Delegate the smartphone user? Security awareness in smartphone platforms Abstract. Smartphone users increasingly download and install third-party applications from official application repositories. Attackers may use this centralized application delivery architecture as a security and privacy attack vector. This risk increases since application vetting mechanisms are often not in place and the user is delegated to authorize which functionality and protected resources are accessible by third-party applications. In this paper, we mount a survey to explore the security awareness of smartphone users who download applications from official application repositories (e.g. Google Play, Apple's App Store, etc.). The survey findings suggest a security complacency, as the majority of users trust the app repository, security controls are not enabled or not added, and users disregard security during application selection and installation. As a response to this security complacency, we built a prediction model to indentify users who trust the app repository. Then, the model is assessed, evaluated, and proved to be statistically significant and efficient. Unlike PC software, smartphone applications (or 'apps') adopt centralized distribution architectures and are usually available to users from app repositories or app marketplaces. These app repositories may either be official (i.e. maintained by the smartphone platform, e.g. Apple's App Store, Microsoft's App Hub), or not (e.g. Amazon Appstore for Android). The security models of smartphone platforms provide different options with respect to the permitted sources of applications (Barrera et al., 2011; Mylonas et al., 2011a) . In addition, the strictness of app vetting controls in an app repository 1 ranges from relaxed app submission in community-based app repositories, such as Google play, to strictly controlled repositories that follow the 'walled garden' model, such as Apple's App Store (Barrera et al., 2011; Mylonas et al., 2011a Mylonas et al., , 2011b . Regardless of how strict and centralized the security model of a platform may be, it always leaves some choice to the user. Again, this delegation can be simply authorizing access to some protected resources, or may give user the choice to infer if an application may impair her security and privacy.. Meanwhile, the rate of downloads for smartphone applications from app repositories is on the rise (Baghdassarian and Milanesi, 2010) . This popularity of smartphone applications has drawn the attention of attackers, who try to use the app repository as a security and privacy attack vector. In this context, an increasing number of malicious applications have already been discovered in app repositories (Felt et al., 2011b; Zhou et al., 2012b) . This is one of the reasons that smartphones have also drawn the security literature's attention. The security literature that focuses on smartphone applications has elaborated on malicious application identification (Egele et al., 2011; Enck et al., 2009 Enck et al., ,2010 Enck et al., , 2011 Nauman et al., 2010; Zhou et al., 2012a Zhou et al., , 2012b Zhou and Jiang, 2012) . Automated scanners have been proposed to aid advanced users deduce whether an application requests permissions that can impair the security and\or privacy of users (Enck et al., 2010; Felt et al., 2011a; Hornyack et al., 2011) . Nonetheless, it is unclear whether the burden of making security decisions is reasonable for normal users. Studies have shown that normal users are not able to make such decisions, nor are able to use security controls adequately (Furnell, 2005 (Furnell, , 2007 Furnell et al., 2006; Whitten and Tygar, 1999) .. In this paper, we examine the security awareness of smartphone users who install applications from official app repositories. We conducted a survey with the aim to answer the following main research questions:. Q1: Do smartphone users enable security controls on their devices? Q2: Do users consider security while choosing and downloading applications? Q3: Do smartphone users trust applications from the official app repository? The survey scope includes only users who download applications from the official app repository of the current popular smartphone platforms, i.e. Android, BlackBerry, iOS, Symbian and Windows Phone. Our survey results indicate a clear lack of smartphone users' security awareness. Contrarily to Q1 and Q2, the security unaware users of Q3 cannot be identified with the use of software, e.g. smartphone agents, Mobile Device Management (MDM) (Redman et al., 2011) , etc. For this reason, we propose and evaluate the effectiveness of a prediction model that identifies users who trust applications from the app repository.. The rest of the paper is organized as follows. The next section presents related work. Section 3 provides the reader with the methodology of the survey. In Sections 4 and 5 the findings from the summary of the sample responses and the essential statistical analysis are presented, respectively. In Section 6 the prediction model is described and its effectiveness is evaluated. Finally, Section 7 includes the survey's limitations, whereas Section 8 includes a discussion of the results and conclusions. The smartphone platforms' security models delegate users to make security decisions while downloading apps from official app repositories. This delegation is heterogeneous, ranging from simply authorizing access to some protected resources, to authorizing the user to deduce whether an app may impair her security and privacy. The survey findings (see Table 21 ) are not in-line with the expectation of smartphones' security models for a reasonable security aware user. In contrast, they suggest that users are not adequately prepared to make appropriate security decisions. The findings of the survey analysis show that the majority of smartphone users believe that downloading applications from the app repository is risk-free. It is unclear why this security complacency exists, as the majority of smartphone users who trust the app repository were unaware whether application testing mechanism is enabled in it. Two factors may be decisive in misleading users. First, the fact that an app is distributed from an official app repository may mislead the users into believing that the app is secure or that security controls exist in the app repository. Second, smartphone users may not be able to realize that their device is not just a telephone. Users who use mobile telephony -and in particular those using fixed telephony -have been accustomed to use voice services in a context with limited threats. In contrast to feature phones and fixed landline devices, smartphones combine the capabilities of a feature phone and a handheld computer and, as a result, it is exposed to the union of threat targeting both devices (Theoharidou et al., 2012) .. On the contrary with what popular permission-driven smartphone security models (e.g. Android, Symbian, Windows Phone, etc.) may expect, our findings suggest that users tend to ignore security messages that are prompted to them. Also, some users were found to be more likely to ignore all messages that an application displays. This is a vulnerability that violates the trust model of smartphone security models. This is since these models assume that smartphone users will thoroughly inspect these messages in order to make correct decisions that affect their privacy and security. It should be noted that this user behaviour, where users click through security messages, is known to exist in other platforms, e.g. Windows UAC (Motiee et al., 2010) , browser messages that warn about invalid SSL certificates and phishing scams (Egelman et al., 2008; Sunshine et al., 2009) . Moreover, users are trained to click through interruptive messages, which appear while they are completing a task (Motiee et al., 2010) , as well as tend to ignore consequent warnings, especially the ones which resemble EULAs. This may partially explain why users did not scrutinize security messages that smartphones prompt them. The importance of this vulnerability is increased due to permission overdeclaration of smartphone applications, i.e. developers tend to request access to more permissions than needed for the API they use (Felt et al., 2011a) . This permission overdeclaration may be exploited by deputy attacks (Felt et al, 2011c , Grace et al., 2011 , or by malicious advertisements (Shekhar et al., 2012 ) that share the permissions of an application.. Our analysis shows that only technically and security savvy users tend to inspect these messages. This is also important, as smartphone devices are becoming more widespread and thus more users who are not security or technical savvy tend to use them. Moreover, the findings show that user security or privacy (e.g. protection from surveillance, unauthorized access to personal data) is not a criterion during app selection from the official repository. Only a few users consider security or privacy issues (3.5%). Finding 5: Users who occasionally inspect security messages or ignore them at all are more likely to disable encryption Finding 6: Users who always inspect security messages are more likely technically and security savvy users Finding 7: Users who ignore security messages are more likely to also ignore agreement messages Finding 8: Non-security savvy users are more likely not to inspect app's reputation Finding 9: Users with usefulness as app selection criterion tend to ignore app reviews and reputation Finding 10: Users who consider security or privacy issues during app selection are more likely security aware users Q3: Do smartphone users trust the app repository? Finding 1: Users believe that downloading