On Learning Thresholds of Parities and Unions of Rectangles in Random Walk Models In a recent breakthrough, [Bshouty et al., 2005] obtained the first passivelearning algorithm for DNFs under the uniform distribution. They showed that DNFs are learnable in the Random Walk and Noise Sensitivity models. We extend their results in several directions. We first show that thresholds of parities, a natural class encompassing DNFs, cannot be learned efficiently in the Noise Sensitivity model using only statistical queries. In contrast, we show that a cyclic version of the Random Walk model allows to learn efficiently polynomially weighted thresholds of parities. We also extend the algorithm of Bshouty et al. to the case of Unions of Rectangles, a natural generalization of DNFs to {0, . . . , b − 1} n . Learning Boolean formulae in Disjunctive Normal Form (DNF) has been a central problem in the computational learning theory literature since Valiant's seminal paper on PAC learning [25] . In [12] , it was shown that DNFs can be learned using membership queries, a form of active learning. Jackson's algorithm, also known as Harmonic Sieve (HS), uses a clever combination of two fundamental techniques in learning, Harmonic Analysis and Boosting. The use of Harmonic Analysis in the study of Boolean functions was introduced in [15] . It was subsequently used as the basis of a learning algorithm for AC 0 circuits in [20] . The Harmonic Analysis used in the HS algorithm is based on a parity-finding algorithm of Goldreich and Levin [10] , which was first applied to a learning problem by Kushilevitz and Mansour [19] . Hypothesis boosting, a technique to reduce the classification error of a learning algorithm, was introduced by Schapire [23] . The boosting algorithm used by HS is actually due to Freund [7] .. In a recent breakthrough, Bshouty et al. [5] obtained the first passive learning algorithm for DNFs. Their algorithm is based on a modification of HS which focuses on low-degree Fourier coefficients. That variant of HS, called Bounded Sieve (BS), was first obtained in [4] . In [5] , BS was used to learn DNFs under the uniform distribution in two natural passive learning models. The first one is the Random Walk model, where examples, instead of being i.i.d., follow a random walk on the Boolean cube (see also [2, 9] for related work). The second model is the closely related Noise Sensitivity model, where this time examples come in pairs, the second instance being a noisy version of the first one. The results of [5] are interesting in that they give a learning algorithm for DNFs in a case where the observer has no control over the examples provided. However the problem of learning DNFs under the uniform distribution when examples are i.i.d. still remains open. It is known that DNFs cannot be learned in the more restrictive Statistical Query model (introduced in [16] ) where one can ask only about statistics over random examples [3] .. Jackson [12] also showed that HS applies to thresholds of parities (TOP), a class that can express DNFs and decision trees with only polynomial increase in size, and extended his algorithm to the non-Boolean case of unions of rectangles, a generalization of DNFs to {0, . . . , b − 1} n (where b = O(1)). Whether those classes of functions can be learned in the Random Walk and Noise Sensitivity models was left open by [5] . Our contribution is threefold. We first show that TOPs cannot be learned in the Noise Sensitivity model using statistical queries (SQs) 1 . As far as we know, this is the first example of a negative result for "second-order" statistical queries, i.e. queries on pairs of examples. This does not rule out the possibility of learning TOPs in the Random Walk model although it provides evidence that the techniques of [5] cannot be easily extended to that case. On the other hand, we show that a simple variant of the Random Walk model where the component updates follow a fixed cycle allows to learn TOPs efficiently. This seems to be the first not-too-contrived passive model in which TOPs are efficiently learnable with respect to the uniform distribution. Actually, one can perform the Harmonic Sieve in this Cyclic Random Walk model, and we also show that this model is strictly weaker than the active setting under a standard cryptographic assumption. Finally we extend the techniques of [4] and [5] to the non-Boolean domain {0, . . . , b − 1} n and use this to learn unions of rectangles in the Noise Sensitivity and Random Walk models. This last result turns out to be rather straightforward once the proper analogues to the Boolean case are found.. In Section 2, we introduce the learning models and give a brief review of Fourier analysis. The negative result for learning TOPs is derived in Section 3. The learning algorithms for TOPs and Unions of Rectangles are presented in Sections 4 and 5 respectively.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Runtime Monitoring for Next Generation Java ME Platform Many modern mobile devices, such as mobile phones or Personal Digital Assistants (PDAs), are able to run Java applications, such as games, Internet browsers, chat tools and so on. These applications perform some operations on the mobile device, that are critical from the security point of view, such as connecting to the Internet, sending and receiving SMS messages, connecting to other devices through the Bluetooth interface, browsing the user's contact list, and so on. Hence, an adequate security support is required to protect the device from malicious applications. This paper proposes an enhanced security support for next generation Java Micro Edition platform. This support performs a runtime monitoring of the operations performed by the Java applications, and enforces a security policy that defines which operations applications are allowed to perform. Two possible design approaches for the security support are presented and compared. The increased availability of mobile broadband connections enables the expansion of software downloads to mobile phones. This leads to a greater number of available services and a better utilisation of the computational power of mobile phones. A light version of the Java platform for mobile devices, Java ME, is available on most of the mobile phones currently available on the market. Moreover, in the last years, a lot of Java applications for mobile devices, named MIDlets, have become available for download on the Internet, such as games, Internet browsers, chat tools. The downside of this increased software availability is an increase in the possible attack vectors; e.g. the misuse of resources.. As an example, a malicious MIDlet could establish a network connection to a remote server and transfer to this server all the contacts stored in the mobile device phone list. Thus, techniques need to be in place that prevent downloaded MIDlets from misusing resources on the mobile phone.. This paper presents a framework to prevent such misuse of resources using a runtime monitor that performs execution-time checks to monitor if the application is behaving correctly or not. This runtime monitor enhances the flexibility of the Java security model for mobile phones, allowing to enforce security policies without having to rely only on signatures of the downloaded applications.. Hence, our framework allows the secure execution of MIDlets developed by third companies, signed by untrusted principals or even unsigned.. This paper extends the security solution for mobile devices described in our previous work, that is based on a security enhanced version of the Java ME platform [1] [2] , by proposing an alternative framework architecture, based on the bytecode in-lining technique. Moreover, this paper provides performance figures and a detailed comparison between the two approaches.. The paper is structured as follows. Section 2 describes the Java ME platform and discusses some previous attempts to enhance its security. Section 3 describes our approach to improve the security of the Java ME platform, and Section 3.1 describes the architectures of our framework exploiting the two distinct approaches. While Section 4 describes