Advanced Persistent Threats (APTs) have been a major challenge in securing both Information Technology (IT) and Operational Technology (OT) systems. Due to their capability to navigates around defenses and to evade detection for a prolonged period of time, targeted APT attacks present an increasing concern for both cyber security and business continuity personnel. This paper explores the application of Artificial Immune System (AIS) and Recurrent Neural Networks (RNNs) variants for APT detection. It has been shown that the variants of the suggested algorithms provide not only detection capability, but can also classify malicious data traffic with respect to the type of APT attacks. CCS CONCEPTS • Computing methodologies → Artificial intelligence; Machine learning; Neural networks.

Abstract. We present a hybrid approach to Distributed Constraint Satisfaction which combines incomplete, fast, penalty-based local search with complete, slower systematic search. Thus, we propose the hybrid algorithm PenDHyb where the distributed local search algorithm DisPeL is run for a very small amount of time in order to learn about the difficult areas of the problem from the penalty counts imposed during its problem-solving. This knowledge is then used to guide the systematic search algorithm SynCBJ. Extensive empirical results in several problem classes indicate that PenDHyb is effective for large problems.

No abstract

Multiclass problems, such as detecting multi-steps behaviour of advanced persistent threats (APTs), have been a major global challenge due to their capability to navigates around defenses and to evade detection for a prolonged period. Targeted APT attacks present an increasing concern for both cyber security and business continuity. Detecting the rare attack is a classification problem with data imbalance. This paper explores the applications of data resampling techniques together with heterogeneous ensemble approach for dealing with data imbalance caused by unevenly distributed data elements among classes with the focus on capturing the rare attack. It has been shown that the suggested algorithms provide not only detection capability but can also classify malicious data traffic corresponding to rare APT attacks.

Abstract. Constraint Satisfaction Problems can be solved using either iterative improvement or constructive search approaches. Iterative improvement techniques converge quicker than the constructive search techniques on large problems, but they have a propensity to converge to local optima. Therefore, a key research topic on iterative improvement search is the development of effective techniques for escaping local optima, most of which are based on increasing the weights attached to violated constraints. An alternative approach is to attach penalties to the individual variable values participating in a constraint violation. We compare both approaches and show that the penalty-based technique has a more dramatic effect on the cost landscape, leading to a higher ability to escape local optima. We present an improved version of an existing penalty-based algorithm where penalty resets are driven by the amount of distortion to the cost landscape caused by penalties. We compare this algorithm with an algorithm based on constraint weights and justify the difference in their performance.

Abstract. Over the past years, a number of increasingly expressive languages for modelling constraint and optimisation problems have evolved. In developing a strategy to ease the complexity of building models for constraint and optimisation problems, we have asked ourselves whether, for modelling purposes, it is really necessary to introduce more new languages and notations. We have analyzed several emerging languages and formal notations and found (to our surprise) that the already existing Z notation, although not previously used in this context, proves to a high degree expressive, adaptable, and useful for the construction of problem models. To substantiate these claims, we have both compiled a large number of constraint and optimisation problems as formal Z specifications and translated models from a variety of constraint languages into Z. The results are available as an online library of model specifications, which we make openly available to the modelling community. MotivationFormal methods and notations are most commonly associated with software development in procedural and object-oriented implementation languages. We are developing a strategic software engineering approach for modelling constraint and optimisation problems (csops); one of the main underlying objectives is to integrate the notion of such problems into the standard software design cycle [8]. For this purpose, we have been investigating the use of formal notation in general and of Z in particular, coming to the conclusion that advantages are to be had in at least four areas.The first concerns the inception phase of building an initial or conceptual model. A modeller must first come up with an understanding of the problem requirements before being able to exploit its specific features. Quoting Smith, a recognized expert in the area of modelling: "Hence, although constraint programming does require an understanding of search and constraint propagation, it is by understanding the problem and building in that understanding that we can develop a successful model." [9, sec. 13] Secondly, as larger-scale software is mostly developed in a (possibly distributed) team context and problem-solving strategies are shared across the modelling community, we see the importance of formal notation as a means of communication which is not constrained by and tied to the specifics of a

No abstract

Abstract. Constraint Satisfaction has been widely used to model static combinatorial problems. However, many AI problems are dynamic and take place in a distributed environment, i.e. the problems are distributed over a number of agents and change over time. Dynamic Distributed Constraint Satisfaction Problems (DDisCSP) [1] are an emerging field for the resolution problems that are dynamic and distributed in nature. In this paper, we propose DynABT, a new Asynchronous algorithm for DDisCSPs which combines solution and reasoning reuse i.e. it handles problem changes by modifying the existing solution while re-using knowledge gained from solving the original(unchanged) problem. The benefits obtained from this approach are two-fold: (i) new solutions are obtained at a lesser cost and; (ii) resulting solutions are stable i.e. close to previous solutions. DynABT has been empirically evaluated on problems of varying difficulty and several degrees of changes has been found to be competitive for the problem classes tested.