Developing a SPASE Query Language Abstract The advent of the Virtual Observatory has begun an evolution in the space physics data environment. A number of nascent and discipline specific Virtual Observatories have started to emerge with an emphasis on data search and retrieval. As this new data environment takes shape an emphasis will be placed on interdisciplinary communication in attempts to address large scale and global problems. To this end we formulate the development of a query language to facilitate Virtual Observatory to Virtual Observatory communication. Furthermore, we outline the goals of such a language, how it would work and how existing community efforts can be leveraged to speed the development of this query language. The astronomical community first coined the term Virtual Observatory (VO) 1,2,3 with their work in the creation of a distributed computing system. This system consisted of simultaneous access to disparate and heterogeneous data sources in addition to advanced visualization and analysis tools. In order to facilitate this effort the community developed the Astronomical Data Query Language (ADQL) (Yasuda et al. 2004 ). This query standard was intended to provide interoperability among the data servers. It is implemented through the exchange of XML documents that contain a subset of SQL commands. ADQL has proven beneficial to the astronomical community and a number of systems have been developed that utilize it (O'Mullane et al. 2005; Shirasaki et al. 2006) .. The VO paradigm has begun to influence space physics and a number of nascent VOs are beginning to emerge within this community. In contrast to the astronomical community, which has one VO serving everyone, the NASA space physics community deemed that multiple sub-discipline VOs would be created with the ultimate goal of unification into a grand data access system. In particular, six VOs were commissioned. Figure 1 shows an illustration of the space physics environment from the Sun to the Earth and points out the regions covered by each VO. Additionally, several VOs are being developed independent of NASA, supported by other funding agencies. Although potentially applicable to all space physics VOs, this work focuses primarily on the NASA efforts, as they are the primary users of the data model used in this work.. The Space Physics Archive Search and Extract (SPASE) (Harvey et al. 2004 (Harvey et al. , 2007 4 consortium is an international group of space physics researchers, VO developers and data providers who have taken on the task of creating a comprehensive space physics data model. This data model consists of agreed upon terminology and definitions as well as protocols on how to document a data product for use in the community and use in VOs. It serves as a standard to which the diverse discipline vocabularies can be mapped, thus serving as a lingua franca. The SPASE data model is implementation neutral and the group currently provides an implementation in XML Schema.. Within the NASA VO framework the SPASE data model has been adopted as a metadata standard for exchanging resource descriptions. There exists community consensus amongst the NASA VOs in the use of SPASE and frequent dialogue continues between VO developers and the SPASE consortium. Participation in the consortium is open to all in the community. Updates and additions to the data model are proposed to the consortium and are then debated and potentially ratified. As such, SPASE has become a data model oversight board and its implementation an adhoc standard amongst the NASA VOs. This data model allows VOs to define and classify spacecraft, instruments, data products, and parameters in a clear and consistent manor. Sharing of descriptions is facilitated through unique identifiers assigned to each resource. SPASE affords straightforward comparisons of data products and eases the end user's use and understanding of the data. We see the SPASE data model as the common thread uniting all of the NASA discipline specific VOs and we have devised a method of using SPASE to address the issue of interoperability among the VOs.. Within a given community users may find it sufficient to utilize the programming interface and web services of their VO. However, these often specialized and specific calls make it extremely challenging to communicate with services outside a user's discipline. Furthermore, this reliance on static interfaces creates a barrier to interdisciplinary communication. Additionally, the lack of standards in interface implementation further complicates matters. Thus, addressing large scale and global space physics problems is at present a formidable challenge.. We conceive a SPASE query language to address this challenge, now, while space physics VOs are in their infancy, so that the goal of VO interoperability can be achieved more readily. This query language addresses the issues of interoperability and shares some features of the ADQL solution. It differs from ADQL in that SPASE descriptions are considerably more structured than their IVOA counterparts and a traditional relational approach is insufficient. Specifically, we propose to adopt key aspects of ADQL and combine them with the existing technologies of Document Object Model (DOM) 5 , XQuery 6 and VOTables 7 . The following sections outline our implementation plan and introduce use cases that define our requirements.

