John-Mark Agosta

Bayes probability networks, also termed `influence diagrams,' promise to be a versatile, rigorous, and expressive uncertainty reasoning tool. This paper presents an example of how a Bayes network can express constraints among visual hypotheses. An example is presented of a model composed of cylindric primitives, inferred from a line drawing of a plumbing fixture. Conflict between interpretations of candidate cylinders is expressed by two parameters, one for the presence and one for the absence of visual evidence of their intersection. It is shown how `partial exclusion' relations are so generated and how they determine the degree of competition among the set of hypotheses. Solving this network obtains the assemblies of cylinders most likely to form an object.

This paper works through the optimization of a real world planning problem, with a combination of a generative planning tool and an influence diagram solver. The problem is taken from an existing application in the domain of oil spill emergency response. The planning agent manages constraints that order sets of feasible equipment employment actions. This is mapped at an intermediate level of abstraction onto an influence diagram. In addition, the planner can apply a surveillance operator that determines observability of the state---the unknown trajectory of the oil. The uncertain world state and the objective function properties are part of the influence diagram structure, but not represented in the planning agent domain. By exploiting this structure under the constraints generated by the planning agent, the influence diagram solution complexity simplifies considerably, and an optimum solution to the employment problem based on the objective function is found. Finding this optimum is equivalent to the simultaneous evaluation of a range of plans. This result is an example of bounded optimality, within the limitations of this hybrid generative planner and influence diagram architecture.

This thesis builds a probabilistic model, called a "recognition network," which is an influence diagram for visual recognition, to determine the probability that an object appears in an image. The presence of each visual feature corresponds to one node in the network, thus there must be multiple paths connecting nodes in the network. Formulating one influence diagram for the entire recognition process demonstrates how evidence can be integrated consistently. At intermediate stages of the process, probabilities in the partially constructed network guide the process. This thesis demonstrates a method to determine the probabilities of existence of features from image evidence, and show how these probabilities propagate to determine which objects appear. We show how a network of the part-whole relations among objects and their features can be interpreted as a network of conditional probabilities. Further we show how such a network can be constructed dynamically from the evidence so that it scales "nicely" with the size of the problem, and can be solved by existing influence diagram solution techniques. Specifically we develop two kinds of network nodes, one to express "vertical" relations between objects and the set of features from which they are aggregated, and the other to express "horizontal relations", such as ambiguity, among existence probabilities. The second kind of nodes have "Conditional Inter-Causally Independent" (CICI) distributions that express conflict among candidate hypotheses. As an example of an aggregation node, we develop a probability model for its counting aspect. Such a counting operation cannot be carried out with singly connected networks. CICI distributions are applied to model the degree of conflict among cylinder hypotheses due to their intersections. Constructing and evaluating an example network based on a image of a plumbing fixture demonstrates how the intersections of cylinder volumes tend to remove spurious cylinder hypotheses in the model.

This report describes the development of a prototype decision support system for oil spill response configuration planning that will help U.S. Coast Guard planners to determine the appropriate response equipment and personnel for major spills. The report discusses the application of advanced artificial intelligence planning techniques, as well as other software tools for spill trajectory modeling, plan evaluation and map display. The implementation of the prototype system is discussed in the context of two specific major spill scenarios in the San Francisco Bay.

We describe an approach to modeling diagnostic problems that is based on a passive observation of a diagnostician’s work-flow and recording their findings and final diagnosis, from which the model can be modified directly, or improved by learning from cases so acquired. While the probabilistic model of a system under diagnosis is necessarily simplified, based on three-layer Bayesian networks with canonical interactions among the network variables, we are able to reduce greatly the most important bottleneck—the knowledge engineering effort that goes into model building. Our initial experience with an implementation of this idea suggests that the sacrifices in diagnostic quality are not large, while gains are tremendous.

This thesis builds a probabilistic model, called a "recognition network," which is an influence diagram for visual recognition, to determine the probability that an object appears in an image. The presence of each visual feature corresponds to one node in the network, thus there must be multiple paths connecting nodes in the network. Formulating one influence diagram for the entire recognition process demonstrates how evidence can be integrated consistently. At intermediate stages of the process, probabilities in the partially constructed network guide the process. This thesis demonstrates a method to determine the probabilities of existence of features from image evidence, and show how these probabilities propagate to determine which objects appear. We show how a network of the part-whole relations among objects and their features can be interpreted as a network of conditional probabilities. Further we show how such a network can be constructed dynamically from the evidence so that it scales "nicely" with the size of the problem, and can be solved by existing influence diagram solution techniques. Specifically we develop two kinds of network nodes, one to express "vertical" relations between objects and the set of features from which they are aggregated, and the other to express "horizontal relations", such as ambiguity, among existence probabilities. The second kind of nodes have "Conditional Inter-Causally Independent" (CICI) distributions that express conflict among candidate hypotheses. As an example of an aggregation node, we develop a probability model for its counting aspect. Such a counting operation cannot be carried out with singly connected networks. CICI distributions are applied to model the degree of conflict among cylinder hypotheses due to their intersections. Constructing and evaluating an example network based on a image of a plumbing fixture demonstrates how the intersections of cylinder volumes tend to remove spurious cylinder hypotheses in the model.

