Non-uniform Deblurring for Shaken Images Abstract Photographs taken in low-light conditions are often blurry as a result of camera shake, i.e. a motion of the camera while its shutter is open. Most existing deblurring methods model the observed blurry image as the convolution of a sharp image with a uniform blur kernel. However, we show that blur from camera shake is in general mostly due to the 3D rotation of the camera, resulting in a blur that can be significantly non-uniform across the image. We propose a new parametrized geometric model of the blurring process in terms of the rotational motion of the camera during exposure. This model is able to capture non-uniform blur in an image due to camera shake using a single global descriptor, and can be substituted into existing deblurring algorithms with only small modifications. To demonstrate its effectiveness, we apply this model to two deblurring problems; first, the case where a single blurry image is available, for which we examine both an approximate marginalization approach and a maximum a posteriori approach, and second, the case where a sharp but noisy image of the scene is available in addition to the blurry image. We show that our approach makes it possible to model and remove a wider class of blurs than previous approaches, including uniform blur as a special case, and demonstrate its effectiveness with experiments on synthetic and real images. Everybody is familiar with camera shake, since the resulting blur spoils many photos taken in low-light conditions. While significant progress has been made recently towards removing this blur from images, almost all current approaches to this problem model the blurred image as the convolution of a sharp image with a spatially uniform filter (Chan and Wong 1998; Fergus et al. 2006; Shan et al. 2007; Yuan et al. 2007a ). However, real camera shake, which we show can be (mostly) attributed to the rotation of the camera during exposure, does not in general cause uniform blur, as illustrated by Fig. 1 .. In this paper we propose a geometrically motivated model of non-uniform image blur due to camera shake. By showing that such blur can be mainly attributed to the rotation (as opposed to translation) of the camera during exposure, we develop a global descriptor for such parametrically non-uniform blur, derived from the geometry of camera rotations about a fixed center. Our descriptor can be seen as a generalization of a convolution kernel, and as such our model includes uniform blur as a special case. We demonstrate the effectiveness of our model by using it to replace Fig. 1 Modeling non-uniform blur in a shaken image. The blurry image (a) clearly exhibits blur which is non-uniform, as highlighted at different locations in the image. Using the model proposed in this paper, we can describe this blur using a single global descriptor (b), which in this case has been estimated from the blurry image itself, simply by modifying existing algorithms for blind deblurring (see Sect. 3 for a complete explanation). Close-ups of different parts of the image (c) show the variation in the shape of the blur, which can be accurately reproduced using our model, as shown by the local point spread functions generated from it. As can be seen in (d) and the close-ups in (e), different parts of the image, blurred in different ways, can be deblurred to recover a sharp image the uniform blur model in three existing approaches to camera shake removal, and show quantitative and qualitative improvements in the results.. Specifically, we consider the problems of "blind" deblurring, where only a single blurry image is available, and the case where an additional sharp but noisy image of the same scene is available. To approach these two problems, we apply our model within the frameworks proposed by Miskin and MacKay (2000) and Fergus et al. (2006) , and by Cho and Lee (2009) for the blind case, and Yuan et al. (2007a) for the case of a noisy/blurry image pair. We have proposed a new model for camera shake, derived from the geometric properties of cameras, and applied it to two deblurring problems within the frameworks of existing camera shake removal algorithms. We have validated the model with experiments on real and synthetic data, demonstrating superior results compared to the uniform blur model. The model assumes that the motion of the camera during exposure is limited to rotations about its optical center, and is temporally-agnostic to the distribution over camera orientations. Note, however, that camera rotations that are off the optical center can be modeled by camera rotations about the optical center together with translation; these translations should generally be small for rotation centers that are not far from the optical center. The model is not applicable for non-static scenes, or nearby scenes with large camera translations where parallax effects may become significant.. In the future, we plan to investigate the use of our general bilinear model to other non-uniform blurs. We also plan to investigate means of reducing the computational overhead of the model, for example with the use of a suitable approximation strategy, such as Hirsch et al. (2010) . In this section, we present results with noisy/blurry image pairs, and refer the reader to Sect. 7 for implementation details. Figures 12 and 13 show a comparison between the uniform model and ours, using the algorithm described above to estimate the blur kernels. Having estimated the kernel, we deblur the blurred images using the augmented RL algorithm of Yuan et al. (2007a) . As can be seen from the deblurred images obtained with the two models, our results exhibit more detail and fewer artifacts than those using the uniform blur model. The problem of modeling non-uniform blur is not new, and previous approaches to this problem are diverse, as are the many possible causes of such blurs. Much of the previous work has relied on the local uniformity of the blur, for example, modeling blur due to moving objects as piecewise uniform (Levin 2006; Cho et al. 2007; Chakrabarti et al. 2010) , or approximating a continuously varying blur by a spatially varying combination of localized uniform blurs (Nagy and O'Leary 1998; Vio et al. 2005; Hirsch et al. 2010; Tai et al. 2010a ). Models of non-uniform blur that do not rely on assumptions of local uniformity have been applied under various constrained motion models (Shan et al. 2007; Sawchuk 1974; Klein and Drummond 2005; Tai et al. 2010b) , and while (as in this work) global models are used to describe these continuously varying blurs, the constraints are often restrictive.. Recent work has investigated the automatic estimation of global descriptors for the non-uniform blur caused by camera shake. Joshi et al. (2010) use inertial measurement sensors to estimate the motion of the camera over the course of the exposure. This information can then be used to effectively deblur the captured image. Gupta et al. (2010) propose a model similar to ours, where the blur-causing motions are approximated using image-plane translations and rotations, as opposed to the 3D camera rotations used in this work. Levin et al. (2009) note that the assumption of uniform blur made by most algorithms is often violated, but do not address this fact.. If the point spread function (PSF) for each pixel in an image is known, the problem of recovering a sharp image is generally referred to as non-blind deconvolution, for which standard techniques such as the Wiener filter (for uniform blur) or the Richardson-Lucy algorithm (for general blur) exist (Richardson 1972; Lucy 1974; Banham and Katsaggelos 1997; Puetter et al. 2005) . Sophisticated algorithms for non-blind deconvolution have recently been proposed (Dabov et al. 2008; Shan et al. 2008; Yuan et al. 2008; Couzinie-Devy et al. 2011 ), but their application has generally been limited to the case of uniform blur. Note however that Tai et al. (2009) propose a modified version of the Richardson-Lucy algorithm for deblurring scenes under general projective motion, where the temporal sequence of projective transformations which caused the blur is known.. The task of recovering a sharp image when the pixels' PSFs are unknown, so-called blind deblurring, is a difficult problem. Existing approaches for uniform blur, where a single PSF, or "blur kernel", describes the blur everywhere typically proceed by first estimating this kernel, then applying a non-blind deconvolution algorithm to estimate the sharp image. For uniform blur, Fergus et al. (2006) estimate the kernel by first applying the variational algorithm of Miskin and MacKay (2000) to approximate the posterior for the kernel and sharp image with a simpler distribution. This distribution is chosen such that it is then trivial to estimate the kernel by marginalizing over all possible sharp images. Many different maximum a posteriori (MAP) formulations have also been proposed, such as those of Shan et al. (2008) , Cho and Lee (2009 ), Cai et al. (2009 ), and Xu and Jia (2010 . These algorithms typically use an alternation scheme, updating the estimate of the blur kernel at one step, and of the sharp image at the next. The algorithm proposed by Gupta et al. (2010) for their non-uniform blur model also follows this paradigm. To simplify the deblurring problem, others have considered using additional information in the form of additional blurry images (Rav-Acha and Peleg 2005; Chen et al. 2008) , or a sharp but noisy image of the same scene (Yuan et al. 2007a; Lim and Silverstein 2008) .. The rest of this paper is organized as follows. Section 2 presents our geometric model. Section 3 presents a discrete version of this model. In Sect. 4, we demonstrate its application within two existing algorithms for deblurring a single blurry image, both an approximate marginalization approach and a maximum a posteriori (MAP) approach, and in Sect. 5 we compare the results obtained these two algorithms. In Sect. 6 we examine a second deblurring problem, where a sharp but noisy image of the same scene is available, in addition to the blurry image. In Sect. 7 we describe some of the implementation details for the presented algorithms, and in Sect. 8 we conclude with a discussion of some limitations of our work and potential future research directions. The implementation of the variational kernel estimation method presented in Sect. 4.1 is based on the code made available by Miskin and MacKay (2000) and by Fergus et al. (2006) . 2 We have modified the algorithm to use our blur model and replaced the parameter update equations with the corresponding versions derived for our bilinear blur model in (23)-(26). A package containing our code is available online. 3 The implementation of the image reconstruction algorithm of Krishnan and Fergus (2009) is also based on MAT-LAB code made available online by the authors. 4 The implementations of the Richardson-Lucy algorithm, the algorithm of Cho and Lee (2009) , and the augmented RL algorithm of Yuan et al. (2007a) are our own, and we use these implementations for both uniform and non-uniform blur models when comparing results. A binary executable for Cho and Lee's algorithm is available, however we did not observe an improvement in the results obtained, and thus use our own implementation to permit a fairer comparison between the results from the uniform and non-uniform blur models.

