Guaranteed Intersection-Free Polygon Morphing We present a method for naturally and continuously morphing two simple planar polygons with corresponding vertices in a manner that guarantees that the intermediate polygons are also simple. This contrasts with all existing polygon morphing schemes who cannot guarantee the non-self-intersection property on a global scale, due to the heuristics they employ. Our method achieves this property by reducing the polygon morphing problem to the problem of morphing compatible planar triangulations of corresponding point sets, which is performed by interpolating vertex barycentric coordinates instead of vertex locations. The reduction involves compatibly triangulating simple polygons and polygons with a single hole. We show how to achieve this using only a small number of extra (Steiner) vertices. Morphing, also known as metamorphosis, is the gradual transformation of one shape (the source) into another (the target). Morphing has wide practical use in areas such as computer graphics, animation and modeling. To achieve more spectacular, impressive and accurate results, the morphing process requires a lot of the work to be done manually. A major research challenge is to develop techniques that will automate this process as much as possible.. The morphing problem has been investigated in many contexts, e.g., morphing of two-dimensional images [1}3], polygons and polylines [4}9], freeform curves [10] and even voxel-based volumetric representations [11] . The morphing process always consists of solving two main problems. The "rst one is to "nd a correspondence between elements (features) of the two shapes. The second problem is to "nd trajectories that corresponding elements traverse during the morphing process.. Regrettably, a formal de"nition of a successful correspondence does not exist, as well as a de"nition of a successful solution of the trajectory problem. In this paper we assume the more typical morphing scenario, namely, that the correspondence is given and only the trajectory problem is to be solved.. The naive approach to solve the trajectory problem is to choose the trajectories to be straight lines, where every feature of the shape travels with a constant velocity along its line towards the corresponding feature of the target during the morph. Unfortunately, this simple approach can lead to undesirable results. The intermediate shapes can vanish, i.e. degenerate into a single point, or contain self-intersections even though the source and target are simple, namely, self-intersection-free. Even if the linear morph is free of self-intersections and degeneracies, its intermediate shapes may have areas or distances between features far from those of the source and target, resulting in a`misbehaveda looking morph. Most of the research on solving the trajectory problem for morphing concentrates on trying to eliminate self-intersections and preserve the geometrical properties of the intermediate shapes. Many existing methods achieve good results for many inputs, however, none guarantees that the resulting morph is always self-intersection-free. One exception is the method of Guibas et al. [12] , but this works only for so-called`parallela source and target polygons, i.e. those whose corresponding edges are parallel.. In this paper we present a polygon morphing scheme, which, to the best of our knowledge, is the only one which guarantees that the intermediate polygons are simple, given any simple source and target polygons. This is achieved by reducing the problem to planar triangulation morphing, for which morphing techniques which preserve triangle orientations have been developed. To perform the reduction, it is necessary to compatibly triangulate the interiors of the source and target polygons, and certain regions exterior to the polygons. We show how to do this e$ciently.. Our work is closest in spirit to that of Tal and Elber [3] and Alexa et al. [4] , in that they also triangulate the interior of the source and target polygons in a compatible manner prior to morphing. The main motivation for this is that texture mapping be well de"ned on the interiors of the triangulated polygons as a piecewise-a$ne mapping. However, the actual vertex trajectories used by Tal and Elber are the simple linear ones, hence do not guarantee that the triangulated polygons are compatible and certainly do not guarantee that they do not self-intersect throughout the morph. Alexa et al. compatibly triangulate the source and target polygons, and optimize the vertex trajectories during the morph in an attempt to maintain compatibility and preserve shape. This results in non-linear vertex trajectories, in which individual triangle orientations seem to be preserved on a local scale throughout the morph. However, on a global scale, there is nothing to prevent the intermediate polygons from self-intersecting.. The paper is organized as follows: Section 2 introduces the notion of compatible triangulations and reviews previous relevant work on morphing of compatible triangulations. Section 3 shows how the polygon morphing problem may be reduced to compatible triangulation morphing by introducing Steiner vertices. Section 4 presents a novel technique to compatibly triangulate the interiors of two simple polygons and a pair of polygons with a single hole each using a small number of Steiner vertices, which is of independent interest. Section 5 shows some results generated by our method, and we conclude in Section 6. This paper has shown how to morph simple polygons in a manner that guarantees that the intermediate shapes are also simple. This is the "rst morphing method which relies on a solid mathematical (as opposed to heuristic) basis to achieve this. It is also a completely automatic process.. A number of parameters related to the morph of the compatible triangulations generated during the process provide some control over the speci"c morph generated. Another algorithmic parameter which might a!ect the quality of the morph is the size of the convex enclosure. Right now we construct the convex enclosure such that its diameter is approximately twice that of the maximum of the source and target polygon diameters. This seems to be the natural choice, as less than this would overconstrain the vertex trajectories, and more than this would not add any extra #exibility.. Many interactive morphing systems allow the user some control over the vertex trajectories, e.g. by specifying the locations of some of the vertices in some of the intermediate frames. While not demonstrated here, our method supports this since the underlying techniques of Surazhsky and Gotsman [17] for morphing compatible triangulations also support it.. A central ingredient in our method is the compatible triangulation of the source and target polygons using a small number of Steiner vertices and maintaining this compatibility throughout the morph. The fact that the triangulation is valid throughout the morph has the extra bene"t that texture mapping is well de"ned in the polygon interior (as well as its exterior) throughout the morph, so the method may be used to morph images while avoiding the common foldover artifacts that occur in many other methods.. Our method of compatible triangulating simple polygons and polygons with one hole is of independent interest, and generates quite fair triangulations using a small number of Steiner vertices. In general there is a tradeo! between the number of Steiner points and the fairness of the triangulation, in the sense that a very small number of Steiner points will not allow a very fair triangulation, and a large number of Steiner points gives a lot of #exibility. The crux of the matter is to carefully position as few Steiner points as possible in order to optimize the tradeo!. We are able to do this by taking into account the relative shapes and feature points of the input polygons. Reducing the number of Steiner points reduces the complexity of the morphing problem, and the number of compatibility constraints. A more detailed description of the triangulation algorithms and some enhancements, which further reduce the number of Steiner vertices, along with formal correctness proofs, will be published separately [22] .. In terms of complexity, most of the morphing computation time is spent on solving a set of linear equations per intermediate frame. Our implementation has not been optimized to solve these equations e$ciently. However, Floater [8] has reported that these sets of equations may be solved in an order of magnitude less CPU time by using sparse matrix numerical methods.. Future work includes generalizing our algorithm to more complex planar shapes, such as polylines, and the so-called`skeletonsa or`stick "guresa * connected straight-line planar graphs. Morphing between unconnected planar "gures, or between "gures with completely di!erent topologies, is more complicated.. The most challenging task ahead, by far, is to generalize our methods to 3D, namely, to morph 3D polyhedra. The straightforward extension to polyhedra involves compatible tetrahedralizations of the polyhedra, which seems to be much more di$cult than triangulation of planar polygons. We believe, however, that the theory and basic methods should carry through.

