A conservative scheme for the relativistic Vlasov-Maxwell system A new scheme for numerical integration of the 1D2V relativistic VlasovMaxwell system is proposed. Assuming that all particles in a cell of the phase space move with the same velocity as that of the particle located at the center of the cell at the beginning of each time step, we successfully integrate the system with no artificial loss of particles. Furthermore, splitting the equations into advection and interaction parts, the method conserves the sum of the kinetic energy of particles and the electromagnetic energy. Three test problems, the gyration of particles, the Weibel instability, and the wakefield acceleration, are solved by using our scheme. We confirm that our scheme can reproduce analytical results of the problems. Though we deal with the 1D2V relativistic Vlasov-Maxwell system, our method can be applied to the 2D3V and 3D3V cases. In a wide range of plasma processes operating in laboratories or astrophysical phenomena, interactions between relativistic particles and electromagnetic fields play vital roles. For instance, recent laser experiments revealed that a high intensity laser can accelerate particles to ultra-relativistic speed (see, e.g., Esarey et al. [1] ). Non-thermal components found in spectra of active astrophysical objects, e.g., supernova remnants, gamma-ray bursts, and jets from active galactic nuclei, are interpreted as synchrotron radiation emitted by charged, relativistic particles gyrating about magnetic field lines.. There are two approaches in order to model such plasmas. One is the fluid approach based on the relativistic magnetohydrodynamics(RMHD) and the other is the kinetic approach based on the Boltzmann equation coupled with the Maxwell equations. Because the fluid approach implicitly assumes that the distribution of particles in the momentum space is the Maxwell-Jüttner distribution, which is the relativistic extension of the classical MaxwellBoltzmann distribution, the kinetic approach is indispensable for dealing with the momentum distribution deviating from the thermal equilibrium. Especially, dilute plasmas in which collisions between particles composing the plasmas are absent, often called collisionless plasmas, are known to be modeled by the so-called Vlasov-Maxwell system [2] .. At present, the most reliable and reasonable method to simulate dynamical behaviors of collisionless plasmas is the particle-in-cell (PIC) simulation (see, e.g., Birdsall and Langdon [3] ), which calculates the orbits of charged particles by solving the equation of motion and the configuration of electromagnetic fields by solving the Maxwell equations. In this method, the momentum distribution of plasmas is approximated by an ensemble of the momentum of each particle placed in the physical space. Although the number of particles in virtual plasmas produced by a PIC simulation is much smaller than that in real plasmas, it is known that behaviors of plasmas are well reproduced by the method. Nevertheless, we cannot avoid significant numerical noises due to the shortage of particles when we focus on the high momentum tail of the distribution function of plasma particles.. On the other hand, the direct numerical integration of the Vlasov-Maxwell system (referred to as "Vlasov simulation"), which discretizes the momentum space as well as the physical space, does not suffer from such noises. Therefore, some methods to perform the Vlasov simulation have been developed [4, 5, 6, 7] . While Vlasov simulations require higher computational performance than PIC simulations do, recent developments of computational technology allow us to study plasma processes by using Vlasov simulations. For example, Mangeney et al. [7] presented a scheme to numerically integrate the 2D3V Vlasov-Maxwell system (the term "2D3V" means the two dimensional space associated with the three dimensional velocity space) and demonstrated that the scheme could simulate the Weibel instability with high accuracy. Valentini et al. [8] provided a scheme for the integration of the electrostatic 1D2V Vlasov-Poisson system in a uniform magnetic field. They adopted the polar coordinates in the velocity space, which allows them to perform simulations with a good energy conservation. The scheme presented by Valentini et al. [9] integrates the Vlasov-Maxwell system in the hybrid approximation, i.e., they solve the 2D3V electromagnetic Vlasov equation for ions and fluid equations for electrons, based on the current advance method introduced by Matthews [10] . Suzuki and Shigeyama [11] investigated nonlinear behavior of the Weibel instability in detail by using a scheme similar to that of Mangeney et al. [7] . Schmitz and Grauer [12] performed a series of simulations for the magnetic reconnection and confirmed that their results are consistent with those of some PIC simulations. However, the attempts stated above treated only non-relativistic plasmas. Investigations into the numerical integration of the relativistic Vlasov-Maxwell system are still rare. Although Besse et al. [13] presented a scheme for the 1D2V relativistic Vlasov-Maxwell system, they assumed that particles have no dispersion in the transverse momentum space. Furthermore, there exists another problem that the mass and energy conservations are not always guaranteed unlike PIC simulations.. In this paper, we propose a new conservative scheme for the numerical integration of the 1D2V relativistic Vlasov-Maxwell system that allows particles to have dispersions in the momentum space. The scheme is based on the semi-Lagrangian approach, which is extensively used to solve the VlasovMaxwell system [13, 14, 15] . In Sec. 2, we introduce the 1D2V relativistic Vlasov-Maxwell system and some characteristic scales, and then transform the equations for convenience of the subsequent sections. Sec. 3 describes the method for the numerical integration of the system. In Sec. 4, we calculate three test problems using the scheme proposed in Sec. 3, the gyration of particles, the Weibel instability, and the wakefield acceleration. We conclude this paper in Sec. 5. In this paper, we have proposed a new conservative scheme for numerical integration of the relativistic Vlasov-Maxwell system and performed three test problems, the gyration of particles, the Weibel instability, and the wakefield acceleration. Adopting semi-Lagrange method, we succeed in developing a scheme that conserves the number of particles and the sum of the energies of particles and electromagnetic fields. Since the previous scheme [13] solving the relativistic Vlasov-Maxwell system do not treat the dispersion of the lateral momentum of particles, our scheme is the first one that can treat the dispersion correctly. Results of the simulations clearly indicate that our method succeeds in reproducing detailed behaviors of the distribution functions in the phase space. Especially, the tail of the distributions where only a tiny fraction of particles reside seems to be solved with considerably high accuracy, while PIC simulations would suffer from large statistical error there.. As we noted above, Vlasov simulations generally require more computational resources than PIC simulations do. Furthermore, as previous works [7, 23] have investigated, Vlasov simulations suffer from so-called "filamentation problem". Ref. [23] studied wave-particle interactions of a plasma approaching to an equilibrium state using PIC simulation and showed that the equilibrium is realized through a phase mixing accompanied by formation of filamentary structures in the phase space. In Vlasov description, particles composing a plasma are treated as a continuous medium, which means that Vlasov equation can not take account of essential discreteness of plasma. As a result, artificial entropy may arise when a structure with the characteristic scale smaller than the mesh size is generated in the phase space. Ref. [23] argued that this artificial entropy prevents the plasma treated by the Vlasov simulation from following the correct path toward the statistical equilibrium. Therefore, we need careful studies of long-term evolutions of plasmas by using Vlasov simulations.. Nevertheless, Vlasov simulations provide us detailed dynamics of plasmas in the phase space. Though we deal with the 1D2V relativistic VlasovMaxwell system, our method can be applied to the 2D3V and 3D3V cases Although our scheme proposed in this paper suffer from numerical diffusion, there is a plenty room for improvement. For example, in order to integrate advection part of the Vlasov equation, we can use the orbit of the particle located at each vertex of a cell. In other words, taking account for the deformation of the cell at each time step improves the accuracy of the scheme. In theoretical investigations into complex behaviors of collisionless plasmas, Vlasov simulations must be a attractive tool to compensate defects of PIC simulations.

