Trajectory sampling for direct traffic observation Abstract-Traffic measurement is a critical component for the control and engineering of communication networks. We argue that traffic measurement should make it possible to obtain the spatial flow of traffic through the domain, i.e., the paths followed by packets between any ingress and egress point of the domain. Most resource allocation and capacity planning tasks can benefit from such information. Also, traffic measurements should be obtained without a routing model and without knowledge of network state. This allows the traffic measurement process to be resilient to network failures and state uncertainty.We propose a method that allows the direct inference of traffic flows through a domain by observing the trajectories of a subset of all packets traversing the network. The key advantages of the method are that (i) it does not rely on routing state, (ii) its implementation cost is small, and (iii) the measurement reporting traffic is modest and can be controlled precisely. The key idea of the method is to sample packets based on a hash function computed over the packet content. Using the same hash function will yield the same sample set of packets in the entire domain, and enables us to reconstruct packet trajectories. The efficiency of resource allocation and the quality of service provided by IP networks depends critically on effective traffic management. Traffic management consists of short-term traffic control and longer-term traffic engineering. Traffic control operates on a time-scale of seconds and without direct human intervention. Examples of traffic control functions include congestion control, automatic recovery in case of link or router failures, or admission control. Traffic engineering operates on time-scales from minutes to weeks or months, and typically with some degree of human intervention. Its goal is to optimally allocate network resources, such as link capacity, to different classes of network traffic in order to ensure good service quality and high network efficiency. Examples of traffic engineering functions include traffic characterization (e.g., trending), accounting (e.g., for pricing), and capacity planning and provisioning.. All of these functions represent feedback loops on a wide range of time-scales and of varying spatial extent, and traffic observation or measurement is therefore an integral component of these functions. The importance of traffic measurement capabilities is compounded by the fact that IP networks do not maintain per-flow state. By contrast, in circuit-switched networks, the traffic is essentially "observable for free", because per-call state exists along each node on the call's path. In a sense, the scalability of the stateless IP networks has been bought at the expense of observability.. Virtually all traffic engineering functions, such as route optimization or planning of failover strategies, rely on an understanding of the spatial flow of traffic through the domain. For example, suppose we observe that some link in the backbone is overloaded. Appropriate corrective action requires an understanding of which ingress points the traffic observed on this link originates and where it is headed, what customers are affected by the congestion, and what the traffic mix is; without this information, effective remedies (e.g., rerouting of part of that traffic) cannot be taken [11] , [12] . Also, it should be possible to infer what fraction of traffic entering the measurement domain at a certain ingress point traverses each link in the network, for example to focus on how the traffic of a specific customer flows through the domain, and to diagnose which link might be the reason for a performance problem experienced by that customer. Domain-wide spatial traffic information is also a prerequisite for the establishment of label-switched tunnels [3] , or to decide which potential ingress point is best to connect a new customer to the domain.. We distinguish between direct and indirect measurement methods. Conceptually, an indirect measurement method relies on a network model and network status information to infer the spatial flow of traffic through the domain. For example, suppose that the traffic is observed only at network ingress points (e.g., by computing statistics on the distribution of source-destination pairs). In order to infer how that traffic flows through the domain, timely and accurate information about the state of the routing protocol and link states has to be available. If assumptions about traffic routing have to be made in order to obtain the traffic flow matrix, then the use of an outdated routing table can lead to erroneous inferences, and suboptimal allocation of network resources.. More generally, indirect measurement methods suffer from the uncertainty associated with the physical and logical state of a large, heterogeneous network [11] . This uncertainty has several sources. First, the exact behavior of a network element, such as a router, is not exactly known to the service provider and depends on vendor-specific design choices. For example, the algorithm for traffic splitting among several shortest paths in OSPF is not standardized. Second, there are deliberate sources of randomness in the network to avoid accidental synchronization, e.g., through active queue management disciplines [13] or randomized timers in routing protocols [14] . Third, some of the behavior of the network depends on events outside of the control of the domain; for example, how traffic is routed within an autonomous system (AS) depends in part on the dynamics of route advertisement to this AS by neighboring domains [18] . Fourth, the interaction between adaptive schemes operating at different time-scales and levels of locality (e.g., QoS routing, end-to-end congestion control) may simply be too complex to characterize and predict [30] . Finally, with increasing size and complexity, the likelihood increases for faults and misconfigurations to disrupt the normal operation of the network. Often, traffic measurement is one of the potential tools to detect and diagnose such problems; however, this benefit is mitigated if traffic measurement requires correct network operation.. A direct method does not rely on a network model and an estimation of its state and its expected behavior. Rather, it relies on direct observation of traffic at multiple points in the network. As such, it does not suffer from the sources of uncertainty discussed above. In this paper, we describe a direct method for traffic measurement, called trajectory sampling. The method samples packets that traverse each link (or a subset of these links) within a measurement domain. The subset of sampled packets over a certain period of time can then be used as a representative of the overall traffic.. If packets were simply randomly sampled at each link, then we would be unable to derive the precise path that a sampled packet has followed through the domain from the ingress to the egress point. The key idea in our proposal is therefore to base the sampling decision on a deterministic hash function over the packet's content. If the same hash function is used throughout the domain to sample packets, then we are ensured that a packet is either sampled on every link it traverses, or on no link at all. In other words, we effectively are able to collect trajectory samples of a subset of packets. The choice of an appropriate hash function will obviously be crucial to ensure that this subset is not statistically biased in any way. For this, the sampling process, although a deterministic function of the packet content, has to resemble a random sampling process.. A second key ingredient of our proposal is that of packet labeling. Note that to obtain trajectory samples, we are not interested in the packet content per se; we simply need to know that some packet has traversed a set of links. But to know this, it is sufficient to obtain a unique packet identifier, or label, for each sampled packet within the domain and within a measurement period. Because the label is unique, we will know that a packet has traversed the set of links which have reported that particular label. We propose to use a second hash function to compute packet labels that are, with high probability, unique within a measurement period. While the size of the packet labels obviously depends on the specific situation, note that labels can in practice be quite small (e.g., 20 bit). As the measurement traffic that has to be collected from nodes in the domain only consists of such labels (plus some auxiliary information), the overhead to collect trajectory samples is small.. Trajectory sampling has several important advantages. It is a direct method for traffic measurement, and as such does not require any network status information. The spatial flow of traffic through the domain can be inferred from trajectory samples, i.e., paths taken by a pseudo-random subset of packets through the domain. Trajectory sampling does not require router state (e.g., per-flow cache entries) other than a small label buffer. The amount of measurement traffic necessary is modest and can be precisely controlled. Multicast packets require no special treat- A measurement system collects packet labels from all the links within the domain. Labels are only collected from a pseudo-random subset of all the packets traversing the domain. Both the decision whether to sample a packet or not, and the packet label, are a function of the packet's invariant content. ment -the trajectory associated with a multicast packet is simply a tree instead of a path. Finally, trajectory sampling can be implemented using state-of-the art digital signal processors (DSPs) even for the highest interface speeds available today. This paper is structured as follows. We define notation and formally define trajectory sampling in Section II. We discuss the choice of parameters for the hashing functions, and demonstrate their statistical properties in Section III. We give an example of traffic measurement based on an extensive packet trace in Section IV. In Section V, we discuss implementation issues and possible extensions of trajectory sampling. Section VI concludes the paper. Sampling has been proposed as a method to measure the endto-end performance of individual flows in connection-oriented networks [10] , [31] . ATM cells are sampled at the ingress and egress points of a virtual circuit in order to measure QoS metrics such as the end-to-end delay and the loss rate. To compute these metrics, cells at the ingress and egress points have to be matched. The authors propose to label cells using a hash function over the header and payload.. While this use of identification hashing is similar to ours, there are some fundamental differences between this method and trajectory sampling. The focus of end-to-end hash-based sampling is on determining the QoS of a single connection, rather than obtaining a statistically representative sample of the entire path matrix over a domain. Therefore, these methods do not require a pseudo-random sampling hash function to determine which packets to sample. The goal is simply to select a subset of cells for which the end-to-end performance is measured. In fact, in [10] , it is suggested to use simple bit pattern matching in the cell content to sample packets; this would not be an acceptable sampling hash function.. In contrast, trajectory sampling critically relies on a sampling hash function to select a statistically representative subset of packets over all the flows traversing the network. This is because there is a strong correlation between some fields in the packet (e.g., the destination address) and the path taken by the packet. The focus of trajectory sampling is to directly observe the entire traffic flowing through a domain, rather than a single flow at its endpoints, and to infer statistics on the spatial flow of this traffic.

