Publications by Dr Özgür Kafalı

We address the problem of engineering a sociotechnical system (STS) with respect to its stakeholders' requirements. We motivate a two-tier STS conception comprising a technical tier that provides control mechanisms and describes what actions are allowed by the software components, and a social tier that characterizes the stakeholders' expectations of each other in terms of norms. We adopt agents as computational entities, each representing a different stakeholder. Unlike previous approaches, our framework, Desen, incorporates the social dimension into the formal verification process. Thus, Desen supports agents potentially violating applicable norms—a consequence of their autonomy. In addition to requirements verification, Desen supports refinement of STS specifications via design patterns to meet stated requirements. We evaluate Desen at three levels. We illustrate how Desen carries out refinement via the application of patterns on a hospital emergency scenario. We show via a human-subject study that a design process based on our patterns is helpful for participants who are inexperienced in conceptual modeling and norms. We provide an agent-based environment to simulate the hospital emergency scenario to compare STS specifications (including participant solutions from the human-subject study) with metrics indicating social welfare and norm compliance, and other domain dependent metrics.

Context: Modern software systems are deployed in sociotechnical settings, combining social entities (humans and organizations) with technical entities (software and devices). In such settings, on top of technical controls that implement security features of software, regulations specify how users should behave in security-critical situations. No matter how carefully the software is designed and how well regulations are enforced, such systems are subject to breaches due to social (user misuse) and technical (vulnerabilities in software) factors. Breach reports, often legally mandated, describe what went wrong during a breach and how the breach was remedied. However, breach reports are not formally investigated in current practice, leading to valuable lessons being lost regarding past failures. Objective: Our research aim is to aid security analysts and software developers in obtaining a set of legal, security, and privacy requirements, by developing a crowdsourcing methodology to extract knowledge from regulations and breach reports. Method: We present Çorba, a methodology that leverages human intelligence via crowdsourcing, and extracts requirements from textual artifacts in the form of regulatory norms. We evaluate Çorba on the US healthcare regulations from the Health Insurance Portability and Accountability Act (HIPAA) and breach reports published by the US Department of Health and Human Services (HHS). Following this methodology, we have conducted a pilot and a final study on the Amazon Mechanical Turk crowdsourcing platform. Results: Çorba yields high quality responses from crowd workers, which we analyze to identify requirements for the purpose of complementing HIPAA regulations. We publish a curated dataset of the worker responses and identified requirements. Conclusions: The results show that the instructions and question formats presented to the crowd workers significantly affect the response quality regarding the identification of requirements. We have observed significant improvement from the pilot to the final study by revising the instructions and question formats. Other factors, such as worker types, breach types, or length of reports, do not have notable effect on the workers' performance. Moreover, we discuss other potential improvements such as breach report restructuring and text highlighting with automated methods.

We present Pirasa: an agent-based simulation environment for studying how autonomous agents can best interact with each other to exchange goods in e-commerce marketplaces. A marketplace in Pirasa enables agents to enact buyer or seller roles and select from sales, auction, and negotiation protocols to achieve the individual goals of their users. An agent's strategy to maximize its utility in the marketplace is guided by its user's preferences and constraints such as `maximum price' and `deadline', as well as an agent's personality attributes, e.g., how `eager' or `late' the agent can be for exchanging goods and whether the agent is a `spender' or `saver' in an exchange. To guide the agent's actions selected by a strategy, we use the notion of electronic contracts formulated as regulatory norms. In this context, we present how Pirasa is organized with regards to seller processes for goods submission, the inclusion of buyer preferences, and the management of transactions through specialized broker agents. Using randomized simulations, we demonstrate how a buyer agent can strategically select the most suitable protocol to satisfy its user's preferences, goals and constraints in dynamically changing market settings. The generated simulation data can be leveraged by researchers to analyze agent behaviors, and develop additional strategies.