O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Candid Covariance-Free Incremental Principal Component Analysis Appearance-based image analysis techniques require fast computation of principal components of high dimensional image vectors. We introduce a fast incremental principal component analysis (IPCA) algorithm, called candid covariance-free IPCA (CCIPCA), to compute the principal components of a sequence of samples incrementally without estimating the covariance matrix (thus covariance-free). The new method is motivated by the concept of statistical efficiency (the estimate has the smallest variance given the observed data). To do this, it keeps the scale of observations and computes the mean of observations incrementally, which is an efficient estimate for some well known distributions (e.g. Gaussian), although the highest possible efficiency is not guaranteed in our case because of unknown sample distribution. The method is for real-time applications, and thus it does not allow iterations. It converges very fast for high dimensional image vectors. Some links between IPCA and the development of the cerebral cortex are also discussed.Index items: principal component analysis, incremental principal component analysis, stochastic gradient ascent (SGA), generalized hebbian algorithm (GHA), orthogonal complement. A class of image analysis techniques called appearance-based approach has now become very popular. A major reason that leads to its popularity is the use of statistics tools to automatically derive features instead of relying on human to define features. Although principal component analysis is a well known technique, Kirby & Sirovich [1] appears to be among the first who used the technique directly on the characterization of human faces -each image is considered simply as a high dimensional vector, each pixel corresponding to a component. Turk & Pentland [2] were among the first who used this representation for face recognition. The technique has been extended to 3-D object recognition [3] , sign recognition [4] and autonomous navigation [5] , among many other image analysis problems.. requires that the system performs while new sensory signals flow in. Further, when the dimension of the image is high, both the computation and storage complexity grow dramatically. For example, in the eigenface method, a moderate grey image of 64 rows and 88 columns results in a d-dimensional vector with d = 5632. The symmetric covariance matrix requires d(d+1)/2 elements, which amounts to 15,862,528 entries! A clever saving method can be used when the number of images is smaller than the number of pixels in the image [1] . However, an online developing system must observe an open number of images and the number is larger than the dimension of the observed vectors.. Thus, an incremental method is required to compute the principal components for observations arriving sequentially, where the estimate of principal components are updated by each arriving observation vector. No covariance matrix is allowed to be estimated as an intermediate result.. There is evidence that biological neural networks use an incremental method to perform various learning, e.g., Hebbian learning [8] .. Several IPCA techniques have been proposed to compute principal components without the covariance matrix [9] [10] [11] . However, they ran into convergence problems when facing high dimensional image vectors. We explain in this article why. We propose a new method, candid covariance-free IPCA (CCIPCA), based on the work of Oja [10] and Sanger [11] . It is motivated by a well-known statistical concept called efficient estimate. An amnesic average technique is also used to dynamically determine the retaining rate of the old and new data, instead of a fixed learning rate.

O O O B I I O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O B I I B I I I B I I I B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Integrating intrusion alert information to aid forensic explanation: An analytical intrusion detection framework for distributive IDS The objective of this research is to show an analytical intrusion detection framework (AIDF) comprised of (i) a probability model discovery approach, and (ii) a probabilistic inference mechanism for generating the most probable forensic explanation based on not only just the observed intrusion detection alerts, but also the unreported signature rules that are revealed in the probability model. The significance of the proposed probabilistic inference is its ability to integrate alert information available from IDS sensors distributed across subnets. We choose the open source Snort to illustrate its feasibility, and demonstrate the inference process applied to the intrusion detection alerts produced by Snort. Through a preliminary experimental study, we illustrate the applicability of AIDF for information integration and the realization of (i) a distributive IDS environment comprised of multiple sensors, and (ii) a mechanism for selecting and integrating the probabilistic inference results from multiple models for composing the most probable forensic explanation. Current intrusion detection technology provides rich information about an attack. However, the primary focus of intrusion detection is on one-bit information about whether the security has been compromised. Forensic analysis, on the other hand, attempts to understand and explain what has happened to the security environment, and how a security breach could happen [1] [2] [3] .. We present an analytical intrusion detection framework (AIDF) with an underlying structure comprised of a probability model discovery and inference mechanism. The purpose of AIDF is to bridge intrusion detection with forensic analysis based on inferring and integrating alert information from distributive IDS sensors; whereas the outcomes of an inference are referred to as forensic explanations. It is important to note that forensic explanations typically are not what one will be seeking as the final product of a forensic analysis. Rather, forensic explanations are useful stepping stones for an analyst to narrow the possible attack goals to model, and provide intermediate snapshots on events useful for modeling attacks in a forensic analysis.. The relationship between intrusion detection and forensic explanation could be perceived as the following: an attack signature rule of a misuse based IDS such as Snort can be conceived as a manifestation of an illegal activity, and different combinations of n illegal activities can be represented by n-bit binary strings; whereas each binary string pattern of the n-bit constitutes a forensic explanation on the corresponding underlying illegal activities. In other words, there is a high level linguistic description of a forensic explanation, which has a semantic interpretation using predict calculus that corresponds to the truthfulness of the n-bit binary string pattern about the conjunctive occurrence of the signature rules. The utility of a forensic explanation is its potential for offering a basis on security policy modification, and on improving intrusion prevention capability; e.g., an "offline incremental" rule revision in the case of misuse based intrusion detection.. The significance of this research is a novel probabilistic based approach for uncovering hidden information during the course of intrusion detection useful for generating forensic explanations. Specifically, we will illustrate how the novel approach is applied to generating the most probable forensic explanation from the intrusion alerts produced by distributive Snort IDS sensors [4, 5] .. In section 2 a brief survey on forensics, and the relationship between forensic explanation and analysis are discussed. In section 3 different types of intrusion detection technology and alarm alerts are discussed. In sections 4 the details on signature rules for misuse based intrusion detection and network monitoring are described. In section 5 an analytical intrusion detection framework (AIDF) is introduced. We will discuss an algebraic constraint formulation within the AIDF for deriving multiple models based on incomplete observations, and an inference process for discovering hidden inhibiting negative for a forensic analysis. In section 6 the theoretical foundation behind the probability model discovery for the AIDF is detailed. In section 7 the scenario of applying AIDF to the real world situation for integrating intrusion alert information from multiple sensors are discussed. The scalability issue of the proposed AIDF is presented in section 8. An illustration on distributive coverage to address the scalability issue is presented in section 9. In section 10 an experimental study and its evaluation are presented, followed by the conclusion and future work in section 11. It is rare for an intrusion detection system to be operated in full logging mode for the purpose of forensic data gathering because of the practical consideration and implementation of anti-DoS strategy in a real world deployment. Consequently, there is a gap between the information useful for forensic and that revealed by intrusion detection. This paper presents a novel approach for generating the most probable forensic explanation from intrusion alerts and brings forth two specific contributions. First, a probabilistic inference approach is proposed for uncovering hidden information due to, for example, inhibiting negative ─ thus bridging intrusion detection with forensic analysis. Second, the proposed approach is generalized for an analytical intrusion detection framework for realizing distributive intrusion detection with a granularity at the level of rule partition, and a voting mechanism for integrating intrusion alerts from different IDS sensors distributed cross the same subnet or different subnets.. To demonstrate the relevancy of this research to the state-of-the-art intrusion detection technology, we investigated the underlying implementation of rule inspection engine in Snort. Current implementation of the rule inspection engine for