The power of two min-hashes for similarity search among hierarchical data objects In this study we propose sketching algorithms for computing similarities between hierarchical data. Specifically, we look at data objects that are represented using leaf-labeled trees denoting a set of elements at the leaves organized in a hierarchy. Such representations are richer alternatives to a set. For example, a document can be represented as a hierarchy of sets wherein chapters, sections, and paragraphs represent different levels in the hierarchy. Such a representation is richer than viewing the document simply as a set of words. We measure distance between trees using the best possible super-imposition that minimizes the number of mismatched leaf labels. Our distance measure is equivalent to an Earth Mover's Distance measure since the leaf-labeled trees of height one can be viewed as sets and can be recursively extended to trees of larger height by viewing them as set of sets. We compute sketches of arbitrary weighted trees and analyze them in the context of locality-sensitive hashing (LSH) where the probability of two sketches matching is high when two trees are similar and low when the two trees are far under the given distance measure. Specifically, we compute sketches of such trees by propagating min-hash computations up the tree. Furthermore, we show that propagating one min-hash results in poor sketch properties while propagating two min-hashes results in good sketches. The proliferation of information on the internet creates a huge amount of data in different formats. In the absence of rigid standards, ad hoc methods are used by different entities to represent data. For instance, a book may be represented hierarchically as a collection of chapters and these in turn as a collection of sections. Such an abstraction may be represented as a tree in the emerging XML standard. Similarly directory structures may be viewed as hierarchical entities that can be communicated in different formats. It then becomes a challenge to compare two such information corpora. For example, the same information can be represented under different isomorphic permutations of the underlying directory structure. A database record could be presented with attributes in different order. In such cases, rather than looking at the exact tree structure representing the objects, it may be more appropriate to check the similarity of the two tree structures under all possible isomorphic permutations. Again, to measure the similarity between two directory structures, it may be more appropriate to ignore the directory names and check if there is an ordering of the directory structure that minimizes mismatch between the file contents. However, computing the ordering that minimizes the mismatch on the tree data becomes hard as the degree and height of the tree increase.. Sketching is a powerful tool for concise representation and comparison of complex and large data. For instance, strings and sets can be compressed into points in hamming space. This typically yields sketches represented by short bit-vectors. Such sketches, although are not identical to the original data, preserve many of their properties. For instance sketches can be used to measure containment and distance [3] . Given the plethora of applications for sketching, there have been several attempts to compute sketches of more complex data such as trees and graphs. Some examples include file system directories, XML DOM trees, and phylogenetic trees [21, 16, 2, 7, 20, 9] . Other works of research have presented methods for computing tree edit distances [6] . Another important application of sketching sets is comparison of documents such as web pages wherein a document is viewed as a set of words. However, we lose the structure of the document by viewing it as a set. A hierarchical structure is richer in capturing context in which words occur such as a paragraph, chapter, etc. In this work, we propose a sketch based algorithm via an Earth Mover's Distance metric for trees with provable guarantees. Similarity among trees has been widely studied in the context of edit distance between trees, i.e., the number of edits required to transform one tree into the other [15, 19, 20] while others have approached this problem of matching via alignment of trees and effectively computing the best alignment that minimized the objective function [14] . The distance function adopted in this work is similar in spirit and is based on the optimal super-imposition that minimizes the number of mismatches in the set of leaf labels between the two trees. A more recent work of Augsten et al [2] uses pqgrams to match hierarchical data, represented as ordered, labeled trees. A pq-gram is a small subtree of a specific shape. A sketch of the tree is composed of a set of pq-gram profiles and sketch similarity is computed using well known set similarity measures. This approach, however, is not resistant to permutations in the leaf labels when q = 1. The other case of q > 1 generates mismatches that are amplified by the shingling approach adopted to generate the pq-grams, thus resulting in a poor match between trees even when they are similar. In constrast to our work they assume that all nodes of the tree are labeled. In a later work their approach was extened to unordered trees [1] . The sketching approach of Garofalakis and Kumar [9] for an ordered tree-similarity metric based on edit operations is different from ours as we handle unordered trees using an EMD based metric.

O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Balanced bootstrap resampling method for neural model selection Uniform resampling is the easiest to apply and is a general recipe for all problems, but it may require a large replication size B. To save computational effort in uniform resampling, balanced bootstrap resampling is proposed to change the bootstrap resampling plan. This resampling plan is effective for approximating the center of the bootstrap distribution. Therefore, this paper applies it to neural model selection. Numerical experiments indicate that it is possible to considerably reduce the replication size B. Moreover, the efficiency of balanced bootstrap resampling is also discussed in this paper.Crown It is well-known that backpropagation multilayer perceptrons (MLPs) are often used to describe neural network structures. Their applications are in a wide range of areas, such as pattern recognition, signal processing, data compression, and automatic control. A backpropagation MLP is an adaptive network whose nodes (or neurons) perform the same function on incoming signals; and this node function is usually a composite of the weight sum and a differentiable nonlinear activation function. Three activation functions are the most commonly used in backpropagation MLPs: logistic, hyperbolic tangent and identity functions. In this paper, for simplicity, we assume that the logistic function is used in backpropagation MLP.. Let (x 1 , x 2 , . . . , x p ) be a a set of p explanatory variables to explain a continuous variable y. An MLP with p inputs, one hidden layer with H hidden units and one output layer is used to model these data as follows:. where ϵ is the residual term, with zero mean, variance σ 2 (with normal distribution or not), and φ is the logistic function. Let y(x; θ ) be the computed value for an input x = (x 1 , . . . , x p ) and a parameter θ = (w 0 , w 1 , . . . , w H , w 11 , . . . , w pH ).. For MLPs, the choice of an appropriate mode is an important problem. Kallel et al. [1] applied the bootstrap method [2] for neural model selection, since it is more effective than the leave-one-out method. To reduce the bootstrap method's computational load, Lendasse et al. [3] proposed a fast bootstrap (FB) methodology for regression model selection. According to their numerical experiments on multi-layer perceptrons, radial-basis function networks and least-square support vector machines, the FB can reduce the bootstrap replication size. However, they do not discuss the asymptotic efficiency of FB relative uniform resampling (i.e., the original bootstrap method). Recently, Chuang et al. [4] proposed a weighted bootstrap to selection model for MLPs. Based on their numerical results, the performance of the weighted bootstrap is better than the bootstrap method. However, there is a problem in Chuang et al. [4] : How to select the optimal weight in the weighted bootstrap? To solve this problem, we apply the balanced bootstrap resampling, which is not necessary to select the weight, to selection model for MLPs.. The remaining of this paper is organized as follows. In Section 2 we apply an efficient bootstrap-balanced resampling-to selection model for MLPs. The balanced resampling scheme ensures that each data appears the same number of times in all the resamples. Furthermore, the asymptotic efficiency of balanced resampling relative uniform resampling is considered in Section 3. Some numerical results are given in Section 4 and conclusions are given in the last section. In this paper we propose the BR algorithm to reduce computer effort of the bootstrap method for neural model selection. Compared with OB, WB and BR algorithms, the numerical results show that the BR algorithm not only is an effective means of reducing the bootstrap replications but also selects the correct model. According to the experimental results, the BR