O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


UML As Domain Specific Language For The Construction Of Knowledge-Based Configuration Systems In many domains, software development has to meet the challenges of developing highly adaptable software very rapidly. In order to accomplish this task, domain specific, formal description languages and knowledge-based systems are employed. From the viewpoint of the industrial software development process, it is important to integrate the construction and maintenance of these systems into standard software engineering processes. In addition, the descriptions should be comprehensible for the domain experts in order to facilitate the review process.For the realization of product configuration systems, we show how these requirements can be met by using a standard design language (UML-Unified Modeling Language) as notation in order to simplify the construction of a logic-based description of the domain knowledge. We show how classical description concepts for expressing configuration knowledge can be introduced into UML and be translated into logical sentences automatically. These sentences are exploited by a general inference engine solving the configuration task. Shorter product cycles, lower prices of products, and higher customer demands have created big challenges for the product development process. A successful approach to master these challenges is to employ knowledge-based systems with domain specific, high level, formal description languages which allow a clear separation between domain knowledge and inference knowledge. These techniques can be exploited to (partially) automate the generation of software solutions.. Unfortunately, in many cases, such high level, formal description languages are not integrated in the industrial software development process. In addition, these descriptions are difficult to communicate to domain experts for reviewing purposes. This makes it demanding for software development departments to incorporate such technologies into their standard development process. Therefore, our goal is to make such descriptions more accessible both for the software engineering practitioners and domain experts with a technical background.. As an application domain we introduce product configuration a systems which show a high industrial demand. Examples of applications of configuration systems can be found in the telecommunication industry, computer industry or automotive industry.. A configuration task can be characterized through a set of components, a description of their properties, namely attributes and possible attribute values, connection points (ports), and constraints on legal configurations. Given some customer requirements, the result of computing a configuration is a set of components, corresponding attribute valuations, and connections satisfying all constraints and customer requirements.. Product configuration creates big challenges on software development:. • The complexity of the task requires the sophisticated knowledge of technical experts.. • The configuration knowledge base has to be adapted continuously because of changing components and configuration constraints.. • Configurator development time and maintenance time are short and strictly limited. Development of the product and the product configuration system has to be done concurrently.. In order to enhance the usability of formal descriptions we employ UML [5] for two reasons. First, UML is widely applied in industrial software development as a standard design method. Second, we had excellent experiences in using UMLdesigns for validation by technical domain experts. The key idea of our approach is twofold: First, we extend the static model of UML by broadly used configurationspecific modeling concepts. Second, we define a mapping from these concepts to a configuration language based on first-order-logic. Consequently, the construction of a logic-based description of the domain knowledge is simplified. We employ the extension mechanism of UML (stereotypes) to express domain-specific modeling concepts, which has shown to be a promising approach in other areas [17] . The semantics of the different modeling concepts are formally defined by the mapping of the notation to logical sentences.. The proposed development process for valid configuration knowledge bases is shown in Fig. 1 . First, a conceptual model of the configurable product is designed (1) using the modeling language UML. After syntactic checks of the correct usage of the concepts (2) , this model is then non-ambiguously transformed to logical sentences (3) which are exploited by a general configuration engine for computing configurations of products. Consequently, the configurator is based on a declarative, a Product configuration should not be confused with Software Configuration Management, although there are some similarities concerning components and relationships between components. logic based, explicit representation of the configuration knowledge. Finally, the resulting knowledge base is validated by the domain expert (4) using test runs on examples. In the case of unexpected results, the product model can be revised on the conceptual level (5) . If the knowledge base is correct (6) , it can be employed in productive use. The contributions of this paper are broadening the scope of formal approaches as well as the applicability of logic-based, declarative technology within the standard software development process. In addition, we facilitate rapid application development, and enhancement of the validation and maintenance tasks, because these tasks are performed on a conceptual level. Extensible standard design methods (like UML) are able to provide a basis for introducing and applying rigorous formal descriptions of application domains. This approach helps us to combine the advantages of various areas. First, high level formal description languages reduce the development time and effort significantly because these descriptions are directly executable. Second, standard design methods like the UML static model are far more comprehensible and are widely adopted in the established industrial software development process.. We defined a logic based formal semantics for UML constructs, which allows us to generate logical sentences and to process them by a problem solver. This enables us to automate the generation of specialized software applications and allows for rapid generation of prototypes. An improvement in the requirements engineering phase through short feedback cycles is achieved.. The design model is comprehensible for domain experts and can be adapted and validated without the need for specialists. Consequently, time and costs for the development and maintenance of product configuration systems can be reduced significantly. We chose product configuration systems because of the economic and technical relevance and the challenges to be mastered by software engineering of these products. In addition, our concepts correspond to the generation and consistency management of object networks which is related to various other domains.. By using UML as a front-end for formal descriptions, both sides broaden their application area -UML as a notation for formal problem specification and formal descriptions in standard industrial software development processes. Bourdeau and Chen [1] give a formal semantics for object model diagrams based on OMT. This work is an important step in automating the process of obtaining a formal description from the information in the diagrams. They use the Larch Shared Language as their target language since their goal is to support the assessment of requirement specifications in general. A step towards the formalization of UML based on a mathematical system model is done in [2] . We view our work as complementary since our goal is to generate formal descriptions which can be interpreted by logic based problem solvers.. Peltonen, Männistö, Alho, and Sulonen ( [15, 16] ) use product configuration as a practical application for a prototype based approach. They view configuration as a process where objects are created by specifying their parent and the inheritance of information. Our approach is in the tradition of explicitly describing a valid configuration using a declarative language. The process of generating configurations is an automated search process which can be guided by heuristics. Using this approach we have a clear separation of procedural and declarative knowledge as well as a precise semantics of the configuration problem and the content of the knowledge base.. There is a long history in developing configuration tools in knowledge-based systems (see [18] ). However, the automated generation of logic-based knowledge bases by exploiting a formal definition of standard design descriptions like UML has not been discussed so far. Comparable research has been done in the fields of Automated and Knowledge-Based Software Engineering, e.g., the derivation of programs in the Amphion [11] project. In this project, specifications are developed and maintained by end-users in a declarative manner using a graphical language for the astronomical domain. The specification is tested for solvability and program synthesis is done by a theorem prover, which deduces an intermediate program, that is translated to subroutine calls of a target language. The main focus of this project is to automate software reuse, where a procedural program is constructed from existing soft-ware libraries, whereas our approach uses a constraint based inference engine optimized for solving configuration problems.. Consistency management for complex applications as discussed by Tarr and Clarke [20] and product configuration share some interesting common properties. Both application areas have to ensure that an object model is consistent with respect to a set of constraints. However, in consistency management, the goal is mainly to cope with a steady stream of changes resulting in consistency violations. The repair of these violations is a main task. In product configuration, the main task is to generate a valid configuration given some customer requirements. Since our formalism is based on rigorous logic definition, concepts for representing repair actions in order to restore consistency from other consistency based models are applicable. General concepts were developed in the field of model-based diagnosis [6] .. Structural information (components and ports) also plays an important role in the domain of Architecture Description Languages (ADL). Some important work was done in [8] , where common concepts for ADLs and an interchange format are defined. Architectures are (graphically) modeled and represented in first-order-logic allowing for the definition of assertions and additional constraints. The architecture description may then be translated to other existing ADLs. The full semantics of the modeling concepts may vary, depending on the translation to other ADLs. However, in our approach, we use logic not only for representation and model exchange, but have the possibility to interpret the logical sentences derived from the conceptual model.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


How does personality affect trust in B2C e-commerce? Trust is a critical component of successful e-Commerce. Given the impersonality, anonymity, and automation of transactions, online vendor trustworthiness cannot be assessed by means of body language and other environmental cues that consumers typically use when deciding to trust offline retailers. It is therefore essential that the design of e-Commerce websites compensate by incorporating circumstantial cues in the form of appropriate trust triggers. This paper presents and discusses the results of a study which took an initial look at whether consumers with different personality types (a) are generally more trusting and (b) rely on different trust cues during their assessment of first impression vendor trustworthiness in B2C e-Commerce.

O O O O B O O B B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B


Bioinformatic

identification

of

Mycobacterium

tuberculosis

proteins

likely

to

target

host

cell

mitochondria:

virulence

factors?

Background:

M.

tuberculosis

infection

either

induces

or

inhibits

host

cell

death,

depending

on

the

bacterial

strain

and

the

cell

microenvironment.

There

is

evidence

suggesting

a

role

for

mitochondria

in

these

processes.

On

the

other

hand,

it

has

been

shown

that

several

bacterial

proteins

are

able

to

target

mitochondria,

playing

a

critical

role

in

bacterial

pathogenesis

and

modulation

of

cell

death.

