Search

Security operations centers (SOCs) employ various cyber defend measures to monitor network events. Apart from these measures, SOCs also have to resort to human analysts to make sense of the collected data for incident detection and response. However, with the oncoming network data collected and accumulated at a rapid speed, analysts are usually overwhelmed by tedious and repeated data triage tasks so that they can hardly concentrate on in-depth analysis to create timely and quality incident reports. This paper aims to reduce the analysts’ workloads by developing data triage automatons. We have developed a computer-aided tracing method for capturing analysts’ operations while they are performing a task. This paper proposes a graph-based trace mining approach for constructing useful patterns for data triage from the operation traces. Finite state machines can be constructed based on the rules to automate data triage. A human-in-the-loop case study is conducted to evaluate our approach, in which 30 professional analysts were recruited and asked to complete a cyber-analysis task with their operations being traced. State machines were constructed based on the traces and then the effectiveness of developing state machines and the performance of state machines are evaluated. The result shows that it is feasible to conduct automated data triage by leveraging analysts’ traces. The state machines are able to complete processing a large amount of data within minutes. Comparing the performance of automated data triage with the ground truth, we found that a satisfactory false positive rate can be achieved.

The importance of potential intentions has been demonstrated both in the construction of agent systems and in the formalisation of teamwork behaviour. However, there still lacks an adequate semantics for the notion of potential intentions as introduced by Grosz and Kraus in their SharedPlans framework. In this paper, we give a formal semantics to intentions and potential intentions, drawing upon both the representationalist approach and the accessibility-based approach. The model captures the dynamic relationship among intentions and potential intentions by providing semantic rules and conditions. Also, the model treats norms as a special class of intentional context, and it is shown that norms play a critical role in the dynamics of intentions in multiagent systems. The formal semantics allows us to validate some properties that are widely-accepted for intention attitudes.

Multicontext team decision making under time stress is an extremely challenging issue faced by various real-world application domains. In this paper, we employ an experience-based cognitive agent architecture (called R-CAST) to address the informational challenges associated with military command and control (C2) decision-making teams, the performance of which can be significantly affected by dynamic context switching and tasking complexities. Using context switching frequency and task complexity as two factors, we conducted an experiment to evaluate whether the use of R-CAST agents as teammates and decision aids can benefit C2 decision-making teams. Members from a U.S. Army Reserve Officer Training Corps organization were randomly recruited as human participants. They were grouped into ten human-human teams, each composed of two participants, and ten human-agent teams, each composed of one participant and two R-CAST agents, as teammates and decision aids. The statistical inference of experimental results indicates that R-CAST agents can significantly improve the performance of C2 teams in multicontext decision making under varying time-stressed situations.

Cognitive studies indicate that members of a high performing team often develop shared mental models to predict others' needs and coordinate their behaviors. The concept of shared mental models is especially useful in the study of human-centered collaborative systems that require humans to team with autonomous agents in complex activities. We take the position that in a mixed human-agent team, agents empowered with cognitive load models of human team members can help humans develop better shared mental models to enhance team performance. Inspired by human information processing system, we here propose a HMM-based load model for members of human-agent teams, and investigate the development of realistic cognitive load models. A cognitive experiment was conducted in team contexts to collect data about the observable secondary task performance of human participants. The data were used to train hidden Markov models (HMM) with varied numbers of hypothetical hidden states. The result indicates that the model spaces have a three-layer structure. Statistical analysis also reveals some characteristics of the models at the top-layer. This study can be used in guiding the selection of HMM-based cognitive load models for agents in human-centered multi-agent systems.

Helping behavior in effective teams is achieved via some overlapping "shared mental models" that are developed and maintained by members of the team. In this paper, we take the perspective that multiparty "proactive" communication is critical for establishing and maintaining such a shared mental model among teammates, which is the basis for agents to offer proactive help and to achieve coherent teamwork. We first provide formal semantics for multiparty proactive performatives within a team setting. We then examine how such performatives result in updates to mental model of teammates, and how such updates can trigger helpful behaviors from other teammates. We also provide conversation policies for multiparty proactive performatives.

