Exploiting synchronous and asynchronous DVS for feedback EDF scheduling on an embedded platform Contemporary processors support dynamic voltage scaling (DVS) to reduce power consumption by varying processor voltage/frequency dynamically. We develop power-aware feedback-DVS algorithms for hard real-time systems that adapt to dynamically changing workloads. The algorithms lower execution speed while guaranteeing timing constraints. We study energy consumption for synchronous and asynchronous DVS switching on a PowerPC board. Energy, measured via data acquisition, is reduced up to 70% over naïve DVS for our feedback scheme with 24% peak savings over previous algorithms. These results, albeit differing in quantity, confirm trends observed under simulation. They are the first of their kind on an embedded board. Energy consumption has always been a critical issue for embedded and mobile systems where the system service time largely depends on the limited battery 3:2 • Y. Zhu and F. Mueller capacity. Software mechanisms have been widely exploited to reduce the energy consumption of those embedded systems, especially the energy costs from processors and I/O devices. Some coarse-grained power-saving solutions have been implemented in operating systems, which turn off the CPU or I/O devices whenever the system idle time exceeds a certain threshold. These solutions restrict the system functionality when the CPU or I/O devices are shut down, usually resulting in much longer response times for external requests. Therefore, fine-grained power-saving mechanisms have been studied in recent years for a better trade-off between system performance and energy consumption. The philosophy behind those mechanisms is to keep processors or I/O devices running without heavy-weight shutdown operations. Processors or I/O devices dynamically switch between low-and high-power states with little overhead. The degradation of quality of service is usually transparent to users so that low power consumption is achieved while providing continuous system services and short interrupt response times.. Dynamic voltage scaling (DVS) is one of the fine-grained power saving mechanisms proposed in recent years for microprocessors. It is based on the relationship of. where P denotes the power dissipation of CMOS-based chips, V is the supply voltage, and f the clock frequency the processor [Chandrakasan et al. 1992] . Because of the quadratic relationship between the supply voltage and the power consumption, lowering the voltage results in significant power reductions for CMOS circuits. Since multiple voltage and frequency levels are supported in contemporary microprocessors and supporting chipsets, DVS can leverage power consumption by dynamically scaling the processor supply voltage up or down, depending on the computational demand of the workload. For any concrete processor, a higher clock frequency mandates a higher supply voltage. Hence, DVS controls both voltage and frequency simultaneously. In the following, we use the term dynamic voltage scaling to refer to combined voltage and frequency switching. DVS algorithms for general-purpose systems often use various heuristics to reduce processor voltage or frequency according to observed system workload [Weiser et al. 1994; Pering et al. 1995; Govil et al. 1995] . DVS for hard real-time systems, in contrast, requires more subtle control to not only consider the voltage and frequency, but also the timing constraints of a task set. Each task in a real-time system has a certain deadline associated with it. Since the execution of the task has to finish before that deadline, reducing the processor frequency, i.e., slowing down the speed of execution, may not always feasible in a real-time context. Different schemes have been proposed in previous work to integrate DVS algorithms into real-time systems [Pillai and Shin 2001; Aydin et al. 2001; Grunwald et al. 2000] . The objective is to derive a safe clock frequency considering timing constraints so that just enough processing capability is provided to complete a given task before its deadline. The primary objective is to meet deadlines, i.e., to guarantee schedulability of hard real-time tasks while the secondary objective is to save as much energy as possible under the timing constraints.. In this work, we focus on DVS algorithms for hard real-time systems with earliest-deadline-first (EDF) scheduling. Hard real-time systems are mission-critical control systems, where a single deadline miss may have catastrophic effects, i.e., the highest mandate is to meet all deadlines without compromise. We develop several power-aware schemes for feedback-DVS algorithms under EDF scheduling. The feedback-DVS algorithms adjust real-time tasks' speed dynamically according to feedback of past execution workload characteristics and guarantee that deadlines can still be met at the adjusted speeds.. Our previous work presented a simulation framework for DVS scheduling algorithms and reported results from simulations with different task sets [Dudani et al. 2002; Zhu and Mueller 2004] . In this paper, we refine this framework and further develop feedback schemes considering practical design and implementation issues on a real embedded platform. Specifically, our feedback DVS algorithm targets real-time tasks with dynamic workloads. It aggressively reclaims unused or underutilized CPU resources according to the dynamic variation of task workloads. Different feedback schemes are compared with each other and the actual energy consumption is measured on an embedded platform. Although the relationship of P ∝ V 2 × f is useful for simulation, the actual power savings also depend on other architectural and operating system factors. DVS algorithm overhead, such as the voltage and frequency switching overhead, and the DVS scheduling overhead, are measured and evaluated quantitatively in an actual embedded environment.. Traditionally, the processor voltage and frequency switching operation, although lighter weight than the overheads associated with sleep modes, still takes a small amount of time to complete. All other tasks have to be stopped during that interval. A unique DVS feature supported by our embedded platform is asynchronous switching, which allows applications to continue execution even during the frequency and voltage transitions. We study this asynchronous switching feature with our feedback DVS algorithm and compare it with synchronous switching operations.. Another factor that needs to be considered is the DVS scheduling overhead. Since DVS schemes are integrated into the operating system scheduler, the scheduler itself may execute at different processor speeds, which impacts timing properties of the entire system and requires accurate modeling. We examine all these issues by implementing our feedback DVS algorithm as well as several other DVS algorithms on an IBM PowerPC 405LP embedded board, which was specially modified for power-management research. We show the strength of our feedback DVS algorithms by comparing their energy consumption with other DVS algorithms on the embedded platform. This paper is organized as follows. Section 2 gives a brief introduction of the DVS scheduling framework and task model. Section 3 discusses our DVS algorithm and two feedback mechanisms proposed for the practical environment. Detailed experimental results are presented in Section 4. Section 5 discusses some of the related work. Conclusions are given in Section 6. This paper presents different feedback schemes for DVS algorithms considering practical hardware and software design and implementation issues. We evaluated our feedback DVS algorithms as well as several other real-time DVS algorithms on an IBM 405LP embedded platform. Real-time task sets with different varying workloads were assessed under different feedback schemes. We measured the actual energy consumption of our feedback DVS algorithm as well as several other real-time dynamic DVS algorithms on the embedded platform. Algorithm performance and its adaptability to dynamic workloads were evaluated. Asynchronous switching, a unique feature provided by the IBM 405LP embedded test board and synchronous switching were also assessed with the real-time task sets. Our experiments show up to 5% additional energy savings with asynchronous switching, as opposed to traditional synchronous-switching operations. The experimental results indicates a considerable potential for realtime DVS scheduling algorithms with up to 70% energy savings over a naïve DVS scheme. The strengths of our feedback DVS algorithms were also shown in experiments with a 24% peak energy savings over previous real-time DVS algorithms. These results differ in quantity from prior simulations, but they confirm the trends of savings observed under simulation. To the best of our knowledge, this is the first comparative study of real-time DVS algorithms on a concrete microarchitecture and the first evaluation of asynchronous DVS switching. Dynamic voltage scaling for real-time systems has received considerable attention in recent years. Pillai and Shin [2001] present a suite of DVS algorithms integrated with hard real-time EDF and RM scheduling. Processor speed for each task is adjusted dynamically while the schedulability of the system is still reserved. Look-ahead DVS is the most