O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


The Degree Distribution of Random k-Trees A power law degree distribution is established for a graph evolution model based on the graph class of k-trees. This k-tree-based graph process can be viewed as an idealized model that captures some characteristics of the preferential attachment and copying mechanisms that existing evolving graph processes fail to model due to technical obstacles. The result also serves as a further cautionary note reinforcing the point of view that a power law degree distribution should not be regarded as the only important characteristic of a complex network, as has been previously argued [1, 16, 17] . Since the discovery of the power-law degree distribution of the web graphs and other complex large-scale networks, many random models for such networks have been proposed [3, 6, 9, 10] . By studying a variety of graph models with a power law degree distribution, it is hoped that one can gain insight into the characteristics of real-world complex networks that are algorithmically exploitable, and can use these models as a tool for empirical studies [7] . It is therefore desirable to have random models that not only exhibit power law degree distributions, but also have other structural features specified in a controlled manner.. Most of the existing models for complex networks define a graph evolution process in which vertices are added to the current graph one at a time. In each time step, the newly-added vertex is connected to a number of existing vertices selected according to some probability distribution. Two popular ways to specify the probability distribution for vertex selection are preferential attachment and copying (also known as duplication).. In the preferential attachment model, an existing vertex is selected with probability in proportion to its vertex degree. In the copying model, neighbors of an existing vertex (selected uniformly at random) are sampled to determine the vertices to connect to.. Bollobas et al. [6] proved the first rigorous result on the power law degree distribution of such graph evolution models, showing that with high probability the degree distribution of the Barabasi-Albert model [3] obeys a power law d −3 . Since then, many variants of the preferential attachment model have been proposed by introducing additional parameters that manipulate the probability with which an existing vertex is to be selected. The motivation is to construct models that obey a power law degree distribution with the exponent depending on some adjustable parameters so that a variety of power law distributions observed in the real-world setting can be modelled. Jordan [13] analyzed a slightly generalized model investigated by Dorogovtsev et al. [11] and showed that for large constant d > 0, the proportion of vertices of degree d follows a power law d −γ with the exponent γ ∈ (2, ∞) determined by two adjustable parameters. Aiello, Chung, and Lu [2] and Cooper and Frieze [9] studied even more general preferential-attachment models with a set of parameters. These parameters specify the number of existing vertices to be selected in each step and control in a probabilistic way how these vertices are selected. A vertex can be selected by sampling uniformly at random from existing vertices or by the preferential attachment mechanism. Among the other results, Cooper and Frieze showed that in their general model the proportion of vertices of degree d > 0 follows a power law with the exponent γ ∈ (2, ∞) determined by the model parameters. In all of the preferential attachment models, it is an essential assumption that the vertices to be connected to the new vertex are selected independently of each other.. The first model with copying mechanism for the web graphs is proposed in [15] . A similar model, called the duplication model, arises in the context of biological networks [8] . With the copying mechanism, a new vertex v n+1 is connected to a set of existing vertices using the following scheme:. 1. An existing vertex v i is selected uniformly at random to copy from. Without any extra work, the above copying mechanism generates a star-like graph centered on the initial graph G 0 . To overcome this limitation, Kumar et al. [15] require that the out-degree (i.e., the number of out-edges) is a constant and implement this by connecting the new vertex to either its neighbors or other vertices selected uniformly at random which is crucial for the construction to work. For the case that the out-degree is 1, it was proved in [15] that the in-degree sequence has a power law distribution with high probability.. In the duplication models studied in [8, 5] , N (v i ) is extended to contain all the neighbors of v i and each vertex in this extended N (v i ) is connected to v n+1 independently with a certain probability. As noted in [5] , a correction step has to be employed to avoid the generation of degenerate graph processes. Power law distributions for the expected fraction of vertices of a given degree are proved in [8, 5] . Cooper and Frieze [9] use a copying scheme in which the neighbors of v n+1 is selected one at a time by repeating the process a number of times independently. This makes the (highly-complicated) analysis more approachable, but spoils to a large extent the idea of the copying mechanism that is intended to capture the phenomenon that neighboring vertices are likely to be connected together to a new vertex.. In this paper, we study a random model for the well-known graph class of k-trees, which may serve as an alternative (and idealized) model in the study of complex networks. The notion of k-trees is a generalization of trees and is closely related to the concept of treewidth in graph theory [14] . We show that the degree distribution of a graph evolution process obtained by a straightforward randomization of the recursive definition of k-trees obeys the power law d. with high probability for large d, where k is the parameter that characterizes the degree to which a graph is tree-like. In addition to introducing an alternative model with preferential attachment and copying mechanisms, we hope that the fact that a power law degree distribution exists in such a graph class with quite unique structural characteristics serves as a further cautionary note, reinforcing the viewpoint that a power law degree distribution should not be regarded as the only important characteristic of a complex network, as has been previously argued in [16, 17] . We note that in [1] , the inherent bias of existing approaches in the empirical study of the Internet graph was identified -it was shown that the widely-used traceroute sampling method "can make power laws appear where none existed in the underlying graphs!". In the next section, we introduce the construction of the random k-treesand discuss its relation to existing models of complex networks. In Section 3, we prove the power law degree distribution of random k-trees. We conclude in Section 4 with a discussion on the construction of random partial k-trees. In this paper, we have shown that a simple evolving graph model based on the the notion of k-trees has a power law degree distribution with high probability. Due to its simplicity and unique structures, we think this model of evolving graphs provides a useful alternative in the modeling, analysis, and simulations of complexity networks such as the web graphs that have attracted much attention [7] . The fact that a power law degree distribution exists in such a graph models with quite unique characteristics also serves as a further cautionary note, reinforcing the viewpoint that a power law degree distribution should not be regarded as the only important feature of a complex network, as has been previously argued in [1, 16, 17] .. A partial k-tree is a subgraph of a k-tree. To enrich the modelling power of the class of models, it is desirable to have a natural model of random partial k-trees. It is tempting to think of the following model based on the construction of the k-tree process: For each vertex v in G k (n), delete randomly-selected (1 − b) * k of its k out-edges for some 0 < b < 1. In [12] , we claimed that a model of random partial k-trees obtained in this way has a power law degree distribution d ) , which turns out to be flawed. A few alternatives have since then been investigated, resulting in very unnatural random models. We leave it as an open question the existence of a natural evolution model for the partial k-trees.

