This work stems on the idea that timed automata models and model-checking techniques may bring much in a decision-aid context when dealing with large and interacting qualitative models. In this paper, we focus on two key issues when facing the interpretation and explanation of behavior in real-world systems: the model building and its exploration using logic patterns. We illustrate this approach in the ecological domain with the modeling and exploration of a fisheries ecosystem.

The paper addresses the problem of maintaining the quality of service (QoS) of an orchestration of Web services (WS), which can be affected by exogenous events (i.e., faults). The main challenge in dealing with this problem is that typically the service where a failure is detected is not the one where a fault has occurred: faults have cascade effects on the whole orchestration of services. The paper presents a novel methodology to treat the problem that is not based on Web service (re)composition, but on an adaptive re-execution of the original orchestration. Specifically, an orchestrator Manager exploits an abstract representation of the whole orchestration and a diagnostic module to localize the source of the detected failure. Then, the Manager drives the re-execution of the orchestration by deciding which service activities can be skipped, and which others must be re-executed.

Detection of web attacks is an important issue in current defense-in-depth security framework. In this paper, we propose a novel general framework for adaptive and online detection of web attacks. The general framework can be based on any online clustering methods. A detection model based on the framework is able to learn online and deal with "concept drift" in web audit data streams. Str-DBSCAN that we extended DBSCAN to streaming data as well as StrAP are both used to validate the framework. The detection model based on the framework automatically labels the web audit data and adapts to normal behavior changes while identifies attacks through dynamical clustering of the streaming data. A very large size of real HTTP Log data collected in our institute is used to validate the framework and the model. The preliminary testing results demonstrated its effectiveness.

We define an inference system to capture explanations based on causal statements, using an ontology in the form of an IS-A hierarchy. We introduce a simple logical language which makes it possible to express that a fact causes another fact and that a fact explains another fact. We present a set of formal inference patterns from causal statements to explanation statements. We introduce an elementary ontology which gives greater expressiveness to the system while staying close to propositional reasoning. We provide an inference system that captures the patterns discussed, in a datalog (limited predicate) framework.

Monitoring patients in intensive care units is a critical task. Simple condition detection is generally insufficient to diagnose a patient and may generate many false alarms to the clinician operator. Deeper knowledge is needed to discriminate among alarms those that necessitate urgent therapeutic action. We propose an intelligent monitoring system that makes use of many artificial intelligence techniques: artificial neural networks for temporal abstraction, temporal reasoning, model based diagnosis, decision rule based system for adaptivity and machine learning for knowledge acquisition. To tackle the difficulty of taking context change into account, we introduce a pilot aiming at adapting the system behavior by reconfiguring or tuning the parameters of the system modules. A prototype has been implemented and is currently experimented and evaluated. Some results, showing the benefits of the approach, are given.

Real-life complex systems are often required to offer high reliability and quality of service and must be provided with self-management abilities, even in faulty situations. They are expected to be self-aware of their current state and survive autonomously the occurrence of faults, still managing to provide the desired functionality. In other words, such systems must be self-healing [2]. Designing self-healing systems requires to be able to evaluate the joint degree of self-awareness and reactiveness. In the artificial intelligence community, these two properties are better known as diagnosability [3, 1], i.e. the capability of a system to exhibit different observables for different anticipated faulty situations, and repairability, i.e. the ability of a system and its repair actions to cope with any unexpected situation. Checking separately diagnosability and repairability leads to a conservative assessement of self-healability. In this paper, we show that neither standard diagnosability nor repairability of every anticipated fault are necessary to achieve self-healability. Our main contribution consists of defining self-healability as a joint property bridging diagnosability and repairability, which requires a new definition of diagnosability that allows diagnosable subsets of faults to overlap, as opposed to the standard definitions which rely on a partition.

The formalism of chronicles has been proposed to monitor and diagnose dynamic physical systems. Even if efficient chronicle recognition algorithms exist, it is now well-known that distributed approaches are better suited to monitor real systems. In this article, we adapt the chronicle-based approach to a distributed context and illustrate this work on the monitoring of software components.

Two distinct and parallel research communities have been working along the lines of the model-based diagnosis approach: the fault detection and isolation (FDI) community and the diagnostic (DX) community that have evolved in the fields of automatic control and artificial intelligence, respectively. This paper clarifies and links the concepts and assumptions that underlie the FDI analytical redundancy approach and the DX consistency-based logical approach. A formal framework is proposed in order to compare the two approaches and the theoretical proof of their equivalence together with the necessary and sufficient conditions is provided.

We address the problem of diagnosing complex discrete-event systems such as telecommunication networks. Given a flow of observations from the system, the goal is to explain those observations by identifying and localizing possible faults. Several model-based diagnosis approaches deal with this problem but they need the computation of a global model which is not feasible for complex systems like telecommunication networks. Our contribution is the proposal of a decentralized approach which permits to carry out an on-line diagnosis without computing the global model. This paper describes the implementation of a tool based on this approach. Given a decentralized model of the system and a flow of observations, the program analyzes the flow and computes the diagnosis in a decentralized way. We also present experimental results based on a real system.

Knowledge base validation and knowledge base refinement aim to help the expert to improve an existing knowledge base. They deal with the final knowledge acquisition phase and rely on a quality measurement of an existing knowledge base. We present our approach to knowledge base refinement, which is based on results in the domain of knowledge base validation. Our approach is based on a general consistency definition of a knowledge base and on a study of causes of knowledge base inconsistency. Our approach relies significantly on a differentiation of sure and expert knowledge in the knowledge base. We have implemented a system that has two phases: one computational phase decides on the consistency of a knowledge base, and, if necessary, a second phase helps the expert to interactively update the knowledge base. We present some related work in the domain. We illustrate the use of our system with an example.

Revision can be seen as any operation which turns a cognitive state CSt into a subsequent cognitive state CSt'. Two kinds of change can be considered: in the “belief change” case, the cognitive states represent beliefs on a world; they are revised in response to the getting of new information about a static world. In the “world change” case, the cognitive states represent known facts on a real world; they are revised in response to change in this dynamic world. We focus in the following on world change case and propose a way to keep up to date with a dynamic world. Reasoning about change requires predicting how the world will change along time. In absence of a predictive model of evolution, the commonsense law of inertia has been currently used and justifies the minimal change approach to the frame problem. We propose here to use an explicit transition model, which will be used as a predictive evolution model. Dean and Kanazawa propose to use a probabilistic model of persistence and causation. We propose in this paper to use a symbolic model of transition by directly encoding expectations. In the first two sections, we describe the formalism that we propose to explicitly encode the transition model and its axiomatisation. We give then a formal definition of the revision operation using a transition model and discuss what can be a contraction operation in the context of world change. an illustrative example is presented and in the last section, our approach is compared to other related works. © 1994 John Wiley & Sons, Inc.