O B O B B O O B O O O B O O B O O O B I O O O B B O O O O O O O B B O B O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O O B O O O O O O B B O O B O B O O O O B B B O O O O B O O O O O O B O O O B B O B O O O O O O O B O O O O O O O O B O O O O O B O O O O O O O O B O O O B B O O O O O B O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O O B O B O O O O B B O O B I B B O O O O O O O O B O O O O B B O O O B O O O O O O O O O O O B B I O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B B O O O O O O O O O B O O O B I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O B O O O O B O O O O O O B B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O B B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O B O O O O O B O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O B O O O O B B O O O B B O B O O O O O B B O B O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O B B O O O O O O O O O B B O O O O O O O B O O O O O O O O O O B O O O O B O O O O B O O O O O O O O O O O B O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B B O O O O O O O O O O O O O O O O O O B B O O B O O B B O O O O O B B O O O O O O O O O O O O O O B O O B O O O O O B O O O O O O O O O O B O O O O O O O O B B O B B O O B O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B B O B B O O O O O O O B O O O B B O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O B O O O O O O B O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O B O O O O O O O O O B B O O B


Boosted Bayesian network classifiers The use of Bayesian networks for classification problems has received a significant amount of recent attention. Although computationally efficient, the standard maximum likelihood learning method tends to be suboptimal due to the mismatch between its optimization criteria (data likelihood) and the actual goal of classification (label prediction accuracy). Recent approaches to optimizing classification performance during parameter or structure learning show promise, but lack the favorable computational properties of maximum likelihood learning. In this paper we present boosted Bayesian network classifiers, a framework to combine discriminative data-weighting with generative training of intermediate models.We show that boosted Bayesian network classifiers encompass the basic generative models in isolation, but improve their classification performance when the model structure is suboptimal. We also demonstrate that structure learning is beneficial in the construction of boosted Bayesian network classifiers. On a large suite of benchmark data-sets, this approach outperforms generative graphical models such as naive Bayes and TAN in classification accuracy. Boosted Bayesian network classifiers have comparable or better performance in comparison to other discriminatively trained graphical models including ELR and BNC. Furthermore, boosted Bayesian networks require significantly less training time than the ELR and BNC algorithms. A Bayesian network is an annotated directed graph that encodes the probabilistic relationships among variables of interest (Pearl 1988) . The explicit representation of probabilistic relations can exploit the structure of the problem domain, making it easier to incorporate domain knowledge in the model design. In addition, a Bayesian network has a modular and intuitive graphical representation which is very beneficial in decomposing a large and complex problem representation into several smaller, self-contained models for tractability and efficiency. Furthermore, the probabilistic representation combines naturally with the EM algorithm to address problems with missing data. These advantages of Bayesian networks and generative models as a whole make them an attractive modeling choice.. In many problem domains where a Bayesian network is applicable and desirable, we may want to infer the label(s) for a subset of the variables (class variables) given an instantiation of the rest (attributes). Bayesian network classifiers ) model the conditional distribution of the class variables given the attributes and predict the class with the highest conditional probability. Bayesian network classifiers have been applied successfully in many application areas including computational molecular biology (Segal et al. 2003; Pavlović et al. 2002; Jojic et al. 2004) , computer vision (Torralba et al. 2004; Rehg et al. 2003; Schneiderman 2004) , relational databases (Friedman et al. 1999 ), text processing (Cutting et al. 1992; McCallum et al. 2000; Lafferty et al. 2001) , audio processing (Rabiner and Juang 1993) and sensor fusion (Pavlović et al. 2000) . Its simplest form, the naive Bayes classifier, has received a significant amount of attention (Langley et al. 1992; Duda and Hart 1973; Ng and Jordan 2002) .. However, standard Maximum Likelihood (ML) parameter learning in Bayesian network classifiers tends to be suboptimal . It optimizes the joint likelihood, rather than the conditional likelihood, a score more closely related to the classification task. Unlike the joint likelihood, however, the conditional likelihood cannot be expressed in a log linear form, therefore no closed form solution is available to compute the optimal parameters. Recently there has been substantial interest in discriminative training of generative models coupled with advances in discriminative optimization methods for complex probabilistic graphical models (Greiner and Zhou 2002; McCallum et al. 2000; Lafferty et al. 2001; Chelba and Acero 2004; Altun et al. 2003; Taskar et al. 2004) .. If the selected model structure contains the structure from which the data is generated, the parameters that maximize the likelihood also maximize the conditional likelihood (see p. 159). For this reason, structure learning (Cooper and Herskovits 1992; Heckerman 1995; Friedman and Koller 2000; Chickering and Heckerman 1997; Heckerman et al. 1995; Lam and Bacchus 1992) can potentially be used to improve the classification accuracy. However, experiments show that learning an unrestricted Bayesian network fails to outperform naive Bayes in classification accuracy on a large sample of benchmark data Grossman and Domingos 2004) . Friedman et al. (1997) attribute this to the mismatch between the structure selection criteria (data likelihood) and the actual goal for classification (label prediction accuracy). They proposed Tree Augmented Naive Bayes (TAN), a structure learning algorithm that learns a maximum spanning tree from the attributes, but incorporates a naive Bayes model as part of its structure to bias the model towards the estimation of the conditional distribution. On the other hand, Keogh and Pazzani (1999) proposed Augmented Naive Bayes (ANC) algorithm that uses the 0-1 loss function as the optimization criteria in its heuristic search for the best k-tree Bayesian network classifiers. Recently proposed BNC-2P (Grossman and Domingos 2004) uses the conditional likelihood as optimization criteria in its structure search and is shown to outperform naive Bayes, TAN, and generatively trained unrestricted networks. Although the structures in TAN and BNC-2P are selected discriminatively, the parameters are trained via ML training for computational efficiency.. In this work, we propose a new approach to the discriminative training of Bayesian networks. Similar to a standard boosting approach, we recursively form an ensemble of classifiers. However in contrast to situations where the weak classifiers are trained discriminatively, the "weak classifiers" in our method are trained generatively to maximize the likelihood of weighted data. Our approach has two benefits. First, ML training of generative models is dramatically more efficient computationally than discriminative training. By combining maximum likelihood training with discriminative weighting of data, we obtain a computationally efficient method for the discriminative training of a general Bayesian network. Second, our classifiers are constructed from generative models. This is important in many practical problems where domain knowledge can be readily encoded in the structure of the generative model. This paper makes five contributions:. 