the in-lining technique, Section 5 describes the security policy language and the security policy evaluation. Section 6 presents the implementation of two prototypes, one for each approach, running on real mobile devices, and Section 7 makes a comparison between the two approaches. Section 8 describes the demonstration scenario in which our security support could be adopted. Finally, Section 9 draws the conclusion. This paper presented a solution to improve the security support of the Java ME platform that is not based on the trust on the MIDlet provider, but on the runtime monitoring of the MIDlet enforcing an advanced security policy. This new security support enhances the flexibility of the Java security model for mobile phones, because it allows the secure execution of third party MIDlets (i.e. untrusted MIDlets) without explicitly asking the user for the permission of every action these MIDlets tries to perform. Hence, the adoption of this support will allow the secure execution of MIDlets that have been downloaded from the Internet, developed by unknown providers. This Section discusses the advantages and the drawbacks of the two approaches described in Section 3.1 to implement the runtime monitoring of MIDlets.. Following the first approach, the one that embeds the PEP in the MIDlet bytecode through the in-lining process, the deployment of the runtime monitoring framework on a mobile phone is a quite simple task, because it requires to install two software components on the device: the in-liner and the PDP. As described in Section 6, these components have been developed, respectively, as standard Java ME and Symbian C++ applications. Consequently, they can be installed on the device like any other application, and their deployment does not require any change to the original software platform of the mobile device.. Hence, the major advantage of this approach is that it can be adopted on standard devices and Java ME platforms, because no changes to the Java runtime environment nor to the operating system installed on the device are required. Consequently, this approach can be easily adopted on common mobile phones available on the market supporting Java ME. As a matter of fact, as shown in Section 6, we installed and tested our prototype on very common mobile phones, such as the Nokia N61 and the Nokia N78 ones.. On the other hand, to allow their monitoring, this approach requires that MIDlets are instrumented with the PEP code through the in-lining process, before being installed on the mobile device. A drawback is that the in-lining process could be computationally heavy, and could take some time to be executed on the mobile device. However, this process has to be executed only once in the MIDlet's life cycle, i.e. before the MIDlet installation.. Moreover, to avoid the execution of MIDlets that have not been in-lined, the in-liner could be integrated directly in the MIDlet installer, but this requires the modification of the original software platform provided by the mobile device.. Another issue of this solution concerns the MIDlet signature. As a matter of fact, the in-lining process modifies the MIDlet executable code, thus compromising the MIDlet signature.. The second approach presented in Section 3.1, instead, embeds the PEP directly in the Java ME platform, thus creating a security enhanced Java ME platform. The security enhanced Java ME platform should be deployed on the mobile device, replacing the original one. Hence, this could be a drawback of this approach, because currently it can be adopted only on some advanced mobile devices that allow to replace system components such as the Java ME platform. As a matter of fact, to develop our prototype, we chose the HTC Universal smartphone running the Linux Openmoko distribution [23] operating system and the phoneME Feature Software MR2 [22] Java ME platform, that are both open source platforms.. An advantage of this approach is that it allows the execution of standard MIDlets, avoiding the overhead of the in-lining process, because it does not require any modification to the MIDlet to allow the runtime monitoring. This also means that signed MIDlets can be monitored without compromising their signature.. A noticeable difference between these two techniques is the flexibility with respect to the accepted events alphabet. Actually, the PDP running on both implementations of our system does not depend on a fixed, predefined set of security-relevant actions. As the PDP starts, it loads the definition of the current policy. The policy also defines the accepted symbols, that is the set of symbolic names paired with actual method calls. Using a customised Java ME platform, the names referred by the rules of a policy are bound by the methods that the current PEP implementation can intercept. Indeed, if the PEP sends no signal to the PDP before and after the execution of a method, there is no way for the PDP to monitor it. The only solution consists in implementing a new, customized platform to replace the previous one. On the other hand, an in-lined MIDlet communicates with the PDP through bytecode instructions. As we mentioned in Section 4 the instrumentation process replaces direct calls to some APIs calls with proper PEPs, i.e. calls to a corresponding, wrapping class. The current version of our framework uses an internal library containing the necessary wrappers. Such library handles exactly the same methods as the other approach. Hence the two implementations can use policies defined on the same set of events. However, the in-liner does not depend directly on the particular library used. Indeed, without modifying the application, we can use external libraries enriched with further wrappers that, thereafter, can be used by the PDP. Moreover, being totally independent from the original classes, we could even imagine that wrappers are created during the in-lining process obtaining a completely general implementation. Finally, the in-lining method offers some interesting compositionality issues. Indeed an in-lined MIDlet can be processed more than once. Then, if we decide to monitor calls that were neglected during the first process, we can apply our transformation again with no interferences.. ¿From the performance point of view, the difference among the two approaches is due to the PEP component only. As a matter of fact, the PDP engine, that is the code that decides whether the security policy allows a given action performed by the MIDlet or not, is the same for the two approaches. The difference is in the mechanism used to intercept the security relevant actions and to interact with the PDP. The in-lining approach adopts a PEP that is written in Java ME and that is embedded directly in the MIDlet executable code. Hence, for each security relevant method, a set of Java instructions is added before and after the method invocations in the executable code. In the second approach, instead, the PEP is integrated in the Java ME platform code. Hence, the second approach has a lower impact on the MIDlet execution time than the first one, because the wrapping of the security relevant method invocations and and the interactions with the PDP are managed at a lower level, i.e. inside the Java ME platform. Java Micro Edition (Java ME) is a version of the Java platform for mobile and embedded devices, such as mobile phones, personal digital assistants (PDAs), TV set-top boxes, printers, and so on. The Java ME architecture mainly consists of two components [3] :. The Java ME platform provides a basic security support. The security support provided by CLDC concerns the low level and the application level security. The low level security guarantees that MIDlets do not harm the device while running. The application level security, instead, deals with security relevant operations performed by MIDlets, such as accesses to libraries or resources. To execute MIDlets, CLDC adopts a sandbox that ensures that: the MIDlet must be pre-verified; the MIDlet cannot bypass or alter standard class loading mechanisms of the KVM; only a predefined set of APIs is available to the MIDlet; the MIDlet can only load classes from the archive