Vladimir Gorodetsky

1
Agent and Data Mining Research in Laboratory of
Intelligent Systems (St. Petersburg Institute
for Informatics and Automation)
Vladimir Gorodetsky Head of Laboratory of
Intelligent Systems http//space.iias.spb.su/ai/
gor_at_mail.iias.spb.su
2
Contents

• 1. Structure of the research and developments of
  the Intelligent System Laboratory
• 2. Multi-Agent System Development Kit (MASDK) A
  software tool supporting MAS application
  technology
• 3. Agent-based distributed data mining and
  machine learning
• 4. International collaboration
• 5. Russian Grant and projects
• 6. Relevant publications

3

• Laboratory stuff
• 11 researchers including
• Ph.D. -- 3
• Research analysts and programmers 4
• Ph.D. students -- 4

4

• 1. Structure of the Research and Developments of
  the Intelligent System Laboratory

5
Types of the Research of IS Laboratory

• Fundamental research
• Machine learning, distributed data mining and
  decision making
• Resource constraint project planning and
  scheduling
• Protocols for distributed data mining and
  decision making
• Agent-based simulation
• Technology and software tools
• Technology and software tool for multi-agent
  application design, implementation and deployment
• Agent-based technology for distributed data
  mining and decision making system
• Technology for resource constraint project
  planning and scheduling
• Software tool kit for machine learning
• Multi-agent applications (software prototyping)
• Intrusion detection,
• Design process planning, scheduling and
  management,
• Image processing,
• Airspace deconfliction,
• Transportation logistics, etc.

6
Research Structure
Multi-agent technology and MASDK software tool
Data mining machine learning tool kit
RoboCup (2004 World winner in Simulation league)
Problem-oriented multi-agent technology
P2P agent-based service-oriented networks (NEW)
Distributed data mining and decision
making infrastructure
Computer Network security
Information fusion for situation assessment
Transportation logistics
Project planning and scheduling
Airspace deconfliction (P2P decision making)
Intrusion detection
Learning of Intrusion detection
Knowledge-based project planning and scheduling
Image processing
Agent-based simulation
Simulation of distributed attacks against
computer network
7

• 2. Multi-Agent System Development Kit A Software
  Tool Supporting MAS Application Technology

8
General Description of MASDK Multi-Agent System
Development Kit
System Core Applied system specification in
XML
Host
Host
Agent
Agent
Agent
Agent
Agent
Agent
Portal
Portal
Multi Agent System Development Kit
Integrated editor system
Software agent builder
Communication platform
Generic agent
9
MASDK Components Integrated Editors System
Browser
MAS system Meta model Ontology Protocol Agent
class Behavior model Private ontology State
machine State Configuration Agents
Hosts (Deployment)
10
Basic MASDK- Related Publication

• Vladimir Gorodetsky, Oleg Karsaev, Vladimir
  Samoylov, Victor Konushy, Evgeny Mankov, and
  Alexey Malyshev. Multi Agent System Development
  Kit. Chapter in book R.Unland, M.Klusch,
  M.Calisti (Eds.) Software Agent-Based
  Applications, Platforms and Development Kits.
  Whitestein Publishers, 2005
• (and a decade of others internationally
  published earlier)

11

• 3. Agent-based Distributed Data Mining and
  Machine Learning

12
Agent-based (Mediated) Distributed Learning
Infrastructure
Data Source KE
Data Source KE
Meta-level KE (manager)
Data Source
Sensor
User interface
Host 1
Host k
Meta-level infrastructure component
Communication
Platform
Data Source KE
Data Source KE
Host 2
Host 3
Data Source
Sensor
Distributed Learning Infrastructuresource
host-based components meta-level component
interaction protocols communication platform
user interfaces (not the machine learning
algorithms!)
13
Example of Application Distributed Learning of
Intrusion Detection (Hierarchical Architecture)
NETWORL TRAFFIC
Preprocessing procedures
Data Source 1
Data Source 2
Data Source 3
Data Source 4
Data Source 5
Source-based classifiers
Source-based classifiers
Source-based classifiers
Source-based classifiers
Source-based classifiers
Decision stream 4
Decision stream 1
Decision stream 2
Decision stream 3
Decision stream 5
Input composition of asynchronous data streams
Two-level meta-classification
Computer security status Normal or
attack of a class
Output
14
Machine Learning Methods in Use and Basic
Publications