O B O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O B O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O O O O B O O O O O O O O O O B O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O


Using Basic Image Features for Texture Classification Abstract Representing texture images statistically as histograms over a discrete vocabulary of local features has proven widely effective for texture classification tasks. Images are described locally by vectors of, for example, responses to some filter bank; and a visual vocabulary is defined as a partition of this descriptor-response space, typically based on clustering. In this paper, we investigate the performance of an approach which represents textures as histograms over a visual vocabulary which is defined geometrically, based on the Basic Image Features of Griffin and Lillholm (Proc. SPIE 6492(09):1-11, 2007), rather than by clustering. BIFs provide a natural mathematical quantisation of a filter-response space into qualitatively distinct types of local image structure. We also extend our approach to deal with intra-class variations in scale. Our algorithm is simple: there is no need for a pre-training step to learn a visual dictionary, as in methods based on clustering, and no tuning of parameters is required to deal with different datasets. We have tested our implementation on three popular and challenging texture datasets and find that it produces consistently good classification results on each, including what we believe to be the best reported for the KTH-TIPS and equal best reported for the UIUCTex databases. Effective general-purpose analysis of texture in images is an important step towards a variety of computer vision applications, from industrial inspection to scene and object recognition. Its challenge lies in the wide variety of possible textures-ranging in nature from regular to stochastic and in origin from albedo variations to 3D surface structureand the conditions under which they are imaged. Changes in lighting geometry and intensity or in camera viewpoint can have a significant impact on appearance (Leung and Malik 2001) .. Any texture analysis relies on an appropriate representation, and the task which has become canonical as a test of representation is multi-class classification.. One paradigm which has proved effective for coping with the problems described above is to represent texture images statistically as histograms over a discrete vocabulary of local features (Leung and Malik 2001; Cula and Dana 2001; Zisserman 2005, 2009; Hayman et al. 2004; Lazebnik et al. 2003; Zhang et al. 2006; Varma and Garg 2007; Ojala et al. 2002) . Images are probed locally by considering, for example, the responses to a filter bank or the greyscale values of a local image patch. These descriptor responses are then assigned to discrete bins according to some partition of the feature space.. This model encompasses two approaches to image representation. In the first Zisserman 2005, 2009; Hayman et al. 2004; Varma and Garg 2007; Ojala et al. 2002) , every image in the dataset is represented as a histogram over a common dictionary and some form of histogram comparison measure is used to compare images. This dictionary is most often defined by a once-and-forall clustering of feature vectors from a subset of images from the dataset, as described below. The second approach (Lazebnik et al. 2003; Zhang et al. 2006 ) uses a separate dictionary for each image and represents the image as a 'signature': a table of feature definitions (e.g. cluster centres) with the corresponding numbers of occurrences in the image. Image signatures are compared using a measure such as the Earth Mover's Distance. This dictionary is most often defined by clustering feature vectors from the single image to be represented.. Various classification schemes have been explored for both of these approaches, from nearest-neighbour matching Zisserman 2005, 2009; Lazebnik et al. 2003) to kernel-based SVMs (Zhang et al. 2006; Hayman et al. 2004) . Although the superiority of SVMs for texture classification has been clearly demonstrated (Caputo et al. 2005; Hayman et al. 2004; Zhang et al. 2006) , nearest-neighbour is still often used as an uncommitted mechanism to compare texture representations due to its simplicity and absence of parameters that need to be tuned.. Of these three dimensions of statistical texture representation-the choice of histogram or signature representation; the descriptive space over which the histogram bins are defined; and the actual choice of histogram bins-the first two have been well-studied. The relative merits of histogramand signature-based approaches are explored in tandem with classification schemes, and a variety of local descriptors have been proposed including:. -The joint responses of various filter banks (Varma and Zisserman 2005; Hayman et al. 2004; Leung and Malik 2001; Cula and Dana 2001) , made up of e.g. Gaussian derivative filters (Hayman et al. 2004; Varma and Zisserman 2005 ). -Grey-scale image patches (Varma and Zisserman 2009) or points sampled in some regular local configuration (Ojala et al. 2002) ; and the related notion of Markov Random Fields (Varma and Zisserman 2009 ). -Modified SIFT (Lowe 1999) and intensity domain SPIN images (Lazebnik et al. 2003; Zhang et al. 2006 ). -Local fractal dimension and length (Varma and Garg 2007) .. In this paper we are interested in the third dimension: how to choose a dictionary of discrete features over which an image can be represented. For the sake of clarity, this paper uses the language of the common dictionary/histogram approach to representation, although many points are also relevant to signature-based approaches. We have developed a statistical texture representation which models images as histograms over a dictionary of features which is based on the qualitative type of local geometric structure, encoded by Basic Image Features, rather than a dictionary based on clustering. Our features are naturally invariant to rotation and reflection, and addition and linear multiplication of illumination intensity; and we have extended the approach to incorporate invariance to changes in scale.. Our approach has the advantages over methods which use clustering of simplicity-there is no need for a pre-training step to learn a visual dictionary-and computational efficiency, since we assign feature vectors to histogram bins without needing to perform a nearest-neighbour computation. In addition, it avoids the potential introduction of biases by clustering algorithms poorly suited to the data.. We have tested our implementation on three popular and challenging texture datasets and find that it produces consistently good classification results on each, including what we believe to be the best reported for the KTH-TIPS and equal best reported for the UIUCTex databases. Further, it does this without requiring modification or tuning of parameters between datasets. Statistical texture representations which are based on equally-spaced binning of feature space or on visual dictionaries derived by clustering feature vectors are discussed above.. One approach which, like ours, engineers a datasetindependent dictionary of local features over which textures are represented statistically, is Local Binary Patterns (LBPs) (Ojala et al. 2002) . Images are probed