O O O B O O O O O O O O B O O O B O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O


Software architecture improvement through test-driven development This research involves empirical software engineering studies applied in academic and professional settings to assess the influence of test-driven development on software quality. Particular focus is given to internal software design quality. Pedagogical implications are also examined. Initial results and the study protocol and plans will be presented.

O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O


System-Level Performance Analysis for Designing On-Chip Communication Architectures Abstract-This paper presents a novel system-level performance analysis technique to support the design of custom communication architectures for system-on-chip integrated circuits. Our technique fills a gap in existing techniques for system-level performance analysis, which are either too slow to use in an iterative communication architecture design framework (e.g., simulation of the complete system) or are not accurate enough to drive the design of the communication architecture (e.g., techniques that perform a "static" analysis of the system performance). Our technique is based on a hybrid trace-based performance-analysis methodology in which an initial cosimulation of the system is performed with the communication described in an abstract manner (e.g., as events or abstract data transfers). An abstract set of traces are extracted from the initial cosimulation containing necessary and sufficient information about the computations and communications of the system components. The system designer then In this paper, we have demonstrated that the selection of the communication architecture for a system (its topology and channel protocols) can have a significant impact on its performance. This motivates the need for fast and accurate exploration tools to evaluate various design alternatives. We have described a trace-based approach that helps evaluate alternative bus protocols and communication architecture topologies. We believe our technique will be helpful in meeting this need in the system-on-chip design environment and have presented experimental results that support claims of efficiency and accuracy.. In future work, we plan to develop methodologies to automatically generate simulation test benches that create worst-case conditions for the communication architecture-for instance, such a test bench could include a set of input stimuli that result in very high contention for access to a shared communication channel. Since our performance-analysis technique is tracebased, use of such test benches will enable exhaustive performance analysis of the system under various boundary conditions. We are currently investigating how to incorporate our performance-analysis tool into an optimization framework to automatically generate an optimal communication architecture for a given system. We are also enhancing the tool to take into account a variety of runtime effects.

O B I O O O B I O O O O O O B I O O O O O O O B I O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Planning for code buffer management in distributed virtual execution environments ABSTRACT Over the last several years virtual execution environments (VEE) have been increasingly useful in system implementation. A VEE can reduce and manage complexity by providing a common runtime and a self-contained operating environment that facilitates the programmatic modification of an executing program. In addition to the well-known Java virtual machine (JVM), a wide variety of systems can also be classified as virtual execution environments, such as dynamic optimizers [2, 5, 6, 17] , dynamic software updaters [18] , dynamic binary translators [8, 9, 11, 27] , dynamic instrumentation systems [3, 19, 23] , and certain emulators and simulators [26, 29] .. Although a virtual machine (VM) can execute programs using interpretation, performance-critical VMs often employ software dynamic translation because a translator has the potential to produce significantly higher quality code and thus is able to utilize resources efficiently. Just-in-time (JIT) compilation, for instance, is used in many JVMs. After translating a code segment, a translation-based VEE typically stores the translated code in a code buffer (CB), and reuses the code for future invocations. The overhead of dynamic translation can be amortized if the translated code is reused frequently.. As VEE techniques have been applied to a range of computing environments, there is a set of environments in which devices have exceptionally tight memory and performance constraints, such as smart cards and sensors in distributed systems [4, 10, 15, 22, 25, 28] . The software executing in such environments, however, has become quite complex. For example, a smart card might use the RSA protocol to authenticate a user's identity [25] . Furthermore, such constrained devices may need to support multitasking workloads. For instance, a sensor in an intrusion detection network concurrently monitors environmental events, tracks objects, and communicates with other sensors [1] . A consequence of this trend is that memory demands have become very high.. Due to severe memory limitations (e.g., an Atmel ATmega128 processor has 128 KB flash memory and 4 KB SRAM [4] ), the original code of a single large program, or multiple small programs, may not fit in the memory of a resource-constrained device. To address such constraints, and inspired by program partitioning schemes for traditional systems [16, 24, 31, 32] , we propose to store the original software on a code server and to execute the VM using its code buffer on the device (as a client). A piece of original program code (e.g., trace, basic block sequence, method, program slices, etc.), called a partition, is downloaded from the code server to the client on-demand via a wireless link. The code executes on the client and a CB miss happens when a needed partition is not in the CB. Not only does this partition need to be downloaded on-demand, it also needs to be re-translated by the VM before execution continues. As wireless bandwidth is limited in resource-constrained devices and dynamic translation is expensive, the CB has a high miss penalty, and it must be intelligently managed to keep miss rates low.. In dynamic optimization systems, a generational buffer is proposed [14] , which tries to identify and use the lifetime of code to manage the code buffer. Two other similar techniques that have been proposed to manage the CB are adaptive code unloading [30] and code collection [24] , both of which use online profiling to trigger a garbage collector. Another technique for embedded systems is compiler-controlled function caching [32] . Code replacement policies employed in hardware caches and operating systems, such as LRU, are related as well. However, these methods are unsuitable for distributed VEEs due to two reasons. First, although a technique might effectively reduce CB misses, its overhead can be too high to be practical (e.g., a VM must maintain usage information to employ online profiling). Second, most of these approaches cannot achieve a satisfactory CB miss rate when memory space is tightly limited, as these approaches lack the awareness of both program and memory size. To achieve an effective CB miss rate, a scheme needs to utilize knowledge of a program and its memory size, while having a low run-time cost.. In this paper we present a technique whereby the server "plans" for memory management using both the program and the memory size. Using program profiles helps the schemes maintain hot code partitions in the CB and thus avoid caching cold partitions. We move management decision-making to a server to keep the demands placed on the clients minimal. One scheme is used for programs that are insensitive to data inputs, having stable behavior across different data sets, while the other scheme adapts decisions for programs that are highly sensitive to inputs.. The contributions of this paper include:. • Planning for CB management before execution and moving decision-making from the client to a server; • A simple yet effective planning management scheme for programs with stable behavior across