This paper reports on methods and results of an applied research project by a team consisting of SAIC and four universities to develop, integrate, and evaluate new approaches to detect the weak signals characteristic of insider threats on organizations' information systems. Our system combines structural and semantic information from a real corporate database of monitored activity on their users' computers to detect independently developed red team inserts of malicious insider activities. We have developed and applied multiple algorithms for anomaly detection based on suspected scenarios of malicious insider behavior, indicators of unusual activities, high-dimensional statistical patterns, temporal sequences, and normal graph evolution. Algorithms and representations for dynamic graph processing provide the ability to scale as needed for enterprise-level deployments on real-time data streams. We have also developed a visual language for specifying combinations of features, baselines, peer groups, time periods, and algorithms to detect anomalies suggestive of instances of insider threat behavior. We defined over 100 data features in seven categories based on approximately 5.5 million actions per day from approximately 5,500 users. We have achieved area under the ROC curve values of up to 0.979 and lift values of 65 on the top 50 user-days identified on two months of real data.

We present a novel ensemble architecture for learning problem-solving techniques from a very small number of expert solutions and demonstrate its effectiveness in a complex real-world domain. The key feature of our “Generalized Integrated Learning Architecture” (GILA) is a set of heterogeneous independent learning and reasoning (ILR) components, coordinated by a central meta-reasoning executive (MRE). The ILRs are weakly coupled in the sense that all coordination during learning and performance happens through the MRE. Each ILR learns independently from a small number of expert demonstrations of a complex task. During performance, each ILR proposes partial solutions to subproblems posed by the MRE, which are then selected from and pieced together by the MRE to produce a complete solution. The heterogeneity of the learner-reasoners allows both learning and problem solving to be more effective because their abilities and biases are complementary and synergistic. We describe the application of this novel learning and problem solving architecture to the domain of airspace management, where multiple requests for the use of airspaces need to be deconflicted, reconciled, and managed automatically. Formal evaluations show that our system performs as well as or better than humans after learning from the same training data. Furthermore, GILA outperforms any individual ILR run in isolation, thus demonstrating the power of the ensemble architecture for learning and problem solving.

Developing sensor agents that can be deployed untethered in the field presents significant challenges in adapting to hardware, communication, power and environmental limitations. Real-world characteristics dictate agent behavior and operating strategies, sometimes quite differently from often held assumptions and intuitions. In this article, we describe the sensor-agent hardware and blackboard-system software used in CNAS (collaborative network for atmospheric sensing), an agent-based, power-aware sensor network for ground-level atmospheric monitoring. CNAS is representative of a class of battery-powered, wireless sensor networks in which the distance separating deployed sensor agents is near the limit of their WiFi communication range. To conserve battery power, CNAS sensor agents must have their wireless radios turned off most of the time, as even having them turned on consumes significant power. This limitation complicates agent interaction and network responsiveness, because an agent cannot simply turn on its radio when it needs to send a message. CNAS agents also must have their radios turned on when others are sending messages to them and to support multi-hop message forwarding. We discuss how CNAS agents collaborate using only periodic radio availability and consider how different hardware and communication capabilities would change CNAS strategies. We also relate challenges that had to be addressed during deployments of CNAS at military exercises held in the summer heat in Wisconsin and in the rain and mud in Queensland, Australia. We conclude with research on improving CNAS responsiveness with limited radio availability and on potential next-generation CNAS hardware.

A situated agent must determine aspects of its environment in order to make appropriate decisions. This determination must be done quickly, as performance can suffer until each agent develops a sufficiently accurate model of its environment. We introduce a two-phase model-development approach called pre-deployment learning and situated model-development in agents (PLASMA) that leads to a significant reduction in the online (post-deployment) time required to determine environmental models. During the pre-deployment phase, an incompletely specified, site-independent model of an agent's environment is developed, with the site-dependent features represented as parameters in the model. This pre-deployment model is then completed during the post-deployment phase by determining the model parameters using constraints between local and shared observations. In this article, we use the PLASMA approach in developing an environmental model for potential solar visibility and panel collection characteristics by each agent in a power-aware wireless sensor network. We show that, by using temporal and spatial constraints between shared observations, agents can reduce online model-development time by as much as 80% relative to a standard multi-agent reinforcement learning algorithm. Furthermore, we show that using constraints between shared observations can further reduce post-deployment parameter determination time by as much as 67% relative to sharing only local variable values in a distributed variable satisfaction post-deployment technique. In all but the most unlikely of environmental conditions, using the PLASMA-based approach allows individual agent-harvesting models to be completed using only the first and second day observations when compared with 10 days of observations required by the power management algorithm of Kansal et al.