aggressive DVS scheme among the suite of algorithms proposed. discuss a series of algorithms, which dynamically reclaim unused computation time of real-time tasks to reduce the processor speed. Energy-aware scheduling of hybrid workloads, including both periodic and aperiodic tasks, are further investigated by Aydin and Yang in[2004] . Gruian [2001] analyzes dual-speed and multistep stochastic intratask DVS using a hybrid scheme with static-and dynamic-frequencyscaling. He observes that a dual-speed approach would be best but, short of knowledge about the actual execution time, promotes the stochastic approach whose data is derived from past execution traces. In contrast, our PID controller approximates the actual execution time closely so that the dual-speed approach becomes feasible. PID feedback is superior to a stochastic approach in that it can dynamically adjust to changing execution patterns. Also, our approach switches to the maximum frequency in the second part, not just a higher one. Furthermore, this switch only takes place when the predicted actual execution time is exceeded, while Gruian's approach allowed earlier switches, which would result in additional switch overhead on average. Jejurikar and Gupta [2004b] investigate static and dynamic slowdown factors for periodic tasks and combine it with procrastination scheduling [Jejurikar and Gupta 2004c] and preemption threshold scheduling [Jejurikar and Gupta 2004a] for DVS. Several of these algorithms were compared in a unified simulation environment-SimDVS [Shin et al. 2002] . In contrast, we measure power consumption on a concrete microarchitecture for several EDF-based algorithms.. Feedback control for real-time scheduling was first investigated by Stankovic et al. [1999] . Real-time system performance specifications are analyzed systematically through a control-theoretical methodology by Lu et al. [2000] . A feedback-control real-time scheduling framework for unpredictable dynamic real-time systems is further proposed by where execution times Feedback control was also proposed for energy-aware computing in previous work. Varma et al. [2003] present a feedback-control algorithm where the previous workload execution history is used to predict the future workload behavior by a discrete-time PID function. The combination of the proportional, integral, and derivative part of the PID function provides good estimation across different applications insensitive of the change of their parameters. describe a formal feedback-control algorithm combined with dynamic voltage/frequency scaling technologies for multimedia systems. Both continuous and discrete DVS settings are exploited in a scheme to reduce energy consumption, while still guaranteeing real-time requirements. An adaptive set-point is used to achieve fast responses with a stable multimedia throughput. Poellabauer et al. [2005] apply a feedback loop on cache miss rates to make more reliable prediction of future task execution times. A general energy-management scheme with feedback control is proposed by Minerick et al. [2002] . Average energy usage is achieved by continuously adjusting the voltage/frequency of a processor to meet the energy consumption goal. A PI (proportional and integral) feedback controller is used to adapt the proper power setting based on previous energy consumptions without the prediction of future system workloads. While Varma, Lu, and Poellabauer's work target software real-time systems and Minerick's work targets general purpose systems, our feedback DVS scheme focuses on hard real-time systems where timing constraints must not be violated.

O O O O O O O O B O O O O O O O B I I O O O O O O O O O O O O O O B O O B I O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B I I O B I O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B B I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O


The politecast communication primitive for low-power wireless In low-power wireless networks, nodes need to duty cycle their radio transceivers to achieve a long system lifetime. Counter-intuitively, in such networks broadcast becomes expensive in terms of energy and bandwidth since all neighbors must be woken up to receive broadcast messages. We argue that there is a class of traffic for which broadcast is overkill: periodic redundant transmissions of semi-static information that is already known to all neighbors, such as neighbor and router advertisements. Our experiments show that such traffic can account for as much as 20% of the network power consumption. We argue that this calls for a new communication primitive and present politecast, a communication primitive that allows messages to be sent without explicitly waking neighbors up. We have built two systems based on politecast: a low-power wireless mobile toy and a full-scale low-power wireless network deployment in an art gallery and our experimental results show that politecast can provide up to a four-fold lifetime improvement over broadcast. Low-power wireless networking has long been investigated in the context of wireless sensor networks, but its application space has recently been significantly broadened with new applications in the smart grid, smart cities, building automation, industrial automation, home automation, and container tracking, to name a few [14] . In such networks, the power consumption of the network nodes must be low to achieve the necessary multi-year lifetimes.. In low-power wireless, power consumption and communication is intertwined. The radio transceiver typically is the most power consuming peripheral so to achieve a low power consumption, nodes must duty cycle their radio transceivers [1, 11, 13] . With recent duty cycling mechanisms, idle nodes have their radios switched off more than 99% of the time [3] while being ready to accept incoming traffic. To Figure 1 : With unicast (left), only one receiver is awakened to receive the message; with broadcast (middle), all neighbors are awakened to receive the message; with politecast (right), only nodes that for themselves have decided to be aware receives the message.. send a message in a duty cycled low-power network, a sender must either wait until the receiver is known to be awake or explicitly wake up the receiver before sending the message. To send a unicast, only the receiver needs to be awakened. To send a broadcast, all nodes in the neighborhood must be awakened.. Many have found the traditional unicast and broadcast primitives to be too constraining for low-power wireless applications. For example, in achieving a low power consumption for neighbor discovery mechanisms, in the Disco and U-Connect neighbor discovery mechanisms [5, 8] nodes periodically transmit beacons that are sent to the link-layer broadcast address but that do not wake neighbors up. A similar communication pattern is found in receiver-initiated duty-cycling protocols such as RI-MAC [13] , where nodes periodically transmit beacons to the link-layer broadcast address but without any explicit wake-up of neighbors.. We argue that there is an additional class of traffic for which the traditional unicast and broadcast primitives are too coarse-grained: periodic redundant transmissions. Periodic redundant transmissions are messages that is periodically sent and that contain information that is already known to neighbors. Examples are neighbor and router reachability advertisements or routing metric beacons. This information must be periodically transmitted since new or mobile nodes may join the network at any time. This type of traffic is traditionally sent using broadcast. But in a lowpower wireless network, broadcasts are expensive in terms of power consumption and bandwidth since all neighbors must be explicitly awakened to receive the information. For this reason, protocols attempt to reduce the amount of periodic broadcasts they transmit [3, 7] .. We propose that the communication patterns found in Disco, U-Connect, RI-MAC, and other low-power mechanisms should be generalized into a new communication primitive that can be efficiently used to reduce the power consumption for periodic redundant transmissions. We call this communication primitive politecast.. A politecast is a transmission that potentially reaches all neighbors, but only if the neighbors are actively listening for the transmission. The receivers independently decide if they are interested in hearing the transmission or not. Unlike unicast, a politecast is not directed at any particular receiver but potentially reaches multiple nodes. Unlike broadcast, a politecast is not intended to reach all nodes in the neighborhood. The relationship between unicast, broadcast, and politecast is shown in Figure 1 .. With politecast, periodic redundant transmissions can be sent without disturbing those neighbors that already are aware of the information. New or mobile nodes, that do not have knowledge of the information, can independently listen for politecasts from neighbors in order to gather their information.. The contributions of this paper are twofold. First, we identify and generalize the politecast communication primitive based on communication patterns used in existing lowpower wireless mechanisms. Second, we apply the politecast primitive to a class of traffic for which it has not previously been used and, with results from