different data inputs; • An adaptive scheme for programs in which inputs can produce varying behaviors; and • Experimental results that demonstrate the benefits of our schemes over previous approaches.. The remainder of the paper is organized as follows. Section 2 provides a background on resource-constrained systems, and Section 3 describes our planning schemes. Section 4 evaluates the schemes in terms of miss reduction and the impact on execution time. Section 5 surveys related work and Section 6 summarizes the paper. As the memory requirements of distributed VEEs is growing, we proposed to store the original programs on a code server, and to execute a VEE with its code buffer on the client. The original program is divided into code partitions and partitions are downloaded on-demand. This paper described two schemes to manage the CB with profile guidance. From experimental results, we showed that these schemes have fewer CB misses than a generational buffer and a unified circular buffer, which translates into significant speedup. In particular, the adaptive scheme performed better than the fixed scheme. Yet, it has low overhead and it is a good choice for resource-constrained devices in distributed VEEs. DELI [9] , an infrastructure for manipulating or monitoring running programs, provides a mode (called code streaming) for remote execution, where a remote application is loaded on-demand piece by piece. The authors discussed the method when the emulated ISA and the target ISA are the same, while we extended the idea to general VEEs, even if the original and target ISAs are different.. There are several buffer management approaches proposed for dynamic translation/optimization systems, including: flushing the stands for individualized generational scheme; "Den (Fix.)" stands for fixed scheme using density in planning; and "Den (Adp.)" stands for adaptive scheme using density in planning. Figure 9 . Execution time speedup over the baseline. "Gen (Unif.)" stands for unified generational scheme; "Gen (Ind.)" stands for individualized generational scheme; "Den (Fix.)" stands for fixed scheme using density in planning; and "Den (Adp.)" stands for adaptive scheme using density in planning.. buffer when it gets full (Dynamo [5] and DELI [9] ), an unbounded buffer (Strata [27] and DynamoRio [6] by default), and a circular buffer. The generational buffer was proposed to overcome the limitations of these techniques [14] . The results presented in Section 4 show that these techniques are unsuitable for distributed systems with tight resource constraints. Zhang and Krintz proposed an adaptive code unloading method for JVMs with JIT compilation [30] . Their cached element is method based, which may include cold code. And the fragmentation is handled by the system's garbage collector, which is too expensive to execute on a constrained device. They mentioned a very simple offline profiling method in their paper but its result was disappointing. Popa et al. proposed a mechanism called code collection to support large applications on mobile devices [24] , which is similar to our approaches. But their heuristic algorithm necessitates a client to collect run-time information for selecting code units to discard, while ours does not. And their scheme is also method-based and requires a garbage collector running on the client. Zhang et al. proposed a buffer management technique, function caching, for smart cards [32] . Their approach is not adaptive as the compiler fully controls the management, and their caching elements are functions which may contain unneeded code. Another undesirable side is that they only applied the technique in user defined calls where source code is available. Another related research is profile guided code compression [7] , which compresses cold code to achieve size reduction, and leaves hot code uncompressed to minimize run-time penalty. The number of their code categories is fixed to 2 (hot and cold), and the classification can be adaptive to neither a particular input nor available memory size.. Regarding the security concerns, our approaches can easily incorporate the tamper-resistant partitioning method [32] , and transferred code could be encrypted.. Hazelwood and Smith have found that pure FIFO policy is not enough for real world applications due to some complications, such as undeletable cache code and program-forced evictions. Pseudo-circular policy, a variant of FIFO, can be used in this situation [14] . Our scheme is compatible to use the pseudo-circular policy as the local policy. Tight memory constraints and high CB miss penalties make good CB management decisions critical to performance. In general, with more knowledge about program behavior, better decisions can be made about buffer management. Program profiling can be used to identify likely execution paths. Indeed, it is known that most execution time is spent in a small portion (hot code) of a program, with recent studies showing similar results for code traces [5] . A trace is a sequence of basic blocks that are executed along a path. Hazelwood and Smith [13] showed that regardless of data inputs for SPEC2000 programs, code traces that account for roughly 85% of the dynamic instruction count are repeated during successive executions. Hence, basic block profiling works well in these programs and can identify sequences of hot code.. Although there are many programs in which profiling can capture execution stability, there are some programs with much variability across inputs. For instance, the program blowfish [21] behaves differently when encoding a plain-text file and an image file. Considering the importance of good CB decisions, a management scheme needs adaptivity for these unstable programs. The adaptivity can be achieved by gathering run-time information about hot basic blocks and paths.. When management decisions are made by the client, profiles can introduce considerable overhead. Offline profiles need to be accessible to the client and run-time information needs to be updated. Both are very expensive to use or maintain on the client. Indeed, it is typically infeasible for a severely restricted client to use profile information directly. Therefore, we propose to make a code server responsible for CB management, moving decision-making from a client to a more powerful server that can more easily maintain, update, and use profiles. Thus, the client only executes simple actions guided by the server, while the server manages the client's CB.

O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Jmax-pruning: A facility for the information theoretic pruning of modular classification rules The Prism family of algorithms induces modular classification rules in contrast to the Top Down Induction of Decision Trees (TDIDT) approach which induces classification rules in the intermediate form of a tree structure. Both approaches achieve a comparable classification accuracy. However in some cases Prism outperforms TDIDT. For both approaches pre-pruning facilities have been developed in order to prevent the induced classifiers from overfitting on noisy datasets, by cutting rule terms or whole rules or by truncating decision trees according to certain metrics. There have been many pre-pruning mechanisms developed for the TDIDT approach, but for the Prism family the only existing pre-pruning facility is J-pruning. J-pruning not only works on Prism algorithms but also on TDIDT. Although it has been shown that J-pruning produces good results, this work points out that J-pruning does not use its full potential. The original J-pruning facility is examined and the use of a new pre-pruning facility, called Jmax-pruning, is proposed and evaluated empirically. A possible pre-pruning facility for TDIDT based on Jmax-pruning is also discussed. The growing interest in the area of data mining has led to various developments for the induction of classification rules from large data samples in order to classify previously unseen data instances. Classification rule induction algorithms can be categorised in two different approaches the Top Down Induction of Decision Trees (TDIDT) [1] also known as the 'divide and conquer' approach and the 'separate and conquer' approach. The 'divide and conquer' approach induces classification