apps from the repository is secure (approximately 3/4 users in each platform). Finding 2: Misconceptions were found regarding app testing in the repository Finding 2.1: Users were unaware if app testing takes place in the app repository (~half of the sample population) Finding 2.2: Users expected app testing in repositories that did not use it Finding 2.3: Users reported that app testing was not applied in 'walled gardened' repositories Finding 3: Users were found exposed to malicious applications: Finding 3.1: Users who trust app repository are more likely non security and IT savvy Finding 3.2: Unaware users of smartphone malware more likely trust the app repository Finding 3.3: Users who trust the repository tend to be unaware about smartphone secsoft and tend not use them Finding 4: Users who trust app repository are less likely to always inspect security messages Finding 5: Users with good IT skills more likely to trust app repository, regardless that they tend to be unaware whether app testing takes place in it Other findings: Finding 1: Users who store business data are more likely to store personal data Finding 2: Users unaware about smartphone malware are more likely to store personal data Finding 3: Users who store personal data are more likely to trust the app repository and occasionally inspect security messages Smartphone users were found exposed to several security and privacy threats, as the majority of the available security controls were disabled. Moreover, the results suggest that the res-pondents' technical skills tend to affect the adoption of security controls. In specific users were found to enable encryption, remote data wipe and remote device locator when they tend to be technically savvy. A similar correlation was not found with the use of device password lock. This is expected since this control is available in feature phones and users have been, in general, trained to use simple authentication mechanisms. Nonetheless, our results indicate that users who do not password protect their devices are more likely to be non-security savvy -a correlation which was not found in the other security controls.. Our results indicate that users tend to use the same device both for business and personal purposes. Therefore, the impact of unauthorized access to stored data is greater. Moreover, the majority of smartphone users did not install any third-party security software on their device. However, these users reported that they facilitate security software in their PCs. This denotes a clear asymmetry in the security awareness of users, between the PC and smartphone platform. Furthermore, a considerable number of users reported that smartphone security software is not essential. This attitude towards secsoft may stem from technological parameters, e.g. battery consumption, overall device performance (i.e. delays), false positives and/or cognitive limitations (i.e. unawareness of existing threats and available controls), and/or psychological parameters, i.e. the trust in the application market itself. However, smartphone security software adds an additional line of defence against malware and can protect non-security savvy users at least from the threat of non-sophisticated attackers (Mylonas et al., 2011a) .. Furthermore, the users' belief that applications deriving from the official repository are secure seems to be a severe vulnerability. This is so, as trust in the application repository is more likely to: (a) be encountered in users who are not technology and security savvy, and (b) increase the users' security complacency, as they are more likely not to scrutinize security messages and not use secsoft software. Moreover, this trust is not always justified by the availability of security controls in the app repository (e.g. app testing) or their effectiveness regarding the mitigation of malware. Hence, this user security complacency regarding trust in the app repository may be exploited by attackers who use the repository as a malware infection vector. The users who trust the application repository cannot be identified via software solutions (e.g. software agents, MDM). As such, we provide a prediction model that identifies them. The suggested model performs well enough, even if it is evaluated in a different sample than the one used for its design. As the latter sample includes smartphone users from the United Kingdom, this suggests that the proposed model is not affected by the demographics of the Greek sample. The prediction model can be used by an organization to identify users who have the above mentioned security complacency regarding the app repository and engage them in a relevant training awareness program. The prediction model is prone to Type I errors, which may cause frustration to a user who does not trust the app repository (e.g. she may be asked to undergo relevant security training). However, we argue that that a significant Type I error coupled with a negligible Type II error is a good security trade-off, as far as smartphone awareness is concerned.. For future work we plan to extend our analysis by comparing the smartphone security awareness in selected user subgroups of our sample. We also plan to further explore and compare the security awareness of users with different demographics. Regarding the assessment of the model we conducted the essential statistic tests, so as to ensure: (a) the model's statistical significance, (b) the model's goodness-of-fit, and (c) the minimum sample size requirement for logistic regression. Initially, we tested the null hypothesis that the dependent variable, denoting trust in the app repository, and the seven independent variables x i are unrelated, i.e. the selected predictors variables x i do not contribute to the prediction of the dependent variable TrustRep. We denote with p the probability that the null hypothesis is true and reject it if p<0.05. Table D .2 describes the results of these tests. We reject the null hypothesis (p<0.05), hence our model is statistically significant. The model has seven degrees of freedom, as each of its coefficients has one degree of freedom. Then the model was tested against the HosmerLemeshow goodness-of-fit test (Hosmer and Lemeshow, 2000) , so as to determine whether the model adequately 'fits', i.e. describes, the data. The significance level p in this test must be greater than 0.05, otherwise the model does not adequately fit the data.. Also, we checked the ability of the model's independent variables to explain the variance of the dependent variable (Nagelkerke, 1991) . For this test, the Nagelkerke R 2 value must be in the range [0, 1] . Table D .3 shows that the model was successfully tested against these two tests. Finally, Harrell et al. (1984) argue that for a valid logistic regression model at minimum the sample size must have 10 cases for each candidate predictor (variable) of the instrument. Our sample size meets this requirement, as there exist 36 candidate predictors (n=458, i.e. >10*36=360). Even thought smartphones are well studied in security literature, the relevant research work on the security awareness of smartphone users is currently rather limited and mainly focuses on Android. Chia et al. (2012) studied risk signaling concerning the privacy intrusiveness of Android applications in two application repositories, i.e. Android market 2 and AppBrain.com. Their results suggest that the number of dangerous permissions that an application requests is positively correlated with its popularity. Even though users understand the notion of application popularity, the fact that an application is popular does not imply that it respects the users' privacy. Moreover, their results indicate that the current risk signals employed by an app repository (e.g. developer's website, application reputation) become ineffective over time, as users tend to click through them. Our findings also indicate that users tend to ignore the reputation and the reviews of an application, as well as the security and agreement messages received during application installation from app repositories.. Similarly to our user survey, smartphone users were found to ignore security messages during application installation in (Felt et al., 2012; Kelley et al., 2012) . Moreover, they were unable to comprehend the permissions and the risks that are related with them (Felt et al., 2012; Kelley et al., 2012) . As a result, in both studies the Android security messages did not assist most users to make appropriate security decisions. Our results suggest that the majority of respondents ignore every aspect of security and privacy during application selection, as well as the app's reputation, reviews and security and agreement messages. Nonetheless, when expli-citly asked, a minority of users in the survey conducted by Felt et al. (2012) reported that they have cancelled the installation of an application due to its permission requests. In our survey a minority of users was found to delve into security and agreement messages, who tend to be security and technology savvy.. Finally, in the user study conducted in (Kelley et al., 2012) users erroneously believed that applications undergo security analysis during their submission in the Android Market. In our study we also found such misconceptions about application testing in application markets. Moreover, most users were unaware of the existence of the application testing mechanism. To assess the security awareness of smartphone users, a survey was conducted from September-December 2011, in Athens, Greece. This section presents the survey methodology, as well as some details about the tests mounted so as to ensure the validity and statistical significance of the results.

