Carsten Elfers

Typed linear chain conditional random fields and their application to intrusion detection

Intrusion detection in computer networks faces the problem of a large number of both false alarms and unrecognized attacks. To improve the precision of detection, various machine learning techniques have been proposed. However, one critical issue is that the amount of reference data that contains serious intrusions is very sparse. In this paper we present an inference process with linear chain conditional random fields that aims to solve this problem by using domain knowledge about the alerts of different intrusion sensors represented in an ontology.

Intuitive Plan Construction and Adaptive Plan Selection

Typical tasks of multi agent systems are effective coordination of single agents and their cooperation. Especially in dynamic environments, like the RoboCup soccer domain, the uncertainty of an opponents team behavior complicates coordinated team action. This paper presents a novel approach for intuitive multi agent plan construction and adaptive plan selection to attempt these tasks. We introduce a tool designed to represent plans like in tactical playbooks in human soccer which allows easy plan construction, editing and managing. Further we introduce a technique that provides adaptive plan selection in offensive situations by evaluating effectiveness of plans and their actions with statistically interpreted results to improve a teams style of play. Using experts as a concept for abstracting information about a teams interaction with another, makes fast accommodated plan selection possible. We briefly describe our software components, examine the performance of our implementation and give an example for rational plan selection in the RoboCup Small Size League.

Incremental Generation of Abductive Explanations for Tactical Behavior

According to the expert literature on (human) soccer, e.g., the tactical behavior of a soccer team should differ significantly with respect to the tactics and strategy of the opponent team. In the offensive phase the attacking team is usually able to actively selectan appropriate tactic with limited regard to the opponent strategy. In contrast, in the defensive phase the more passive recognitionof tactical patterns of the behavior of the opponent team is crucial for success. In this paper we present a qualitative, formal, abductive approach, based on a uniform representation of soccer tactics that allows to recognize/explain the tactical and strategical behavior of opponent teams based on past (usually incomplete) observations.

Intelligent monitoring with background knowledge

This paper describes the design and implementation of an intelligent monitoring system, that runs advanced inference mechanisms to correlate events from various sensors. Different to existing monitoring approaches, it exploits taxonomic background knowledge in form of ontological information to draw refined inferences. The monitoring system provides abstract knowledge exchange capabilities between different monitoring clients to support users during the setup and maintenance process. The system supports a variety of sensors and collectors, also including new sensors that can be mapped to the system conveniently.

Combining Conditional Random Fields and Background Knowledge for Improved Cyber Security

This paper shows that AI-methods can improve detection of malicious network traffic. A novel method based on Conditional Random Fields combined with Tolerant Pattern Matching is presented. The proposed method uses background knowledge represented in a description logic ontology, user modeled patterns build on-top of this ontology and training examples from the application domain to improve the detection accuracy of IT incidents, particularly addressing the problem of incomplete information.

Unternehmensübergreifender Austausch von sicherheitsrelevantem Wissen

ZusammenfassungKoordinierte verteilte Angriffe im Internet sind ein akutes Problem. Während Angriffe jedoch in kollaborativen Verbünden organisiert werden, verteidigen Unternehmen sich häufig im Alleingang. Sicherheitsmaßnahmen gelten oft als wohl gehütete Geheimnisse und werden ungern preisgegeben. In diesem Beitrag werden Methoden und Voraussetzungen vorgestellt, die einen kooperativen Austausch von sicherheitsrelevantem Wissen ermöglichen, ohne damit etwaige eigene Schwachstellen offen zu legen.