rules in the intermediate form of a decision tree, whereas the 'separate and conquer' approach directly induces 'IF... THEN...' rules. The 'divide and conquer' approach can be traced back to the 1960s [2] and resulted in wide selection of classification systems such as C4.5 and C5.0. The 'separate and conquer' approach [3] can also be traced back to the 1960s. Its most notable member is the Prism family of algorithms as a direct competitor to the induction of decision trees.. The original Prism algorithm described in [4] identified the tree structure induced by 'separate and conquer' as the major handicap of decision trees which makes them vulnerable to overfitting, especially on noisy datasets. Prism has been shown to produce a similar classification accuracy compared with decision trees and in some cases, even outperforms decision trees. This is particularly the case, if the training data is noisy. There is also some recent interest in parallel versions of Prism algorithms, in order to make them scale better on large datasets. The framework described in [5] , the Parallel Modular Classification Rule Inducer (PMCRI) allows to parallelise any member of the Prism family of algorithms.. Nevertheless also Prism, like any classification rule induction algorithm, is prone to overfitting on the training data. For decision trees there is a large variety of pruning algorithms that modify the classifier during or after the induction of the tree in order to make the tree more general and reduce unwanted overfitting [6] . For the Prism family of algorithms there is only one method described in the literature, and that is J-pruning [7, 17] . Jpruning is based on the J-measure [8] , a information theoretic measure for quantifying the information content of a rule. Also there is an extension of the PMCRI framework mentioned above, the J-PMCRI framework [9] that incorporates J-pruning into PMCRI, not only for quality reasons but also because J-pruning reduces the number of rules and rule terms induced and thus the runtime of Prism and PMCRI.. This paper examines the J-pruning method described in [7, 17] and proposes a new pruning method Jmax-pruning, that aims to exploit the Jmeasure further and thus further to improve Prism's classification accuracy. The basic Prism approach is described in Section 2 and compared with decision trees, also some particular members of the Prism family are introduced briefly. J-pruning is described and discussed in Section 2.3 and Jmax-pruning as a new variation of J-pruning is introduced and discussed in Section 3.2 and evaluated in Section 4. The ongoing work is described in Section 5 and discusses J-PrismTCS a version of Prism solely based on the J-measure and more importantly proposes the development of a version of Jmax-pruning for Decision Tree induction algorithms. Section 6 concludes the paper with a brief summary and discussion of the findings presented. Section 2 discussed the replicated subtree problem introduced due to the representation of rules in the form of decision trees. The Prism family of algorithms has been introduced as an alternative approach to TDIDT that does induce modular classification rules that do not necessarily fit into a tree structure. The Prism family of algorithms was highlighted and Jpruning, a pre-pruning facility for Prism algorithms based on the J-measure, which describes the information content of a rule, was introduced. Section 3 criticised J-pruning as it does not fully exploit the potential of the J-measure. The J-value of a rule may go up or down when rule terms are appended to the rule. J-pruning truncates a rule as soon as the J-value decreases even if it may recover (increase again). The proposed Jmax-pruning exploits the possibility of a J-value recovery and achieves in some cases, examined in Section 4, better results compared with J-pruning, but in every case examined Jmax-pruning achieved at least the same or a higher classification accuracy compared with J-pruning.. The ongoing work comprises the development of J-PrismTCS, a version of PrismTCS that is solely based on the J-measure, by using it also as a rule term selection metric as discussed in Section 5.1. Furthermore the ongoing work comprises the development of a TDIDT algorithm that incorporates Jmax-pruning as discussed in Section 5.2.

B O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O B B O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O B O O O O O O O O O B O O B O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O


Currency Hedging Strategies Using Dynamic Multivariate GARCH This paper examines the effect on the effectiveness of using futures contracts as hedging instruments of: 1) the model of volatility used to estimate conditional variances and covariances, 2) the analyzed currency, and 3) the maturity of the futures contract being used. For this purpose, daily data of futures and spot exchange rates of three currencies, Euro, British pound and Japanese yen, against the American dollar are used to analyze hedge ratios and hedging effectiveness resulting from using two different maturity currency contracts, near-month and next-to-near-month contract. We estimate four multivariate volatility models (CCC, VARMAA-GARCH, DCC and BEKK) and calculate optimal portfolio weights and optimal hedge ratios to identify appropriate currency hedging strategies. Hedging effectiveness index suggests that the best results in terms of reducing the variance of the portfolio are for the USD/GBP exchange rate.The results show that futures hedging strategies are slightly more effective when the near-month future contract is used for the USD/GBP and USD/JPY currencies.Moreover, CCC and AGARCH models provide similar hedging effectiveness although some differences appear when the DCC and BEKK models are used. With the rise of the capital market liberalization and globalization, foreign currency denominated assets circulate rapidly in the world. With increasing internationalization of financial transactions, the foreign exchange market has been profoundly transformed and became more competitive and volatile. This places the accurate and reliable measurement of market risks in a crucial position for both investment decision and hedging strategy designs.. Foreign exchange rate markets are the largest and most liquid of all asset markets.. Developments in these markets influence national trade and monetary policies and the competitiveness of nations. Foreign exchange markets are also important for the increasing number of companies engaged in cross-border trade and investment. The foreign exchange business is naturally risky, because it deals primarily in measuring, pricing, and managing risk. The success of an institution trading in the foreign exchange market depends critically on how well it assesses prices and manages the inherent risk, on its ability to limit losses from particular transactions, and to keep its overall exposure under control.. The fact in managing currency risk is to control the volatility of the portfolio. The volatility of a portfolio includes variances and correlation coefficients of, and among, individual positions. Great losses may be yielded from holding this portfolio without a time-varying consideration of its variance and correlation parts simultaneously. If investors can sense the interacting dynamics among markets in advance, then adjusting and hedging activities will be implemented in time. Successful and profitable performances can therefore be made.. The aim of hedging is to use derivatives to reduce a particular risk. A relatively inexpensive and reliable strategy for hedging foreign exchange risk involves the use of foreign currency futures markets. Hedging with futures contracts is perhaps the simplest method for managing market risk arising from adverse movements in the foreign exchange market. Hedgers usually short an amount of futures contracts if they hold the long position of the underlying currency and vice versa. The question is how many futures contracts should be held for each unit of the underlying currency, as well as the effectiveness measure of that ratio. The hedge ratio provides information on how many futures contracts should be held, whereas its effectiveness evaluates the hedging performance and the