• 1. VAM (Visual Analytical Mining) for extraction
  rules from numerical dataset
• V.Gorodetski, V.Skormin, L.Popyack. Data
  Mining Technology for Failure Prognostics of
  Avionics, IEEE Transactions on Aerospace and
  Electronic Systems. Volume 38, 2, pp.388-403,
  2002, etc.
• 2. GK2-for extraction rules from discrete
  datasets
• V.Gorodetsky, O.Karsaev and V.Samoilov.
  Direct Mining of Rules from Data with Missing
  Values. Studies in Computational Intelligence,
  Volume 6, Chapter in book T.Y.Lin, S.Ohsuga, C.J.
  Liau, X.T.Hu, S.Tsumoto (Eds.). Foundation of
  Data Mining and Knowledge Discovery, Springer,
  2005, 233-264, etc.
• 3. Frequent Pattern grows (J.Han)-for extraction
  association rules

15
Visual Analytical Mining of Numerical Data
3rd step of VAM Generation of separation
formula corresponding to both dashed sub-regions.
Result of VAM is specified as the formula of the
first order logic given over linear terms.
The 1st and 2nd steps of VAM Projection of the
mined data onto two dimensional plane (1st) and
drawing the separation line (2nd).
16
International Collaboration (Projects)

• US Air Force Research Laboratory - European
  Office of Aerospace Research and Development--8
  year collaboration since 1998, 5 projects
  successfully completed, 1 - in progress until
  August 2007, new one is discussed)
• FP4, FP5, FP6 AgentLink Coordination Action
  for Agent-based Computing,
• FP6 FET Project POSITIF Formal
  specification and verification of computer
  network security policy,
• FP5 KDNet NoE Data Mining and Knowledge
  Discovery,
• FP6 KDUbiq NoE Knowledge Discovery for
  Ubiquitous Computing (WG2 member)
• Cadence Design System Ltd. (USA, German Research
  office) Multi-agent system for design activity
  support in microelectronics (2004-2006)
• INTEL (USA)Preprocessing algorithms for
  intrusion detection (2004-2005)
• Fraunhofer First Institute, BMBF (Germany)
  MINDMachine Learning in Intrusion Detection
  System (2004-2006)

17
Grants and Projects Russia

• Grants of Russian Foundation for Basic Research
• Multi-agent technology for distributed learning
  and decision making (2004-2006)
• Projects from Department of Information
  Technology and Computer Systems of the Russian
  Academy of Sciences
• Agent-based stochastic modeling and simulation of
  adversarial competition of teams in the Internet
  environment (2003-2005)
• Mathematical models of active audit of computer
  network vulnerabilities, intrusion detection and
  response Multi-agent approach (2003-2005)
• Multi-agent technology and software tool
  (2004-2006)

18
International Conferences etc. Organized by IS
Laboratory

• 1-4. Mathematical methods, model and
  architectures for computer network security
  (MMM-ACNS) 2001, 2003, 2005 (Proceedings in LNCS
  of Springer, vol. 2952, 2776, 3685),
  MMM-ACNS-2007 will be held in September of 2007
  (St. Petersburg, Russia).
• 5. International Workshop of Central and
  Eastern Europe on Multi-agent Systems (CEEMAS)
  1999.
• 6-7. International Workshop on Autonomous
  Intelligent Systems Agents and Data Mining
  (AIS-ADM) June 2005 (Proceedings in LNAI of
  Springer, vol.3505), AIS-ADM-2007 will be held in
  June of 2007 (St. Petersburg, Russia).

19
Distributed Data Mining and Decision Making
related Publications

• V.Gorodetsky, O.Karsaev and V.Samoilov. On-Line
  Update of Situation Assessment Generic Approach.
  In International Journal of Knowledge-Based
  Intelligent Engineering Systems. IOS Press,
  Netherlands, 2005,
• V.Samoylov, V.Gorodetsky. Ontology Issue in
  MultiAgent Distributed Learning. In
  V.Gorodetsky, J.Liu, V. Skormin (Eds.).
  Autonomous Intelligent Systems Agents and Data
  Mining. Lecture Notes in Artificial Intelligence,
  vol. 3505, 2005, 215-230.
• O.Karsaev. Technology of Agent-Based Decision
  Making System Development. In V.Gorodetsky,
  J.Liu, V. Skormin (Eds.). Autonomous Intelligent
  Systems Agents and Data Mining. Lecture Notes in
  Artificial Intelligence, vol. 3505, 2005,
  107-121.
• V.Gorodetsky, O.Karsaev and V.Samoilov. Direct
  Mining of Rules from Data with Missing Values.
  Studies in Computational Intelligence, Volume 6,
  Chapter in book T.Y.Lin, S.Ohsuga, C.J. Liau,
  X.T.Hu, S.Tsumoto (Eds.). Foundation of Data
  Mining and Knowledge Discovery, Springer, 2005,
  233-264
• V.Gorodetsky, O.Karsaev, V.Samoylov, A.Ulanov.
  Asynchronous Alert Correlation in Multi-Agent
  Intrusion Detection Systems, Lecture Notes in
  Computer Science, Vol.3685, Springer, 2005,
  366-379