1. We introduce Boosted Augmented Naive Bayes (bAN), an approach to improving the classification accuracy of generative models. We demonstrate that bAN's classification accuracy on a large suite of benchmark datasets is comparable or superior to competing methods such as naive Bayes, TAN and ELR. 2. We investigate alternative training strategies for constructing boosted Bayesian network classifiers and introduce a novel algorithm bAN mix as a more efficient alternative to bAN due to its heterogeneous assembly of structures. 3. We study the manner in which the complexity of the Bayesian network structure affects the classification accuracy of the final boosted ensemble by comparing bAN against bBNC-2P, bTAN, and other alternative boosted Bayesian network classifiers. Our experiments highlight the importance of structure learning. 4. We demonstrate that bAN and bAN mix are significantly faster to train than competing algorithms including ELR and BNC-2P. To ensure fairness, we implemented bNB, bAN, TAN, BNC-2P, bTAN, bBNC-2P and ELR algorithms such that they share a common code base in C++. We optimized the common code base for efficiency. In addition, we optimized the published BNC-2P method to improve its training speed. 5. We describe a multiclass extension of the bAN algorithm based on AdaBoost.MH and AdaBoost.M2. The results further demonstrate the advantages of structure selection.. A preliminary version of a portion of the results in this paper appeared in (Jing et al. 2005) . This paper differs from (Jing et al. 2005) in the following areas. We provide a detailed comparison against five alternative boosted Bayesian network learning algorithms to demonstrate that structure learning is crucial to the ensemble classification accuracy. We also investigate the effect of combining heterogeneous mixture of Bayesian network structures into one ensemble and propose bAN mix as a more efficient alternative to bAN. We provide additional experiments with simulated datasets (generated from more complex structures) to highlight the capability of bAN to explore the structure of the data distribution. We supplement the analysis of training cost in (Jing et al. 2005 ) with a thorough empirical evaluations and comparisons (Sect. 7, Fig. 9 to Fig. 11 ). We include both AdaBoost.MH and AdaBoost.M2 variations in our analysis of multi-class bAN algorithm. Finally, we provide a graphical interpretation of boosted Bayesian network classifier in Fig. 12 in the appendix. This paper is divided into 8 sections. Sections 1 through 3 review the formal notations of Bayesian networks and parameter learning methodologies. Section 4 introduces AdaBoost as an effective way to improve the classification accuracy of naive Bayes. Section 5 extends this work to structure learning and proposes the bAN and bAN mix structure learning algorithm. Sections 6 and 7 contain the experiments and analysis for boosted naive Bayes, bAN and bAN mix structure learning algorithm. The last three sections contain related works, conclusions and acknowledgments. This paper proposes a family of boosting models to improve Bayesian Network classifier framework to improve the classification accuracy of Bayesian network classifiers. Our experiments demonstrate that boosted parameter optimization in conjunction with greedy structure optimization can improve the classification performance. Unlike previous experiments results that combining ELR with structure learning (Greiner and Zhou 2002), we In cases where bAN augments naive Bayes with a significant number of edges ("letter", "satimage"), bAN mix can significantly reduce the number of classifier evaluations by incrementing adding more complex structures into the ensemble, without re-starting boosting given each new structure find significant benefit in combining parameter boosting with structure learning. However, full structure search at each stage of boosting can be both computationally expensive and counterproductive-better performance and less overfitting can be achieved when additional edges are gradually and parsimoniously added to the Bayesian network structure in the course of boosting.. We attribute the success of our approach to the following two reasons. First, bAN takes advantage of AdaBoost's resistance to over-fitting (Schapire and Singer 1999) and the variance reduction and bias reduction property of ensemble classifiers (Webb and Zheng 2004) . Also, as a result of the parameter boosting, the base Bayesian network classifier constructed by bAN is simpler than BNC-2P and TAN. In our experiments, bAN adds 2 edges to naive Bayes on average while BNC-2P typically adds more than 10 edges.. We believe that the primary advantage of our approach is its simplicity and computational efficiency that scales well in datasets with large class cardinality and feature space dimension, coupled with its good performance in practice. Its use of weighted maximum likelihood parameter learning uniquely determines the parameters of the Bayesian network (in contrast to minimizing a non-convex loss function in ELR), providing an efficient mechanism for discriminative training.. One of the main advantages of using generative models for classification is the ease of encoding domain knowledge into the classifier design. bAN relies on the construction of TAN to provide an initial set of structure candidates. However, a user can readily translate his or her domain knowledge into a collection of structure candidates, from which the bAN algorithm forms the boosted Bayesian network classifier. In particular, in classification situations where domain information is potentially incomplete or noisy, instead of designing (or learning) a single model, the users may encode the most obvious (and likely to be correct) dependence relationships, while leaving the rest to the discriminative training via AdaBoost.. Our future work will focus on further studying the effects of combining boosting with Bayesian network structure selection. On important issue, in particular, is to understand the relationship between complex Bayesian network structures and the approximate decision boundaries learned by bAN from the data generated by those distributions.. Acknowledgements The authors would like to thank Matt Mullin for several fruitful discussions and for suggesting the chain-structured model in Fig. 3 . We would like to thank S. Charles Brubaker for his help in constructing the factor graph in Fig. 12 . We would also like to thank Pedro Domingos for his helpful suggestions on improving the speed and performance of the BNC-2P algorithm.. This material is based upon work which was supported in part by the National Science Foundation under NSF Grant IIS-0205507 and IIS-0413105. We evaluated the performance of bNB and variations of bAN on 23 datasets from the UCI repository (Blake and Merz 1998) and two artificial data sets, Corral and Mofn, designed by Kohavi and John (1997) . Friedman et al. (1997) , Greiner and Zhou (2002) , Grossman 6. Repeat for k = 1, 2, . . .. • Given G k , θ k is learned through ML parameter learning on the weighted data D at iteration k.. • Compute the weighted error, . and Domingos (2004) and Pernkopf and Bilmes (2005) used this group of data sets as benchmarks for Bayesian network classifiers. We used hold-out test for larger data sets and 5 fold cross validation for smaller sets.. 6 To ensure fairness, we used Dirichlet prior Bayesian smoothing, with parameters identical to the ones from page 18 of Friedman et al. (1997) for all classifiers when appropriate. The data preparation, experimental set-up as well as Bayesian smoothing are the same as those used by Friedman et al. for the evaluation of TAN (Friedman 1997) . Since the Wilcoxon Signed-Ranks Test is demonstrated to provide the most unbiased evaluations for comparing methods across multiple datasets (Demsar 2006), we also used it to generate confidence scores. All algorithms are implemented in C++.