O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B I O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B


DYFRAM: dynamic fragmentation and replica management in distributed database systems In distributed database systems, tables are frequently fragmented and replicated over a number of sites in order to reduce network communication costs. How to fragment, when to replicate and how to allocate the fragments to the sites are challenging problems that has previously been solved either by static fragmentation, replication and allocation, or based on a priori query analysis. Many emerging applications of distributed database systems generate very dynamic workloads with frequent changes in access patterns from different sites. In such contexts, continuous refragmentation and reallocation can significantly improve performance. In this paper we present DYFRAM, a decentralized approach for dynamic table fragmentation and allocation in distributed database systems based on observation of the access patterns of sites to tables. The approach performs fragmentation, replication, and reallocation based on recent access history, aiming at maximizing the number of local accesses compared to accesses from remote sites. We show through simulations and experiments on the DASCOSA distributed database system that the approach significantly reduces communication costs for typical access patterns, thus demonstrating the feasibility of our approach. There is an emerging need for efficient support of databases consisting of very large amounts of data that are created and used by applications at different physical locations. Examples of application areas include telecom databases, scientific databases on grids, distributed data warehouses, and large distributed enterprise databases. In many of these application areas the delay from accessing a remote database is still significant enough to make necessary the use of distributed databases employing fragmentation and replication, a fact also evident recently by increased support for distributed fragmented and replicated tables in commercial products like MySQL Cluster.. In distributed databases, the communication costs can be reduced by partitioning database tables horizontally into fragments, and allocating these fragments to the sites where they are most frequently accessed. The aim is to make most data accesses local, and avoid remote reads and writes. The read cost can be further reduced by the replication of fragments when beneficial. Obviously, important challenges in fragmentation and replication are how to fragment, when to replicate fragments, and how to allocate the (replicated) fragments.. Previous work on data allocation has focused on (mostly static) fragmentation based on analyzing queries. These techniques are only useful in contexts where read queries dominate and where decisions can be made based on SQL-statement analysis. Moreover, they also involve centralized computations based on collected statistics from participating sites. However, in many application areas, workloads are very dynamic with frequent changes in access patterns at different sites. One common reason for this is that their data usage often consists of two separate phases: a first phase where writing of data dominates (for instance during simulation when results are written), and a subsequent second phase when a subset of the data, for example results, is mostly read. The dynamism of the overall access pattern is further increased by different instances of the applications executing in different phases at different sites.. Because of dynamic workloads, static/manual fragmentation and replication may not always be optimal. Instead, the fragment and replication management should be dynamic and completely automatic, i.e., changing access patterns should result in refragmentation and reallocation of fragments when beneficial, as well as in the creation or removal of fragment replicas. In this paper, we present DYFRAM, a decentralized approach for dynamic fragmentation and replica management in distributed database systems, based on observation of access patterns of sites to tables. Fragmentation and replication is performed based on recent access history, aiming at maximizing the number of local accesses compared to accesses from remote sites.. An example of what we aim at achieving with our approach is illustrated in Fig. 1 . It illustrates the access pattern of a database table from two sites. Site 1 has a uniform distribution of accesses, while site 2 has an access pattern with distinct hot spots. In this case, a good fragmentation would generate 6 fragments, one for each of the hot spot areas and one for each of the intermediate areas. A good allocation would be the fragments of the hot spot areas (F 1 , F 3 , and F 5 ) allocated to site 2, with the other fragments (F 2 , F 4 , and F 6 ) allocated to site 1. As will be shown later in the experimental evaluation, DYFRAM will detect this pattern, split the table into appropriate fragments, and then allocate these fragments to the appropriate sites. Whether some of the fragments should be replicated or not depends on the read/write pattern. Note that if the access pattern changes later, this will be detected and fragments reallocated as well as repartitioned if necessary.. The main contributions of this paper are (1) a low-cost algorithm for fragmentation decisions, making it possible to perform refragmentation based on the recent workload, and (2) dynamic reallocation and replication of fragments in order to minimize total access cost in the system. The process is performed in a completely decentralized manner, i.e., without a particular controlling or coordinating site. An important aspect of our approach is the combination of the dynamic refragmentation, reallocation, and replication into a unified process. To the best of our knowledge, no previous work exists that perform this task dynamically during query execution based on both reads and writes in a distributed setting. Our approach is also applicable in a parallel system, since one of our important contributions compared to previous work is that the decisions can be taken without communication of statistics or synchronization between sites.. The organization of the rest of this paper is as follows. In Sect. 2 we give an overview of related work. In Sect. 3 we outline our system and fragment model and state the problem tackled in this work. In Sect. 4 we give an overview of DYFRAM. In Sect. 5 we describe how to manage replica access statistics. In Sect. 6 we describe in detail the dynamic fragmentation and replication algorithm. In Sect. 7 we evaluate the usefulness of our approach. Finally, in Sect. 8, we conclude the paper and outline issues for further work. The problem of fragmenting tables so that data is accessed locally has been studied before. It is also related to some of the research in distributed file systems (see a summary in [14] ). One important difference between distributed file systems and distributed database systems is the typical granularity of data under consideration (files vs. tuples) and the need for a fragmentation attribute that can be used for partitioning in distributed database systems.. Fragmentation is tightly coupled with fragment allocation. There are methods that do only fragmentation [1, 24, 26, 33, 34] and methods that do only allocation of predefined fragments [3, 4, 7, 10, 13, 20, 30] . Some methods also exist that integrate both tasks [9, 11, 17, 19, 25, 27, 29] . Replication, however, is typically done as a separate task [5, 8, 15, 21, 22, 32] , although some methods, like ours, take an integral view of fragmentation, allocation and replication [11, 27, 29] . Dynamic replication algorithms [5, 15, 21, 22, 32] can optimize for different measures, but we believe that refragmentation and reallocation must be considered as alternatives to replication. In DYFRAM we choose among all these options when optimizing for communication costs. Our replication scheme is somewhat similar to that of DIBAS [11] , but DYFRAM also allows remote reads and writes to the master replica, whereas DIBAS always uses replication for reads and do not allow remote writes to the master replica. This operation shipping is important when analyses [8] of replication vs. remote reads and writes conclude that the