O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Round Security and Super-Pseudorandomness of MISTY Type Structure Abstract. The security of an iterated block cipher heavily depends on its structure as well as each round function. Matsui showed that MISTY type structure is faster and more robust than Feistel structure on linear cryptanalysis and differential cryptanalysis. On the other hand, Luby and Rackoff proved that the four round Feistel structure is superpseudorandom if each round function fi is a random function. This paper proves that the five round MISTY type structure is super-pseudorandom. We also characterize its round security. The security of an iterated block cipher heavily depends on its structure as well as each round function. There are some well known structures of iterated block ciphers, Feistel structure (for example, DES), MISTY type structure, IDEA type structure and etc. For Feistel structure, Nyberg and Knudsen [7] showed that if each round function is secure against linear cryptanalysis and differential cryptanalysis, then the whole block cipher is immune to both attacks. Matsui showed that MISTY type structure is faster and more robust than Feistel structure on linear cryptanalysis and differential cryptanalysis [4, 5] .. Pseudorandomness is also an important cryptographic criterion of iterated block ciphers. This approach studies the pseudorandomness of the block cipher by assuming that each round function is ideally random. We say that a block cipher is pseudorandom if it is secure against chosen plaintext attack, where the adversary has access only to the forward direction of the block cipher. It is said to be super-pseudorandom if it is secure under both chosen plaintext and chosen ciphertext attacks, where the adversary has access to both directions of the block cipher.. The super-pseudorandomness of Feistel structure has been studied extensively so far. Luby and Rackoff proved that the three round Feistel structure is pseudorandom and the four round Feistel structure is super-pseudorandom if each round function f i is a random function [2] . Patarin gave an alternate proof [8, 9] . Lucks showed that the three round Feistel structure is pseudorandom even if the first round function f 1 is an XOR-universal hash function (not necessarily random) [3] . Naor and Reingold showed that the four round Feistel structure is super-pseudorandom even if the first and the last round functions f 1 and f 4 are XOR-universal [6] . Finally, Ramzan and Reyzin showed that the four round Feistel structure is super-pseudorandom even if the adversary has oracle access to the second and the third round functions f 2 and f 3 , but not super-pseudorandom if the adversary has oracle access to the first or the last round function, f 1 or f 4 [10] .. However, only a little is known about the super-pseudorandomness of MISTY type structure. Sakurai and Zheng showed that the three round MISTY type structure is not pseudorandom, and the four round MISTY type structure is not super-pseudorandom [11] . On the other hand, it is not known if the five round MISTY type structure is super-pseudorandom [11] .. This paper characterizes the super-pseudorandomness of the five round MISTY type structure. We prove that the five round MISTY type structure is super-pseudorandom even if: We also show that it is not super-pseudorandom if the adversary is allowed to have oracle access to the first or the last round function, p 1 or p 5 . Intuitively, our results can be stated as follows. The five round MISTY type structure is super-pseudorandom if: (1) the first and the last rounds have secrecy and only weak randomness, (2) the third and fourth rounds have strong randomness and no secrecy, and (3) the second round has secrecy and only weak randomness, or no secrecy and strong randomness.. To derive our positive results, we use Patarin's approach [8, 9] while Ramzan and Reyzin [10] used the approach of Naor and Reingold [6] .. Related works: About pseudorandomness (but not super-pseudorandomness) Sugita showed that the four round MISTY type structure is pseudorandom [12] , and the five round recursive MISTY type structure is pseudorandom [13] .