Understanding accountability in contract violations, e.g., whom is accountable for what, is a tedious, time-consuming, and costly task for human decision-making, especially when contractual responsibilities are delegated among parties. Intelligent software agents equipped with expert capabilities such as monitoring and diagnosis help save time and improve accuracy of diagnosis by formal reasoning upon electronic contracts. Such contracts are represented as commitment norms, a well studied artifact in multi-agent systems, which provide semantics for agent interactions. Due to the open and heterogeneous nature of multi-agent systems, commitments are often violated. When a commitment is violated, e.g., an exception occurs, agents need to collaborate to understand what went wrong and which agent is responsible. We propose Comodo: a framework for monitoring commitment delegations and detecting violations. We define a complete set of possible rational delegation schemes for commitments, identifying for each combination of delegations what critical situations may lead to an improper delegation and potentially to a commitment violation. Comodo provides a sound and complete distributed reasoning procedure that is able to find all improper delegations of a given commitment. We provide the complete implementation of Comodo using the Reactive Event Calculus, and present an e-commerce case study to demonstrate its workings. Due to its generic nature, we discuss the application of our approach to other distributed diagnosis problems in emergency healthcare, Internet of Things and smart environments, and security, privacy, and accountability in the context of socio-technical systems

We develop a novel strategy that supports software agents to make decisions on how to negotiate for a resource in open and dynamic e-markets. Although existing negotiation strategies offer a number of sophisticated features, including modelling an opponent and negotiating with many opponents simultaneously, they abstract away from the dynamicity of the market and the model that the agent holds for itself in terms of ongoing negotiations, thus ignoring information that increases an agent's utility. Our proposed strategy COncurrent Negotiating AgeNts (Conan) considers a weighted combination of modelling the market environment and the progress of concurrent negotiations in which the agent partakes. We conduct extensive experiments to evaluate the strategy's performance in various settings where different opponents from the literature provide a competitive market. Our experiments provide statistically significant results showing how Conan outperforms the state-of-the-art in terms of the utility gained during negotiations.

We present a knowledge representation framework on the basis of the Event Calculus that allows an agent to recognize complex activities from low-level observations received by multiple sensors, reason about the life cycle of such activities, and take action to support their successful completion. Activities are multivalue fluents that change according to events that occur in the environment. The parameters of an activity consist of a unique label, a set of participants involved in the performing of the activity, and a unique goal associated with the activity revealing the activity's desired outcome. Our contribution is the identification of an activity life cycle describing how activities can be started, interrupted, suspended, resumed, or completed over time, as well as how these can be represented. The framework also specifies activity goals, their associated life cycle, and their relation with the activity life cycle. We provide the complete implementation of the framework, which includes an activity generator that automatically creates synthetic sensor data in the form of event streams that represent the everyday lifestyle of a type 1 diabetic patient. Moreover, we test the framework by generating very large activity streams that we use to evaluate the performance of the recognition capability and study its relative merits.

Diabetes is a disease that has to be managed through appropriate lifestyle. Technology can help with this, particularly when it is designed so that it does not impose an additional burden on the patient. This paper presents an approach that combines machine-learning and symbolic reasoning to recognise high-level lifestyle activities using sensor data obtained primarily from the patient's smartphone. We compare five methods for machine-learning which differ in the amount of manually labelled data by the user, to investigate the trade-off between the labelling effort and recognition accuracy. In an evaluation on real-life data, the highest accuracy of 83.4 % was achieved by the MCAT method, which is capable of gradually adapting to each user.

Privacy remains a major challenge today, partly because it brings together social and technical considerations. Yet, current software engineering focuses only on the technical aspects. In contrast, the authors' approach, Revani, understands privacy from the standpoint of sociotechnical systems (STSs), with particular attention on the social elements of STSs. They specify STSs via a combination of technical mechanisms and social norms founded on accountability. Revani provides a way to formally represent mechanisms and norms and applies model checking to verify whether specified mechanisms and norms would satisfy stakeholder requirements. Additionally, Revani provides a set of design patterns and a revision tool to update an STS specification as necessary. The authors demonstrate the work of Revani on a healthcare emergency use case pertaining to patient privacy during disasters.

Diabetes is both heavily affected by the patients' lifestyle, and it affects their lifestyle. Most diabetic patients can manage the disease without technological assistance, so we should not burden them with technology unnecessarily, but lifestyle-monitoring technology can still be beneficial both for patients and their physicians. Because of that we developed an approach to lifestyle monitoring that uses the smartphone, which most patients already have. The approach consists of three steps. First, a number of features are extracted from the data acquired by smartphone sensors, such as the user's location from GPS coordinates and visible wi-fi access points, and the physical activity from accelerometer data. Second, several classifiers trained by machine learning are used to recognise the user's activity, such as work, exercise or eating. And third, these activities are refined by symbolic reasoning encoded in Event Calculus. The approach was trained and tested on five people who recorded their activities for two weeks each. Its classification accuracy was 0.88.

