ACS is an annual meeting for research on the initial goals of artificial intelligence and cognitive science, which aimed to explain the mind in computational terms and to reproduce the entire range of human cognitive abilities in computational artifacts. Many researchers remain committed to this original vision, and Advances in Cognitive Systems provides a place to present recent results and pose new challenges for the field. The meetings bring together researchers with interests in human-level intelligence, complex cognition, integrated intelligent systems, cognitive architectures, and related topics.

In this paper we discuss work performed in an ambitious DARPA funded cyber security effort.The broad approach taken by the project was for the network to be self-aware and to self-adapt in order to dodge attacks. In critical systems, it is not always the best or practical thing, to shut down the network under attack. The paper describes the qualitative trust modeling and diagnosis system that maintains a model of trust for networked resources using a combination of two basic ideas: Conditional trust (based on conditional preference (CP-Nets) and the principle of maximum entropy (PME)).We describe Monte-Carlo simulations of using adaptive security based on our trust model.The results of the simulations show the trade-off, under ideal conditions, be-tween additional resource provisioning and attack mitigation.

We demonstrate an integrated system for building and learning models and structures in both a real and virtual environment. The system combines natural language understanding, planning, and methods for composition of basic concepts into more complicated concepts. The user and the system interact via natural language to jointly plan and execute tasks involving building structures, with clarifications and demonstrations to teach the system along the way. We use the same architecture for building and simulating models of biology, demonstrating the general-purpose nature of the system where domain-specific knowledge is concentrated in sub-modules with the basic interaction remaining domain-independent. These capabilities are supported by our work on semantic parsing, which generates knowledge structures to be grounded in a physical representation, and composed with existing knowledge to create a dynamic plan for completing goals. Prior work on learning from natural language demonstrations enables learning of models from very few demonstrations, and features are extracted from definitions in natural language. We believe this architecture for interaction opens up a wide possibility of human-computer interaction and knowledge transfer through natural language.

Cognitive systems face the challenge of pursuing changing goals in an open world with unpredictable collaborators and adversaries. Considerable work has focused on automated planning in dynamic worlds, and even re-planning and plan repair due to unexpected changes. Less work explores how humans and computers can negotiate to define shared goals and collaborate over the fulfillment of those goals. Our work takes a domain-general approach to plan localization, the problem of establishing the set of steps within the plan that are candidates (potentially after some adaptive repair actions) for next actions given the world’s unforeseeen changes. We use analogical mapping to help agents determine the nearest states in a diverse plan relative to the current world state, identifying both the maximal satisfied states that the world conforms to presently, and the closest desired states adjacent to satisfied states that are both achievable by an action and makes progress toward the goal. These are demonstrated in a system called CLiC. The system’s overall purpose is to engage in symmetric dialog with human users about goals and recommended actions to achieve those goals. Both the human and the system may choose to take those actions, or describe them to the other party. They may not always do what they are told. Preliminary results indicate that our approach suits collaborative situated agents with flexible goals in open worlds.

This paper describes R3 ( Reading, Reasoning, and Report- ing ), our system for deep language understanding and model management for the biomedical domain. Starting from a base BioPAX model, we learn extensions to it by reading biomedical research articles from PubMed Central. We describe the particular issues for text understanding in this domain and how we use pre- and post-analysis reasoning to bridge the differences in how knowledge is packaged in a text and in a biomedical database. We close with brief description of our first year results, where R3 was faster than all other reported systems, reading 1,000 articles in 15 minutes.

Despite our increasing understanding of the structure and dynamics of scientific domains, functional knowledge and functional language— such as referring to a central purpose or function of a molecule— permeate scientific articles. Cognitive systems that collaborate with scientists must therefore represent functional knowledge to support machine reading and explanation. This paper describes our progress on automatically inferring and representing functional knowledge in R3 (Reading, Reasoning, and Reporting). R3 automatically reads biology articles from PubMed Central, using a massive domain model from Pathway Commons (www.pathwaycommons.org/) as background knowledge. R3 now relates functional language to its background structural model and explains functional knowledge, which is the central contribution of this paper. We motivate the representation of functional knowledge in the biology domain— which many existing ontologies omit— using examples from PubMed articles. We then describe how R3 automatically adds functional knowledge to its model by parsing textual summaries of biological processes and extracting semantics. We then describe how R3 builds event structures and compositional models with functional knowledge, and we illustrate how R3 uses its functional knowledge to diagram protein activity from the information it learned from reading.

This paper describes our approach to anticipating and recognizing potential cyber threats in order to provide timely responses to those threats. Our approach anticipates attacks on distributed systems by generating a diverse set of attack plans on key system components and then determining the probabilities that these attacks may threaten those components or others that are stepping stones to those systems. The results enable our overall system, STRATUS, to defend these systems by preparing backups and controlling communications pathways appropriately. We present a preliminary empirical study of our techniques, demonstrating their promise.