it comes from; and, finally, the classes of the system packages cannot be overridden or modified.. The security support provided by MIDP [6] defines four protection domains: Untrusted, Trusted, Minimum, and Maximum. Each MIDlet is bound to one protection domain depending on its provider, and this determines the value of its permissions. Permissions refer to the actions that the MIDlet can perform during its execution and their value can be either allowed or user. For example, the javax.microedition.io.Connector.http permission refers to HTTP connections. If the value of this permission is allowed, then the permission is granted, otherwise, if the value is user, a user interaction to explicitly grant the right is required every time that the MIDlet tries to establish an HTTP connection. When asked by the MIDP security support, the user can deny the right to execute the action, or can allow it by choosing among three possible values: oneshot, session, blanket. If the user chooses oneshot, the right to execute the current action is granted, but the user will be asked when the MIDlet will try to perform the same action again. If the user chooses session, the right to execute the current action is granted to the MIDlet until it terminates. Instead, if the user chooses blanket, the MIDlet will be allowed to perform the action until it is uninstalled or the permission is explicitly changed by the user. In other words, this disables any further control on this action.. A security study of Java ME has been presented by Kolsi and Virtanen in [7] , where they described the possible threats and the security needs in a mobile environment. In particular, they described how MIDP 2.0 solved some security issues of MIDP 1.1, but they concluded that some problems are still present. A security analysis of Java ME has been presented also by Debbabi et al. in [8] , [9] and [10] . In these papers, they detail the MIDP and CLDC security architecture, and they identify a set of vulnerabilities of this architecture. Moreover, they also test some attack scenarios on actual mobile phones. However, the previous papers do not propose any improvement to the Java ME security support to solve the security issues they described.. An attempt of extending the Java ME architecture with an enhanced security support is shown in [11] . This paper proposes a runtime monitor architecture that consists of a Runtime Monitor, a Policy Manager and a History Keeper. The Runtime Monitor is in charge of making resource access decisions, and relies on the Policy Manager to identify the relevant application-specific policy. Once the policy is identified, the Runtime Monitor evaluates its conditions in conjunction with resource usage history information of the system and MIDlet, as obtained from the History Keeper. This architecture enforces policies written in the Security Policy Language (SPL) [12] . SPL is a constraint based security policy language that allows to express simultaneously several types of authorization policies, hence allowing the definition of complex access control models (e.g. RBAC, DAC, TRBAC).. In [13] the authors present a framework for the run time monitoring of applications running on the .NET platform exploiting the in-lining technique. Their model is symmetrical to the one we have presented but for the technical differences deriving from the diverse environment. Recently, they also presented in [14] a complete system composed by an instrumentator for modifying the .NET Intermediate Language and a PDP for enforcing ConSpec policies. Actually, the proposed framework implements the PDP as a Dynamic Link Library that is invoked during the execution. Instead, our model exploits a separate process for monitoring the running applications. The necessity for this mechanism arises from the different execution environment. Indeed the Java MIDlets do not share the execution context and they can not access public, external libraries.. Proof carrying code (PCC) enables safe execution of code from untrusted sources by requiring a producer to furnish a proof regarding the safety of mobile code. Then the code consumer uses a proof validator to check, with certainty, that the proof is valid (i.e. it checks the correctness of this proof) and hence the foreign code is safe to execute. Proofs are automatically generated by a certifying compiler by means of a static analysis of the producer code. The PCC approach is problematic for two main reasons. A practical difficulty is that automatic proof generation for complex properties is still a daunting problem, making the PCC approach not suitable for real mobile applications. A more fundamental difficulty is that the approach is based on a very strong assumption: since the producer sends the safety proof together with the mobile code, the code producer should know all the security policies that are of interest to consumers. This appears an impractical assumption since security may vary considerably across different consumers and their operating environments. To evaluate the effectiveness of the architectures we described, and to make a comparison among them, we developed the related prototypes, both running on real mobile phones.

B I O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O O O O O O B O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Automatic image annotation and retrieval using cross-media relevance models Libraries have traditionally used manual image annotation for indexing and then later retrieving their image collections. However, manual image annotation is an expensive and labor intensive procedure and hence there has been great interest in coming up with automatic ways to retrieve images based on content. Here, we propose an automatic approach to annotating and retrieving images based on a training set of images. We assume that regions in an image can be described using a small vocabulary of blobs. Blobs are generated from image features using clustering. Given a training set of images with annotations, we show that probabilistic models allow us to predict the probability of generating a word given the blobs in an image. This may be used to automatically annotate and retrieve images given a word as a query. We show that relevance models. allow us to derive these probabilities in a natural way. Experiments show that the annotation performance of this cross-media relevance model is almost six times as good (in terms of mean precision) than a model based on word-blob co-occurrence model and twice as good as a state of the art model derived from machine translation. Our approach shows the usefulness of using formal information retrieval models for the task of image annotation and retrieval. Efficient access to multimedia information requires the ability to search and organize the information. While, the technology to search text has been available for some time -and in the form of web search engines is familiar to many people -the technology to search images and videos, is much more challenging. Several researchers (see [8] for a review) have investigated techniques to retrieve images based on their content but many of these approaches require the user to query based on image concepts like color or texture which most people are not familiar with. In general, people would like to pose semantic queries using textual descriptions and find images relevant to those semantic queries. For example, one should be able to pose a query like "find me all images of tigers in grass". This is difficult if not impossible with many of these image retrieval systems and hence has not led to widespread adoption of these systems. The traditional solution to this problem, used by libraries and other organizations is to annotate such images manually and then search those annotations. Although this allows semantic image retrieval manual annotations are expensive and do not always capture the content of images and videos well.. One approach to automatically annotating images is to look at the probability of associating words with image regions. Mori et al. [15] used a Co-occurrence Model in which they looked at the co-occurrence of words with image regions created