replication costs in some cases may be higher than the gain from local data access. A key difference between DIBAS and DYFRAM is that DIBAS is a static method where replication is based on offline analysis of database accesses, while DYFRAM is dynamic and does replication online as the workload changes.. Another important categorization of fragmentation, allocation and replication methods is whether they are static or dynamic. Static methods analyze and optimize for an expected database workload. This workload is typically a set of database queries gathered from the live system, but it could also include inserts and updates. Some methods also use more particular information on the data in addition to the query set [26] . This information has to be provided by the user, and is not available in a fully automated system. A form of static method is the design advisor [34] which suggests possible actions to a database administrator. The static methods are used at major database reconfigurations. Some approaches, such as evolutionary algorithms for fragment allocation [3, 10] , lend themselves easily to the static setting.. Static methods look at a set of queries or operations. It can be argued that the workload should be viewed as a sequence of operations, not as a set [2] . Dynamic methods continuously monitor the database and adapt to the workload as it is at the moment and are thus viewing a sequence of operations. Dynamic methods are part of the trend towards fully automatic tuning [31] , which has become a popular research direction. Recently, work has appeared aiming at integrating vertical and physical partitioning while also taking other physical design features like indices and materialized views into consideration [1] . Adaptive indexing [2, 6] aims to create indices dynamically when the costs can be amortized over a long sequence of read operations, and to drop them if there is a long sequence of write operations that would suffer from having to update both base tables and indices. Our work is on tables and table fragments, but shares the idea of amortizing costs over the expected sequence of operations. In adaptive data placement, the focus has either been on load balancing by data balancing [9, 17] , or on query analysis [19] . In our algorithms, we seek to place data on the sites where they are being used (by reads or writes), not to balance the load.. Using our method, fragments are automatically split, coalesced, reallocated and replicated to fit the current workload using fragment access statistics as a basis for fragment adjustment decisions. When the workload changes, our method adjusts quickly to the new situation, without waiting for human intervention or major reconfiguration moments. Closest to our approach may be the work of Brunstrom et al. [7] , which studied dynamic data allocation in a system with changing workloads. Their approach is based on pre-defined fragments that are periodically considered for reallocation based on the number of accesses to each fragment. In our work, there are no pre-defined fragments. In addition to reallocating, fragments can be split and coalesced on the fly. Our system constantly monitors access statistics to quickly respond to emerging trends and patterns.. A third aspect is how the methods deal with distribution. The method can either be centralized, which means that a central site gathers information and decides on the fragmentation, allocation or replication, or it can be decentralized, delegating the decisions to each site. Some methods use a weak form of decentralization where sites are organized in groups, and each group chooses a coordinator site that is charged with making decisions for the whole group [15, 21] .. Among the decentralized systems, we find replication schemes for mobile ad hoc networks (see [23] for an overview). However, these approaches do not consider table fragmentation and in general do replication decisions on a more coarse granularity, e.g., files.. In DYFRAM, fragmentation, allocation and replication decisions are fully decentralized. Each site decides over its own fragments, and decisions are made on the fly based on current operations and recent history of local reads and writes. Contrary to much of the work on parallel database systems, our approach has each site as an entry point for operations. This means that no single site has the full overview of the workload. Instead of connecting to the query processor and reading the WHERE-part of queries, we rely on local access statistics.. Mariposa [27, 28] is a notable exception to the traditional, manually fragmented systems. It provides refragmentation, reallocation and replication based on a bidding protocol. The difference from our work is chiefly in the decision-making process. A Mariposa site will sell its data to the highest bidder in a bidding process where sites may buy data to execute queries locally or pay less to access it remotely with larger access times, optimizing for queries that have the budget to buy the most data. A DYFRAM site will split off, reallocate or replicate a fragment if it optimizes access to this fragment, seen from the fragment's viewpoint. This is performed also during query execution, not only as part of query planning, as is the case in Mariposa.. A summary and feature comparison of our method and related fragmentation, allocation and replication methods is given in Table 1 . We show which features are provided by each method and whether it is a dynamic method that adapts to the workload or a static method that never updates its decision. The methods are also ategorized according to the where the decisions to fragment, allocate and replicate are made. This can be done either centralized to a single site which has the necessary information about the other sites, or decentralized. For the evaluation, we implemented a simulator which allows us to generate distributed workloads, i.e., simulate several sites all performing tuple reads and writes with separate access patterns. In all presented simulation results, the fragmentation and replication decision algorithms were run every 30 seconds. All simulations have been run 100 times, and we present the average values. For each simulated site, the following parameters can be adjusted: -Fragmentation attribute value interval: minimum and maximum values for the accesses from the site. -Access distribution: either uniform or hot spot (10% of the values get 90% of the accesses). -Average rate of tuple accesses in number of accesses per minute. We use a Poisson distribution to generate accesses according to the frequency rate. -Access type: reads, writes or a combination of both.. Values for these parameters need not be constant, but can change at any point for any site in the workload. In our simulations, we have used maximum histogram size of MAX B = 100 buckets, and each table has one fragment with no read replicas when a simulation starts. We also tested with 1000 buckets, but this provided negligible benefits for our workloads.. Unlike most of the relevant previous work, our method tightly integrates fragmentation allocation and replication. Therefore, it does not make much sense comparing against techniques that only perform one of the tasks. Instead, we use the following two fragmentations methods to act as baselines for comparison. The first is a baseline where the table is not fragmented or replicated at all. The table consists of a single fragment with its master replica permanently allocated to the site with the largest total number of accesses. This is what would happen in a database system that does not use fragmentation or replication (e.g., to simplify implementation and configuration), at least given that workloads were completely predictable. Since there is no replication, there are no communication costs from migrations either.. The second allocation method we compare against, is optimal fragmentation. Here we assume full knowledge about future accesses. Each table is (at runtime) fragmented and the fragments are migrated and/or replicated to the sites which would minimize remote accesses.. It should be noted that both these fragment allocation alternatives assume advance knowledge about the fragmentation attribute value interval, distribution, frequency and type of accesses, none of which are required for our dynamic approach.