However,

mycobacteria-derived

proteins

able

to

target

host

cell

mitochondria

are

less

studied.

Results:

A

bioinformaic

analysis

based

on

available

genomic

sequences

of

the

common

laboratory

virulent

reference

strain

Mycobacterium

tuberculosis

the

avirulent

strain

the

clinical

isolate

and

M.

bovis

BCG

Pasteur

strain

as

well

as

of

suitable

bioinformatic

tools

(MitoProt

II,

PSORT

II,

and

SignalP)

for

the

in

silico

search

for

proteins

likely

to

be

secreted

by

mycobacteria

that

could

target

host

cell

mitochondria,

showed

that

at

least

M.

tuberculosis

proteins

could

possibly

target

host

cell

mitochondria.

We

experimentally

tested

this

bioinformatic

prediction

on

four

M.

tuberculosis

recombinant

proteins

chosen

from

this

list

of

proteins

and

Confocal

microscopy

analyses

showed

that

and

proteins

colocalize

with

mitochondria.Conclusions:

Based

on

the

bioinformatic

analysis

of

whole

M.

tuberculosis

genome

sequences,

we

propose

that

at

least

out

of

M.

tuberculosis

predicted

proteins

would

be

able

to

target

host

cell

mitochondria

and,

in

turn,

control

mitochondrial

physiology.

Interestingly,

such

a

list

of

proteins

includes

five

members

of

a

mycobacteria

specific

family

of

proteins

thought

to

be

virulence

factors,

and

a

well

known

virulence

factor.

and

proteins

experimentally

showed

to

target

mitochondria

in

cells.

Our

results

suggest

a

link

between

mitochondrial

targeting

of

M.

tuberculosis

proteins

and

virulence.

Over

the

past

decade

it

has

been

shown

that

in

addition

to

their

role

in

ATP

production,

mitochondria

also

function

as

signal

transducers

platforms

and

have

an

essential

role

in

immune

responses

and

host-pathogen

interactions..

In

analysing

the

pathogen-host

cell

crosstalk,

it

has

been

shown

that

several

pathogen

proteins

target

mitochondria

thus

controlling

the

host

cell

fate.

Here,

we

conducted

a

bioinformatic

analysis

aimed

at

identifying

M.

tuberculosis

proteins

that,

based

on

aminoacid

sequence,

could

possible

be

secretory,

and

target

mitochondria.

Our

results

singled

out

out

of

M.

tuberculosis

predicted

proteins

as

likely

to

be

secretory

and

harbour

mitochondrial

targeting

sequences.

Interestingly,

several

proteins

considered

to

be

virulence

factors

are

included

and

over-represented

in

this

protein

list.

Four

such

proteins

were

experimentally

tested

and

while

confirming

that

targets

mitochondria,

a

new

M.

tuberculosis

mitochondria

targeting

protein

was

identified

This

work

suggests

a

correlation

between

M.

tuberculosis

protein

mitochondrial

targeting

potential

and

virulence.

The

interaction

between

M.

tuberculosis

and

its

host

cell

is

complex

and,

as

we

think,

understanding

the

role

of

mitochondria

in

mycobacterial

infections

and

the

role

of

M.

tuberculosis

specific

proteins

in

the

crosstalk

with

host

cells

at

the

level

of

mitochondria

will

lead

us

to

a

better

explanation

of

phenomena

such

as

tuberculosis

latency.

Macrophages

are

the

main

host

cells

for

M.

tuberculosis,

therefore

considerable

attention

has

been

devoted

to

the

analysis

of

the

mycobacteria-containing

phagosomes

and

the

way

by

which

mycobacteria

inhibit

their

association

with

lysosomes

and

more

recently

the

host-pathogen

cross-talk

by

transcriptional

analyses

has

gained

interest

On

the

other

hand,

it

has

been

shown

that

M.

tuberculosis

infection

controls

host

cells,

either

by

inducing

or

inhibiting

their

death

and

some

M.

tuberculosis-derived

molecules

have

been

associated

with

those

opposing

biological

activities

Mitochondria

play

a

pivotal

role

in

programmed

cell

death

and

mitochondrial

activity

has

been

shown

to

be

disrupted

by

mycobacterial

infection

in

a

process

that

appears

to

be

dependent

on

the

virulence

It

has

been

shown

that

several

secreted

microbial

proteins

are

transferred

to

the

cell

during

infection

and

may

target

mitochondria,

playing

an

important

role

in

bacterial

pathogenicity

and

more

recent

observations

suggest

that

the

mitochondrial

role

in

the

regulation

of

cellular

responses

to

pathogens

may

go

further

than

the

sole

regulation

of

host

cell

death

Taking

all

this

into

account

we

wanted

to

analyze

the

M.

tuberculosis

genome

and

their

predicted

proteome

in

search

of

moieties

likely

to

play

a

mitochondrial-mediated

pathogenicity

role,

by

using

bioinformatic

tools..

Gomez

et

al.

have

already

identified

M.

tuberculosis

secreted

proteins

by

performing

a

bioinformatic

search

on

the

initially

predicted

proteins

from

the

M.

tuberculosis

genome

Here,

we

used

a

different

approach.

The

whole

predicted

proteins

from

the

M.

tuberculosis

genome

were

first

analyzed

for

the

presence

of

The

MitoProt

II

analysis

we

performed

was

more

stringent

than

similar

searches

on

other

bacterial

proteomes

were

authors

concluded

that

at

least

of

proteins

from

E.coli

are

predisposed

for

targeting

mitochondria

In

this

work,

by

using

two

predictive

algorithms,

it

was

found

that,

in

M.

tuberculosis

out

of

proteins

are

likely

to

target

mitochondria.

Mitoprot

has

a

level

of

accuracy

of

for

successfully

predicting

mitochondrial

proteins

and

for

successfully

predicting

non-mitochondrial

proteins

in

a

protein

training

group

and

PSORT

II

has

an

accuracy

of

approximately

The

predicted

proteins

likely

to

target

mitochondria

were

further

analyzed

for

the

presence

of

secretory

signal

peptides

by

using

the

SignalP

hidden

Markov

model,

which,

incidentally,

has

recently

been

reported

to

outperform

other

similar

tools

in

predicting

M.

tuberculosis

secreted

proteins

with

a

level

of

accuracy

of

as

it

predicted

no

false

positives

or

false

negatives

in

a

negative

set

and

in

a

positive

set

of

mycobacterial

proteins,

respectively.