Introduction Probabilistic models have been widely proposed as di-agnostic methods for trouble-shooting and repair (Breese and Heckerman 1996; Agosta and Gardos 2004). In such models, Bayesian networks are described in terms of causes and evidence. The objective ...

Abstract—We model a little studied type of traffic, namely the network traffic generated from endhosts. We introduce a parsimonious model of the marginal distribution for connection arrivals consisting of mixture models with both heavy and lighttailed component distributions. Our methodology assumes that the underlying user data can be fitted to one of several models, and we apply Bayesian model selection criterion to choose the preferred combination of components. Our experiments show that a simple Pareto-exponential mixture model is preferred over more complex alternatives, for a wide range of users. This model has the desirable property of modeling the entire distribution, effectively clustering the traffic into the heavy-tailed as well as the non-heavy-tailed components. Also this method quantifies the wide diversity in the observed endhost traffic. I.

As part of a larger project on distributed anomaly detection using local host traffic, (See Agosta et al. [2005], Dash et al. [2006]) we review some current analysis and modeling of enterprise traffic flows. The origins of this work grew out of a project on individual host anomaly detection for worm spreading behavior. The Distributed Detection and Inference (DDI) project improved on this to consider anomalies among a host’s neighbors, greatly increasing detection accuracy. To ground the project we’ve completed a comprehensive traffic data collection effort over several weeks on several hundred individual enterprise hosts. Here we review several threads of the work, and make some observations for better detection methods relevant to the overall project. Strong dependencies among network flows lead to bursty network traffic, which makes modeling and prediction hard. This is true to the extent that machine idle and off periods are hardly evident in network traffic traces. (Is a quiet ...

Intrusion attempts due to self-propagating code are becoming an increasingly urgent problem, in part due to the homogeneous makeup of the internet. Recent advances in anomaly-based intrusion detection systems (IDSs) have made use of the quickly spreading nature of these attacks to identify them with high sensitivity and at low false positive (FP) rates. However, slowly propagating attacks are much more difficult to detect because they are cloaked under the veil of normal network traffic, yet can be just as dangerous due to their exponential spread pattern. We extend the idea of using collaborative IDSs to corroborate the likelihood of attack by imbuing end hosts with probabilistic graphical models and using random messaging to gossip state among peer detectors. We show that such a system is able to boost a weak anomaly detector D to detect an order-of-magnitude slower worm, at false positive rates less than a few per week, than would be possible using D alone at the end-host or on a...

This paper is part of a study whose goal is to show the effciency of using Bayes networks to carry out model based vision calculations. [Binford et al. 1987] Recognition proceeds by drawing up a network model from the object's geometric and functional description that predicts the appearance of an object. Then this network is used to find the object within a photographic image. Many existing and proposed techniques for vision recognition resemble the uncertainty calculations of a Bayes net. In contrast, though, they lack a derivation from first principles, and tend to rely on arbitrary parameters that we hope to avoid by a network model. The connectedness of the network depends on what independence considerations can be identified in the vision problem. Greater independence leads to easier calculations, at the expense of the net's expressiveness. Once this trade-off is made and the structure of the network is determined, it should be possible to tailor a solution technique for it. This paper explores the use of a network with multiply connected paths, drawing on both techniques of belief networks [Pearl 86] and influence diagrams. We then demonstrate how one formulation of a multiply connected network can be solved.

Design is a cognitive task, of abstracting aspects of things and their relationships to form a model. Thinking of a modeling language, a design is the high level construct in that language. Alternatively a design has a reduction into the low-level "alphabet" of that language, out of which it is constructed according to the rules of that language. A novice

Abstract In this paper, we derive a method to refine a Bayes network diagnostic model by exploiting constraints implied by expert decisions on test ordering. At each step, the expert executes an evidence gathering test, which suggests the test's relative diagnostic value. ...

This paper works through the optimization of a real world planning problem, with a combination of a generative planning tool and an influence diagram solver. The problem is taken from an existing application in the domain of oil spill emergency response. The planning agent manages constraints that order sets of feasible equipment employment actions. This is mapped at an intermediate

Determining which actions to take and when has been addressed by distinct methods in AI. Among them are two techniques that choose actions in sequence to meet a speci ed goal. One is generative planning, coming out of the classical planning eld; and the other, in u-ence diagrams, out ...

ABSTRACT Formal diagnostic methods ,are emerging ,from ,the machine-learning research ,community ,and beginning to find application in Intel. In this paper ,we give ,an overview of these ,methods ,and the potential they show for improving ,diagnostic procedures ,in operational environments. We present ,an historical ,overview ,of Bayes networks and discuss how they can be applied,to diagnosis. We then,give an illustration of how,they can model,the ,faults in a ,vacuum ,subsystem ,of a manufacturing tool.

Formal diagnostic methods ,are emerging ,from ,the machine-learning research ,community ,and beginning to find application in Intel. In this paper ,we give ,an overview of these ,methods ,and the potential they show for improving ,diagnostic procedures ,in operational environments. We present ,an historical ,overview ,of Bayes networks and discuss how they can be applied,to diagnosis. We then,give an illustration of how,they can model,the ,faults in a ,vacuum ,subsystem ,of a manufacturing tool.