two politecast-based systems, show that politecast can provide significant energy savings.. The name of the politecast primitive comes from its politeness. A sender does not push its message onto its neighbors, but politely delivers it only to those that want to hear it. In low-power wireless networks, radio transceivers are duty cycled to save power and nodes need to be woken up to receive transmissions. With duty cycling, the traditional communication primitives unicast and broadcast do not always provide a favorable power trade-off and many low-power protocols have sidestepped these primitives by allowing messages to be sent without waking nodes up. We generalize this communication pattern into a new communication primitive that we call politecast. Unlike unicast and broadcast trans- Figure 6 : The art gallery infrastructure nodes were used both as a traffic backbone and for approximate localization.. missions, a politecast transmission does not wake neighbors up, but reaches only those that explicitly are awake. We argue that politecast can be efficiently used for periodic redundant transmissions; transmissions that contain information that the neighbors already know. New or mobile nodes, who need to quickly gather information about the network, will explicitly listen for the periodic politecast transmissions from its neighbors. We experimentally evaluate how well politecast can save reduce power consumption for periodic redundant transmissions in a toy example and a full-scale network deployment. Our results show that politecast can save significant amounts of both power and bandwidth, thereby allowing increased network lifetime and application performance. Broadcasts have a history of problems in wireless multihop networks but these problems have been for multi-hop broadcast forwarding (flooding). If nodes blindly re-broadcast received broadcast packets, the network can enter a broadcast storm. Several mechanisms have been devised to tackle the broadcast storm problem in wireless multi-hop networks, such as Trickle [9] and RPB [12] . These protocols solve a different problem than politecast: politecast addresses power consumption and congestion in single-hop broadcast transmission and not the problems in multi-hop network flooding.. Many mechanisms try to reduce the number of broadcast transmission. Examples include adaptive beaconing [7] and beacon coordination [3] . Unlike those mechanisms, politecast does not try to reduce the number of transmissions, but instead make each transmission cheaper.. Vertically integrated systems such as Dozer [2] achieve a low power consumption, but does so at the price of modularity and layering. Dozer consists of a routing protocol that is conflated with a synchronous radio duty cycling mechanism. In such vertically integrated systems, there is little need to define layers or abstractions between layers inside the system. In contrast, the purpose of politecast is to find a modular element that can be used to build systems that have similarly low power consumption as a vertically integrated system, but with a clean separation of concerns in terms of layering. Politcast can be used below any network layer or protocol and on top of any underlying duty cycling mechanism.

O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O


Image-Guided Intraoperative Cortical Deformation Recovery Using Game Theory: Application to Neocortical Epilepsy Surgery Abstract-During neurosurgery, nonrigid brain deformation prevents preoperatively-acquired images from accurately depicting the intraoperative brain. Stereo vision systems can be used to track intraoperative cortical surface deformation and update preoperative brain images in conjunction with a biomechanical model. However, these stereo systems are often plagued with calibration error, which can corrupt the deformation estimation. In order to decouple the effects of camera calibration from the surface deformation estimation, a framework that can solve for disparate and often competing variables is needed. Game theory, which was developed to handle decision making in this type of competitive environment, has been applied to various fields from economics to biology. In this paper, game theory is applied to cortical surface tracking during neocortical epilepsy surgery and used to infer information about the physical processes of brain surface deformation and image acquisition. The method is successfully applied to eight in vivo cases, resulting in an 81% decrease in mean surface displacement error. This includes a case in which some of the initial camera calibration parameters had errors of 70%. Additionally, the advantages of using a game theoretic approach in neocortical epilepsy surgery are clearly demonstrated in its robustness to initial conditions. The results outlined in Section III-A indicate that the developed game theoretic algorithm can accurately track a deforming surface in vivo. Fig. 4 , showing the algorithm results for all eight intraoperative neocortical epilepsy cases, reveals the algorithm's tracking potential over a range of cases. Large deformations (up to 14 mm) and varying patient orientations, including one patient with bilateral craniotomies (data sets 2 and 3) did not affect the algorithm error, which never rose above 1.7 mm.. The illustrations from data sets 4 and 5, which provide visual validation of the algorithm solution, show that the game theoretic result aligns both the feature and intensity information from the stereo camera images. The results are consistent with validation points acquired by the neurosurgeon and make intuitive sense relative to each other. Data set 5 is particularly interesting due to its initial large amount of calibration error, which the algorithm is able to correct. Examination of data set 8 shows a similar effect, in that the feature and intensity matching is improved using the updated calibration parameters and displacement field. However, this case shows the reliance of the algorithm on the distribution of the initial calibration error. Regardless of this reliance, using the tracking algorithm in this case, as in all of the cases tested, still produced an advantage over relying solely on preoperative images. These results are very encouraging and indicate the potential of a surface tracking algorithm posed with game theory to improve surgical navigation.. The robustness comparison shows that, in the absence of calibration error, the algorithm based on game theory performs at least as well as a pure displacement cost function and that the addition of the camera calibration optimization did not decrease the surface tracking accuracy. With the other paradigms tested, camera calibration optimization interfered with displacement field detection and led to a suboptimal result. This does not mean that it is impossible to achieve accurate results in these paradigms. However, it does reveal the problems that may arise from solving for competing variables in a single objective framework. The robustness comparison also clearly shows the deleterious effects that camera calibration error can have on the ability to track a moving surface. Since most algorithm terms rely on the calibration parameters in some way, and because calibration errors are difficult to distinguish from surface deformation effects (see Fig. 1 ), it is no surprise that calibration error can propagate through the algorithm solution. The algorithm based on game theory outperforms all the other methods tested in this context, thus proving its ability to separate calibration and deformation effects and demonstrating its robustness to a range of initial calibration inaccuracies.. Future work on this algorithm could further enhance its accuracy by allowing dynamic choices of the weighting terms based on assessments of the algorithm inputs. In addition, the application of this algorithm can be expanded beyond procedures relating to epilepsy. Although particularly useful in neocortical epilepsy surgeries due to the great need for surface deformation information during epilepsy monitoring and tissue resection, this intraoperative deformation compensation algorithm could be applied to many neurosurgical procedures (since dural openings cm in diameter, which normally occur when the patient undergoes a craniotomy, will allow for adequate intensity/feature detection). And, when used in conjunction with a biomechanical model and/or volumetric imaging, the range of neurosurgical procedures that would benefit from this tracking technique becomes even larger; although, surgeries in which the brain surface is significantly disrupted may still present a problem.. Surgical navigation systems (SNS) have already proven to be a beneficial addition to neurosurgery. The aid that SNS provide in localizing pathologic tissue is invaluable. However, due to brain deformation, SNS use is limited to guidance before the brain has shifted or providing limited information after the shift. Overall, this work shows that game theory can be used as an image processing tool to infer information about physical processes (brain deformation/camera calibration). Incorporating this system into current SNS guidance systems will provide more accurate surgical guidance for many procedures, leading to better detection of pathologic tissue and decreased surgical complications.

