Abstract:
Methods and systems for detecting anomalous communications include simulating a network graph based on community and role labels of each node in the network graph based on one or more linking rules. The community and role labels of each node are adjusted based on differences between the simulated network graph and a true network graph. The simulation and adjustment are repeated until the simulated network graph converges to the true network graph to determine a final set of community and role labels. It is determined whether a network communication is anomalous based on the final set of community and role labels.

Description:
RELATED APPLICATION INFORMATION 
       [0001]    This application claims priority to 62/148,232, filed on Apr. 16, 2015, incorporated herein by reference in its entirety. 
     
    
     BACKGROUND 
       [0002]    1. Technical Field 
         [0003]    The present invention relates to computer and network security and, more particularly, to integrated discovery of node community and role in such networks. 
         [0004]    2. Description of the Related Art 
         [0005]    Enterprise networks are key systems in corporations and they carry the vast majority of mission-critical information. As a result of their importance, these networks are often the targets of attack. Communications on enterprise networks are therefore frequently monitored and analyzed to detect anomalous network communication as a step toward detecting attacks. 
         [0006]    However, accurate and effective detection is difficult if the system lacks knowledge of community and roles. Community represents the working group that a machine belongs to, while role represents the function of the machine (e.g., as an email server, as a data server, as a personal desktop, etc.). It often isn&#39;t possible for users to provide an accurate picture of community and role for an entire network. 
         [0007]    Existing approaches to community and role detection treat the questions separately, for example detecting roles without taking community structures into account and detecting a node&#39;s community while ignoring its role, when in fact communities and roles are tightly coupled and cannot be separated in real networks. 
       SUMMARY 
       [0008]    A method for detecting anomalous communications includes simulating a network graph based on community and role labels of each node in the network graph based on one or more linking rules. The community and role labels of each node are adjusted based on differences between the simulated network graph and a true network graph. The simulation and adjustment are repeated until the simulated network graph converges to the true network graph to determine a final set of community and role labels. It is determined whether a network communication is anomalous based on the final set of community and role labels. 
         [0009]    A system for detecting anomalous communications includes a community and role detection module having a processor configured to simulate a network graph based on community and role labels of each node in the network graph based on one or more linking rules, to adjust the community and role labels of each node based on differences between the simulated network graph and a true network graph, and to repeat said simulation and adjustment until the simulated network graph converges to the true network graph to determine a final set of community and role labels. An anomaly detection module is configured to determine whether a network communication is anomalous based on the final set of community and role labels. 
         [0010]    These and other features and advantages will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0011]    The disclosure will provide details in the following description of preferred embodiments with reference to the following figures wherein: 
           [0012]      FIG. 1  is a block/flow diagram directed to an automatic security intelligence system architecture in accordance with the present principles. 
           [0013]      FIG. 2  is a block/flow diagram directed to an intrusion detection engine architecture in accordance with the present principles. 
           [0014]      FIG. 3  is a block/flow diagram directed to a network analysis module architecture. 
           [0015]      FIG. 4  is directed to a network graph representing communities and roles of nodes in accordance with the present principles. 
           [0016]      FIG. 5  is a block/flow diagram of a method of discovering community and role memberships and detecting anomalies in accordance with the present principles. 
           [0017]      FIG. 6  is a block/flow diagram of a method of detecting anomalies in accordance with the present principles. 
           [0018]      FIG. 7  is a block diagram of a system for discovering community and role memberships and detecting anomalies in accordance with the present principles. 
           [0019]      FIG. 8  is a block diagram of a processing system in accordance with the present principles. 
       