Twitter has been recognized as a useful channel for the sharing and dissemination of health information, owing in part to its "retweet" function. This study reports findings from a content analysis of frequently retweeted obesity-related tweets to identify the prevalent beliefs and attitudes about obesity on Twitter, as well as key message features that prompt retweeting behavior conducive to maximizing the reach of health messages on Twitter. The findings show that tweets that are emotionally evocative, humorous, and concern individual-level causes for obesity were more frequently retweeted than their counterparts. Specifically, tweets that evoke amusement were retweeted most frequently, followed by tweets evoking contentment, surprise, and anger. In regard to humor, derogatory jokes were more frequently retweeted than nonderogatory ones, and in terms of specific types of humor, weight-related puns, repartee, and parody were shared frequently. Consistent with extant literature about obesity, the findings demonstrated the predominance of the individual-level (e.g., problematic diet, lack of exercise) over social-level causes for obesity (e.g., availability of cheap and unhealthy food). Implications for designing social-media-based health campaign messages are discussed.

Online health communities are a major source for patients and their informal caregivers in the process of gathering information and seeking social support. The Cancer Survivors Network of the American Cancer Society has many users and presents a large number of user interactions with regards to coping with cancer. Sentiment analysis is an important process in understanding members' needs and concerns and the impact of users' responses on other members. It aims to determine the participants' subjective attitude and reflect their emotions. Analyzing the sentiment of posts in online health communities enables the investigation of various factors such as what affects the sentiment change and discovery of sentiment change patterns. Since each writer has his or her own personality, and temporal emotional state, behavioral traits can be reflected in the writer's writing style. Pronouns are function-words which often convey some unique styling patterns into the texts. Drawing on a lexical approach to emotions, we conduct factor analysis on the use of pronouns in self-descriptions texts. Our analysis shows that the usage of pronouns has an effect on sentiment classification. Moreover, we evaluated the use of pronouns in our domain, and found it different than standard English usage.

Proactive information sharing is a challenging issue faced by intelligence agencies in effectively making critical decisions under time pressure in areas related to homeland security. Motivated by psychological studies on human teams, a team-oriented agent architecture, Collaborative Agents for Simulating Teamwork (CAST), was implemented to allow agents in a team to anticipate the information needs of teammates and help them with their information needs proactively and effectively. In this paper, we extend CAST with a decision-making module. Through two sets of experiments in a simulated battlefield, we evaluate the effectiveness of the decision-theoretic proactive communication strategy in improving team performance, and the effectiveness of information fusion as an approach to alleviating the information overload problem faced by distributed decision makers.

Effective agent teamwork requires information exchange to be conducted in a proactive, selective, and intelligent way. In the field of distributed artificial intelligence, there has been increasing number of research focusing on need-driven proactive communication, both theoretically and practically. Among these works, CAST has realized a team-oriented agent architecture where agents, based on a computational shared mental model, are able to anticipate teammates' information needs and proactively deliver relevant information to the needers in a timely manner. However, the first implementation of CAST takes little consideration of the dynamics of the anticipated information needs, which can change in various ways as the context develops. In this paper we describe a novel mechanism for organizing and managing the "context" of information needs. This allows agents to dynamically activate and deactivate information needs progressively. It has been shown that the two-level context-centric approach can enhance team performance considerably.

MALLET, a multi-agent logic language for encoding teamwork, is intended to enable expression of teamwork emulating human teamwork, allowing experimentation with different levels and forms of inferred team intelligence. A consequence of this goal is that the actual teamwork behavior is determined by the level of intelligence built into the underlying system as well as the semantics of the language. In this paper, we give the design objectives, the syntax, and an operational semantics for MALLET in terms of a transition system. We show how the semantics can be used to reason about the behaviors of team-based agents. The semantics can also be used to guide the implementation of various MALLET interpreters emulating different forms of team intelligence, as well as formally study the properties of team-based agents specified in MALLET. We have explored various forms of proactive information exchange behavior embodied in human teamwork using the CAST system, which implements a built-in MALLET interpreter.