O O O O O O B I O O O O B O O O B O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Can we trust digital image forensics? Compared to the prominent role digital images play in nowadays multimedia society, research in the field of image authenticity is still in its infancy. Only recently, research on digital image forensics has gained attention by addressing tamper detection and image source identification. However, most publications in this emerging field still lack rigorous discussions of robustness against strategic counterfeiters, who anticipate the existence of forensic techniques. As a result, the question of trustworthiness of digital image forensics arises. This work will take a closer look at two state-of-theart forensic methods and proposes two counter-techniques; one to perform resampling operations undetectably and another one to forge traces of image origin. Implications for future image forensic systems will be discussed. Back in analog times, a photograph was generally perceived as a "piece of truth". With digital image processing replacing its analog counterpart, critics have expressed the concern that it has never been so easy to manipulate images. The advent of low-cost digital imaging devices as well Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. as powerful and sophisticated editing software makes it no longer necessary to obtain specialist skills to alter an image's tenor. Thus, questions regarding image authenticity are of growing relevance, especially in contexts where nowadays' multimedia society bases important decisions on them. Lately discovered forgeries in newspapers and scientific journals are only the tip of the iceberg. Particular attention has to be drawn to courtroom applications, in which the authenticity of photographs as pieces of evidence deserves utmost importance.. Recently, methods subsumed to the concept of digital image forensics have been proposed to address these issues. The area of digital image forensics can be broadly divided into two branches [14] . The first field of application is to determine whether a specific digital image has undergone malicious post-processing or tampering. Forensic algorithms of this type are designed to unveil either characteristic traces of image processing operations, or to verify the integrity of particular features introduced in a typical image acquisition process. The second problem linked to digital image forensics is image source identification, which is obviously based on specific characteristics of the image acquisition device or technology. As forensic algorithms basically rely on particular statistical features, which can be understood as a "natural" and inherent watermark, digital image forensics does not require any prior knowledge of the original image.. Since in general, existing methods are deemed quite reliable in laboratory tests, one might be tempted to apply them in practice as well. However, little is known about the robustness of forensic algorithms. This aspect plays only a marginal role in the existing body of literature. As a consequence, it is reasonable to question the trustworthiness of digital image forensics -in particular with regard to a farsighted counterfeiter who is aware of forensic tools.. To draw attention to this disproportion, this paper focuses on two specific forensic methods -a resampling detector proposed by Popescu and Farid [16] and an approach to digital camera identification by Lukáš, Fridrich and Goljan [11] -and develops ways to deceive these methods. Forensic methods might benefit from research on countermeasures in a similar way as reasoning about attacks in multimedia security in general is useful to improve security. In this sense, attacks on image forensic algorithms can be understood as schemes to systematically mislead the detection methods.. In general, such attacks can be assigned to one of the following three objectives, namely:. 1. the camouflage of malicious post-processing or tampering of an image, 2. the suppression of correct image origin identification, 3 . and furthermore, the forgery of image origin.. The paper is organized as follows: Section 2 briefly reviews commonly known image forensic algorithms in general and describes in more detail the two specific forensic algorithms under investigation. Section 3 points out possible weaknesses of digital image forensics and explains two countertechniques. The first one allows to perform resampling operations undetectably while the second technique aims at misleading image source identification methods. The effectiveness of both techniques is validated with experimental results. Finally, Section 4 summarizes and provides an outlook for future work. This paper has taken a critical view on the reliability of forensic techniques as tools to generate evidence of authenticity for digital images. Corresponding to the objective of image authentication schemes, three possible goals of attacks were pointed out. We have discussed an approach for image manipulations undetectable to the resampling detector of Popescu and Farid [16] . Moreover, we have demonstrated how to suppress a reliable image source identification with Lukáš et al.'s method [11] , and we have shown a way to falsely frame an 'innocent' camera in the source identification scheme.. More precisely, the following techniques stand behind these results: To avoid typical traces of geometric image transformations in terms of systematic dependencies between adjacent pixels, geometric distortions during the resampling process were introduced. We found that a dual path approach designed to suppress traces of resampling in the transformed image's high frequency component only is particularly promising. Moreover, flatfielding can be used as a method to reduce spatial noise, which is the key to camera identification. While naive flatfielding allows to impede the correct identification of the image source, inverse flatfielding can be used to forge an image origin. Apart from their ability of misleading the respective forensic tools, the proposed attacks do not introduce visual artifacts.. It is well-known from the security community that development of attacks fruitfully helps to improve the security of next generation algorithms. As we designed our attacks in terms of targeted attacks, it is obvious that our results are limited to the specific detection methods under investigation. Thus, it is still possible that further improved detection methods will be able to cope with our attacks. However, such improved detection schemes can be subject to even better targeted attacks by farsighted counterfeiters, what might trigger a cat-and-mouse game between forensic and counterforensic techniques.. Furthermore, in practice, forensic evidence will often be based on several methods rather than on one specific algorithm. This is particularly true in the field of manipulation detection, in which an elaborate forensic analysis with regard to several manipulation techniques obviously increases the quality of the decision whether an image has been tampered with or not. Reliable source identification seems impossible when indications of potential post-processing steps are not taken into account. In a stylized forensic process flow, as depicted in Figure 10 , both the manipulation detector and the source identification may consist of one or more forensic algorithms. Information obtained from the manipulation detector may be used to fine-tune the process of source identification, and vice versa. The dashed arrow indicates that a more thorough investigation of image consistency may be feasible once information about the digitization device is available. One step further ahead, one can conceive power-ful machine learning classifiers that draw on a large set of orthogonal criteria. Although an attacker might adapt to several forensic algorithms, it is unlikely that he is able to preserve the manifold of all relevant image statistics. Finally, we would like to point out that the two selected forensic techniques are not known to be weak or unreliable tools. On the contrary, these particular methods were chosen in order to build example attacks against powerful and challenging forensic algorithms. And we believe that many other published techniques would be vulnerable to targeted attacks of comparable sophistication. Therefore, the results presented in this paper suggest that the question whether digital image forensics can be trusted has to be answered with no; at least to the extent that currently known techniques are concerned. Whether it will ultimately be possible to construct powerful forensic tools which resist deliberate attacks of informed counterfeiters remains an interesting and -given the number of real-world applications -relevant question for further research.

