  In this paper, we address the knowledge engineering problems for hypothesis
generation motivated by applications that require timely exploration of
hypotheses under unreliable observations. We looked at two applications:
malware detection and intensive care delivery. In intensive care, the goal is
to generate plausible hypotheses about the condition of the patient from
clinical observations and further refine these hypotheses to create a recovery
plan for the patient. Similarly, preventing malware spread within a corporate
network involves generating hypotheses from network traffic data and selecting
preventive actions. To this end, building on the already established
characterization and use of AI planning for similar problems, we propose use of
planning for the hypothesis generation problem. However, to deal with
uncertainty, incomplete model description and unreliable observations, we need
to use a planner capable of generating multiple high-quality plans. To capture
the model description we propose a language called LTS++ and a web-based tool
that enables the specification of the LTS++ model and a set of observations. We
also proposed a 9-step process that helps provide guidance to the domain expert
in specifying the LTS++ model. The hypotheses are then generated by running a
planner on the translated LTS++ model and the provided trace. The hypotheses
can be visualized and shown to the analyst or can be further investigated
automatically.