intrusion detection in Snort reports only a partial list of all matching rules due to the consideration of the anti-DoS strategy and the need of real time performance. We show how our proposed model discovery and probabilistic inference mechanism could be applied to uncovering the hidden matching rules for generating forensic explanations from intrusion alerts. A preliminary experimental study is conducted to better understand its practicability and scalability. The results of this proposed approach is compared favorably against naïve Bayes approach. In our future research, we plan to further investigate the open questions raised from the five factors discovered in our experimental study. These open questions bear an impact on further improving the effectiveness and usefulness of the proposed framework for (i) realizing distributive IDS, and (ii) integrating intrusion alerts from different IDS sensor sources for the purpose of forensic inference and generating forensic explanation. Examine Z' or row R1 to determine the entry/entries below a positive Z'-row that is/are negative. In this case, we have (R2 C7), (R2 C8), (R2 C9), (R2 C10), (R3 C5), (R3 C6), (R3 C9), (R3 R10), (R4 C4), (R4 C6), (R4 C8), (R4 C10), (R5 C9), (R5 C10), (R6 C3), (R7 C3) through (R7 C10).. Note that altogether there are 14 variables plus three slack variable (P 0 , … P 7 , Z 0 , … Z 5 , S 0 , S 1 , S 2 ) and six equations (rows 2 -7) not including the cost function (row 1). It is always possible to set the variables appearing at the Z'-row (row 1) to be zero while solving the equations in row 2 -row 7 for the remaining variables. For example, in the tableau shown above, P 0 , … P 7 , S 0 , S 1 , and S 2 appear at Z'-row (row 1). If P 0 = … = P 7 = S 0 = … = S 2 =0, equations on rows 2-7 can be used to solve for Z 0 , through, Z 5 . In such a case, the value for Z 0 , through Z 5 can readily be read off from the "constant" column (column 2). In other words, maximizing Z' on row1 can be reduced to merely focusing on increasing the "constant" at row1 as much as possible.. Therefore, the objective is to increase the "constant" at row1 as much as possible. Evidently the limiting increase is given by dividing the element in the right-hand column (referred to as the pivot element) into the element in the constant column (column 2) of the pivot element's row. A value that is small in magnitude is most restrictive. The increase in the objective function for this choice of pivot element is then that value multiplied by the Z'-row entry of that column. We repeat this procedure on all possible right-hand columns (columns 3 -13) to find the most appropriate pivot element. . The mechanism behind the method by Kuenzi, Tzschach and Zehnder is to always choose the pivot element that will lead to the smallest increase in the cost function among all the possible choices of the pivot elements. In this case, the pivot element is [R3 C5]. This is used to "swap in" Z 1 and to "swap out" P 2 , resulting in the following tableau form : C1 C2 C3 C4 C5 C6 C7 C8 C9 C10 C11 C12 C13 Constant P0 P1 Z1 P3 P4 P5 P6 P7 S0 S1 The pivot element swap process just described is repeated until there is no more positive in the Z' row (or row1) for columns C3 -C13, which signals no further increase for Z' in row1 is possible. The answer for the optimal solution can then be read from the constant column (column 2) of the final tableau. The model utility evaluation result shows that the utility of the models constructed for this experiment ranges from 19% to 49%. Recall that a model covers only a very small subset of all the available signature rules of an IDS sensor. The choice of signature rule set partition for an IDS sensor, and the selection of small subset of rules for modeling, have a direct impact on the model utility percentage. Unless historical network traffic bears a predictable relationship with the future network traffic for estimating the distribution of the triggered rule set, it remains as an open question as to the choice of signature rule set partition for an IDS sensor and the selection of small subset of rules for optimizing the model utility percentage.. In reference to the inference accuracy, the results are shown in table 10 . The performance of the naïve Bayes is shown in the bracket labeled as "NB." It is noted that the proposed method significantly outperforms naïve Bayes in terms of true positive and false negative categories. The two methods perform relatively similar to each other in the other categories. While the proposed approach achieves an encouraging high accuracy on the true positive, it is also noted that the choice of the rule coverage by a model and the number of models chosen for each IDS sensor tends to be too conservative in lieu of a relatively high percentage of neglected negative ─ suggesting that the proposed approach tends to remain neutral and refrain from contributing towards the generation of a forensic explanation on rules that are not actually triggered. Although it is conceptually conceivable to improve the neglected negative and false silence rate by twinkling the model utility factor via different choices of scope coverage, the redistribution of the rules for the models, however, does not guarantee the outcomes to fall into the categories of true positive or true negative. Furthermore, it remains as a challenge in a real world deployment environment to know whether it is a true negative when a rule is not triggered, except the potential inhibiting negative in certain cases. In reference to the case level evaluation, the discovery rate is very encouraging when the results of AIDF are compared against that of naïve Bayes. As discussed previously, one should expect that naïve Bayes would not perform as well because of the nature of the problem. Note that extracting forensic explanation from intrusion alerts takes advantage on the possible association among the rules that do not just co-occur independently. Yet the underlying independence assumption of the naïve Bayes will naturally ignore the useful co-occurrence information. This is confirmed by the experimental result that shows a significantly lower true positive rate. Although theoretically naïve Bayes has an advantage in terms of computational simplicity and efficiency, such an advantage is marginal given the size of the problem and the consideration of the model discovery complexity that involves inequality constraint.. Imperfect discovery rate, however, seems high even though it's still better than that of the naïve Bayes. It is because the imperfect discovery rate accounts for about 40% of the successful discovery of the hidden rule. There are two aspects that could be further investigated for improving the imperfect discovery rate. Note that imperfect discovery originates from the cases that include partially incorrect statement on the occurrence of the irrelevant rules in addition to the correct claim on the masked element (rule). There are three open questions that could be further investigated for improving the imperfect discovery rate. First, the success on generating forensic explanation depends on the ability of reasoning the accurate mathematical constraints for model discovery. How do we automate the process for generating the optimal constraint set? Second, alternative voting strategy other than the "equal-weight" strategy may help to cancel the effect of incorrect voting bias. What domain knowledge could be used to devise voting strategy that improves the imperfect and unsuccessful discovery in the process of generating a forensic explanation? Third, if operational knowledge (based on, for example, security policy and firewall rule implementation) on the maximum number of triggering conditions is known a priori, one could carefully select a queue size matching the maximum number of rules that could be triggered simultaneously, thus offering additional insights into improving inference accuracy and imperfect discovery rate. In other words, could one derive the relationship between the choice of queue size and a given rule set when operational knowledge is available?. In regard to the potential contribution of AIDF to integrating information from multiple IDS, and particularly in the area of forensic inference based on intrusion alerts, the results are encouraging. 16 .67% of successful (perfect) discovery of hidden signature rules would not be possible without integrating intrusion alerts from multiple IDS sensors. Furthermore, in 87% of the test cases the scope coverage of the forensic explanations is improved upon by combining the information about the intrusion alerts produced by the multiple sensors.. In summary, although the experimental results demonstrate the success on the analytical intrusion detection framework and distributive intrusion detection, the following five factors bear interesting research open questions for further investigation:. Choice of signature rule set partition Number of models per IDS Scope of rule coverage for each model Voting strategy Queue size with respect to operational knowledge Despite the open research questions just raised, perhaps the most valuable real world forensic inference that we have learned from the one-month experimental study is a common attack on our site targeting at the exploit of the weakness of PHP and Perl applications that provide web interaction and database access without performing input validation ─ a vulnerability that could be exploited for remote arbitrary code execution. This explanation has an equivalent semantic interpretation of the conjunctive combination of (R2:1 R3:1), (R5:1), (R6:1), (R5:1 R6:1) and (R47:1 R48:1). In particular, this explanation is derived based on the discovery of three consistent events shown in table 4 of the online appendix [28] : (a) signature rules 2 and 3 co-occurred throughout the one-month period, (b) rule 5 and rule 6 occurred separately and jointly in half of the one-month period, as well as co-occurred together with rules 2 and 3, and (c) rules 47 and 48 co-occurred after the co-occurrence of rules 2 and 3.