20
Distributed Data Mining and Decision Making
related Publications

• V.Gorodetsky, O.Karsaev, V.Samoilov, and
  A.Ulanov. Multi-Agent Framework for Intrusion
  Detection and Alert Correlation. NATO ARW
  Workshop "Security of Embedded Systems", Patras,
  Greece, August 22-26, 2005. In Proceedings of the
  Workshop, IOS Press, 2005.
• V.Gorodetsky, O.Karsaev, and V.Samoilov. On-Line
  Update of Situation Assessment Based on
  Asynchronous Data Streams. In M.Negoita,
  R.Howlett, L.Jain (Eds.) Knowledge-Based
  Intelligent Information and Engineering Systems,
  Lecture Notes in Artificial Intelligence, vol.
  3213, Springer Verlag, 2004, pp.11361142
  (Received The Best Paper Award)
• V.Gorodetsky, O.Karsaev, V.Samoilov. Multi-agent
  and Data Mining Technologies for Situation
  Assessment in Security Related Application. In
  B.Dunin-Keplicz, A. Jankovski, A.Skowron,
  M.Szczuka (Eds.) Monitoring, Security, and Rescue
  Techniques in Multi-agent Systems. Series of
  books Advances in Soft Computing, Springer, 2004,
  411-422.
• V.Gorodetsky, O.Karsaev, I.Kotenko, and
  V.Samoilov. Multi-Agent Information Fusion
  Methodology, Architecture and Software Tool for
  Learning of Object and Situation Assessment.
  International Conference "Fusion-04", Stockholm,
  2004, pp. 346353

21
Distributed Data Mining and Decision making
related Publications

• V.Gorodetsky, O.Karsaev, and V.Samoilov.
  Distributed Learning of Information Fusion A
  Multi-agent Approach. Proceedings of the
  International Conference "Fusion 03", Cairns,
  Australia, July 2003, 318325.
• V.Gorodetsky, O.Karsaeyv, and V.Samoilov.
  Multi-agent Technology for Distributed Data
  Mining and Classification. Proceedings of the
  IEEE Conference Intelligent Agent Technology
  (IAT03), Halifax, Canada, October 2003, 438441.
• V.Gorodetsky, O.Karsaev, and V.Samoilov.
  Software Tool for Agent-Based Distributed Data
  Mining. Proceedings of the IEEE Conference
  Knowledge Intensive Multi-agent Systems (KIMAS
  03), Boston, USA, October 2003, 710715,
• etc.

22
Contact data
For more information and related publications
please contact E-mail gor_at_mail.iias.spb.su http/
/space.iias.spb.su/ai/gorodetsky
23

• ?

24

• Future Research and Development in Agent and Data
  Mining Area

Vladimir Gorodetsky Head of Laboratory of
Intelligent Systems http//space.iias.spb.su/ai/
gor_at_mail.iias.spb.su
25
Focus of the Laboratory Current and Forthcoming
Research Projects

• The main idea From hierarchical agent-based
  distributed decision making to P2P (serverless)
  ad-hoc agent-based service-oriented decision
  making networks

1. Algorithms for P2P rule extraction from
distributed data sources with overlapping
attributes -- DDM area. 2. P2P Agent platform
Agent area (now it is subject of activity of
FIPA Nomadic Agent Working Group). 3. Software
tool kit supporting agent-based P2P rule
extraction from distributed data sources
integrated area
26
Example Hierarchical Architecture of Distributed
Decision Making for Intrusion Detection Task
NETWORL TRAFFIC
Preprocessing procedures
Data Source 1
Data Source 2
Data Source 3
Data Source 4
Data Source 5
Source-based classifiers
Source-based classifiers
Source-based classifiers
Source-based classifiers
Source-based classifiers
Decision stream 4
Decision stream 1
Decision stream 2
Decision stream 3
Decision stream 5
Input composition of asynchronous data streams
Two-level meta-classification
Computer security status Normal or
attack of a class
Output
27
Hierarchical Architecture Multi-Agent IDS
Intended for Heterogeneous Alert Correlation
Heterogeneous alerts notify about various classes
of attacks, either DoS, or Probe, or U2R

