Search

Teaming permits cognitively complex work to be rapidly executed by multiple entities. As artificial agents (AAs) participate in increasingly complex cognitive work, they hold the promise of moving beyond tools to becoming effective members of human–agent teams. Coordination has been identified as the critical process that enables effective teams and is required to achieve the vision of tightly coupled teams of humans and AAs. This paper characterizes coordination on the axes of types, content, and cost. This characterization is grounded in the human and AA literature and is evaluated to extract design implications for human–agent teams. These design implications are the mechanisms, moderators, and models employed within human–agent teams, which illuminate potential AA design improvements to support coordination.

Changes in the geopolitical landscape and increasing technological complexity have prompted the U.S. Military to coin the terms Multi-Domain Operations (MDO) and Joint All-Domain Command and Control (JADC2) as over-arching strategy to frame the complexity of warfare across both traditional and emerging warfighting domains. Teaching new concepts associated with these terms requires both innovation as well as distinct education and training tools in order to realize the cultural change advocated by senior military leaders. Battlespace NextTM (BSN) is a serious game designed to teach concepts integral to MDO and initiate discussion on military strategy while conserving time, money, and manpower. BSN, a Collectable Card Game (CCG), is engineered to provide an engaging learning tool that educates on capabilities in a multi-domain conflict. This paper proposes an extensible game framework for modeling and reasoning about MDO concepts and presents our empirical feedback from over 120 military play testers evaluating a moderate to difficult version of the game. Results reveal the game teaches MDO concepts and delivers an engaging, hands-on learning experience. Specifically, we provide evidence it improved military readiness in seven areas of MDO in at least 62% of participants and 76% of respondents reported they enjoyed playing the game.

Autonomous unmanned aerial systems (UAS) could supplement and eventually subsume a substantial portion of the mission set currently executed by remote pilots, making UAS more robust, responsive, and numerous than can be achieved by teleoperation alone. Unfortunately, the development of robust autonomous systems is difficult, costly, and time-consuming. Furthermore, the resulting systems often make little reuse of proven software components and offer limited adaptability for new tasks. This work presents a development platform for UAS which promotes behavioral flexibility. The platform incorporates the unified behavior framework (a modular, extensible autonomy framework), the robotic operating system (a robotic software framework), and PX4 (an open-source flight controller). Simulation of UBF agents identify a combination of reactive robotic control strategies effective for small-scale navigation tasks by a UAS in the presence of obstacles. Finally, flight tests provide a partial validation of the simulated results. The development platform presented in this work offers robust and responsive behavioral flexibility for UAS agents in simulation and reality using a methodology originally proven on ground robots.

Sequence pattern mining (SPM) seeks to find multiple items that commonly occur together in a specific order. One common assumption is that the relevant differences between items are captured through creating distinct items. In some domains, this leads to an exponential increase in the number of items. This paper presents a new SPM, Sequence Mining of Temporal Clusters (SMTC), that allows item differentiation through attribute variables for domains with large numbers of items. It also provides a new technique for addressing interleaving, a phenomena that occurs when two sequences occur simultaneously resulting in their items alternating. By first clustering items temporally and only focusing on sequences after the temporal clusters are established, it sidesteps the traditional interleaving issues. SMTC is evaluated on a digital forensics dataset, a domain with a large number of items and frequent interleaving. Its results are compared with Discontinuous Varied Order Sequence Mining (DVSM) with variables added (DVSM-V). By adding variables, both algorithms reduce the data by 96 percent, and identify 100 percent of the events while keeping the false positive rate below 0.03 percent. SMTC mines the data in 20 percent of the time it takes DVSM-V and provides a lower false positive rate even at higher similarity thresholds.

Loss of user engagement with automation in increasingly complex environments, such as driving a car, can have increasingly unexpected and consequential impacts. This paper presents a three-step pro...

Serious games provide a method for teaching students in an engaging, non-threatening way. To be useful educational tools, these games need to be designed with the lesson objectives in mind. This paper uses the Game Design Matrix to design a game from learning objectives. The lesson objectives focus on software development, security and operations (DevSecOps). DevSecOps requires judging the cost and risk trade offs between secure and unsecured software aspects including code, data and usability; devising a strategy to produce a system under threat; comprehending that partial security may equate to no security; and identifying examples of insecure code and methods of mitigating it. These lesson objectives combined with the teaching environment drive design decisions that produce a game that fits well into a graduate level course in secure software design and development. We evaluate the game in a graduate course on secure software design and development. Learner surveys confirm that DevSecOps conveys the learning objectives in an engaging way.