O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Hierarchical trust management for wireless sensor networks and its application to trust-based routing In this work, we propose a highly scalable cluster-based hierarchical trust management protocol for wireless sensor networks to effectively deal with selfish or malicious nodes. Unlike prior work, we consider multidimensional trust attributes derived from communication and social networks to evaluate the overall trust of a sensor node. Our peer-to-peer trust evaluation method leverages the cluster-based hierarchical structure for efficient communications. We develop a probability model using stochastic Petri net techniques to analyze the performance of the proposed trust management protocol. We validate the protocol design by comparing subjective trust generated as a result of protocol execution against objective trust obtained from actual node status. We apply our hierarchical trust management protocol to trust-based geographical routing as an application. Our results demonstrate that trust-based geographic routing under identified design settings can approach the ideal performance level achievable by flooding-based routing in message delivery ratio and message delay without incurring substantial message overhead. Furthermore, it can significantly outperform traditional geographic routing protocols that do not use trust concept in selecting forwarding nodes in message delivery ratio over a wide range of design parameter settings. A wireless sensor network (WSN) is usually composed of a large number of spatially distributed autonomous sensor nodes (SNs) to cooperatively monitor physical or environmental conditions, such as temperature, sound, vibration, pressure, motion or pollutants. A SN deployed in the WSN has the capability to read the sensed information and transmit or forward information to base stations or a sink node through multi-hop routing. While SNs have popularly used for various monitoring purposes such as wild animals, weather, or environments for battlefield surveillance, they also have severely restricted resources such as energy, memory, and computational power. Further, wireless environments give more design challenges due to inherently unreliable communications. A more serious issue is that nodes may be compromised and perform malicious attacks such as packet dropping or packet modifications to disrupt normal operations of a WSN wherein SNs usually perform unattended operations. A large number of SNs deployed in the WSN also require a scalable algorithm for highly reconfigurable communication operations. In this work, we consider a scalable hierarchical structure to deal with a large number of SNs with trust management mechanisms to identify selfish or malicious nodes for trust-based routing in WSNs.. We propose a hierarchical trust management protocol for clusterbased WSNs for efficient communications. Unlike prior work, we consider multidimensional trust attributes derived from communication and social networks to evaluate the overall trust of a sensor node (SN) for WSN applications wherein both social trust and QoS trust are important for mission execution. We apply our hierarchical trust management protocol to trust-based geographical routing as an application. Traditional geographic routing [5, 6] uses geographic location information to select the next forwarding node closest to the destination node, so that a message if delivered successfully may be delivered with the shortest delay. However, in the presence of selfish and malicious nodes, geographical routing may result in low message delivery ratio because the next forwarding node selected may be compromised or selfish, resulting in message losses. Unlike traditional geographical routing, trust-based geographical routing uses both trust and distance as criteria to select the most trustworthy neighbor nodes among those closest to the destination node for message forwarding so that a message may be delivered successfully with a high probability. The key design issues considered include trust formation (i.e., how a peer-to-peer trust value is formed), trust aggregation (i.e., how information is aggregated in parallel), and trust composition (i.e., what trust components are considered and their optimal weights) of the hierarchical trust management protocol and its application to trustbased geographical routing.. In the literature, trust has been used in WSNs for assessing the availability, reliability, or security property of a node (e.g., whether a node is malicious or not) based on past interaction experiences [1, 4, 7, 8, 10, 12] . Ganeriwal et al. [4] proposed a reputation-based framework for data integrity in WSNs. The proposed reputation system takes information collected by each node using a Watchdog mechanism (for direct monitoring and observations) to detect invalid data and uncooperative nodes. Yao et al. [12] proposed a parameterized and localized trust management scheme for WSN security, particularly for secure routing, where each node only maintains highly abstracted Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. parameters to evaluate its neighbors. Aivaloglou and Gritzalis [1] proposed a hybrid trust and reputation management protocol for WSNs by combining certificate-based and behavior-based trust evaluations. However, [1, 4, 12] cited above only considered a node's QoS property in trust evaluation based on a flat architecture. Shaikh et al. [10] proposed a group-based trust management scheme for clustered WSNs in which each SN performs peer evaluation based on direct observations or recommendations, and each cluster head (CH) evaluates other CHs as well as SNs under its own cluster. This work is similar with ours in that a hierarchical structure is employed for scalability. However, they only considered QoS metrics (i.e. the message delivery ratio in a time window) based on direct observations. Liu et al. [7] and Moraru et al. [8] also proposed trust management protocols and applied them to geographic routing in WSNs. However, no hierarchical trust management was considered for managing clustered WSNs. Also, their work evaluated trust based on QoS aspects of a SN only such as packet dropping and the degree of cooperativeness while our work considers both QoS and social trust for trust evaluation of a SN. In this paper, we proposed a hierarchical trust management protocol for cluster-based wireless sensor networks, considering two aspects of trustworthiness, namely, social trust and QoS trust.. We developed a probability model utilizing stochastic Petri nets techniques to quantitatively analyze the protocol performance, and validated subjective trust against objective trust obtained based on actual node status. We applied our hierarchical trust management protocol to trust-based geographic routing and demonstrated that our trust-based geographic routing performs close to the ideal performance of flooding-based routing in delivery ratio and message delay without sacrificing much in message overhead compared with traditional geographic routing protocols which does not use trust.