B I O B O B I I O O O O O O B I O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I I O O O O O O O O B I I O O O O O O O B I I O O O O O O O O O O O O O O O O O B I I O O O O O O O O B O O O O B I I O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B I I O O O O O O O O O B I I O O O O


A collaborative ontology development tool for information security managers This paper explores the need for a collaborative development tool to allow information security experts to capture their interrelated knowledge in an ontology. Such a tool would enable organisations to make more informed security policy decisions around shared security issues. However, population of ontologies can be time-consuming and error-prone, and current collaborative ontology editing tools require a familiarity with ontology concepts. We present a Web-oriented tool which simplifies ontology population for information security experts, allowing them to develop ontology content without the need to understand ontology concepts. To understand how organisations manage information security knowledge within policies, we consulted two information security managers in large organisations. The WebProtégé collaborative ontology editor was then modified to create a tool with an appropriate knowledge ontology structure that meets their requirements. The same information security managers then evaluated the tool, judging it to be accessible and potentially useful in policy decision-making. Organisations need to manage the security of their information assets to limit potential abuse or damage within business activities. Information security policies are typically formulated which stipulate at an operational level how these assets should be secured across the entire organisation.. Currently, information security policies are generally informed by a mix of "professional opinion", staff experience, technology manufacturer advice and external security standards or regulations (e.g. ISO27001 [3] ). However there are a potentially vast number of disparate information sources; the successful management of which can be complex and time-consuming. Although such knowledge may be consolidated by individual organisations, it is typically kept "in-house".. This knowledge can be aligned in the form of a communal ontology. An ontology can represent both structured and unstructured information security management knowledge within a single body of reference. This would help policy makers to make more informed security policy decisions. Information within the ontology is formalised as a set of concepts, creating an agreedupon vocabulary of IT-security knowledge. The interdependencies between fragments of such knowledge will be exposed, facilitating navigation across related information concepts.. Information security managers and practitioners within different organisations often have to resolve the same or similar IT-security issues (e.g. authentication, remote access, etc.) and explore large amounts of information when doing so. Dissemination of this information throughout the IT security practitioner community in the form of an ontology has not as yet been explored as a specific issue. However, by making collaboration between domain experts an integral part of the knowledge management process, practitioners could share their expertise in an effective manner, deriving increasingly robust solutions to shared security problems.. The Web is a natural platform to host collaborative information security ontology development and facilitate distribution of ontology content. However, current editing tools tend to be complex, generic in nature and aimed at those with experience in ontology creation, and not necessarily those domain experts whose knowledge requires capture. It cannot be assumed that CISOs have the appropriate skills in ontology development, as they may be unable to acquire such skills due to a lack of time, inclination, or technical ability. As a result the process of populating an ontology could prove time-consuming and prone to errors during knowledge capture.. CISOs to ensure that it is both approachable and useful. We also explore how CISOs might use the features of a collaborative ontology editor to derive knowledge to help improve information security policy decision-making within organisations.. Through consultations with two CISOs within large organizations we build a picture of the process of formulating information security policies within organizations, as well as identifying influential factors that arise within this process. Within these consultations we also explore the potential to share the knowledge inherent in these policies with the IT-security practitioner community.. Insights from the CISO consultations inform development of a collaborative Web-based ontology development tool intended to serve CISOs or individuals in similar positions in charge of information security policies for organisations. The tool allows direct capture of knowledge -both from disparate sources and created as professional "know-how" -and integration of this knowledge into a centralised ontology-based knowledge repository. The tool limits the need for users to be familiar with ontology construction.. The CISOs consulted earlier within the research participated in a structured evaluation of the ontology editor tool, providing feedback on tool design and functionality. Evaluation sessions also provided the participants with a tangible software tool around which to discuss the preferences they have for a potential knowledge-sharing environment.. The paper is arranged as follows: Section 2 discusses the need for a collaborative ontology effort and current construction approaches. Section 3 discusses related work in ontology tools and construction; and Section 4 captures the requirements for our tool through consultations with real CISOs. Section 5 details the implementation of the tool while evaluation findings from followup consultations with CISOs are discussed in Section 6. Concluding remarks are presented in Section 7. The tool satisfies the requirements outlined in Section 4.3. A summary of other key points that emerged from the evaluation sessions is as follows:.  The tool is approachable and easy to use. We have shown that the capture and sharing of knowledge between information security experts (namely CISOs or similar) can be enhanced through a collaborative ontology development tool.. Here we have taken the needs of CISOs into consideration through CISO consultations, and developed a collaborative, Webhosted ontology editor tool as a deployable application, allowing community users to record and share their knowledge within the structure of a pre-defined information security ontology.. When formulating information security policies, CISOs typically use numerous disparate information sources whose management can be complex and time consuming. Our tool has the potential to improve the IT policy making process by providing the information security management community with a single, shared, comprehensive reference for information security knowledge.. The tool"s prototype has been evaluated by two CISOs from varying backgrounds, meeting with general praise for both its appearance and functionality. With further development work we look to address concerns raised about the control and quality of content through enhancement of the tool"s collaborative features. This may include provision of a voting system or content-rating scheme.. Future work also hopes to consider the suggestions from participating CISOs for extensions to the underlying ontology structure, alongside incentives to motivate members of the information security management community to contribute knowledge to a tool as described here. This may include the provision of user anonymity guarantees, together with appropriate authentication and verification controls.. We also aim to engage with further CISOs or similar, and deploy our tool within their organisations to help us validate our assumptions relating to how security experts would participate in the collaborative development of information security knowledge. Formalising information security knowledge for the purpose of auditing and aiding with policy making has been shown to be viable through a number of studies (e.g. [8] , [9] , [12] , [22] ). Fenz et al [9] integrate the ISO/IEC 27001 guidelines [3] with their own security ontology which considers the physical aspects of information security. Organisations can use the ontology and accompanying the "OntoWorks" toolset to automatically review and examine IT security policies for ISO 27001 compliance and/or certification.. The ontology by Parkin et al [22] that is used here has also been used by Mace et al [18] as the foundation for an existing information security ontology editing tool tailored for domain experts. Experts are able to intuitively capture and formalise their knowledge while the ontology construction itself is abstracted away. This tool concentrates on single-site deployment, and so is not Web-oriented and lacks collaborative features.. The main features identified for successful collaborative ontology development are discussed in [2] and [19] . These include synchronous/asynchronous communication; proposed content agreement policy; annotation of content and changes; content provenance; concurrency and version control; and personalized views of ontology content.. A host of generic Web-oriented collaborative ontology tools are available aiming themselves at users with varying degrees of