E-commerce has become an integral part of everyday life. Many e-commerce systems enable users to browse products, place orders, and track deliveries online. However, these interactions is time-consuming, especially if they do not proceed as expected. Instead of a human user, software can offer automated support to monitor e-commerce transactions to ensure that they are completed by the businesses as planned. Accordingly, this paper studies methods to develop a software agent for monitoring its users' interactions with businesses (PISAGOR). The interactions are represented as commitments, which have been extensively studied in multiagent systems. With a commitment-based specification at hand, the agent knows what the meaning of its interactions are and can therefore reason over its actions. The reasoning is accompanied with the as-good-as relation that compares the agent's current state with its expectations from a transaction. This enables PISAGOR to decide whether the transaction is progressing as expected. Moreover, we propose operational rules for the agent to create expectations based on its commitments and check its progress toward them. We demonstrate via a case study how PISAGOR can detect if a user's interactions are not progressing well and identify a problem for the user to take action.

Online social networks have become an essential part of social and work life. They enable users to share, discuss, and create content together with various others. Obviously, not all content is meant to be seen by all. It is extremely important to ensure that content is only shown to those that are approved by the content's owner so that the owner's privacy is preserved. Generally, online social networks are promising to preserve privacy through privacy agreements, but still everyday new privacy leakages are taking place. Ideally, online social networks should be able to manage and maintain their agreements through well-founded methods. However, the dynamic nature of the online social networks is making it difficult to keep private information contained. We have developed PROTOSS, a run time tool for detecting and predicting privacy violations in online social networks. PROTOSS captures relations among users, their privacy agreements with an online social network operator, as well as domain-based semantic information and rules. It uses model checking to detect if relations among the users will result in the violation of privacy agreements. It can further use the semantic information to infer possible violations that have not been specified by the user explicitly. In addition to detection, PROTOSS can predict possible future violations by feeding in a hypothetical future world state. Through a running example, we show that PROTOSS can detect and predict subtle leakages, similar to the ones reported in real life examples. We study the performance of our system on the scenario as well as on an existing Facebook dataset.

We present the development of COMMODITY12, a Personal Health System (PHS) to assist in the provision of continuous and personalised health services to diabetic patients, thus empowering their lifestyle regardless of their location. COMMODITY12 consists of ambient, wearable and portable devices, which acquire, monitor and communicate physiological parameters and other health-related context of an individual, such as physical activity and vital body signals. This data is interpreted by intelligent agents that use expert biomedical knowledge to derive important insights about the individual's health status, which are then presented in the form of active feedback to the patient directly from the device, or via health professionals who assist in diagnosis, treatment and life management. The emphasis of the work is on the design of the PHS in terms of its main components, their integration and deployment to address major problems of interest to both diabetic patients and doctors that treat diabetes.

We propose a diagnosis procedure that agents can use to explain exceptions to contract executions. Contracts are expressed by social commitments associated with temporal constraints. The procedure reasons from the relations among such commitments, and returns one amongst different possible mismatches that may have caused an exception. In particular, we consider two possibilities: misalignment, when two agents have two different views of the same commitment, and misbehavior, when there is no misalignment, but a debtor agent fails to oblige. We also provide a realignment policy that can be applied in case of a misalignment. Our formalization uses a reactive form of Event Calculus. We illustrate the workings of our approach by discussing a delivery process from e-commerce as a case study.

Scientific advancement is fueled by solid fundamental research, followed by replication, meta-analysis, and theory building. To support such advancement, researchers and government agencies have been working towards a "science of security". As in other sciences, security science requires high-quality fundamental research addressing important problems and reporting approaches that capture the information necessary for replication, meta-analysis, and theory building. The goal of this paper is to aid security researchers in establishing a baseline of the state of scientific reporting in security through an analysis of indicators of scientific research as reported in top security conferences, specifically the 2015 ACM CCS and 2016 IEEE S&P proceedings. To conduct this analysis, we employed a series of rubrics to analyze the completeness of information reported in papers relative to the type of evaluation used (e.g. empirical study, proof, discussion). Our findings indicated some important information is often missing from papers, including explicit documentation of research objectives and the threats to validity. Our findings show a relatively small number of replications reported in the literature. We hope that this initial analysis will serve as a baseline against which we can measure the advancement of the science of security.