O B I O B I I O O O O B I O O O O O O O O O O B I O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O


Efficient character-level taint tracking for Java Over 80% of web services are vulnerable to attack [4] , and much of the danger arises from command injection vulnerabilities. We present an efficient character-level taint tracking system for Java web applications and argue that it can be used to defend against command injection vulnerabilities. Our approach involves modification only to Java library classes and the implementation of the Java servlets framework, so it requires only a one-time modification to the server without any subsequent modifications to a web application's bytecode or access to the web application's source code. This makes it easy to deploy our technique and easy to secure legacy web software. Our preliminary experiments with the JForum web application suggest that character-level taint tracking adds 0-15% runtime overhead. Web applications provide user services on a global scale without the need to distribute specialized client software. They allow for easy, centralized software maintenance via server-side updates, making it possible to provide useful, inexpensive services to anyone with access to the Internet. Unfortunately, many of these services contain security vulnerabilities, making the use of web services and websites Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. potentially dangerous to a user's security and privacy. It has been observed that over 80% of websites contain security vulnerabilities [4] .. Much of the danger arises from data-driven attacks. A malicious user can send a web application malformed input that, if improperly sanitized, can cause the program to behave in an unexpected and undesirable manner. The exploited application may then leak personal information or serve malware to users. Some common attacks in this class include SQL injection, cross-site scripting (XSS), path traversal, response splitting, and shell injection attacks.. One emerging approach to solving this problem is taint tracking. Taint tracking consists of three main steps. The first step is to identify untrusted input at the point that it enters the program and mark that it is untrusted (i.e., tainted). This is called "source identification" or "source tainting." The second step is to propagate taint information as subsequent computation occurs, marking as tainted all data that is derived from an untrusted source. For example, if part of the tainted data is used to create a new variable, that variable also becomes tainted and subsequently tracked as well. Finally, all data going into a sensitive data sink (e.g., a database, response output, or file) is checked, using the taint information to identify potential attacks.. We present an efficient character-level taint tracking system for Java programs. Our approach requires modification only to Java library classes and the Java servlets implementation. Unlike techniques that require bytecode translation on every web application, our approach is a zeromaintenance server-centric approach that does not require any changes to be made to any web application bytecode or source code. It is a one-time server-side modification, making it easy to adopt, deploy, and protect legacy web software. This technique also allows taint tracking to be performed on strings that use Java reflection, unlike bytecode translation techniques.. In this work, we focus on character-level taint tracking: i.e., we track the taint status of each character individually. Instead of considering each string variable as either tainted or untainted, character-level taint propagation tracks the taint status of each character of the string separately, allowing us to determine which portions of the string are tainted. This provides finer-grained information to the sanitization method, and thus contributes to a lower false positive rate. Despite the added analysis, we show that character-level tracking can be performed efficiently. We evaluate performance in the context of Java web services as they often need to interface with untrusted input. Our technique, however, can be generalized for any Java program. Our preliminary measurements indicate that character-level tracking adds no more than 15% runtime overhead, suggesting that our approach is efficient and easily deployable.. We are not the first to study character-level taint tracking for web security. There is a great deal of prior work on taint tracking [8, 9, 3, 12, 7, 1, 2, 5, 6] , and many authors have explained how character-level taint tracking can be used to build runtime defenses against command injection attacks [8, 9, 12, 10] . Most closely related is work by Halfond et al., who also study character-level taint tracking for Java web applications [6] . Their system works by rewriting the bytecode of the web application. We build upon many of their ideas, but we implement taint tracking by replacing the Java libraries instead of rewriting application bytecode. Because our approach avoids the need for bytecode rewriting, it may be easier to deploy and may be more compatible with legacy code: for instance, we avoid certain technical limitations regarding use of reflection. In addition, we place a special focus on the completeness of our taint propagation policy, and we carefully analyze a number of technical details that were not discussed in that work.. In Section 2, we give an overview of command injection attacks and how character-level taint tracking is effective in protecting against these attacks. In Section 3, we present our Java taint tracking system and our policy decisions. In Section 4, we share our implementation details, and in Section 5, we evaluate JForum's performance using our system. We discuss open problems in Section 6, discuss related work in Section 7, and conclude in Section 8. In efforts to harden legacy web applications against inputbased attacks, we introduce a taint tracking system that can be easily adopted and deployed through server-side changes. This approach is a one-time modification that is transparent to the web application. It neither requires any web application source code nor any change to the bytecode.. Our preliminary experiments indicate that character-level taint tracking can be performed efficiently without a significant impact on the application's runtime performance: in the context of the JForum application, we observed a runtime overhead of 0-15%. Although this paper focuses on the problem of securing web applications, our approach can also be applied to track taint information in any Java application. Command injection attacks account for a large fraction of vulnerabilities on the web. One study reports that SQL injection, cross-site scripting, and HTTP response splitting account for 52% of observed vulnerabilities in a large collection of web sites [11] ; another found that these vulnerability classes accounted for 80% of observed vulnerabilities [4] . Therefore, a successful defense against these attacks could make a significant difference to web applications.. One attraction of the approach to defending web applications sketched above is that it can be applied to legacy applications. The required checks are application-independent and could be incorporated into the underlying application server or libraries. Because this approach detects attacks at runtime as they occur and blocks them before they can cause any harm, no extra effort from developers is needed to deploy these defenses.. This approach crucially relies upon the ability to track taint status at character granularity. Many researchers have proposed taint-tracking mechanisms where there is conceptually a single taint bit per string: each string is either tainted or untainted. Although this may be sufficient for PHP, it is not for Java. In PHP, the programmer may use the echo command to avoid direct concatenation, potentially keeping tainted data separate from untainted data. In this case, if taint is checked per echo call, string granularity tainting may be sufficient. Java programs, however, generally use string concatenation heavily, so string-level tainting would lead to many false positives. As the examples above illustrate, many SQL queries, HTML documents, and other messages will commonly contain some tainted data. This is often benign and not an indication of an attack. Distinguishing these benign cases from actual attacks requires a way to keep track of which portions of each string are tainted. This motivates our study of character-level taint tracking.. With our technique, it is possible to lose taint information in a few subtle ways, which can lead to a failure to detect some attacks.. We do not track taint information associated with the Java char, char[], or other primitive types. If the web application developer takes a tainted string from the HTTP request and extracts its character information (through, e.g., getBytes(), getChars(), toCharArray(), codePointAt(), charAt(), etc.) and then performs text processing on these primitive chars, then taint information is lost. We hypothesize that this is a rare occurrence if the developer is