Many systems exist without us knowing structural system models and require us to discover structural system models from system data. A major shortcoming of current statistical modeling and data mining techniques is their focus on building relations of variables that hold for all values of variables. This paper presents the new partial-value association discovery (PVAD) algorithm to discover relations of variables that may exist for only certain values or different value ranges of variables and to use these partial-value variable relations for constructing structural system models. The PVAD algorithm along with its performance and computational complexity is presented.

The rapid adoption of service-oriented architecture (SOA) in many large-scale distributed applications requires the development of adaptive service-based software systems (ASBS) with the capability of monitoring the changing system status, analyzing, and controlling tradeoffs among various quality-of-service (QoS) aspects, and adapting service configurations to satisfy multiple QoS requirements simultaneously. In this paper, our results toward the development of adaptive service-based software systems are presented. The formulation of activity-state-QoS (ASQ) models and how to use the data from controlled experiments to establish ASQ models for capturing the cause-effect dynamics among service activities, system resource states, and QoS in service-based systems are presented. Then, QoS monitoring modules based on ASQ models and SOA-compliant simulation models are developed to support the validation of the ASBS design. The main idea for developing QoS adaptation modules based on ASQ models is discussed. An experiment based on a voice communication service is used to illustrate our results.

We consider the problem of scheduling independent jobs on identical parallel machines so as to minimize the waiting time variance of the jobs (Pm//WTV). We show that the optimal value of(Pm//WTV) is identical to the optimal value of the problem for minimizing the completion time variance of jobs on identical parallel machines(Pm//WTV). We prove that, given the same job set, any feasible schedule of (Pm//WTV) can be transformed into the feasible solution for (Pm//WTV) with the same job set by applying the polynomial algorithms proposed in this paper. Several other important properties of (Pm//WTV) are also proved. Heuristic algorithms are proposed to solve (Pm//WTV) problems. We present the testing results of these heuristic algorithms, which are applied to problems with both small and large job sets.

This paper presents a data mining algorithm based on supervised clustering to learn data patterns and use these patterns for data classification. This algorithm enables a scalable incremental learning of patterns from data with both numeric and nominal variables. Two different methods of combining numeric and nominal variables in calculating the distance between clusters are investigated. In one method, separate distance measures are calculated for numeric and nominal variables, respectively, and are then combined into an overall distance measure. In another method, nominal variables are converted into numeric variables, and then a distance measure is calculated using all variables. We analyze the computational complexity, and thus, the scalability, of the algorithm, and test its performance on a number of data sets from various application domains. The prediction accuracy and reliability of the algorithm are analyzed, tested, and compared with those of several other data mining algorithms.

Intrusions into computer systems have caused many quality/reliability problems. Detecting intrusions is an important part of assuring the quality/reliability of computer systems by quickly detecting intrusions and associated quality/reliability problems in order to take corrective actions. In this paper, we present and compare two methods of forecasting normal activities in computer systems for intrusion detection. One forecasting method uses the average of long-term normal activities as the forecast. Another forecasting method uses the EWMA (exponentially weighted moving average) one-step-ahead forecast. We use a Markov chain model to learn and predict normal activities used in the EWMA forecasting method. A forecast of normal activities is used to detect a large deviation of the observed activities from the forecast as a possible intrusion into computer systems. A Chi square distance metric is used to measure the deviation of the observed activities from the forecast of normal activities. The two forecasting methods are tested on computer audit data of normal and intrusive activities for intrusion detection. The results indicate that the Chi square distance measure with the EWMA forecasting provides better performance in intrusion detection than that with the average-based forecasting method.

Cyber-attack detection is used to identify cyber-attacks while they are acting on a computer and network system to compromise the security (e.g., availability, integrity, and confidentiality) of the system. This paper presents a cyber-attack detection technique through anomaly-detection, and discusses the robustness of the modeling technique employed. In this technique, a Markov-chain model represents a profile of computer-event transitions in a normal/usual operating condition of a computer and network system (a norm profile). The Markov-chain model of the norm profile is generated from historic data of the system's normal activities. The observed activities of the system are analyzed to infer the probability that the Markov-chain model of the norm profile supports the observed activities. The lower probability the observed activities receive from the Markov-chain model of the norm profile, the more likely the observed activities are anomalies resulting from cyber-attacks, and vice versa. This paper presents the learning and inference algorithms of this anomaly-detection technique based on the Markov-chain model of a norm profile, and examines its performance using the audit data of UNIX-based host machines with the Solaris operating system. The robustness of the Markov-chain model for cyber-attack detection is presented through discussions & applications. To apply the Markov-chain technique and other stochastic process techniques to model the sequential ordering of events, the quality of activity-data plays an important role in the performance of intrusion detection. The Markov-chain technique is not robust to noise in the data (the mixture level of normal activities and intrusive activities). The Markov-chain technique produces desirable performance only at a low noise level. This study also shows that the performance of the Markov-chain techniques is not always robust to the window size: as the window size increases, the amount of noise in the window also generally increases. Overall, this study provides some support for the idea that the Markov-chain technique might not be as robust as the other intrusion-detection methods such as the chi-square distance test technique , although it can produce better performance than the chi-square distance test technique when the noise level of the data is low, such as the Mill & Pascal data in this study.

