As power grids transition into decentralized Cyber-Physical Power Systems, the digitalization of legacy devices has dramatically multiplied the potential entry points for cyber adversaries. To accurately assess these threats, security models must capture both detailed attack steps and network timing effects. However, obtaining real-world cyber incident data to parameterize these models is rarely possible due to strict privacy and confidentiality constraints within utility companies. To overcome this limitation, we present a simulation-based framework that integrates Attack Graphs (AGs) with the OMNeT++ Discrete Event Simulation environment and Dynamic Bayesian Networks (DBNs). Attack step logic is modeled through Control Finite State Machines, allowing for dynamic interactions between attacker behavior and simulated network components. The simulation automatically generates time-series data used to train AG-derived DBNs used to answer probabilistic queries on attack progression. We present a case study on a Distributed Energy Resource cyberattack which demonstrates that the framework captures complex temporal dependencies and maintains high predictive accuracy supporting cybersecurity assessment for critical energy infrastructures. The code and models implemented in this work are available here: https://github.com/Dosclic98/dbn-sim-learning.git.

Graph based recommendation strategies are recently gaining momentum in connection with the availability of new Graph Neural Network (GNN) architectures. In fact, the interactions between users and products in a recommender system can be naturally expressed in terms of a bipartite graph, where nodes corresponding to users are connected with nodes corresponding to products trough edges representing a user action on the product (usually a purchase). GNNs can then be exploited and trained in order to predict the existence of a specific edge between unconnected users and products, highlighting the interest for a potential purchase of a given product by a given user. In the present paper, we will present an experimental analysis of different GNN architectures in the context of recommender systems. We analyze the impact of different kind of layers such as convolutional, attentional and message-passing, as well as the influence of different embedding size on the performance on the link prediction task. We will also examine the behavior of two of such architectures (the ones relying on the presence of node features) with respect to both transductive and inductive situations.

Personalized recommendation of products is an essential feature in any e-commerce service and is becoming more and more important for SME as well. The main problem is to be able to exploit limited amount of data concerning both user interactions and item availability. In the present paper, we introduce and evaluate some k-means based clustering strategies able to recognize different user categories even in presence of limited data. The ability to recognize users on the basis of their activity on the e-commerce site is fundamental to get insights about their preferences, in such a way that suitable products (or categories of products) can be recommended to them. We report on the experiments we have performed in the evaluation of three different clustering strategies, having the goal of grouping users showing similar behavior in interacting with items. We conclude that a standard k-means based on the Frobenius norm of the user matrix can provide good performances in terms of clustering users in the corresponding categories of interest.

We tackle the problem of authenticating high value Italian wines through machine learning classification. The problem is a seriuos one, since protection of high quality wines from forgeries is worth several million of Euros each year. In a previous work we have identified some base models (in particular classifiers based on Bayesian network (BNC), multi-layer perceptron (MLP) and sequential minimal optimization (SMO)) that well behave using unexpensive chemical analyses of the interested wines. In the present paper, we investigate the role of esemble learning in the construction of more robust classifiers; results suggest that, while bagging and boosting may significantly improve both BNC and MLP, the SMO model is already very robust and efficient as a base learner. We report on results concerning both cross validation on two different datasets, as well as experiments with models trained with the above datasets and tested with a dataset of potentially fake wines; this has been synthesized from a generative probabilistic model learned from real samples and expert knowledge.

We exploit Decision Networks (DN) for the analysis of attack/defense scenarios in critical infrastructures. DN extend Bayesian Networks (BN) with decision and value nodes. DN inherit from BN the possibility to naturally address uncertainty at every level, making possible the modeling of situations that are not limited to Boolean combinations of events. By means of decision nodes, DN can include the interaction level of attacks and countermeasures. Inference algorithms can be directly exploited for implementing a probabilistic analysis of both the risk and the importance of the attacks. Thanks to value nodes, a sound decision theoretic analysis has the goal of selecting the optimal set of countermeasures to activate.

Personalized financial advisory systems based on Case-Based Reasoning and on historical user activity are an emerging trend. In the present paper, we report the experience related to the development of a case-based recommendation module in a project called SMARTFASI, where the knowledge about past experiences is exploited, in order to suggest suitable asset investments to the final user. We present a solution aimed at personalizing the asset picking phase, by taking into consideration choices made by customers who have a financial and personal data profile "similar" to the current one. We discuss the notion of distance-based similarity adopted in our system and how to actually implement an asset recommendation strategy integrated with the other software modules of SMARTFASI. We finally discuss the impact such a strategy may have both from the point of view of private investors and professional users.