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0020]    In accordance with the present principles, the present embodiments detect communities and roles in a network in an integrated manner. In particular, every node in a network is associated not only with community membership, but also with role membership, so that the system can capture both community and role structures simultaneously. When two nodes attempt to interact (e.g., when forming an edge between two nodes on the graph representing the network), both community and role memberships are considered when determining how probable the link is and, thus, whether the link can be considered anomalous. The community and role of each node is determined, in one embodiment, according to Gibbs sampling-based learning. 
         [0021]    Referring now in detail to the figures in which like numerals represent the same or similar elements and initially to  FIG. 1 , an automatic security intelligence system (ASI) architecture is shown. The ASI system includes three major components: an agent  10  is installed in each machine of an enterprise network to collect operational data; backend servers  200  receive data from the agents  10 , pre-process the data, and sends the pre-processed data to an analysis server  30 ; and an analysis server  30  that runs the security application program to analyze the data. 
         [0022]    Each agent  10  includes an agent manager  11 , an agent updater  12 , and agent data  13 , which in turn may include information regarding active processes, file access, net sockets, number of instructions per cycle, and host information. The backend server  20  includes an agent updater server  21  and surveillance data storage. Analysis server  30  includes intrusion detection  31 , security policy compliance assessment  32 , incident backtrack and system recovery  33 , and centralized threat search and query  34 . 
         [0023]    Referring now to  FIG. 2 , additional detail on intrusion detection  31  is shown. There are five modules in an intrusion detection engine: a data distributor  41  that receives the data from backend server  20  and distributes the corresponding to network level module  42  and host level module  43 ; network analysis module  42  that processes the network communications (including TCP and UDP) and detects abnormal communication events; host level analysis module  43  that processes host level events, including user-to-process events, process-to-file events, and user-to-registry events; anomaly fusion module  44  that integrates network level anomalies and host level anomalies and refines the results for trustworthy intrusion events; and visualization module  45  that outputs the detection results to end users. 
         [0024]    Referring now to  FIG. 3 , additional detail on network analysis module  42  is shown. The network analysis module  42  includes at least three major components: a blue print graph  52  that is a heterogeneous graph constructed from historical dataset  51  of the communications in the enterprise network, with the nodes of the graph representing machines on the enterprise network and edges representing the normal communication patterns among the nodes; a community and role discovery module  53  that automatically discovers the communities and roles of each node in the blueprint graph; and an online processing and anomaly detection module  54  that takes incoming streaming network communication events as input, conducts analysis based on the blueprint graph and community/role information, and outputs detected abnormal network communications (i.e., network anomalies). The online processing and anomaly detection module  52  also updates the blueprint graph. 
         [0025]    Referring now to  FIG. 4 , an exemplary computer network  100  is illustratively depicted in accordance with one embodiment of the present principles. The network  100  is formed from a set of nodes  101 , each of which has a role and a community. In the embodiment of  FIG. 1 , the nodes marked  102  have a community  108 , while the nodes marked  104  have a community  110 . It should be noted that the network graph  100  does not represent a physical network, but instead represents communications between the nodes  101 , with each edge of the graph representing a communications link. There is nothing in principle stopping a node  102  from community  108  from forming a link with a node  104  in community  110 . However, the present embodiments will consider the communities and roles of the nodes  101  in determining whether that link is anomalous. The nodes  101  are described herein as representing individual devices, but it should be understood that in some embodiments a single node  101  may incorporate multiple devices and, conversely, a single device may host multiple nodes  101 . Similarly, a single node  101  may occupy multiple roles. 
         [0026]    It should be understood that nodes  101  in different communities will have a low likelihood of interaction with one another (e.g., a low probability of forming a link). However, one exception is in the case of a node  106  that has a specific role, such as a router or bridge. In this case, the node  106  may belong to one, both, or neither of the communities  108  and  110 , and its role as an intermediary between those two communities will strongly influence its likelihood of forming connections with other nodes  101 . This may be referred to as a background role-based connection. Note though that communities need not be identified with physical network segments—a community may instead simply represent for example a department or other organizational structure that communicates frequently within itself and relatively rarely with other departments. 
         [0027]    Similarly, when two nodes are in the same community they will interact with a higher probability, but roles are also a strong factor. For example, a file server  103  within community  108  may interact more frequently with user terminals  102  than those nodes  102  interact with one another. This may be referred to as a within-community role-based connection. 
         [0028]    Referring now to  FIG. 2 , a method for detecting anomalous links is shown. Block  202  generates an adjacency matrix representation of a blueprint graph, which is a heterogeneous graph constructed from a historical dataset of communications in the network  100 , with nodes  101  representing physical devices on an enterprise network and edges reflecting the normal communication patterns among the nodes  101 . For each pair of nodes in the adjacency matrix, block  204  generates community and role labels. The initial labels generated by block  204  may be random or may be generated according to any initial information that is available (e.g., based on known software installed on respective nodes  101  or based on an existing network map). 
         [0029]    Block  206  then simulates the interactions of node pairs between different communities and roles. The simulation is based on a set of rules for known interactions between community members and according to roles. For example, the nodes  104  marked by the labels as being members of community  110  will have a simulated link between them. In another example, server/client role relationships can be represented as links. This simulation is used to generate a simulated graph blueprint. Block  207  uses the simulated graph blueprint to form a synthetic adjacency matrix for the simulated graph. 
         [0030]    If there are discrepancies between the adjacency matrix and the synthetic adjacency matrix, block  208  adjusts the community and role labels to bring the simulated links closer to the actual links in the blueprint graph. Block  210  then determines whether the synthetic matrix has converged with the real adjacency matrix, such that the links in the simulated graph match those of the blueprint graph. Convergence may be satisfied when the synthetic adjacency matrix is identical to the real adjacency matrix or may alternatively be based on a similarity metric for the matrices, where convergence is reached when the similarity metric is below a threshold. If so, block  212  uses the detected community and role labels to determine whether there is an anomaly. If not, processing returns to block  206  until the synthetic matrix does converge. 
         [0031]    In one example of anomaly detection, consider a first node n 1  that has the role label of, “database server,” and a community label of, “system team.” A second node n 2  has the role label of, “email server,” and the community label of, “operational team.” If a new network connection between n 1  and n 2  is detected, the system can determine that the database server of one team will rarely have legitimate need to communicate with the email server of another team (with such information being set by the domain user). Block  212  may then determine that an intrusion has occurred. 
         [0032]    The assignment of labels in block  204  may be performed as a respective community membership vector π i  and a respective role membership vector θ i  for each node i. When a pair of nodes (i,j) attempts to form a link, their community and role membership assignments Z ij   c ,Z ji   c ,Z ij   r ,Z ji   r  are drawn according to a multinomial distribution parameterized by their membership distribution vectors, with Z ij   c  being the community assignment of node i for the pair of nodes (i,j) and Z ij   r  being the role assignment of node i for the pair of nodes (i,j). The question of whether a link is formed is represented as a Bernoulli event based on the community and role assignments of the two nodes and an interaction parameter B that characterizes the interaction probability between two community and role assignment tuples, for example (Z ij   c , Z ij   r ). 
         [0033]    The parameters π, θ, and B are treated as random variables, with Beta prior on each entry of B. The term B δpq  is a Bernoulli distribution, and π i  and θ i  have a multinomial distribution with Dirichlet priors. The present model can then be summarized as follows: 
         [0034]    For each entry (δ, p, q) in B:
       draw B δpq ˜Beta(ξ δpq   1 ,ξ δpq   2 ).       
 