not adversarial. One way to evaluate this hypothesis might be to log when a tainted character is extracted from a string using one of these methods, to measure how frequently this scenario occurs in practice. Our prototype currently logs these cases, but we have not yet performed any experiments to test this hypothesis.. There is one case where taint information can be lost due to an inability to taint a character buffer from the Servlet framework. In the implementation of the javax.servlet. http.HttpServletRequest interface, the getReader() method returns an object of type CoyoteReader which allows for access to the raw request body data in the form of either a String or character array. If returned as a String, taint can be tracked. However, if it is accessed as a character array, taint information is lost. We hypothesize that the latter case would usually occur only for opaque handling of binary data (e.g., file uploads) that is unlikely to participate in command injection attacks. We do not expect applications to use getReader() to obtain form parameters, as that data is more naturally and easily accessed via the getParameter() method.. Another way to lose taint information is if we fail to propagate taint or miss a taint source. Outside of methods in the StringBuffer and StringBuilder classes, a few String methods create objects from other classes. The String.format() method creates an object of type java.util.Formatter. This method constructs a string from arguments given in the printf() style. For this, the format() in the formatter class also needs to be augmented to track taint across any %s style strings. Likewise, a few methods call other methods in the java.util.regex.Pattern and java.util.regex.Matcher classes. We have yet to instrument these additional classes.. As mentioned earlier, it is also possible to lose taint information through serialization. Finally, like other approaches, we do not attempt to track implicit data flow. Our work is inspired by seminal work on fine-grained taint analysis in other languages, including PHP, C, and Java.. PHP. Nguyen-Tuong et al. show how to provide characterlevel taint tracking for PHP web applications by augmenting the PHP interpreter [8] . Their implementation achieves a performance overhead of less than 10%. Pietraszek and Berghe present a similar character-level taint tracker for PHP, and use it to prevent SQL injection [9] . The runtime overhead of their scheme is 2-17%, depending upon the application. Futoransky et al. present GRASP, an augmented PHP interpreter that also does character-level taint tracking and achieves a 30-100% overhead [3] .. C. Several researchers have studied byte-level taint tracking of C programs. Xu et al. use source-to-source transformations to track the taint status of every byte of memory [12] . By applying their transformation to the source code of the PHP interpreter, they also show how to protect PHP web applications from a number of vulnerabilities. They do not measure the performance overhead in this scenario, but overheads for other applications range from 3-100%. Lam and Chiueh present a general framework which can be used for byte-level taint tracking, among other things [7] ; they ob-serve performance overheads in the 1-30% range. Chang et al. further reduce performance overheads by applying static analysis to optimize the dynamic taint tracking operations [1] . They achieve performance overheads as low as 0-4% for taint tracking of several network servers written in C.. While the performance of these systems is impressive, their performance cannot be directly applied to our measurements because they evaluated different systems and different workloads. Also, few web applications are written directly in C, which limits the ability to apply C-based systems to web security directly. It is plausible that the static analysis methods developed by these authors could be applied to optimize character-level taint tracking in Java as well, though we have not investigated this direction.. Java. Although we have seen impressive techniques for taint tracking in other programming languages, it does not necessarily follow that they can or will translate well to other languages. As we have discussed previously in Section 2.6, PHP may be more suited to string-level taint tracking because of its ability to keep tainted data separate from untainted data by using the echo command on separate strings. Java however uses string concatenation heavily and therefore could be prone to false positives if taint is not tracked at the character granularity. With regard to C, the language lacks string types, possibly requiring a more heavyweight process to perform taint tracking.. A few researchers have examined taint tracking for Java. The early work only tracked taint at a string level and was not able to track taint information at a character granularity [2, 5] .. Since then, Halfond et al. have introduced methods for character-level taint tracking of Java applications based upon bytecode rewriting [6] . They apply their methods to preventing SQL injection in web applications, and observe a performance overhead of 1-19%. Our work shows that one can achieve acceptable performance simply by replacing library classes, without requiring bytecode rewriting of the application itself. Additionally, our work handles taint propagation for Java reflected strings while the bytecode rewriting technique is unable to do this. Our taint tracking system was implemented using the 32-bit IBM JDK 6.. 1 We experimented with other JDKs, including Sun's OpenJDK 6 and IBM JDK 5. However, both 1 One thing to note about the IBM JDK is that it structures its library class files differently from those of the Sun JDK. While Sun stores all of its class files in a JAR file called of these JDKs presented problems when trying to augment the string classes. We suspect that they require a predetermined size for the string class files, so changes to these classes broke the JVM.. To support web applications, we instrumented Tomcat Servlet Container 6, which follows the Servlet 2.5 specification.

O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B I O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O


Under-approximating loops in C programs for fast counterexample detection Many software model checkers only detect counterexamples with deep loops after exploring numerous spurious and increasingly longer counterexamples. We propose a technique that aims at eliminating this weakness by constructing auxiliary paths that represent the effect of a range of loop iterations. Unlike acceleration, which captures the exact effect of arbitrarily many loop iterations, these auxiliary paths may under-approximate the behaviour of the loops. In return, the approximation is sound with respect to the bit-vector semantics of programs. Our approach supports arbitrary conditions and assignments to arrays in the loop body, but may as a result introduce quantified conditionals. To reduce the resulting performance penalty, we present two quantifier elimination techniques specially geared towards our application. Loop under-approximation can be combined with a broad range of verification techniques. We paired our techniques with lazy abstraction and bounded model checking, and evaluated the resulting tool on a number of buffer overflow benchmarks, demonstrating its ability to efficiently detect deep counterexamples in C programs that manipulate arrays. The generation of diagnostic counterexamples is a key feature of model checking. Counterexamples serve as witness for the refutation of a property, and are an invaluable aid to the engineer for understanding and repairing the fault.. Counterexamples are particularly important in software model checking, as bugs in software frequently require thousands of transitions to be executed, and are thus difficult to reproduce without the help of an explicit error trace. Existing software model checkers, how-ever, fail to scale when analysing programs with bugs that involve many iterations of a loop. The primary reason for the inability of many existing tools to discover such "deep" bugs is that exploration is performed in a breadth-first fashion: the detection of an unsafe execution traversing a loop involves the repeated refutation of increasingly longer spurious counterexamples. The analyser first considers a potential error trace with one loop iteration, only to discover that this trace is infeasible. As consequence, the analyser will increase the search depth, usually by considering one further loop iteration. In practice, the computational effort required to discover an assertion violation thus grows exponentially with the depth of the bug.. Notably, the problem is not limited to procedures based on abstraction, such as predicate abstraction or abstraction with interpolants. Bounded model checking (BMC) is optimised for discovering bugs up to a given depth k, but the computational cost grows exponentially in k.. The contribution of this paper is a new technique that enables scalable detection of deep bugs. We transform the program by adding a new, auxiliary path to loops that summarises the