usefulness of the strategy. In addition, hedgers may use the effectiveness measure to compare the benefits of hedging a given position from many alternative contracts.. Generally speaking, when the market trend is stable, the hedge ratio will become smaller, whereas if a big fluctuation of the market takes place it will get bigger. Several distinct approaches have been developed to estimate the optimal hedge ratio (OHR), also known as the minimum-variance hedge ratio.. The static hedging model with futures contracts (Johnson [32] , Stein [56] , Ederington, [21] ) assumes that the joint distribution of spot and futures returns is time-invariant and therefore the OHR, defined as the optimal number of futures holdings per unit of spot holdings, is constant over time. The minimum variance OHR use to be derived form the ordinary-least squares (OLS) regression of spot price changes on future price changes.. There is wide evidence that the simple OLS method is inappropriate to estimate hedge ratios since it suffers from the problem of serial correlation in the OLS residuals and the heteroscedasticity often encountered in spot and futures price series (Herbst et al. [31] ).. Therefore, the underlying assumption of the static hedging model of time-invariant asset distributions has been changed. The Autoregressive Conditional Heteroscedastic (ARCH) framework of Engle [23] and its extension to a generalized ARCH (GARCH) structure by Bollerslev [8] have proven to be very successful in modelling asset price second-moment movements. Bollerslev [9] , Bailie and Bollerslev [3] , and Diebold [19] have shown that the GARCH (1,1) model is effective in explaining the distribution of exchange rate changes. However, Lien et al. [39] compared Ordinary Least Squares (OLS) and constant-correlation vector generalized autoregressive conditional heteroscedasticity (VGARCH) and claimed that the Ordinary List Squares (OLS) hedge ratio performs better than the VGARCH one. CHAN [16] proposed a dynamic hedging strategy based on a bivariate GARCH-jump model augmented with autoregressive jump intensity to manage currency risk. The collective evidence shows that the GARCHmodelled dynamic hedging strategies are empirically appropriate but the risk-reduction improvements over constant hedges vary across markets and may be sensitive to the sample period employed in the analysis.. Regarding foreign currencies, different results are provided. Kroner and Sultan [35] demonstrated that GARCH hedge ratios produce better hedging effectiveness than conventional hedge ratios in currency markets. Chakraborty and Barkoulas [15] employed a bivariate GARCH model to estimate the joint distribution of spot and futures currency returns and they constructed the sequence of dynamic (time-varying) OHRs based upon the estimated parameters of the conditional covariance matrix. The empirical evidence strongly supports time-varying OHRs but the dynamic model provides superior out-of-sample hedging performance, compared to the static model, only for the Canadian dollar. Ku et al. [37] applied the dynamic conditional correlation (DCC)-GARCH model of Engle [24] with error correction terms to investigate the optimal hedge ratios of British and Japanese currency futures markets and compare the DCC-GARCH and OLS model. Results show that the dynamic conditional correlation model yields the best hedging performance.. Given the distinct theoretical advantages of the dynamic hedging method over the static one, a great number of studies have employed the multivariate GARCH framework to examine its hedging performance for various assets. To evaluate the impact of model specification on the forecast of conditional correlations, Hakim and McAleer [29] analyze whether multivariate GARCH models incorporating volatility spillovers and asymmetric effect of negative and positive shocks on the conditional variance provide different conditional correlations forecasts. Using three multivariate GARCH models, namely the CCC model (Bollerslev, [10] ), VARMA-GARCH model (Ling and McAleer, [41] ), and VARMA-AGARCH model (McAleer et.al., [45] ) they forecast conditional correlations between three classes of international financial assets (stock, bond and foreign exchange). The paper suggested that incorporating volatility spillovers and asymmetric of negative and positive shocks on the conditional variance does not affect forecasting conditional correlations.. To estimate time-varying hedge ratios using multivariate conditional volatility models Chang et.al. [17] examined the performance of four models (CCC, VARMA-GARCH, DCC and BEKK) for the crude oil spot and futures returns of two major international crude oil markets (BRENT and WTI). The calculated OHRs form each multivariate conditional volatility model presented the time-varying hedge ratios and recommended to short in crude oil futures, with a high portion of one dollar long in crude oil spot. The hedging effectiveness indicated that DCC (BEKK) was the best (worst) model for OHR calculation in terms of the variance of portfolio reduction. This paper extends Chang et.al. [17] to currency hedging. To evaluate the impact of model specification on conditional correlations forecasts, this paper calculates and compares the correlations between conditional correlations forecasts resulted from four different multivariate models (CCC, VARMA-AGARCH, DCC and BEKK) to estimate the returns on spot and futures (analyzing two sets of futures depending on their maturity) of three currency prices (USD/GBP, USD/EUR and USD/JPY). The purpose is to calculate the optimal portfolio weights and OHRs ratio from the conditional covariance matrices in order to achieve an optimal portfolio design and hedging strategy, and to compare the performance of OHRs from estimated multivariate conditional volatility models by applying the hedging effectiveness index. One of the main contributions of this study is that allows us to compare whether the results are different depending on the volatility model, currency and maturity of the future contract selected. We have found no evidence of these three items considered together for currency hedging in prior literature.. The remainder of the paper is organized as follows. In Section 2 we discuss the multivariate GARCH models used, and the derivation of the OHR and hedging effective index. In section 3 the data used for estimation and forecasting and the descriptive statistics are presented. Section 4 analyses the empirical estimates from empirical modeling. Section 5 presents some conclusions. This study sheds light on the importance of measuring conditional variances and covariances when hedging daily currency risk using futures. The findings are of importance to currency hedgers who require taking futures positions in order to adequately reduce the risk. In this paper, we use four multivariate GARCH models, CCC, VARMA-AGARCH, DCC, and BEKK, to examine the volatilities among spot and two distinct maturity futures, near-month and next-to-near-month contracts. The estimated conditional covariances matrices from these models were used to calculate the optimal portfolios weights and optimal hedge ratios.. The empirical results in this paper reveal that there are not big effectiveness differences when either the near-moth or the next-to-near-month contract is used for hedging spot position on currencies. They even reveal that hedging ratios are lower for near-month contract when the USD/EUR and USD/JPY exchange rate are analyzed. This result is explained in terms of the higher correlation between spot prices and the next-to-nearmonth futures prices than that with near-month contract and additionally because of the lower volatility of the long maturity futures.. Finally, CCC and VARMA-AGARCH models provide similar results in terms of hedging ratios, portfolio variance reduction and hedging effectiveness. Some differences appear when the DCC and BEKK models are used. Hedging ratios seem to decrease during the GFC as opposed to increasing ratios when CCC and VARMA-AGARH models are consider for calculating the covariance matrix. Future research should be done to investigate the effects of the GFC on the conditional correlation between spot and futures contracts as well as its impact on hedging effectiveness.