experience in ontology construction and offering various techniques in knowledge capture and representation, e.g. [17, 21, 24] . A survey of selected tools is carried out in [5] . OntoWiki [1] serves to decrease the entrance barrier for domain experts to capture their knowledge and collaboratively develop ontologies. OntoWiki combines existing Wiki systems and Semantic Web knowledge representation models. The simplification of knowledge acquisition and presentation is brought about by considering ontologies as "information maps". Each node or concept in the map is represented visually in its own page and allows intuitive viewing, editing and linking to other concepts and resources. COE (Collaborative Ontology Environment) [11] builds on the rapid construction techniques of CmapTools [6] and its concept mapping system to represent domain knowledge. An ontology viewing area and collaborative editing environment are combined within COE which then displays ontologies as concept maps. The tool converts these human readable maps into a machine readable ontology language. Concepts from other Webbased ontologies may be incorporated into an ontology, allowing the capture of knowledge from a wide variety of sources.. These tools are aimed towards the domain expert and primarily attempt to make collaborative ontology development and knowledge sharing more accessible. They do however remain relatively complex, are generic in nature and require a substantial amount of initial training and configuration before knowledge owners can begin the knowledge capture process. An prototype of the tool has been completed to help assess how members of the CISO community could capture and share their knowledge first-hand. The tool strives to allow these experts to construct and/or modify, share and analyse a security ontology at an abstract level without the need to familiarise themselves with ontology technologies.. The open-source ontology editor Web-Protégé [27] forms the foundation of the tool. Web-Protégé is a Web-accessible collaborative ontology editor built with a number of collaborative features that can be tailored to meet our requirements.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O


Time-predictable memory arbitration for a Java chip-multiprocessor In this paper, we propose an approach to calculate worst-case execution times (WCET) of tasks running on a homogeneous Java multiprocessor. These processors access a shared main memory. Hence, the tasks running on different CPUs may influence the execution times of each other. Therefore, we implemented a time division multiple access arbiter that divides the memory access time into equal time slots, one time slot for each CPU. This memory arbitration allows calculating upper bounds for the execution time of Java bytecodes depending on the number of CPUs, the size of the time slot, and the memory access time. A WCET analysis tool can utilize these results and generate temporal, upper bounds for application tasks. We further explore how the size of the time slot and the number of CPUs in the system influence the WCET results. Furthermore, a real-world application task is used to compare the analyzed results with measured execution times. This paper describes the timing analysis of a time-predictable Java multiprocessor with shared memory. We use the simple loop as an example to find the WCET estimates for varying system configurations. In Table 3 , the analyzed WCETs of different system configurations are shown. The number of CPUs is varied between 1 and 32. Additionally, the size of the time slot changes between 3 and 48 clock cycles. The first row of the results Table 3 : Analyzed WCET of the loop example depending on the system configuration.. shows that the WCET of the single JOP is 488 cycles. No number is given for the time slot of this configuration because a single JOP does not have to share the main memory bandwidth.. The second part of the table shows the results of the dual-core JopCMP with varying time slot sizes. In general the WCET increases continuously with larger time slot sizes. The systems with more CPUs show a similar behavior concerning the size of the time slot. When comparing the analyzed WCET results of the 2-way JopCMP, both systems with the time slot equal to 3 and 6 cycles have the same WCET. Only the two bytecodes iaload and iastore of the loop access the main memory. The execution times of all other bytecodes of the loop are not affected by the size of the time slot. The configuration with the time slot equal to 3 results in a WCET of 22 cycles for iaload and 24 cycles for iastore. If the time slot is 6 cycles, the WCETs of iaload=17 and iastore=29 cycles. We can see that the sums of the two WCETs of the bytecodes are the same, independent of whether the size of the time slot equals 3 or 6 cycles. Consequently, the execution times of both loop bodies The WCET result and the measured execution time are the same, because only one execution path exists in the code. Furthermore, one can see that the WCET estimates are tight for CMP versions with minor time slots. The configurations with a slot size of 9 cycles result in the lowest WCETs. The measured execution times vary greatly depending on the time slot. It results in 716 cycles for the 2-way CMP with a 12-cycle time slot. The same system with a slot size equal to 24 cycles executes in only 502 cycles. This result shows that iaload and iastore are frequently executed in only one time slot in the configuration with 24 cycles. In the worst case, they need two time slots to execute, which explains the large difference between the measured and the analyzed execution time.. Furthermore, we used a benchmark called Lift as another example to calculate some WCETs. Lift is a real-world example with an industrial background. This embedded application is a lift controller used in an automation factory. It is part of the embedded Java benchmark suite called JavaBenchEmbedded, as described in [15] . Table 5 shows that the WCET of a single JOP results in 8689 cycles. Each CPU of a dual-core JopCMP with a time slot size of three cycles executes the Lift benchmark in 12391 cycles in the worst case. Therefore, the WCET increases only by 43%. The tricore CMP version experiences an increase of 83% in the execution time compared to the single JOP. Whereas one JOP executes Lift only once, the CMP configuration executes the benchmark three tify, whether to define the size of the time slot larger or smaller. Furthermore, we want to extend the solution and present an idea how tighter WCET estimates can be obtained, in order to increase the accuracy of the analysis.. We will investigate the use of a percentage-based arbitration of the available memory access bandwidth. Hence, the memory bandwidth per CPU will be adjusted, dependent on the workload of the multiple CPUs. For example, if CPU 0 needs 60% of the available memory bandwidth for example, it will receive 60% of the bandwidth share or the time slots accordingly. WCET analysis is crucial to timing analysis of hard real-time systems. The task set of a real-time system requires timing validation by schedulability analysis [4, 8] . Hence, the WCET of each task has to be calculated. If and only if these upper bounds of the execution times are known, the schedulability analysis can be performed. Consequently, the result of the analysis shows whether the deadlines of the tasks will be met (guaranteeing that all tasks can be executed by the system) or not.. WCET analysis has been an active and well-established research area for years in the uniprocessor domain. Both Puschner and Burns [12] , and Wilhelm et al. [20] give a broad overview of the WCET research. Nevertheless, not all these achievements can be applied to multiprocessor systems. They are based on the assumption that tasks are independent and cannot influence each other. Using modern multiprocessors with shared resources (i.e. a shared memory), tasks influence each other's execution times and cannot be analyzed in isolation.. To the best of our knowledge, only one research group (from university of Linköping) has studied the WCET analysis of multiprocessors [1, 13] . These publications are based on a multiprocessor system-on-chip with a shared communication bus, connecting several CPUs with two different types of memory. Each CPU has a private memory and all the processing units share a common memory for communication. A CPU is equipped with instruction and data caches, which are used to fetch data and instructions from the private memory. During execution, a task can only access private memory and no shared data objects. Hence, all input data must be placed into the private memory before the task can start executing. Consequently, in most cases the execution time of the task can never be influenced by other tasks (compare the simple-task model [5] ). However, the communication bus serves as a communication interface between the CPUs and the private memories, and the CPUs and the shared memory. If a cache miss occurs during task execution, data has to be fetched from private memory using the communication bus. Therefore, some sort of bus arbitration is necessary because several CPUs may request a cache line from their private memories simultaneously.. In this paper, we introduce our approach to WCET analysis of a multiprocessor using shared resources. Even though the application tasks running on different CPUs may influence the execution times of each other, we are able to bound the WCET of the real-time tasks.