In

addition,

this

algorithm

showed

accuracy

in

predicting

the

actual

cleavage

site

Their

analysis

predicted

that

between

and

of

the

proteins

in

the

proteomes

of

different

mycobacteria

(including

the

strain)

are

secreted

proteins.

Our

SignalP

hidden

Markov

model

search

predicted

that

out

of

the

proteins

likely

to

target

mitochondria

are

also

secreted

proteins,

i.e.,

In

their

analysis,

Gomez

et

al.

excluded

PE/

PPE

proteins

out

of

the

top

M.

tuberculosis

proteins

predicted

to

be

secretory,

arguing

that

biased

amino

acid

composition

and

a

repetitive

primary

sequence

could

lead

to

unreliable

results

in

sequence

analyses.

We

did

not

exclude

these

proteins

from

our

analysis

and

we

found

that

some

proteins

are

not

predicted

to

harbour

mitochondrial

targeting

or

secretory

signals

(data

not

shown);

thus,

suggesting

that

the

amino

acid

composition

of

these

proteins

did

not

introduce

any

bias

in

our

bioinformatic

output.

In

addition,

it

has

recently

been

shown

that

some

and

PPE

proteins

are

secreted

by

at

least

one

mycobacterial

species

(M.

marinum)

and

that

those

proteins

are

transported

via

the

type

VII

secretion

system

Interestingly,

among

the

proteins

likely

to

be

secreted

and

to

targeted

mitochondria,

belong

to

the

protein

family

Table

About

of

the

coding

capacity

of

the

genome

is

devoted

to

two

large

unrelated

families

of

acidic,

glycine-rich

proteins,

the

PE

(Pro-Glu)

and

PPE

(Pro-Pro-Glu)

families,

often

based

on

multiple

copies

of

the

polymorphic

repetitive

sequence

referred

to

as

PGRSs

(polymorphic

GC-rich

repetitive

sequences).

It

has

been

suggested

that

these

protein

families

could

be

of

immunological

importance

and

a

possible

source

of

antigenic

variability

that

would

help

M.

tuberculosis

to

evade

the

host

immune

system

during

infection

In

addition,

by

using

a

computational

strategy

based

on

phylogenetic

profiling

and

comparative

proteomic

analysis,

Meszaros

et

al.

have

proposed

that

M.

tuberculosis

PE/PPE

proteins

can

be

considered

as

potential

targets

for

drug

design.

Although

the

biological

function

of

the

PE

proteins

is

still

under

study,

the

member

annotated

as

has

been

characterized

as

fibronectinbinding

protein

and

a

genetic

screen

of

M.

bovis

BCG

Pasteur

mutagenized

with

the

transposon

identified

a

gene,

identical

to

the

gene

of

M.

tuberculosis,

encoding

a

protein

that

influences

the

interactions

of

mycobacteria

with

macrophages

has

also

been

implied

in

T

lymphocytes

apoptosis

and

it

has

been

shown

that

most

genetic

differences

between

M.

tuberculosis

and

strains,

likely

to

function

as

virulence

factors

are

in

the

PE/PPE/

family

genes

The

availability

of

suitable

bioinformatic

tools

allowed

us

to

single

out

M.

tuberculosis

proteins

as

likely

to

be

secreted

and

to

target

host

cell

mitochondria,

among

them

five

family

protein

members.

Recently,

Cadieux

et

al.

showed

that

the

M.

tuberculosis

protein

(encoded

by

the

gene)

colocalize

with

mitochondria

when

expressed

in

human

rhabdomyosarcoma

(RD)

cells,

and

mitochondrial

localization

of

protein

was

followed

by

induction

of

cell

death

This

finding

is

somewhat

in

contrast

with

our

in

silico

analysis,

since

is

not

predicted

to

harbour

a

mitochondrial

targeting

sequence

by

MitoProt

or

PSORT

II

(Table

Moreover,

the

M.

tuberculosis

protein

which

is

the

ortholog

of

is

predicted

to

harbour

a

mitochondria

targeting

sequence

(Table

and

experimentally

failed

to

do

so

(Figure

A

possible

explanation

for

this

is

that

proteins

are

unreliably

alignable

or

differences

in

the

annotation

for

the

strain

as

compared

for

the

stain

of

M.

tuberculosis.

In

addition

the

similarity

score

between

and

is

just

a

very

low

score

for

considering

true

homology

between

these

two

proteins

Table

All

in

all,

our

results

show,

in

another

experimental

system

murine

macropheges

exposed

to

the

recombinant

protein),

that

targets

host

cell

mitochondria,

thus

confirming

Cadieux

et

al.

findings..

In

addition,

based

on

bioinformatic

analyses,

we

present

evidence

that

which

is

the

M.

tuberculosis

ortholog

of

M.

tuberculosis

and

a

known

virulence

factor,

targets

mitochondria

Figure

Identifying

other

M.

tuberculosis

proteins

that

target

mitochondria

would

help

to

clarify

the

structural

requirements

for

mitochondrial

targeting

and

more

important,

the

role

of

those

proteins

in

the

M.

tuberculosis-host

cell

communication.

This

work

provided

a

list

of

candidate

proteins,

and

after

experimentally

testing

some

of

them

and

identifying

as

a

mitochondria

targeting

protein,

still

leaves

some

candidate

proteins

for

further

analysis.

M.

tuberculosis

proteins

predicted

to

be

secreted

and

to

target

host

cell

mitochondria.

The

whole

predicted

proteins

from

the

M.

tuberculosis

genome

as

shown

in

the

JCVI/CMR

webpage

were

analyzed

for

the

presence

of

mitochondrial

targeting

sequences

by

using

the

MitoProt

algorithm.

Although

previous

analyses

using

this

algorithm

on

other

bacterial

proteomes

have

set

the

probability

limit

at

to

consider

a

protein

as

likely

to

target

mitochondria

we

decided

for

a

more

stringent

analysis

and

therefore

we

set

the

probability

limit

at

that

would

help

to

reduce

false

negatives.

As

shown

in

Figure

a

total

of

out

of

M.

tuberculosis

proteins

are

predicted

to

have

mitochondrial

targeting

potential.

Next

we

analyzed

those

proteins

by

using

another

mitochondrial

targeting

predictive

algorithm

(PSORT

II),

and

found

that

out

of

the

proteins

scored

as

likely

to

target

host

cell

mitochondria.

