We propose a method to enable Large Language Models to access Knowledge Graph (KG) data and justify their text generation by showing the specific graph data the model accessed during inference. For this, we combine Language Models with methods from Neurosymbolic Artificial Intelligence designed to answer queries on Knowledge Graphs. This is done by modifying the model so that at different stages of inference it outputs an Existential Positive First-Order (EPFO) query, which is then processed by an additional query appendix. In turn, the query appendix uses neural link predictors along with description aware embeddings to resolve these queries. After that, the queries are logged and used as an explanation of the inference process of the complete model. Lastly, we train the model using a Linear Temporal Logic (LTL) constraint-based loss function to measure the consistency of the queries among each other and with the final model output.

Abstract Reconstruction‐based one‐class classification has shown to be very effective in a number of domains. This approach works by attempting to capture the underlying structure of the normal class, typically, by means of clusters of objects. It has the main disadvantage, however, that one has to indicate the number of clusters in advance, for this yields an efficient way of computing a clustering. In this paper, we introduce a new algorithm, OCKRA++, which achieves a better performance, by enhancing a clustering‐based one‐class ensemble classifier (OCKRA) with a cluster validity index that is used to set the best number of clusters during the classifier's training process. We have thoroughly tested OCKRA++ in a particular domain, namely masquerade detection. For this purpose, we have used the Windows‐Users and ‐Intruder simulation Logs data set repository, which contains 70 different masquerade data sets. We have found that OCKRA++ is currently the algorithm that achieves the best area under the curve, with a significant difference, in masquerade detection using the file system navigation approach.

Latent palmprint identification is a crucial element for both law enforcement and integrated automated fingerprint identification systems because approximately 30% of the imprints found in a crime scene originate from a human’s palms. To find the person whom the palmprint belongs to, forensic experts use systems that automatically compare the imprints found, called latent, against thousands of potential palmprints. Identification systems rely on features obtained from the palmprint, and different feature representations to include discriminative information. However, there is no consensus as to which representation allows for a better matching between latent palmprints, and those with a known identity. Furthermore, evaluating the identification performance when matching palmprints obtained when using different representations has not been done fairly. The current manner of evaluating palmprint identification methods uses different datasets, performance measures, and does not allow to discern the contributions of the feature representation and the methods for matching the palmprints. In this study, we have reviewed those features used for latent palmprint identification, and also we propose an evaluation methodology that allows for a fair comparison of minutiae-based features. Using our methodology, we evaluated each representation performing more than 5 billion comparisons. Our experiments are done using a dataset that includes information about the matching minutiae according to an expert. We aim with our results to provide a baseline for new research in latent palmprint identification feature representations, allowing for a fair comparison of newly developed representations in the future, which would enhance the whole latent palmprint identification methods. For this purpose, we also publicly provide our dataset, methodology implementation, and the feature representations implementation tested in our experiments.

People often face risk-prone situations, that range from a mild event to a severe, life-threatening scenario. Risk situations stem from a number of different scenarios: a health condition, a hazard situation due to a natural disaster, a dangerous situation because one is being subject to a crime or physical violence, among others. The lack of a prompt response, calling for assistance, may severely worsen the consequences. In this paper, we propose a novel visualisation method to track and to identify, in real-time, when a person is under a risk-prone situation. Our visualisation model is capable of providing a decision maker a visual description of the physiological behaviour of an individual, or a group thereof; through it, the decision maker may infer whether further assistance is required, if a risky situation is in progress. Our visualisation is leveraged with a traffic light model of a one-class classifier. This combination allows us to train the decision maker into visualising correct and potential risky or abnormal behaviour.

We define personal risk detection as the timely identification of when someone is in the midst of a dangerous situation, for example, a health crisis or a car accident, events that may jeopardize a person’s physical integrity. We work under the hypothesis that a risk-prone situation produces sudden and significant deviations in standard physiological and behavioural user patterns. These changes can be captured by a group of sensors, such as the accelerometer, gyroscope, and heart rate. We introduce a dataset, called PRIDE, which provides a baseline for the development and the fair comparison of personal risk detection mechanisms. PRIDE contains information on 18 test subjects; for each subject, it includes partial information about the user’s behavioural and physiological patterns, as captured by Microsoft Band©. PRIDE test subject records include sensor readings of not only when a subject is carrying out ordinary daily life activities, but also when exposed to a stressful scenario, thereby simulating a dangerous or abnormal situation. We show how to use PRIDE to develop a personal risk detection mechanism; to accomplish this, we have tackled risk detection as a one-class classification problem. We have trained several classifiers based only on the daily behaviour of test subjects. Further, we tested the accuracy of the classifiers to detect anomalies that were not included in the training process of the classifiers. We used a number of one-class classifiers, namely: SVM, Parzen, and two versions of Parzen based on k-means. While there is still room for improvement, our results are encouraging: they support our hypothesis that abnormal behaviour can be automatically detected.

Most studies in masquerade detection focus mainly on the user action, ignoring the object upon which that action is performed. This may yield limited models, since, for example, command execution (an action) usually ends up in the transformation of a file (the object). The overall goal of this paper is to prove that the object is paramount to distinguishing a user from a masquerade. With this in mind, we have developed a new approach to masquerade detection, called file system navigation, and tested our ideas using the Windows-Users and Windows-Intruder simulations Logs Data set, (WUIL) which unlike other datasets of its kind includes close-to-real simulated attacks. We have shown that our approach makes it possible to capture computer behavior in an abstract way difficult to realize in a purely action-based approach. In this paper, we introduce an abstraction called locality, the tendency of programs to cluster references to memory. While temporal locality is applicable to both actions and objects, spatial locality is more suitable to objects, as it depends on a notion of position. We have successfully validated our working hypothesis: locality-based features better capture user behavior for masquerade detection. Particularly, results based on our approach report an Area Under the Curve (AUC) of the receiver operating characteristic curve value of 0.97 in average with 30% of users having an AUC equal to or above 0.99.