Proactive information delivery is critical to achieving effective teamwork. However, existing theories do not adequately address proactive information delivery. This paper presents a formal framework for proactive information delivery in agent teamwork. First, the concept of information need is introduced. Second, a new modal operator, InfoNeed is used to represent information needs. The properties of the InfoNeed operator and its relationships to other mental modal operators are examined, four types of information needs are formally identified, and axioms for anticipating the information needs of other agents are proposed and justified. Third, the axiom characterizing chains of helpful behavior in large agent teams is given. Fourth, the semantics for two proactive communicative acts (ProInform and 3PTSubscribe) is given using a reformulation of the Cohen–Levesque semantics for communicative acts in terms of the SharedPlans formalism of Grosz and Kraus. The work in this paper not only provides a better understanding of the underlying assumptions required to justify proactive information delivery behavior, but also provides a coherent basis for the specification and design of agent teams with proactive information delivery capabilities.

Among researchers in multi-agent systems there has been growing interest in using intelligent agents to model and simulate human teamwork behaviors. Teamwork modeling is important for training humans in gaining collaborative skills, for supporting humans in making critical decisions by proactively gathering, fusing, and sharing information, and for building coherent teams with both humans and agents working effectively on intelligence-intensive problems. Teamwork modeling is also challenging because the research has spanned diverse disciplines from business management to cognitive science, human discourse, and distributed artificial intelligence. This article presents an extensive, but not exhaustive, list of work in the field, where the taxonomy is organized along two main dimensions: team social structure and social behaviors. Along the dimension of social structure, we consider agent-only teams and mixed human–agent teams. Along the dimension of social behaviors, we consider collaborative behaviors, communicative behaviors, helping behaviors, and the underpinning of effective teamwork—shared mental models. The contribution of this article is that it presents an organizational framework for analyzing a variety of teamwork simulation systems and for further studying simulated teamwork behaviors.

We prove that for any finite deduction structure there exists a unique concise-widest chain-preserved split. Based on this result, we propose a logical splitting strategy which enables an agent to ...

Online health communities (OHCs) constitute a useful source of information and social support for patients. American Cancer Society’s Cancer Survivor Network (CSN), a 173,000-member community, is the largest online network for cancer patients, survivors, and caregivers. A discussion thread in CSN is often initiated by a cancer survivor seeking support from other members of CSN. It captures a multi-party conversation that often serves the function of providing social support e.g., by bringing about a change of sentiment from negative to positive on the part of the thread originator. While previous studies regarding cancer survivors have shown that members of OHC derive benefits from their participation in such communities, causal accounts of the factors that contribute to the observed benefits have been lacking. This paper reports results of a study that seeks to address this gap by discovering temporal causality of the dynamics of sentiment change (on the part of the thread originators) in CSN. The resulting accounts offer new insights that the designers, managers and moderators of an online community such as CSN can utilize to facilitate and enhance the interactions so as to better meet the social support needs of the community participants. The proposed methodology also has broad applications in the discovery of temporal causality from big data.

Recent research on human-centered teamwork highly demands the design of cognitive agents that can model and exploit human partners' cognitive load to enhance team performance. In this paper, we focus on teams composed of human-agent pairs and develop a system called Shared Mental Models for all - SMMall. SMMall implements a hidden Markov model (HMM)-based cognitive load model for an agent to predict its human partner's instantaneous cognitive load status. It also implements a user interface (UI) concept called shared belief map, which offers a synergic representation of team members' information space and allows them to share beliefs. An experiment was conducted to evaluate the HMM-based load models. The results indicate that the HMM-based load models are effective in helping team members develop a shared mental model (SMM), and the benefit of load-based information sharing becomes more significant as communication capacity increases. It also suggests that multiparty communication plays an important role in forming/evolving team SMMs, and when a group of agents can be partitioned into subteams, splitting messages by their load status can be more effective for developing subteam SMMs.

This paper describes the strengths of two types of visual aids: VADS (Visualization of Agent Decision Space) and ADT (Agent Decision Table). The VADS is a newly developed visual aid that intuitively represents complicated target attributes in a graphical form, whereas the ADT shows such things in a traditional tabular form. The strengths of each visual aid have been obtained through the analysis of realtime situational awareness queries. Graphical icons expressing multiple attributes are useful in achieving overall situation awareness in most cases. However, there are cases where presentation by a simple text is better in recognition than that by a graphical notation. We discuss the recognition of the ethnic affiliation of crowds as an example at the end.