Finally,

the

predicted

proteins

that

scored

positive

for

both

predictive

algorithms

were

further

analyzed

for

the

probability

of

harboring

secretory

signal

peptides

by

using

the

SignalP

software.

Taken

together,

these

three

bioinformatic

resources

allowed

us

to

identify

predicted

proteins

with

the

probability

of

harboring

secretory

peptide

signals

as

well

as

mitochondrial

targeting

signals.

PE

and

family

proteins

are

among

the

M.

tuberculosis

proteins

likely

to

be

secreted

and

targeted

to

host

cell

mitochondria

Table

shows

that

the

bioinformatic

procedure

used

in

this

work

selected

out

of

predicted

proteins

from

the

M.

tuberculosis

strain

genome

that

are

predicted

to

be

secreted

and

targeted

to

the

host

cell

mitochondria.

By

looking

at

the

annotated

characteristics

of

those

proteins,

it

is

evident

that

members

from

the

PE

and

family

proteins

are

overrepresented

since

the

total

number

of

PE

and

proteins

is

estimated

to

be

by

manually

counting

them

from

the

JCVI/CMR

M.

tuberculosis

list

Interestingly,

a

recent

comparative

analysis

among

mycobacterial

genomes,

performed

in

an

attempt

to

identify

the

mutations

that

lead

to

the

loss

of

virulence

in

the

M.

tuberculosis

strain,

showed

that

most

mutations

were

confined

to

the

PE/PPE/

family

genes,

highlighting

the

likely

role

of

those

proteins

as

virulent

factors

Accordingly,

we

performed

a

search

for

homologous

proteins

in

M.

tuberculosis

M.

tuberculosis

and

M.

bovis

BCG

Pasteur

strain

and

then

analyzed

those

homologous

proteins

by

using

MitoProt

II,

PSORT

II,

and

SignalP

algorithms

as

previously

described.

Table

shows

the

protein

codes

for

each

mycobacterial

strain,

as

well

as

the

possible

identity

and

the

scores

for

the

three

aforementioned

predictive

algorithms.

These

analyses

showed

that

the

percentage

of

similarity

among

the

identified

M.

tuberculosis

strain

PE

or

proteins

and

their

and

BCG

Pasteur

strain

homologous

proteins

ranged

from

to

The

and

BCG

homologous

to

protein

are

predicted

as

not

mitochondrial

targeted,

whereas

the

scored

positive

just

as

well

as

and

the

same

holds

true

for

the

three

homologous

proteins

to

but

of

them

seem

to

have

secretory

signal

sequences.

All

six

homologous

proteins

to

and

did

not

score

positive

for

mitochondrial

targeting

sequences.

On

the

other

hand,

the

three

homologous

proteins

for

are

predicted

to

harbor

mitochondrial

targeting

sequences.

With

the

exception

of

and

all

other

homologous

proteins

are

predicted

to

harbor

secretory

signal

sequences.

In

spite

of

the

huge

efforts

to

overcome

the

burden

of

tuberculosis

(TB),

nearly

million

incident

cases

of

TB

cases,

the

death

of

million

HIV-negative

TB

patients

and

an

additional

million

deaths

from

HIV-associated

TB

are

reported

each

year.

Unfortunately,

the

selection

and

spread

of

multidrug-resistant

(MDR)

Mycobacterium

tuberculosis

strains

worsen

the

scenario,

since

an

estimated

million

cases

of

MDR-TB

were

documented

for

the

year

Clearly,

in

addition

to

the

improvement

of

human

population

welfare,

the

development

of

new

vaccines,

early

diagnosis

tests,

and

pharmacological

treatments,

a

precise

knowledge

on

mycobacteria-host

cell

interactions

is

also

a

requirement

for

the

successful

control

of

TB..

In

this

regard,

some

bacterial

pathogenicity

factors

have

been

shown

to

contain

N-terminal

mitochondrial

targeting

signals

and

a

diverse

array

of

bacterial

proteins

including

some

bacterial

toxins

from

enteropathogenic

E.coli.

Salmonella

spp,

N.

gonorrhoea,

N.

meningitides,

A.

baumanii,

H.

pylori,

S.

aureus,

S.

pneumoniae,

C.

sordelli,

and

C.

difficile

have

been

shown

to

target

mitochondria

Two

proteins

of

particular

interest

are

mitochondrialassociated

protein

(Map,

former

and

EspF

from

enteropathogenic

E.coli,

which

enter

the

host

cell

via

the

type

secretion

system

and

colocalize

with

host

mitochondria

It

is

worth

noting

that,

Map

causes

alterations,

in

the

form

of

mitochondrial

membrane

potential

(Δψ

m

dissipation

but

apparently

it

is

not

responsible

for

enteropathogenic

E.coli-induced

host

cell

apoptosis

Mycobacterial

infection

affects

mitochondrial

function

and

it

has

been

suggested

that

Δψ

m

changes

are

related

to

the

mycobacterial

virulence

However,

the

identity

of

the

molecules

responsible

for

such

a

response

has

not

been

defined.

Recently,

the

M.

tuberculosis

protein

was

shown

to

localize

within

host

cell

mitochondria,

and

in

doing

so,

induces

host

cell

apoptosis

Since

mitochondria

targeting

proteins

such

as

Map

and

EspF

(from

enteropathogenic

E.

coli)

are

secreted

proteins,

we

thought

that

it

is

likely

that

at

least

some

of

the

mycobacterial

proteins

that

potentially

target

host

cell

mitochondria

are

also

secreted

proteins.

Therefore,

we

set

up

a

bioinformatic

search

of

M.

tuberculosis

proteins

likely

to

be

secreted

and

to

target

host

cell

mitochondria..

The

M.

tuberculosis

genome

was

first

made

available

in

opening

the

possibility

for

in-depth

analysis

of

the

possible

pathogenic

mechanisms

involved

in

the

course

of

mycobacterial

infections

Other

mycobacterial

genomes

have

been

elucidated

since,

and

new

bio-informatic

resources

allow

for

in

silico

analysis

of

their

genomes

Genome

wide

analysis

predicts

that

M.

tuberculosis

and

contain

and

genes,

respectively

By

using

freely

available

data

bases

and

bioinformatic

tools,

we

were

able

to

single

out

M.

tuberculosis

predicted

proteins

as

likely

candidates

for

targeting

mitochondria..

Among

these,

five

family

proteins

deserve

particular

attention.

About

of

the

potential

coding

capacity

of

M.

tuberculosis

accounts

for

two

large

unrelated

gene

families

encoding

the

PE

and

PPE

proteins.