Refining a sociotechnical system (STS) specification with respect to its requirements is a nontrivial task. Previous work on verification and refinement of software systems either ignores the social dimension, or limits the autonomy of agents by controlling their interactions. We address these limitations by proposing an STS specification that provides not only regimentation via control mechanisms that describe how agents interact with software components, but also regulation via norms that characterize the expectations of agents from each other. We use formal verification techniques to understand whether an STS specification meets the functional, security, and privacy requirements of its stakeholders. If a requirement is not satisfied, we suggests refinements based on normative design patterns.

Understanding tradeoffs among stakeholder requirements regarding liveness (something good happens) and safety (nothing bad happens) is crucial for designing sociotechnical systems (STSs). Safety-focused specifications restrict agents' actions to avoid undesired executions. However, such restrictions hinder liveness. We formalize such tradeoffs using the elements of an STS specification to understand how much a specification promotes liveness or safety. We propose metrics to measure liveness and safety, and demonstrate how constraint logic programming is used to compute such metrics.

Recent data breaches in domains such as healthcare where confidentiality of data is crucial indicate that breaches often originate from misuses, not only from vulnerabilities in the technical (software or hardware) architecture. Current requirements engineering (RE) approaches determine what access control mechanisms are needed to protect sensitive resources (assets). However, current RE approaches inadequately characterize how a user is expected to interact with others in relation to the relevant assets. Consequently, a requirements analyst cannot readily identify misuses by legitimate users. We adopt social norms as a natural, formal means of characterizing user interactions whereby potential misuses map to norm violations. Our research goal is to help analysts identify misuse cases by formal reasoning about norm enactments. We propose Nane, a formal framework for identifying such misuse cases using a semiautomated process. We demonstrate how Nane enables monitoring of potential misuses on a healthcare scenario.

Sociotechnical systems (STSs), where users interact with software components, support automated logging, i.e., what a user has performed in the system. However, most systems do not implement automated processes for inspecting the logs when a misuse happens. Deciding what needs to be logged is crucial as excessive amounts of logs might be overwhelming for human analysts to inspect. The goal of this research is to aid software practitioners to implement automated forensic logging by providing a systematic method of using attackers' malicious intentions to decide what needs to be logged. We propose Lokma: a normative framework to construct logging rules for forensic knowledge. We describe the general forensic process of Lokma, and discuss related directions.

Recon is an experimental simulation platform that supports the development of software agents interacting concurrently with other agents in negotiation domains. Unlike existing simulation toolkits that support only imperative negotiation strategies, Recon also supports declarative strategies, for applications where logic-based agents need to explain their negotiation decisions to a user. Recon is built on top of the GOLEM agent platform, specialized with a set of infrastructure agents that can manage an electronic market and extract statistics from the negotiations that take place. We evaluate the performance of Recon by showing how by increasing the number of agents in a simulation affects the agents' time to make an offer during negotiation.

STARLITE is a novel web-based agent platform that allows open, dynamic execution of agent simulations. Using STARLITE researchers can start simulations as web applications whose URI can then be used by other researchers to inspect progress with these simulations and deploy their agents on them dynamically to test their behaviour and performance. We describe the overall architecture of STARLITE and exemplify its main features through a tournament simulation for the Iterated Prisoner's Dilemma (IPD).

We present Hydra: a multi-agent hybrid diagnosis and monitoring architecture that is aimed at helping diabetic patients manage their illness. It makes use of model-based diagnosis techniques, where the model can be developed by two different approaches combined in a novel way. In the first approach, we build the model based on the medical guidelines provided for diabetes. A computational logic agent monitors the patient and provides feedback based on the model whenever the current observations regarding the patient are sufficient to draw a conclusion. In the second approach, we assume a function for the model, and learn its parameters through data. The model is consistently updated via incoming observations about the patients, and allows prediction of possible future values. We describe the components of such an architecture, and how it can integrated into the existing COMMODITY12 personal health system. We implement a prototype of Hydra, and present its workings on a case study on hypoglycemia monitoring. We report our prediction results for this scenario.

