- Technical Report
- GALOIS-02-12-A
- Feb 2021
A fundamental requirement for success with technology such as automated planning is that it needs to operate on valid models or ontologies of the application domain. Making these models is difficult because the data involved are voluminous, dynamic and come from a variety of sources and formats, so manual entry and maintenance is prohibitive. Using an ontological framework such as OWL can greatly alleviate this effort, but domain experts reason in domain terms, not the formal logic of ontologies. This paper describes an editing system that allows NASA domain experts to construct and maintain ontological information, and yet produce a standard form that can be manipulated by automated planners and other AI applications.
Read More
- Technical Report
- GALOIS-02-12-A
- Feb 2021
Automation and autonomy are key elements in realizing the vision for space exploration. The NASA Exploration Technology Development Program (ETDP) has been developing several core autonomy capabilities, one of which is called a procedure representation language (PRL). PRL can be automatically translated into code that can be executed by NASA-developed autonomous executives. Another type of automation being developed by ETDP is automated planning aids. These will be needed to increase the number of missions that existing levels of flight personnel are able to handle. But PRL has few constructs to enable automated planners and schedulers to take advantage of the procedures resulting from PRL. In a continuing research effort, we have been developing extensions to PRL to add planning information – resource, constraints and sub-procedural information – so as to produce code usable by automated planning software. From a representative scenario for the PHALCON and EVA flight disciplines, we have derived requirements for planning, developed XML tags for the PRL changes, and translated the changes into the ANML planning language.This paper describes these results.
Read More
- Technical Report
- GALOIS-02-12-A
- Feb 2021
The process control system (PCS) owner can no longer rely on a physical air gap and custom hardware to protect her network from attack. Demand for greater visibility into PCS operations, coupled with greater use of commodity hardware, now exposes the PCS network to the same threats facing other networks. To address these threats, we argue for the deployment of prevention-based, host-resident, network layer devices, coupled with scalable, service-based management, that will not only protect PCS communications but will also support higher level reasoning about PCS trust-worthiness. We explain why the modern PCS network is particularly well-suited for this approach, and we highlight where our own research supports this claim.
Read More
- Technical Report
- GALOIS-02-12-A
- Feb 2021
- Robert P. Goldman
- Steven Harp
We describe the Scyllarus system, which performs Intrusion Detection System (IDS) fusion, using Bayes nets and qualitative probability. IDSes are systems that sense intrusions in computer networks and hosts. IDS fusion is the problem of fusing reports from multiple IDSes scattered around a computer network we wish to defend, into a coherent overall picture of network status. Scyllarus treats the problem of IDS fusion as an abduction problem, formalized using Bayes nets and Knowledge-based Model Construction (KBMC). Because of the coarseness of the data available, Scyllarus uses a qualitative framework, based on System-Z+. Qualitative Bayes nets allow Scyllarus to exploit the trengths of probabilistic reasoning, without excessive knowledge acquisition and without committing to a misleading level of accuracy in its conclusions.
Read More
- Technical Report
- GALOIS-02-12-A
- Feb 2021
- Tim Strayer
- Walter Milliken
- Ronald Watro
- Walt Heimerdinger
- Steven Harp
- Robert Goldman
- Dustin Spicuzza
- Beverly Schwartz
- David Mankins
- Derrick Kong
- Peiter Mudge Zatko
We describe a novel architecture for network de-fense designed for scaling to very high data rates (100 Gb/s) and very large user populations. Scaling requires both efficient attack detection algorithms as well as appropriate an execution envi-ronment. Our architecture considers the time budget of traffic data extraction and algorithmic processing, provides a suite of detection algorithms—each designed to present different and complementary views of the data—that generate many “traffic events,” and reduces false positives by correlating these traffic events into benign or malicious hypotheses.
Read More
- Technical Report
- GALOIS-02-11-A
- Feb 2021
Over the past several months, we have been engaged in the definition and implementation of automated planning capabilities for supporting NASA operations personnel in planning and executing operations on the International Space Station (ISS). For this activity, we have chosen to use the Action Notation Modeling Language (ANML). In this process, we have exercised much of ANML’s considerable flexibility, including exploring several different means of specifying goal decomposition, rather than the task decomposition directly supported in ANML. We have also encountered unexpected semantic ambiguities in the language, for example related to the use of functional fluents with non-numeric ranges. In this paper, we briefly describe the domain, then discuss the modeling challenges arising in this domain and how we have used ANML to address those challenges, and some lessons learned about ANML in the process.
Read More
- Technical Report
- GALOIS-02-11-A
- Feb 2021
- Santosh Mathan
- Patricia Ververs
- Michael Dorneich
- Jim Carciofini
- Stephen Whitlow
A system and method of efficiently and effectively triaging an image that may include one or more target entities. The image is divided into a plurality of individual image chips, and each image chip is successively displayed to a user for a presentation time period. Data are collected from the user at least while each image chip is being displayed. For each image chip, a probability that the image chip at least includes a target entity is assigned, based at least in part on the collected data. The image is then displayed with the assigned probabilities overlaid thereon.
Read More
- Technical Report
- GALOIS-02-11-A
- Feb 2021
Over the past several months, we have been engaged in layering planning information onto execution procedures for supporting NASA operations personnel in planning and executing activities on the International Space Station (ISS). The procedures are captured in the Procedural Representation Language (PRL). The planning information is to be integrated with the procedural information using a PRL authoring system. This paper describes an initial design for eliciting planning information by the domain experts who created the procedures. The goal is to generate actions in standard planning languages that automated planners can use to generate executable plans. Of particular note is that the resulting action representations support both goal and action HTN decompositions.
Read More
- Technical Report
- GALOIS-02-11-A
- Feb 2021
- Kyle Nelson
- Brian J. Bischoff
Embodiments of the present invention relate to methods, devices, and systems to monitor activity. One method to monitor activity includes monitoring a sensor activated by an individual. The method also includes recording activation of the sensor, determining a behavior routine of the individual based on recorded activations of the sensor, and analyzing the recorded sensor activations to determine a behavior routine. The method also includes identifying a change in the behavior routine based on the analysis of the recorded sensor activations.
Read More
- Technical Report
- GALOIS-02-11-A
- Feb 2021
- Michael Atighetchi
- Partha Pal
- Aaron Adler
- Andrew Gronosky
- Fusun Yaman
- Jonathan Webb
- Joe Loyall
- Asher Sinclair
A specific and currently relevant issue motivating the notion of ruggedized software is the confluence of the threat of cyber attacks and our increased dependence on software systems in enterprise as well as tactical situations. Software services that are essential for mission success must not only withstand normal wear and tear, stresses and accidental failures, they also must endure the stresses and failures caused by malicious activities and continue to remain usable. The Crumple Zone (CZ), a software shock absorber that absorbs attack effects before they cause significant system failures, is an architectural construct that we have developed and are maturing iteratively. We argue that the CZ is an important building block for constructing ruggedized software for supporting network-centric operations. In this paper we discuss the CZ in the context of Service-Oriented Architecture (SOA) and describe a configuration that has been realized and demonstrated.
Read More