The

names

PE

and

PPE

are

derived

from

the

motifs

Pro-Glu

(PE)

and

Pro-Pro-Glu

(PPE),

and

the

largest

class

of

the

PE

family

in

M.

tuberculosis

is

the

subfamily

which

consist

of

proteins

with

a

PE

domain

followed

by

a

C-terminal

glycine-rich

extension

encoded

by

the

PGRS

motif

(polymorphic

GCrich

repetitive

sequence)

As

a

family,

the

PE/

proteins

are

polymorphic

and

account

for

many

of

the

differences

found

between

the

avirulent

and

virulent

strains

of

M.

tuberculosis

and,

in

consequence,

have

been

proposed

as

possible

virulence

factors

Bioinformatic

analysis

of

predicted

M.

tuberculosis

proteins

M.

tuberculosis

predicted

protein

sequences

were

downloaded

from

the

M.

tuberculosis

Genome

Project

from

J.

Craig

Venter

Institute/Comprehensive

Microbial

Resource

(JCVI/CMR

version

org/pub/data/Microbial_Genomes/m_tuberculosis_cdc1551/

annotation_dbs/m_tuberculosis_cdc1551.pep)..

Protein

sequences

were

then

analyzed

by

using

the

MitoProt

Software

mitoprot.html),

which

calculates

the

N-terminal

protein

region

that

can

support

a

mitochondrial

targeting

sequence

and

the

cleavage

site,

as

described

M.

tuberculosis

putative

proteins

with

a

probability

of

at

least

of

having

a

mitochondrial

targeting

sequence

were

selected

and

re-analyzed

by

means

of

the

PSORT

II

prediction

algorithm

for

subcellular

localization

which

uses

the

k

nearest

neighbours

classifier

Those

proteins

that

in

addition

of

scoring

well

for

MitoProt

II

had

the

highest

probability

of

being

targeted

to

mitochondria

by

PSORT

II

were

further

analyzed

for

secretory

signal

peptides

by

using

SignalP

SignalP/),

which

predicts

the

presence

and

location

of

signal

peptide

cleavage

sites

in

amino

acid

sequences

from

Gram-positive

prokaryotes,

Gram-negative

prokaryotes,

and

eukaryotes.

The

method

incorporates

a

prediction

of

cleavage

sites

and

a

signal

peptide/non-signal

peptide

prediction

based

on

a

combination

of

several

artificial

neural

networks

and

hidden

Markov

models,

as

described

The

amino

acid

sequences

of

some

proteins

likely

to

harbor

mitochondrial

targeting

sequences,

and

to

be

secreted

by

the

strain

of

M.

tuberculosis,

were

compared

against

the

homologous

proteins

of

M.

tuberculosis

M.

tuberculosis

and

M.

bovis

BCG

Pasteur

strain,

by

using

the

"Protein

vs.

All

Alignment"

tool

at

the

JCVI/CMR

webpage.

The

retrieved

amino

acid

sequences

were

then

analyzed

by

MitoProt

PSORT

II,

and

SignalP

algorithms

as

previously

described.