using a regular grid. More recently, a few other researchers [2, 3] have also examined the problem using machine learning approaches. In particular Duygulu et al [9] proposed to describe images using a vocabulary of blobs. Each image is generated by using a certain number of these blobs. Their Translation Model -a substantial improvement on the Co-occurence Model -assumes that image annotation can be viewed as the task of translating from a vocabulary of blobs to a vocabulary of words. Given a set of annotated training images, they show how one can use one of the classical machine translation models suggested by Brown et al. [5] to annotate a test set of images.. Isolated pixels or even regions in an image are often hard to interpret. It is the context in which an image region is placed that gives it meaning. Query expansion is a standard technique for reducing ambiguity in information retrieval. One approach to doing this is to perform an initial query and then expand queries using terms from the top relevant documents (often approximated by the top documents). This expanded query when used for retrieval increases the perfor-mance substantially. In the image context, tigers are more often associated with grass, water, trees or sky and less often with objects like cars or computers and we want to take advantage of this context.. Relevance-based language models [13, 14] were introduced to allow query expansion to be performed in a more formal manner. These models have been successfully used for both ad-hoc retrieval and cross-language retrieval. Here, we investigate the problem of automatically annotating images as well as the ranked retrieval of images using a modification of the relevance model. As in Duygulu et al [9] we assume that every image may be described using a small vocabulary of blobs. Using a training set of annotated images, we learn the joint distribution of blobs and words which we call a cross-media relevance model (CMRM) for images. There are two ways this model can be used. In the first case, which corresponds to document based expansion, the blobs corresponding to each test image are used to generate words and associated probabilities from the joint distribution of blobs and words. Each test image can, therefore, be annotated with a vector of probabilities for all the words in the vocabulary. We call this the probabilistic annotation-based crossmedia relevance model (PACMRM). Given a query word, this model can be used to rank the images using a language modeling approach [12, 11, 4, 18] . While this model is useful for ranked retrieval, it is less useful for people to look at. Fixed length annotations can be generated by using the top N (N = 3, 4 or 5) words (without their probabilities) to annotate the images. This model is called the fixed annotation-based cross-media relevance model (FACMRM). FACMRM is not useful for ranked retrieval (since there are no probabilities associated with the annotations) but is easy for people to use when the number of annotations is small.. In the second case, which corresponds to query expansion, the query word(s) is used to generate a set of blob probabilities from the joint distribution of blobs and words. This vector of blob probabilities is compared with the vector of blobs for each test image using Kullback-Liebler (KL) divergence and the resulting KL distance is used to rank the images. We call this model the direct-retrieval cross-media relevance model (DRCMRM).. We should point out that cross-media relevance models are not translation models in the sense of translating words to blobs. Instead, these models take advantage of the joint distribution of words and blobs -that is the fact that an image can be described both using image features (blobs) and text (words). As Duygulu et al. [9] point out the problem of object recognition can be viewed as one of assigning "names" or words to images or image regions. In our model, we assign words to entire images and not to specific blobs because the blob vocabulary can give rise to many errors.. Our annotation-based model performs much better than either the Co-occurrence Model or the Translation Model on the same dataset (same training and test images and the same features). Specifically, for the top 49 annotations, we show that FACMRM gives a mean precision of 0.41 compared to 0.20 (obtained from published results [9] ) for the Translation Model. This is twice as good as the Translation Model. At the same time the FACMRM also has a much higher recall than the Translation Model. Both models perform substantially better than the Co-occurrence Model. PACMRM and DRCMRM cannot be directly compared to the other systems since the Translation Model and the Co- occurrence model have not been used for ranked retrieval. Figure 1 illustrates the power of the relevance model. The figure shows three images (from the test set) which were annotated with "sunset" by FACMRM. Although the three are clearly pictures of sunset (the last picture shows both a sun and a sunset), the word "sunset" was missing from the manual annotations. In these cases, the model allows us to catch errors in manual annotation. This paper is organized as follows. We discuss related work in section 2. This is followed by a brief discussion of how the blob features are constructed. Section 4 has a discussion of the cross-media language model and how it can be used for image annotation and retrieval. Section 5 shows experimental results for the different models and compares them to those for the Translation and Co-occurrence Model. The section also shows example results to illustrate the different aspects of the model. Finally, the last section concludes with a discussion of future work in this area. We have shown that Cross-Media Relevance Models are a good choice for annotating and retrieving images. Three different models were suggested and tested. The FACMRM model is more than twice as good (in terms of mean precision) as a state of the art Translation Model in annotating images. We also showed how to perform ranked retrieval using some of our models.. Obtaining large amounts of labeled training and test data is difficult but we believe this is needed for improvements in both performance and evaluation of the algorithms proposed here. Better feature extraction or the use of continuous features will probably improve the results. Other areas of possible research include the use of actual captions (instead of keywords) We believe that this is a fruitful area of research for applying formal models of information retrieval. While there has been some work on statistical models for object recognition and image retrieval [10] , there has been little work on automatically annotating images. We have already mentioned the Co-occurrence [15] and Translation Models [9] . The Co-occurrence model tends to require large numbers of training samples to estimate the correct probability and also tends to map frequent words to every blob. Duygulu et al [9] also try to use their Translation Model to label individual regions in the image. Picard and Minka [16] describe a tool for users to semi-automatically annotate image regions by selecting positive and negative examples manually and then using texture similarity to propagate annotations. Barnard and Forsyth [2] extended Hofmann's Hierarchical Aspect Model for text and proposed a multimodal hierarchical aspect model for hierarchical clustering of images and words. The results of this model are not available in a form which can be directly compared to our present model. Blei and Jordan [3] extended the Latent Dirichlet Allocation (LDA) Model and proposed a Correlation LDA model which relates words and images. This model assumes that a Dirichlet distribution can be used to generate a mixture of latent factors. This mixture of latent factors is then used to generate words and regions. EM is again used to estimate this model. Blei and Jordan show a few examples for labeling specific regions in an image. They also report recall-precision graphs for retrieval performance based on one word queries but the results are not directly comparable since the datasets are different.