O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O B I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Effects of passenger's arrival distribution to double-deck elevator group supervisory control systems using genetic network programming The Elevator Group Supervisory Control Systems (EGSCS) are the control systems that systematically manage three or more elevators in order to efficiently transport the passengers in buildings. Double-deck elevators, where two cages are connected with each other, are expected to be the next generation elevator systems. Meanwhile, Destination Floor Guidance Systems (DFGS) are also expected in DoubleDeck Elevator Systems (DDES). With these, the passengers could be served at two consecutive floors and could input their destinations at elevator halls instead of conventional systems without DFGS. Such systems become more complex than the traditional systems and require new control methods Genetic Network Programming (GNP), a graph-based evolutionary method, has been applied to EGSCS and its advantages are shown in some previous papers. GNP can obtain the strategy of a new hall call assignment to the optimal elevator because it performs crossover and mutation operations to There have been installed more and more high-rise buildings in the cities for the spatial and economical considerations. To provide transportation services among floors in the building, elevator systems are installed as primary service facilities. Elevator group supervisory control systems (EGSCS) [1] are responsible for controlling elevators to provide convenient and comfortable services for passengers. The new generation elevators, Double-deck elevators [2] are designed to connect two cages in an elevator shaft. This allows passengers on two consecutive floors to use the elevator simultaneously, significantly increasing the transportation capacity of elevator systems. Meanwhile, with the Destination Floor Guidance System (DFGS) [3, 4] , EGSCS could use the information of the destination floor before passengers get in elevators, instead of waiting until the cage call button is operated in elevators.. Furthermore, since the elevator system is driven by passenger's arrival, its probability distribution characterizes the traffic in the elevator systems. In order to get tractable analytical results, researchers have used Exponential distribution to model the elevator systems for many years. However, Erlang distribution is a more general distribution of nonnegative random variables. Especially, it could be used to model passengers who got off at the railway stations adjacent to the buildings arrive at the floors of elevators. In this paper, we use Erlang distribution and Binomial distribution to build more general passenger's arrival model and to study how the passenger's arrival distribution affects EGSCS using DDES with DFGS and Genetic Network Programming (GNP) [5, 6] , which is a newly developed graph-based evolutionary computation method.. The paper is organized as follows. Section 2, 3 and 4 gives an overview of DDES, GNP and describes the details of Erlang and Binominal distribution used for EGSCS, respectively. Section 5 explains EGSCS using GNP. Section 6 shows the simulation conditions and results. Finally, some conclusions are devoted in section 7. In this paper, a method for studying the effects of passenger's arrival distribution to elevator group supervisory control systems using GNP has been proposed. It has been clarified from the simulations of using Erlang and Binominal distribution for passenger's arrival that poisson arrival and batch arrival have great influences on average waiting time and average traveling time in terms of increasing these values.

O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Profile-based routing and traffic engineering We present a new algorithm and framework for dynamic routing of bandwidth-guaranteed flows. The problem is motivated by the need to set up bandwidth-guaranteed paths in carrier and ISP networks dynamically. Traditional routing algorithms such as minimum-hop or widest-path routing do not take advantage of any knowledge about the traffic distribution or ingress-egress pairs, and therefore can often lead to severe network underutilization. Our work is inspired by the recently proposed "minimum interference routing" algorithm (MIRA) of Kodialam and Lakshman, but it improves on their approach in several ways. Our main idea is to use a "traffic profile" of the network, obtained by measurements or service-level agreements as a rough predictor of the future traffic distribution. We use this profile to solve a multicommodity network flow problem, whose output is used both to guide our online path-selection algorithm as well as to impose admission control. The offline multi-commodity solution seems very effective at distributing the routes and avoiding bottlenecks around hot spots. In particular, our algorithm can anticipate a flow's blocking effect on groups of ingress-egress pairs, whereas MIRA only considers one ingress-egress pair at a time. Our simulation results show that the new algorithm outperforms shortest-path, widestpath, and minimum interference routing algorithms on several metrics, including the fraction of requests routed and the fraction of requested bandwidth routed. Finally, the framework is quite general and can be extended in numerous ways to accommodate a variety of traffic management priorities in the network.Keyword: We present a new algorithm and framework for dynamic routing of bandwidth-guaranteed flows. Our algorithm is online, meaning that it routes requests one at a time, without specific knowledge of future demands. We use quasi-static information about the network and traffic to select paths so as to minimize the number of requests that are rejected or the network bandwidth that is wasted. a pathologically chosen set of requests can foil any online algorithm. We make minimal assumptions that are justifiable in practice and lead to a significant improvement in network utilization. In particular, we assume that the ingress and egress nodes in the network are known, and that a traffic profile between pairs of ingress-egress nodes is also known. This traffic profile can be measured, inferred from servicelevel agreements (SLAs), created by rule-of-thumb or any other mechanism suitable to the network operator. Our algorithm uses this quasi-static information in a preprocessing step (one multi-commodity flow computation), to determine certain bandwidth allocations on the links of the network. The online phase of the routing algorithm then routes tunnel requests using a "shortest-path" (SPF) like algorithm but with the additional information given by the preprocessing phase. The multi-commodity preprocessing phase allows the online algorithm to exercise admission control by rejecting some requests because of their blocking effects in the network.The motivation for our problem arises from the needs of service providers who must dynamically reserve bandwidthguaranteed routes in carrier and Internet Service Provider (ISP) networks. Following Kodialam and Lakshman [KL00], we will describe our algorithms in the context of setting up paths in Multi-Protocol Label-Switched (MPLS) networks, although our algorithms are applicable in other contexts as well, most notably virtual-circuit systems. MPLS networks [RVC01] allow explicit routing of packets by putting labels on them, which can then be used to forward packets along specific Label-Switched Paths (LSPs). Service providers can perform this encapsulation at the ingress routers, and then use LSPs to implement Virtual Private Networks (VPNs) [G + 00] or satisfy other quality-of-service (QoS) agreements with clients. At the ingress routers, packet classification [LS98, SVSW98, SSV99] can be used to map packets into "forwarding equivalence classes" by examining packet headers. This aggregation (mapping into equivalence classes) also has the potential advantage of smoothing out the bandwidth requirement across many bursty streams. In addition, the service providers can use a measurementbased mechanism to build a traffic profile for an ingressegress node pair. Such a profile can be as simple as an average bandwidth requirement over a certain time period.An LSP requires set up, meaning that all the intermediate routers between the ingress and egress nodes are specified. The path is set up using a signaling protocol such as RSVP [BCS93] or LDP (Label Distribution Protocol [ADF + 01]). The ability to specify explicit paths for

