1. Wagner Associates NCSD-ADS-DOC-3810-2.0-20070412 ARO Workshop on Cyber Situation Awareness RPD-inspired Hypothesis Reasoning for Cyber Situation Awareness November 14, 2007 John Yen, Mike McNeese, and Peng Liu COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY

2. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 2 Overview Cognitive Foundation: RPD Model RPD-enabled Collaborative Agents: R- CAST Hypothesis Reasoning in R-CAST Similarity-based Activation of Hypothesis Gathering Missing Relevant Information

3. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 3 Recognition-Primed Decision A cognitive model of human decision-making under time pressure. A naturalistic decision-making model A holistic decision-making model –Includes gathering relevant information –Captures the entire decision making process, not just the “decision point”. An adaptive decision-making process –Includes detecting changes in the environment so that decisions can be adapted.

4. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 4 Three Types of Relevant Information in RPD Model –Missing Cues –Criteria for Evaluating Options –Expectancy Adapted from G.A. Klein 1989 start end miss information complete information workable not workable InvestigationFeature matching Expectancy monitor Evaluate option Implement option Situation analysis anomalies detected Learning

5. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 5 RPD-enabled Agents: R-CAST RPD Model R-CAST Investigation in RPD Information Manager in R-CAST

6. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 6 Hypothesis Reasoning Hypothesis guides the seeking of relevant information.

7. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 7 Hypothesis Reasoning in R-CAST

8. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 8

9. 9 Similarity-based Activation of Hypotheses Based on similarity-based matching with cues of “Experience” Allows for partial matching Cues can be associated with weights Variable bindings of hypotheses are established by the matching process. Experience e1 Cue: C1 C3 C5 Hypothesize B

10. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 10 Closest Experiences For Alternative Hypotheses Recommended Hypothesis Current Situation Similarity-based Matching for Hypothesis Activation e1 e12 e14 Hypothesis Type D e10 e5 e6 Hypothesis Type C e4 e3 Hypothesis Type A e7 e8 e9 e2 Hypothesis Type B X

11. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 11 Hypothesis Activation ExperienceC1C2C3C4C5Hypothesis e1 Large-Yes-?B e3 ----A e8 --Violated-C e14 ----D Shows the hypothesis that matches the current situation best Presents option analysis for alternative hypotheses Matching cues of the recommended hypothesis Matching cues of alternative hypothesis Cues not applicable for a hypothesis Unknown cues relevant for a hypothesis

12. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 12 Option Analysis for Alternative Hypotheses C1C2C3C4C5Hypothesis Large-Yes-?B -No--A --Violated-C ----D Shows what conditions would have resulted in alternative hypothese Blue cells indicate conditions identical to the current situations Example: –If C3 did not occur, the recommended hypothesis would have been A

13. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 13 Overview Cognitive Foundation: RPD Model RPD-enabled Collaborative Agents: R- CAST Hypothesis Reasoning in R-CAST Similarity-based Activation of Hypothesis  Gathering Missing Relevant Information Automated Update/Refine of Hypothesis

14. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 14 R-CAST Automates Gathering Relevant Information Four sources of information for matching with experiences 1.Facts in knowledge base 2.Inference rules in knowledge base 3.External services 4.Hypothesis Experience C1 C3 C5 B Cues Hypothesis Inference Rules C9 ? C3 ? Information Manager RPD Decision Model Knowledge Base C3 C9 Communication Manager C9 Service C1 Facts Hypothesis Manager C5?

15. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 15 Gather Missing Information Through Backward Reasoning and Hypothesis E C3 D F G H Missing Information Known Experience C3 Hypothesize B Cues Decision Missing Information Information Requirement Inference Rules Information Manager RPD Decision Model Agent Hypothesize F Request: E

16. COLLEGE OF INFORMATION SCIENCES AND TECHNOLOGY 16 Summary RPD-based agents enable similarity-based activation of hypotheses –Allow for incomplete information –Enable comparison with alternative hypotheses Reasoning about missing relevant information –Through backward inference Potential for Cyber Situation Awareness –Using hypothesis reasoning to infer missing information –Using hypothesis reasoning to reduce false positive alerts. Current Efforts A novel integration of Bayes Net with predicate logic for missing information reasoning. Refinement of hypotheses through reasoning about their variable bindings.