Recognition plan/goal abandonment

• US 20070150427A1
• Filed: 12/22/2005
• Published: 06/28/2007
• Est. Priority Date: 12/22/2005
• Status: Abandoned Application

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Geib, Christopher
• Application Number:
  US11/317,461
• Publication Number:
  US 20070150427A1
• Time in Patent Office: Days
• US Class Current: 706/45
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A plan recognition model is arranged to recognizing a plan based on observed actions as contained in an audit log. An audit log containing a collection of observed actions of at least one agent is read, and the observed actions contained in the audit log are compared to plan actions contained in plans stored in a plan library. Explanations for the observed actions are generated based on the comparison of the observed actions to plan actions, and at least one of the explanations is selected as a best fit for the observed actions. The selected explanation is provided as an output.

Claims

1. A plan recognition method, implemented by a processing system, of recognizing a plan based on observed actions as contained in an audit log comprising:

reading an audit log containing a collection of past observed actions of at least one agent;

based on the observed actions contained in the audit log and a plan library, repeatedly interleaving generation of a pending set of actions that are pending execution by the agent and generation of explanations for the pending actions contained in the pending set;

computing probabilities as to the likelihood that the explanations represent at least one actual plan of the agent; and

,

recognizing at least one of the explanations as the actual plan of the agent based on the computed probabilities.

2. The method of claim 1 wherein the generation of a pending set of pending actions based on the observed actions contained in the audit log includes:

comparing the observed actions contained in the audit log with actions contained in plans stored in a plan library; and

,

forming the pending sets based on yet-to-be-observed actions corresponding to plans in the plan library that have actions matching the observed actions.

3. The method of claim 2 wherein the plans contained in the plan library are characterized by “

and nodes,”

“

or nodes,” and

ordering constraints between actions in the plans stored in the plan library.

4. The method of claim 1 wherein the computing of probabilities comprises computing the probabilities as a function of (i) probabilities associated with root goals of plans corresponding to the generated explanations, (ii) the number of alternative courses of action available to the agent in the generated explanations, and (iii) the number of elements in the generated pending set.

5. The method of claim 4 further comprising storing in the plan library the prior probabilities associated with each of the root goals stored in the plan library.

6. The method of claim 1 wherein the computing of probabilities comprises computing the probabilities as a function of (i) probabilities associated with root goals of plans corresponding to the generated explanations, (ii) the number of alternative courses of action available to the agent in the generated explanations, (iii) the number of elements in the generated pending set, and (iv) probabilities associated with actions that have not been observed but that are consistent with the generated explanations.

7. The method of claim 6 further comprising:

storing in the plan library the prior probabilities associated with each of the root goals stored in the plan library; and

,

storing in the plan library the prior probabilities associated with false negatives for observation of the actions stored in the plan library.

8. The method of claim 6 further comprising removing any explanation based on one or more unobserved actions associated whose false negative probability exceeds a predetermined threshold.

9. The method of claim 1 further comprising:

determining when the agent has abandoned a goal; and

,

modifying the explanations based on the abandoned goal.

10. The method of claim 9 wherein the modifying of the explanations based in the abandoned goal comprises removing all elements from the pending set that contribute to the abandoned goal.

11. The method of claim 9 wherein the determining of when the agent has abandoned a goal comprises computing a probability that the agent has abandoned a goal g based on (i) a number of elements in a pending set that contribute to the goal g, (ii) a last time s of observing an action contributing to the goal g, (iii) a number of elements in the pending set indexed based on the last time s and a current time t, and (iv) a probability of abandonment threshold.

12. The method of claim 1 wherein the generation of a pending set of pending actions based on the observed actions contained in the audit log includes comparing the observed actions contained in the audit log with actions contained in plans stored in a plan library, and wherein the plans stored in the plan library include argument variables.

13. The method of claim 12 wherein at least one of the variables has a type defined by negation.

14. The method of claim 1 wherein the generation of a pending set of pending actions based on the observed actions contained in the audit log includes comparing the observed actions contained in the audit log with actions contained in plans stored in a plan library, wherein the actions contained in the plans stored in the plan library include temporal constraints between actions.

15. A plan recognition method, implemented by a processing system, of recognizing a plan based on observed actions as contained in an audit log comprising:

reading an audit log containing a collection of observed actions of at least one agent;

comparing the observed actions contained in the audit log to plan actions contained in plans stored in a plan library;

generating explanations for the observed actions based on the comparison of the observed actions to plan actions;

selecting at least one of the explanations as a best fit for the observed actions; and

,

providing an output based on the selected explanation.

16. The method of claim 15 wherein the plans contained in the plan library are characterized by “

and nodes,”

“

or nodes,” and

ordering constraints between actions in the plans stored in the plan library.

17. The method of claim 15 further comprising removing one of the explanations based on a failure to observe an action that is an element of the removed explanation.

18. The method of claim 15 further comprising:

determining when the agent has abandoned a goal; and

,

modifying the explanations based in the abandoned goal.

19. The method of claim 15 wherein the plans stored in the plan library include argument variables.

20. The method of claim 15 wherein the plans stored in the plan library include at least one variable that has a type defined by negation.

21. The method of claim 15 wherein the plan actions contained in the plans stored in the plan library include temporally constrained actions.

22. A computer readable storage medium having program code stored thereon which, where executed, performs the following plan recognition functions:

reading an audit log containing a collection of observed actions of at least one agent;

comparing the observed actions contained in the audit log to plan actions contained in plans stored in a plan library;

generating explanations for the observed actions based on the comparison of the observed actions to plan actions;

computing probabilities as to the likelihood that the explanations explain the observed actions;

based on the computed probabilities, determining at least one actual goal of the agent; and

,

providing an output based on the determined goal.

23. The computer readable storage medium of claim 22 wherein the function of computing of probabilities comprises the function of computing the probabilities as a function of probabilities stored in the plan library.

24. The computer readable storage medium of claim 22 wherein the function of computing of probabilities comprises the function of computing the probabilities as a function of actions that have not been observed but that are consistent with the generated explanations.

25. The computer readable storage medium of claim 22 further comprising the functions of:

determining when the agent has abandoned a goal; and

,

modifying the explanations based in the abandoned goal.

26. The computer readable storage medium of claim 22 wherein the plans stored in the plan library include argument variables.

27. The computer readable storage medium of claim 22 wherein the plans stored in the plan library include at least one variable that has a type defined by negation.

28. The computer readable storage medium of claim 22 wherein the plan actions contained in the plans stored in the plan library include temporally constrained actions.