Classifiers Attack class data source
1 1 DoS connection-based data
2 2 R2U time window-based data -1
3 3 Prob time window-based data -1
4 4 R2U time window-based data -1
5 5 Prob connection window data-1
6 6 Prob connection-based data
7 7 R2U connection-based data
8 8 DoS time window-based data -2
9 9 R2U time window-based data -2
10 10 DoS time window-based data -2
Preprocessing procedures
NETWORK TRAFFIC
28
P2P Architecture of Distributed Decision Making
for Intrusion Detection Task
Example Serverless (P2P) network for intrusion
detection (no meta-classifiers). Each agent
detecting an alert acts as combiner of decisions
provided by other agents (service providers) on
its request
29
Ground Object Recognition Based on Infra Red
Images Produced by Airborne Equipment
Infra red data preprocessing and their
transformation into feature spaces
Object recognition components of the agent-based
software
Object models (set of features)
Scale Invariant Feature Transform (SIFT)
Recognized object
2D Views
SIFT 1
Classifier 1
Model 1
Meta-agent
SIFT 2
Classifier 2
Model 2
Wavelet Transform (WT)
Decision combining
WT 1
Classifier 3
Model 3


WT 2
Structural Description (SD)
Classifier 16
Model 16
SD 1
SD 2
Agent-classifiers
Objects models
The Task On-line automatic recognition of ground
objects based on infra-red images perceived by
airborne surveillance system.
30
Ground Object Recognition Structure of Decision
Making and Decision Combining
Meta-classifier combining decision of particular
meta-classifiers
Recognized objects
Combined decision of the classifiers trained to
detect the object class 1
Combined decision of the classifiers trained to
detect the object class M60
3-SIFT-based Object of class 1 - right
2-SIFT-based Object of class 1 - right
2SIFT-based Object of class 2 -left
3SIFT-based Object of class 2 -left
Combined decision of the classifiers trained to
detect the object class 3
2SIFT-based Object of class 2 -right
3SIFT-based Object of class 2-right
Combined decision of the classifiers trained to
detect the object class 4
2SIFT-based Object of class 3 - front
3SIFT-based Object of class 3 - front
3SIFT-based Object of class 3 - right
2SIFT-based Object of class 3 - right
3SIFT-based Object of class 4 -front
2SIFT-based Object of class 4 -front
2SIFT-based Object of class 3 - back
3SIFT-based Object of class 3 - back
3SIFT-based Object of class 4 -left
2SIFT-based Object of class 4 l eft
31
Agent-based P2P Classification Network
Implementing Ground Object Recognition System
Classifiers detecting the objects of class 1 Classifiers detecting the objects of class 3
4 21
9 23
8 10
18
19
15
Classifiers detecting the objects of class 2 Classifiers detecting the objects of class 4
24 12
3 5
17 13
25 6
20 1
11 22
14
7
16
Agent providing user interface
32
Software Prototype of Agent-based Service-
oriented P2P Classification Network for Ground
Object Recognition
The main window of the user interface of the P2P
classification network for ground object
recognition
33
Architecture of Agent-based Service-oriented P2P
Network

Network Transport
General requirements to P2P agent platform
architecture are formulated in the document of
Nomadic Agent Working Group (NAWG) of FIPA. Our
expected contribution is a version of its
implementation and verification (via software
prototyping on the basis of particular
classification networks).
34
Architecture of a Peer of Agent-based
Service-oriented P2P Network
Agent 1-1
Agent 1-2
Agent 1-k

OnReceive Handler
OnReceive Handler
OnReceive Handler
Transport System (TCP/IP) (UDP) interface
PEER P2P Agent Platform instance
Message Transport System Interface
Existing P2P networking middleware
OnReceive Handler
OnReceive Handler
Routing Book
Interface AMS (dll, Agent)
Message history
Interface Yellow Pages (dll, Agent)
Agent book
Peer Address book
Search Results
Service book
Search Results
35
Hot Problems

• 1. Development of P2P agent platform
  decoupling peers and applications and supporting
  open serviceoriented architectures,
  selfoptimization of the network structure
  through on-line learning. Although the last
  problem is currently the subject of the intensive
  research in the networking scope, for agent-based
  architecture it will require specific efforts.
• 2. Combining of decisions produced by P2P agents
  within distributed heterogeneous environment. A
  peculiarity of this task is that in each
  particular case, the classifications incoming
  from the peers may be very diverse in the sense
  that different peers may be involved in service
  provision. That is why, distributed learning of
  decision combing that is a challenging task of
  P2P data mining and ubiquitous computing should
  be an important component of the technology in
  question.

36
Contact data
For more information and related publications
please contact E-mail gor_at_mail.iias.spb.su http/
/space.iias.spb.su/ai/gorodetsky
37

• ?