Intelligence workers such as analysts, commanders, and soldiers often need a hypothesis reasoning framework to gain improved situation awareness of the highly dynamic cyber space. The development of such a framework requires the integration of interdisciplinary techniques, including supports for distributed cognition (human-in-the-loop hypothesis generation), supports for team collaboration (identification of information for hypothesis evaluation), and supports for resource-constrained information collection (hypotheses competing for information collection resources). We here describe a cognitively-inspired framework that is built upon Klein’s recognition-primed decision model and integrates the three components of Endsley’s situation awareness model. The framework naturally connects the logic world of tools for cyber situation awareness with the mental world of human analysts, enabling the perception, comprehension, and prediction of cyber situations for better prevention, survival, and response to cyber attacks by adapting missions at the operational, tactical, and strategic levels.

1. Be aware of the current situation. This aspect can also be called situation perception. Situation perception includes both situation recognition and identification. Situation identification can include identifying the type of attack (recognition is only recognizing that an attack is occurring), the source (who, what) of an attack, the target of an attack, etc. Situation perception is beyond intrusion detection. Intrusion detection is a very primitive element of this aspect. An IDS (intrusion detection system) is usually only a sensor, it neither identifies nor recognizes an attack but simply identifies an event that may be part of an attack once that event adds to a recognition or identification activity.

As the use of automated negotiations becomes more mainstream, one key attribute that needs to be incorporated is a measure of a seller's trust or reliability. In this paper, we describe a combinatorial auction mechanism that allows buyers to specify their preferences over both an item and the seller's trustworthiness, and use it to generate a bid for a bundle of items. We consider some implications of generating a combined trust rating for a bundle of resources that are supplied by more than one seller. We show that allowing buyers to specify trust preferences leads to a higher overall utility and task completion rate than when compared with a model that does not consider seller trustworthiness.

The recognition-primed decision (RPD) framework is a naturalistic decision making model that focuses on how people actually make decisions in realistic settings that typically involve ill-structured problems. In this paper, we generalize the existing studies on RPD and propose a team-RPD representation model that treats a situation as a layered organization of state variables, and the decision process as a timed transition Petri net. This model can serve as a foundation for implementing agent architectures and multi-agent systems with built-in supports for naturalistic decision making.

Discovering unknown adverse drug reactions (ADRs) in postmarketing surveillance as early as possible is of great importance. The current approach to postmarketing surveillance primarily relies on spontaneous reporting. It is passive and suffers from gross underreporting (

Conversation is the most natural communication means for people to communicate with each other. I believe that conversation plays a critical role in realizing a paradigm of human-centered web intelligence in which web intelligence engines are grounded on the human society. We are currently building a computational framework for circulating information in a conversational fashion, using information packages called conversation quanta that encapsulate conversational scenes. Technologies are being developed for acquiring conversation quanta on the spot, accumulating them in a visually recognizable form, and reusing them in a situated fashion. Conversational Informatics constitutes the theoretical foundation for measurement, analysis, and modeling of conversation. I will overview recent results in Conversational Informatics that will help achieve our vision. I will also discuss our approach in the context of Social Intelligence Design aimed at the understanding and augmentation of social intelligence for collective problem solving and learning.

Healthcare systems and insurers nationwide regularly make decisions regarding which drugs to include or exclude from their formularies based on evidence concerning benefits, risks, and costs of the medications. A major barrier to effective drug selection is the lack of sufficient published information on the safety of drugs, particularly new drugs. In this paper, we propose an innovative multi-agent system, named ADRMonitor, for actively monitoring and detecting signal pairs implicating anticipated or potential adverse drug reactions (ADRs) of interest at a healthcare facility. Each intelligent agent is empowered by a fuzzy logic-based computational recognition-primed decision (RPD) model where fuzzy logic is utilized to represent, interpret, and compute vague and/or subjective information. We conducted a simulation study based on thousands of hypothetical patient cases that were created on the basis of real patients who were prescribed the drug Cisapride in a local hospital. At the current stage, our focus is to establish that the system can outperform the spontaneous reporting approach in identifying signal pairs. Under certain conditions (e.g., without agent collaboration), our simulation results show that (1) ADRMonitor detected 21 out of 27 (78%) ADRs when the optimized RPD model was used as a gold standard; (2) the number of ADRs detected by the agents is (many) more than those detected by the spontaneous reporting strategy (assuming 10% reporting rate - high end of rates reported in the literature) at any particular time. The second result implies that useful information could be collected more timely by the proposed agent system for formulary decisions.