O B O O O B I O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O B I O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O


Certified In-lined Reference Monitoring on .NET Mobile is an extension of the .NET Common Intermediate Language that supports certified In-Lined Reference Monitoring. Mobile programs have the useful property that if they are welltyped with respect to a declared security policy, then they are guaranteed not to violate that security policy when executed. Thus, when an In-Lined Reference Monitor (IRM) is expressed in Mobile, it can be certified by a simple type-checker to eliminate the need to trust the producer of the IRM.Security policies in Mobile are declarative, can involve unbounded collections of objects allocated at runtime, and can regard infinite-length histories of security events exhibited by those objects. The prototype Mobile implementation enforces properties expressed by finite-state security automata-one automaton for each security-relevant object-and can type-check Mobile programs in the presence of exceptions, finalizers, concurrency, and non-termination. Executing Mobile programs requires no change to existing .NET virtual machine implementations, since Mobile programs consist of normal managed CIL code with extra typing annotations stored in .NET attributes. Language-based approaches to computer security have employed two major strategies for enforcing security policies over untrusted programs.. • Low-level type systems, such as those used in Java bytecode [22] , .NET CIL [10] , and TAL for x86 [24] , can enforce important program invariants such as memory safety and control safety, which dictate that programs must access and transfer control only to certain suitable memory addresses throughout their executions. Proof-Carrying Code (PCC) [25] generalizes the type-safety approach by providing an explicit proof of safety in first-order logic.. • Execution Monitoring technologies such as Java and .NET stack inspection [15] [22, II. 22 .11], SASI [12] , Java-MAC [21] , Java-MOP [4] , Polymer [1] , and Naccio [13] , use runtime checks to enforce temporal properties that can depend on the history of the program's execution. For example, SASI Java was used to enforce the policy that no program may access the network after it reads from a file [11] . For efficiency, execution monitors are often implemented as In-lined Reference Monitors (IRM's) [28] , wherein the runtime checks are in-lined into the untrusted program itself to produce a self-monitoring program.. The IRM approach is capable of enforcing a large class of powerful security policies, including ones that cannot be enforced with purely static type-checking [18] . In addition, IRM's can enforce a flexible range of policies, often allowing the code recipient to choose the security policy after the code is received, whereas static type systems and PCC usually enforce fixed security policies that are encoded into the type system or proof logic itself, and that therefore cannot be changed without changing the type system or certifying compiler.. But despite their power and flexibility, the rewriters that automatically embed IRM's into untrusted programs are typically trusted components of the system. Since rewriters tend to be large and complex when efficient rewriting is required or complex security policies are to be enforced, the rewriter becomes a significant addition to the system's trusted computing base.. In this paper, we present Mobile, an extension to the .NET CIL that makes it possible to automatically verify IRM's using a static type-checker. Mobile (MOnitorable BIL with Effects) is an extension of BIL (Baby Intermediate Language) [16] , a substantial fragment of managed .NET CIL that was used to develop generics for .NET [20] . Mobile programs are CIL programs with additional typing annotations that track an abstract representation of program execution history. These typing annotations allow a type-checker to verify statically that the runtime checks in-lined into the untrusted program suffice to enforce a specified security policy. Once type-checked, the typing annotations can be erased, and the selfmonitoring program can be safely executed as normal CIL code. This verification process allows a rewriter to be removed from the Even when the rewriter is small and therefore comparable in size to the type-checker, type-checking constitutes a useful level of redundancy that provides greater assurance than trusting the rewriter alone. Mobile thus leverages the power of IRM's while using the type-safety approach to keep the trusted computing base small. Figure 1 summarizes a typical load path on a system that executes IRM's written in Mobile. Untrusted, managed CIL code is first automatically rewritten according to a security policy, yielding an annotated, self-monitoring program written in Mobile. The rewriting can be performed by either a code producer or by a client machine receiving the untrusted code. Since the rewriter, and therefore the self-monitoring program, remains untrusted, the self-monitoring program is then passed to a trusted type-checker that certifies the code with respect to the original security policy. Code that satisfies the security policy will be approved by the typechecker, and is therefore safe to execute; code that is not well-typed will be rejected and would indicate a failure of the rewriter.. In this paper we focus on robust certification of Mobile code. Techniques for efficient rewriting are left to future work, but we describe a naïve rewriter and suggest some strategies for optimizing it in §3. Our prototype implementation of Mobile consists of a type-checker that verifies sound rewriting with respect to security policies expressed as ω-regular expressions. The implementation can verify both single-threaded and multi-threaded managed CIL applications, and it supports language features beyond those modeled by BIL, such as exceptions and finalizers. A Mobile security policy identifies a set of security-relevant object classes and assigns a set of acceptable traces to each such class. A trace is a finite or infinite sequence of security-relevant eventsprogram operations that take a security-relevant object as an argument. Our implementation expresses security policies as ω-regular expressions over the alphabet of events, but the formalisms presented in this article can be leveraged to support alternative policy languages as well. A Mobile program satisfies the security policy if for every complete run of the program, (i) if the run is finite (i.e., the program terminates), the sequence of security-relevant events performed on every object allocated during that run is a member of the set of traces that the security policy has assigned to that object's class; and (ii) if the run is infinite (i.e., the program does not terminate), at each step of the run the sequence of security-relevant events performed so far on each security-relevant object is a prefix of a member of the set of traces assigned to that object's class.. For example, [8, p. 5] proposes a security policy involving a WebPageFetcher class for which proper usage is to call the Open method to acquire the resource, the GetPage method to use the resource, and the Close method to release the resource. A Mobile policy that requires programs to open web pages before reading them, allows at most three reads per opened page, and requires programs to close web pages before the program terminates (but allows them to remain open on runs that never terminate), might. ω as the set of acceptable traces for class WebPageFetcher (where O, G, and C denote Open, GetPage, and Close events, respectively, and ω denotes finite or infinite repetition). Note that this policy can only be enforced by a mechanism that tracks events at a per-object level.. Although Mobile security policies model events as operations performed on objects, global events that do not concern any particular object can be encoded as operations on a global object that is allocated at program start and destroyed at program termination. Thus, Mobile policies can regard global events, per-object events, and combinations of the two.. For example, one might modify the example policy above by additionally requiring that at most ten network sends may occur during the lifetime of the program. In that case, the global object would additionally be identified as a security-relevant object, a Send method call performed on any System.Net.Sockets.Socket object would be identified as a security-relevant event for the global object, and the global object would be assigned the set of traces denoted by ∪ S ∪ S 2 ∪ · · · ∪ S 10 (where S denotes a Send event). A rewriter that produces self-monitoring programs from untrusted CIL code is expected to produce well-typed Mobile code, so that the policy-adherence theorem can be used to guarantee that it is safe to execute. For this rewriting task to be feasible, Mobile's type system must be flexible enough to permit rewriters to insert runtime security checks-well-typed code that tracks the state of security-relevant objects at runtime, testing aspects of the state that cannot be verified statically. To that end, Mobile supports a pack operation that pairs a security-relevant object with a runtime value (e.g., an integer) representing an abstraction of the object's current state, and that encapsulates them into a two-field package object. Mobile's unpack operation can be used to unpack a package, yielding the original object that was packed along with the runtime value that represents its state. Mobile programs can then test this