Reverse engineers are in high demand in digital forensics for their ability to investigate malicious cyberspace threats. This group faces unique challenges due to the security-intensive environment, such as working in isolated networks, a limited ability to share files with others, immense time pressure, and a lack of cognitive support tools supporting the iterative exploration of binary executables. This paper presents an exploratory study that interviewed experienced reverse engineers’ work processes, tools, challenges, and visualization needs. The findings demonstrate that engineers have difficulties managing hypotheses, organizing results, and reporting findings during their analysis. By considering the provenance support techniques of existing research in other domains, this study contributes new insights about the needs and opportunities for reverse engineering provenance tools.

Distributed real-time virtual environments entail a well-known set of trade-offs resulting in a lack of state consistency across simulation nodes. This lack of consistency gives rise to a number of challenges that must be addressed by system designers to ensure users remain engaged and satisfied. This paper surveys several approaches to defining, measuring, and controlling the consistency of simulation state data and relates them to the concepts of fairness and fitness for purpose. The interplay between consistency and fairness, in relation to fitness for purpose, must be carefully considered by system engineers to ensure appropriate design trade-offs.

Examiners in the field of digital forensics regularly encounter enormous amounts of data and must identify the few artifacts of evidentiary value. One challenge these examiners face is manual reconstruction of complex datasets with both hierarchical and associative relationships. The complexity of this data requires significant knowledge, training, and experience to correctly and efficiently examine. Current methods provide text-based representations or low-level visualizations, but levee the task of maintaining global context of system state on the examiner. This research presents a visualization tool that improves analysis methods through simultaneous representation of the hierarchical and associative relationships and local detailed data within a single page application. A novel whitelisting feature further improves analysis by eliminating items of less interest from view. Results from a pilot study demonstrate that the visualization tool can assist examiners to more accurately and quickly identify artifacts of interest.

Current digital forensic tools and applications lack the capability to visually present high-level system events and their associated low-level traces in a user interpretable form. This chapter describes the Temporal Analysis Integration Management Application (TAIMA), an interactive graphical user interface that renders graph-based information visualizations for digital forensic event reconstruction. By leveraging correlation and abstraction as core functions, TAIMA reduces the manual, labor-intensive efforts needed to conduct timeline analyses during digital forensic examinations. A pilot usability study conducted to evaluate TAIMA supports the claim that correlation and abstraction of low-level events into high-level system events can enhance digital forensic examinations.

Pursuit and evasion game related tasks are one application area envisioned for future multi- vehicle Unmanned Aircraft systems (UAs). Pursuit and evasion games relate to tasks such as search and rescue operations, surveillance, and search and capture missions. They include two sub-tasks of finding evaders and then capturing them. Because there are two sub-tasks, there are different roles that each pursuer must take on during the game. This paper examines the amount of communication required to determine what role each UAs pursuer should take to achieve a quick location and capture of the evader. Results demonstrate that more robust internal control strategies offset role communication when the communications become limited.

Division of labor in natural systems enables resiliency in times of dynamic change. Researchers have shown that division of labor can emerge in homogeneous populations predicated on the system's environment and the distribution of agent task bias. This article demonstrates that the emergence of division of labor in homogenous populations is also impacted by agent decision functions, agent population size, and environmental constraints. Results show, one, agent decision functions and population size have a significant impact on the division of labor scores, whereas, the influence of environmental constraints depends upon the chosen agent decision function. Two, results indicate that high division of labor scores do not necessarily translate to higher resource production, which, again, appears tied to agent decision functions. Three, although agent population size possesses a positive correlation to division of labor scores, agent decision functions play a more critical role in its emergence.

Intelligent agents provide simulations a means to add lifelike behavior in place of manned entities. When implemented, typically a single intelligent agent model (or approach to defining decision making), such as rule-based, behavior trees, neural networks, etc., is selected. This choice introduces restrictions into what behaviors agents can manifest, and can require significant testing in edge cases. This paper presents the incorporation and application of the Unified Behavior Framework (UBF) into the Advanced Framework for Simulation, Integration, and Modeling environment. The UBF provides the flexibility to implement any and all behavior-based systems, allowing the developer to rapidly assemble a decision making agent that leverages multiple paradigms or approaches. The UBF achieves this by leveraging several key software engineering principles: modular design, scalability through reduced code complexity, simplified development and testing through abstraction, and the promotion of code reuse. The use of UBF to define intelligent agents within a 2v2 Integrated Air Defense System is demonstrated.