O O O O O B B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


On Upper Bounds for Toroidal Mosaic Numbers Abstract. In this paper, we construct mosaic representations of knots on the torus, rather than in the plane. This consists of a particular choice of the ambient group A, as well as different definitions of contiguous and suitably connected. We present conditions under which mosaic numbers might decrease by this projection, and present a tool (called waste) to measure this reduction. We show that the order of edge identification in construction of the torus sometimes yields different resultant knots from a given mosaic when reversed. Additionally, in the Appendix we give the catalog of all torus 2-mosaics. This paper was inspired from open question (8) of [1] ; unless otherwise noted, definitions come from [1] . For simplicity of exposition, we will frequently use the term "knot" to mean either a knot or a link, and we adopt the conventions put forth in [1] , making the following adjustments to definitions, and using hats to distinguish toroidal objects from planar objects: Definition 1. A toroidal n-mosaic is an n-mosaic projected onto the torus in R 3 by identifying opposite edges of the n-mosaic. (We examine these mosaics via their matrix representation as given in [1] .) Definition 2. Two tiles in a toroidal n-mosaic are said to be contiguous if they lie immediately next to each other in either the same row or the same column, or are on opposite ends of a row or column (i.e. the tiles in rows 0 and n − 1 in column j are contiguous, as are the tiles in columns 0 and n − 1 of row j). An unoriented tile within a mosaic is said to be toriodally suitably connected if each of its connection points touches a connection point of a contiguous tile.

O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Soft constraint abstraction based on semiring homomorphism The semiring-based constraint satisfaction problems (semiring CSPs), proposed by Bistarelli, Montanari and Rossi [3], is a very general framework of soft constraints. In this paper we propose an abstraction scheme for soft constraints that uses semiring homomorphism. To find optimal solutions of the concrete problem, the idea is, first working in the abstract problem and finding its optimal solutions, then using them to solve the concrete problem.In particular, we show that a mapping preserves optimal solutions if and only if it is an order-reflecting semiring homomorphism. Moreover, for a semiring homomorphism α and a problem P over S, if t is optimal in α(P ), then there is an optimal solutiont of P such thatt has the same value as t in α(P ). In the recent years there has been a growing interest in soft constraint satisfaction. Various extensions of the classical constraint satisfaction problems (CSPs) [10, 9] have been introduced in the literature, e.g., Fuzzy CSP [11, 5, 12] , Probabilistic CSP [6] , Weighted CSP [15, 7] , Possibilistic CSP [13] , and Valued CSP [14] . Roughly speaking, these extensions are just like classical CSPs except that each assignment of values to variables in the constraints is associated to an element taken from a semiring. Furthermore, nearly all of these extensions, as well as classical CSPs, can be cast by the semiring-based constraint solving framework, called SCSP (for Semiring CSP ), proposed by Bistarelli, Montanari and Rossi [3] .. Compared with classical CSPs, SCSPs are usually more difficult to process and to solve. This is mainly resulted by the complexity of the underlying semiring structure. Thus working on a simplified version of the given problem would be worthwhile. Given a concrete SCSP, the idea is to get an abstract one by changing the semiring values of the constraints without changing the structure of the problem. Once the abstracted version of a given problem is available, one can first process the abstracted version and then bring back the information obtained to the original problem. The main objective is to find an optimal solution, or a reasonable estimation of it, for the original problem.. The translation from a concrete problem to its abstracted version is established via a mapping between the two semirings. More concretely, suppose P is an SCSP over S, and S is another semiring (possibly simpler than S). Given a mapping α : S → S, we can translate the concrete problem P to another problem, α(P ), over S in a natural way. We then ask when is an optimal solution of the concrete problem P also optimal in the abstract problem α(P )? and, given an optimal solution of α(P ), when and how can we find a reasonable estimation for an optimal solution of P ?. The answers to these questions will be helpful in deriving useful information on the abstract problem and then taking some useful information back to the concrete problem. This paper is devoted to the investigation of the above questions.. These questions were first studied in Bistarelli, Codognet and Rossi [1] , where they established a Galois insertion-based abstraction framework for soft constraint problems. In particular, they showed that [1, Theorem 27] if α is an order-preserving Galois insertion, then optimal solutions of the concrete problem are also optimal in the abstract problem. This sufficient condition, however, turns out to be equivalent to say α is a semiring isomorphism (see Proposition 6.1), hence too restrictive. Theorem 29 of [1] concerns computing bounds that approximate an optimal solution of the concrete problem. The statement of this theorem as given there is incorrect since a counter-example (see Soft Problem 4 in this paper) shows that the result holds conditionally. This paper shows that semiring homomorphism plays an important role in soft constraint abstraction. More precisely, we show that (Theorem 4.1) a mapping preserves optimal solutions if and only if it is an order-reflecting semiring homomorphism, where a mapping α : S → S is order-reflecting if for any two a, b ∈ S, we have a < S b from α(a) < e S α(b). Moreover, for a semiring homomorphism α and a problem P over S, if t is optimal in α(P ), then there is an optimal solutiont of P such thatt has the same value as t in α(P ) (see Theorem 5.1).. This paper is organized as follows. First, in Section 2 we give a summary of the theory of soft constraints. The notion of α-translation of semiring CSPs is introduced in Section 3, where we show that α preserves problem ordering if and only if α is a semiring homomorphism. Section 4 discusses when a translation α preserves optimal solutions, i.e. when all optimal solutions of the concrete problem are also optimal in the abstract problem. In Section 5, we discuss, given an optimal solution of the abstract problem, what we can say about optimal solutions of the concrete problem. Conclusions are given in the final section. In this paper we proposed a homomorphism based abstraction scheme for soft constraints. The intuition is that we first work in the abstract problem, finding all optimal solutions, and then use them to find optimal solutions of the concrete problem. Surprisingly, our framework turns out to be a generalization of that of de Givry et al. [4] , where they consider totally ordered sets.. In detail, our Theorem 4.1 showed that a mapping preserves optimal solutions if and only if it is an order-reflecting semiring homomorphism; and Theorem 5.1 showed that, for a semiring homomorphism α and a problem P over S, if t is an optimal solution of α(P ), then there is an optimal solution of P , sayt, such thatt is also optimal in α(P ) and has the same value as t. These results greatly improved or generalized those obtained in Bistarelli et al. [1] . Our abstraction framework is closely related to the work of Bistarelli et al. [1] and de Givry et al. [4] .