The requirements of a problem-solving architecture that can be tightly embedded within other architectures and coexist with multiple instances of itself and of other problem-solvers are discussed. The additional effort needed to produce an embedable problem-solving architecture is minor compared to the substantial increase in applicability of the architecture. A specific need for embedable problem-solvers arose with the University of Massachusetts Generic Blackboard Framework (UMass GBB). UMass GBB is based on the blackboard paradigm, which naturally integrates heterogeneous problem-solving representations as individual knowledge sources (KSs). This need is met by developing general specifications for embedable problem-solving architectures, and the specifications are used to modify the public-domain version of OPS5 in order to embed it as an integral KS language within UMass GBB. The OPS5 modifications result in an easily integrated GBB KS language (distributed with the UMass GBB system) that has been used in several GBB applications.>

The authors present an overview of cooperative distributed problem solving (CDPS), an emerging research area that combines aspects of AI (artificial intelligence) and distributed processing. CDPS can be used to study how a loosely coupled network of sophisticated problem-solving nodes can solve a complex problem which consists of a set of interdependent subproblems. Subproblems arise because of spatial, temporal, and functional distribution of data, knowledge, and processing capabilities. Application areas include distributed interpretation, distributed planning and control, cooperating expert systems, and computer-supported human cooperation. The authors survey the important approaches and empirical investigations that have been developed. The approaches covered include negotiation, functionally accurate cooperation, organizational structuring, multiagent planning, sophisticated local control, and theoretical frameworks.>

When two or more computing agents work on interacting tasks, their activities should be coordinated so that they cooperate coherently. Coherence is particularly problematic in domains where each agent has only a limited view of the overall task, where communication between agents is limited, and where there is no ``controller'' to coordinate the agents. Our approach to coherent cooperation in such domains is developed in the context of a distributed problem-solving network where agents cooperate to solve a single problem. The approach stresses the importance of sophisticated local control by which each problem-solving node integrates knowledge of the problem domain with (meta-level) knowledge about network coordination. This allows nodes to make rapid, intelligent local decisions based on changing problem characteristics with only a limited amount of intercommunication to coordinate these decisions. We describe three mechanisms that improve network coherence: 1) an organizational structure that provides a long-term framework for network coordination to guide each node's local control decisions; 2) a planner at each node that develops sequences of problem-solving activities based on the current situation; and 3) meta-level communication about the current state of local problem solving that enables nodes to dynamically refine the organization. We present a variety of problem-solving situations to show the benefits and limitations of these mechanisms, and we provide simulation results showing the mechanisms to be particularly cost effective in more complex problem-solving situations. We also discuss how these mechanisms might be of more general use in other distributed computing applications.

A new approach for structuring distributed processing systems, called functionally accurate, cooperative (FA/C), is proposed. The approach differs from conventional ones in its emphasis on handling distribution-caused uncertainty and errors as an integral part of the network problem-solving process. In this approach nodes cooperatively problem-solve by exchanging partial tentative results (at various levels of abstraction) within the context of common goals. The approach is especially suited to applications in which the data necessary to achieve a solution cannot be partitioned in such a way that a node can complete a task without seeing the intermediate state of task processing at other nodes. Much of the inspiration for the FA/C approach comes from the mechanisms used in knowledge-based artificial intelligence (Al) systems for resolving uncertainty caused by noisy input data and the use of approximate knowledge. The appropriateness of the FA/C approach is explored in three application domains: distributed interpretation, distributed network traffic-light control, and distributed planning. Additionally, the relationship between the approach and the structure of management organizations is developed. Finally, a number of current research directions necessary to more fully develop the FA/C approach are outlined. These research directions include distributed search, the integration of implicit and explicit forms of control, and distributed planning and organizational self-design.