         [0036]    For each node i:
       Draw a community membership vector Z ij   c ˜Dirichlet(α c )   Draw a role membership distribution vector Z ji   c ˜Dirichlet(α r )       
 
         [0039]    For each node pair (i,j):
       Draw node i&#39;s community Z ij   c ˜Multinomial(π i )   Draw node j&#39;s community Z ji   c ˜Multinomial(π j )   Draw node i&#39;s role Z ij   r ˜Multinomial(θ i )   Draw node j&#39;s role Z ji   r ˜Multinomial(θ j )   Draw link E ij ˜Bernoulli (B δ(Z     ij       c     ,Z     ji       c     ),Z     ij       r     ,Z     ji       r   )       
 
         [0045]    Under the above generative model, when the adjacency matrix E ij  is observed, the posterior distribution of hidden variables, such as membership vectors, can be inferred. Given the network communications data, the posterior distribution and, in particular, the posterior mean, of the variables in the model are inferred. Due to the complicated integrals over hidden states in the posterior inference, exact inference is intractable. The present embodiments therefore employ Gibbs sampling inference, though it should be understood that other types of inference may be used instead. 
         [0046]    In Gibbs sampling, a Markov chain is maintained. The chain sequentially reaches its next state by sampling a variable from its distribution when conditioned on current values of all of the other variables. When the Markov chain approaches an equilibrium distribution, the subsequent samples are generated from the target distribution. Using collapsed Gibbs sampling, direct samples of the Dirichlet membership variables π and θ are avoided by integrating those variable out. Thus, only the membership assignments of a pair of nodes (i,j) are sampled at a time according to the pair&#39;s conditional distribution. The conditional distribution P is therefore computed, representing the community and role assignments of the pair of nodes (i,j) given the adjacency matrix E ij  and current assignments of the other node pairs. The conditional distribution P is defined as: 
         [0000]    
       
         
           