Goal-based agent architectures have been one of the most effective architectures for designing agents. In such architectures, the state of the agent as well as its goal set are represented explicitly. The agent then uses its set of actions to reach the goals in its goal set. However, in multiagent systems, most of the time, an agent cannot reach a goal only using its own actions but needs other agents to act as well. Commitments have been successfully used to regulate those interactions between agents. This paper proposes a framework and an environment for agents to manage the relations between their commitments and goals. More specifically, we provide an algorithm called GOSU to compute if a given set of commitments can be used to achieve a particular goal. We describe how GOSU can be implemented using the Reactive Event Calculus and demonstrate its capabilities over a case study.

We develop CONAN, a heuristic agent for concurrent bilateral negotiations in electronic markets that are open, dynamic and complex. Existing strategies often omit the factors determining when a market environment is open or how an agent evaluates progress in bilateral negotiations. Such omissions in turn damage the offer-making ability of an agent and consequently the number of successful negotiations that this agent can achieve. Negotiation experiments indicate that CONAN outperforms other agents that rely on the current state-of-the-art by a significant amount in terms of the utility gained during a negotiation.

As online social networks are becoming part of both social and work life, preserving privacy of their users is becoming tremendously difficult. While these social networks are promising privacy through privacy agreements, everyday new privacy leakages are emerging. Ideally, online social networks should be able to manage and maintain their agreements through well-founded methods. However, the dynamic nature of the online social networks is making it difficult to keep private information contained. We have developed PROTOSS, a run time tool for detecting privacy leakages in online social networks. PROTOSS captures relations among users, their privacy agreements with an online social network operator, and domain-based inference rules. It then uses model checking to detect if an online social network will leak private information.

We study the development of a distributed, agent-based, simulation environment where autonomous agents execute e-commerce contracts. We present a multi-agent architecture in which contracts are represented as a set of commitments that an agent must be capable of monitoring and reason with in order to be able to verify that the contract is not violated during interaction. We employ the JADE agent platform to build the multi-agent simulation infrastructure, and the Reactive Event Calculus to provide agent reasoning for monitoring and verification of contracts. We then experimentally evaluate the performance of our system by analysing the time and memory requirements as the number of agents increases, and by looking whether the behaviours of agents have any significant effect on the system's overall performance.

Distributed resource allocation in multiagent systems is hard to solve. Since the allocation will be done distributively, agents are not aware of others that use the resources that they need and in what quantity. That is, because the agents do not have access to the entire list of allocations, they can attempt to use resources that are not available. One naive approach is to allow agents to try different allocations repeatedly, so that they can eventually an effective allocation can emerge. However, such a technique is difficult to succeed when the resources are scarce but the number of agents is high. An effective solution to the problem has to allow agents to self-organize intelligently rather than randomly. Accordingly, this paper proposes a communication scheme, where agents are allowed to exchange a small part of their prior knowledge with a few of the agents that they know. We study our proposed approach in relation to existing approaches in the literature and show the positive effects of communication on better resource allocation, especially when the resources are scarce and the agents have a variety of choices for allocation.

The success of contract-based multiagent systems relies on agents complying with their commitments. When something goes wrong, the key to diagnosis lies within the commitments' mutual relations as well as their individual states. Accordingly, we explore how commitments are related through the three-agent commitment delegation operation. We then propose exception diagnosis based on such a relation.

Exceptions constitute a great deal of autonomous process execution. In order to resolve an exception, several participants should collaborate and exchange knowledge. We believe that argumentation technologies lend themselves very well to be used in this context, both for elaborating on possible causes of exceptions, and for exchanging the result of such elaboration. We propose an open and modular multi-agent framework for handling exceptions using agent dialogues and assumption-based argumentation as the underlying logic.

The success of contract-based multiagent systems relies on agents complying with their commitments. When something goes wrong, it is important to understand what are the commitments' mutual relations as well as their individual states. Accordingly, we explore how commitments are related through the three-agent commitment delegation operation. We then propose exception monitoring based on such relations, and demonstrate it via a case study.

We show an application of Assumption-Based Argumentation for reasoning about and handling exceptions in multiagent contracts. We show that this solution enjoys interesting properties regarding the ABA semantics of results obtained and the determinism of diagnostic answers. As a case study, we present the workings of the framework on a delivery process from e-commerce.