O B I O B O O B I B O O O O B I O B O O O O O B O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O B O B O O O O O O O O O B O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O O O B B O O O B B O O O O O O O O O B O O O B O O O O B O O O O O O O O O B B O O B I O O O O O O O O O B O O O B O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O B O O B I O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O B O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B B O O O O O O B O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O B O O O O O O O B B O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B B O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B B O O O B O O B O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B B O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O B B O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O B O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O B O O O O B O O O O O O B O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O B O B O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O B O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O B O O B O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O B B O O O O O O O O O O O O O O O O O


Multistage expansion planning of generation and interconnections with sustainable energy development criteria: A multiobjective model A novel multiobjective, multiarea and multistage model to long-term expansion planning of integrated generation and transmission corridors incorporating sustainable energy developing is presented in this paper. The proposed MESEDES model is a ''bottom-up" energy model which considers the electricity generation/transmission value-chain, i.e., power generation alternatives including renewables, nuclear and traditional thermal generation along with transmission corridors. The model decides the optimal location and timing of the electricity generation/transmission abroad the multistage planning horizon. The proposed model considers three objectives belonging to sustainable energy development criteria such as: (a) the minimization of investments and operation costs of power generation, transmission corridors, energy efficiency (demand side management (DSM) programs) considering CO2 capture technologies; (b) minimization of Life-Cycle Greenhouse Gas Emissions (GHG); and (c) maximization of the diversification of electricity generation mix. The proposed model consider aspects of the carbon abatement policy under the CDM -Clean Development Mechanism or European Union Greenhouse Gas Emission Trading Scheme. A case study is used to illustrate the proposed framework. The energy policy and planning are changing worldwide due to the increasing concern about the world environment. The sustainable energy development has gained much attention of all governments on finding a trade-off between the economic development and the environmental constraints. One example is the current discussion about the global warming which is the top concern of most politicians and decision makers [1] [2] [3] .. Several studies using different approaches and different perspectives [4, 5] share the conclusion that the current world energy model (particularly the one of developed countries) is unsustainable on economic, social and environmental terms. Considering the current economic growth and the equalization in energy access to the world population, a serious environmental impact is expected. There is a broad consensus on sustainability challenges of the current energy model and on the general strategies required to face them [1] [2] [3] [4] [5] [6] [7] . The major aspects that the electricity/energy supply model should focus are: (a) the universal access to electricity; (b) the energy efficiency and savings; (c) the GHG Emission (global climate warning) and air pollutions; (d) the security of supply which means the dependence on energy imports and diversity of supply.. The traditional generation/transmission expansion planning of electricity is defined as the problem of determining which, where, and when new generation/transmission installations should be constructed over a long range planning horizon. The main objective of this traditional approach is to minimize the total investment and operating costs in order to supply the electricity demand following a set of technical criteria. In many countries the expansion planning of the electricity generation and transmission is done in a centralized way. Particularly in Brazil, the generation and transmission plan is made by the government. As for the generation, it is indicative whereas for transmission it is determinative. However, in countries such as Spain, the power generation/transmission expansion is an outcome of the market, i.e., it is driven by the economic signals generated in the market.. Additionally, Refs. [1] [2] [3] argue that, although markets are adequate instruments to achieve an efficient allocation of resources and to promote private initiative, the resolution of the sustainability cannot be left only to market forces. It requires other complementary instruments, such as carbon markets for a decentralized form, an indicative plan with incentives to follow its guidelines or a determinative plan.. Optimal expansion planning in energy systems with multiple energy carriers is currently dominated by those bottom-up large- participation factor of project j at subsystem i, in (%) rf i,j,s rebound effect of DSM program j at subsystem i, during the load-block s in (%) dms max i;j power save capacity of the DSM program j at subsystem i in MW uc t i;j unit CO2-eq capture operation cost of power generation plant j at subsystem i at stage t in $/MW h penc t i;j unit CO2-eq emission penalty cost to power generation plant j at subsystem i at stage t in US$/ton CO2-eq ef i,j direct CO2-eq emission factor of power generation plant j at subsystem i at stage t in ton CO2-eq/MW h efI t i;j cycle-life indirect CO2-eq emission factor of power generation plant j at subsystem i at stage t in ton CO2-eq/ MW h emall i;j allocated CO2-eq emission of power generation plant j at subsystem i in ton CO2-eq/year; state on/off (1/0) DSM project j, at subsystem i during each period t of planning horizon. It takes 1 from the project is selected until its time life 0, otherwise xc t i;j state on/off (1/0) of CO2-eq capture equipment of generation plants j, at subsystem i during each period t of planning horizon. It takes 1 from the project is selected until its time life 0, otherwise pe t i;j;s energy of power unit j at subsystem i, at stage t, during the load-block s in MW h fe electricity energy interchange from subsystem i to subsystem m at stage t, during the load-block s in MW h dms t i;j;s electricity energy saved of the DSM program j at subsystem i, at stage t and during the load-block s in MW h, respectively qc t i;j;s amount of CO2-eq captured in plant i at stage t and during the load-block s in ton CO2-eq vc t i;j;s excess CO2-eq emission of power generation j at subsystem i, at stage t during the load-block s in ton CO2-eq, respectively a t variable of level energy diversification measure, at period t in MW h 1980s towards the use of Multiple Criteria Decision Analysis (MCDM). Ref. [19] gives a literature review and survey about the use MCDM regarding energy planning. The energy planning under the aid of the multiobjective models allows decision makers to grasp the conflicting nature and the trade-offs among different objectives in order to select satisfactory compromise solutions for the energy planning problem [20] . Powerful and attractive multiobjective programming models have been proposed in order to effectively incorporate environmental considerations into electricity generation expansion planning [20] [21] [22] [23] [24] [25] [26] .. In this paper, a multiarea, multiobjective, and multistage model is proposed for integrating power generation/transport long-term expansion planning of the electricity systems. Such a methodology is named MESEDES and differ from the previous proposed methods in the following characteristics:. It includes three conflicting objectives to generate a set of expansion alternatives: (a) Investment and operational costs minimization, including costs in demand side management as well as cost of investments in carbon capture technology projects; (b) minimization of greenhouse emissions from power generation plants; and (c) maximization of the supply security based on the diversity of primary resources including energy imports. It considers aspects from the carbon market and GHG abatement policy under the Clean Development Mechanism (CDM) or European Union Greenhouse Gas Emission Trading Scheme. The electricity infrastructures (electricity energy mix, interconnections) are modelled on a multiarea manner for multistage expansion planning purposes resulting in a large-scale mixedinteger optimization model. Transmission infrastructures constraints and their energy losses are considered in order to measure the locational impact of the production additions, so that more realistic results to the electricity expansion planning are obtained.. The paper is organized as follows: Section 2 provides the formulation of sustainable objectives to be considered into the multiobjective expansion planning model presented in Section 3. Section 4 provides the numerical results corresponding to the application of these proposed models to a small but didactic test-system. Finally in Section 6 presents the conclusions. In this paper a novel multiobjective, multiarea and multistage model for the integrated generation mix and transmission corridors expansion/investment planning incorporating some sustainable energy development criteria is presented. The proposed MESEDES model is a ''bottom-up" energy model which consider the electricity value-chain. The model decides the optimal location and timing of the electricity generation/transmission abroad the multistage planning horizon. In the paper three objectives belonging to sustainable energy development criteria are modelled. They are summarized as: (a) the minimization of expansion and operation costs of power generation and transmission corridors, investments cost in energy efficiency based on DSM programs CO2 capture costs; (b) minimization of GHG emission (CO2-eq); and (c) maximization of the diversification of electricity generation mix. A case study using realistic data is used to illustrate the proposed framework.. The integration of sustainable aspects can change completely the traditional view of least-cost planning methods. For instance, the inclusion of the cycle-life GHG emission causes a strong impact in the energy planning process. The indirect GHG emissions of power plants like bigger hydro plant can make this kind of plant being displaced by nuclear plants.. In the sustainability context the carbon capture technologies are useful to help the GHG emission reduction in complementary form with removable technologies and energy efficiency programs. However, this is true only for short and medium terms.. The energy diversification is not always expensive. The energy diversification under any DSM programs and renewable energy, such as biomass and wind technologies, has a strong positive impact in the GHG emission reduction with low impact in the cost. 2352 more than 100 papers in national and international journals and conference proceedings. He has supervised 20 doctoral theses. He has worked and lectured extensively on power system dynamic analysis, monitoring and diagnosis of power system devices and systems, intelligent computer design of industrial systems, planning and operation of electric generation and networks, and regulatory, economic and environmental aspects of the energy sector. In this latter topic he has been a consultant for governments, international institutions, industrial associations, and utilities in more than 30 countries. His current research interests are centred on energy regulation, the design of regional electricity markets and energy sustainability.

