection relies on the establishment of a knowledge base created from cyber attack signatures, but building a comprehensive knowledge base that covers all variations of attacks is impractical under large-scale networks since knowledge engineering can be a time-consuming process. Therefore, how to effectively leverage limited number of human experience became the second focus of our research. In this paper, we presented the logic-based approach under an experience-driven framework, followed by the concept of experience relaxation for mitigating the limitation of knowledge-based intrusion detection. Our experimental results showed a significant improvement in the knowledge base coverage by applying experience relaxation.

Knowledge acquisition has been identified as the bottleneck for knowledge engineering. One of the reasons is the lack of an integrated methodology that is able to provide tools and guidelines for the elicitation of knowledge as well as the verification and validation of the system developed. Even though methods that address this issue have been proposed, they only loosely relate knowledge acquisition to the remaining part of the software development life cycle. to alleviate this problem, we have developed a framework in which knowledge acquisition is integrated with system specifications to facilitate the verification, validation, and testing of the prototypes as well as the final implementation. to support the framework, we have developed a knowledge acquisition tool, TAME. It provides an integrated environment to acquire and generate specifications about the functionality and behavior of the target system, and the representation of the domain knowledge and domain heuristics. the tool and the framework, together, can thus enhance the verification, validation, and the maintenance of expert systems through their life cycles. © 1994 John Wiley & Sons, Inc.

Extracting good features is critical to the performance of learning algorithms such as classifiers. Feature extraction selects and transforms original features to find information hidden in data. Due to the huge search space of selection and transformation of features, exhaustive search is computationally prohibitive and randomized search such as evolutionary algorithms (EA) are often used. In our prior work on evolutionary-based feature extraction, an individual, which represents a set of features, is evaluated by estimating the accuracy of a classifier when the individual's feature set is used for learning. Although incorporating a learning algorithm during evaluation, which is called the wrapper approach, generally performs better than evaluating an individual simply by the statistical properties of data, which is called the filter appproach, our EA based on a wrapper approach suffers from overfitting, so that a slight enhancement of fitness in training can dramatically reduce the classification accuracy for unseen testing data. To cope with this problem, this paper proposes a two-population EA for feature extraction (TEAFE) that combines filter and wrapper approaches, and shows the promising preliminary results.

Determining a good feature set is critical to the performance of learning algorithms such as classifiers. Recently, researchers have proposed evolutionary-based feature extraction methods that aim to find a good feature set by combining the original features with new features generated by mathematical transformations of the original features. In this paper, we propose dynamically collecting past performance information on promising features and operators to use in our mutation method. We consider how to make our evolutionary algorithm more efficient and reliable by reducing overfitting. Preliminary results using UCI data show that our dynamic mutation method only slightly enhances the classification accuracy but it produces more reliable results.

Finding similar patients is highly desirable in many clinical applications. In this paper, we address the issue of how to find similar patients in a multi-agent environment where software agents, located in different places, work collaboratively and proactively help one another to empower their human users to achieve a common healthcare goal. We show how the agents, equipped with fuzzy similarity rules developed by the physicians on the team, collaborate to find similar patients in each agent's patient database. We describe the architecture, design and implementation of the system. Using the popular agent language JADE and clinical information on 1,000 patients treated at the Detroit Veterans Affairs Medical Center, we have implemented a five-agent system and generated some preliminary simulation results.

Data available for intelligence analysis is often incomplete, ambiguous and voluminous. Also, the data may be unorganized, the details overwhelming, and considerable analysis may be required to uncover adversarial activities. This paper describes a simulation-based approach that helps analysts understand data and use it to predict future events and possible scenarios. In particular, the approach enables intelligence analysts to find, display and understand data relationships by connecting the dots of data to create network of information. The approach also generates alternative storylines, allowing analysts to view other possible outcomes. It facilitates the automation of reasoning and the detection of inconsistent data, which provides more reliable information for analysis. A case study using data from the TV series, 24, demonstrates the feasibility of approach and its application to intelligence analysis of WMD attacks against the critical infrastructure.

A task-based specification methodology for expert system specification that is independent of the problem solving architecture, that can be applied to many expert system applications, that focuses on what the knowledge is, not how it is implemented, that introduces the major concepts involved gradually, and that supports verification and validation is discussed. To evaluate the methodology, a specification of R1/SOAR, an expert system that reimplements a major portion of the R1 expert system, was reverse engineered. >

Identifying a good set of features is critical to the performance of learning algorithms such as classifiers. Previous methods have focused on either selecting a subset of features or transforming features using principle components analysis. In this paper, we propose a genetic algorithm approach that searches for a good feature transformation function over a subset of features using a novel representation scheme with novel reproduction operators. Preliminary experimental results using the UCI data set show promising results.