locally by sampling greyscale values at a point g c and P points g 0 , . . . , g P −1 spaced equidistantly around a circle of radius R (the choice of which acts as a surrogate for controlling the scale of description) centred at g c , as shown in Fig. 1a . The resulting feature space of P + 1 greyscale values can be partitioned according to one of a nested set of progressively more invariant LBP systems: -The first defines Local Binary Patterns themselves. The greyscale value at g c is subtracted from those at g 0 , . . . , g P −1 and the resulting values thresholded about zero to produce a Local Binary Pattern (as in Fig. 1b Fig. 1c . In many cases, the majority of patterns observed in texture images are classified as one of these P + 1 uniform LBPs. All other LBPs are grouped together into a single 'other' category, producing a P + 2 dimensional representation.. LBPs are similar to our approach in that they are based upon a pre-defined visual dictionary rather than one derived with reference to the dataset to be analysed. They therefore share the advantages listed above over methods based on clustering. They also possess similar invariances to our method. The central difference results from the local description used: we probe an image locally using Gaussian derivative filters where as LBPs sample greyscale values. This allows us to make use of some powerful mathematical properties of Gaussian derivatives in order to study the local geometry of the image in a way that allows a more geometrically rigorous treatment of invariances and partitioning of feature space. For example, the steerability (Freeman and Adelson 1991) of Gaussian derivative filters allows us to achieve exact rotation invariance rather than the approximate rotation invariance of LBPs.. The remainder of the paper is structured as follows: In Sect. 2 we introduce Basic Image Features and our BIFbased texture representation. In Sect. 3 we evaluate this approach against a selection of state-of-the-art alternatives on a commonly used texture dataset. In Sect. 4 we extend our approach to incorporate scale invariance: this involves extending our representation and developing a multi-scale texture comparison metric for classification. Results are presented on two additional datasets which contain significant intraclass changes in scale.

O B I I O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Testing the hypothesis of preferential attachment in social network formation The hypothesis of preferential attachment (PA) -whereby better connected individuals make more connections -is hotly debated, particularly in the context of epidemiological networks. The simplest models of PA, for example, are incompatible with the eradication of any disease through population-level control measures such as random vaccination. Typically, evidence has been sought for the presence or absence of preferential attachment via asymptotic power-law behaviour. Here, we present a general statistical method to test directly for evidence of PA in count data and apply this to data for contacts relevant to the spread of respiratory diseases. We find that while standard methods for model selection prefer a form of PA, careful analysis of the best fitting PA models allows for a level of contact heterogeneity that in fact allows control of respiratory diseases. Our approach is based on a flexible but numerically cheap likelihood-based model that could in principle be applied to other integer data where the hypothesis of PA is of interest.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Automatic Reconfiguration for Large-Scale Reliable Storage Systems Abstract-Byzantine-fault-tolerant replication enhances the availability and reliability of Internet services that store critical state and preserve it despite attacks or software errors. However, existing Byzantine-fault-tolerant storage systems either assume a static set of replicas, or have limitations in how they handle reconfigurations (e.g., in terms of the scalability of the solutions or the consistency levels they provide). This can be problematic in long-lived, large-scale systems where system membership is likely to change during the system lifetime. In this paper, we present a complete solution for dynamically changing system membership in a large-scale Byzantine-fault-tolerant system. We present a service that tracks system membership and periodically notifies other system nodes of membership changes. The membership service runs mostly automatically, to avoid human configuration errors; is itself Byzantinefault-tolerant and reconfigurable; and provides applications with a sequence of consistent views of the system membership. We demonstrate the utility of this membership service by using it in a novel distributed hash table called dBQS that provides atomic semantics even across changes in replica sets. dBQS is interesting in its own right because its storage algorithms extend existing Byzantine quorum protocols to handle changes in the replica set, and because it differs from previous DHTs by providing Byzantine fault tolerance and offering strong semantics. We implemented the membership service and dBQS. Our results show that the approach works well, in practice: the membership service is able to manage a large system and the cost to change the system membership is low. T ODAY, we are more and more dependent on Internet services, which provide important functionality and store critical state. These services are often implemented on collections of machines residing at multiple geographic locations such as a set of corporate data centers. For example, Dynamo uses tens of thousands of servers located in many data centers around the world to build a storage back-end for Amazon's S3 storage service and its e-commerce platform [1] . As another example, in Google's cluster environment each cluster includes an installation of the GFS file system spanning thousands of machines to provide a storage substrate [2] .. Additionally, these systems are long lived and need to continue to function even though the machines they run on break or are decommissioned. Thus, there is a need to replace failed nodes with new machines; also it is necessary to add machines to the system for increased storage or throughput. Thus, the systems need to be reconfigured regularly so that they can continue to function.. This paper provides a complete solution for reliable, automatic reconfiguration in distributed systems. Our approach is unique because. . It provides the abstraction of a globally consistent view of the system membership. This abstraction simplifies the design of applications that use it, since it allows different nodes to agree on which servers are responsible for which subset of the service. . It is designed to work at large scale, e.g., tens or hundreds of thousands of servers. Support for large scale is essential since systems today are already large and we can expect them to scale further. . It is secure against Byzantine (arbitrary) faults.. Handling Byzantine faults is important because it captures the kinds of complex failure modes that have been reported for our target deployments. For instance, a recent report about Amazon's S3 showed that a bit flip in a server's internal state caused it to send messages with the wrong content [3] . Additionally, the Byzantine fault model makes it possible to tolerate malicious intrusions where an attacker gains control over a number of servers. Earlier, proposals for keeping track of a dynamic system membership do not provide all three properties. Many do not tolerate Byzantine failures, (e.g., [4] , [5] ). Some that handle Byzantine faults provide consistency but work only for a system containing a small number of nodes (e.g., [6] ), while others trade off consistency to achieve scalability (e.g., [7] ). The one exception is Census [8] ; this builds on our techniques for flexible reconfiguration, but uses other mechanisms to track system membership.. Our solution has two parts. The first is a membership service (MS) that tracks and responds to membership changes. The MS works mostly automatically, and requires only minimal human intervention; this way we can reduce manual configuration errors, which are a major cause of disruption in computer systems [9] . Periodically, the MS publishes a new system membership; in this way it provides a globally consistent