Reliability and quality of service from information systems has been threatened by cyber intrusions. To protect information systems from intrusions and thus assure reliability and quality of service, it is highly desirable to develop techniques that detect intrusions. Many intrusions manifest in anomalous changes in intensity of events occurring in information systems. In this study, we apply, test, and compare two EWMA techniques to detect anomalous changes in event intensity for intrusion detection: EWMA for autocorrelated data and EWMA for uncorrelated data. Different parameter settings and their effects on performance of these EWMA techniques are also investigated to provide guidelines for practical use of these techniques.

Intrusion detection complements prevention mechanisms, such as firewalls, cryptography, and authentication, to capture intrusions into an information system while they are acting on the information system. Our study investigates a multivariate quality control technique to detect intrusions by building a long-term profile of normal activities in information systems (norm profile) and using the norm profile to detect anomalies. The multivariate quality control technique is based on Hotelling's T/sup 2/ test that detects both counterrelationship anomalies and mean-shift anomalies. The performance of the Hotelling's T/sup 2/ test is examined on two sets of computer audit data: a small data set and a large multiday data set. Both data sets contain sessions of normal and intrusive activities. For the small data set, the Hotelling's T/sup 2/ test signals all the intrusion sessions and produces no false alarms for the normal sessions. For the large data set, the Hotelling's T/sup 2/ test signals 92 percent of the intrusion sessions while producing no false alarms for the normal sessions. The performance of the Hotelling's T/sup 2/ test is also compared with the performance of a more scalable multivariate technique-a chi-squared distance test.

Intrusions exploit vulnerabilities and introduce external disturbances into information systems to compromise security attributes of information systems such as availability, integrity, and confidentiality. Intrusions into information systems cause faults of software and hardware components in information systems, which then lead to errors and failures of system performance. Intrusion tolerance requires information systems to function correctly in a timely manner even under impact of intrusions. In this paper, we discuss causes, chain effects and barriers of intrusions into information systems, and reveal roles that various information security techniques play in intrusion tolerance. We present two robust intrusion tolerance methods through fault masking: Taguchi’s robust method for system configuration and sharing of resources via an information infrastructure for redundancy.

This paper presents a series of studies on probabilistic properties of activity data in an information system for detecting intrusions into the information system. Various probabilistic techniques of intrusion detection, including decision tree, Hotelling's T/sup 2/ test, chi-square multivariate test, and Markov chain are applied to the same training set and the same testing set of computer audit data for investigating the frequency property and the ordering property of computer audit data. The results of these studies provide answers to several questions concerning which properties are critical to intrusion detection. First, our studies show that the frequency property of multiple audit event types in a sequence of events is necessary for intrusion detection. A single audit event at a given time is not sufficient for intrusion detection. Second, the ordering property of multiple audit events provides additional advantage to the frequency property for intrusion detection. However, unless the scalability problem of complex data models taking into account the ordering property of activity data is solved, intrusion detection techniques based on the frequency property provide a viable solution that produces good intrusion detection performance with low computational overhead.

A military air operations plan contains a number of sequential and/or parallel tasks. Given information about the battlefield situation (including a task status estimate) during the plan's execution, it is necessary to assess the situation impact on the plan, especially whether the entire plan would be delayed. Plan performance assessment fuses the task status estimate into the status estimate of the entire plan. The plan performance assessment assists the air operations commander in deciding the need for plan modification to assure the air operations goal. The performance assessment of the plan must deal with uncertainty in the task status estimate. This paper presents a comparative study of two information fusion techniques that infer the entire plan's status estimate from the task status estimate under uncertainty: a decomposition technique with low computational cost and a composition technique with high computational cost. The test results of these two techniques indicate their similar estimation accuracies. Due to its low computational cost, the decomposition technique is recommended. Guidelines for applying the decomposition technique to a large-scale complex task plan are also provided.

Presents an experiment that investigated the potential benefits of virtual reality (VR) environments in supporting assembly planning. In the experiment, 15 subjects performed an assembly planning task in three different conditions: a traditional engineering (TE) environment, a nonimmersive desktop VR (DVR) environment, and an immersive CAVE (Cave Automatic Virtual Environment) VR (CVR) environment. The effects of the three conditions on the subjects' performance were analyzed. The subjects' performance time in the TE condition was significantly longer than that in the DVR condition and that in the CVR condition, whereas the difference in performance time between the DVR condition and the CVR condition was not significant. The total number of problematic assembly steps in the TE condition was significantly greater than that in the CVR condition. Specifically, the subjects' assembly sequences in the TE condition involved more reorientations than in the DVR condition. The number of difficult assembly steps in the TE condition was significantly greater than that in the DVR condition, which was significantly greater than that in the CVR condition. The number of dissimilar assembly steps in the TE condition was significantly greater than that in the CVR condition, which was significantly greater than that in the DVR condition. Hence, the results revealed advantages of the two VR environments over the TE environment in improving the subjects' overall assembly planning performance and in minimizing the handling difficulty, excessive reorientation and dissimilarity of assembly operations.