runtime value to infer information about the associated object's state. Both pack and unpack are implemented as CIL method calls to a small trusted library (about ten lines of C# code).. To keep type-checking tractable, Mobile does not allow securityrelevant operations on objects that are packed. A package class's two fields are declared to be private so that, to access a securityrelevant object directly and perform operations on it, it must first be unpacked. While unpacked, Mobile allows only limited aliasing of security-relevant objects-none of their aliases can escape to the heap. To enforce this restriction, the unpack operation is implemented as a destructive read, preventing the package from being unpacked again before it is re-packed. Packages, however, are permitted to escape to the heap and to undergo unlimited aliasing. These restrictions allow the type-checker to statically track histories of unpacked objects and to ensure that packed objects are always paired with a value that accurately reflects their state. When an object is packed, it is safe for the type-checker to forget whatever information might be statically known about the object, keeping the type-checking algorithm tractable and affording the rewriter a dynamic fallback mechanism when static analysis cannot verify all security-relevant operations.. When pack and unpack are implemented as atomic operations, Mobile can also enforce security policies in concurrent settings. In such a setting, Mobile's type system maintains the invariant that each security-relevant object is either packed or held by at most one thread. Packed objects are always policy-adherent (or their finalizers must bring them to a policy-adherent state at program termination; see §5), whereas unpacked objects are tracked by the type system to ensure that they return to a policy-adherent state before they are relinquished by the thread.. Implementing pack and unpack as atomic swaps is a somewhat blunt approach, but it is still powerful enough to support useful and effective rewriting strategies. Using the above operations, a naïve rewriter can implement state-based histories by simply representing security-relevant objects as packages. Whenever a securityrelevant operation is to be performed, the rewriter would insert code to first unpack the package and test the object's runtime state, then perform the security-relevant operation only if the test succeeds (possibly terminating otherwise), and finally repackage the object with updated state.. This strategy suffices to implement any state-based history but might result in inefficient code if security-relevant operations are frequent. Thus, Mobile's type system also makes it possible to avoid some of these dynamic operations when policy-adherence can be proved statically. For example, a more sophisticated rewriter could in some cases insert code to perform numerous securityrelevant operations consecutively without any dynamic checks. Instead of dynamic checks, the rewriter could add typing annotations that prove to the type-checker that the omitted checks are unnecessary for preventing a security violation. Substituting annotations for dynamic checks in this way is often possible in straight-line code or tight loops that do not leak security-relevant objects to the heap. However, when objects do escape to the heap, the type system is not sufficiently powerful to track them and dynamic checks would usually be necessary in order to prove that a security violation cannot occur. Thus, Mobile's type system is sufficiently expressive that rewriters can avoid some but not all dynamic checks.. Our implementation of Mobile models security policies as finite-state security automata. This approach is appealing because it is simple, practical, it introduces minimal extra state to untrusted programs, and it seems to cover most of the enforceable security policies discussed in the literature. However, the formalisms presented in this paper do not assume any particular method of representing object states at runtime. Rather, we parameterize the framework in terms of arbitrary state representations and state tests so that alternative implementations can be realized in the future. For example, future implementations might track object states using LTL expressions or even by recording an object's complete history at runtime. Thus, Mobile constitutes a framework general enough to reason about many different in-lining strategies used by IRM's. Figure 3 provides Mobile's type system. Mobile types consist of void types, integers, classes, and history abstractions (the types of runtime state values). The type of each unpacked, securityrelevant object C is parameterized by an object identity variable that uniquely identifies the object. All aliases of the object have types with the same object identity variable, but other unpacked objects of the same class have types with different object identity Mobile's type system and the theorems presented in §4. 4 show that a common style of IRM, in which extra state variables and guards that model a security automaton have been in-lined into the untrusted code, can be independently verified by a type-checker, eliminating the need to trust the rewriter that produced the IRM. We verify policies that are universally quantified over unbounded collections of objects-that is, policies that require each object to exhibit a history of security-relevant events that conforms to some stated property. The language of security policies is left abstract and could consist of DFA's, LTL expressions, or any computable language of finite and infinite event sequences.. Our implementation of Mobile for managed Microsoft .NET CIL expresses security policies as ω-regular expressions. We verify such policies in the presence of exceptions, concurrency, finalizers, and non-termination, demonstrating that Mobile can be scaled to real type-safe, low-level languages.. Our presentation of Mobile has not addressed issues of object inheritance of security-relevant classes. Future work should examine how to safely express and implement policies that require objects related by inheritance to conform to different properties. A type-checker for such a system would need to identify when a typecast at runtime could potentially lead to a violation of the policy and provide a means for policy-adherent programs to perform necessary typecasts.. Another open problem is how to support a wider range of IRM implementations. Mobile supports only a specific (but typical) treatment of runtime state, wherein each security-relevant object is paired with a dynamic representation of its state every time it is leaked to the heap. In some settings, it may be desirable to implement IRM's that store an object's dynamic state differently, such as in a separate array rather than packaged together with the object it models. Type systems for coordinated data structures [27] could potentially be leveraged to enforce invariants over these decoupled objects and states.. We chose a type system for Mobile that statically tracks control flow in a data-insensitive manner, with ω-regular expressions denoting sets of event sequences. This approach is appealing because there is a natural rewriting strategy (outlined in §3) whereby well-typed Mobile code can be automatically generated from untrusted CIL code. A more powerful type system could employ a richer language like Hoare Logic [19] to track data-sensitive control flow. This could allow clever rewriters to eliminate additional runtime checks by statically proving that they are unnecessary. However, formulating a sound and complete Hoare Logic for .NET that includes objects and concurrency is challenging; furthermore, the burden of producing useful proofs in this logic would be pushed to the rewriter. Future work should investigate rewriting strategies that could make such an approach worthwhile.. Finally, not every enforceable security policy can be couched as a computable property that is universally quantified over object instances. For example, one potentially useful policy is one that requires that for every file object opened for writing, there exists an encryptor object to which its output stream has been linked. Such a policy is not supported by Mobile because it regards both universal and existentially quantified properties that relate multiple object instances. Future work should consider how to implement IRM's that enforce such policies, and how these implementations could be type-checked so as to statically verify that the IRM satisfies the security policy.. The following is a formal statement of Mobile's typing rules. . Judgment Γ Sig 1 <: Sig 2 in rule 32 asserts that Sig 1 alphavaries to Sig 2 . Type-systems λA [32] and λhist [29] enforce history-based security policies over languages based on the λ-calculus. In both, program histories are tracked at the type-level using effect types that represent an abstraction of those global histories that might have been exhibited by the program prior to control reaching any given program point.. Mobile differs from λA and λhist by tracking history on a perobject basis. That is, both λA and λhist represent a program's history as a finite or infinite sequence of global program events, where the set of all possible global program events is always finite. Policies that are only expressible using an infinite set of global program events (e.g., events parameterized by object instances) are therefore not enforceable by λA or λhist. For example, the policy that every opened file must be closed by the time the program terminates is not enforceable by either λA