O O O B I O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O B I O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Making information flow explicit in HiStar By nickolai Zeldovich, Silas Boyd-Wickizer, eddie Kohler, and David Mazières abstract HiStar is a new operating system designed to minimize the amount of code that must be trusted. HiStar provides strict information flow control, which allows users to specify precise data security policies without unduly limiting the structure of applications. HiStar's security features make it possible to implement a Unix-like environment with acceptable performance almost entirely in an untrusted user-level library. The system has no notion of superuser and no fully trusted code other than the kernel. HiStar's features permit several novel applications, including privacy-preserving, untrusted virus scanners and a dynamic Web server with only a few thousand lines of trusted code. Many serious security breaches stem from vulnerabilities in application software. Despite an extensive body of research in preventing, detecting, and mitigating the effects of software bugs, the security of most systems ultimately depends on a large fraction of the code behaving correctly. Unfortunately, experience has shown that only a handful of programmers have the right mind-set to write secure code, and few applications have the luxury of being written by such programmers. As a result, we see a steady stream of high-profile security incidents.. How can we build secure systems when we cannot trust programmers to write secure code? One hope is to separate the security critical portions of an application from the untrusted bulk of its implementation; if security depends on only a small amount of code, this code can be verified or implemented by trustworthy parties regardless of the complexity of the application as a whole. Unfortunately, traditional operating systems do not lend themselves to such a division: they make it too difficult to predict the full implications of every action by untrusted code. 7 HiStar is a new operating system designed to overcome this limitation.. HiStar enforces security by controlling how information flows through the system. Hence, one can reason about which components of a system may affect which others and how, without having to understand those components themselves. Specifying policies in terms of information flow is often much easier than reasoning about the security implications of individual operations.. As an example, let us consider anti-virus software, which often has full access to all files on a user's computer. There have been critical vulnerabilities discovered in virus scanners from Norton, 14 McAfee, 10 and others 15 that allow attackers to take full control of the scanner. Such vulnerabilities can easily be exploited to, at the very least, steal private data from millions of users. To prevent such a disaster, we might switch to the simpler, open-source ClamAV virus scanner. However, it has suffered from security vulnerabilities in the past, 21 and is over 40,000 lines of code-large enough that hand-auditing the system to eliminate vulnerabilities would be an expensive and lengthy process at best. Yet a virus scanner must periodically be updated on short notice to counter new threats, in which case users would face the unfortunate choice of running either an outdated virus scanner or an unaudited one. A better solution would be for the operating system to enforce security without trusting ClamAV to keep the user's data private, thereby minimizing potential damage from ClamAV's vulnerabilities. Figure 1 illustrates ClamAV's components. How can we protect a system should these components be compromised? Among other things, we must ensure a compromised ClamAV cannot purloin private data from the files it scans, or corrupt those files. In doing so, we must also avoid imposing restrictions that might interfere with ClamAV's proper operation-for example, the scanner needs to spawn a wide variety of external helper programs to decode input files. Here are just a few ways in which, on Linux, a maliciously controlled scanner and update daemon can collude to copy private data to an attacker's machine:. • The scanner can send the data directly to the destination host over a TCP connection.. • The scanner can trick another program, such as a mail server running on the same machine, into transmitting the data.. • The scanner can take over an existing process using debug mechanisms (e.g., ptrace on Unix), and send the data via that process.. • The scanner can write the data to a file in /tmp. The update daemon can then read the file and leak the data by encoding it in the contents, ordering, or timing of subsequent network packets.. • The scanner can use any number of less efficient and subtler techniques to impart the data to the update daemon-for example, use file locking to lock different ranges of the database, bind particular TCP or UDP port numbers, modulate memory or disk usage in a detectable way, or change the title of the scanner process.. This work was originally presented at the 7th Symposium on Operating Systems Design and Implementation and the 5th Symposium on Networked Systems Design and Implementation.. is to allow only the system administrator-root-access to this mechanism, but doing so both hampers the ability of other applications to use this mechanism and increases the amount of fully privileged code running as root.. HiStar addresses these challenges with three key ideas. First, instead of implementing a traditional Unix interface, the kernel provides a lower-level interface, consisting of six types of kernel objects and a small number of operations that make any information flows between objects explicit. This provides a correspondingly small number of places where the kernel must perform data flow checks. Second, the only protection mechanism provided by the kernel is an information flow control mechanism, which generalizes the intuition behind taint. All other forms of protection, including Unix user IDs, process memory protection, and tainting itself, are implemented in terms of information flow control. This both reduces the amount of trusted kernel code and avoids any ambiguity about how the mechanisms will form a coherent policy. Finally, HiStar's information flow control mechanism is egalitarian, meaning that it can be used by any process, not just by superuser, which further reduces the amount of fully trusted code.. Though we used the virus scanner as an example, many security problems can be couched in terms of information flow. For example, protecting users' private profiles on a Web site often boils down to ensuring one person's information (Social Security number, credit card, etc.) cannot be sent to another user's browser. Protecting against trojan horses means ensuring network payloads do not affect the contents of system files. Protecting passwords means ensuring that whatever code verifies them can reveal only the single bit signifying whether or not authentication succeeded. The rest of this paper describes how HiStar provides a new, Unix-like environment in which small amounts of code can secure much larger, untrusted applications by enforcing such policies. HiStar is a new operating system that provides strict information flow control without superuser privilege. Narrow interfaces allow for a small trusted kernel of less than 20,000 lines, on which a Unix-like environment is implemented in untrusted user-level library code. A new container abstraction lets administrators manage and revoke resources for processes they cannot observe. Side-by-side with the Unix environment, the system supports a number of highsecurity, privilege-separated applications previously not possible in a traditional Unix system. HiStar is available at http://www.scs.stanford.edu/histar/. acknowledgments We thank Martin Abadi, Michael Reiter, and Michael Walfish for helping improve this paper, and many others that provided feedback on earlier papers. [18] [19] [20] This work was funded by joint NSF Cybertrust/DARPA grant CNS-0430425, by NSF Cybertrust award CNS-0716806, by the DARPA Application Communities (AC) program as part of the VERNIER project at Stanford and SRI International, and by a gift from Lightspeed Venture Partners. HiStar was directly inspired by Asbestos, 4 but differs in providing systemwide persistence and a lower-level kernel interface that closes known covert storage channels. While Asbestos is a message-passing system, HiStar relies heavily on shared memory. The HiStar kernel provides gates, not IPC, with the important distinction that upon crossing a gate, a thread's resources initially come from its previous domain. By contrast, Asbestos changes a process's label to track information flow when it receives IPCs, which is detectable by third parties and can leak information. Asbestos optimizes comparisons between enormous labels, which so far we have not done in HiStar. Flume 8 showed how to provide information flow control on top of the Linux kernel, and introduced a cleaner label system (which HiStar and this paper have adopted). Flume also proposed endpoints to help programmers reason about labels on standard Unix abstractions; adopting endpoints in HiStar's Unix library would similarly help HiStar programmers. DStar 19 extended information flow control to decentralized systems and developed the HiStar Web server. Loki 20 showed how hardware can partially enforce HiStar's labels, to reduce the amount of fully trusted kernel code.. HiStar controls information flow with mandatory access control (MAC), a well-studied technique dating back decades. 1 The ADEPT-50 dynamically adjusted labels (essentially taint tracking) using the High-Water-Mark security model back in the late 1960s 9 ; the idea has often resurfaced, for instance in IX 12 and LOMAC. 5 HiStar and its predecessor Asbestos are novel in that they make operations such as category allocation and untainting available to application programmers, where previous OSes reserved this functionality for security administrators. Decentralized untainting allows novel uses of categories that we believe promote better application structure and support applications such as Web services, which were not targeted by previous MAC systems.. Like HiStar, capability-based KeyKOS 3 and EROS 17 use a small number of kernel object types and a single-level store. HiStar's containers are reminiscent of hierarchical space banks in KeyKOS. However, while KeyKOS uses kernel-level capabilities to enforce labels at user level, HiStar bases all protection on kernel-level labels. The difference is significant because labels specify security properties while imposing less structure on applications; for example, an untrusted thread can dynamically alter its label to observe secret data, which has no analogue in a capability system.. The idea of using gates for protected control transfer 6 Decentralized untainting, while new in operating systems, was previously provided by programming languages, notably Jif. 13 Jif can track information flow at the level of individual variables and perform most label checks at compile time. However, Jif relies on the operating system for storage, trusted input files, administration, etc., which avoids many issues HiStar needs to address. SELinux 11 lets Linux support MAC; like most MAC systems, policy is centrally specified by the administrator. In contrast, HiStar lets applications craft policies around their own categories. Retrofitting MAC to a large existing kernel such as Linux can be error-prone, especially given the sometimes ill-specified semantics of Linux system calls. HiStar's disciplined, small kernel can potentially achieve much higher assurance at the cost of compatibility.