effect of a parametric number of iterations of the loop. Similar to acceleration, which captures the exact effect of arbitrarily many iterations of an integer relation by computing its reflexive transitive closure in one step [4, 8, 11] , we construct a summary of the behaviour of the loop. By symbolically bounding the number of iterations, we obtain an under-approximation which is sound with respect to the bit-vector semantics of programs. Thus, we avoid false alarms that might be triggered by modeling variables as integers.. In contrast to related work, our technique supports assignments to arrays and arbitrary conditional branching by computing quantified conditionals. As the computational cost of analysing programs with quantifiers is high, we introduce two novel techniques for summarising certain conditionals without quantifiers. The key insight is that many conditionals in programs (e.g., loop exit conditions such as i ≤ 100 or even i = 100) exhibit a certain monotonicity property that allows us to drop quantifiers.. Our approximation can be combined soundly with a broad range of verification engines, including predicate abstraction, lazy abstraction with interpolation [19] , and bounded software model checking [5] . To demonstrate this versatility, we combined our technique with lazy abstraction and the Cbmc [5] model checker. We evaluated the resulting tool on a large suite of benchmarks known to contain deep paths, demonstrating our ability to efficiently detect deep counterexamples in C programs that manipulate arrays. We present a sound under-approximation technique for loops in C programs with bit-vector semantics. The approach is very effective for finding deep counterexamples in programs that manipulate arrays, and compatible with a variety of existing verification techniques. A short-coming of our under-approximation technique is its lack of support for dynamic data structures, which we see as a challenging future direction. The under-approximation technique presented in this paper is based on our previous work on loop detection [16, 17] . The algorithm in [16] , however, does not yield a strict under-approximation, and thus necessitates an additional step to validate the unwound counterexample. Our new technique avoids this problem.. The techniques in Sect. 3.1 constitute a simple form of acceleration [4, 8] . The subsequent restrictions in Sects. 3.3 and 3.4 on π , however, impose a symbolic bound on the number of iterations, yielding an under-approximation. In contrast to acceleration of integer relations, our approximation is sound for bit-vector arithmetic. Sinha uses term rewriting to compute symbolic states parametrised by the loop counter, stating that his technique can be extended to support bit-vectors [22] .. The quantifier elimination technique of Sect. 4.1 bears similarities with splitter predicates [21] , a program transformation facilitating the generation of disjunctive invariants. Similarly, trace partitioning [9] splits program paths to increase the precision of static analyses. Neither technique aims at eliminating quantifiers.. Loop summarisation [15] and path invariants [3] avoid loop unrolling by selecting an appropriate over-approximation of the loop from a catalogue of invariant templates. Overapproximations are also used in the context of loop bound inference [24] and reasoning about termination [6] . However, over-approximations do not enable the efficient detection of counterexamples.. Hojjat et al. [11] uses interpolation to derive inductive invariants from accelerated paths. While this work combines under-and over-approximation, it is not aimed at counterexample detection. Motivated by the results of [11] , we believe that under-approximation can, if combined with interpolation, improve the performance of verification tools on safe programs. We plan to support interpolation in a future version of our implementation.. Techniques to solve recurrences are frequently used in compiler construction [23] . For example, van Engelen et al. [7] present an algorithm to compute closed forms for systems of recurrence equations, which also supports induction variables that are updated conditionally by introducing a dynamic range for each variable. While it would be straight forward to incorporate these ideas into our work, the technique discussed in Sect. 3 is sufficient for all practical purposes if the bounded range of program variables is taken into account (see our remark at the end of Sect. 3.1.2).. We refer the reader to [17] for a description of additional related work.

O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O B I B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Model checking implicit-invocation systems While implicit invocation (publish-subscribe) systems have good engineering properties, they are difficult to reason about and to test. Model checking such systems is an attractive alternative. However, it is not clear what kinds of state models are best suited for this. In this paper we propose a structural approach, which factors the model checking problem into two parts: behavior specific to a particular implicit invocation system, and reusable run-time infrastructure that handles event-based communication and delivery policies. The reusable portion is itself structured so that alternative run-time mechanisms may be experimented with.

B O O B O B I B B O O O O O O O O O O O O B B O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O B O O O O B I O O O O B O O O B O O O O O O O O O O O O O O O O O O


A Multichannel Approach to Fingerprint Classification Abstract-Fingerprint classification provides an important indexing mechanism in a fingerprint database. An accurate and consistent classification can greatly reduce fingerprint matching time for a large database. We present a fingerprint classification algorithm which is able to achieve an accuracy better than previously reported in the literature. We classify fingerprints into five categories: whorl, right loop, left loop, arch, and tented arch. The algorithm uses a novel representation (FingerCode) and is based on a two-stage classifier to make a classification. It has been tested on 4,000 images in the NIST-4 database. For the five-class problem, a classification accuracy of 90 percent is achieved (with a 1.8 percent rejection during the feature extraction phase). For the four-class problem (arch and tented arch combined into one class), we are able to achieve a classification accuracy of 94.8 percent (with 1.8 percent rejection). By incorporating a reject option at the classifier, the classification accuracy can be increased to 96 percent for the five-class classification task, and to 97.8 percent for the four-class classification task after a total of 32.5 percent of the images are rejected. INGERPRINTS are the ridge and furrow patterns on the tip of the finger [1] and are used for personal identification of people [2] . Fig. 1 shows some examples of fingerprints. Large volumes of fingerprints are collected and stored everyday in a wide range of applications, including forensics, access control, and driver license registration. An automatic recognition of people based on fingerprints requires that the input fingerprint be matched with a large number of fingerprints in a database (the FBI database contains more than 70 million fingerprints!). To reduce the search time and computational complexity, it is desirable to classify these fingerprints in an accurate and consistent manner such that the input fingerprint needs to be matched only with a subset of the fingerprints in the database. Fingerprint classification is a technique used to assign a fingerprint into one of the several prespecified types already established in the literature which can provide an indexing mechanism. Fingerprint classification can be viewed as a coarse level matching of the fingerprints. An input fingerprint is first matched at a coarse level to one of the prespecified types and then, at a finer level, it is compared to a subset of the database corresponding to that fingerprint type. In this study, we classify fingerprints into five classes, namely, whorl (W), right loop (R), left loop (L), arch (A), and tented arch (T) (Fig. 1) .. There are two main types of features in a fingerprint: 1) global ridge and furrow structures which form special patterns in the central region of the fingerprint, and 2) local ridge and furrow minute details.. A fingerprint is classified based on only the first type of features and uniquely identified based on the second type of features (one such feature is the ridge endings and bifurcations, also known as minutiae). See Fig. 2 for examples of ridges, minutiae, orientation field, and singular points in a fingerprint image.. Several approaches have been developed for automatic fingerprint classification. These approaches can be broadly categorized into four main categories: 1) model-based, 2) structure-based, 3) frequency-based, and 4) syntactic.. The model-based fingerprint classification technique uses the locations of singular points (core and delta) to classify a fingerprint into the five above-mentioned classes [3] , [4] . A