O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Generalized Bonferroni mean operators in multi-criteria aggregation In this paper we provide a systematic investigation of a family of composed aggregation functions which generalize the Bonferroni mean. Such extensions of the Bonferroni mean are capable of modeling the concepts of hard and soft partial conjunction and disjunction, as well as that of k-tolerance and k-intolerance. There are several interesting special cases with quite an intuitive interpretation for application. The need to aggregate several inputs into a single representative output arises naturally in many practical applications. The research effort concerning aggregation functions, their behavior and properties, has been disseminated throughout various fields including decision making, knowledge based systems, artificial intelligence and image processing. Recent books providing a comprehensive overview include [1, 3, 9, 12] . Logical connectives in fuzzy logic are often modeled by triangular norms and conorms, whereas various means are applied in decision making problems. Weighted and parameterized generalizations of aggregation functions allow the flexibility to model many practical situations, whilst maintaining stable and easily interpreted properties. In other cases, aggregation systems can be employed to provide the desired properties and modeling capability.. In this paper, we investigate modeling capabilities of generalized Bonferroni means. Bonferroni's original function presented in [2] was shown to be expressible as an aggregation system in [13] , composed of arithmetic means and the product. This has an interesting interpretation involving the product of each argument with the average of the rest of the arguments. Yager [13] suggested replacing the simple average with other mean type operators, in particular, the Ordered Weighted Averaging (OWA) function and discrete Choquet integral. Generalizations of this aggregation system were also investigated in [11] (referred to as ABC-aggregation functions) and [14] where the generalized Bonferroni mean was shown to be suitable for modeling various concepts, such as hard and soft partial conjunction and disjunction [6] and boundedness similar to k-intolerance [10] .. The paper is structured as follows. In Section 2 we recall the main definitions which will be used in the rest of the paper. In Section 3 we give our definition of the composed aggregation function called the generalized Bonferroni mean, and we look at generalizing each of the operators that comprise the standard Bonferroni mean. We study its basic properties and their interpretations in Section 4. We study iterative extension of the Bonferroni mean in Section 5 and in Section 6 we study its bounds and its relation to the concepts of partial conjunction and k-intolerance. In Section 7 we show that if all components of the generalized Bonferroni mean are generated by the same generating function, it collapses to a weighted quasi-arithmetic mean. Section 8 concludes. We have presented a composed aggregation operator called the generalized Bonferroni mean. This operator models the average of the conjunctive expressions x i AND "the average of the remaining". We considered various mean-type operators to model both averages, and different conjunctive functions to model AND. We investigated the general properties of the Bonferroni means, and in particular proved that for every choice of the means and the conjunctor with invertible diagonal, the resulting function is an averaging aggregation function.. We can summarize the most interesting properties as follows. • The generalized Bonferroni mean can model any number of mandatory but not sufficient requirements (partial conjunction), and by duality, partial disjunction;. • It can model averages in which a fixed number of inputs must be nonzero (for nonzero output);. • It can model k-tolerance and k-intolerance concepts;. • If both means and the conjunctive functions are generated by the same generator, the Bonferroni mean collapses to a quasi-arithmetic mean.. We have presented several examples which show the power of expression of the generalized Bonferroni mean.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A roadmap towards sustainable self-aware service systems Self-awareness and self-adaptation have become primary concerns in large-scale systems as they have become too complex to be managed by human administrators alone, but rather require a new blend of coordination mechanisms between people and software services. This paper presents a roadmap to effective and efficient system adaptation through coupling self-awareness of globallevel goals with sustainability constraints. Sustainability of large-scale systems challenges self-adaptation approaches by its intrinsic characters of global and long-lasting effects. We introduce five levels of awareness: (i) event-awareness, (ii) situation-awareness, (iii) adaptability awareness, (iv) goalawareness, and (v) future-awareness. Within each level we introduce applicable principles and subsequently outline necessary models, algorithms, and protocols. The approach puts special focus on the interdependencies of human and service elements. Over the past decades we have observed a trend towards large-scale systems [47] . These systems are characterized by decentralized control, continuous change of elements, omnipresence of failures, and conflicting interests. Especially noteworthy is the increasingly blurry boundary between humans and software. Self-adaptation has become a primary concern in those systems as they have become too complex to be managed by human administrators alone [29] . Failures happen too often for humans to follow and react to. Relations between entities have become too impenetrable to extract the relevant dependencies. User requirements shift between different contexts depending on the underlying social structure. Elements belonging to different authorities defy any attempts to exercise any form of centralized, external adaptation on the system. We focus particularly on service systems where traditional software services reside alongside Human provided Services (HpS) [50] . The concept of Human-provided Services envisions humans to publish their skills and capabilities as Web services. Not only interactions between humans are supported by using HpSs, but also interactions with software services, for example, human interactions in BPEL4People-like processes. Interactions range from ad-hoc to processcentric collaborations. HpS is an integral concept, as it provides the foundation for modeling, measuring, engineering, and controlling a versatile mix of software and Humanprovided Services. In the scope of this paper, service system always denotes an ensemble comprising Human-provided Services and software-provided services (SpS).. Awareness is a fundamental prerequisite to any self-adaptation endeavor. Extensive and comprehensive information about the configuration of the self and the context is imperative. The self comprises all parts of the system that are monitored, evaluated, and adapted. The context describes the system's embedding in its environment. The convergence of technical and social networks enables us to observe the properties that are fundamental to understanding the human interaction structure [36] and how this structure affects the requirements of the technical systems that are engineered to assist such human collaboration. System self-adaptation must consequently regard humans and their relations as integral parts of the overall system, rather than merely a form of context.. Information technology needs to become more sustainable. In service systems, sustainability does not only address energy consumption but any type of limited resource. Adapting the definition from the Brundtland report [9] : "sustainable service systems seek to meet the current goals and requirements of the whole system without compromising the ability to meet those of the future". To this end, awareness has to include resource characteristics to enable sustainable self-adaptation.. In this paper, we outline a roadmap to sustainable selfaware service systems. We define a conceptual framework that specifies levels of awareness. These levels describe the scope of information available for self-adaptation. We further outline the interdependency of principles, models, algorithms, and mechanisms we see suitable and necessary to achieve each level of awareness. Ultimately, each level of awareness permits ever more sophisticated and ever more sustainable self-adaptation.. The following subsection (Sec. 1.1) provides a motivating scenario. We outline the major challenges of awareness and self-adaptation in the subsection thereafter. Section. 2) introduces the building blocks of our roadmap. Section 3 discusses the state of the art in self-adaptive systems and explains how our roadmap extends and improves existing research efforts. Finally, Section 4 concludes this position paper. We presented a roadmap that outlines the various contributions required to achieve sustainable, self-aware service systems. We put explicit focus on awareness in service systems that comprise human-provided services and software-provided systems. Capturing the various mixtures of humans and services is a fundamental aspect to selfadaptation. Without this knowledge, self-adaptation can never react to nor anticipate the hidden dependencies in the underlying human interaction structure.. Sustainability is the second distinctive feature of our roadmap besides the concept of human-provided services. Modeling the dependencies between resources, goals, and actions increases self-adaptation effectiveness and efficiency as the expected result can be predicted more precisely.. We acknowledge the importance of concerns such as security and privacy but deliberately did not address them in this paper for sake of clarity.