O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O


Basic Observables for a Calculus for Global Computing We develop the semantic theory of a foundational language for modelling applications over global computers whose interconnection structure can be explicitly manipulated. Together with process distribution, process mobility and remote asynchronous communication through distributed data repositories, the language has primitives for explicitly modelling inter-node connections and for dynamically activating and deactivating them. For the proposed language, we define natural notions of extensional observations and study their closure under operational reductions and/or language contexts to obtain barbed congruence and may testing equivalence. We then focus on barbed congruence and provide an alternative characterisation in terms of a labelled bisimulation. To test practical usability of the semantic theory, we model a system of communicating mobile devices and use the introduced proof techniques to verify one of its key properties. Programming global computational infrastructures for offering uniform services over wide area networks has become one of the main issues in Computer Science. Innovative theories, computational paradigms, linguistic mechanisms and implementation techniques have been proposed that have to face the challenges posed This paper is a much extended and revised version of [15] and was mainly written when the second author was a PhD student in Florence.. Email addresses: denicola@dsi.unifi.it (Rocco De Nicola), gorla@di.uniroma1.it (Daniele Gorla), pugliese@dsi.unifi.it (Rosario Pugliese).. by issues like communication, cooperation, mobility, resource usage, security, failure handling, etc. . We have thus witnessed to the birth of many calculi and kernel languages intended to support programming of global systems and to provide formal tools for reasoning over them. These formalisms in general provide constructs and mechanisms, at different abstraction levels, for describing the execution contexts where applications roam and run, for coordinating and monitoring resources usage, for modelling process communication and mobility, and for specifying and enforcing security policies.. In the last ten years, much research effort has been addressed to study the impact of different communication and mobility paradigms, but little attention has been devoted to modelling the actual network underlying global computers as such: it usually originates from the linguistic choices concerning the mobility paradigm. Some of the proposed foundational languages intend migration as the movement of bare processes; in this case, the network is seen as a fully connected graph of computing sites where new sites can be dynamically added (see, e.g., Dπ-calculus [22] , KLAIM [13] , π 1 -calculus [1] or NOMADIC PICT [35] ). The remaining languages intend migration as the movement of entities with executable content (such as entire sites); in this case, the network is seen as a forest of trees that evolves by adding/pruning/moving subtrees (see e.g., Ambient [9] and its variants, DJoin [18] , Homer [23] , M-calculus [34] , Seal [10] ). However, global computers (e.g. the Internet) are generic graphs: their nodes are neither organised according to tree-like structures nor fully (directly) connected; moreover, connections can unpredictably break down rendering nodes (at least temporarily) unreachable.. To meet the demands arising from modelling the network topology of global computers and its evolution in time, in [16] we have introduced a new modelling language that takes its origin from two formalisms with opposite objectives, namely the programming language X-KLAIM [4, 3] and the π-calculus [26] . The former one is a full fledged programming language based on KLAIM [13] , whereas the latter one is the generally recognised minimal common denominator of calculi for mobility. The resulting model has been called TKLAIM (Topological KLAIM); it retains the main features of KLAIM (distribution, remote operations, process mobility and asynchronous communication through distributed data spaces), but extends it with new constructs to model the evolving interconnection structure underlying a network: TKLAIM provides three specific process primitives to activate, accept and deactivate inter-node connections. Connections become essential to perform remote operations; these are possible only if their source and target nodes are directly connected.. Here, we develop the semantic theory of TKLAIM and introduce two abstract semantics, barbed congruence and may testing, that are obtained as the closure under operational reductions and/or language contexts of the extensional equivalences induced by what we consider basic observables for global computers.. As possible basic observables, we have considered the following ones:. (i) a specific node is up and running (i.e., it provides a datum of any kind), (ii) a specific information is available in (at least) a node, (iii) a specific information is present at a specific node.. Other calculi for global computers make use of (barbed) congruences induced by similar observables; the barbs in Ambient are similar to (i), whereas those in Dπ-calculus are similar to (iii). Within our framework, it can be proved that, by closing observations under any TKLAIM context, the three basic observables all yield the same congruences. This is already an indication of the robustness of the resulting semantic theories. Moreover, the considered observables are sufficiently powerful to yield interesting semantic theories also when considering lower-level features, such as failures [16] .. Of course, after defining equivalences as context closures, it is essential to determine alternative characterisations that permit a better appreciation of their discriminating power and to devise proof techniques that avoid universal quantification over contexts, thus simplifying equivalence checking. For more standard process languages, barbed congruence is characterised via a bisimulation-based equivalence, whereas may testing is characterised via a trace-based equivalence. In [15] , we developed such characterisations for a simplified version of TKLAIM; however, even for that simpler language, it turned out that trace equivalence was very complex and gave (almost) no insight into the discriminating power of may testing. In this paper, we thus focus on the bisimulation-based characterisation of barbed congruence. More precisely, we study the barbed congruence induced by the basic observable (i) above and define its alternative characterisation in terms of a labelled weak bisimilarity.. To this aim, we rely on a labelled transition system (LTS) simpler than the one in [15] and whose distinctive feature is that labels indicate the resources a term offers or requires to the execution context for combined evolution. We then define weak bisimilarity on top of this LTS and present soundness and completeness results with respect to barbed congruence. The actual development of the alternative characterisation, although performed along the lines of similar results for CCS [27] and π-calculus [32, 2] , had to face problems induced by process distribution and mobility, by asynchrony and by the explicit modelling of connections.. To gently introduce the reader to the technicalities of our theory, we start by developing it for the simplified version of TKLAIM presented in [15] , where success of a connection request does not depend on acceptance by the partner. Then, we move to a more sophisticated (and realistic) framework where requests for connection activations must be authorised by the target node. The main difference between the LTS of the simplified and of the full language is the way in which scope of restricted names is opened. In the simplified language, we work like in π-calculus: if the address of a restricted node is transmitted as a datum (the name is extruded), the scope of such name is opened; thus, from the point of view of a receiving process, the node at such address becomes indistinguishable from a free node (the process can freely connect to the restricted node and access it). For the full language, scope handling becomes more critical. Extrusion alone does not suffice to open the scope of a restricted name: if the node is 'unreachable' (i.e., it is not connected with any other node of the net and does not accept/require connections), no receiving process can have access to it. Thus, extruding a name does not completely remove the restriction. For this reason, we introduce the notion of half-restrictions and model opening of the scope in two steps: firstly, a restricted name becomes half-restricted; then, whenever the half-restricted node exhibits/accepts/requires a connection with another node of the net, the half-restriction is removed and the scope is fully opened.. The rest of the paper is organised as follows. In Section 2, we present TKLAIM's syntax and reduction-based semantics and, in Section 3, we define barbed congruence and may testing for it. In Section 4, we consider the simplified version of TKLAIM and develop the alternative characterisation of barbed congruence for it; in Section 5, we then adapt the theory to the full language. In Section 6, we briefly present some sound trace-based laws that can be used to establish may testing and discuss the difficulties of characterising the latter equivalence when considering the language with connection acceptance. In Section 7, we present an example illustrating the use of TKLAIM and of its semantic theories to state and prove properties of global computing applications. In particular, we prove the same equality by using both bisimulation and trace equivalence to compare the two approaches. Finally, in Section 8, we draw some conclusions and briefly discuss some related work.

