- Research Objective
Enhance Situational Awareness in large-scale, complex systems using a combination of knowledge-based and data-driven approaches.
This has immediate applications in areas such as Cyber Security, Computer Forensics, SmartGrids, Networked Experiment Testbeds where the scale and complexity of such domains, combined with the exaflood of data is creating vast challenges and opportunities. Situational awareness will aid users of these systems in making better sense of their environment by enabling faster analysis, diagnosis, discovery and decision making.
Data represents facts about a system or process and making sense of a flood of facts is a cognitively overloading task. Effective analysis of data requires bridging the semantic gap between the data and the user’s high-level understanding of a system or process. The challenge for creating situational awareness, therefore, is to convert the raw data into user understandable situations.
- Latest Research
My current focus is on semantic analysis of distributed system data as applied to the domains of networking testbeds and intrusion detection systems for SmartGrids, done under the larger ThirdEye project. It involves application of formal methods, data mining, machine learning and visualization techniques to make sense of data.
The Semantic Analysis Framework (SAF) is a semantic framework for data analysis of networked and distributed system data. Users capture their high-level understanding of system operations as behavior models. Users then use such models to pose questions over data and do analysis.
The semantic analysis framework provides:
- A formal language for modeling high-level assertions over networked systems data as behavior models.
- An analysis engine for extracting instances of user-specified behavior models from raw data.
The key differentiator of the semantic approach is the introduction of the notion of behavior - a sequence or a group of related facts - as a fundamental abstraction for analysis and reasoning over data.Behaviors can be composed using a rich set of operators to express semantically-relevant relationships. Behaviors capture system semantics and operators allow expressing sophisticated relationships between behaviors. This enables users to reason over data at higher levels and closer to their understanding of system operation.