O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


General results on the decomposition of transitive fuzzy relations We study the transitivity of fuzzy preference relations, often considered as a fundamental property providing coherence to a decision process. We consider the transitivity of fuzzy relations w.r.t. conjunctors, a general class of binary operations on the unit interval encompassing the class of triangular norms usually considered for this purpose. Having fixed the transitivity of a large preference relation w.r.t. such a conjunctor, we investigate the transitivity of the strict preference and indifference relations of any fuzzy preference structure generated from this large preference relation by means of an (indifference) generator. This study leads to the discovery of two families of conjunctors providing a full characterization of this transitivity. Although the expressions of these conjunctors appear to be quite cumbersome, they reduce to more readily used analytical expressions when we focus our attention on the particular case when the transitivity of the large preference relation is expressed w.r.t. one of the three basic triangular norms (the minimum, the product and the Lukasiewicz triangular norm) while at the same time the generator used for decomposing this large preference relation is also one of these triangular norms. During our discourse, we pay ample attention to the Frank family of triangular norms/copulas.keywords Fuzzy preference relation Transitivity Conjunctor Indifference generator Frank family of t-norms The pairwise comparison of possible alternatives is a first step in many approaches to decision making. If this first step lacks coherence, the whole decision process might become meaningless. A popular criterion for coherence is the transitivity of preferences, expressing that the strength of the link between two alternatives cannot be weaker than the strength of any chain involving another alternative. Along this paper, we will consider a decision agent with a certain decision policy, which will be used to compare a finite set of alternatives A. In classical preference modelling (see e.g. [4, 32] ), there exists a basic relation R on A, called large preference relation, such that for any two alternatives a and b, (a, b) ∈ R expresses that alternative a is considered to be at least as good as alternative b. This relation R is further decomposed into a strict preference relation P , an indifference relation I and an incomparability relation J. It is well known that the transitivity of R is completely characterized by the transitivity of P and I and two additional transitivity-like inequalities involving P and I. In case the relation R is complete, i.e. any two alternatives are comparable, the transitivity of R is fully characterized by the transitivity of P and I (see [4] ).. The relations R, P and I play a central role in decision making and are used frequently in the social sciences. However, as these relations are crisp, they are not always appropriate to model human decisions. This lack of flexibility has led to the introduction of fuzzy relations. They are often used as alternative to crisp relations as they allow the decision maker to express a degree of preference rather than its presence or absence only. Since then, fuzzy preference relations have been widely studied and applied (see e.g. [5, 20, 23, 31] ). A key notion in this context is the notion of a fuzzy preference structure (see e.g. [5, 10, 21, 22, 26, 38] ); see [9] for a historical account of its development.. Not surprisingly, in this fuzzy context transitivity is again one of the most important properties (see e.g. [5, 23, 27] ). Traditionally, transitivity of a fuzzy relation is defined w.r.t. a triangular norm. In this setting, the transitivity of the large preference relation R has been characterized in a similar way as in the crisp case, however, for strongly complete R only [14] . However, strong completeness is a rather restrictive condition, since even not every fuzzy preference structure with an empty incomparability relation fulfills it. Subsequent works have therefore treated more general large preference relations [6, 7] . These works concentrate on the propagation of a fixed type of transitivity from a large preference relation R to various associated strict preference (P ) and indifference (I) relations. We continue along this line of research, but treat the problem from a much more general viewpoint. First, we work with conjunctors, a class of operations broader than the class of triangular norms; hence, we consider also more general types of transitivity. Second, we consider all possible strict preference and indifference relations associated with a large preference relation, making explicit use of (indifference) generators to decompose a large preference relation. Third, we do not just study the possible preservation of the transitivity when decomposing R, but we identify the strongest types of transitivity we can assure for the P and I. In preceding work [19] , we have fenced in the types of transitivity of P and I depending upon the type of transitivity R satisfies and the generator used for constructing them. Here, we take another leap forward: we provide an explicit expression for the conjunctor characterizing the transitivity that any I (resp. P ) satisfies, provided it is generated by means of a given generator from a large preference relation R satisfying a given type of transitivity. We prove that no stronger type of transitivity is fulfilled by all such I (resp. P ). In such case, we will speak of a strongest result possible. This means that the conjunctor we will present is such that all I (resp. P ), satisfy the transitivity w.r.t. that conjunctor, and that for any operation greater than that conjunctor, we can provide at least one large preference relation R such that the associated I (resp. P ), does not satisfy the transitivity w.r.t. that greater operation. Obviously, this does not prevent the existence of some individual large preference relation (such as a crisp one) for which the associated I (resp. P ) satisfies a stronger type of transitivity.. This work is structured as follows. In Section 2 we recall the most relevant concepts concerning (fuzzy) preference structures. In Section 3 we discuss conjunctors and related operations, and some of their useful properties. In Section 4 we characterize the transitivity of the indifference relation I by means of a general conjunctor and simplify the general expression for the most important particular cases. In Section 5 we characterize the transitivity of the strict preference relation P by means of another general conjunctor, and give ample attention to the most important particular cases. Concluding remarks and further considerations are given in Section 6. We have dealt with the transitivity of indifference and strict preference relations generated by means of a generator i from a reflexive fuzzy relation R that is htransitive w.r.t. a conjunctor h. We have presented both theorems expounding Table 2 : Propagation of the transitivity of R to P for the three most important t-norms.. very general results as well as specific propositions treating the most important particular cases.. The general results are of use for any (1-Lipschitz) increasing generator i and any (commutative) conjunctor h. These results finally close the study of the transitivity of the symmetric and asymmetric components of a reflexive fuzzy relation. Both the decomposition by means of a generator i and the use of a conjunctor h for describing the transitivity are the most general considerations possible.. The specific results concern the most important particular cases, i.e. those for which both the generator i and the conjunctor h are among the most important t-norms. These particular cases have been a topic of study for many years. However, focus was too often on preservation of transitivity, rather than trying to identify the strongest type of transitivity possible. The specific results provide easy-to-use expressions, except for one case leading to an unwieldy expression.. Despite the non-comprehensive general formulae obtained in Theorems 4.1 and 5.1, we have already proven that these conjunctors have interesting properties in some particular cases [8] . In future work, we intend to study the properties of these conjunctors in more detail.