B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O


Symbolic analysis of network security policies using Rewrite Systems First designed to enable private networks to be opened up to the outside world in a secure way, the growing complexity of organizations make firewalls indispensable to control information flow within a company. The central role they hold in the security of the organization information make their management a critical task and that is why for years many works have focused on checking and analysing firewalls. The composition of firewalls, taking into account routing rules, has nevertheless often been neglected. In this paper, we propose to specify all components of a firewall, i.e. filtering and translation rules, as a rewrite system. We show that such specifications allow us to handle usual problems such as comparison, structural analysis and query analysis. We also propose a formal way to describe the composition of firewalls (including routing) in order to build a whole network security policy. The properties of the obtained rewrite system are strongly related to the properties of the specified networks and thus, classical theoretical and practical tools can be used to obtain relevant security properties of the security policies. Security constitutes a crucial concern in modern information systems. Several aspects are involved, such as user authentication (establishing and verifying users' identity), cryptology (changing secrets into unintelligible messages and back to the original secrets after transmission) and security policies (preventing illicit or forbidden accesses from users to information).. Due to the increasing complexity of organizations, network security policies are rarely defined as a single firewall. Most of the time, they are made up of numerous firewalls whose composition depends on the network topology and on the routing rules. That is why it is often difficult to ensure that the composition of different local security policies (i.e. firewalls) expresses the intended security policy. Their formal specification is thus crucial and for several years now the importance of using formal methods to specify security policies has been generally accepted. For example, to achieve high levels of certification (EAL 1 5, 6, 7) , it is necessary to provide a formal specification enabling to obtain mechanized formal proofs, to carry out techniques for test generation, or to perform static analyses ensuring required properties.. Many methods and tools have been developed for analysing and testing firewall policies. These methods are broken down into two different categories: the active methods and the passive methods. The former consist in sending packets to the network and to make a diagnosis according to the received packets. The main advantage of these methods is that they require no abstract representation of firewalls and thus no error can be introduced between the specification and the implementation. However, such methods have the major drawback of consuming bandwidth, interfering with the traffic and being non exhaustive. That is why we focused on passive methods, that is methods which send no packet and make an offline analysis. Two main categories of passive analysis are investigated in the literature: structural analysis and query analysis. Structural analysis examines the relationships that rules have with other rules within a firewall configuration or across multiple firewalls. A misconfiguration (or conflict) occurs when several rules match the same packet or when a rule can be removed without changing the behavior of the firewall. Query analysis provides a way to ask questions of the form "Which computers in the private network can receive packets from 212.12.30.25 ?". It then consists in defining a language to describe a firewall query and a way to compute its solutions. Some works [13, 1, 6, 21, 12, 28, 2] deal with structural analysis and focus on defining, detecting and discussing misconfigurations while others [23, 17, 30] concentrate on query analysis. Some of these works abstract firewall filtering rules as one or two-dimensional ranges of IP, which does not allow to take completely advantage of the obtained results. Others assume that packets are not modified during their network traversal and then do not support network translation address capabilities. Moreover, they often focus on policies based on a single firewall or do not take into account the network topology. Some of the approaches can handle these various aspects (a detailed comparison between the different techniques could be found in [31] ) but the routing aspects and especially the issues related to their combination with firewall policies are not deeply investigated. More generally, several rewrite based frameworks have already been proposed for specifying and analysing security policies. In particular, [26] introduces a narrowing based method for querying rule based policies and illustrates the proposed technique by the analysis of a standalone firewall policy. This approach can be seen as a first step toward a dedicated and more complete method for rewrite based analysis of firewall security policies.. In this paper, we introduce a new framework, based on rewrite systems and automata, for specifying and analysing firewall security policies. First, we show that this approach is particularly well adapted for the efficient verification of standalone firewall rules. The particular specification we propose here is not only natural since quite close to real world firewall rules but allows also an efficient implementation. We briefly explain how this approach can be used to perform the various types of analyses described in the literature. Second, we extend this approach to take into account the network topology of the network secured by firewall security policies. We show that there is a strong relationship between relevant properties of the secured network and the properties of the rewrite systems used to specify them. We focus here on completeness, i.e. the ability to take a decision for any (routed) packet, and consistency, i.e. the coherence of the final decisions independently of the routing protocol. We consider this approach particularly interesting since the correspondence with the properties of the rewrite systems used for the specifications allowed us to use theoretical and automatic tools to perform these analyses.. The paper is structured as follows. In Section 2 we present notions and notations we use throughout this paper. Section 3 is devoted to the presentation of the rewrite-based framework for specifying and analysing (standalone) firewalls. In Section 4 we address the composition of firewalls with respect to topologies and routing rules. Finally, the last section concludes with some perspectives for further work. We have proposed in this paper an approach to describe firewalls using rewrite systems and automata. We have shown that this approach can be used to perform several kinds of analyses not only for standalone firewalls but also for routed networks of firewalls. In both cases we consider firewalls that can handle NAT rules.. We have shown that this rewrite based specification of firewalls is adapted for verifying usual properties related to the semantics of a firewall (such as completeness) and to perform firewall comparisons. We can also detect the so-called misconfigurations and perform query analyses. Moreover, all these analyses can be performed in the same formalisms and using the same tools.. The same rewrite based approach has been used to specify a network topology together with routing rules and firewall policies. The obtained rewrite system provides an executable specification of the network traffic under the security policy and, because of its form (left-linear, etc.), can be used to effectively perform completeness, reachability and consistency verifications. Some properties, like the consistency, are considered w.r.t. a routing policy or for any routing policy.. The modeling hypotheses assumed in this paper allow us to apply the obtained results in real cases. In particular, the automata operations needed here can be performed quite efficiently. Furthermore, one of the main advantages of using rewrite systems is the possibility to use automatic tools for verifying their properties. Indeed, termination of rewrite systems can be proved using A3PAT (CiME) [11] , AProVE [20] or TTT [27] for example while confluence can be checked using ACP (Automated Confluence Prover) [3] and ground confluence with CrC Maude [14] . Moreover, reachability analysis can be performed using Autowrite [15, 16] (which implements the reachability problem for left-linear growing term rewrite system) or Timbuk [18] and efficient simulations of network traffics can be done using Tom [5] , ELAN [7] or Maude [8] .. We have already started the implementation of the approach presented here. The rewrite systems could be automatically generated starting from a given topology and a security policy and the preliminary results are quite promising. Once again, the particular shape of the rules we used allowed relatively quick automatic termination proofs (around 3s for 200 generated rules).. There are numerous perspectives to this work. Let us just mention that we plan to extend the approach in order to take into account statefull firewalls and to model proxy abilities. More precisely, to completely model TCP connections, we will consider sequences of packets instead of single packets. This should allow us to capture other vulnerabilities such as, for example, denial of services caused by unshared memories of firewalls. Moreover, since proxy abilities essentially con-sist in rewriting sequences of packets, rewrite systems seem to be particularly suitable to model them.