This paper describes a novel combination of Java program analysis and automated learning and planning architecture to the domain of Java vulnerability analysis. The key feature of our “HACKAR: Helpful Advice for Code Knowledge and Attack Resilience” system is its ability to analyze Java programs at development-time, identifying vulnerabilities and ways to avoid them. HACKAR uses an improved version of NASA’s Java PathFinder (JPF) to execute Java programs and identify vulnerabilities. The system features new Hierarchical Task Network (HTN) learning algorithms that (1) advance stateof-theart HTN learners with reasoning about numeric constraints, failures, and more general cases of recursion, and (2) contribute to problem-solving by learning a hierarchical dataflow representation of the program from the inputs of the program. Empirical evaluation demonstrates that HACKAR was able to suggest fixes for all of our test program suites. It also shows that HACKAR can analyze programs with string inputs that original JPF implementation cannot.

This paper describes an automated process of active perception for cyber defense. Our approach is informed by theoretical ideas from decision theory and recent research results in neuroscience. Our cognitive agent allocates computational and sensing resources to (approximately) optimize its Value of Information. To do this, it draws on models to direct sensors towards phenomena of greatest interest to inform decisions about cyber defense actions. By identifying critical network assets, the organization's mission measures interest (and value of information). This model enables the system to follow leads from inexpensive, inaccurate alerts with targeted use of expensive, accurate sensors. This allows the deployment of sensors to build structured interpretations of situations. From these, an organization can meet mission-centered decision-making requirements with calibrated responses proportional to the likelihood of true detection and degree of threat.

The STRATUS project seeks to provide resilience against cyber threats to distributed systems. STRATUS is designed to anticipate, diagnose, and respond proactively to threats. It uses a reactive technique to respond to the latest events quickly and a more `strategic' technique that recognizes attack plans and responds to them proactively. We focus on a set of experiments where we approximate the behavior of STRATUS in order to evaluate its responses given a variety of missions and attacks. We show the relative merits of responding to threats using local, reactive responses versus strategically ones and present evidence that justifies combining the two approaches to system defense.

We outline our approach to developing, a distributed capability to achieve shared situation awareness of mission status and trust relationships, anticipate and diagnose cyber threats, and respond strategically and tactically to those threats.

We outline our approach to developing, a distributed capability to achieve shared situation awareness of mission status and trust relationships, anticipate and diagnose cyber threats, and respond strategically and tactically to those threats.

Today’s computer systems are under relentless attack from cyber attackers armed with sophisticated vulnerability search and exploit development toolkits. To protect against such threats, we are developing FUZZBUSTER, an automated system that provides adaptive immunity against a wide variety of cyber threats. FUZZBUSTER reacts to observed attacks and proactively searches for never-before-seen vulnerabilities. FUZZBUSTER uses a suite of fuzz testing and vulnerability assessment tools to find or verify the existence of vulnerabilities. Then FUZZBUSTER conducts additional tests to characterize the extent of the vulnerability, identifying ways it can be triggered. After characterizing a vulnerability, FUZZBUSTER synthesizes and applies an adaptation to prevent future exploits. Keywords-self-adaptive immunity, cyber-security, fuzz-testing.

Today's computer systems are under relentless attack from cyber attackers armed with sophisticated vulnerability search and exploit development toolkits. To protect against such threats, we are developing FUZZBUSTER, an automated system that provides adaptive immunity against a wide variety of cyber threats. FUZZBUSTER reacts to observed attacks and proactively searches for never-before-seen vulnerabilities. FUZZBUSTER uses a suite of fuzz testing and vulnerability assessment tools to find or verify the existence of vulnerabilities. Then FUZZBUSTER conducts additional tests to characterize the extent of the vulnerability, identifying ways it can be triggered. After characterizing a vulnerability, FUZZBUSTER synthesizes and applies an adaptation to prevent future exploits.

We present a cognitive architecture that heavily utilizes metareasoning for self adaptation,. The architecture is derived in part from neuroscience data and theories about the operation of the human vision system. We also discuss how this architecture is applied in the POIROT system, which learns web services workflow from “observing” a small number of expert examples.

SILK is an expressive Semantic Web rule language and system equipped with scalable reactive higher-order defaults. We present one of its latest novel features: a graphical user interface (GUI) for knowledge entry, query answering, and justification browsing that supports user specification and understanding of advanced courteous prioritized defeasible reasoning. We illustrate the use of the GUI in an example from college-level biology of modeling and reasoning about hierarchically-structured causal processes with interfering multiple causes.

Existing work on workflow mining ignores the dataflow aspect of the problem. This is not acceptable for service-oriented applications that use Web services with typed inputs and outputs. We propose a novel algorithm WIT (Workflow Inference from Traces) which identifies the context similarities of the observed actions based on the dataflow and uses model merging techniques to generalize the control flow and the dataflow simultaneously. We identify the class of workflows that WIT can learn correctly. We implemented WIT and tested it on a real world medical scheduling domain where WIT was able to find a good approximation of the target workflow.