Knowledge representation is one of important factors that determine human performance on cognitive tasks. Due to different levels of experience, different groups of people may develop different knowledge representations which lead to different levels of performance on cognitive tasks. If knowledge representation differences exist between skill groups such as experts and novices, those differences can be used to guide the training of novices for skill acquisition, and to assist the design of jobs and tools for performance enhancement. A technique is presented in this paper for assessing knowledge representation differences between skill groups, based on multidimensional scaling (MDS) of dissimilarity data and analysis of angular variance (ANAVA). The MDS-ANAVA technique was applied to two sets of dissimilarity data that were obtained from ten experts and ten novices in the computer domain, one set concerning 23 concepts in C computer programming, and another set concerning 21 concepts in the UNIX operating system. Knowledge representation differences from the MDS-ANAVA technique are compared with those from the hierarchical clustering technique. The MDS-ANAVA technique shows several advantages to the hierarchical clustering technique in testing the statistical significance of knowledge representation differences between skill groups and revealing features underlying knowledge representations of skill groups.

The automatic format-setting of journal articles for reducing the workload of computer users involves two processes: automatic acquisition of article format and automatic recall of article formal. Several neural networks have been explored to implement the two processes. The advantages and disadvantages of these neural networks are evaluated in comparison with capabilities of conventional computer programs. A heteroassociative back-propagation network has been developed for the automatic acquisition process. This network excels over computer programs because of its abilities in learning and generalizing implicit knowledge from examples. A bidirectional associative memory network, a Boltzman network, and an autoassociative back-propagation network have been investigated for the automatic recall process. None of them excel over computer programs in terms of recall accuracy.

An experiment was conducted to examine skill differences in the control strategy for computer program comprehension. A computer program along with its hierarchy of program plans was provided to 10 intermediate and 10 novice computer programmers. Each program plan is known as a program segment to the subjects. A random list of plan goals was also provided to the subjects. The subjects were asked to match each program segment with its goal while they were comprehending the program. Several measures of the subjects' performance and control strategy were collected and analysed. The results indicated the use of an overall top-down strategy by both intermediates and novices for program comprehension. Novices' control strategies involved more opportunistic elements than experts' in the overall top-down process of program comprehension. Those differences in the control strategy between intermediates and novices result in better performance in intermediates than novices.

An experiment was conducted to investigate the main and interaction effects of screen distances (600 mm and 900 mm), screen letter heights (for visual angles of 16, 20, and 30 minutes of arc), and source document distances (same as the screen distance and closer than the screen distance) on visual performance and subjective preference in text proofreading tasks. Thirty subjects in different age groups participated in the experiment. The experimental results revealed that the subjects' performance improved from the letter height of 16 minutes of arc to the letter height of 20 minutes of arc for the 600 mm screen distance, but from 20 minutes of arc to 16 minutes of arc for the 900 mm screen distance. The subjects generally preferred a screen distance slightly higher than 600 mm, a letter height at the 22 minutes of arc, and a small difference between the visual angle of screen letters and the visual angle of source letters.

System fault diagnosis is often performed by humans using fault diagnosis knowledge such as fault trees and system state information. An experiment was conducted to investigate how various forms of presenting fault trees and system state information affect human performance and preference during fault diagnosis. Three knowledge presentations (a semantic network, a schema-based semantic network, and production rules) and four state-information presentations (direct manipulation, menus, fill-in-forms, commands) were examined in the experiment; 30 subjects participated. The results of the experiment indicated that knowledge presentation by the semantic network yielded better subject performance of fault diagnosis. In addition, direct manipulation was the most favorite form of state information presentation to the subjects. The s-significant interaction between the knowledge presentations and the state information presentations in terms of subject preference was also found.

This study investigated quantitative and qualitative differences between experts and novices in knowledge structure, specifically in their chunking of computer software knowledge. An experiment was conducted to collect pairwise relatedness ratings of 23 concepts in C computer programming from 10 experts and 10 novices. Correlation analyses of relatedness ratings were performed to examine expert‐novice differences in overall knowledge structure. The intragroup correlation coefficients of experts were greater than the intragroup correlation coefficients of novices and the intergroup correlation coefficients between experts and novices. Hence, there existed structural differences of knowledge between experts and novices. To examine how experts differ from novices quantitatively and qualitatively in their knowledge chunking, the relatedness ratings of experts were averaged within the group to give a single set of relatedness ratings, and the relatedness ratings of novices were also averaged within the group to give a single set of relatedness ratings. Then the hierarchical clustering analyses were performed on the set of relatedness ratings for the experts group and on the set of relatedness ratings for the novices group, respectively. The hierarchical clustering of C concepts made by experts and the hierarchical clustering of C concepts made by novices indicated that novices had more but smaller knowledge chunks than experts for the common set of knowledge, and thatthe rough chunking of knowledge made by novices was qualitatively similar to the rough chunking of knowledge made by experts, although on a more detailed level qualitative differences still existed.