A Model-Based, Decision-Theoretic Perspective on Automated Cyber Response

Cyber-attacks can occur at machine speeds that are far too fast for human-in-the-loop (or sometimes on-the-loop) decision making to be a viable option. Although human inputs are still important, a defensive Artificial Intelligence (AI) system must have considerable autonomy in these circumstances. When the AI system is model-based, its behavior responses can be aligned with risk-aware cost/benefit tradeoffs that are defined by user-supplied preferences that capture the key aspects of how human operators understand the system, the adversary and the mission. This paper describes an approach to automated cyber response that is designed along these lines. We combine a simulation of the system to be defended with an anytime online planner to solve cyber defense problems characterized as partially observable Markov decision problems (POMDPs).

Probabilistic Reasoning About Ship Images

One of the most important aspects of current expert systems technology is the ability to make causal inferences about the impact of new evidence. When the domain knowledge and problem knowledge are uncertain and incomplete Bayesian reasoning has proven to be an effective way of forming such inferences [3,4,8]. While several reasoning schemes have been developed based on Bayes Rule, there has been very little work examining the comparative effectiveness of these schemes in a real application. This paper describes a knowledge based system for ship classification [1], originally developed using the PROSPECTOR updating method [2], that has been reimplemented to use the inference procedure developed by Pearl and Kim [4,5]. We discuss our reasons for making this change, the implementation of the new inference engine, and the comparative performance of the two versions of the system.

Implementing a Bayesian Scheme for Revising Belief Commitments

Our previous work on classifying complex ship images [1,2] has evolved into an effort to develop software tools for building and solving generic classification problems. Managing the uncertainty associated with feature data and other evidence is an important issue in this endeavor. Bayesian techniques for managing uncertainty [7,12,13] have proven to be useful for managing several of the belief maintenance requirements of classification problem solving. One such requirement is the need to give qualitative explanations of what is believed. Pearl [11] addresses this need by computing what he calls a belief commitment-the most probable instantiation of all hypothesis variables given the evidence available. Before belief commitments can be computed, the straightforward implementation of Pearl's procedure involves finding an analytical solution to some often difficult optimization problems. We describe an efficient implementation of this procedure using tensor products that solves these problems enumeratively and avoids the need for case by case analysis. The procedure is thereby made more practical to use in the general case.

BaRT: A Bayesian Reasoning Tool for Knowledge Based Systems

As the technology for building knowledge based systems has matured, important lessons have been learned about the relationship between the architecture of a system and the nature of the problems it is intended to solve. We are implementing a knowledge engineering tool called BART that is designed with these lessons in mind. BART is a Bayesian reasoning tool that makes belief networks and other probabilistic techniques available to knowledge engineers building classificatory problem solvers. BART has already been used to develop a decision aid for classifying ship images, and it is currently being used to manage uncertainty in systems concerned with analyzing intelligence reports. This paper discusses how state-of-the-art probabilistic methods fit naturally into a knowledge based approach to classificatory problem solving, and describes the current capabilities of BART.