O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B O O O O O O O O O O O O O O O O O O O B B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O


Movement similarity assessment using symbolic representation of trajectories This article describes a novel approach for finding similar trajectories, using trajectory segmentation based on movement parameters (MPs) such as speed, acceleration, or direction. First, a segmentation technique is applied to decompose trajectories into a set of segments with homogeneous characteristics with respect to a particular MP. Each segment is assigned to a movement parameter class (MPC), representing the behavior of the MP. Accordingly, the segmentation procedure transforms a trajectory to a sequence of class labels, that is, a symbolic representation. A modified version of edit distance called normalized weighted edit distance (NWED) is introduced as a similarity measure between different sequences. As an application, we demonstrate how the method can be employed to cluster trajectories. The performance of the approach is assessed in two case studies using real movement datasets from two different application domains, namely, North Atlantic Hurricane trajectories and GPS tracks of couriers in London. Three different experiments have been conducted that respond to different facets of the proposed techniques and that compare our NWED measure to a related method. Understanding the dynamic behavior of moving objects (e.g., humans, animals, vehicles) or processes (e.g., hurricanes, oil spills) is quickly becoming a key task in many GIScience application domains. In movement behavior studies, it is essential to take into account the key parameters that characterize the movement of objects, the so-called movement parameters (MPs) such as speed, acceleration, or direction (Dodge et al. 2008) . For example, in intelligent transport systems, it is important to know the speed patterns of vehicles across the street network at different times of the day in order to detect traffic anomalies and incidences (Miller and Han 2009) . Likewise, in order to predict the position or time of a hurricane's landfall, it is crucial to know the speed, acceleration, and direction behavior of hurricanes before and close to the landfall (Elsner and Kara 1999) . MPs can be either derived from the trajectories of objects or recorded directly by sensors. Today, with the emergence of new sensor technologies such as accelerometers, gyroscopes, and recent advances of in-vehicle sensors, a variety of movement parameters of mobile objects can be registered as an object moves. The development of analysis techniques that are capable of exploiting these new sources of information thus appears to be a logical step forward for knowledge discovery from movement datasets.. Similarity analysis as an exploratory tool in movement research is an important and challenging topic. Recently, similarity analysis has become the focus of many studies in mobility data mining (Giannotti and Pedreschi 2008; Miller and Han 2009) . A review of the relevant literature suggests that although there are several trajectory similarity search methods that are relatively well developed, most of them are restricted to geometric abstractions of the objects' movement path as a static curve (i.e., a time-ordered sequence of coordinates). And only a few of the available similarity analysis techniques take the variations of MPs into account. However, in many applications spatial similarity alone may not be appropriate to detect objects with similar movement characteristics. For instance, the trajectories of vehicles that move on the same route are similar in terms of geometric shape (i.e., spatial similarity). However, the speed variations of vehicles might exhibit different patterns over time that cannot be discovered with purely spatial similarity assessment. As another example, 'history has shown that many of the hurricanes that have struck New England over the last 100 years share very similar characteristics'. 1 For instance, in 1954 two hurricanes, Carol and Edna, made landfall on Cape Cod, MA, USA and exhibited very similar movement characteristics insofar as they have been known as identical hurricanes in the meteorological literature in terms of their evolution (Malkin and Holzworth 1954) . However, since their movement paths exhibit a distinctively different geometry (see Figure 1 ), these two hurricanes would not be extracted as similar using the available spatial movement similarity measures. By the same token, hurricane Edna and hurricane Isaac, that their movement paths follow a similar geometry as seen in Figure 1 , would be extracted as similar, although their speeds exhibit a very different pattern. Therefore, in addition to the geometric similarity of trajectories, it seems inevitable to investigate the similarity of the variation of MPs over time.. The objective of this article is to contribute to trajectory similarity search, by proposing a new approach that allows seeking for trajectories in movement datasets that exhibit common patterns in the variation of their movement parameters over time. The main contribution of this research is the introduction of a novel technique for spatiotemporal trajectory similarity assessment that relies on trajectory segmentation based on the MPs of the objects under study, yielding segments of homogeneous movement characteristics. In this approach, the variability of MPs, mirrored in the segmentation of trajectories, is used for expressing trajectory similarity, as opposed to a variety of approaches based on shape similarities. The segmentation process leads to a simplified, compressed representation of trajectories, called movement parameter class (MPC) sequence, which converts MP profiles derived from trajectories into a symbolic representation. In this representation, the important movement characteristics are preserved. We propose a modified version of edit distance, termed normalized weighted edit distance (NWED) as the measure of similarity between trajectories. We evaluate NWED in comparison to a relevant similarity measure, called edit distance on movement (EDM), proposed by Chen et al. (2004) . Similar to our approach, EDM applies the edit distance on a symbolic representation of trajectories obtained from the segmentation of two MPs, distance, and direction between fixes. However, there are distinctive differences in how the MPCs and the edit distance are computed, as will be discussed later.. Additionally, we evaluate our proposed method with two applications in trajectory clusterings: (1) exploiting variability of MPCs, using descriptive statistics of the trajectories' MPCs and (2) exploiting sequence of MP classes using NWED. These (1954, green) , exhibited a very similar behavior to her predecessor, (b) hurricane Carol (1954, red) . (c) Hurricane Isaac (2000, blue) exhibited a different speed pattern and yet similar geometry to hurricane Edna. Source: http://www.nhc.noaa.gov/ applications are presented as demonstrations to show how our proposed segmentation and similarity analysis techniques can be applied in conjunction with existing standard clustering techniques, such as hierarchical clustering, DBSCAN, or OPTICS (Nanni and Pedreschi 2006) , for clustering trajectories according to similarities in the spatiotemporal variation of their MPs. The remainder of this article is organized as follows: Section 2 gives a structured overview of previous research on similarity analysis, segmentation of movement data, and trajectory clustering. Section 3 introduces the methodology that is proposed in this research. Section 4 describes two application examples of the developed method in trajectory clustering. Section 5 presents three experiments based on two case studies using the tracking data of hurricanes and couriers in an urban setting, respectively. Section 6 discusses the key findings of the experiments, the strengths, and the limitations of our method in comparison to existing techniques. Finally, Section 7 presents the concluding remarks and outlines directions for future work. In this article, we introduce a new methodology for trajectory similarity detection, which moves similarity analysis beyond considering merely the geometric similarity of trajectories, toward considering movement dynamics. The method bases on the segmentation of MP profiles of an object over time, which can be derived from trajectory data or directly observed using data from tracking sensors.. In our article, we present a comparative evaluation, to show the usefulness of our approach in clustering both hurricane and courier trajectories. Besides, we experimentally evaluate our approach in comparison to a relevant method by Chen et al. (2004) . The experiments show that the proposed NWED similarity measure together with the MPC sequence representation of trajectories can be successfully applied in movement behavior analysis for finding structure in movement datasets. Particularly, when objects exhibit a common movement pattern, our approach becomes more effective in comparison to the