             P 
             ∝ 
             
               
                 
                   
                     
                       ( 
                       
                         
                           n 
                           
                             
                               
                                 δ 
                                  
                                 
                                   ( 
                                   
                                     a 
                                     , 
                                     b 
                                   
                                   ) 
                                 
                               
                                
                               pq 
                             
                             + 
                           
                           
                             - 
                             ij 
                           
                         
                         + 
                         
                           ξ 
                           1 
                         
                       
                       ) 
                     
                     
                       E 
                       ij 
                     
                   
                    
                   
                     
                       ( 
                       
                         
                           n 
                           
                             
                               
                                 δ 
                                  
                                 
                                   ( 
                                   
                                     a 
                                     , 
                                     b 
                                   
                                   ) 
                                 
                               
                                
                               pq 
                             
                             - 
                           
                           
                             - 
                             ij 
                           
                         
                         + 
                         
                           ξ 
                           2 
                         
                       
                       ) 
                     
                     
                       1 
                       - 
                       
                         E 
                         ij 
                       
                     
                   
                 
                 
                   
                     n 
                     
                       
                         
                           δ 
                            
                           
                             ( 
                             
                               a 
                               , 
                               b 
                             
                             ) 
                           
                         
                          
                         pq 
                       
                       + 
                     
                     
                       - 
                       ij 
                     
                   
                   + 
                   
                     n 
                     
                       
                         
                           δ 
                            
                           
                             ( 
                             
                               a 
                               , 
                               b 
                             
                             ) 
                           
                         
                          
                         pq 
                       
                       - 
                     
                     
                       - 
                       ij 
                     
                   
                   + 
                   
                     ξ 
                     1 
                   
                   + 
                   
                     ξ 
                     2 
                   
                 
               
                
               
                 ( 
                 
                   
                     h 
                     ia 
                     
                       - 
                       ij 
                     
                   
                   + 
                   
                     α 
                     c 
                   
                 
                 ) 
               
                
               
                 ( 
                 
                   
                     h 
                     jb 
                     
                       - 
                       ij 
                     
                   
                   + 
                   
                     α 
                     c 
                   
                 
                 ) 
               
                
               
                 ( 
                 
                   
                     m 
                     ip 
                     
                       - 
                       ij 
                     
                   
                   + 
                   
                     α 
                     r 
                   
                 
                 ) 
               
                
               
                 ( 
                 
                   
                     m 
                     ip 
                     
                       - 
                       ij 
                     
                   
                   + 
                   
                     α 
                     r 
                   
                 
                 ) 
               
             
           
         
       
     
         [0000]    where a=Z ij   c , b=Z ji   c , p=Z ij   r , q=Z ji   r , h ia  is the count of the node i assigned to community a, m ip  is the count of the node i assigned to role b, n δ(a,b)pq+   −ij  is a count of linked node pairs with community assignments a and b and role assignments p and q, n δ(a,b)pq−   −ij  is a count of unlinked node pairs with community assignments a and b and role assignments p and q, ξ 1  and ξ 2  are scalar Beta hyperparameters for (k, p, q) in the interaction tensor B. 
         [0047]    It is worth noting that the conditional distribution P is proportional to two parts: the rate of link/non-link given the community and role assignments of the two nodes, and the ratio (after normalization) of community and role membership assignments of both nodes. Both parts are calculated by excluding their current assignments. 
         [0048]    The Markov chain can then be initialized by a given community and role membership assignments for all node pairs. The chain can be run by sequentially re-sampling assignments of each pair of nodes conditioned on the rest. Once the assignments of a pair of nodes are updated, the counters n, m and h are also updated. After enough iterations, the Markov chain approaches the equilibrium distribution. The subsequent samples of the community and role assignments can be collected to estimate the posterior distribution of the variables. 
         [0049]    The community membership of node i is Dirichlet distributed, and its mean at a th  dimension is: 
         [0000]    
       
         
           
             
               π 
               ia 
             
             = 
             
               
                 ( 
                 
                   
                     h 
                     ia 
                   
                   + 
                   
                     α 
                     c 
                   
                 
                 ) 
               
               
                 
                   
                     ∑ 
                     
                       a 
                       = 
                       1 
                     
                     
                       K 
                       c 
                     
                   
                    
                   
                       
                   
                    
                   
                     h 
                     ia 
                   
                 
                 + 
                 
                   
                     K 
                     c 
                   
                    
                   