We present the software implementation of our Qualia Modeling Framework (QMF), a computational cognitive model based on the dual-process theory, which theorizes that reasoning and decision making rely on integrated experiences from two interactive minds: the autonomous mind, without the agent’s conscious awareness, and the reflective mind, of which the agent is consciously aware. In the QMF, artificial qualia are the vocabulary of the conscious mind, required to reason over conceptual memory, and generate cognitive inferences. The autonomous mind employs pattern-matching, for fast reasoning over episodic memories. An ACT-R model with conventional declarative memory represents the autonomous mind. A second ACT-R model, with an unconventional implementation of declarative memory utilizing a hypernetwork theory based model of qualia space, represents the reflective mind. Using real-world, non-trivial, data sets, our cognitive model achieved classification accuracy comparable to, or greater than, analogous machine learning classifiers kNN and DT, while providing improvements in flexibility by allowing the Target Attribute to be identified or changed any time during training and testing. We advance the BICA challenge by providing a generalizable, efficient, algorithm which models the phenomenal structure of consciousness as proposed by a contemporary theory, and provides an effective decision aid in complex environments where data are too broad or diverse for a human to evaluate without computational assistance.

Reverse engineering is a time-consuming process essential to software-security tasks such as malware analysis and vulnerability discovery. During the process, an engineer will follow multiple leads to determine how the software functions. The combination of time and possible explanations makes it difficult for the engineers to maintain a context of their findings within the overall task. Analytic provenance tools have demonstrated value in similarly complex fields that require open-ended exploration and hypothesis vetting. This paper introduces SensorRE, the first analytic provenance tool designed to support software reverse engineers. A semi-structured interview with experts led to the design and implementation of the system. As core components, we describe the visual interfaces and their integration within an existing software analysis tool. SensorRE automatically captures user’s sensemaking actions and provides a graph and storyboard view to support further analysis. User study results demonstrate that SensorRE is easy to use and that it improved the participants’ exploration process.

Self-organized and distributed control methods are increasingly important as they allow multi-agent systems to scale more readily than centralized control techniques. Furthermore, these methods increase system robustness and flexibility. In the online multi-object k-coverage domain studied here, a collective of autonomous agents must dynamically form sub-teams to accomplish two concurrent tasks: target discovery and coverage. Once a target is discovered, the collective of agents must create a sub-team of k-agents to cover the target. The work presented here introduces a novel, entropy-based task selection technique that incorporates signal suppression behaviors found in bee colonies. We test the technique in the online multi-object k-coverage domain while exploring three team properties: heterogeneity, team size, and sensor ranges, and their impact on multi-task accomplishment. Results show that signal suppression helps avoid over-provisioning of team resources to individual targets, dynamically creating sub-teams that simultaneously accomplish target discovery and coverage tasks.

Ontological data representation and data normalization can provide a structured way to correlate digital artifacts and reduce the amount of data that a forensics investigator needs to process in order to understand the sequence of events that happened on a system. However, ontology processing suffers from large disk consumption and a high computational cost. This paper presents Property Graph Event Reconstruction (PGER), a data normalization and event correlation system that utilizes a native graph database to store event data. This storage method leverages zero index traversals. PGER reduces the processing time of event correlation grammars by up to a factor of 9.9 times over a system that uses a relational database based approach.

Analyzing how agent interactions affect macro-level self-organized behaviors can yield a deeper understanding of how complex adaptive systems work. The dynamic nature of complex systems makes it difficult to determine if, or when, a system has reached a state of equilibrium or is about to undergo a major transition reflecting the appearance of self-organized states. Using the notion of local neighborhood entropy, this paper presents a metric for evaluating the macro-level order of a system. The metric is tested in two dissimilar complex adaptive systems with self-organizing properties: an autonomous swarm searching for multiple dynamic targets and Conway's Game of Life. In both domains, the proposed metric is able to graphically capture periods of increasing and decreasing self-organization (i.e. changes in macro-level order), equilibrium and points of criticality; displaying its general applicability in identifying these behaviors in complex adaptive systems.

Automated feature matching of nuclear detonations (NUDETs) enables three-dimensional point cloud reconstruction, and establishment a volume-based model to reduce uncertainty in estimating the yield of NUDETs solely from video. Establishing a volume-based model requires feature correspondences between wide viewpoints of 58°–110° that are larger than scale-invariant feature transform-based techniques can reliably match. The presented technique detects relative bright features in the NUDET known as ‘hotspots,’ and matches them across wide viewpoints using a spherical based object model. Results show that hotspots can be detected with a 71.95% hit rate and 86.03% precision. Hotspots are matched to films from different viewpoints with 76.6% correctness and a standard deviation of 16.4%. Hotspot descriptors are also matched in time sequence with 99.6% correctness and a standard deviation of 1.07%. The results demonstrate that a spherical model can serve as a viable descriptor model for matching across wide viewpoints when the object is known to be spherical. It also demonstrates an automated feature detection and matching combination that enables features to be matched from unsynchronised video across wide viewpoints of 58°–110° on spherical objects where state-of-the-art techniques are insufficient.

