Jakub Moskal

Detection of Suspicious Activity Using Different Rule Engines -- Comparison of BaseVISor, Jena and Jess Rule Engines

In this paper we present our experience working on the problem of detecting suspicious activity using OWL ontologies and inference rules. For this purpose we implemented partial solutions using three different rule engines - BaseVISor, Jena and Jess. Each of them required different levels of effort and each had its strengths and weaknesses. We describe our impressions from working with each engine, focusing on the ease of writing and reading rules, support for RDF-based documents, support for different methods of reasoning and interoperability.

Inference and Ontologies

The importance of visualization—discussed in the previous chapter—does not diminish the critical role that algorithmic analysis plays in achieving CSA. Algorithms reason about the voluminous observations and data about the network and infer important features of the situation that help analysts and decision-makers form their situational awareness. In order to perform this inference, and to make its output useful to other algorithms and human users, an algorithm needs to have its inputs and outputs represented in a consistent vocabulary of well-specified terms and their relations, i.e., it needs an ontology with a clear semantics and a standard. This topic is the focus of the present chapter. We already touched on the importance of semantics in the Cognition and Technology chapter. Now we discuss in detail how, in cyber operations, inference based on ontology can be used to determine the threat actor, the target and purpose in order to determine potential courses of action and future impact. Since a comprehensive ontology for cyber security does not exist, we show how such an ontology can be developed by taking advantage of existing cyber security related standards and markup languages.

Reusability of knowledge for deriving latent situational information in EW scenarios

this paper provides an overview of research to apply human-machine Situation Awareness (SA) principles to Electronic Warfare (EW). The research leverages the Endsley SA model combined with Cognitive Radio Ontology extensions to provide automatic inference capabilities for EW. The result is an interoperable language for autonomous cognitive EW systems to create and share knowledge about the Electromagnetic Spectrum (EMS) and the platforms using it. In this paper, we explore several modeling and inference constructs using ontologies expressed in the Web Ontology Language (OWL). We show that these constructs are aligned with the elements of the Endsley model and when implemented in an autonomous system they can significantly enhance the SA of its users and lead to more informed courses of action.