O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Distributed error confinement Abstract. We study error confinement in distributed applications, which can be viewed as an extreme case of various fault locality notions studied in the past. Error confinement means that to the external observer, only nodes that were directly hit by a fault may deviate from their specified correct behavior, and only temporarily. The externally observable behavior of all other nodes must remain impeccable, even though their internal state may be affected. Error confinement is impossible if an adversary is allowed to inflict arbitrary transient faults on the system, since the faults might completely wipe out input values. We introduce a new fault-tolerance measure we call agility, which quantifies the fault tolerance of an algorithm that disseminates information against state corrupting faults.We then propose broadcast algorithms that guarantee error confinement with optimal agility to within a constant factor in synchronous networks. These algorithms can serve as building blocks in more general reactive systems. Previous results in exploring locality in reactive systems were not error confined, or allowed a wide range of behaviors to be considered correct. Our results also include a new technique that can be used to analyze the "cow path" problem. One of the key differences between centralized and distributed systems is that in distributed systems, faults may hit only a part of the system, whereas a centralized system is monolithic by definition. Consider transient faults: when the fault event is over, everything is functioning properly, but the state of the nodes hit by the fault may be wrong. The state of the system is not directly important, though: what matters is the external behavior of the system, which, of course, depends on the state. Faulty nodes may output wrong values, exposing the fault to the local users. However, while the damage at the nodes hit by the fault is unavoidable, the externally observable effect of a fault may reach much further: the system, which in most cases is designed to spread information, might actually amplify the effect of a fault by spreading harmful data across the system (see, e.g., the infamous crash of the Arpanet [McQuillan et al. 1980] ).. Fault-resilient protocols traditionally deal with faults by allowing arbitrary behavior until recovery is complete (intuitively, declaring a temporary "state of emergency"). In this article we devise systems that, in addition to recovering from arbitrary transient faults, keep the faulty information masked from as many external users as possible, even during the recovery period.. Let us be a little more specific (see Section 2 for formal definitions). We consider a synchronous distributed system that consists of a collection of interconnected nodes, that collectively executes some reactive task. Abstractly, there is an "environment" (representing the users) that inputs values at nodes and reads outputs from nodes. The system functionality is specified as a predicate over the sequences of input and output values, which says what are the legal inputs and what are the allowed outputs for each legal input. We consider transient faults, that is, faults that eventually leave the system. This is modeled by assuming that a fault may hit a set of nodes by arbitrarily modifying their state. Note that a fault is an abstraction of a "batch" of faults that may hit many nodes simultaneously.. The main property our protocols enjoy is error confinement. Intuitively, a system is said to have the error confinement property if in any execution, the observable input and output values at all nodes meet the specification, except possibly nodes that were directly hit by a fault. This is the best one can ask for: a local fault can trivially violate the specification at a faulty node, say by changing the value of a local output variable. Moreover, we note that this is often good enough. For example, if the task is routing in a large network and a few nodes are hit, then typically, most routes will not be affected. In addition, error confinement allows for layered design of resilient protocols: a high-level error-confined system can be built on top of a low-level error-confined system (in fact, we use this methodology in our article).. To be concrete, in this article we study the basic problem of broadcast, where a value is input at one of the nodes and the task is that eventually, all other nodes will output that value exactly. The problem of broadcast is interesting in our context for two reasons. First, the essence of broadcast is dissemination of information, in apparent contrast to the idea of error confinement, since the operation of the protocol might contaminate nonfaulty nodes with bad information. Second, broadcast is, in some sense, a complete problem for reactive tasks: by broadcasting all input values, all the nodes can know all inputs, and each node can compute the output locally for any reactive task.. One difficulty with the concept of error confinement is that it is impossible to attain in general, because if a value is input at a node, and an error hits that node before it sent out any message, then the input value may have no trace whatsoever in the system, making perfect recovery impossible. On the other hand, if the fault hits only a minority of the nodes after the input value is already safely mirrored in all the nodes, recovery is possible [Kutten and Peleg 1995] . In this article we consider the broadcast protocol that starts when an input value resides at one node (the source) and ends when the input value is mirrored everywhere. Thus, our protocol covers the critical interval that starts when recovery even from a singlenode fault is impossible, and ends when it is possible to recover from any fault that hits as many as n−1 2 nodes. A good protocol should increase the fault resilience as quickly as possible during the dissemination interval. We capture this intuition by introducing a new measure we call agility, which quantifies the resilience of reactive algorithms as a function of time. Intuitively, the algorithm must confine faults if they hit only a minority of the nodes in a ball around the origin of the input value. An algorithm is said to be more agile if that ball grows more quickly, that is, the agility of the algorithm measures how quickly do we lift the restriction on the faults. For example, an algorithm that cannot recover from a corrupted source has agility 0. On the other hand, an algorithm that can recover, for any time t, from a fault that corrupts only a minority of the nodes in distance at most t from the source is said to have agility 1 (assuming that messages travel one distance unit per time unit).. Note, that the agility is a measure of fault tolerance, not a measure of complexity. The "speed" in the preceding explanation is not the speed of the output, for example. Intuitively, it is the "speed" we allow the faults to become more severe while still managing to tolerate them. An algorithm that is fast according to known measures of complexity may not have high agility, and vice versa, an algorithm with high agility may not be fast in some known measures.. As we show, the agility cannot reach 1 in error confined protocols, that is, the process of establishing correct mirrors is inherently slower than the propagation speed of messages. If an algorithm can recover at any time t from a fault that corrupts only a minority of the nodes in the ball of, say, radius. around the source then its agility is 1 f (n) . It turns out that the optimal agility algorithm is not greedy. That is, a policy of increasing the number of mirrors (and thus increasing the number of faults the algorithm can withstand in the next step) is not optimal with regard to agility in the worst-case sense. In the optimal algorithm, nodes that have received the broadcast are not used immediately as mirrors: Instead, the algorithm waits until sufficiently many additional nodes receive the broadcast, and only then declares them as mirrors.. 