view of the set of available servers. The choice of strong consistency makes it easier to implement applications, since it allows clients and servers to make consistent local decisions about which servers are currently responsible for which parts of the service.. We run the MS on a small group of replicas and use a number of protocols [10] , [11] , [12] , [13] to enable the MS to tolerate malicious attacks; we were able to take advantage of protocols developed by others but combine them in novel ways. Using a small group for the MS is important since these protocols work well only in this case. The design provides scalability to a large number of nodes, most of which are clients of the MS. Additionally, it avoids overloading the servers that form the MS by offloading expensive tasks to other nodes.. When there is a reconfiguration, the MS may need to move to a new group of servers. This way, we allow the system to continue to operate correctly, even though the failure bound in the original group of MS replicas may subsequently be exceeded. We present a design for reconfiguring the Byzantine-fault-tolerant group.. Tracking membership is only part of what is needed for automatic reconfiguration. In addition, applications need to respond to membership changes appropriately.. Therefore, the second part of our solution addresses the problem of how to reconfigure applications automatically as system membership changes. We present a storage system, dBQS, that provides Byzantine-fault-tolerant replicated storage with strong consistency. dBQS serves as an example application that uses the membership service and takes advantage of its strong consistency guarantees. Additionally, dBQS is important on its own for two reasons. First, to develop dBQS we had to extend existing Byzantine quorum protocols, originally designed for a static replica set, to enable them to be reconfigurable while continuing to provide atomic semantics across changes in the replica set. Second, dBQS implements the popular DHT interface [14] , but differs from previous DHTs by handling Byzantine faults and focusing on strong semantics, which can facilitate design of applications that build on a DHT interface. In addition, the techniques used to handle membership changes in dBQS could be generalized to other applications.. We have implemented the membership service and dBQS. We present performance results that show that the MS is able to manage a large system and reconfigure in a reasonably short interval, and that the impact of reconfiguration on dBQS performance is small. This paper presents a complete solution for building large scale, long-lived systems that must preserve critical state in spite of malicious attacks and Byzantine failures. We present a storage service with these characteristics called dBQS, and a membership service that is part of the overall system design, but can be reused by any Byzantine-faulttolerant large-scale system. The membership service tracks the current system membership in a way that is mostly automatic, to avoid human configuration errors. It is resilient to arbitrary faults of the nodes that implement it, and is reconfigurable, allowing us to change the set of nodes that implement the MS when old nodes fail, or periodically to avoid a targeted attack.. When membership changes happen, the replicated service has work to do: responsibility must shift to the new replica group, and state transfer must take place from old replicas to new ones, yet the system must still provide the same semantics as in a static system. We show how this is accomplished in dBQS.. We implemented the membership service and dBQS. Our experiments show that our approach is practical and could be used in a real deployment: the MS can manage a very large number of servers, and reconfigurations have little impact on the performance of the replicated service. Barbara Liskov is an MIT Institute professor of computer science and engineering and head of the Programming Methodology Group. Her research interests includes programming methodology, programming languages and systems, and distributed computing. Major projects include: the design and implementation of CLU, the first language to support data abstraction; the design and implementation of Argus, the first high-level language to support implementation of distributed programs; and the Thor object-oriented database system, which provides transactional access to persistent, highly-available objects in wide-scale distributed environments. Her current research interests include Byzantine-fault-tolerant storage systems and efficient and secure online storage. She is a member of the National Academy of Engineering, the IEEE, and the IEEE Computer Society, and a fellow of David Schultz received the BA degree in computer science (with distinction) from the University of California, Berkeley, and the MS degree in computer science from the Massachusetts Institute of Technology (MIT). He is currently working toward the PhD degree at MIT, with a focus on information flow control. His main interests include distributed systems, security, and cryptography.. . For more information on this or any other computing topic, please visit our Digital Library at www.computer.org/publications/dlib. We begin by discussing prior work on systems like our MS that provide membership control. Then, we discuss work on replicated systems, like dBQS, that support a dynamic set of replicas. At the end of the section, we discuss other examples of large-scale Byzantine-fault-tolerant storage systems.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A coordination-theoretic investigation of the impact of electronic integration on logistics performance Using the Coordination Theory, we explored the impact of electronic integration of intraorganizational and inter-organizational business processes on organizational performance in terms of logistics cost and service improvements. Our work extends knowledge on adoption of IT in logistics operations, with a focus on examining the performance implications of electronic integration within and between firms in a supply chain. Data was collected from 227 trading firms in Hong Kong and analyzed to investigate the research issues. Our empirical findings revealed that electronic integration is positively * Corresponding What can be done to improve the logistics performance of firms? This is a question facing managers in business and industry. Logistics has become an integral part of corporate strategy; it contributes to the primary activities of the value chain of firms. The logistics activities are inter-dependent, requiring careful allocation of resources to achieve service goals and to reduce wastes in the supply chain such as idle time, and duplication of efforts. Logistics deals with the processes of planning, implementing, and controlling the efficient flow and storage of raw materials, in-process inventory, finished goods, services, and related information from points of origin to consumption while conforming to customer requirements. These processes require the use of IT for effective coordination. However, the logistics business processes of many firms are still confined to manual processes and to isolated functional automation [19] , which lack coordination to manage the tasks effectively.. Electronic integration (E-integration) can be traced to Porter's Value Chain Model [33] .. Electronic linkage is the enabling mechanism to coordinate logistics activities and integrate the business processes [20] . According to Stevens [38] , there are different types of integration, ranging from functional to internal and external integration. Romano [36] suggested that there are two levels of e-integration in support of the coordination of business processes in a supply chain; intra-company, spanning internal functional boundaries, and inter-company improving communication between companies. A systematic investigation of the performance implications of e-integration is highly desirable as many reputable companies such as Dell Computer, Seven-Eleven Japan, Lucent Technologies, Wal-Mart, and Procter & Gamble have reported being their benefits from integrating activities with their supply chain partners. To provide empirical evidence of the contribution of e-integration, we therefore examined through the use of empirical data, the extent of e-integration and its