                     α 
                     c 
                   
                 
               
             
           
         
       
     
         [0000]    where K c  is the number of communities and a′ is the Dirichlet hyperparameter for π i . The role membership of the node i is also Dirichlet distributed, and its mean at the p th  dimension is given by: 
         [0000]    
       
         
           
             
               θ 
               ip 
             
             = 
             
               
                 ( 
                 
                   
                     m 
                     ip 
                   
                   + 
                   
                     α 
                     r 
                   
                 
                 ) 
               
               
                 
                   
                     ∑ 
                     
                       p 
                       = 
                       1 
                     
                     
                       K 
                       r 
                     
                   
                    
                   
                       
                   
                    
                   
                     m 
                     ip 
                   
                 
                 + 
                 
                   
                     K 
                     r 
                   
                    
                   
                     α 
                     r 
                   
                 
               
             
           
         
       
     
         [0000]    where K r  is the number of roles and α r  is the Dirichlet hyperparameter for θ i . The interaction tensor B is Beta distributed, with the mean of each entry being estimated by: 
         [0000]    
       
         
           
             
               B 
               kpq 
             
             = 
             
               
                 
                   n 
                   
                     kpq 
                     + 
                   
                 
                 + 
                 
                   ξ 
                   1 
                 
               
               
                 
                   n 
                   
                     kpq 
                     + 
                   
                 
                 + 
                 
                   n 
                   
                     kpq 
                     - 
                   
                 
                 + 
                 
                   ξ 
                   1 
                 
                 + 
                 
                   ξ 
                   2 
                 
               
             
           
         
       
     