1.1. OUR CONTRIBUTION. The conceptual contributions of this article are the formalization of the notions of error confinement and agility. (The concept of agility is applicable also for protocols which are not error confined.) The technical contribution of the article is a study of error-confined protocols for the basic primitive of broadcast, including an algorithm and a lower bound on the slowdown speed of any such algorithm. Specifically, we prove that error confinement necessarily entails a slowdown of factor 2 for broadcast, and we present an algorithm with slowdown 6 + 4 √ 2 ≈ 11.7. The algorithm uses a novel tool called ball core which is natural in our context. This technique may be of interest in itself. For algorithms using ball cores, we present matching lower and upper bounds on the agility of any broadcast algorithm. We remark that the analysis of ball cores may be of independent interest, as it includes a new technique that can be used to analyze the cow path problem [Papadimitriou and Yanakakis 1991] . In addition to the new technique, algorithm Boot, we present a building block (Algorithm B) that utilizes some known techniques for new purposes.. In addition to confining faults, our protocol is self-stabilizing, that is, regardless of the extent of the fault, the system will eventually reach a legal state. In other words, recovery of the input is guaranteed only if the faults are limited, but in all cases, the system will eventually stabilize to a consistent state: In a consistent state, all output variables mirror the value of the input variable at the source.. 1.2. RELATED WORK. Our approach in modeling faults is similar to the one in Lynch [1995] and Breitling [2000] . The model of state-corrupting faults is implicit in the work of Dijkstra about self stabilization [Dijkstra 1974 ]: put in our terminology, a system is called self-stabilizing if after an arbitrary state-corrupting fault occurs (possibly hitting all the nodes), eventually the system starts behaving correctly. Some general algorithmic solutions for making a system self-stabilizing appear in Katz and Perry [1993] , Afek et al. [1990 , Awerbuch et al. [1991] , Dolev and Herman [1995] , based on the paradigm of reset [Awerbuch et al. 1994] : when an error is detected, a global reset action is invoked, whose effect is to impose a correct state on the system. Many fault-resilient protocols allow incorrect behavior until recovery is complete. Some protocols manage to limit the kind of incorrect behavior permitted [Afek et al. 1990; Dolev and Herman 1995] . That is, shortly after the faults, all the network nodes start obeying some passage predicate that is not the desired predicate (that defines the correctness), however, it has some desirable properties.. A large number of papers were devoted to the question of how to reduce the effect of faults in terms of time until all the nodes start behaving correctly. That is, they achieve short recovery time if the number of faults is small. By comparison, in error confinement, one can view the goal as reducing the effect of faults in space (i.e., portion of the network). That is, the set of eventually affected nodes should be related to the set of nodes directly hit by a fault. We note that if the effect of the faults is bounded in time it is very likely to be bounded in space too. Moreover, some of the techniques for bounding the effect in time did that by bounding the propagation of information in space ( [Kutten and Patt-Shamir 1999; Afek and Bremler 1998 ] and multiple follow-up papers). Still, there are some differences between error confinement and these other concepts listed shortly. First, error confinement is a requirement that no nonfaulty node ever outputs incorrectly. This can be viewed as the extreme case of bounding in space, such that the effect of the faults is bounded exactly to the set of faulty nodes. This was not required by the previous locality definitions mentioned shortly. We should also note that it is conceivable that a protocol will be error confined but the effect of the faults will not be bounded in time (or, at least, will not have a sublinear bound).. In Kutten and Peleg [1995] the question was how to recover the consistency of values distributed in the network, when some unknown k of them were corrupted, and how to do that fast as a fraction of k. They termed the fast recovery time fault locality and such a recovery they termed mending. In Kutten and Peleg [2000] it was demonstrated that the time for such a recovery could be sublinear in the unknown number of faults k. In Afek and Dolev [1997] a stronger model of selfdetectable faults (or, alternatively, of probabilistic faults) was used to obtain fast recovery as a function of the number of faults k. This was termed local stabilization. (The algorithm of Afek and Dolev [1997] self-stabilizes also without the selfdetectability assumption; in addition, it addresses a general reactive problem, not just the basic problems discussed here.) A similar idea is used in Yen [1996] , where a fault can be detected by a neighbor. Obviously, these fault models are much weaker than the one we use. We should note that if used for broadcasting, the agility of the algorithms of Yen [1996] and Afek and Dolev [1997] would be 1 in the worst case, which is an optimal agility. The agility of the algorithms in the current article is smaller by a constant factor. However, it is obtained here without assuming self-detection of faults.. In Kutten and Patt-Shamir [1999] , a protocol is called time-adaptive if it is self-stabilizing and optimally adaptive, without assuming the self-fault detection. In Kutten and Patt-Shamir [1999] , a time-adaptive protocol is presented for the broadcast problem: The algorithm of Kutten and Patt-Shamir [1999] recovered corrupted replicas of some file whenever such a recovery was possible. (This was generalized by Burman et al. [2005] to performing a majority consensus efficiently.) One of the tasks performed in the current article can be viewed as complementing the task of Kutten and Patt-Shamir [1999] , that is, the current article shows how to distribute safely the aforementioned replicas. More networkrelated adaptive and fault local tasks (such as routing and clustering) are performed by the algorithms of Zhang and Arora [2006] , Demirbas et al. [2006] , Arora and Zhang [2006] , and Demirbas et al. [2004] . All these papers used a technique to bound the propagation of the faults. Such a technique was also used in Afek and Bremler [1998] , Papadimitrou and Yanakakis [1991] and Kutten and Patt-Shamir [1999] .. In Ghosh et al. [1996a] , and in many follow-up papers [Ghosh and He 2000; Ghosh and Pemmaraju 1997; Ghosh et al. , 1996b Herman and Pemmaraju 2000; Lin and Huang] , the main attention was given to optimizing the recovery time when exactly one fault occurred (although a recovery is achieved in any case). This property was termed error containment.. We stress that all the aforesaid concepts allow for correct nodes to exhibit faulty behavior before stabilization.. A simple type of error confinement is achieved in Malkhi et al. [2002] , where it is assumed that there are t correct sources to begin with, and at most t − 1 nodes may be faulty; the faults considered in Malkhi et al. [2002] are Byzantine, rather than transient. On one hand, no stabilization can be guaranteed in this case for our problem (if the Byzantine nodes continue to change their broadcasts). However, it is easy to ensure error confinement by allowing each node to make an output only after it gets identical values from t distinct nodes. Hence confinement does not imply stablization (for the definitions in this article, we added the requirement for stabilization, too). It is easy to show examples that stabilization does not imply confinement either.. In Bui et al. [1999] , a system is called snap-stabilizing if its behavior stabilizes to its specification in 0 time. Many papers studied this direction, such as Cournier et al. [2003 Cournier et al. [ , 2006 and Petit and Villain [2007] . Clearly, snap stabilization is possible only for the limited class of tasks that allow a faulty node to be considered externally correct even at the time of the fault (broadcast, studied here, does not satisfy this requirement).. Error confinement is an important aspect in fault-tolerant software systems. See, for example, Lee and Anderson [1990] and Taylor [1998] and references therein for the software engineering perspective on fault confinement in other contexts.. There exist numerous studies that measure the fault tolerance of a system by the number of faults it can tolerate. For example, in the context of Byzantine behavior it was shown that the system can tolerate up to (and excluding) one-third of the nodes [Dolev 1982 ]. The new measure of agility may be the first that uses this number as a growing function of the time. The novel "ball core" technique presented in this article involves voting not only for the final result, but also for deciding on intermediate stages (here this vote is about whether to forward a message or not). Voting is very common in studies about agreement, and in studies about fault tolerance in general. In some studies, voting is performed in intermediate stages as well. See, for example, Lee and Anderson [1990] (though the purpose of the intermediate vote there is different than the purpose of the voting used by the ball core technique).. 