John Gersh

Supporting insight-based information exploration in intelligence analysis

Capturing the exploratory search process can help represent analytical insight.

Ocelot: user-centered design of a decision support visualization for network quarantine

Most cyber security research is focused on detecting network intrusions or anomalies through the use of automated methods, exploratory visual analytics systems, or real-time monitoring using dynamic visual representations. However, there has been minimal investigation of effective decision support systems for cyber analysts. This paper describes the user-centered design and development of a decision support visualization for active network defense. Ocelot helps the cyber analyst assess threats to a network and quarantine affected computers from the healthy parts of a network. The described web-based, functional visualization prototype integrates and visualizes multiple data sources through the use of a hybrid space partitioning tree and node link diagram. We describe our design process for requirements gathering and design feedback which included expert interviews, iterative design, and a user study.

Cognitive engineering of rule-based supervisory control systems: effects of concurrent automation

The authors observed subjects performing a task in a dynamic environment using rule-based supervisory control (RBSC). Task performance was evaluated in an experiment using control and display features derived from a cognitive process model of RBSC. In particular, the effects of numerical versus graphical display of rule parameter, textual data entry versus direct manipulation for control of rule parameters and the presence or absence of a display of the history of past actions were examined. Results indicate that the way in which subjects use the automation is affected by the controls and displays provided, and that the nature of that use can affect overall task performance.<<ETX>>

Cognitive engineering of rule-based supervisory control systems: observations concerning users' task performance

A rule-based supervisory control (RBSC) system is one in which a decision makers supervisory commands to the system are in the form of explicit condition-action (if-then) rules. The authors report observations of subjects performing a simulated tactical problem with an RBSC system and relate those observations to current cognitive models of decision-making performance. The performance of several subjects was observed and analyzed to obtain a sense of the qualitative nature and range of performance variation among subjects for this tactical problem. The observations focus on how decision makers go about specifying and using supervisory rules to control the RBSC system.<<ETX>>

A knowledge-based approach to spacecraft distributed modeling and simulation

Abstract The Johns Hopkins University Applied Physics Laboratory is developing a knowledge-based approach to spacecraft distributed modeling and simulation and to sustaining design knowledge. We define an object-oriented decomposition of a virtual spacecraft into both functional and physical classes, and standardize the class methods. Simulations of spacecraft components inherit from the classes and implement the standard methods as well as their own special methods. Federated simulations of spacecraft system designs can integrate multiple component simulations in a plug-and-play fashion through the standard interfaces. We also define a knowledge-based architecture that captures and synthesizes the object-oriented standards, component simulation descriptions, and designs of spacecraft systems. Software tools extract abstract simulation specifications from the knowledge base and create files that drive platform-specific federated simulations. Finally, we define a knowledge-based approach to sustaining design and design process knowledge to facilitate the design process of current and future spacecraft.

Effects of Gain/Loss Framing in Cyber Defense Decision-Making

Cyber defense requires decision making under uncertainty, yet this critical area has not been a focus of research in judgment and decision-making. Future defense systems, which will rely on software-defined networks and may employ “moving target” defenses, will increasingly automate lower level detection and analysis, but will still require humans in the loop for higher level judgment. We studied the decision making process and outcomes of 17 experienced network defense professionals who worked through a set of realistic network defense scenarios. We manipulated gain versus loss framing in a cyber defense scenario, and found significant effects in one of two focal problems. Defenders that began with a network already in quarantine (gain framing) used a quarantine system more, as measured by cost, than those that did not (loss framing). We also found some difference in perceived workload and efficacy. Alternate explanations of these findings and implications for network defense are discussed.

Reports on the 2005 AAAI Spring Symposium Series

The Association for the Advancement of Artificial Intelligence presented its 2005 Spring Symposium Series on Monday through Wednesday, March 21-23, 2005 at Stanford University in Stanford, California. The topics of the eight symposia in this symposium series were (1) AI Technologies for Homeland Security; (2) Challenges to Decision Support in a Changing World; (3) Developmental Robotics; (4) Dialogical Robots: Verbal Interaction with Embodied Agents and Situated Devices; (5) Knowledge Collection from Volunteer Contributors; (6) Metacognition in Computation; (7) Persistent Assistants: Living and Working with AI; and (8) Reasoning with Mental and External Diagrams: Computational Modeling and Spatial Assistance.