The dynamic nature of many real-world domains (e.g., military, emergency first response and hurricane relief, etc) requires adaptive resource allocation to respond to changes in the environment that trigger additional resource requirements. Since the total resources are limited, there are often conflicts among various tasks regarding their resource needs. Thus, resources must be reallocated in order to maximize global utility for the current situation. This problem is further complicated when scarce resources are owned by distributed teams, each of which needs to allocate resources among tasks assigned to them, because each team has limited information about the other teams' resources and states. In this paper, we propose a market-based approach that uses an agent-based auction mechanism to enable teams to communicate and coordinate their utility information about possibly competing resource needs. As a result, the teams can collaboratively assess trade-offs among competing needs to allocate resources efficiently.

There has been an increasing interest in reasoning about multi-agent information dependence, which is very important for supporting social reasoning in multi-agent cooperations. In this paper we seek to characterize the nature of multi-agent information dependence in general, and investigate ways of using information dependence knowledge in agent teamwork settings. We also describe a tool that can facilitate humans to dynamically manipulate information dependence.

One research focus of human-centered teamwork is on advanced decision architectures that can help people make effective and timely decisions. This requires distributed team members to effectively establish shared situation awareness and to collaboratively develop explanations on how an unfamiliar situation might have been emerging. One key to achieve this goal is the ability to anticipate others' future information needs and to offer help proactively. In this paper we investigate a novel approach to anticipating teammates' information needs based on step-wise conversation pattern recognition, leveraging the idea of multi-party communication. This approach can be further extended to build a computational model for collaborative story building as needed in recognition-primed, naturalistic decision architectures.

Multiparty communication and proactive communication have each been studied extensively, but separately. A combinatorial approach would be to investigate proactive communication in a multiparty settings, aiming to support effective collaboration by leveraging the benefits of both. In this paper, we take a first attempt along this direction, providing formal definitions for multiparty proactive performatives. Such performatives not only result in an exchange of knowledge among teammates, but also in an increased awareness about teammates' mental states which can initiate additional helpful behaviors

Current postmarketing surveillance methods largely rely on spontaneous reports which suffer from serious underreporting, latency, and inconsistent reporting. Thus they are not ideal for rapidly identifying rare adverse drug reactions (ADRs). We propose an active, multi-agent computer software system, where each agent is empowered with teamwork capabilities such as anticipating information needs, identifying relevant ADR information, and continuously monitoring and proactively sharing such information in a collaborative fashion with other agents. The main purpose of this system is to help regulatory authorities (e.g., FDA in the U.S.) find previously unrecognized ADRs as early as possible. Another objective is to promote increased filing of on-line ADR reports thereby, addressing the severe underreporting problem with the current system. The proposed system has the potential to significantly accelerate the process of ADR discovery and response by utilizing electronic patient data distributed across many different sources and locations more effectively. Our preliminary system design is presented and some issues related to it are discussed.

MALLET is a team-oriented agent specification and programming language. In this paper, we define an operational semantics for MALLET in terms of a transition system. The semantics can be used to guide the implementation of MALLET interpreters, and to formally study the properties of team-based agents specified in MALLET.

Techniques that support effective communication during teamwork processes are of particular importance. Psychological study shows that an effective team often can anticipate information exchange among the team and communicate relevant information proactively. Proactive communication is crucial for understanding and sharing common goals and for cooperative actions. Communication can be valuable if it assists agents with new and timely information; it also has cost because it consumes network resources such as bandwidth. To address these issues, we present a new model that uses information production and need to capture the complex multi-agent communication process and a dynamic decision-theoretic determination of communication strategies. We also introduce a generic utility function and an algorithm, DTPC (Decision-Theoretic Proactive Communication), that focuses on representing information production and need of team members and resolving decision interactions among them for making decisions.