This paper discusses the data mining approach followed in a project called TRAQUASwine, aimed at the definition of methods for data analytical assessment of the authenticity and protection, against fake versions, of some of the highest value Nebbiolo-based wines from Piedmont region in Italy. This is a big issue in the wine market, where commercial frauds related to such a kind of products are estimated to be worth millions of Euros. The objective is twofold: to show that the problem can be addressed without expensive and hyper-specialized wine analyses, and to demonstrate the actual usefulness of classification algorithms for data mining on the resulting chemical profiles. Following Wagstaff's proposal for practical exploitation of machine learning (and data mining) approaches, we describe how data have been collected and prepared for the production of different datasets, how suitable classification models have been identified and how the interpretation of the results suggests the emergence of an active role of classification techniques, based on standard chemical profiling, for the assesment of the authenticity of the wines target of the study.

This paper describes how to exploit the modeling features and inference capabilities of dynamic Bayesian networks (DBN), in designing and implementing an innovative approach to fault detection, identification, and recovery (FDIR) for autonomous spacecrafts (e.g., a Mars rover). In particular, issues like partial observability, uncertain system evolution and system-environment interaction, as well as the prediction and mitigation of imminent failures can be naturally addressed by the proposed approach. The DBN framework can augment the modeling and analytical power of standard FDIR methodologies, while still being able to be integrated into the usual system modeling procedures (like, for instance, fault tree analysis). An FDIR cycle composed of the tasks of diagnosis (identification of the current state of the system), prognosis (identification of the future state under the current conditions), and recovery (selection of the best set of actions the autonomous system can perform, in order to avoid critical situations) is introduced and characterized through a DBN model. In particular, by considering the execution of recovery actions in response to either a current or a future abnormal situation, both reactive as well as preventive recovery can be addressed respectively. The proposed approach has been implemented in an on-board software architecture called Anomaly resolution and prognostic health management for autonomy (ARPHA), realized during the Verifim study funded by the European Space Agency and jointly performed with Thales/Alenia Italy. We report on some of the results obtained by performing a case study concerning the FDIR analysis of the power supply system of the ExoMars rover, by considering different anomalous and failure simulated scenarios; we conclude that ARPHA is able to properly detect and deal with the simulated problems.

Computer Interpretable Guidelines (CIG) are an emerging area of research, to support medical decision making through evidence-based recommendations. However, new challenges in the data management field have to be faced, to integrate CIG management with a proper treatment of patient data, and of other forms of medical knowledge (e.g., causal and behavioral knowledge). In this position paper, we summarize a proposal for a research agenda that, in our opinion, can lead to a significant advancement in the field. The goal of the work is to provide suitable models and reasoning methodologies to cope with the aforementioned aspects, and to properly integrate them for medical decision support. Achieving such a goal requires advances in data management, and, in particular, in the treatment of indeterminate valid-time data in relational databases, of temporal abstraction on time series, of case retrieval on time series, of design-time and run-time model-based verification of guidelines, of case-based reasoning, of non-monotonic logics, of formal ontologies, of probabilistic graphical models (Bayesian Networks and Influence Diagrams).

Supporting decision making in domains in which the observed phenomenon dynamics have to be dealt with, can greatly benefit of retrieval of past cases, provided that proper representation and retrieval techniques are implemented. In particular, when the parameters of interest take the form of time series, dimensionality reduction and flexible retrieval have to be addresses to this end. Classical methodological solutions proposed to cope with these issues, typically based on mathematical transforms, are characterized by strong limitations, such as a difficult interpretation of retrieval results for end users, reduced flexibility and interactivity, or inefficiency. In this paper, we describe a novel framework, in which time-series features are summarized by means of Temporal Abstractions, and then retrieved resorting to abstraction similarity. Our approach grants for interpretability of the output results, and understandability of the (user-guided) retrieval process. In particular, multilevel abstraction mechanisms and proper indexing techniques are provided, for flexible query issuing, and efficient and interactive query answering. Experimental results have shown the efficiency of our approach in a scalability test, and its superiority with respect to the use of a classical mathematical technique in flexibility, user friendliness, and also quality of results.

We address the problem of defining the behavior of an autonoumous FDIR (Fault Detection, Identification and Recovery) agent (e.g. a space rover), in presence of uncertainty and partial observability, we show how a Dynamic Decision Network (DDN) can be built through a fault analysis phase by producing an Extended Dynamic Fault Tree (EDFT). In this fault tree extension, several modeling features are introduced: a generalization of Boolean components to multi-state components, general stochastic dependencies among components, and finally external actions on the system as well as controllable actions triggered by the system itself. We discuss how EDFT can be adopted as a formal modeling language (familiar to reliability engineers), then compiled into a DDN for the FDIR analysis through standard inference algorithms.