Open multiagent systems consist of autonomous agents that are built by different vendors. In principle, open multiagent systems cannot provide any guarantees about the behaviors of their agents. This means that when agents are working together, such as carrying out a business protocol, one agent's misbehavior may potentially create an exception for another agent and obstruct its proper working. Faced with such an exception, an agent should be able to identify the problem by verifying the compliance of other agents. Previous work on verification of protocols unrealistically assume that participants have full knowledge of a protocol. However, when multiple agents enact a protocol, each agent has access to its part of the protocol and not more. This will require agents to check verification by querying others and more importantly by discovering the contracts between them. Here, we propose a commitment-based framework for detecting exceptions in which an agent augments its part of the protocol with its knowledge to construct states that are previously hidden to the agent by generating possible commitments between other agents. The agent then queries others to confirm those states. Our framework is built using C+ and Java, and is tested using a realistic delivery scenario.

This paper studies misalignment of commitments associated with temporal constraints. We propose a diagnosis algorithm where agents reason based on the current states of their commitments. We also provide an alignment policy that can be applied by an agent when the diagnosis algorithm identifies a misalignment. We formalize a delivery process from e-commerce using REC, and present a case study to demonstrate the workings of our approach.

In open multiagent systems, agents need to model their environments in order to identify trustworthy agents. Models of the environment should be accurate so that decisions about whom to interact with can be done soundly. Traditional trust models are based on modeling specific properties of agents, such as their expertise or reliability. Building those models requires too many prior interactions to be accurate. This paper proposes an approach that is based on keeping track of outcomes of agent's actions towards others rather than modeling other agents' performances explicitly. Contrary to existing modeling approaches that require domain knowledge to build models, our proposed approach can be effectively realized in multiagent systems when the agent's actions are clearly identified. Comparisons with other modeling approaches in various environments reveal that our proposed approach can create more precise models in short time and can adjust its behavior quickly when other agents' behaviors change.

In open multiagent systems, agents need to select whom to trust. Traditionally, this selection is done based on the models that are built for the agents in the system. After each interaction with others, agents update their models of others based on the outcome. However, building and maintaining accurate models is difficult especially before many interactions take place. Contrary to traditional modeling approaches, we propose to model the environment in terms of agents' actions and their effects, rather than building individual models for each agent. Based on the effects of its actions, each agent can modify its behavior appropriately. We evaluate our proposed approach in comparison to a traditional approach in the Agent Reputation and Trust (ART) Testbed simulation environment. The simulations compare the two approaches in terms of the accuracy of models, the effectiveness in finding trustworthy agents as well as the effort needed to build accurate models.

We address the problem of extracting useful information contained in security and privacy breach reports. A breach report tells a short story describing how a breach happened and the follow-up remedial actions taken by the responsible parties. By predicting sentences that may follow a breach description using natural language processing, our goal is to suggest security and privacy requirements for practitioners and end users that can be used to prevent and recover from such breaches. We prepare a curated dataset of structured short breach stories using unstructured breach reports published by the U.S. Department of Health and Human Services. We propose a prediction model for inferring held-out sentences based on Paragraph Vector, a document embedding method, and Long Short-Term Memory networks. The predicted sentences can suggest natural language requirements. We evaluate our model on the curated dataset as well as the ROCStories corpus, a collection of five-sentence commonsense stories, and find that the presented model performs significantly better than the baseline of using average word vectors.

Policy design is an important part of software development. As security breaches increase in variety, designing a security policy that addresses all potential breaches becomes a nontrivial task. A complete security policy would specify rules to prevent breaches. Systematically determining which, if any, policy clause has been violated by a reported breach is a means for identifying gaps in a policy. Our research goal is to help analysts measure the gaps between security policies and reported breaches by developing a systematic process based on semantic reasoning. We propose SEMAVER, a framework for determining coverage of breaches by policies via comparison of individual policy clauses and breach descriptions. We represent a security policy as a set of norms. Norms (commitments, authorizations, and prohibitions) describe expected behaviors of users, and formalize who is accountable to whom and for what. A breach corresponds to a norm violation. We develop a semantic similarity metric for pairwise comparison between the norm that represents a policy clause and the norm that has been violated by a reported breach. We use the US Health Insurance Portability and Accountability Act (HIPAA) as a case study. Our investigation of a subset of the breaches reported by the US Department of Health and Human Services (HHS) reveals the gaps between HIPAA and reported breaches, leading to a coverage of 65%. Additionally, our classification of the 1,577 HHS breaches shows that 44% of the breaches are accidental misuses and 56% are malicious misuses. We find that HIPAA's gaps regarding accidental misuses are significantly larger than its gaps regarding malicious misuses.