O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B I O O O O O O O O


Multi-level reconfigurable architectures in the switch model In this paper we study multi-level Reconfigurable architectures that can be reconfigured dynamically on two different levels have been proposed in [3] . These architectures allow to adapt the amount of reconfiguration possibilities that are available for (ordinary) reconfigurations to the actual needs. A small amount of reconfiguration possibilities offers less flexibility but has the advantage that dynamic reconfiguration is faster because less reconfiguration bits are necessary to define the new state of the architecture. The lower reconfiguration level of a 2-level reconfigurable architecture corresponds to ordinary reconfiguration operations. On the upper reconfiguration level the reconfiguration capabilities of the reconfigurable resources that are available for the lower level reconfiguration can be reconfigured. The upper level reconfiguration operations were called hyperreconfigurations in [3] . Accordingly there exist two types of (reconfiguration) contexts: i) the ordinary context is defined by the reconfiguration bits that have been loaded onto the architecture during the last reconfiguration operation and ii) the hypercontext is defined by the reconfiguration bits that have been loaded during the last hyperreconfiguration operation. This definition of 2-level reconfiguration is different from the two-level reconfiguration scheme of the MATRIX architecture [5] . MATRIX uses a two level configuration scheme where traditional "instructions" are seen as the lower reconfiguration level. The higher level reconfiguration is used to configure the architectural organization for a computation and the corresponding reconfiguration data are called metareconfiguration data. Several aspects of 2-level reconfigurable architectures have been studied so far. The problem to find for an algorithm that is characterized by a sequence of ordinary reconfiguration operations the best time steps when to perform upper level reconfiguration operations and to determine the corresponding hypercontexts was studied in [3] and called Partition into Hypercontexts (PHC) problem. It was shown that PHC is NP-hard in general but for the so called switch model of 2-level reconfiguration it can be solved in polynomial time. The use of a context cache in 2-level reconfigurable architectures was studied in [2] . It was shown that the PHC problem with cache is NP-complete even in the switch model of 2-level reconfiguration no matter which cache replacement strategy is used. Heuristics to select the contexts that are stored in the upper level cache have been proposed. The fundamental design problem to find the best level of granularity that should be provided for the upper level reconfiguration operations was addressed in [4] .. It has been argued in [3] that architectures with more than two reconfiguration levels might be advantageous to make dynamic reconfiguration even faster. But so far no detailed investigations have been done to explore the concept of multi-level reconfiguration for more than two levels of reconfiguration.. In this paper we introduce a formal model for multilevel reconfigurable architectures and study algorithmic problems for their use. In particular, we define a multi-level reconfigurable Switch model architecture and investigate versions of the PHC problem for this architectures. We extend the results of [3] and show that the PHC problem can be solved optimally in polynomial time also for Switch model reconfigurable architectures with more than 2 levels. The concept of 2-level reconfigurable architectures that can adapt their ability of reconfiguration during runtime in order to speed up ordinary reconfiguration steps has been extended in this paper to multiple reconfiguration levels. We also introduced heterogeneous multi-level reconfigurable architectures where each switch can have a different number of reconfiguration levels. It was shown that optimal reconfigurations with an arbitrary number of reconfiguration levels can be found in polynomial time for the switch cost model. The problem of finding the optimal number of reconfiguration levels (RLP) was shown to be solvable in polynomial time on homogeneous multi-level architectures but it becomes NP-hard for heterogeneous multilevel architectures. experimental results for four applications (8 bit adder, counter, LED-decoder, and simple control circuit) on an architectures that has different reconfigurable units are presented. The results show that multiple reconfiguration level can lead to reduced reconfiguration costs. In the following we evaluate the concept of multiple reconfiguration levels by applying it to four test cases. The test cases consist of reconfigurable designs implemented on the SHyRA architecture as described in [3] . The SHyRA architecture consists of a file of registers, a plane of LUTs, and a MUX and DeMUX that are used as interconnection for moving the data to the LUTs and the results back to the registers. MUX, DeMUX as well as the LUTs are multi-level reconfigurable (see Figure 3 ). For the tests we used an 8 bit ripple carry adder, a counter, an LED-decoder, and a simple control circuit consisting primarily of adders and counters.. The first test case is a 4 bit reconfigurable counter circuit that was implemented on a SHyRA with 2 LUTs and 8 registers. 48 reconfiguration bits are needed to As the fourth test case a part of a simple control circuit is chosen and implemented on the SHyRA using 36 LUTs. Here only the reconfiguration data of the LUTs is taken into account. This way it is ensured that a large portion of the reconfigurable resources is active, because the routing resources do not change very frequently in most parts of the design. The resulting LUT reconfiguration data consists of 144 reconfiguration bits and 141 reconfiguration operations.. The optimal number of reconfiguration levels as well as the minimal reconfiguration costs are obtained by applying Multi phc to architectures with 1 to [m + 1] reconfiguration levels, where m is the number of context requirements for the corresponding test design (see Table 1 ). This solves the RLP problem. Note that the cost reduction in the last column of the table shows the percentage by which the reconfiguration costs are reduced when compared to an architecture of only one reconfiguration level (i.e., only ordinary reconfiguration). Figure 6 shows the optimal reconfiguration costs all test cases and 1-19 reconfiguration levels. In all cases costs decrease with higher number of reconfiguration levels until the optimal number of reconfiguration levels is reached. Then the costs increase with a higher In this case the 4th-level is not very useful and increases only the reconfiguration costs. For analogous reasons the reconfiguration costs for the test cases increase linearly when the number of reconfiguration levels becomes large. In that case for each additional reconfiguration level one reconfiguration has to be done before the first computations. Each such reconfiguration has costs that are equal to the total number of switches used during the computation (in case that the reconfiguration are done according to an optimal solution of the PHC-Switch problem).