         [0050]    Blocks  206  and  207  therefore compute the conditional distribution for each pair of nodes (i, j) and block  208  determines π ia , θ ip , and B kpq . 
         [0051]    Embodiments described herein may be entirely hardware, entirely software or including both hardware and software elements. In a preferred embodiment, the present invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc. 
         [0052]    Embodiments may include a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system. A computer-usable or computer readable medium may include any apparatus that stores, communicates, propagates, or transports the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be magnetic, optical, electronic, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. The medium may include a computer-readable storage medium such as a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk, etc. 
         [0053]    Each computer program may be tangibly stored in a machine-readable storage media or device (e.g., program memory or magnetic disk) readable by a general or special purpose programmable computer, for configuring and controlling operation of a computer when the storage media or device is read by the computer to perform the procedures described herein. The inventive system may also be considered to be embodied in a computer-readable storage medium, configured with a computer program, where the storage medium so configured causes a computer to operate in a specific and predefined manner to perform the functions described herein. 
         [0054]    A data processing system suitable for storing and/or executing program code may include at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code to reduce the number of times code is retrieved from bulk storage during execution. Input/output or I/O devices (including but not limited to keyboards, displays, pointing devices, etc.) may be coupled to the system either directly or through intervening I/O controllers. 
         [0055]    Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters. 
         [0056]    Referring now to  FIG. 3 , a method of performing intrusion detection based on an integrated network-level analysis that includes both community and role information is shown. Block  302  collects data from agents installed on each of the nodes  101 . The agents collect information regarding each node&#39;s activities, including for example host-level activities (e.g., user-to-process events, process-to-file events, user-to-registry events, etc.) and network-level activities (e.g., TCP and UDP connections with other nodes  101  on the network  100 ). 
         [0057]    Block  304  performs a network-level analysis using the collected information. The network-level analysis is described in greater detail above and integrates both node community membership and node role membership to detect anomalous communications. Block  306  performs a host-level analysis based on the collected information to determine whether anomalous behavior has occurred locally within a single node  101 . 
         [0058]    Block  308  integrates the network-level and host-level anomalies to provide intrusion detection events. This may include further contextual analysis to detect interactions between network-level and host-level anomalies, for example noting that certain host-level and network-level anomalies may have greater import when occurring together. Block  310  then presents the detected intrusion events to a user for review and for further action. In some embodiments, block  312  may automatically respond to the intrusion detection event. The response may include, for example, blocking certain network-level communications, restricting access on the level of an individual host, changing security policies, and providing alerts to interested parties, such as a system administrator. Block  312  may consider the specific intrusion information determined by block  308  to determine a best course of action. 
         [0059]    Referring now to  FIG. 4 , a network-level anomaly detection system  400  is shown. The detection system  400  includes a hardware processor  402  and a memory  404 , as well as a network interface  405 . The system  400  further includes certain functional modules that may, in some embodiments, be implemented as software that is stored in the memory  404  and executed by processor  402 . In other embodiments, the functional modules may be implemented as one or more discrete hardware components, for example in the form of an application-specific integrated chip or field programmable gate array. 
         [0060]    The system  400  collects historical data  406  regarding the network  100  via the network interface  405  and stores the historical data  406  in the memory  404 . This historical data  406  includes information that reflects communications between nodes  101  on the network  100  and is provided by agents at the individual nodes  101  that report what each respective node  101  is doing. The historical data  406  is used to construct a blueprint graph  410  of the network  100 , with nodes  101  of the blueprint graph representing individual hosts on the network  100  and edges representing normal communications between the nodes  101 . 
         [0061]    A community and role detection module  408  automatically discovers the community and role memberships of each node  101  in the network  100  as described in detail above. The community and role detection module  408  uses the processor  402  to analyze the blueprint graph  410  and provides membership vectors θ and π. Anomaly detection module  412  uses the membership vectors and the blueprint graph to review incoming information about current network communications and to determine whether a given communication is anomalous. The anomaly detection module  412  furthermore uses the incoming network communications to make adjustments to the blueprint graph  410 , which in turn may lead to adjustments in the community and role memberships. 
         [0062]    Referring now to  FIG. 5 , an exemplary processing system  500  is shown which may represent the network-level anomaly detection system  400 . The processing system  500  includes at least one processor (CPU)  504  operatively coupled to other components via a system bus  502 . A cache  506 , a Read Only Memory (ROM)  508 , a Random Access Memory (RAM)  510 , an input/output (I/O) adapter  520 , a sound adapter  530 , a network adapter  540 , a user interface adapter  550 , and a display adapter  560 , are operatively coupled to the system bus  502 . 
         [0063]    A first storage device  522  and a second storage device  524  are operatively coupled to system bus  502  by the I/O adapter  520 . The storage devices  522  and  524  can be any of a disk storage device (e.g., a magnetic or optical disk storage device), a solid state magnetic device, and so forth. The storage devices  522  and  524  can be the same type of storage device or different types of storage devices. 
         [0064]    A speaker  532  is operatively coupled to system bus  502  by the sound adapter  530 . A transceiver  542  is operatively coupled to system bus  502  by network adapter  540 . A display device  562  is operatively coupled to system bus  502  by display adapter  560 . 
         [0065]    A first user input device  552 , a second user input device  554 , and a third user input device  556  are operatively coupled to system bus  502  by user interface adapter  550 . The user input devices  552 ,  554 , and  556  can be any of a keyboard, a mouse, a keypad, an image capture device, a motion sensing device, a microphone, a device incorporating the functionality of at least two of the preceding devices, and so forth. Of course, other types of input devices can also be used, while maintaining the spirit of the present principles. The user input devices  552 ,  554 , and  556  can be the same type of user input device or different types of user input devices. The user input devices  552 ,  554 , and  556  are used to input and output information to and from system  500 . 
         [0066]    Of course, the processing system  500  may also include other elements (not shown), as readily contemplated by one of skill in the art, as well as omit certain For example, various other input devices and/or output devices can be included in processing system  500 , depending upon the particular implementation of the same, as readily understood by one of ordinary skill in the art. For example, various types of wireless and/or wired input and/or output devices can be used. Moreover, additional processors, controllers, memories, and so forth, in various configurations can also be utilized as readily appreciated by one of ordinary skill in the art. These and other variations of the processing system  500  are readily contemplated by one of ordinary skill in the art given the teachings of the present principles provided herein. 
         [0067]    The foregoing is to be understood as being in every respect illustrative and exemplary, but not restrictive, and the scope of the invention disclosed herein is not to be determined from the Detailed Description, but rather from the claims as interpreted according to the full breadth permitted by the patent laws. It is to be understood that the embodiments shown and described herein are only illustrative of the principles of the present invention and that those skilled in the art may implement various modifications without departing from the scope and spirit of the invention. Those skilled in the art could implement various other feature combinations without departing from the scope and spirit of the invention. Having thus described aspects of the invention, with the details and particularity required by the patent laws, what is claimed and desired protected by Letters Patent is set forth in the appended claims.