Several cyber-attacks on the cyber-physical systems (CPS) that monitor and control critical infrastructure were publically announced over the last few years. Almost without exception, the proposed security solutions focus on preventing unauthorized access to the industrial control systems (ICS) at various levels – the defense in depth approach. While useful, it does not address the problem of making the systems more capable of responding to the malicious actions of an attacker once they have gained access to the system. The first step in making an ICS more resilient to an attacker is identifying the cyber security vulnerabilities the attacker can use during system design. This paper presents a method that reveals cyber security vulnerabilities in ICS through the formal modeling of the system and malicious agents. The inclusion of the malicious agent in the analysis of an existing systems identifies security vulnerabilities that are missed in traditional functional model checking.

Obtaining data for the training of failure prediction algorithms has long been an issue. A framework for automating the generation of this data for the training and deployment of these algorithms has recently been introduced. Unfortunately, the framework was only tested on a single deprecated operating system. In order to generalize the approach a few key functions must be performed, one of which being realistic workload generation. Unfortunately, a workload generator capable of generating sufficient workload has not been developed for a Microsoft Windows active directory environment. This paper introduces a tool that makes the implementation of this new framework possible on a modern Microsoft operating system. We present data generated by the tool to demonstrate its efficacy, and finish with several extensions and applications.

Summary Distributed virtual environments provide a shared sense of time and space to geographically distributed users. They depend on a limited ability to ensure system nodes at different locations maintain consistent state data. This paper presents system models and algorithms designed to find optimal update scheduling parameters that minimize the effects of inconsistent simulation state data. The first model is concerned with ensuring distributed virtual environments that present a fair experience to all users while simultaneously providing adequate levels of system performance. In the second model, we introduce the concept of plausibility limits and address their use in ensuring all participants in an interaction to see the same result.

Adaptive automation systems allow the user to complete a task seamlessly with a computer performing tasks at which the human operator struggles. Unlike traditional systems that allocate functions to either the human or the machine, adaptive automation varies the allocation of functions during system operation. Creating these systems requires designers to consider issues not present during static system development. To assist in adaptive automation system design, this paper presents the concept of inherent tasks and takes advantage of this concept to create the function-to-task design process model . This process model helps the designer determine how to allocate functions to the human, machine, or dynamically between the two. An illustration of the process demonstrates the potential complexity within adaptive automation systems and how the process model aids in understanding this complexity during early stage design.

Epaminondas is a two-person, zero-sum strategy game that combines long-term strategic play with highly tactical move sequences. The game has two unique features that make it stand out from other games. The first feature is the creation of phalanxes, which are groups of pieces that can move as a whole unit. As the number of pieces in a phalanx increases, the mobility and capturing power of the phalanx also increases. The second feature differs from many other strategy games: when a player makes a crossing, a winning move in the game, the second player has an opportunity to respond. This paper presents strategies and heuristics used in a Min-Max Alpha-Beta agent that plays at a novice level. Furthermore, it defines the state-space and game-tree complexities for Epaminondas. Finally, a new version of MCTS is implemented that uses the Alpha-Beta heuristic function during node selection to guide MCTS to more promising areas of the search tree. Additionally, in an effort to overcome the MCTS tactical weakness, the MCTS player implements the Alpha-Beta search once the game reaches 15 turns. Results show that the added heuristic value and the switch to Alpha-Beta for endgame play, positively impact the performance of MCTS, surpassing novice Alpha-Beta win ratios at certain time intervals.

Biometric computer authentication has an advantage over password and access card authentication in that it is based on something you are, which is not easily copied or stolen. One way of performing biometric computer authentication is to use behavioral tendencies associated with how a user interacts with the computer. However, behavioral biometric authentication accuracy rates are worse than more traditional authentication methods. This article presents a behavioral biometric system that fuses user data from keyboard, mouse, and Graphical User Interface (GUI) interactions. Combining the modalities results in a more accurate authentication decision based on a broader view of the user's computer activity while requiring less user interaction to train the system than previous work. Testing over 31 users shows that fusion techniques significantly improve behavioral biometric authentication accuracy over single modalities on their own. Between the two fusion techniques presented, feature fusion and an ensemble based classification method, the ensemble method performs the best with a False Acceptance Rate (FAR) of 2.10% and a False Rejection Rate (FRR) 2.24%.