logistics performance implications.. Although some case studies have documented intra-and inter-organizational eintegration for logistics operations, they only investigated the use of IT in logistics processes for better performance [37] ; they provided limited understanding of the link between e-integration and logistics performance. But as Rogers' Innovation Diffusion Theory [35] says, there are multiple stages in the diffusion of IT However, several research gaps still exist. First, past studies were limited to examining the prerequisite of e-integration and its related measures in the decision stage, focusing on analysis of the supplier selection process for logistics process integration, raising awareness of e-integration benefits, and designing business networks for logistics management, etc. Second, work has tended to focus on the effects of antecedents, such as organizational characteristics, organizational support, organizational readiness, institutional pressures, and inter-organizational relationships, on the performance of eintegration. Such studies have only provided limited insights into the business value of eintegration. Third, there have been few empirical investigations into the performance from being exposed to an innovation to making a decision to adopt or reject it.. implications, due mainly to a lack of appropriate measurements to cope with the complexity of electronic linkages between business processes.. There is a need for theoretical explanations for the observation that some firms perform better than others when using e-integration. In Figure 1 , we have summarized the research issues in the different stages of e-integration (decision, adoption, and implementation), and identified the position of this study in the literature.. <Insert Figure 1 about here> The objective of our study was to examine the link between e-integration and logistics performance, providing reasons why such a link may exist from the Coordination Theory aspect. The questions were:. (1) Is the implementation of intra-and inter-organizational e-integration associated with cost-and service-related logistics performance? (2) What are the different aspects (dimensions) of e-integration? and (3) Why some firms perform better than others despite though they all have implemented e-integration?

O O O O O O O B I O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Medical Informatics: Searching for Underlying Components Objective: To discuss unifying principles that can provide a theory for the diverse aspects of work in medical informatics. If medical informatics is to have academic credibility, it must articulate a clear theory that is distinct from that of computer science or of other related areas of study.The notions of reusable domain ontologies and problem-solving methods provide the foundation for current work on second-generation knowledge-based systems. These abstractions also are attractive for defining the core contributions of basic research in informatics. We can understand many central activities within informatics in terms defining, refining, applying, and evaluating domain ontologies and problem-solving methods.and problem-solving methods may move us closer to a theoretical basis for our field.Keywords: Medical informatics, computing methodologies, artificial intelligence, academic training, professional training 2There is wide recognition that the management of medical information is central to the future of both health care and the world's health. Medical professional societies everywhere point to medical informatics as an essential element of medical practice. The word informatics increasingly is used as an adjective to sell the latest health-care technology. Vendors of clinical information systems hope to impress customers by claiming that their products are based on "informatics techniques" and "informatics methods." The recent report of the Institute of Medicine on the problem of medical errors specifically identified information technology as a large element of the needed solution [1] . For the first time in its history, the American Society for Clinical Investigation-the major honor society for academic physician-scientists in the United States-now recognizes medical informatics as a specific area of investigation. With the concept of informatics finally entering the mainstream, one would think that these would be heady days for our research community. My problem, however, is that I am still sure not what "medical informatics" is.The term medical informatics has become a universally applied term that, sadly, remains difficult to define. The latest edition of Shortliffe's textbook defines the discipline as, "a field of study concerned with the broad issues in the management and use of biomedical information, including medical computing and the study of the nature of medical information" [2] . Jan van Bemmel and I defined informatics as "the science that studies the use and processing of data, information, and knowledge," and medical informatics as "informatics applied to medicine, health care, and public health" [3] . Shortliffe's definition, by couching medical informatics in terms of unspecified "broad issues," leaves the dimensions of the discipline intentionally vague. This lack of specificity has the advantage of defining the field to be maximally inclusive. Van Bemmel and I, in using the word science to describe informatics, implicitly make strong claims about the existence of an underlying theory and of an empirical methodology that can explore potentially defeasible hypotheses. As an academic, I very much want to believe that medical informatics is a science, or at least that it has scientific elements. It remains a challenge for our community, however, both to articulate the underlying theory of informatics and to embrace an empirical approach to validating hypotheses.When most people talk about medical informatics, they speak not of theories or of methodologies, but simply of computer applications in medicine. Terms such as clinical computing permeate our culture. Descriptions that emphasize the computational aspects of our work are indeed much more understandable to most people than is the word informatics-which even my spell-checker insists is not a real word. The problem for our field-and the problem for more entrenched disciplines such as computer science-is that the emphasis on the role of the computer in defining our discipline is that we highlight the technology that facilitates our work, rather than putting the focus squarely on the work itself. We don't call probability theory "dice science"; we don't call the study of literature "pencil science." We easily seem to be able to call medical informatics medical computer science, however.Our colleagues in traditional departments of computer science remain confused about the relationship between work in our community and that in their own. My own fellow faculty My colleagues also wonder why the rather close relationship shared by medical informatics and computer science at Stanford does not seem to be replicated at many other universities.Traditionally, workers in medical informatics have been somewhat estranged from their colleagues in computer science. They have worked in different faculties, often quite separated geographically. The two disciplines also have been quite separated intellectually, despite the fact that both are dependent, ultimately, on computational principles. The result is that the medicalinformatics community as a whole has been extremely slow to build on the advances that have been achieved in computer science. In the 1970s, for example, the computer-science community was discovering structured programming and abstract data types; at the same time, the medicalinformatics community, struggling to build time-shared applications that would execute within a minuscule memory space, was still discovering MUMPS. In the 1980s, when the computerscience community was turning to relational database technology and distributed architectures, our community still was promoting hierarchical databases and mainframe systems. In the 1990s, when the computer science community had come to grips with the significant limitations of rule-4 based architectures for building knowledge-based systems [4], the medical-informatics community was advocating the use of medical logic modules as the standard