O B I O O O O O O O O O O O O O O O O O O B I O O O O O O B O O O O O O O B I O O O B O O B B I O O O O O B O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O B B O O B O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O B O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O B O O B O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B O B O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O B O O B I O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O B I O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O B O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A high fidelity ATM traffic and network simulator ADSTRACT


Adaptive clock synchronization in sensor networks Recent advances in technology have made low cost, low power wireless sensors a reality. Clock synchronization is an important service in any distributed system, including sensor network systems. Applications of clock synchronization in sensor networks include data integration in sensors, sensor reading fusion, TDMA medium access scheduling, and power mode energy saving. However, for a number of reasons, standard clock synchronization protocols are unsuitable for direct application in sensor networks.In this paper, we introduce the concept of adaptive clock synchronization based on the need of the application and the resource constraint in the sensor networks. We describe a probabilistic method for clock synchronization that uses the higher precision of receiver-to-receiver synchronization, as described in Reference Broadcast Synchronization (RBS) protocol. This deterministic protocol is extended to provide a probabilistic bound on the accuracy of the clock synchronization, allowing for a tradeoff between accuracy and resource requirement. Expressions to convert service specifications (maximum clock synchronization error and confidence probability) to actual protocol parameters (minimum number of messages and synchronization overhead) are derived. Further, we extend this protocol for maintaining clock synchronization in a multihop network. Recent advances in technology have made low-cost, lowpower wireless sensors a reality. Sensor networks formed from such sensors can be deployed in an ad hoc fashion and cooperate to sense and process a physical phenomenon. As each sensor has a finite battery source, an important feature of sensor network is energy efficiency to extend the network's lifetime.. As in any distributing computer system, clock synchronization is an important service in sensor networks. Sensor network applications can use synchronization for data integration and sensor reading fusion. A sensor network may also use synchronization for TDMA medium access scheduling, power mode energy savings, and scheduling for directional antenna reception. Sensor networks show some unique characteristics that make it difficult to directly apply traditional network clock synchronization approaches.. The error in clock synchronization comes mainly from the non-deterministic random time delay for a message transfer between two nodes. Kopetz et al. [1] first characterized this message delay. In some recent work, this non-determinism has been reduced to provide tighter bounds on the clock synchronization error [2, 3] . Our work, which is based on the Reference Broadcast Synchronization (RBS) [3] , provides an analytical way to convert service specifications to protocol parameters.. The need in sensor networks is to provide the best possible clock synchronization under existing circumstances, given the limited resources of the nodes and the network in the system. Highly accurate clock synchronization typically requires more message transfers and processing as part of the synchronization protocol. In situations where the system energy is extremely low, it might not be possible to provide high accuracy. The accuracy needed in clock synchronization is variable, depending on the higher layer application requirements. If the need for determinism can be relaxed, probabilistic guarantees often suffice for the needs of an application, while allowing for optimal use of resources. Probabilistic guarantees provide better accuracy in most cases as compared to deterministic accuracy in all cases. Also the failure probability of achieving a certain accuracy can be bounded. Quality of Service (QoS) in networks make extensive use of this concept to give probabilistic guarantees by allowing resources to be allocated on the basis of expected aggregate demand. Previous work [4, 5] uses this concept for providing probabilistic clock synchronization in distributed systems.. Clock synchronization might not be necessary at all times, except during sensor reading integration. In such a case, providing clock synchronization all the time will be a waste on the limited available resources of sensors. The sensor clocks can be allowed to go out of sync, and then re-synchronize only when there is a need for synchronization, thereby saving resources. We design our adaptive clock synchronization protocol keeping in mind the concepts discussed above. The remainder of this paper is organized as follows. In Section 2, we describe the various concepts of clock synchronization in detail and motivate the design principles used in building our algorithm. In Section 3, we survey the related work in this area. Section 4 describes the RBS protocol, along with our improvements. Section 6 evaluates the performance of the protocol. Section 5 extends this protocol for multihop sensor networks. Finally, we discuss our conclusions in Section 7. In this paper, we present and analyze a adaptive clock synchronization protocol for sensor networks. This protocol is based on the earlier deterministic RBS protocol [3] . The RBS protocol uses the concept of receiver-receiver synchronization to achieve better synchronization bounds than traditional synchronization protocols. Our protocol, being a probabilistic one, is not bound by the limit given by Lundelius et al. [10] . In our protocol, we periodically send n messages to probabilistically keep the clocks of the sensor network within the specified error bound. Our contributions in this paper are three-fold:. • We extend the deterministic RBS protocol to provide adaptive clock synchronization, allowing the trade-off between the synchronization accuracy and the resources used by the protocol.. • We analyze the protocol to derive expressions for synchronization overhead (in terms of number of messages) and synchronization interval. For example, we show that to achieve a synchronization error less than σ of the distribution with a confidence probability of 99%, the protocol requires 7 synchronization messages per interval. We show how to convert service specifications (maximum clock synchronization error and confidence probability) to actual protocol parameters (minimum number of messages and synchronization interval).. • We also extend the RBS protocol to handle multihop clock synchronization in which all nodes need not be within single-hop range of a clock synchronization sender. Those nodes not within single-hop range will receive synchronization with some degradation of the bounds, when compared to single-hop case.. We are currently implementing our adaptive clock synchronization protocol in Berkeley sensor motes to show its performance experimentally. We would like to build actual applications for sensor networks that utilize our adaptive clock synchronization service.

O B I O B I O O O O O O O B B I O O O O B I O O O O O O O O O B B B B O B I O B I O O O O O B O B B O B B O B O B I O O O O O O O B I O O O O B O O B O O B O O O B O O B I O O O O O O O O O B B O O B I O O O O B O B I O O O O O O O B O O O O B B O O O O O O O O O O O O O O B O O B I O O O O O B O B O O O O O O O B I O O O B O O O O O O O O O B O O O O O O O O O O B I O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B B O O O O O O O O O O O O O O B I O O O O O B I B B B O O B O O O O B O B O B B O O O B O B O B B B O O O O B O O O O B I O O O O O O O O O O O O B B I O O O O B I O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O B O O O O O B I O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O B O B O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O B O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O B B I O O O O O O O O O B O O O O O O O B I O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B O O O O O O B I O O B I O O O O O O O O O O O O O O O O O B O O B O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O B O O O O O O O O O O O O B I O O O O O B B O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O B O O O O O O O O O O B O O O O O O B O O O O O O O O O O O B I O O O B O O O O O O O O O B O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O B I O O O B O O O O O O O O O O O O B O B I O O O O B I O


Best Asymptotic Normality of the Kernel Density Entropy Estimator for Smooth Densities Abstract-In the random sampling setting we estimate the entropy of a probability density distribution by the entropy of a kernel density estimator using the double exponential kernel. Under mild smoothness and moment conditions we show that the entropy of the kernel density estimator equals a sum of independent and identically distributed (i.i.d.) random variables plus a perturbation which is asymptotically negligible compared to the parametric rate n 01=2 . An essential part in the proof is obtained by exhibiting almost sure bounds for the Kullback-Leibler divergence between the kernel density estimator and its expected value. The basic technical tools are Doob's submartingale inequality and convexity (Jensen's inequality).

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B O O