Digital forensics practitioners face a continual increase in the volume of data they must analyze, which exacerbates the problem of finding relevant information in a noisy domain. Current technologies make use of keyword based search to isolate relevant documents and minimize false positives with respect to investigative goals. Unfortunately, selecting appropriate keywords is a complex and challenging task. Latent Dirichlet Allocation (LDA) offers a possible way to relax keyword selection by returning topically similar documents. This research compares regular expression search techniques and LDA using the Real Data Corpus (RDC). The RDC, a set of over 2400 disks from real users, is first analyzed to craft effective tests. Three tests are executed with the results indicating that, while LDA search should not be used as a replacement to regular expression search, it does offer benefits. First, it is able to locate documents when few, if any, of the keywords exist within them. Second, it improves data browsing and deals with keyword ambiguity by segmenting the documents into topics.

The provenance of a file is a detailing of its origins and activities. Tools have been developed that help maintain the provenance of files. However, these tools require prior installation on a computer of interest before and while provenance-generating events occur. The automated tool described in this chapter can reconstruct the provenance of a file from a variety of artifacts. It identifies relevant temporal and user correlations between the artifacts and presents them to an investigator. Results from six use cases demonstrate that these correlations are reliable and valuable in digital forensic investigations.

Being able to imitate individual players in a game can benefit game development by providing a means to create a variety of autonomous agents and aid understanding of which aspects of game states influence game-play. This paper presents a clustering and locally weighted regression method for modeling and imitating individual players. The algorithm first learns a generic player cluster model that is updated online to capture an individual’s game-play tendencies. The models can then be used to play the game or for analysis to identify how different players react to separate aspects of game states. The method is demonstrated on a tablet-based trajectory generation game called Space Navigator.

Large-scale systems are part of a growing trend in distributed computing, and coordinating control of them is an increasing challenge. This paper presents a cooperative agent system that scales to one million or more nodes in which agents form coalitions to complete global task objectives. This approach uses the large-scale Command and Control C2 capabilities of the Resource Clustered Chord RC-Chord Hierarchical Peer-to-Peer HP2P design. Tasks are submitted that require access to processing, data, or hardware resources, and a distributed agent search is performed to recruit agents to satisfy the distributed task. This approach differs from others by incorporating design elements to accommodate large-scale systems into the resource location algorithm. Peersim simulations demonstrate that the distributed coalition formation algorithm is as effective as an omnipotent central algorithm in a one million agent system.

Investigating insider threat cases is challenging because activities are conducted with legitimate access that makes distinguishing malicious activities from normal activities difficult. To assist with identifying non-normal activities, we propose using two types of pattern discovery to identify a person's behavioral patterns in network data. The behavioral patterns serve to deemphasize normal behavior so that insider threat investigations can focus attention on potentially more relevant. Results from a controlled experiment demonstrate the highlighting of a suspicious event through the reduction of events belonging to discovered patterns.

Organizations increasingly rely on the confidentiality, integrity and availability of their information and communications technologies to conduct effective business operations while maintaining their competitive edge. Exploitation of these networks via the introduction of undetected malware ultimately degrades their competitive edge, while taking advantage of limited network visibility and the high cost of analyzing massive numbers of programs. This article introduces the novel Malware Target Recognition (MaTR) system which combines the decision tree machine learning algorithm with static heuristic features for malware detection. By focusing on contextually important static heuristic features, this research demonstrates superior detection results. Experimental results on large sample datasets demonstrate near ideal malware detection performance (99.9+% accuracy) with low false positive (8.73e-4) and false negative rates (8.03e-4) at the same point on the performance curve. Test results against a set of publicly unknown malware, including potential advanced competitor tools, show MaTR's superior detection rate (99%) versus the union of detections from three commercial antivirus products (60%). The resulting model is a fine granularity sensor with potential to dramatically augment cyberspace situation awareness.