Members of high-performing human teams can often anticipate information needs of teammates and offer relevant information to them proactively. Such capabilities are highly desirable for agent teams to achieve better teamwork processes for supporting information gathering, information fusion, and decision makings of teammates. This paper presents a framework for formally specifying proactive agent behaviors based on the SharedPlan theory. Axioms that specify an agent's anticipations of a teammate's information needs are proposed, which enable the teammate to perform an action or protect the teammate from a threat. We also introduce the semantics of two proactive communicative actions (i.e., proactive inform and third party subscribe) that are driven by information needs of teammates. Based on these semantics, we show that suitable proactive information delivery actions can be derived in the proposed framework. This paper thus establishes a formal foundation for proactive information delivery behavior that not only provides better understanding of the underlying assumptions required to justify the behavior, but also provides a coherent basis for the specification and design of agent teams with proactive information delivery capabilities.

The capabilities for agents in a team to anticipate information-needs of teammates and proactively offer relevant information are highly desirable. However, such behaviors have not been fully prescribed by existing agent theories. To establish a theory about proactive information exchanges, we first introduces the concept of ”information-needs”, then identify and formally define the intentional semantics of two proactive communicative acts, which highly depend on the speaker’s awareness of others’ information-needs. It is shown that communications using these proactive performatives can be derived as helping behaviors. Conversation policies involving these proactive performatives are also discussed. The work in this paper may serve as a guide for the specification and design of agent architectures, algorithms, and applications that support proactive communications in agent teamwork.

Psychological studies about human teamwork have shown that members of an effective team can often anticipate needs of other teammates, and choose to assist teammates through appropriate ways. However the fulfillment of help behaviors among teammates is subject to team members' understanding of the underpinning communicative acts performed by individual agents. By extending the mental state analysis of performatives initiated by Cohen and Levesque (1990), we focus this paper on analyzing a missing class of performatives -proactive performatives, which are prevalently used by individual agents to exchange information among teammates.

Effective human teams use overlapping shared mental models for anticipating information needs of teammates and for offering relevant information proactively. The long-term goal of our research is to empower agents with such “shared mental models” so that they can be used to better simulate, train, or support human teams for their information fusion, interpretation, and decisions. Toward this goal, we have developed a team agent architecture called CAST that enables agents to infer information needs of teammates, which further enables agents to assist teammates by proactively delivering needed information to them. In this paper, we focus on two key issues related to proactive information delivery behavior. First, we model the semantics of proactive information delivery as an attempt (called ProAssert), which extends the performative Assert in Joint Intention Theory. Second, we introduce a decision-theoretic approach for reasoning about whether to act on a potential proactive assert. Experimental results suggested that the decision-theoretic communication strategy enhances the team performance. The formal semantics and the decision-theoretic communication strategies together provide a sound and practical framework that enables further studies regarding proactive information delivery for supporting the decision making of a team involving human and agents.

Agent splitting is useful in at least three fields. In mobile computing, it's more reasonable to transfer smarter and smaller clones of an agent rather than the bulky agent itself. In agent teamwork field, it can be used as the basis for modeling the shared mental state of team-based agents. In Multi-Agent systems, it can be embedded as a built-in load-balancing mechanism. Based on a simple BDI agent model, this paper studies how to split BDI agents logically while preserving the implicit information chains.

Training teams is an activity that is expensive, time-consuming, hazardous in some cases, and can be limited by availability of equipment and personnel. In team training, the focus is on optimizing interactions, such as efficiency of communication, conflict resolution and prioritization, group situation awareness, resource distribution and load balancing, etc. This paper presents an agent-based approach to designing intelligent team training systems. We envision a computer-based training system in which teams are trained by putting them through scenarios, which allow them to practice their team skills. There are two important roles that intelligent agents can play; these are as virtual team members and as coach. To carry out these functions, these agents must be equipped with an understanding of the task domain, the team structure, the selected decision-making process and their belief about other team members' mental states.

This paper presents a system prototype for training a teacher based on two objects: the topic and students. In the system prototype, a concept model is defined to provide many topics needed to train teachers. Moreover, the Virtual Classroom Environment (VCE) is built to provide a multi-agent environment for teaching. In the VCE, students with many different personalities and motivations can communicate with each other as well as the teacher. The teacher can use various teaching techniques provided by the system to teach students specific topics in the VCE. The teacher can also test the students at the end of each class. Furthermore, the teacher can also ask the system to give an evaluation of the teaching process. The system will evaluate the user based on the result of the test(s) and the statistics of the whole teaching process throughout the class. The user can gain his/her teaching experience by analyzing the evaluation.