model-based approach tries to capture the knowledge of a human expert by deriving rules for each category by handconstructing the models and therefore, does not require training. Accuracies of 85 percent [3] and 87.5 percent [4] have been reported on the NIST-4 database [5] using these approaches. A structure-based approach uses the estimated orientation field in a fingerprint image to classify the fingerprint into one of the five classes. An accuracy of 90.2 percent with 10 percent rejection is reported on NIST-4 [6] . The neural network used in [6] was trained on images from 2,000 fingers (one image per finger) and then tested on an independent set of 2,000 images taken from the same fingers. The error reported is, thus, optimistically biased. A later version of this algorithm [7] was tested on the NIST-14 database, which is a naturally distributed database, resulting in a better performance. However, this performance improvement should be expected since the NIST-14 database contains only a small percentage of arch-type fingerprints, which pose the most difficulty for fingerprint classifiers and the neural network used in the algorithm implicitly takes advantage of this information. A similar structure-based approach, which uses hidden Markov models for classification [8] , depends on a reliable estimation of ridge locations, which is difficult in noisy images. In another structure-based approach, B-spline curves are used to represent and classify fingerprints [9] . A syntactic approach uses a formal grammar to represent and classify fingerprints [10] . Frequency-based approaches use the frequency spectrum of the fingerprints for classification [11] . Hybrid approaches combine two or more approaches for classification [12] , [13] . These approaches show some promise but have not been tested on large databases. For example, Chong et al. [9] report results on 89 fingerprints, Fitz and Green [11] on 40 fingerprints, and Kawagoe and Tojo [13] on 94 fingerprints.. Most of the category information about a fingerprint is contained in the central part of the fingerprint. The modelbased techniques which use both the core and delta points for classification require that these singular points be present in the image. The dab fingerprint images obtained by optical scanners do not always capture the entire fingerprint and often have the delta point(s) missing. The new solid-state fingerprint capture devices are small in size and so, capture only a part of the fingerprint (e.g., the FPS100 solid-state sensor from Veridicom is about the size of a postage stamp). Also, the core or delta point(s) are difficult to detect in noisy fingerprint images. There is, however, sufficient information available in the ridge pattern itself to classify a fingerprint. While the structure-based approach does not depend upon the core or delta points, it requires a reliable estimate of the orientation field which is again very difficult to obtain in low quality fingerprint images.. We propose a fingerprint classification algorithm (Fig. 3 ) based on a novel representation scheme which is directly derived from local ridge structures. The representation does not use the core, delta, and orientation field, explicitly. It is more capable of tolerating poor image quality, which is a major difficulty in fingerprint classification.. The main steps of our classification algorithm are as follows:. 1) Locate a registration point in the input image and define a spatial tessellation of the region around the registration point (sectors).. 2) Decompose the input image into a set of component images, each of which preserves certain ridge structures; compute the standard deviation of the component images in each sector to generate the feature vector (called FingerCode). 3) Feed the feature vector into a classifier; in our algorithm, a two-stage classifier is used.. This two-stage classifier uses a K-nearest neighbor classifier in its first stage and a set of neural network classifiers in its second stage to classify a feature vector into one of the five fingerprint classes.. In the following sections, we will present the details of our fingerprint classification algorithm. Section 2 presents our feature extraction scheme. In Section 3, we present our classification scheme. In Section 4, we present our experimental results on the NIST-4 database. The conclusions and future research directions are presented in Section 5. We have developed a novel multichannel filter-based classification algorithm which gives better accuracy than previously reported in the literature on the NIST-4 database. Our feature vector, called FingerCode, is more representative of the fingerprint class information and is robust to noise which is reflected in the classification accuracy. We have tested our algorithm on the NIST-4 database and a very good performance has been achieved (90 percent for the five-class classification problem and 94.8 percent for the four-class classification problem with 1.8 percent rejection during the feature extraction phase). However, this algorithm suffers from the requirement that the region of interest be correctly located, requiring the accurate detection of center point in the fingerprint image. By improving the accuracy of registration point location, a better performance can be easily expected. Our system takes about 10 seconds on a Sun Ultra-1 machine to classify one fingerprint, which is another aspect of the algorithm that needs to be improved. Since image decomposition (filtering) steps account for 90 percent of the total compute time, special purpose hardware for convolution can significantly decrease the overall time for classification.

O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Tight Bounds for Testing Bipartiteness in General Graphs Abstract. In this paper we consider the problem of testing bipartiteness of general graphs. The problem has previously been studied in two models, one most suitable for dense graphs, and one most suitable for bounded-degree graphs. Roughly speaking, dense graphs can be tested for bipartiteness with constant complexity, while the complexity of testing bounded-degree graphs is ¢´ÔÒµ, where Ò is the number of vertices in the graph. Thus there is a large gap between the complexity of testing in the two cases. In this work we bridge the gap described above. In particular, we study the problem of testing bipartiteness in a model that is suitable for all densities. We present an algorithm whose complexity is Ç´Ñ Ò´ÔÒ Ò ¾ Ñµµ where Ñ is the number of edges in the graph, and match it with an almost tight lower bound.

O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Tomographic Reconstruction of the Curl and Divergence of 2D Vector Fields Taking Refractions into Account Abstract. This article is concerned with the problem of reconstructing the curl and divergence of two-dimensional (2D) vector fields from ultrasound time-of-flight measurements taking the refraction of the emitted ultrasound rays into account. Usually, in 2D vector field tomography the refraction of the ultrasound signal is neglected; i.e., one assumes that the signal propagates along straight lines. We address refractive effects, assuming that the ultrasound signal propagates along the geodesics of a Riemannian metric that is associated with the refractive index which is due to Fermat's principle. The investigated vector field, however, is still defined on a domain in R 2 that is equipped with the Euclidean metric. We show a connection between the ray transforms and the Radon transform along geodesic curves which generalizes a well-known result from the Euclidean case. Relying on this relation, we develop an asymptotic reconstruction formula for computing the curl and divergence of the vector field using Fourier integral operators. This article concludes with detailed numerical tests proving on the one hand a good performance of our method and showing on the other hand an improvement compared with computations that assume a propagation along straight lines. 1. Introduction. The problem of the tomographic reconstruction of vector fields has been investigated by many authors. Norton [11] proposed a measurement setup to compute twodimensional (2D) velocity fields of moving fluids from ultrasound time-of-flight measurements. He derived an inversion method for incompressible fluids, provided that boundary values of the velocity field v are known. Without this a priori information only the curl of the vector field can be computed from time-of-flight-measurements. Sparr et al. [19] investigated the problem of vector field tomography from ultrasound Doppler measurements, also obtaining the longitudinal ray transform as a mathematical model that in three dimensions is also called the Doppler transform. Juhlin [9] was the first to describe a method for fully reconstructing a three-dimensional (3D) vector field from data measured in a parallel geometry. Wernsdörfer [22] presented an iterative reconstruction scheme for computing 3D vector fields from tomographic data. Schuster [12, 13, 14] computed reconstruction kernels for the 3D Doppler

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O