Jacky Hartnett

DynamicWEB: Adapting to Concept Drift and Object Drift in COBWEB

Examining concepts that change over time has been an active area of research within data mining. This paper presents a new method that functions in contexts where concept drift is present, while also allowing for modification of the instances themselves as they change over time. This method is well suited to domains where subjects of interest are sampled multiple times, and where they may migrate from one resultant concept to another due to Object Drift. The method presented here is an extensive modification to the conceptual clustering algorithm COBWEB, and is titled DynamicWEB.

Using repertory grids for knowledge acquisition for spatial expert systems

The traditional approach to knowledge acquisition from domain experts has been via interview. However deeper knowledge can be elicited using repertory grid techniques which get domain experts to rank objects against concepts. The technique based on Kellys (1955) Personal Construct Theory has been well proven by Boose et. al. (1987) but has not to date been applied to a spatial domain. The current study grew out of the development of a repertory grid program, developed for the KAGES toolkit, which will consist of several knowledge acquisition tools for use in the development of spatial expert systems. The paper describes both the theoretical foundations of a system which elicits spatial knowledge using repertory grids and a practical approach for its implementation. This involves a discussion of the development of production programs for KAGES (Knowledge Acquisition for Geographic Expert Systems) and describes output for a generic knowledge base for use with the SPARTEX system. The domain is represented by a series of satellite images. These are of the Antarctic coastline where sea ice is being identified and classified.

DynamicWEB: profile correlation using COBWEB

Establishing relationships within a dataset is one of the core objectives of data mining. In this paper a method of correlating behaviour profiles in a continuous dataset is presented. The profiling problem which motivated the research is intrusion detection. The profiles are dynamic in nature, changing frequently, and are made up of many attributes. The paper describes a modified version of the COBWEB hierarchical conceptual clustering algorithm called DynamicWEB. DynamicWEB operates at runtime, keeping the profiles up to date, and in the correct location within the clustering tree. Further, as there are a number of attributes within the domain of interest, the tree also extends multi-dimensionally. This allows for multiple correlations to occur simultaneously, focusing on different attributes within the one profile.

Detecting Abnormal Changes in E-mail Traffic Using Hierarchical Fuzzy Systems

E-mail traffic analysis is an area of work that focuses on extracting information about the behaviour of e-mail users based on the sender, receiver, and date/time information taken from the header section of e-mail messages. Such work has applications for law enforcement where investigators and analysts require techniques to assist them with finding unusual or suspicious patterns from large amounts of communication log data. This paper describes work using hierarchical fuzzy systems to detect abnormal changes in e-mail traffic behaviour, through the fusion of e-mail traffic behaviour measurements. The paper focuses on the use of three different hierarchical fuzzy system architectures, to determine the effect that input variable groupings have on the abnormality ratings given to the communication links of suspect e-mail accounts. The case study demonstrates the use of the three hierarchical fuzzy system architectures for analysing suspect e-mail accounts belonging to the Enron e-mail corpus.

Personality Trait Based Simulation Model of the E-mail System

Within the area of criminal and terrorist social network analysis, there is little research being done on analysing the communication behavior of criminal and terrorist groups. In this paper, we describe the development of a conceptual simulation model of the e-mail system, which is based on the use of personality trait dimensions to model the e-mail traffic behavior of e-mail users. This conceptual simulation model is being used as a first step for further development in simulating criminal and terrorist communication behavior. We also describe the development of an e-mail traffic analyser system, which uses a decision tree to search for interesting e-mail traffic behavioral patterns, and uses social network and time-series visualisation to provide the details of the interesting traffic patterns. We demonstrate that the personality trait based e-mail system model is useful as a tool for generating e-mail traffic behavioral patterns and that decision trees are useful for finding interesting patterns in the e-mail traffic data.

Email communications analysis: how to use computational intelligence methods and tools?

The paper aims at investigating computational intelligence methodologies for detecting a change in communication behavioral patterns between e-mail subscribers. This change may indicate a change of social status and behavior, which could be used for early discovery of some preparation to antisocial activity, including but not limiting to terrorist attacks. The patterns in the social interactions or contacts between people by e-mail can be analyzed using social network analysis and user behavior analysis. In this paper we provide a review of the work related to the areas of dynamic modeling and link prediction of social networks, and anomaly detection for detecting changes in the behavior of e-mail usage. The feasibility of neural networks and fuzzy logic methodologies applications for a change detection system design is discussed, as well as a discussion about an e-mail simulation model currently being developed

A visual tool for capturing the knowledge of expert image interpreters: a picture is worth more than a thousand words

This paper describes a system, KAGES (Knowledge Acquisition for Geographic Expert Systems), being developed to use visual means to extract the expertise of image interpreters. The system presents an image either as a single band or as various combinations of bands and allows an expert to use a mouse to point at or draw around features of interest. It then allows the user to interact with the system to confirm or adjust the identifying characteristics that the system suggests define the feature. These characteristics are not confined to pixel characteristics, and their relationship between image bands but, also includes spatial analysis capabilities. This paper also discusses some of the problems associated with the visual representation of the elicited knowledge and the verification of that knowledge. In order to verify a spatial rule, the human image interpreter needs to see it. For expert systems the usual way to view a rule is as an if-then-else triplet. This may be an unfamiliar construct to a user who works with visual cues, and may result in problems with verification.

DynamicWEB: A Method for Reconnaissance Activity Profiling

Port scan correlation aims to differentiate between benign and malicious scans. In this paper we will examine a new method of profiling port scan activity in an attempt to link different source IP addresses to being the same end user. A data mining approach DynamicWEB based upon the COBWEB conceptual clustering algorithm is shown along with some preliminary results of it functioning within the context of scan correlation.

Interaction rules: their place in collaboration software

One major form of social capital that is central to the development of communities is the set of structures devoted to; norms of interaction, making these norms overt and regulating interaction. The creation of these structures is deeply linked to notions of trust, which has been identified as a major factor in the behaviour of successful virtual teams. Because (virtual) teams are complex, the types of interactions that suit a particular team may or may not be predictable. The first author has created Phreda, software that permits group members to create interaction rules in the form of production rules. These rules are then given to an expert system shell that matches these rules against resource use parameters in the groups online collaboration environment. This software as well as results from a first pilot study are described.

A prototype sea ice mapping system using a geographical information system and expert knowledge

An operational sea ice mapping system is being developed which will assist meteorologists at the Casey Antarctic Base to create sea ice maps, from NOAA AVHRR imagery received at the base itself. The system will take AVHRR imagery initially processed via the McIdas meteorological system, and initiate an interactive procedure which assists the expert interpreter to produce a sea ice map from the imagery. A prototype system, called ICEMAPPER, has been developed. It is based on an existing geographical information system and uses production rules, incorporating expert knowledge derived both from the scientific literature and from local sea ice interpreters, to provide an initial classification. If the expert is satisfied with the map produced it can be printed out. If not, thresholds used in the production rules can be altered interactively and the map recreated.