CBR systems designers and developers' research can benefit from the availability of existing platforms, able to provide software design and implementation assistance. The JColibri platform, realized and maintained by the University of Madrid, is one of the most well known among such tools. In this work, we describe a couple of extensions we have provided to the core JColibri open source software. In particular, our extensions are meant to optimize case retrieval performances, in data-rich applications. Specifically, we focused our attention on treating (i) large case bases, in which retrieval time may become unacceptable, and (ii) cases with high-dimensional features - namely time series features - on which proper case representation and retrieval solutions need to be studied. The implemented code has been preliminarly tested, and it is now ready to be integrated with the JColibri code, and made available to the CBR research community. Additional extensions, always dealing with retrieval optimization, are foreseen as our future work.

In the hemodialysis domain, we are implementing a case‐based, closed‐loop architecture aimed at configuring temporal abstractions (TA), which will be applied to time series data. The advantage of a case‐based approach is the one of “quickly” obtaining a suitable TA parameter configuration, simply by looking at the most similar already configured case, where configured cases are indexed by means of contextual information. The retrieved configuration, together with the time series data, is then used as an input to a TA processing module, able to provide a set of qualitative states, trends, and significant combinations of both as an output. TA processing results can finally be evaluated, possibly leading to a (human‐supervized) reorganization/revision of the case base content, to ameliorate future TA configuration sessions—thus closing the loop. The work is being integrated with RHENE, a system for case‐based retrieval in hemodialysis, able to work both on raw time series data and on preprocessed (by means of TA) ones.

The aim of this paper is to formally introduce a fuzzy logic based notion of acceptance and similarity among case features, for case matching and retrieval. In particular, we present an approach where local acceptance relative to a feature can be expressed through fuzzy distributions on its domain, abstracting the actual values to linguistic terms. Furthermore, global acceptance is completely grounded on fuzzy logic, by means of the usual combinations of local distributions through specific defined norms. We propose a retrieval architecture, based on the above notions and implemented through a fuzzy extension of SQL.

This paper presents a software tool allowing the automatic analysis of a dynamic fault tree (DFT) exploiting its conversion to a dynamic Bayesian network (DBN). First, the architecture of the tool is described, together with the rules implemented in the tool, to convert dynamic gates in DBNs. Then, the tool is tested on a case of system: its DFT model and the corresponding DBN are provided and analyzed by means of the tool. The obtained unreliability results are compared with those returned by other tools, in order to verify their correctness.

In this work we propose a case-based architecture tackling the problem of configuring and processing temporal abstractions (trends and qualitative states) produced from raw time series data. The parameter configuration is a critical problem in many temporal abstraction processes; in several application domains (especially in medical ones), contextual knowledge plays a fundamental role in the time series interpretation. Since defining the right configuration for each possible contextual situation may be impractical, we propose to adopt a case-based approach, where the suitable configuration can be obtained by looking at the most similar already configured case, with respect to the current situation. Configured cases are indexed by means of contextual information. The obtained configuration can then be used as input to a temporal abstraction module, providing a set of qualitative states, trends and suitable combination of both as a result. Cases can then be exploited in the processing of such results as well, by providing an evaluation of the whole abstraction processing, possibly leading to the revision of the case base. The approach is illustrated by means of an example taken from a medical application, concerning the monitoring and evaluation of patients undergoing hemodialysis treatment

Time‐varying information embedded in cases has often been neglected and its role oversimplified in case‐based reasoning systems. In several real‐world problems, and in particular in medical applications, a case should capture the evolution of the observed phenomenon over time. To this end, we propose to represent temporal information at two levels: (1) at thecase level, when some features are collected in the form of time series, because they describe parameters varying within a period of time (which corresponds to the case duration), and we aim at analyzing the system behavior within the case duration interval itself; (2) at thehistory level, when we are interested in reconstructing the evolution of the system by retrieving temporally related cases. In this paper, we describe a framework for case representation and retrieval that is able to take into account the temporal dimension, and is meant to be used in any time dependent domain, which is particularly well suited for medical applications. To support case retrieval, we provide an analysis of similarity‐based time series retrieval techniques; to support history retrieval, we introduce possible ways to summarize the case content, together with the corresponding strategies for identifying similar instances in the knowledge base. A concrete application of our framework is represented byRhene, a system for intelligent retrieval in the hemodialysis domain.