In a digital forensics examination, the capture and analysis of volatile data provides significant information on the state of the computer at the time of seizure. Memory analysis is a premier method of discovering volatile digital forensic information. While much work has been done in extracting forensic artifacts from Windows kernel structures, less focus has been paid to extracting information from Windows drivers. There are two reasons for this: (1) source code for one version of the Windows kernel (but not associated drivers) is available for educational use and (2) drivers are generally called asynchronously and contain no exported functions. Therefore, finding the handful of driver functions of interest out of the thousands of candidates makes reverse code engineering problematic at best. Developing a methodology to minimize the effort of analyzing these drivers, finding the functions of interest, and extracting the data structures of interest is highly desirable. This paper provides two contributions. First, it describes a general methodology for reverse code engineering of Windows drivers memory structures. Second it applies the methodology to tcpip.sys, a Windows driver that controls network connectivity. The result is the extraction from tcpip.sys of the data structures needed to determine current network connections and listeners from the 32 and 64 bit versions of Windows Vista and Windows 7. Manipulation (DKOM), tcpip.sys, Windows 7, Windows Vista. 2000 MSC: 60, 490.

When attempting to reconstruct the events leading up to a cyber security incident, one potentially important piece of information is the clipboard (Prosise et al., 2003). The clipboard has been present in Windows since Windows 3.1 and is the mechanism for transferring information from one application to another through copy and pasting actions. Being able to retrieve the last file copied or the last password used may provide investigators with invaluable information during a forensic investigation. This paper describes the Windows clipboard structure and the process of retrieving copy/paste information from Windows XP, Vista, and Windows 7 (both 32 bit and 64 bit) memory captures with data from applications including Notepad, Microsoft Word, and Microsoft Excel.

Behavior-based systems form the basis of autonomous control for many robots, but there is a need to ensure these systems respond in a timely manner. Unexpected latency can adversely affect the quality of an autonomous system's operations, which in turn can affect lives and property in the real-world. A robots ability to detect and handle external events is paramount to providing safe and dependable operation. This paper presents a concurrent version of a behavior-based system called the Real-Time Unified Behavior Framework, which establishes a responsive basis of behavior-based control that does not bind the system developer to any single behavior hierarchy. The concurrent design of the framework is based on modern software engineering principles and only specifies a functional interface for components, leaving the implementation details to the developers. In addition, the individual behaviors are executed by a real-time scheduler, guaranteeing the responsiveness of routines that are critical to the autonomous system's safe operation. Experimental results demonstrate the ability of this approach to provide predictable temporal operation, independent of fluctuations in high-level computational loads.

The underlying goal of a competing agent in a discrete real-time strategy (RTS) game is to defeat an adversary. Strategic agents or participants must define an a priori plan to maneuver their resources in order to destroy the adversary and the adversary's resources as well as secure physical regions of the environment. This a priori plan can be generated by leveraging collected historical knowledge about the environment. This knowledge is then employed in the generation of a classification model for real-time decision-making in the RTS domain. The best way to generate a classification model for a complex problem domain depends on the characteristics of the solution space. An experimental method to determine solution space (search landscape) characteristics is through analysis of historical algorithm performance for solving the specific problem. We select a deterministic search technique and a stochastic search method for a priori classification model generation. These approaches are designed, implemented, and tested for a specific complex RTS game, Bos Wars. Their performance allows us to draw various conclusions about applying a competing agent in complex search landscapes associated with RTS games.

Memory analysis is an integral part of any computer forensic investigation, providing access to volatile data not found on a drive image. While memory analysis has recently made significant progress, it is still hampered by hard-coded tools that cannot generalize beyond the specific operating system and version they were developed for. This paper proposes using the debug structures embedded in memory dumps and Microsoft's program database (PDB) files to create a flexible tool that takes an arbitrary memory dump from any of the family of Windows NT operating systems and extract process, configuration, and network activity information. The debug structures and PDB files are incorporated into a memory analysis tool and tested against dumps from 32-bit Windows XP with physical address extensions (PAE) enabled and disabled, 32-bit Windows Vista with PAE enabled, and 64-bit Windows 7 systems. The results show the analysis tool is able to identify and parse an arbitrary memory dump and extract process, registry, and network communication information.

The Global Information Grid (GIG) is the military’s computer and communications network which supports the myriad of military missions. Military missions are highly planned, passing through many hands in the strategy-to-task methodology to ensure completeness, accuracy, coordination, cohesion, and appropriateness. A benefit of this planning is the possibility to collect knowledge of future conditions that could be of use to network designers whose goals include optimizing and protecting the GIG. This advanced knowledge includes which networked military equipment will be involved, what their capabilities are, where they will be, when they will be there, and particulars on the required data flows. A Network Tasking Order process is proposed as a means of collecting this information, analyzing the information to generate network taskings, and disseminating those taskings. Tactical integration of assets in mobile networks is introduced as another planning variable in the battlefield; not unlike logistical considerations such as fuel, ammunition, water, and so on used currently in operation planning. Modeling and simulation is used to support the proposed benefits.