means for computer-based decision support. It is not that MUMPS and mainframe systems and medical logic modules did not make important contributions. Rather, the point is that, when the traditional computer-science community has made significant intellectual advances, the medicalinformatics community often has trailed in its incorporation of these results. Our colleagues outside our community thus have not tended to view our work as advancing the science-or at least as advancing their science. The problem, of course, is that we in medical informatics have not done a very good job of articulating what our own science is.It is significant, however, that there is substantial overlap in the goals of workers in medical informatics and those of researchers in the subset of the computer-science community concerned with the development of knowledge-based systems. My goal in this paper is to show how principles for building knowledge-based systems that began to be articulated by a large community of researchers in the 1990s are particularly germane to developing a theory for medical informatics. We are a long way from defining an overarching theory for our field, but these advances from the world of knowledge-based systems can offer our own research community a more solid theoretical footing-for purposes of communicating ideas both among ourselves and among our computer-science colleagues.Although there are notable exceptions, workers in medical informatics tend not to present their work in a manner that would allow their computer-science colleagues to identify the generalizable results. It is often difficult for us to present our work detached of the contributions that we make specifically to biomedicine. Work in medical informatics, however, does lead to significant theoretical results-particularly when members of the medical-informatics community can elucidate the general principles and can stimulate their colleagues to build on them. A key question for our field, however, is whether medical informatics should be viewed discipline should be to communicate more effectively with the academic computer-science community, not to merge with it. I believe it would be wrong to construe current work in medical informatics simply as computer science with a biomedical bent. It also would be wrong to construe medical informatics as a form of software engineering that concentrates on the development of clinical computer systems.Many laboratories for medical informatics were created during the past four decades in response to pressing needs to assist clinical information management. Early information systems for health-care organizations frequently addressed administrative and financial concerns. Rarely did such systems provide assistance in the management of clinical data. As a result, academicians stepped in to fill a niche that industry at the time was refusing to address. The need to build information systems that could acquire, store, and communicate clinical data sparked the emergence of many of the great academic groups in medical informatics. Satisfying institutional requirements for clinical data management also provided the substrate for much of the seminal research in medical informatics. I have argued elsewhere that, despite the obvious advantages of having direct access to the information infrastructure of a health-care organization, a set of service commitments no longer necessarily enhances a laboratory's work in medical informatics [7] . Fundamentally, I believe that modern software systems have become much too large and much too complex to be designed, implemented, tested, and maintained by small groups of academicians who are supported on academic budgets. It simply is inconceivable to me that an academic unit without the discipline, procedures, and personnel resources of a commercial software-engineering 6 organization could create and deploy a large-scale information system on the scale of HELP using today's programming conventions. It therefore seems dangerous to define medical informatics-at least in the academic sense-specifically in terms of the software artifacts that we can build for the clinical enterprise. The changing landscape of academic medical centers, at least in the United States, makes some of the "broad issues" of medical informatics to which Shortliffe [2] alludes no longer within the purview of most academic groups. As development and deployment of clinical information systems becomes squarely the province of industry, much of what used to be considered part of academic medical informatics suddenly has been taken away from university faculty. I will suggest, however, that our research contributions actually will be strengthened as we focus on the part of medical informatics that still remains solidly within the academic realm.Investigators in any area of science require theories that can frame the interpretation of observations and that can provide the basis for making advances in understanding. If medical informatics is to have credibility as an academic discipline, it is essential to identify its scientific foundations. We must articulate the basic theories, and explain how our individual contributions extend those theories. It is my belief that workers in medical informatics have difficulty explaining their academic enterprise to other faculty colleagues-and to one another-primarily because our community has not done a good job of articulating a set of fundamental assumptions. We are excellent at describing the surface behavior of our artifacts and quite good at measuring their success. We have a long way to go, however, in being able to explain why our artifacts are successful in terms of some underlying theory or set of basic principles.We certainly can turn to principles of computer science to justify much of our systems' behavior.Theories of software engineering, of human-computer interaction, and of computational complexity certainly are essential to understanding and evaluating computer systems built for the clinical arena. When we define the theory of medical informatics only in terms of the theory of computer science, however, medical informatics loses any claim to being a scientific discipline in its own right. If we believe that the study of medical informatics itself contributes to a basic 8 understanding of some aspect of the world that is intrinsically valuable, then it is imperative for us to articulate the theoretical underpinnings of medical informatics that are distinct from those of computer science-and from those of other fields, such as information theory, biostatistics, and health-services research.Unfortunately, our discipline has had few philosophers with a penchant for suggesting underlying theories. Blois [9] made a landmark attempt at defining a theory of medical informatics in his monograph on the nature of medical information. Blois made the claim that medicine, as an area of human endeavor, is epistemologically unique. He argued that this uniqueness arises because clinical knowledge is dependent on understanding other knowledge that can be defined only at lower levels of abstraction (e.g., that of organismal biology), which in turn can be understood only in terms of knowledge that needs to be defined at still lower levels of abstraction (e.g., that of biochemistry), and so on. Blois suggested that a vast hierarchy of informational levels creates a kind of complexity that is unknown outside of medicine. He justified medical informatics as an academic discipline on the basis of the singular need to model these different hierarchical levels when building information systems for use in clinical care.Blois' hierarchy of information levels has compelling face validity. As a theory, however, it does little to explain our successes and failures in medical informatics. It is hard to think of a specific example of where a clinical information system may have failed expressly because it neglected to consider knowledge that exists at different hierarchical levels, or could not use knowledge at one level to reason about knowledge at another level. There are many compelling examples where systems have taken good advantage of reasoning at multiple levels of abstraction [10] , but demonstration of this principle does mean that the hierarchical levels of knowledge described by Blois contribute to a fundamental theory of medical informatics.