O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I B B B I B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Low-power sub-threshold design of secure physical unclonable functions The unique and unpredictable nature of silicon enables the use of physical unclonable functions (PUFs) for chip identification and authentication. Since the function of PUFs depends on minute uncontrollable process variations, a low supply voltage can benefit PUFs by providing high sensitivity to variations and low power consumption as well. Motivated by this, we explore the feasibility of sub-threshold arbiter PUFs in 45nm CMOS technology. By modeling process variations and interconnect imbalance effects at the post-layout design level, we optimize the PUF supply voltage for the minimum power-delay product and investigate the trade-offs on PUF uniqueness and reliability. Moreover, we demonstrate that such a design optimization does not compromise the security of PUFs regarding modeling attacks and side-channel analysis attacks. Our final 64-stage subthreshold PUF design only needs 418 gates and consumes 0.047pJ energy per cycle, which is very promising for low-power wireless sensing and security applications. A Physical Unclonable Function (PUF) is a function that maps a set of challenges to a set of responses based on complex physical variations [1] . The challenge-response pairs (CRPs) give the unique identity of each PUF instance, which is very important for chip identification and authentication in security applications. The silicon implementation of PUFs relies on the physical uncertainties during the semiconductor manufacturing process. Inter-chip and intra-chip process variations are desirable for PUFs, since they can potentially make the CRPs more distinguishable. Many different PUF designs have appeared in literature. The first PUFs did not exploit VLSI process variations but the random speckle pattern of optical materials [2] . Then many silicon PUFs are studied for integrating with circuits and systems. Some PUF circuits designed for ASIC implementation use ring oscillators or arbitrated race conditions [3] . Other PUF circuits harness the power-up states of FPGA embedded block RAMs statistically gathered by an authentication protocol [4] . PUFs utilizing power-up SRAM states in embedded systems and memory chips have also been demonstrated [5] .. The most significant role of PUFs is to provide affordable security for low-power applications, such as radio frequency identification (RFID). RFID tags were originally proposed for electronic object identification purposes. Passive battery less RFID tags harvest energy through inductive coupling, which limits the power budget to 1-5µW for the tag circuits. Given the pervasiveness of RFID tags, security has become another important concern over the performance, especially in many security-critical financial, medical, and military applications [6, 7] . For example, replay and man-in-the-middle attacks can eavesdrop the open wireless communication channel between reader and tag [7] . Side-channel analysis attacks can extract secret bits stored or processed on the chip [8] . Automated reverse engineering can shatter any hope of security through obscurity [9] .. Introducing cryptography into low-power devices can mitigate the security vulnerabilities, as long as the implementation budget of the cryptography does not break the low-power promise (e.g., RFID tags mandate that only 2000 gates can be used for security [10] ). Although the use of lightweight cryptographic algorithms [11] can fulfill the tight budget, the low implementation complexity of lightweight algorithms can be especially vulnerable to power side-channel analysis attacks [12] . Process variations can further degrade the resistance of cryptographic implementations against side-channel attacks [13] . Instead of using cryptography, PUFs can provide equivalent security with low design overhead. PUFs have been integrated in RFID tags as a solution to low-cost authentication [14] . With the help of low-overhead postprocessing algorithms [15] , PUF responses can also be used for secret key generation on low-power devices.. By admitting the advantages of PUFs, we are further motivated to explore the feasibility of designing sub-threshold PUFs. Operating a circuit at a supply voltage below the threshold voltage significantly minimizes energy and power [16] , which allows minimum energy operation for low-performance situations. This opens many opportunities for ultra-low design of PUFs. Moreover, sub-threshold circuits are more sensitive to process variations in deep sub-micron technologies than super-threshold designs [17] . High variation sensitivity is favored by PUFs to enhance the uniqueness and security through randomness.. The contribution of this work is three-fold: (1) We investigate the optimal supply voltage to minimize power-delay product of 45nm CMOS sub-threshold PUF. (2) We compare the uniqueness and reliability of sub-threshold PUF with those of super-threshold PUF, and discuss the design trade-offs. (3) Besides power considerations, we also evaluate the security of PUFs. A recent work has demonstrated a ring oscillator-based PUF design in subthreshold mode [18] , but without analyzing the PUF uniqueness, reliability and security in detail. We demonstrate that a subthreshold PUF has improved resistance against side-channel analysis attacks and equivalent resistance against modeling attacks.. The PUF being considered in this work consists of n stages and an arbiter (Fig. 1) . A rising edge is propagated down two delay paths, and the arbiter records which input is reached first. The challenges C 1 to C n select the paths that the edge will race down. At each stage, a challenge bit of 1 will pass the tracks straight through, and a challenge bit of 0 will cause a track switch. We demonstrate the feasibility of a 45nm sub-threshold arbiter PUF for low-power applications, in which the system performance is not a critical design consideration. Our PUF design achieves low power, high uniqueness and acceptable levels of reliability and security. Future work includes the fabrication and post-silicon measurements of the 45nm 64-stage subthreshold PUF presented in this paper.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O