The utility of Peer-to-Peer (P2P) systems extends far beyond traditional file sharing. This paper provides an overview of how P2P systems are capable of providing robust command and control for Distributed Multi-Agent Systems (DMASs). Specifically, this article presents the evolution of P2P architectures to date by discussing supporting technologies and applicability of each generation of P2P systems. It provides a detailed survey of fundamental design approaches found in modern large-scale P2P systems highlighting design considerations for building and deploying scalable P2P applications. The survey includes unstructured P2P systems, content retrieval systems, communications structured P2P systems, flat structured P2P systems and finally Hierarchical Peer-to-Peer (HP2P) overlays. It concludes with a presentation of design tradeoffs and opportunities for future research into P2P overlay systems.

Ant clustering algorithms are a robust and flexible tool for clustering data that have produced some promising results. This paper introduces two improvements that can be incorporated into any ant clustering algorithm: kernel function similarity weights and a similarity memory model replacement scheme. A kernel function weights objects within an ant’s neighborhood according to the object distance and provides an alternate interpretation of the similarity of objects in an ant’s neighborhood. Ants can hill-climb the kernel gradients as they look for a suitable place to drop a carried object. The similarity memory model equips ants with a small memory consisting of a sampling of the current clustering space. We test several kernel functions and memory replacement schemes on the Iris, Wisconsin Breast Cancer, and Lincoln Lab network intrusion datasets. Compared to a basic ant clustering algorithm, we show that kernel functions and the similarity memory model increase clustering speed and cluster quality, especially for datasets with an unbalanced class distribution, such as network intrusion.

One means of preventing insider theft is by stopping potential insiders from becoming actual thieves. This article discusses an approach to assist managers in identifying potential insider threats. By using the Author Topic [Rosen-Zvi Michal, Griffiths Thomas, Steyvers Mark, Smyth Padhraic. The author-topic model for authors and documents. In: Proceedings of the 20th conference on uncertainty in artificial intelligence; 2004. p. 487-94.] clustering algorithm, we discern employees' interests from their daily emails. These interests then provide a means to create an implicit and an explicit social network graph. This approach locates potential insiders by finding individuals who either (1) feel alienated from the organization (a key warning sign of a possible disgruntled worker) or (2) have a hidden interest in a sensitive (e.g. proprietary or classified) topic. In both cases, this is revealed when someone demonstrates an interest in a topic but does not share that interest with anyone in the organization. By applying this technique to the Enron email corpus, we produce coherent, sensible topics and reveal Sherron Watkins, the famous Enron whistleblower, as a potential insider threat from the viewpoint of the individuals behind the Enron scandal.

Current cyber-related security and safety risks are unprecedented, due in no small part to information overload and skilled cyber-analyst shortages. Advances in decision support and Situation Awareness (SA) tools are required to support analysts in risk mitigation. Inspired by human intelligence, research in Artificial Intelligence (AI) and Computational Intelligence (CI) have provided successful engineering solutions in complex domains including cyber. Current AI approaches aggregate large volumes of data to infer the general from the particular, i.e. inductive reasoning (pattern-matching) and generally cannot infer answers not previously programmed. Whereas humans, rarely able to reason over large volumes of data, have successfully reached the top of the food chain by inferring situations from partial or even partially incorrect information, i.e. abductive reasoning (pattern-completion); generating a hypothetical explanation of observations. In order to achieve an engineering advantage in computational decision support and SA we leverage recent research in human consciousness, the role consciousness plays in decision making, modeling the units of subjective experience which generate consciousness, qualia. This paper introduces a novel computational implementation of a Cognitive Modeling Architecture (CMA) which incorporates concepts of consciousness. We apply our model to the malware type-classification task. The underlying methodology and theories are generalizable to many domains.

Reinforcement learning is one of the more attractive machine learning technologies, due to its unsupervised learning structure and ability to continually learn even as the operating environment changes. Additionally, by applying reinforcement learning to multiple cooperative software agents (a multi-agent system) not only allows each individual agent to learn from its own experience, but also opens up the opportunity for the individual agents to learn from the other agents in the system, thus accelerating the rate of learning. This research presents the novel use of fuzzy state aggregation, as the means of function approximation, combined with the fastest policy hill climbing methods of Win or Lose Fast (WoLF) and policy-dynamics based WoLF (PD-WoLF). The combination of fast policy hill climbing and fuzzy state aggregation function approximation is tested in two stochastic environments: Tileworld and the simulated robot soccer domain, RoboCup. The Tileworld results demonstrate that a single agent using the combination of FSA and PHC learns quicker and performs better than combined fuzzy state aggregation and Q-learning reinforcement learning alone. Results from the multi-agent RoboCup domain again illustrate that the policy hill climbing algorithms perform better than Q-learning alone in a multi-agent environment. The learning is further enhanced by allowing the agents to share their experience through a weighted strategy sharing.