B I O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I B I B I B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I


Practical issues for the implementation of survivability and recovery techniques in optical networks Failures in optical networks are inevitable. They may occur during work being done for the maintenance of other infrastructures, or on a larger scale as the result of an attack or large-scale disaster. As a result, service availability, an important aspect of Quality of Service (QoS), is often degraded. Appropriate fault recovery techniques are thus crucial to meet the requirements set by the Service Level Agreements (SLAs) between the carriers and their customers.In this paper, we focus on practical issues related to the deployment of fault recovery mechanisms in commercial optical networks. In particular, we outline the most important functionalities that, to our knowledge, need to be implemented, as well as discuss the related problems making deployment of fault recovery mechanisms difficult. Investigated topics include: fault recovery challenges (fault detection, location, and recovery), multiple failures recovery, as well as application of reliability mechanisms in elastic optical networks, and in multiprovider multilevel networks. Network survivability, defined in [1] as the ability to provide continuous service in the presence of failures, is a critical issue for high-bandwidth backbone optical networks with arbitrary mesh topologies. Failures in fiber-optic networks occur often due to the fact that they are a cable-based technology and the infrastructure is co-located with networks for other utilities. Thus, damages usually happen during work being done for the maintenance of other infrastructures.. Furthermore, due to the use of wavelength division multiplexing (WDM) technology in these networks, each fiber can carry an extremely high volume of traffic, thus more traffic is concentrated on fewer routes, increasing the number of customers that can be potentially affected by a failure.. In this paper, we focus on deployment issues of fault recovery mechanisms in commercial optical networks. In particular, we discuss the current needs concerning implementation of failure recovery techniques as well as the related problems following e.g., from hardware constraints.. Over the past two decades, various approaches have been proposed for the recovery of the traffic when a failure event occurs. They are mainly based on utilization of alternate paths, called backup paths (BPs), used to redirect the traffic after a failure of a network element affecting the primary routes, called working paths (WPs) [2] . Specific schemes of backup routes include link-, path-, segment-, and cycle-based techniques.. The general requirement when providing protection against failures of nodes/links is that the respective backup paths should be node-(link-) disjoint from the working paths being protected [3] . Additionally, link capacities reserved for backup paths can be shared along certain links, if the considered backup paths protect mutually disjoint working paths [2] . Failures of single links/nodes are the most frequent types of failures. However, due to the often observed inter-failure correlation, a large set of solutions is dedicated to the case of multiple failures, i.e., a simultaneous failure of several network elements [4] .. Survivability can be provided either in a proactive wayusing a protection strategy, implying establishment of a backup path before the occurrence of a failure (i.e., at the time of working path establishment), or by means of a reactive restoration strategy. In the latter case, the network tries to establish a new connection using available resources only after a failure has occurred. Protection typically has faster recovery speed but lower resource-efficiency than restoration [5] .. There are many types of service disruptions in optical networks, which can be classified in two major types: soft and hard failures [6] . Hard failures, such as fiber cuts and failure of a network linecard occur suddenly and have a severe impact on services, causing major loss of traffic. Soft failures, such as aging of an amplifier, cause subtle changes in performance, resulting in a wide spectrum of service degradations which are far more difficult to detect and localize.. Some failures, called self-reported, are very easily detected because they interfere with the correct functioning of the upstream device and are flagged by internal control mechanisms. Most hard and a large number of soft failures are self-reported [7] . Soft failures that are not self-reported can be very hard to detect and accurately localizing them is timeconsuming and very costly.. Even though failures cannot be avoided, quick detection, identification, and recovery of faults are crucial aspects in the successful deployment of telecommunication networks. A network fault that goes unattended for a long period of time can cause both tangible and intangible losses for the company that provides the service, as well as for its clients. Therefore, the current trend is for more and more networks that are virtually uninterruptible.. Currently, carriers are bound to service-level agreements (SLAs) with their customers guaranteeing that the customer will be provided with services with a prescribed service availability (e.g., 99.999% availability -equivalent to less than 5 minutes of down time per year), with financial penalties if the SLA availability is not met. It is therefore clear that in optical backbone networks it is essential to have effective fault recovery mechanisms to prevent the loss of information due to fiber cuts or equipment failures, which may occur often enough to cause major service disruptions.. Furthermore, the constant growth of traffic in computer networks mainly due to popular services such as cloud computing and content-oriented networks, has triggered the need to develop an efficient and scalable optical transport platform for capacities beyond 100 Gb/s. One of the technologies, which enables improved use of flexible optical network is a scalable and efficient architecture called Elastic Optical Networks (EONs). The key innovation of EONs compared to currently used WDM (Wavelength Division Multiplexing) networks is the possibility of using subwavelength granularity with 6.25 GHz slices for low-rate transmission and super-channel connectivity for accommodating ultra-high capacity client signals within a common network [8] . Accordingly, the optical spectrum can be used much more flexibly compared to the fixed grid of 50 GHz channels in WDM.. One of the consequences of the flexible grid provided in EONs, is the possibility to provision asymmetric traffic where demands of the same bidirectional connection between a particular pair of nodes have different bandwidth requirements in each direction. Especially, in the context of network survivability based on path protection, this option seems very attractive, since significant savings of network resources in terms of optical spectrum should be obtained.. Although much research has been performed in the area of optical networks' reliability and survivability over the last two decades, there are still many practical issues that need to be addressed for the successful commercial implementation of fault recovery techniques in optical networks. In this paper, we identify the most important of them, with invited sections from panelists based on their presentations at IEE/IFIP RNDM (Reliable Networks Design and Modeling) 2013 [9] . In particular, in Section 2, we outline the fault recovery challenges related to fault detection, localization, and recovery related to physical layer impairment issues, shared protection, as well as switch design considerations, especially for the case of transparent or translucent optical networks, where the signal remains in the optical domain for the entire end-to-end path or for large parts of the path. In Section 3, we extend our investigation to the case of multiple failures. Next, in Section 4, we investigate applicability of reliability mechanisms in the context of Elastic Optical Networks. In Section 5, we address the resilience and recovery issues concerning multiprovider multilevel networks, while Section 6 concludes the paper. In this paper, we focused on deployment issues of survivability and dependability mechanisms in optical networks. In particular, we discussed the current challenges concerning implementation of failure recovery techniques, as well as the related problems following e.g., from hardware constraints, and across multiple providers and levels.. Although failures are inevitable, resilience, survivability, and fault recovery mechanisms can provide efficient means to provide uninterrupted service. However, as we discussed in this paper, the problem of fault detection, localization, and recovery becomes more difficult for the scenario of all-optical forwarding due to lack of electronic processing of a signal by the transit nodes of the lightpath.. In the latter part of the paper, we concentrated on fault recovery issues for the new concept of Elastic Optical Networks, being in our opinion an important direction of optical networks evolution. Finally, we discussed issues related to fault recovery in multilevel multiprovider environments, where e.g., due to ownership-related problems, fault recovery strategies can be confined only to certain network areas.