In order to cope efficiently with the dependability analysis of redundant systems with replicated units, a new, more compact fault-tree formalism, called Parametric Fault Tree (PFT), is defined. In a PFT formalism, replicated units are folded and indexed so that only one representative of the similar replicas is included in the model. From the PFT, a list of parametric cut sets can be derived, where only the relevant patterns leading to the system failure are evidenced regardless of the actual identity of the component in the cut set. The paper provides an algorithm to convert a PFT into a class of High-Level Petri Nets, called SWN. The purpose of this conversion is twofold: to exploit the modeling power and flexibility of the SWN formalism, allowing the analyst to include statistical dependencies that could not have been accommodated into the corresponding PFT and to exploit the capability of the SWN formalism to generate a lumped Markov chain, thus alleviating the state explosion problem. The search for the minimal cut sets (qualitative analysis) can be often performed by a structural T-invariant analysis on the generated SWN. The advantages that can be obtained from the translation of a PFT into a SWN are investigated considering a fault-tolerant multiprocessor system example.

The definition of suitable case‐base maintenance policies is widely recognized as a major key to success for case‐based systems; underestimating this issue may lead to systems that either do not fulfill their role of knowledge management and preservation or that do not perform adequately under performance dimensions, namely, computation time and competence and quality of solutions. The goal of this article is to analyze some automatic case‐base management strategies in the context of a multimodal architecture combining case‐based reasoning and model‐based reasoning. We propose and compare two different methodologies, the first one, called replace, is a competence‐based strategy aimed at replacing a set of stored cases with the current one, if the latter exhibits an estimated competence comparable with the estimated competence of the considered set of stored cases. The second one, called learning by failure with forgetting (LFF), is based on incremental learning of cases interleaved with off‐line processes of forgetting (deleting) cases whose usage does not fulfill specific utility conditions. Results from an extensive experimental analysis in an industrial plant diagnosis domain are reported, showing the usefulness of both strategies with respect to the maintenance of suitable performance levels for the target system.

Some of the most popular approaches to model-based diagnosis consist of reasoning about a model of the behaviour of the system to be diagnosed by considering a set of observations about such a system and by explaining it in terms of a set of initial causes. This process has been widely modeled via logical formalisms essentially taking into account declarative aspects. In this paper, a new approach is proposed, where the diagnostic process is captured within a framework based on the formalism of Petri nets. We introduce a particular net model, called Behavioral Petri Net (BPN), We show how the formalization of the diagnostic process can be obtained in terms of reachability in a BPN and can be implemented by exploiting classical analysis techniques of Petri nets like reachability graph analysis and P-invariant computation. Advantages of the proposed methods, like suitability to parallel processing and exploitation of linear algebra techniques, are then pointed out.

Several artificial intelligence architectures and systems based on "deep" models of a domain have been proposed, in particular for the diagnostic task. These systems have several advantages over traditional knowledge based systems, but they have a main limitation in their computational complexity. One of the ways to face this problem is to rely on a knowledge compilation phase, which produces knowledge that can be used more effectively with respect to the original one. We show how a specific knowledge compilation approach can focus reasoning in abductive diagnosis, and, in particular, can improve the performances of AID, an abductive diagnosis system. The approach aims at focusing the overall diagnostic cycle in two interdependent ways: avoiding the generation of candidate solutions to be discarded a posteriori and integrating the generation of candidate solutions with discrimination among different candidates. Knowledge compilation is used off-line to produce operational (i.e., easily evaluated) conditions that embed the abductive reasoning strategy and are used in addition to the original model, with the goal of ruling out parts of the search space or focusing on parts of it. The conditions are useful to solve most cases using less time for computing the same solutions, yet preserving all the power of the model-based system for dealing with multiple faults and explaining the solutions. Experimental results showing the advantages of the approach are presented.

Many different approaches, mainly based on logical formalisms, have been proposed for modeling causal knowledge and the inferential mechanisms based on this type of knowledge. In this article we present an alternative approach to this problem in which the semantics of a causal model is provided by adopting Petri nets. We show how this scheme of modeling is powerful enough to capture all crucial aspects of the corresponding causal model, without resorting to very complex structures; indeed, the model is obtained using a particular type of deterministic Petri net. Moreover, a complete formalization of the aspects concerning the correctness of the represented causal model is provided in terms of reachability in the Petri net. We believe that this aspect is very important in the knowledge acquisition phase when precise correctness criteria should be defined and respected in the construction of the model. We analyze some of these criteria and we discuss an algorithm (based on a backward simulation of the net) capable of discovering incorrectness by exploiting analysis tools available for Petri nets and the explicit parallelism of the model. © 1992 John Wiley & Sons, Inc.