Steganography is the art of hiding a message in plain sight. Modern steganographic tools that conceal data in innocuous-looking digital image files are widely available. The use of such tools by terrorists, hostile states, criminal organizations, etc., to camouflage the planning and coordination of their illicit activities poses a serious challenge. Most steganography detection tools rely on signatures that describe particular steganography programs. Signature-based classifiers offer strong detection capabilities against known threats, but they suffer from an inability to detect previously unseen forms of steganography. Novel steganography detection requires an anomaly-based classifier. This paper describes and demonstrates a blind classification algorithm that uses hyper-dimensional geometric methods to model steganography-free jpeg images. The geometric model, comprising one or more convex polytopes, hyper-spheres, or hyper-ellipsoids in the attribute space, provides superior anomaly detection compared to previous research. Experimental results show that the classifier detects, on average, 85.4% of Jsteg steganography images with a mean embedding rate of 0.14 bits per pixel, compared to previous research that achieved a mean detection rate of just 65%. Further, the classification algorithm creates models for as many training classes of data as are available, resulting in a hybrid anomaly/signature or signature-only based classifier, which increases Jsteg detection accuracy to 95%.

The goal of robotics research is to design a robot to fulfill a variety of tasks in the real world. Inherent in the real world is a high degree of uncertainty about the robot’s behavior and about the world. We introduce a robot task architecture, DTRC, that generates plans with actions that incorporate costs and uncertain effects, and states that yield rewards. The use of a decision-theoretic planner in a robot task architecture is demonstrated on the mobile robot domain of miniature golf. The miniature golf domain shows the application of decision-theoretic planning in an inherently uncertain domain, and demonstrates that by using decision-theoretic planning as the reasoning method in a robot task architecture, accommodation for uncertain information plays a direct role in the reasoning process.

The ability to perform tasks similarly to how a specific human would perform them is valuable in future automation efforts across several areas. This paper presents a \(k\)-nearest neighbor trajectory generation methodology that creates trajectories similar to those of a given user in the Space Navigator environment using cluster-based player modeling. This method improves on past efforts by generating trajectories as whole entities rather than creating them point-by-point. Additionally, the player modeling approach improves on past human trajectory modeling efforts by achieving similarity to specific human players rather than general human-like game-play. Results demonstrate that player modeling significantly improves the ability of a trajectory generation system to imitate a given user’s actual performance.

During the 1950s and 1960s the United States conducted and filmed over 200 atmospheric nuclear tests establishing the foundations of atmospheric nuclear detonation behavior. Each explosion was documented with about 20 videos from three or four points of view. Synthesizing the videos into a 3D video will improve yield estimates and reduce error factors. The videos were captured at a nominal 2500 frames per second, but range from 2300–3100 frames per second during operation. In order to combine them into one 3D video, individual video frames need to be correlated in time with each other. When the videos were captured a timing system was used that shined light in a video every 5 milliseconds creating a small circle exposed in the frame. This paper investigates several method of extracting the timing from images in the cases when the timing marks are occluded and washed out, as well as when the films are exposed as expected. Results show an improvement over past techniques. For normal videos, occluded videos, and washed out videos, timing is detected with 99.3%, 77.3%, and 88.6% probability with a 2.6%, 11.3%, 5.9% false alarm rate, respectively.

Reverse Code Engineering (RCE) to detect anti-debugging techniques in software is a very difficult task. Code obfuscation is an anti-debugging technique makes detection even more challenging. The Rule Engine Detection by Intermediate Representation (REDIR) system for automated static detection of obfuscated anti-debugging techniques is a prototype designed to help the RCE analyst improve performance through this tedious task. Three tenets form the REDIR foundation. First, Intermediate Representation (IR) improves the analyzability of binary programs by reducing a large instruction set down to a handful of semantically equivalent statements. Next, an Expert System (ES) rule-engine searches the IR and initiates a sense-making process for anti-debugging technique detection. Finally, an IR analysis process confirms the presence of an anti-debug technique. The REDIR system is implemented as a debugger plug-in. Within the debugger, REDIR interacts with a program in the disassembly view. Debugger users can instantly highlight anti-debugging techniques and determine if the presence of a debugger will cause a program to take a conditional jump or fall through to the next instruction.