O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O B I O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O


Searching for liveness property violations in concurrent systems with ACO Liveness properties in concurrent systems are, informally, those properties that stipulate that something good eventually happens during execution. In order to prove that a given system satisfies a liveness property, model checking techniques are utilized. However, most of the model checkers found in the literature use exhaustive deterministic algorithms that require huge amounts of memory if the concurrent system is large. Here we propose the use of an algorithm based on ACOhg, a new kind of Ant Colony Optimization algorithm, for searching for liveness property violations in concurrent systems. We also take into account the structure of the liveness property in order to improve the efficacy and efficiency of the search. The results state that our algorithmic proposal, called ACOhg-live, is able to obtain very short error trails in faulty concurrent systems using a low amount of resources, outperforming by far the results of Nested-DFS and Improved-Nested-DFS, two algorithms used in the literature for this task in the model checking community. This fact makes ACOhg-live a very suitable algorithm for finding liveness errors in large faulty concurrent systems, in which traditional techniques fail because of the model size. Model checking [5] is a fully automatic technique that allows to check if a given concurrent system satisfies a property like, for example, the absence of deadlocks, the absence of starvation, the fulfilment of an invariant, etc. The use of this technique is a must when developing software that controls critical systems, such as an airplane or a spacecraft. Unlike test case generation, model checking is a formal method that can prove that the software system fulfils a specified property. However, the memory required for the verification usually grows in an exponential way with the size of the system to verify. This fact is known as the state explosion problem and limits the size of the system that a model checker can verify.. Several techniques exist to alleviate the state explosion problem. They reduce the amount of memory required for the search by following different approaches (see [13] ). However, exhaustive search algorithms are always handicapped in large concurrent systems because most of these systems are too complex even for the most advanced techniques. When the search for errors with a low amount of computational resources (memory and time) is a priority (e.g., in the first stages of the development), non-exhaustive algorithms using heuristic information can be used.. Non-exhaustive algorithms can find errors in programs using less computational resources than exhaustive algorithms, but they cannot be used for verifying a property: when no error is found using a non-exhaustive algorithm we still cannot ensure that no error exists. Due to this fact we can establish some similarities between heuristic model checking using non-exhaustive algorithms and software testing [16] . In both cases, a large region of the state space of the program is explored in order to discover errors; but the absence of errors does not imply the correctness of the program.. A well-known class of non-exhaustive algorithms for solving complex problems is the class of metaheuristic algorithms [4] . They are search algorithms used in optimization problems that can find good quality solutions in a reasonable time. In fact, Genetic Algorithms [11] and Ant Colony Optimization [2] have been applied in the past for searching for safety property violations in concurrent systems. The search for liveness property violations is not so direct and, in fact, no metaheuristic algorithm has been ever applied to it in the literature to the best of our knowledge.. In this work we propose an algorithm based on the ACOhg algorithm presented in [2] for searching for liveness property violations in concurrent systems. We also take into account the internal structure of the property itself in order to im-prove the search. The paper is organized as follows. The next section presents the foundations of the problem. In Section 3 the problem is formalized as a graph search. Section 4 describes our algorithmic proposal, called ACOhg-live. In Section 5 we present some experimental results analyzing the influence on the performance measures of the knowledge about the property structure and we compare our proposal against two exhaustive algorithms utilized for checking liveness properties in explicit state model checking: Nested-DFS and Improved-Nested-DFS. Finally, Section 6 outlines the conclusions and future work. We have presented here a novel proposal based on ant colony optimization for finding liveness property violations in concurrent systems: ACOhg-live. This problem is of capital importance in the development of software for critical systems and no metaheuristic algorithm has been applied to it in the literature, to the best of our knowledge. We have also proposed an improvement of the technique based on the classification of the strongly connected components of the never claim. We have shown the performance of the proposals with a series of experiments. First, we have compared two versions of the algorithm with and without the SCC improvement. After that, we have compared the results obtained with our proposal against two algorithms used for finding liveness errors in concurrent systems: NDFS and INDFS. The results show that ACOhg-live is able to outperform both algorithms in efficacy and efficiency. It requires a very low amount of memory and it is able to find errors even in models in which NDFS and INDFS fail in practice due to memory requirements.. As future work we plan to combine ACOhg-live with other techniques for reducing the amount of memory required in the search such as partial order reduction, symmetry reduction, or state compression. We have observed in a preliminary (not published) study that a version of ACOhg-live that does not use pheromone trails for guiding the search is also able to obtain competitive results and requires even less memory. An additional advantage of such kind of algorithm is that it has fewer parameters than a version using pheromone trails. We will study the advantages and limitations of this alternative. In this section we give some details on the way in which properties are checked in explicit state model checking. In particular, we will focus on the model checker HSF-SPIN [8] , an experimental model checker by Edelkamp, Lluch-Lafuente and Leue based on the popular model checker SPIN [13] . First, we formally define the concept of property of a concurrent system. After that, we detail how the properties can be represented using automata and we define the concept of strongly connected components, which allows us to implement improvements on the search algorithms. Finally, we detail how heuristic information is used to guide the search for property violations. In this section we present some results obtained with our ACOhg-live algorithm. For the experiments we have selected five Promela 2 models (three of them scalable) that are presented in the following section. After that, we discuss the algorithmic parameters used in the experiments in Section 5.2. In Section 5.3 we compare two versions of the algorithm with and without the improvement based on the SCC classification of the never claim. Next, in Section 5.4 we compare the results obtained with ACOhg-live against NDFS and INDFS.

O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O