1.3. ORGANIZATION OF THIS ARTICLE. The remainder of this article is organized as follows. In Section 2, we define the model and the concepts of error confinement and algorithm agility formally. In Section 3 we develop an error-confined algorithm for the broadcast problem in the synchronous model and analyze its agility. The analysis of ball cores (which is related to the cow path problem) is presented in Section 3.4. We conclude with some discussion in Section 4. Error confinement, often required in centralized systems, seems to be even more useful in distributed settings. This article represents only a first step in defining and exploring this notion in distributed systems. The number of problems left open is very large and their solutions may be interesting and challenging. For example, can the agility of our algorithm be improved? It is asymptotically optimal in the worst case of a graph that is a simple path, but a much better agility may be possible in other graphs. Is there a graph parameter that characterizes the agility well? For example, can one have a better agility if the graph connectivity is higher? Similarly, our algorithm uses ball cores. Is this choice optimal? Clearly, there exist topologies and source node locations for which there exist better core functions.. Another natural choice we took is that of monotonically growing cores. In some settings, certain nodes are better protected than others, and this property of nodes may change over time. Also, our algorithm starts with a core that consists of the source only. It may be the case (as in Malkhi et al. [2002] ) that the initial core contains multiple nodes.. Another direction is the relaxation of the model assumptions. For example, it is interesting to investigate the case where faults hit in multiple batches. Other questions lie in correlating error confinement to other notions. For example, the notion of time adaptivity [Kutten and Peleg 1995; Ghosh et al. 1996a; Kutten and Patt-Shamir 1999] restricts the allowed time span of the faulty behavior, as a function of the number of faulty nodes. Is there a trade-off between such a requirement and that of error confinement, that restricts the spatial span of faulty behavior as a function of the number of faults?. We have shown in Theorem 3.2 that error confinement implies a slowdown in the broadcast. This leaves open other questions of overhead implied by confinement. In particular, our algorithms use much more communication resources and memory than algorithms that are not error confined. Can this overhead be reduced?. Finally, there is the question regarding the applicability of the results to general reactive systems. One may be able to treat a general reactive system by reducing it to broadcast. In such a reduction, every node would broadcast its values, and every node would compute the output based on the inputs of all nodes. Even if such a reduction is shown as preserving error confinement and self-stabilization, such a reduction is not an efficient solution. It would be interesting to investigate the fault confinement of other problems, as well as the agility that can be achieved for other problems. We believe that our broadcast algorithm will prove a useful primitive for solving such problems.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


In-depth analysis of the Naming Game dynamics: the homogeneous mixing case Language emergence and evolution has recently gained growing attention through multiagent models and mathematical frameworks to study their behavior. Here we investigate further the Naming Game, a model able to account for the emergence of a shared vocabulary of form-meaning associations through social/cultural learning. Due to the simplicity of both the structure of the agents and their interaction rules, the dynamics of this model can be analyzed in great detail using numerical simulations and analytical arguments. This paper first reviews some existing results and then presents a new overall understanding. Language is based on a set of cultural conventions socially shared by a group. But how are these conventions established without a central coordinator and without teraction scheme, the dynamics of the model can be studied both with massive simulations and analytical approaches. By doing so we import a pre-existing model into the statistical mechanics context (as opposed to the reverse which is often the case).. In past work, sociocultural investigations largely focused on computational issues and the application for emergent communication in software agents or physical robots 20 , resulting in a lack of quantitative investigations. For instance, we shall discuss in detail later how the main features of the process leading the population to a final convergence state scale with the population size, whereas earlier work has concentrated on studying very small populations 21 . The price to pay for quantitative comprehension is a reduction in the number of aspects of the phenomena we can treat. Thus, the agent architectures we shall describe are indeed very basic and stylized, and are much too simple compared to the cognitive mechanisms humans employ, but on the other hand they allow us to study much more clearly what is crucial to obtain the desired global co-ordination based on only local interaction. The present paper shows that the crucial features are in fact simple and we consider this to be one of our major contributions. Despite simplifying the original Naming Game 14 , we retained however its most important properties so that the interaction scheme could still be ported to real world robots or be used to explain the behavior of biological agents.. The paper is organized as follows. In Sec. 2.1 we present the Naming Game model and discuss its basic phenomenology. Sec. 3 is devoted to the study of the role of population size. We investigate the scaling relations of some important quantities and provide analytical arguments to derive the relevant exponents. In Sec. 4 we look in more detail at the mechanisms that give rise to convergence, deepening the analysis presented in 12 . In particular, we identify and explain the presence of a hidden timescale that governs the transition to the final consensus state. In Sec. 5 we focus on the relation between single simulation runs and averaged quantities, while in Sec. 6 we investigate the properties of the consensus word. We then analyze, in Sec. 7, a controlled case that sheds light on the nature of the symmetry breaking process leading to lexical convergence. Finally, in Sec. 8, we discuss the most relevant features of the model and present some conclusions concerning particularly its connections with the fields of Opinion Dynamics on one hand and Artificial Intelligence on the other. The Naming Game is the simplest model able to account for the emergence of a shared set of conventions in a population of agents. The main characteristics are 12,22 :. • The negotiation dynamics between individuals: the interaction rules are asymmetric and feedback is an essential ingredient to reach consensus; • The memory of the agents: individuals can accumulate words, and only after many interactions they have to decide on the final word chosen; • The absence of bounds to the inventory size: the number of words is neither fixed nor limited.. teraction rules has helped to bring out the essential features needed to achieve a consensus state. Remarkably, we have shown that the weights typically associated with word-meaning pairs in all earlier Naming Game models are not crucial. The simplification does not impinge on the ability of the model to be used on embodied agents i.e., it does not introduce a global observer or other forms of global knowledge. Next, because of the simplicity of the presented model, we have been able to perform a comprehensive analysis of its behavior which has never been done with earlier models due to their complexity. We have investigated the basic features of the process leading the population to converge, and how the crucial quantities scale with system size. In this context, we have also revealed a hidden timescale that rules the transition between the initial state, in which there is no communication among agents, and the final one, in which there is global agreement. Then we have analyzed several other aspects of the whole process, such as its properties of convergence, the relation between single runs and averaged curves, and the different probabilities for single words to impose themselves. We have also studied the elementary case in which only two words are present in the system, which can be interpreted as the merging of two converged populations, that clarifies the role of stochastic fluctuations in the convergence process. Although many of these results have been seen in numerical simulations, we have here been able to perform for the first time a mathematical analysis. In future work, the techniques we have used will be applied to more complex forms of communication including grammatical language for which some Artificial Intelligence models already exist 48 .