O B O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Storage-Based Intrusion Detection Storage-based intrusion detection consists of storage systems watching for and identifying data access patterns characteristic of system intrusions. Storage systems can spot several common intruder actions, such as adding backdoors, inserting Trojan horses, and tampering with audit logs. For example, examination of 18 real intrusion tools reveals that most (15) can be detected based on their changes to stored files. Further, an Intrusion Detection System (IDS) embedded in a storage device continues to operate even after client operating systems are compromised. We describe and evaluate a prototype storage IDS, built into a disk emulator, to demonstrate both feasibility and efficiency of storage-based intrusion detection. In particular, both the performance overhead (< 1%) and memory required (1.62MB for 13995 rules) are minimal. Many Intrusion Detection Systems (IDSs) have been developed over the years [Axelsson 1998; Lunt and Jagannathan 1988; Porras and Neumann 1997] , with most falling into one of two categories: network-based or This material is based on research sponsored in part by the Air Force Research Laboratory, under agreement number F49620-01-1-0433, and by the Army Research Office, under agreement number DAAD19-02-1-0389, APC, IBM, Intel, NetApp, and Seagate provided hardware grants which supported our research. Authors' address: A. G. Pennington (corresponding author), J. L. Griffin, J. S. Bucy, J. D. Strunk, and G. R. Ganger, School of Computer Science, Carnegie Mellon University, 5000 Forbes Avenue, Pittsburgh, PA 15213; email: adamp@andrew.cmu.edu. Permission to make digital or hard copies part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies show this notice on the first page or initial screen of a display along with the full citation. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, to redistribute to lists, or to use any component of this work in other works requires prior specific permission and/or a fee. Permissions may be requested from the Publications Dept., ACM, Inc., 2 Penn Plaza, Suite 701, New York, NY 10121-0701 USA, fax +1 (212) host-based. Network IDSs (NIDSs) are usually embedded in sniffers or firewalls, scanning traffic to, from, and within a network environment for attack signatures and suspicious traffic [Cheswick and Bellovin 1994; NFR 2002] . Host-based IDSs (HIDSs) are fully or partially embedded within each host's Operating System (OS). They examine local information (such as system calls [Forrest et al. 1996] ) for signs of intrusion or suspicious behavior. Many environments employ multiple IDSs, each watching activity from its own vantage point.. The storage system is another interesting vantage point for intrusion detection. Several common intruder actions [Denning 1999, p. 218; Scambray et al. 2001, pp. 363-365] are quite visible at the storage interface. Examples include manipulating system utilities (e.g., to add backdoors or Trojan horses), tampering with audit log contents (e.g., to eliminate evidence), and resetting attributes (e.g., to hide changes). By design, a storage server sees all changes to persistent data, allowing it to transparently watch for suspicious changes and issue alerts about the corresponding client systems. Also, like a NIDS, a storage IDS can be compromise-independent of the host OS, meaning that it cannot be disabled by an intruder who only successfully gets past a host's OS-level protection.. This article motivates and describes storage-based intrusion detection. It presents several kinds of suspicious behavior that can be spotted by a storage IDS. Using sixteen "rootkits" and two worms as examples, we describe how fifteen of them would be exposed rapidly by our storage IDS. (The other three do not modify any stored files.) Most of them are exposed by modifying system binaries, adding files to system directories, scrubbing the audit log, or using suspicious file names. Of the fifteen detected, three modify the kernel to hide their presence from host-based detection, including FS integrity checkers like Tripwire [Kim and Spafford 1994] . In general, intruders cannot hide their changes from the storage device if they wish to persist across reboots; to be reinstalled upon reboot, their tools must manipulate stored files.. A storage IDS could be embedded in many kinds of storage systems. The extra processing power and memory space required should be feasible for file servers, disk array controllers, and even augmented disk drives. Most detection rules will also require FS-level understanding of the stored data. Such understanding exists trivially for a file server and may be explicitly provided to block-based storage devices. This understanding of a file system is analogous to the understanding of application protocols used by a NIDS [Paxson 1998 ], but with fewer varieties and structural changes over time.. As a concrete example with which to experiment, we have augmented a disk emulator with a storage IDS that supports online, rule-based detection of suspicious modifications. This Intrusion Detection on Disk (IDD) prototype supports the detection of two main types of suspicious activities. First, it can detect unexpected changes to important system files and binaries, using a rule-set similar to Tripwire's. Second, it can detect patterns of changes like nonappend modification (e.g., of system log files) and reversing of inode times. An administrative interface supplies the detection rules, which are checked during the processing of each block request. When a detection rule triggers, the IDD sends · 30: 3 the administrator an alert containing the full pathname of the modified file and the violated rule(s). Experiments show that the runtime overheads of such intrusion detection is minimal. Further analysis indicates that little memory capacity is needed for reasonable rule sets (e.g., only 1.62MB for a realistic example containing 13995 rules).. The remainder of this article is organized as follows. Section 2 introduces storage-based intrusion detection. Section 3 evaluates the potential of storagebased intrusion detection by examining real intrusion tools. Section 4 discusses storage IDS design issues. Section 5 describes a prototype storage IDS embedded in a disk emulator. Section 6 uses this prototype to evaluate the costs of storage-based intrusion detection. Section 7 discusses related work. Section 8 summarizes this article's contributions. A storage IDS watches system activity from a new viewpoint which immediately exposes some common intruder actions. Running on separate hardware, this functionality remains in place even when client OSes or user accounts are compromised. Our prototype storage IDS demonstrates both feasibility and efficiency of adding IDS capabilities to a workstation disk. Analysis of real intrusion tools indicates that most would be immediately detected by a storage IDS. After adjusting for storage IDS presence, intrusion tools will have to choose between exposing themselves to detection or being removed whenever the system reboots. In our setup, both the host computer and its locally attached disk emulator are 2 GHz Pentium 4-based computers with 512MB RAM. The disk emulator runs FreeBSD 5.2 and makes use of FreeBSD's target-mode SCSI support in order to capture SCSI requests initiated by the host computer. The host computer runs Red Hat Linux 8.0. The host and emulator are connected point-to-point using QLogic QLA2100 Fibre Channel adapters. The backing store for the emulator is an 72 GB Seagate ST373405LC disk connected to an Adaptec 29160 Ultra160 SCSI controller. In an effort to exercise the worst-case storage performance, the file system stored on the disk emulator was mounted synchronously by the host computer and caching was turned off inside the backing store disk.. We do not argue that embedded disk processors will have a 2 GHz clock frequency; this is perhaps an order of magnitude larger than one might expect. However, an actual disk-based IDS would be manually tuned to the characteristics of the platform it runs on (e.g., the disk's SCSI ASICs would obviate much of the IDS communication and interposition overheads) and would therefore run more efficiently than IDD, perhaps by as much as an order of magnitude. To compensate for this uncertainty, we report processing overheads both in elapsed time and in processor cycle counts. The latter provides a reasonably portable estimate of the amount of CPU work performed by IDD.. To approximate the conditions of a production file system deployed in a real environment, we created a disk image of a freshly installed Red Hat Linux 8.0 desktop system. This image is loaded into the emulator at the start of each experiment, after which the emulated disk is mounted synchronously in a root-level directory on the host computer. For each experiment with IDD "fully enabled," we set the administrative policy to match the default Tripwire rule-set for Red Hat Linux [Tripwire 2002] .. Our experiments use a microbenchmark and two macrobenchmarks. Our alert-generating microbenchmark cycles 1000 times over a single file operation on each of 1000 files (out of 1,000,000 spread over 1,000 directories), all of which will generate alerts when IDD is enabled. We use Linux kernel build and PostMark as nonalert-generating macrobenchmarks. Linux kernel build is an example of a disk-intensive workload that creates, operates on, and deletes many temporary files. The benchmark unpacks a bzip2 compressed tarball of the Linux 2.6.9 kernel, and then builds a kernel image using the kernel's default configuration. It can be considered a successor to the Andrew Benchmark [Howard et al. 1988] . PostMark was designed to exercise the file system as would a server for the small files associated with electronic mail, netnews, or Web-based services [Katcher 1997] . Each macrobenchmark result represents the average of 10 runs of the test program on a warm system, where the system was warmed by loading the rules into IDD and running the test program once.