We propose Kont, a formal framework for comparing normative multiagent systems (nMASs) by computing tradeoffs among liveness (something good happens) and safety (nothing bad happens). Safety-focused nMASs restrict agents' actions to avoid undesired enactments. However, such restrictions hinder liveness, particularly in situations such as medical emergencies. We formalize tradeoffs using norms, and develop an approach for understanding to what extent an nMAS promotes liveness or safety. We propose patterns to guide the design of an nMAS with respect to liveness and safety, and prove their correctness. We further quantify liveness and safety using heuristic metrics for an emergency healthcare application. We show that the results of the application corroborate our theoretical development.

We present a knowledge representation framework that allows an agent situated in an environment to recognise complex activities, reason about their progress and take action to avoid or support their successful completion. Activities are understood as parameterised templates whose parameters consist of a unique name labelling the activity to be recognised, a set of participants co-involved in the carrying out of the activity and a goal revealing the desired outcome the participants seek to bring about. The novelty of the work is the identification of an activity lifecycle where activities are temporal fluents that can be started, interrupted, suspended, resumed, or completed over time. The framework also specifies activity goals and their associated lifecycle, as with activities, and shows how the state of such goals aids the recognition of significant transitions within and between activities. We implement the resulting recognition capability in the Event Calculus and we illustrate how an agent using this capability recognises activities in a personal health system monitoring diabetic patients.

ORC is an ontology reasoning component that builds upon existing ontology modelling tools and techniques to support the integration and interpretation of multimodal medical information. We show how to embed ORC as a reasoning capability in reactive infrastructure agents that support intelligent agents operating in COMMODITY12, a personal health environment for diabetic patients and the medical professionals that treat them. The benefits of the approach are illustrated by showing how medical information for patient profiles at different sources can be included in COMMODITY12, thus extending the generality and potential of the resulting system. The approach also illustrates how ontologies can be combined with a variety of artificial intelligence tools and techniques to support e-Health activities on the Internet, thus contributing towards the vision of NetMedicine.

Commitments are key to contract-based multiagent systems. When agents enter a contract, they project the outcome of the contract based on its content as well as their past experiences and the current world state. We model an agent's projections as individual world states, e.g., a satisfactory state. If the contract is indeed executed to satisfy these projections, then the agent is said to complete the contract successfully. If not, we expect the agent to take proper action. This paper formalizes the notion of projection and its relations, to contract execution. Accordingly, we propose a satisfiability relation to check if an agent's state complies with its projections. We then relate satisfiability to the occurrence of exceptions.

Recently several trust models have been developed. However, different trust models make different assumptions about agents' environments, making it difficult to evaluate and compare different models. An accurate examination requires different models to be tested on the same environment and evaluated using precise metrics. For this reason, we adopt wellknown trust concepts and formulate them as agent strategies that can be applied in the Agent Reputation and Trust (ART) Testbed Simulation Environment. We devise trust strategies that can be applied at different stages of agents' interactions. We study different metrics for each stage and compare various strategies using these metrics.

Guest editors introduction

The presence of children in the online world is increasing at a rapid pace. As children interact with services such as video sharing, live streaming, and gaming, a number of concerns arise regarding their security and privacy as well as their safety. To address such concerns, the UK's Information Commissioner's Office (ICO) sets out 15 criteria alongside a risk management process for developers of online services for children. We present an analysis of 15 ICO criteria for age appropriate design. More precisely, we investigate whether those criteria provide actionable requirements for developers and whether video sharing and live streaming platforms that are used by children of different age ranges (i.e., TikTok, Twitch and YouTube Kids) comply with them. Our findings regarding the ICO criteria suggest that some criteria such as age verification and transparency provide adequate guidance for assessment whereas other criteria such as parental controls, reporting of inappropriate content, and handling of sensitive data need further clarification. Our findings regarding the platforms themselves suggest that they choose to implement the simplest form of self-declared age verification with limited parental controls and plenty of opportunities.