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Salt-and-pepper noise removal by median-type noise detectors and detail-preserving regularization Abstract-This paper proposes a two-phase scheme for removing salt-and-pepper impulse noise. In the first phase, an adaptive median filter is used to identify pixels which are likely to be contaminated by noise (noise candidates). In the second phase, the image is restored using a specialized regularization method that applies only to those selected noise candidates. In terms of edge preservation and noise suppression, our restored images show a significant improvement compared to those restored by using just nonlinear filters or regularization methods only. Our scheme can remove salt-and-pepper-noise with a noise level as high as 90%.Index Terms-Adaptive median filter, edge-preserving regularization, impulse noise. In this paper, we propose a decision-based, detail-preserving restoration method. It is the ultimate filter for removing saltand-pepper noise. Experimental results show that our method performs much better than median-based filters or the edgepreserving regularization methods. Even at a very high noise level ( ), the texture, details, and edges are preserved accurately. One can further improve our results by using different noise detectors and regularization functionals that are tailored to different types of noises, such as the random-valued impulse noise or impulse-plus-Gaussian noise. These extensions together with fast solvers for (3) will be given in our forthcoming papers.

O O O O O O O O O O O O O O O O O O O B I O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O


Iterative disaggregation for a class of lumpable discrete-time stochastic automata networks Stochastic automata networks (SANs) have been developed and used in the last 15 years as a modeling formalism for large systems that can be decomposed into loosely connected components. In this work, we concentrate on the not so much emphasized discrete-time SANs. First, we remodel and extend an SAN that arises in wireless communications. Second, for an SAN with functional transitions, we derive conditions for a special case of ordinary lumpability in which aggregation is done automaton by automaton. Finally, for this class of lumpable discrete-time SANs we devise an efficient aggregation-iterative disaggregation algorithm and demonstrate its performance on the SAN model of interest. Recently, a modeling paradigm called stochastic automata networks (SANs) [3] [4] [5] [6] [7] 9, 12, [15] [16] [17] [18] [19] [20] [21] [22] 27, 28, [30] [31] [32] [35] [36] [37] has received attention. SANs provide a methodology for modeling Markovian systems with interacting components. The main idea is to decompose the system of interest into its components and to model each component separately. Once this is done, interactions and dependencies among components can be brought into the picture and the model finalized. With this decompositional approach, the potential state space of the system is equal to the product of the number of states of the individual components. The benefit of the SAN approach is twofold. First, each component can be modeled much easier compared to the global system due to state space reduction. Second, space required to store the description of components is minimal compared to the case in which transitions from each global state are stored explicitly. However, all this happens at the expense of increased analysis time [4, 5, 7, 9, 12, 15, 16, 20, [35] [36] [37] .. In an SAN (see [35, Chapter 9] ), each component of the global system is modeled by a stochastic automaton. When automata do not interact (i.e., when they are independent of each other), description of each automaton consists of local transitions only. In other words, local transitions are those that affect the state of one automaton. Local transitions can be constant (i.e., independent of the state of other automata) or they can be functional. In the latter case, the transition is a function of the global state of the system. Interactions among components are captured by synchronizing transitions. Synchronization among automata happens when a state change in one automata causes a state change in other automata. Similar to local transitions, synchronizing transitions can be constant or functional.. A discrete-time system of N components can be modeled by a single stochastic automaton for each component [27, 30] . Local transitions of automaton k, denoted by A (k) , k ∈ {0, 1, . . . , N − 1}, are modeled by the local transition probability matrix L (k) which has equal row sums of 1. When there are S synchronizing events in the system, automaton k has the transition probability matrix R (k) s that represents the contribution of A (k) to synchronization s ∈ {0, 1, . . . , S −1} and the corresponding diagonal corrector matrix N (k) s whose each diagonal element is the sum of the elements in the corresponding row of R (k) s . When A (k) is not involved in synchronizing event s, we have R (k) s = L (k) . The underlying discrete-time Markov chain (DTMC) corresponding to the global system can be obtained from [27, 30] . We refer to the tensor (i.e., [10] ) representation in Eq. (1) associated with the DTMC as the descriptor of the SAN. Assuming that A (k) has n k states, the size of the potential state space of the global system is n = N−1 k=0 n k . When there are functional transitions, tensor products become generalized tensor products [32] . We denote by A (k) [A (l) ] a functional dependency between A (k) and A (l) if elements in the matrices of A (k) depend on the state of A (l) . Interactions among automata represented by events in an SAN are of the synchronous type. A synchronizing event can take place only in certain states of its involved automata. Recall that for each state of an automaton, the sum of the elements in the corresponding row of the local transition probability matrix is 1. Thus, the probabilities associated with synchronizing transitions are not reflected in the local transition probability matrices of automata. Hence, for the expression in Eq. (1) to form a stochastic matrix, normalization matrices are used. Some discrete-time systems that are modeled as a network of stochastic automata may experience changes in the states of its components due to independent events originating from outside the system rather than been triggered by its components. In this case, the evolution of the system due to local transitions can be treated as the complementary event of no other external events taking place. Therefore, normalization matrices are not needed. Hence, assuming that there are E independent events (i.e., (E − 1) external events) that affect the state of the system, the DTMC underlying the SAN can be obtained from. where the transition probability matrix P (k) e , k ∈ {0, 1, . . . , N − 1}, describes the evolution of A (k) when event e ∈ {0, 1, . . . , E − 1} takes place. Let γ e be the probability of event e such that E−1 e=0 γ e = 1. Observe that P is a stochastic matrix if (1/γ e )P e = N−1 k=0 P (k) e is a stochastic matrix that describes the evolution of the global system conditioned on event e taking place.. To the best of our knowledge, only a single SAN model whose descriptor is given by Eq. (1) has appeared in the literature [30] . It is an SAN model of the mutual exclusion algorithm of Lamport. There are (p + 2) automata and (p 2 + 3p) synchronizing events in the SAN, where p is the number of processes that access a shared resource. Note that due to the large number of synchronizing events, the SAN model is intractable even for moderate values of p. In [30] , the description of the SAN is given for the case p = 2. Note also that therein numerical experiments with this SAN model do not appear. Examples of SAN models whose underlying DTMCs are given by Eq. (2) can be found in [19, 29, 38] . The potential state spaces of the SANs considered in [19, 29, 38] are relatively small and the number of automata in each model does not exceed 3. Hence, analyses of the DTMCs underlying these SAN models are not difficult. In this work, we contribute to the existing research on discrete-time SANs by modeling an application whose underlying MC is relatively dense and its potential state space grows exponentially