O B I O B I O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


On the communication complexity of Bar-Yehuda, Goldreich and Itai's randomized broadcasting algorithm The algorithm by Bar-Yehuda, Goldreich and Itai is one of the best known randomized broadcast algorithms for radio networks. Its probability of success and time complexity are nearly optimal. We propose a modification of this algorithm, which decreases the communication complexity, preserving other properties. Moreover, we show that the local communication complexity of the modified algorithm is deterministic. We have shown a modification of the well known and respected broadcast algorithm, which decreases its communication complexity, preserving all other properties. Moreover, the number of transmissions made by a network node in our algorithm is deterministic, in contrast to the original algorithm. The overall communication complexity of the distributed algorithm is still non-deterministic, because the node reachability is so as well.. It seems that it is not possible to further decrease the communication complexity of the presented algorithm (we have reached the trivial lower bound of a single transmission in Decay2) without changing its principles, which would lead to a new algorithm.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Autonomous and adaptive resource allocation among multiple nodes and multiple applications in heterogeneous wireless networks In the forthcoming future, various means of wireless communication, such as cellular, Wi-Fi, WiMAX, and DSRC, will be available to mobile users and applications. With the development of wireless communication and mobile devices, more and more users and applications will be accommodated in mobile environment. Since mobile users and applications compete for the limited wireless resources whose communication quality dynamically change, we need an adaptive mechanism for mobile users and applications to share the available network resources while satisfying each application's QoS requirements. In this paper, we propose an adaptive resource allocation mechanism where each node autonomously determines wireless network resources to assign to each of networked applications running on it. For this purpose, we adopt an attractor composition model, which is based on an autonomous and adaptive behavior of biological systems. Through numerical analysis, we confirmed that our mechanism could adaptively and stably allocate wireless network resources to applications, while considering their QoS requirements and fairly sharing network resources with other nodes. It also is shown that our mechanism superiors to a mechanism where a node determines resource allocation by solving an optimization problem. With the proliferation of wireless network technology, various means of wireless communication will be available to mobile users and applications to support our daily life everywhere in the forthcoming future. Wireless communications, such as cellular, Wi-Fi, WiMAX, and DSRC (Dedicated Short Range Communication) have heterogeneous characteristics in terms of the availability, capacity, delay, connectivity, and cost. Furthermore, most characteristics dynamically change due to instability of wireless communication and competition among users and applications for wireless network resources. The suitable wireless network for each networked application may be different due to different QoS requirement, i.e. low delay in VoIP, low cost in e-mail, and large bandwidth in video streaming. Therefore, it is necessary for a node, that is, equipment where networked applications are running, to choose a wireless network resource dynamically to use for each of applications taking into account the condition of wireless networks and QoS requirements of applications. For example, a VoIP application running on a smartphone requires one-way end-to-end delay of lower than 150 ms for interactive communication [1] . Therefore, it is better to assign a cellular or DSRC network, which provides an application with a connection with small delay and jitter, to a VoIP application. On the other hand, an e-mail application can tolerate delay, while the volume of traffic is large. Therefore, a Wi-Fi or WiMAX network is appropriate for an e-mail application, because those networks can provide an application with high-speed connection for lower cost than a cellular network.. For effective and efficient use of available wireless networks, in recent years, cognitive networking has been attracting attention of researchers and developers. Cognitive network is, in one definition, the technology that cognizes the condition of wireless networks and selects an appropriate network to efficiently utilize the available network resources [2] [3] [4] [5] [6] . In the context of cognitive network, a wireless network resource corresponds to a network, channel, or spectrum distinguished by wireless network technology, MAC protocol, coding algorithm, or frequency. Although existing proposals are useful in adaptive resource allocation in heterogeneous wireless network environment, most of them only deal with either of resource allocation among multiple nodes or resource allocation among multiple applications running on a node. For example, Kassar et al. proposed an automated network selection strategy dealing with resource allocation among multiple nodes in [4] . They proposed a comprehensive decision making mechanism based on multi-attribute decision making algorithms to assist the node in selecting the top candidate network. They consider more than ten network attributes and treat rule-based multiattribute decision making. However, their approach considers only one network and they did not consider effective and efficient use of multiple networks.. In the environment where a variety of heterogeneous networks are available and there exist multiple nodes having a variety of applications running, we need a mechanism to allocate an appropriate wireless network to each application on each node taking into account characteristics of wireless networks and QoS requirements of the application. Such resource allocation can be formulated as an optimization problem to maximize the degree of satisfaction per node and per application, once information about the current condition of available wireless networks and QoS requirements of all applications is given. However, such optimization requires for a central node, e.g. an access point, to maintain the up-to-date information by frequent and aggressive message exchanges with nodes in the area. Even if the task of derivation of optimal resource allocation is distributed among nodes, nodes need to frequently exchange messages with other nodes to obtain latest information about the current status of applications running on the other nodes. From a viewpoint of dynamic features of wireless networks and cost, e.g. bandwidth and energy, spent in message exchanges, such mechanisms are not feasible at all in the new generation network environment, where various wireless networks are available to a large number of networked applications.. In this paper, we propose an autonomous, fully distributed, and adaptive mechanism of network resource allocation among multiple nodes and multiple applications. In our mechanism, each node decides wireless networks to use for its applications. A node first recognizes the condition of wireless networks available to the node. Next, it evaluates the degree that applications are satisfied with the allocated networks. Then, it determines a wireless network to allocate to each application. To accomplish stable and adaptive resource allocation in the dynamically changing environment, we adopt a nonlinear mathematical model of dynamical and adaptive behavior of biological systems, which is called an attractor composition model [7] . The attractor composition model is a noise-driven metaheuristic to find a stable solution of an optimization problem in an adaptive manner. Possible solutions are defined as attractors of a dynamical system and the potential of solution space is affected by the goodness of the current solution. When the current solution is appropriate, a basin of attractor corresponding to the solution in the solution space becomes deep and the state of the system statically stays there. Once the current solution becomes inappropriate for the new condition, the basin of attractor becomes shallow and the state begins to change randomly until a new good attractor is found. By defining the degree of satisfaction of node as an indicator of goodness of resource allocation, a node can autonomously find a solution, i.e. resource allocation, which is appropriate for the current condition of wireless networks and QoS requirements of applications. Since the condition of wireless networks is influenced by resource allocation at other nodes, nodes indirectly interact with each other and they eventually share the available network resources in a fair manner.. The rest of the paper is organized as follows. We first introduce the attractor composition model in Section 2. Next in Section 3, we propose a novel resource allocation mechanism for multiple nodes and multiple applications in heterogeneous wireless network environment. Then we show results of numerical evaluation and comparison with a mechanism adopting per-node optimization in Section 4. Finally, we conclude the paper and describe future directions in Section 5. In this paper, we propose a novel resource allocation mechanism where each node autonomously determines wireless network resources to assign to each of networked applications running on it under dynamically changing environment. Our proposal employs the attractor composition model, which is based on an autonomous and adaptive behavior of biological systems. Since adaptation requires the certain duration of random walk phase, a vehicular network is one of tough applications of our proposal. However, as shown in the results, our proposal could adaptively and stably allocate wireless network resources to applications with consideration on their QoS requirements and fairly share network resources among nodes. It also is shown that our mechanism superiors to a mechanism where a node determines resource allocation by solving an optimization problem.. In general, it is said that biological models are insensitive to parameter setting. Next, we need to confirm this statement by conducting additional simulation experiments by changing the number of wireless networks and their characteristics, QoS requirements of applications, and mobility using more realistic simulation scenarios. Another direction is to extend our proposal to fit to the actual environment. For example, Web browsing can tolerate instantaneous interruption of connection. Therefore, it is possible to keep assigning a Wi-Fi network to a Web application whereas a Wi-Fi network provides intermittent connectivity to a fast moving node. Finally, we plan to build a prototype and perform realistic experiments in the future. We show how our proposal determines network for application i in Algorithms 1 and 2, where the function NormalDistributionRandom(0, σ ) derives the white Gaussian noise with mean zero and standard deviation σ and t is the calculation interval.