Upon an intrusion, security staff must analyze the IT system that has been compromised, in order to determine how the attacker gained access to it, and what he did afterward. Usually, this analysis reveals that the attacker has run an exploit that takes advantage of a system vulnerability. Pinpointing, in a given log file, the execution of one such an exploit, if any, is very valuable for computer security. This is both because it speeds up the process of gathering evidence of the intrusion, and because it helps taking measures to prevent a further intrusion, e.g., by building and applying an appropriate attack signature for intrusion detection system maintenance. This problem, which we call postmortem intrusion detection, is fairly complex, given both the overwhelming length of a standard log file, and the difficulty of identifying exactly where the intrusion has occurred. In this paper, we propose a novel approach for postmortem intrusion detection, which factors out repetitive behavior, thus, speeding up the process of locating the execution of an exploit, if any. Central to our intrusion detection mechanism is a classifier, which separates abnormal behavior from normal one. This classifier is built upon a method that combines a hidden Markov model withk-means. Our experimental results establish that our method is able to spot the execution of an exploit, with a cumulative detection rate of over 90%. In addition, we propose an entropy-based approach that speeds up the construction of a profile for ordinary system behavior.

This paper is concerned with determining whether a mobile robot, called the pursuer, is up to maintaining visibility of an antagonist agent, called the evader. This problem, a variant of pursuit-evasion, has been largely studied, following a systematic treatment by increasingly relaxing a number of restrictions. In, we considered a scenario where the pursuer and the evader move at bound speed, traveling around a known, 2D environment, which contains obstacles. Then, considering that, in an attempt to escape, the evader travels the shortest path to reach a potential escape region, we provided a decision procedure that determines whether or not the pursuer is up to maintain visibility of the evader and obtained complexity measures of this surveillance task. In this paper, we prove that there are cases for which an evader may escape only if it does not travel the shortest path to an escapable region. We introduce planning strategies for the movement of the pursuer that keeps track of the evader, even if the evader chooses not to travel the shortest path to an escape region. We also present a sufficient condition for the evader to escape that does not depend on the initial positions of the players. It can be verified only using the environment. All our algorithms have been implemented and we show simulation results.

In this paper we consider the problem of maintaining visibility of a moving evader by a mobile robot, the pursuer, in an environment with obstacles. We simultaneously consider bounded speed for both players and a variable distance separating them. Unlike our previous efforts [R. Murrieta-Cid et al., 2007], we give special attention to the combinatorial problem that arises when searching for a solution through visiting several locations. We approach evader tracking by decomposing the environment into convex regions. We define two graphs: one is called the mutual visibility graph (MVG) and the other the accessibility graph (AG). The MVG provides a sufficient condition to maintain visibility of the evader while the AG defines possible regions to which either the pursuer or the evader may go to. The problem is framed as a non cooperative game. We establish the existence of a solution, based on a k- Min approach, for the following givens: the environment, the initial state of the evader and the pursuer, including their maximal speeds. We show that the problem of finding a solution to this game is NP-complete.

The synthesis of programs, as well as other synthetic tasks, often ends up with an unprovable, partially false conjecture. A successful subsequent synthesis attempt depends on determining why the conjecture is faulty and how it can be corrected. Hence, it is highly desirable to have an automated means for detecting and correcting fault conjectures. We introduce a method for patching faulty conjectures. The method is based on abduction and performs its task during an attempt to prove a given conjecture. On input /spl forall/X.G(X), the method builds a definition for a corrective predicate, P(X), such that /spl forall/X.P(X)/spl rarr/G(X) is a theorem. The synthesis of a corrective predicate is guided by the constructive principle of "formulae as types", relating inference to computation. We take the construction of a corrective predicate as a program transformation task. The method consists of a collection of construction commands. A construction command is a small program that makes use of one or more program editing commands, geared towards building recursive, equational procedures. A synthesised corrective predicate is guaranteed to be correct, turning a faulty conjecture into a theorem. If conditional, it will be well-defined. If recursive, it will also be terminating.

Most efforts to automate the formal verification of communicating systems have centred around finite-state systems (FSSs). However, FSSs are incapable of modelling many practical communicating systems, and hence there is interest in a novel class of problems, which we call VIPSs (Value-passing Infinite-state Parameterised Systems). Existing approaches using model checking over FSSs are insufficient for VIPSs, due to their inability both to reason with and about domain-specific theories, and to cope with systems having an unbounded or arbitrary state space. We use the Calculus of Communicating Systems (CCS) with parameterised constants to express and specify VIPSs. We use the laws of CCS to conduct the verification task. This approach allows us to study communicating systems, regardless of their state space, and the data such systems communicate. Automating theorem proving in this system is an extremely difficult task. We provide automated methods for CCS analysis; they are applicable to both FSSs and VIPSs. Adding these methods to the Clam proof-planner, we have implemented an automated theorem prover that is capable of dealing with problems outside the scope of current methods. This paper describes these methods, gives an account as to why they work and provides a short summary of experimental results.