text: We describe a novel approach to monitoring high level behaviors using concepts from AI planning. Our goal is to understand what a program is doing based on its system call trace. This ability is particularly important for detecting malware. We approach this problem by building an abstract model of the operating system using the STRIPS planning language, casting system calls as planning operators. Given a system call trace, we simulate the corresponding operators on our model and by observing the properties of the state reached, we learn about the nature of the original program and its behavior. Thus, unlike most statistical detection methods that focus on syntactic features, our approach is semantic in nature. Therefore, it is more robust against obfuscation techniques used by malware that change the outward appearance of the trace but not its effect. We demonstrate the efficacy of our approach by evaluating it on actual system call traces.
  @cite_14: In this work we aim to narrow the gap between plan recognition and planning by exploiting the power and generality of recent planning algorithms for recognizing the set G* of goals G that explain a sequence of observations given a domain theory. After providing a crisp definition of this set, we show by means of a suitable problem transformation that a goal G belongs to G* if there is an action sequence π that is an optimal plan for both the goal G and the goal G extended with extra goals representing the observations. Exploiting this result, we show how the set G* can be computed exactly and approximately by minor modifications of existing optimal and suboptimal planning algorithms, and existing polynomial heuristics. Experiments over several domains show that the suboptimal planning algorithms and the polynomial heuristics provide good approximations of the optimal goal set G* while scaling up as well as state-of-the-art planning algorithms and heuristics.
  @cite_1: We present a Bayesian framework for explaining how people reason about and predict the actions of an intentional agent, based on observing its behavior. Action-understanding is cast as a problem of inverting a probabilistic generative model, which assumes that agents tend to act rationally in order to achieve their goals given the constraints of their environment. Working in a simple sprite-world domain, we show how this model can be used to infer the goal of an agent and predict how the agent will act in novel situations or when environmental constraints change. The model provides a qualitative account of several kinds of inferences that preverbal infants have been shown to perform, and also fits quantitative predictions that adult observers make in a new experiment.
  @cite_12: 
summary: Behavior recognition is closely related to plan and goal recognition @cite_12 . Given a sequence of observed actions, the goal is to try to infer the actor's intentions. Typically, the output is a ranked list of hypothesized goals. Most work assumes a library of possible behavior instances, i.e., plans, an approach limited in its ability to go beyond known instances. Probabilistic techniques, such as @cite_1 use Bayesian methods to assess the probability of various goals based on the actions involved. An influential recent approach is plan-recognition as planning @cite_14 , where the authors do away with the assumption of an explicit plan library. The plan library is replaced by a model of the domain (which implicitly defines the set of possible plans), and the goal is to compute a good plan that is closest to the observed behavior. This line of work is appropriate when the observations are a subset of the actual actions taken, or when we attempt to recognize the goal before plan completion. We attempt to recognize malicious behavior off-line given a complete trace, although extensions for the online setting are natural.