O O B I I O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O B I I O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Is complexity really the enemy of software security? Software complexity is often hypothesized to be the enemy of software security. We performed statistical analysis on nine code complexity metrics from the JavaScript Engine in the Mozilla application framework to investigate if this hypothesis is true. Our initial results show that the nine complexity measures have weak correlation (ρ=0.30 at best) with security problems for Mozilla JavaScript Engine. The study should be replicated on more products with design and code-level metrics. It may be necessary to create new complexity metrics to embody the type of complexity that leads to security problems. Software security is the ability to defend attacker's exploitation of software problems by building software to be secure throughout the whole development life cycle [4] . Software complexity is often hypothesized to be the enemy of software security [8] . The wisdom of security experts is that complexity leads to security problems [3, 8] . Geer [3] stated that "complexity provides both opportunity and hiding places for attackers" and "security failures come from it [complexity] as surely as dawn comes from the east" when he addressed the importance of cybersecurity in a hearing at the Subcommittee of Homeland Security on Emerging Threats, Cybersecurity, and Science and Technology on 23rd, April, 2007. McGraw [8] also points out complexity as one of three major causes of software security problems (the "Trinity of Trouble"); the other causes together are connectivity and extensibility.. The wisdom of these experts, though, has not been substantiated by empirical evidence using quantifiable metrics in terms of software security. However, we cannot control what we cannot measure [2] . Geer [3] also emphasized that a system of security metrics is in the first priority among the tasks for cybersecurity. Software complexity may be related to security problems or may not. If an empirical relationship can be discovered between software security metrics and security problems at any level (e.g. code, design, or architecture level), these metrics could aid organizations in their efforts to fortify their products early in the development lifecycle.. The study of the relationship between software complexity and vulnerabilities is similar to the study of the relationship between software complexity and faults. A fault is an accidental condition that causes a functional unit to fail to perform its required function [5] . A software vulnerability is an instance of a [fault] in the specification, development, or configuration of software such that its execution can violate an [implicit or explicit] security policy [7] . Previous studies have shown that complexity is related with software faults [6, 9] . However, other studies argue that the currently-known complexity metrics seem not to be good indicators of faults. The previous studies [6, 9] can be replicated in the context of vulnerabilities. However, the results might not be necessarily the same as fault prediction, because even though vulnerabilities are a subset of faults [10] , the differences in the characteristics of vulnerable code and faulty code have not been investigated quantitatively yet. We examine the following two hypotheses in this study.

O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Semi-supervised learning by disagreement Abstract In many real-world tasks, there are abundant unlabeled examples but the number of labeled training examples is limited, because labeling the examples requires human efforts and expertise. So, semi-supervised learning which tries to exploit unlabeled examples to improve learning performance has become a hot topic. Disagreement-based semi-supervised learning is an interesting paradigm, where multiple learners are trained for the task and the disagreements among the learners are exploited during the semi-supervised learning process. This survey article provides an introduction to research advances in this paradigm. In traditional supervised learning, hypotheses are learned from a large number of training examples. Each training example has a label which indicates the desired output of the event described by the example. In classification, the label indicates the category into which the corresponding example falls into; in regression, the label is a real-valued output such as temperature, height, price, etc.. Advances in data collection and storage technology enable the easy accumulation of a large amount of training instances without labels in many real-world applications. Assigning labels to those unlabeled examples is expensive because the labeling process requires human efforts and expertise. For example, in computer-aided medical diagnosis, a large number of X-ray images can be obtained from routine examination, yet it is difficult to ask physicians to mark all focuses in all images. If we use traditional supervised learning techniques to build a diagnosis system, then only a small portion of training data, on Z.-H. Zhou (B) · M. Li National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing 210093, China e-mail: zhouzh@nju.edu.cn which the focuses have been marked, are useful. Due to the limited amount of labeled training examples, it may be difficult to get a strong diagnosis system. Then, a question arises: can we leverage the abundant unlabeled training examples with a few labeled training examples to generate a strong hypothesis? Roughly speaking, there are three major techniques for this purpose [82] , i.e., semi-supervised learning, transductive learning and active learning.. Semi-supervised learning [21, 92] deals with methods for automatically exploiting unlabeled data in addition to labeled data to improve learning performance, where no human intervention is assumed. Transductive learning is a cousin of semi-supervised learning, which also tries to exploit unlabeled data automatically. The main difference between them lies in the different assumptions on the test data. Transductive learning takes a "close-world" assumption, i.e., the test data set is known in advance and the goal of learning is to optimize the generalization ability on this test data set, while the unlabeled examples are exactly the test examples. Semi-supervised learning takes an "open-world" assumption, i.e., the test data set is not known and the unlabeled examples are not necessary test examples. In fact, the idea of transductive learning originated from statistical learning theory [69] . Vapnik [69] believed that one often wants to make predictions on test examples at hand instead of on all potential examples, while inductive learning that seeks the best hypothesis over the whole distribution is a problem more difficult than what is actually needed; we should not try to solve a problem by solving a more difficult intermediate problem, and so, transductive learning is more appropriate than inductive learning. Up to now there is still a debate in the machine learning community on this learning philosophy. Nevertheless, it is well recognized that transductive learning provides an important insight into the exploitation of unlabeled data.. Active learning deals with methods that assume that the learner has some control over the input space. In exploiting unlabeled data, it requires an oracle, such as a human expert, from which the ground-truth labels of instances can be queried. The goal of active learning is to minimize the number of queries for building a strong learner. Here, the key is to select those unlabeled examples where the labeling will convey the most helpful information to the learner. There are two major schemes, i.e., uncertainty sampling and committee-based sampling. Approaches of the former train a single learner and then query the unlabeled example on which the learner is least confident [45] ; approaches of the latter generate multiple learners and then query the unlabeled example on which the learners disagree to the most [1, 63] .. In this survey article, we will introduce an interesting and important semi-supervised learning paradigm, i.e., disagreement-based semi-supervised learning. This line of research started from Blum and Mitchell's seminal paper on co-training [13] . 1 Different relevant approaches have been developed with different names, and recently the name disagreement-based semisupervised learning was coined [83] to reflect the fact that they are actually in the same family, and the key for the learning process to proceed is to maintain a large disagreement between base learners. Although transductive learning or active learning may be involved in some place, we will not talk more on them. In the following we will start by a brief introduction to semi-supervised learning, and then we will go to the main theme to introduce representative disagreement-based semi-supervised learning approaches, theoretical foundations, and some applications to real-world tasks.

B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O