AI is currently in the midst of a boom, mostly due to the success and predominance of large language models and associated models for other perceptual tasks such as computer vision. Yet AI has experienced several booms and busts over the past 75 years. While the booms are driven by commercial potential, the following busts affect not only commercial investment but also research funding and trends. This paper examines the expert systems boom of the 1980s and the following AI winter, identifies similarities, analogs, and differences with the current boom, and projects potential outcomes and directions for AI research that may follow when the current enthusiasm wanes based on these similarities, analogs, and differences. The presentation is distinct from currently active discussions and debates about the potential and limitations of large models such as whether problems such as hallucination will be solved, whether they can reason, or whether they will achieve AGI; rather, it examines previous AI techniques and how they evolved once their capabilities and limitations became well understood.

This paper reports on methods and results of an applied research project by a team consisting of SAIC and four universities to develop, integrate, and evaluate new approaches to detect the weak signals characteristic of insider threats on organizations' information systems. Our system combines structural and semantic information from a real corporate database of monitored activity on their users' computers to detect independently developed red team inserts of malicious insider activities. We have developed and applied multiple algorithms for anomaly detection based on suspected scenarios of malicious insider behavior, indicators of unusual activities, high-dimensional statistical patterns, temporal sequences, and normal graph evolution. Algorithms and representations for dynamic graph processing provide the ability to scale as needed for enterprise-level deployments on real-time data streams. We have also developed a visual language for specifying combinations of features, baselines, peer groups, time periods, and algorithms to detect anomalies suggestive of instances of insider threat behavior. We defined over 100 data features in seven categories based on approximately 5.5 million actions per day from approximately 5,500 users. We have achieved area under the ROC curve values of up to 0.979 and lift values of 65 on the top 50 user-days identified on two months of real data.

While much research has focused on methods for evaluating and maximizing the accuracy of classifiers either individually or in ensembles, little effort has been devoted to analyzing how classifiers are typically deployed in practice. In many domains, classifiers are used as part of a multi-stage process that increases accuracy at the expense of more data collection and/or more processing resources as the likelihood of a positive class label increases. This paper systematically explores the tradeoffs inherent in constructing these multi-stage classifiers from a series of increasingly accurate and expensive individual classifiers, considering a variety of metrics such as accuracy, cost/benefit ratio, and lift. It suggests architectures appropriate for both independent instances and for highly linked data.

This paper describes a case study of an ongoing, deployed, KDD application -NASD Regulation's Advanced Detection System (ADS), which monitors activity on the Nasdaq Stock Marketfrom the perspective of how organizations and systems are impacted by the continuous long-term use of KDD in a dynamic domain.It discusses knowledge management techniques that have been developed for and applied to discovered knowledge.It points out special considerations resulting from the regulatory environment as well as general lessons applicable to all organizations that may come to rely on KDD as an integral part of their business operations.It describes our modifications to accepted KDD processes that are needed to account for the longterm use of KDD as part of a dynamic business environment.