with the integer parameters of the problem. We consider the wireless communication system that employs multiservices resource allocation policy introduced in [38] . We provide a new SAN model that is scalable with respect to the number of events in the system. Furthermore, we extend the SAN model by introducing a service for variable bit rate (VBR) requests.. Iterative solution methods for SANs employ an efficient vector-descriptor multiplication algorithm [15, 27] . Implementation issues and complexity analysis of the algorithm for the case of generalized tensor products are considered in [15, 16] . Improved versions of the algorithm that consider multiplication of a subset of states in the vector with the descriptor are discussed in [8] . Various iterative solution methods for SANs that take advantage of the efficient vector-descriptor multiplication algorithm have been studied in the last 10 years. In particular, application of projection methods to SANs is discussed in [5, 35, 36] and experiments with circulant preconditioners for SANs appear in [9] . In [37] , a recursive implementation of iterative methods based on splittings that take advantage of the tensor structure of the SAN descriptor is introduced. An iterative aggregation-disaggregation (IAD) algorithm for SANs, in which aggregation at each iteration is done with respect to the states of an automaton chosen adaptively, appears in [4] . Nevertheless, we remark that so far numerical solution methods have been studied on continuous-time SAN models.. Lumping (i.e., exact aggregation) [24] is another approach that can aid in the analysis of systems with large state space. In the rest of the paper we use the concepts of lumping and exact aggregation interchangeably. Different kinds of lumpability in finite Markov chains (MCs) and their properties are considered in [1] . Results on exact aggregation of large systems whose MCs are composed of tensor products appear in [2, 23, 33] . Notion of exact performance equivalence for SANs is introduced in [6] and application of ordinary and exact lumpability to SANs is discussed in [3] . We remark that existing work considers the application of exact aggregation only to continuous-time MCs resulting from tensor-based formalisms, although the presented results are valid for DTMCs as well.. In this work, we consider the application of ordinary lumpability to discrete-time SANs. Let the state space S = {0, 1, . . . , n − 1} of a MC given by P be partitioned into K subsets S 0 , S 1 , . . . , S K−1 such that. , we say a MC is ordinarily lumpable with respect to the partitioning S 0 , S 1 , . . . S K−1 if for all states x, y ∈ S k and subsets S l , k, l = 0, 1, . . . , K − 1, (y, j) . In other words, P is ordinarily lumpable if each block in the partitioning of P has equal row sums. In contrast to the existing work on exact aggregation of SANs and related high-level formalisms, we consider an SAN in its general form with functional transitions. In other words, we assume that the descriptor corresponding to the SAN model at hand is a sum of generalized tensor products. We derive easy to check conditions on descriptions of automata and their ordering that enable us to identify a class of ordinarily lumpable partitionings in which lumping happens automaton by automaton. We remark that most of the existing work on exact aggregation of tensor-based formalisms amounts to defining equivalence relations among states in a component of the modeled system or among the components of the system. For instance, in [2] where exact aggregation is applied to hierarchical Markovian models, aggregation is done with respect to identical classes of customers inside low level models, with respect to identical low level models, and with respect to identical states of the high-level model. The goal of our work is to identify ordinarily lumpable partitionings of P induced by the block structure of tensor product. Obviously, this kind of ordinarily lumpable partitionings is a special case of the lumpability and performance equivalence considered in [2, 6] . On the other hand, simplicity of the conditions for ordinary lumpability that we impose on the SAN description allows us to show that some of the SAN models that have been considered before are lumpable.. Finally, we remark that existing research on ordinary lumpability in tensor-based formalisms consider the analysis of the aggregated system, whereas we aim at solving the original system and do not assume a specific Markov reward structure. For a class of ordinarily lumpable discrete-time SANs, we introduce an aggregation-iterative disaggregation (AID) algorithm that takes advantage of the tensor structure of the lumpable partitionings and discuss its implementation details. The introduced algorithm is a modified version of Koury-McAllister-Stewart's IAD algorithm [34] in which aggregation is performed once and disaggregation is a block Gauss-Seidel (BGS) step. To the best of our knowledge, implementation and results of experiments with this kind of IAD algorithm for MCs composed of tensor products is not known in the literature. The algorithm considered in [4] utilizes a different approach in which aggregation at each iteration is done with respect to the states of an automaton chosen adaptively. It should also be emphasized that in the experiments of Buchholz [4] the disaggregation phase of the algorithm is a power iteration, which is inferior to BGS.. In summary, we remark that the number of discrete-time SAN models that appear in the literature are just a handful, they are relatively simple, and we do not know of a study of iterative methods for analyzing them. In our paper, we consider a relatively complex and meaningful SAN model of a wireless TDMA system. Although the concept of ordinary lumpability for SANs has been discussed elsewhere, we stress that in our paper it is applied to SANs having functional dependencies and that our aim is to obtain the complete steady state vector of the underlying MC without imposing any restrictions on the associated Markov reward structure. Besides, we consider the implementation of an IAD algorithm for SANs that was not done before partially due to the fact that an aggregate matrix needs to be formed and solved at each iteration, but more importantly, because the implementation of BGS for SANs used in its disaggregation phase was not clear until recently. The technique devised in our paper handles these problems gracefully, albeit for a class of discrete-time SANs.. In Section 2 we introduce the wireless ATM model that is investigated. In doing so, we first present the basic model with two types of services, show that it can be modeled with a fixed number of events and then add a third service giving a more general model. In Section 3 we give the result regarding ordinary lumpability for a class of discrete-time SANs with functional transitions and introduce the efficient AID algorithm. In Section 4 we provide the results of numerical experiments and in Section 5 we conclude. In this paper, we give a discrete-time SAN model of a system in mobile communications. We remodel the SAN introduced in [38] so that the new model is scalable with respect to the number of events. Furthermore, we extend the model by service for VBR calls. We also address the difficulties associated with the analysis of the DTMC underlying the particular SAN, namely its relatively high density and its high NCDness. Using properties of generalized tensor products, we state sufficient conditions under which discrete-time SANs are ordinarily lumpable with respect to the partitioning induced by the tensor representation. For the particular class of ordinarily lumpable discrete-time SANs, we introduce an efficient AID algorithm that takes advantage of lumpable partitionings. Using the proposed algorithm, we analyze the model for various combinations of its parameters. When the blocks in a lumpable partitioning are relatively small with respect to the size of the DTMC, we suggest using the recursive implementation of BGS [37] in the disaggregation phase of AID. Future work may focus on forecasting better orderings of automata and faster converging partitionings based on NCD analyses of DTMCs underlying SAN models.

B I O O O O O B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O