O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Bridging the Gap Between Feature- and Grid-based SLAM One important design decision for the development of autonomously navigating mobile robots is the choice of the representation of the environment. This includes the question which type of features should be used or whether a dense representation such as occupancy grid maps is more appropriate. In this paper, we present an approach which performs SLAM using multiple representations of the environment simultaneously. It uses reinforcement to learn when to switch to an alternative representation method depending on the current observation. This allows the robot to update its pose and map estimate based on the representation that models the surrounding of the robot in the best way. The approach has been implemented on a real robot and evaluated in scenarios, in which a robot has to navigate in-and outdoors and therefore switches between a landmark-based representation and a dense grid map. In practical experiments, we demonstrate that our approach allows a robot to robustly map environments which cannot be adequately modeled by either of the individual representations. Building maps is one of the fundamental tasks of mobile robots. In the literature, the mobile robot mapping problem is often referred to as the simultaneous localization and mapping (SLAM) problem. It is considered to be a complex problem, because for localization a robot needs a consistent map of the environment and for acquiring a map a robot requires a good estimate of its location. This mutual dependency between the estimates about the pose of the robot and the map of the environment makes the SLAM problem hard and involves searching for a solution in a high-dimensional space.. A large variety of different estimation techniques has been proposed to address the SLAM problem. Extended Kalman filters, sparse extended information filters, maximum likelihood methods, particle filters, and several other techniques have been applied to estimate the trajectory of the robot as well as a map of the environment. Most approaches to mapping use a single scheme for representing the environment. Among the most popular ones are feature-based models such as sets of landmarks or dense representations such as occupancy grids. In a practical robotic application, the decision which model to use is largely influenced by the type of the environment the robot is deployed in. In large open spaces with predefined landmarks, for example, feature-based approaches often are preferred, whereas occupancy grid maps have widely been used in unstructured environments. In real world scenarios, however, one generally cannot assume that the environment is uniformly covered by specific features. Consider, for example, a surveillance system which can operate both inside of buildings and outside on parking spaces or large outdoor storage areas. Such a system has to be capable of dynamically choosing the best representation in each area to maximize its robustness.. The contribution of this paper is a novel approach which allows a mobile robot to utilize different rep-resentations of the environment. At the example of a combination of feature-based models with occupancy grid maps we describe how a robot can perform the mapping process using both types of representation. It applies reinforcement learning to select the representation that is best suited to model the area surrounding the robot based on the current sensor observations and the state of the filter. We apply the approach in the context of a Rao-Blackwellized particle filter to maintain the joint posterior about the trajectory of the robot and the map of the environment.. As we will demonstrate in the experiments, our approach outperforms pure grid and pure featurebased approaches. Furthermore, our approach allows for modeling heterogeneous environments which cannot be adequately represented by either of the single representations. A motivating example is shown in Figure 1 . Here, the environment consists of outdoor and indoor parts. A feature-based representation is well suited to model the outdoor part ( Figure 1a) but cannot be used to correct odometry errors inside the buildings due to the lack of relevant features. A grid-based representation, in contrast, leads to false matches in the outdoor parts due to the sparsity of non max-range measurements there but accurately represents the inside of the buildings (see Figure 1b) . Our system combines the advantages of both representations to generate a consistent map (Figure 1c) . This paper is organized as follows. After a discussion of related work, we briefly introduce the SLAM approach utilized in this paper, namely RaoBlackwellized particle filters, in Section 3. Whereas Section 4 presents our approach for mapping with a dual representation of the environment, Section 5 explains our model selection technique based on reinforcement learning. Finally, we present experimental results obtained in simulation and on real robots in Section 6. In this paper, we presented an improved approach to learning models of the environment with a RaoBlackwellized particle filter. Our approach maintains feature maps as well as grid maps simultaneously to represent spatial structures. This allows the robot to select the model which provides the best expected estimates online. The model selection procedure is obtained by a reinforcement learning approach. The robot considers the previous estimate as well as the current observations to chose the model that will be used in the upcoming correction step. The process itself is independent of the actual feature detector. Our approach has been implemented and evaluated on real robot data as well as in simulation experiments. We showed that the presented technique allows a robot to more robustly learn maps of different types of environments. It outperforms traditional approaches that use only features or only grid maps. In real world experiments, we also showed that our approach is able to map environments which could not be modeled by either of the single approaches. Figure 13 . Results of the parking lot experiment. Deviation of the weighted mean of the samples from the estimated trajectory (using the 80m range scanner). Mapping techniques for mobile robots can be roughly classified according to the map representation and the underlying estimation technique. One popular map representation is the occupancy grid [16] . Whereas such grid-based approaches are computationally expensive and typically require a huge amount of memory, they are able to represent arbitrary objects. It should be noted that to correct the robot pose estimate a certain amount of obstacles in the range of the robot's sensor is needed. This can be a problem if the range of the sensor is short as is the case with small scale laser scanners or if the environment is a large open area.. Feature-based representations are attractive because of their compactness. This is a clear advantage in terms of memory consumption and processing speed. However, such systems rely on predefined feature extractors, which assumes that some structures in the environments are known in advance. This clearly limits the field of action of a robot.. The model of the environment and the applied state estimation technique are often coupled. One of the most popular approaches are extended Kalman filters (EKFs) in combination with predefined landmarks. The effectiveness of the EKF approaches results from the fact that they estimate a fully correlated posterior about landmark maps and robot poses [12, 20] . Their weakness lies in the strong assumptions that have to be made on both the robot motion model and the sensor noise. Moreover, the landmarks are assumed to be uniquely identifiable. There exist techniques [18] to deal with unknown data association in the SLAM context, however, if these assumptions are violated, the filter is likely to diverge [5, 11, 25] .. Thrun et al. [24] proposed a method that uses the inverse of the covariance matrix. The advantage of the sparse extended information filters (SEIFs) is that they make use of the approximative sparsity of the information matrix and in this way can perform predictions and updates in constant time. Eustice et al. [4] presented a technique to make use of exactly sparse information matrices in a delayed-state framework.. In a work by Murphy, Doucet, and colleagues [2, 17] , Rao-Blackwellized particle filters (RBPF) have been introduced as an effective means to solve the SLAM problem. Each particle in a RBPF represents a possible trajectory of the robot and a map of the environment. The framework has been subsequently extended by Montemerlo et al. [14, 15] for approaching the SLAM problem with landmark maps. To learn accurate grid maps, RBPFs have been used by Eliazar and Parr [3] and Hähnel et al. [8] . Whereas the first work describes an efficient map representation, the second presents an improved motion model that reduces the number of required particles. The work of Grisetti et al. [6] describes an improved variant of the algorithm proposed by Hähnel et al. [8] combined with the ideas of FastSLAM2 [14] . Instead of using a fixed proposal distribution, the algorithm computes an improved Gaussian proposal distribution on a perparticle basis on the fly. A further extension of this method which overcomes the limitation of the Gaussian assumption has recently been presented by Stachniss et al. [21] . Additional improvements concerning both runtime and memory requirements have been achieved by Grisetti et al. [7] by reusing already computed proposal distributions.. So far, there exist only very few methods that try to combine feature-based models with grid maps. One is the hybrid metric map (HYMM) approach [10] . It estimates the location of features and performs a triangulation between them. In this triangulation, a so called dense map is maintained which can be transformed according to the update of the corresponding landmarks. This allows the robot to obtain a dense map by using a feature-based mapping approach. However, it is still required that the robot is able to reliably extract landmarks.. A hybrid map is also used in [19] . Sim et al. propose a vision-based SLAM system which extracts 3D point landmarks from stereo camera images. In addition to the map of landmarks, an occupancy grid map is constructed which is used for safe navigation of the robot. In contrast to the approach described in this paper, the SLAM-system is only using the feature map for pose estimation, while the grid map is used for path planning in an exploration task. A similar approach is described by Makarenko et al. [13] . Here, an decision-theoretic exploration algorithm is described which uses a feature map for SLAM and maintains a grid map to determine known and unknown regions of the environment. However, the grid map is not used to correct the estimate of the robot's pose. Another combination of grid and feature maps has been proposed by Ho and Newman [9] . They use grid maps and visual features in a SLAM system. While the grid map generated from laser scans is used for pose estimation, visual features are used to improve the detection of loop closures. Our approach has been evaluated using simulated and real robot data. The experiments have been designed to verify that our mapping approach is able to reduce the error compared to the purely featurebased technique (FastSLAM [15] ) and to the purely grid-based approach [6] . We specifically considered environments which cannot be mapped accurately using one single model. In those cases the result is the same as using the original approach.

O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Watermarking Digital 3-D Volumes in the Discrete Fourier Transform Domain In this paper, a robust blind watermarking method for 3-D volumes is presented. A bivalued watermark is embedded in the Fourier transform magnitude of the 3-D volume. The Fourier domain has been selected because of its scaling and rotation invariance. Furthermore, in order to decrease the detection time, a special symmetry of the watermark is exploited. The proposed method is proven to be resistant to 3-D lowpass filtering, noise addition, scaling, translation, cropping and rotation. Experimental results prove the robustness of this method against the above-mentioned attacks.

O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O