or λhist when the number of file objects that could be allocated during the program's execution is unbounded. In object-oriented languages such as the .NET CIL, policies concerning unbounded collections of objects arise naturally, so it is not clear how λA or λhist can be extended to such settings. Mobile enforces policies that are universally quantified over objects of any given class, and therefore allows objects to be treated as first-class in policy specifications.. PCC has been proposed as a framework for supporting certifying rewriting using temporal logic [3] . The approach is potentially powerful, but does not presently support languages that include exceptions, concurrency, and other features found in real programming languages [2, p. 173] . It is therefore unclear whether proof size and verification speed would scale well in practical settings.. CQual [14] and Vault [7] are C-like languages that enforce history-based properties of objects by employing a flow-sensitive type system based on alias types [30] and typestates [9] . Securityrelevant objects in CQual or Vault programs have their base types augmented with type qualifiers, which statically track the securityrelevant state of the object. A type-checker then determines if any object might enter a state at runtime that violates the security policy. Vault's type system additionally includes variant types that allow a runtime value to reflect an object's current state. The Vault typechecker identifies instructions that test these state values to ensure that those tests will prevent security violations when the program is executed.. Fugue [8] is a static verifier based on Vault that uses programmersupplied specifications to find bugs in .NET source code. It verifies policies that constrain the use of system resources or that prescribe protocols that constrain the order in which methods may be called on objects. Fugue supports any source language that compiles to managed .NET CIL code, but it does not support exceptions, finalizers, or concurrency. It additionally lacks a formal proof of soundness for its aliasing analysis and type system.. Inspired by CQual, Vault, and Fugue, our work scales these ideas up to a large existing programming language-the full managed .NET CIL (minus reflection)-while providing a formal proof of soundness. In scaling up to a larger-scale language, we adopt a somewhat different approach to tracking object security states at the type level. CQual, Vault, and Fugue assign linear types to security-relevant objects (and, in the case of Vault, to runtime state values), and use aliasing analyses to track changes to items with linear types. However, it is not clear how such analyses can be extended to support concurrency or to support an important technique commonly used by IRM's to track object security states, wherein security-relevant objects are paired with runtime values that record their states, and then such pairs are permitted to leak to the heap. Existing alias analyses cannot easily track items that are permitted to leak to the heap arbitrarily, or that are shared between threads.. We therefore take the approach of L 3 [23] , wherein linearlytyped items are permitted to leak to the heap by packing them into shared data structures with limited interfaces. These shared objectstate pairs, called packages, can be aliased arbitrarily and are not tracked by the type system. Mobile provides trusted operations for packing and unpacking linear-typed items to and from shared package objects. To perform any (security-relevant) operation that might change a value with linear type, it must first be unpacked from any package that contains it. As with ownership types [6, 5] , packing and unpacking operations are implemented as destructive reads, so that only one thread can perform security-relevant operations on a given security-relevant object at a time. Mobile's type system and the CLI permissions system are leveraged to maintain invariants linking an object to an accurate runtime representation of its state. Our prototype implementation of Mobile consists of a type-checker for Mobile's type system extended to the full managed subset of Microsoft's .NET CIL (minus reflection). The type-checker was written in Ocaml (about one thousand lines of code) and uses Microsoft's .NET ILX SDK [31] to read and manipulate .NET bytecode binaries. Mobile programs are .NET CIL programs with typing annotations encoded as .NET method attributes. The Mobile type-checker reads these (untrusted) annotations and verifies them in the course of type-checking.. Our implementation allows security policies to identify method calls as security-relevant events. Thus, security policies can constrain the usage of resources provided by the CLR by monitoring CLR method calls and the objects they return. Our type-checker can, in principle, regard any CIL instruction as a security-relevant event, but we leave practical investigation of this feature to future work.. Operations pack and unpack are implemented as method calls to the (very small) trusted C# library given in Figure 9 . Observe that C#'s lock construct is used to make both operations atomic. History abstraction values are implemented as integers. Thus, our newhist operation is simply a ldc.i4 instruction that loads an integer constant onto the evaluation stack. Policies can statically declare for each integer constant a closed history abstraction that integer represents when used as a runtime state value. Tests of runtime state values consist of equality comparisons with integer constants in the manner described in §4.3. As described in §4.3, this implementation suffices to support IRM's that model security policies as finite-state security automata.. The type-checker must verify subset relations over the language of history abstractions given in Figure 3 . Although deciding subset for ω-regular expressions with variables and intersection is not Figure 9 . Implementation of pack and unpack tractable in general, the task is simplified by observing that real Mobile code only introduces history variables at the beginnings of expressions (when an object is unpacked) and only introduces intersections that involve a variable and a closed history abstraction (when a runtime state value is tested). The resulting sub-language can be decided using a simple regular expression subset algorithm (proof omitted for brevity).. Our type-checker also recognizes method annotations attached to finalizers of security-relevant classes. A finalizer's precondition must be satisfied whenever an object of its class escapes to the heap (i.e., when it is packed), since at any point after that, its package object could become orphaned and then garbage-collected. By the time a program terminates, all of its objects are guaranteed to satisfy their finalizers' postconditions, since at that point any remaining objects will be garbage-collected. This allows an IRM to leak security-relevant objects to the heap (in packages) even when they are not yet in a policy-adherent state, as long as the object's finalizer suffices to restore it to a policy-adherent state once garbage-collection occurs.. To test our implementation, we wrote a simple rewriter like that described in §3, and used it to enforce a security policy that allows each .NET network socket object to accept at most n connections during the program's lifetime (where n is a parameter specified by the policy-writer). Such a policy might be used, for example, to force applications to relinquish control of network ports after a certain amount of activity. We applied this policy to a small multithreaded webserver written in C#. The original application binary was 20K in size and rewriting did not alter its size. (Padding introduced by the CLI binary format masked the small overhead introduced by additional instructions and annotations.) Hand-counting the material inserted by the rewriter revealed approximately 83 bytes in additional instructions and 117 bytes in annotations. Rewriting took 0.12 seconds and type-checking took 0.09 seconds on a 1.8GHz Pentium. We benchmarked both the original and rewritten webservers by using WebStone to simulate two clients retrieving five webpages ranging in size from 500 bytes to 5 megabytes. WebStone reported that the rewritten webserver exhibited an average throughput rate that was 99.97% of the original webserver's.. The aforementioned test is obviously not a definitive evaluation of the feasibility of automated rewriting; much work remains to be done in terms of evaluating the approach on richer policies and applications. However, we consider it to be preliminary evidence that rewriting can be automated in a way that produces acceptable annotations.

O B I I O O O O O O O O O O O B O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O B O B O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O B O O O B I O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B I O O O O O B O O O O O O B O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O B O O O O O O O B O O O O B O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O B I O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B O O O O O O O O B O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O B O O O O O O O O B O O O O O O B O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O B O O O O O O B O O O O B O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O B O O O O B O O B O O O O O O O O B I O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B B O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O B O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O