available spatial similarity measures. We demonstrate that taking into account the domain and frequency variation of MPs can help identifying interesting patterns in the movement of objects.. Contrary to most existing work, the proposed similarity assessment approach focuses on the parameters describing the dynamic characteristics of movement, and does not deal with any geospatial or geometry-based similarity. As part of our future work, we plan to develop a combined approach that will integrate the proposed methodology with spatial/geometrical similarity analysis. Depending on the requirements of a particular application, one technique could be used as a filtering/pruning stage for the other. For example, in the second case study, we pruned courier subtrajectories to those along a selected route prior to the segmentation. Furthermore, this study shows that segmentation is a useful technique in extracting the structure of trajectories and assisting knowledge discovery in movement data. However, our segmentation applies only one MP at a time. As a future extension of our approach, we intend to develop a trajectory segmentation technique using multiple MPs. Moreover, we also intend to enrich the developed approach by incorporating contextual data. Finally, to alleviate the computational complexity of the proposed method, we are currently developing a multiscale pruning procedure, working from coarse to finer spatial and temporal granularities. Based on the results of our comparative study, we conclude the following:. (1) When the movement characteristics of objects are highly inconsistent over time, the variability in the segmentation results is high, resulting in a large number of short segments. Therefore, exploiting the MPC variability-based similarity (cf. Section 4.1) from the descriptive statistics of the segments works best for clustering trajectories with heterogeneous movement characteristics, that is, when objects exhibit high variability in the variation of their MPs over time (courier data, in our case). (2) In contrast, the MPC sequence-based similarity (cf. Section 4.2) is better suited for clustering movement data with pronounced sequential movement behavior (as the hurricanes, in our case). The reason is that here the adapted string-matching technique helps to detect similar sequences among segmented profiles.. Furthermore, the experiments suggest that applying the NWED similarity measure together with the MPC sequence representation of trajectories is better suited to study the spatiotemporal behavior of moving objects in comparison to related spatial similarity measures (i.e., the EDM measure proposed by Chen et al. 2004 ). That is, as shown in the first case study, our approach is more effective in extracting the similarities in movement data with respect to the evolution patterns of the objects' MPs over time (e.g., the speed behavior of hurricanes) in comparison to the method by Chen et al. (2004) . Although in the experiments using hurricane data at a regular sampling rate, we implicitly involved time in the computation of EDM to make it more comparable to NWED, the study showed that NWED is better suited to capture the spatiotemporal aspects of hurricane evolution. On the other hand, applying the geometric parameters such as turning angle, NWED provides comparable results to EDM, both being geometric similarity measures.. Representing trajectories with a symbolic representation, such as MPC sequences (our approach), or MPS (Chen et al. 2004 ), significantly reduces the storage costs of trajectory data (e.g., to 12.5 % as shown in Chen et al. 2004) . Moreover, the sequence representation is invariant to rotation and spatial transformations since the proposed segmentation algorithm relies on relative MPCs computed between consecutive fixes along trajectories. The advantage of our proposed representation over MPS is that the number of classes and hence the domain of the sequences is much smaller (i.e., 9 classes in our case, 64 classes in MPS). As shown in Du Mouza et al. (2006) , the pattern matching and retrieval costs are less for strings that are represented with a small number of characters (i.e., class labels in our case), especially in very large datasets. Moreover, similar to other edit distancebased approaches, our approach can deal with trajectories of unequal length and unequal sampling rate as well.. On the other hand, the string-matching process is relatively slow and depends on the length of the profiles (i.e., O(n 2 )). Therefore, the proposed methodology is computationally expensive for very large trajectory datasets with long trajectories. This issue is common to all edit distance-based approaches (e.g., NWED and EDM). In order to reduce the computational cost of similarity computation, Chen et al. (2004) proposed a modified frequency distance (MFD) for frequency vectors that are obtained from MPS. This method is similar to our variability-based similarity approach (cf. Section 4.1). However, in the variability-based approach we employ more features in addition to the frequency of classes to describe characteristics of MPs. Besides, similar to variability-based clustering, MFD does not preserve the sequence of a movement. Another strategy to overcome this problem is to apply pruning approaches prior to the similarity computation (Chen et al. 2005) .. Our proposed approach is originally developed for MP profiles. However, the presented methodology can be applied for similarity analysis and clustering of other types of time series (since MP profiles can be seen as a specific type of time series). A similar method has been proposed for addressing threshold queries as well as similarity analysis in time series databases by Aßfalg et al. (2008) . However, their method only considers the deviation (amplitude) of the time series. In contrast, our approach can handle the frequency of variations by considering the sinuosity of time series.. Finally, our study suggests that there can hardly be a universally applicable similarity measure for movement trajectories. Depending on the application at hand, the best-suited similarity measure and the adequate MP must be chosen. Background knowledge about the investigated movement process helps making an informed choice. Such knowledge can come in the form of knowledge about the geographic context embedding the movement (as in the case of the traffic light in Experiment #3). When an object moves about in space over time (Figure 2 .a), the evolution of its movement parameters can be represented as a function or profile over time ( Fig. 2b) . We refer to this function as MP profile. The amplitude and frequency variation of such functions can be quite different for different types of moving objects (Dodge et al. 2009 ). Even more so, the differences may pertain to different episodes of a single object's lifeline, owing to the variability of the underlying physics of movement and the behavior of the object. However, when two or more objects move in a similar way, the corresponding functions will most likely also express similarity. This has led us to using MP profiles for extracting similarities among trajectories, by decomposing the trajectories into segments (i.e., sections) exposing similar movement characteristics. An overview of the main methodology used in this work is illustrated in Figure 2 and explained in detail in the subsequent sections. Our approach relies on a discrete trajectory representation (Figure 2a ), modeling trajectories as a sequence of coordinates over time (Laube et al. 2007 ). The methodology consists of two main processes: (1) trajectory segmentation (Figure 2b and c), and (2) similarity computation ( Figure 2d ). The key component of the segmentation algorithm is the MP profile. The segmentation procedure makes use of the amplitude and frequency variations of MPs over time and will be explained next. The similarity computation uses a variation of the edit distance as described in Section 3.2. We conducted two case studies in order to assess the applicability of the proposed methods. Thereby, we evaluate our segmentation-based similarity measure with two examples where trajectories are clustered based on our similarity. In these two case studies, the proposed methods were applied on two distinct types of movement data, from different application domains and rather with different dynamic behaviors. From the domain of meteorology, we considered tracks of North Atlantic hurricanes, which express rather smooth and predictable trajectories. In contrast, from the transportation domain, GPS trajectories of couriers were analyzed. The latter dataset involves very diverse dynamic behaviors. Additionally, we compared the outcomes of our similarity measure with the one introduced by Chen et al. (2004) . To do so, we conducted a comparative experiment employing hurricane-tracking data since we have the background information from meteorological literature to validate the computed similarities. Table 1 summarizes the objectives of the conducted experiments.

B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O