Discovering unknown adverse drug reactions (ADRs) as early as possible is highly desirable. Current methods largely rely on passive spontaneous reports, which suffer from serious underreporting, latency, and inconsistent reporting. They are not ideal for early identification of ADRs [5]. In this paper, we propose a multi-agent system approach for ADR detection. A multi-agent system is formed by a community of agents that exchange information and proactively help one another to achieve the goals set by the system designer. We show how agents, equipped with decision rules developed by the physicians on the team, can collaborate to detect signal pairs of potential ADRs. Using the popular agent language JADE [8, 10] and clinical information on 1,000 patients treated at the Detroit Veterans Affairs Medical Center, we have constructed a small group of agents and generated preliminary simulated detection results.

This chapter contains sections titled: Introduction Background Modeling Terrorist Activities with HMMs and BNs Detecting and Tracking Terrorist Network HMMs HMM and BN Information Fusion Simulation Results This chapter contains sections titled: Summary Acknowledgment References

This chapter contains sections titled: Introduction Emerging Asymmetric Tactical Threats The Intelligence Process Terrorist Modus Operandi Detection System (TMODS) This chapter contains sections titled: Summary References ]]>

In evolving social networks, nodes join, make connections, or leave over time. In this paper, we introduce node event sequences that record activities of every node over time. Node event sequences are suitable for microscopic analysis of node behaviors in social networks. As preliminary results of taking advantage of node event sequences (as well as snapshots of networks), we study the health of the community of Nanotechnology based on the analysis of Seniority of nodes, identify the intrinsic dynamics of formation of new edges and its relation to Seniority of nodes, and the changes in the node behavior according to the nodes' Seniority.

1. Be aware of the current situation. This aspect can also be called situation perception. Situation perception includes both situation recognition and identification. Situation identification can include identifying the type of attack (recognition is only recognizing that an attack is occurring), the source (who, what) of an attack, the target of an attack, etc. Situation perception is beyond intrusion detection. Intrusion detection is a very primitive element of this aspect. An IDS (intrusion detection system) is usually only a sensor, it neither identifies nor recognizes an attack but simply identifies an event that may be part of an attack once that event adds to a recognition or identification activity.

As the use of automated negotiations becomes more mainstream, one key attribute that needs to be incorporated is a measure of a seller's trust or reliability. In this paper, we describe a combinatorial auction mechanism that allows buyers to specify their preferences over both an item and the seller's trustworthiness, and use it to generate a bid for a bundle of items. We consider some implications of generating a combined trust rating for a bundle of resources that are supplied by more than one seller. We show that allowing buyers to specify trust preferences leads to a higher overall utility and task completion rate than when compared with a model that does not consider seller trustworthiness.

The problems encountered in applying object-oriented programming to expert systems are described. A production system called Clasp, which addresses these difficulties, is presented. Clasp integrates methods, production rules, and terminological definitions for classes. The approach is a further generalization of Common Loops and the Common Lisp Operating System, which have all extended notion of methods in which all argument types can describe the applicability of methods. The system was designed to improve the modularity and reusability of the rule base, to support the development of a more consistent and homogeneous knowledge base, and to enhance the predictability of rules. >

The general architecture and an implementation of a classification-based production system (CLASP) are presented. The main objective is to extend the benefits of classification capabilities in frame systems to the developers of rule-based systems. Two major processes of CLASP, a semantic pattern matcher and a pattern classifier, are described. The semantic pattern matcher extends the pattern matching capabilities of rule-based systems through the use of terminological knowledge. The pattern classifier enables the system to compute a rule's specificity, which is useful for conflict resolution, based on the semantics of its left-hand side. The paradigm not only enhances the reasoning capabilities of rule-based systems, but also helps to reduce the cost of maintaining such systems because definitional knowledge is explicitly represented in a form that facilitates sharing and minimizes duplication of effort. >

Agent decision-making is an information-intensive activity. Its performance is affected by the availability of relevant information. Bayesian networks have provided a probabilistic estimate for uncertain information. However, for those decision problems where information is represented in predicates, Bayesian inferences are required to process the variable-bound relations across predicates. multi-layer Bayesian network (MLBN) is an extension of the classical model of Bayesian networks with multiple layers of conditional probability tables, each corresponding to one specific variable binding. The MLBN has been implemented based on an agent architecture. Experiments have shown its capability of improving performance in an experience-based decision-making framework.