Semantic world modeling using probabilistic multiple hypothesis anchoring In order to successfully perform typical household tasks such as manipulation or navigation, domestic robots need an accurate description of the world they are operating in. Creating and maintaining such a description, in this work referred to as world model, is a non-trivial task in a domestic environment that typically has a high number of objects, and is unstructured and dynamically changing. This work introduces probabilistic multiple hypothesis anchoring to create and maintain a semantically rich world model using probabilistic anchoring. Multiple hypothesis tracking-based data association is included to be able to deal with ambiguous scenarios. Multiple model tracking is included to be able to easily incorporate different kinds of prior knowledge. Domestic robots are typically confronted with a complex, dynamically changing and unstructured environment. In such environments, robots must be able to perform a wide variety of tasks, e.g., safe navigation, object manipulation, human-robot interaction, including many different objects. An important prerequisite for successfully accomplishing these tasks is the availability of an accurate description of the part of the environment that is relevant for completing the task. In this work, such an environmental description will be referred to as world model and this work focuses on creating one. With the availability of a world model, a task reasoner can exploit the world description during task planning or execution.. A world model usually contains 3D-positions of uniquely labeled objects [1] . In dynamic scenarios, dynamic object properties such as velocities are included as well [2, 3] but depending on the task and the objects that are involved, any object attribute can be added, e.g., color, shape, size. The robot perceives the world using a perceptual system possibly containing multiple sensors such as cameras and laser scanners. The perceptual system generates measurements, i.e., time-stamped features, that can be anything from colored blobs in a camera image [4] to object shapes [5] . These measurements will be the input for the algorithm that constructs the world model. Four requirements for a world modeling algorithm are formulated:. 1. Appropriate anchoring: The world model must contain semantically rich objects such that a robot can understand human's instructions. Therefore, the world modeling algorithm has to link measured attributes to semantically rich objects in the world model. Creating and maintaining this link between instances of grounded object classes and measurements is called anchoring [6] . 2. Proper data association: Updating the object attributes based on measurements is a non-trivial task due to the uncertainties a robot is confronted with. Sensors are prone to measurement noise and object detection algorithms inevitably miss objects, i.e., false negatives, or generate false detections, i.e., false positives. Associating measurements with the corresponding object in the world model that generated the measurement can be difficult if visually identical objects appear close to each other, i.e., if the robot faces ambiguities. Data association algorithms are developed to deal with the association problem in a probabilistic manner explicitly taking into account the uncertainty [7] . 3. Model-based object tracking: Objects in domestic environments change position regularly, e.g., humans or small household items. Despite these movements, we would like to be able to keep track of the object identities. Various types of models are available to predict the object movements. A physicsbased model might describe human movements with a constant velocity motion model, whereas a more common sense based model might describe the location of a person as 'at home in the evening and at work during the day'. Exploiting various kinds of prior knowledge represented by various types of models, allows more effective object tracking. In this work, an approach called probabilistic multiple hypothesis anchoring (PMHA) is introduced and used for world modeling in a robotics setting. PMHA incorporates the strengths of probabilis-tic data association and multiple model tracking into an anchoring algorithm, resulting in a probabilistic anchoring approach. The approach on the one hand allows semantically rich objects with many different attributes and on the other hands allows correcting previous data association decisions based on new evidence which is particularly useful in ambiguous situations. The traditional multiple model target tracking was generalized such that various types of prior knowledge can be incorporated and the real-time applicability was demonstrated during a series of experiments.. The first experiment gives a detailed description of the various components and models in the proposed PMHA framework. It in addition demonstrated how semantically rich object descriptions are exploited while solving the data association problem and the most important assumptions affect the performance. The second set of experiments showed the (i) ability to correct previous data association decisions based on new evidence, (ii) advantages of tracking multiple attributes as it is done in anchoring algorithms and (iii) the effect of incorporating prior knowledge by means of multiple behavior models for object attribute tracking. We think the combination of these features is very important since robots will be confronted with ambiguous situations regularly. The third set of experiments showed the ability to perform correct association with a varying number of visually identical objects, non-linear trajectories, missed detections and full occlusions which is nearly impossible with anchoring algorithms that do not include probabilistic data association. The probabilistic information available in the hypothesis tree was used to show both the most probable state of the world and the expected number of ants in the scene.. Future work will be to further investigate the probabilistic models that are used. A valuable extension would be to autonomously learn these possibly temporal or spatial dependent models from data, e.g., starting from [24, 25] . Combining the PMHA algorithm with a reasoning module paves the way for a probabilistic reasoning module that reasons about various states of the world. The data present in our PMHA algorithm allows answering queries regarding the world state in a probabilistic manner, e.g., ''Where is John?'' can be answered with ''at the office (p = 0.68)''. We have performed the experiment described above twice. In the first experiment, we have set the probabilistic models such that we have a high probability of new cups entering the scene and we track the position attribute of the anchors using a KF with a constant position motion model. As a result, the most probable hypothesis will be the one explaining the cup during the partial occlusion as being a new cup. Once the complete scene is observed again, this appears to be right, as can be seen in Fig. 7 , where the point cloud observed by the robot is shown together with text labels indicating the anchor's class label in the world model and unique IDs that allow distinguishing various instances of the same class.. In the second trial, we have kept everything the same except for two things. We have (i) lowered the probability of new cups entering the scene and (ii) added a second model to the behavior model set M. This second model represents an increasing probability of cups being moved to elsewhere on the table over time. Changing the class dependent model set and probabilities can be done in a separate configuration file. Fig. 8 shows the results with these adapted probabilistic models. During the partial occlusion shown in Fig. 8(b) , the most probable hypothesis is the one that assumes that the cup was moved during the full occlusion. The hypothesis representing the output that was given during the previous experiment is still present, however, because of the probabilistic models we have selected, that hypothesis has a lower probability. After the occlusion being resolved it becomes apparent that the original cup was not moved but a new cup was added during the occlusion. The most probable hypothesis changes hence the PMHA algorithm corrects its previous conclusion based on new evidence as shown in Fig. 8(c) . During the partial occlusion it is impossible to know which of the two alternatives represents the true solution. Besides the advantage of maintaining multiple hypotheses, this experiment also demonstrates the ability of incorporating various kinds of prior knowledge in the probabilistic object tracking models.. The PMHA algorithm was successful in twelve out of the sixteen videos. The data association failed for videos 3, 8, 12 and 14, i.e., ants identities got mixed, which is understandable given the fact that the constant velocity motion models were very poor estimates for the actual ant movements in these videos. In two out of the twelve successes, the hypothesis tree corrected previous conclusions based on new evidence. The performance is comparable to state of the art MTT algorithms such as, [28, 5] , that also failed in four out of the sixteen videos. However, they excluded the anchoring part that we think is inevitable in a domestic robotics setting. A more detailed comparison of the results is shown in Table 3 , copied from [5] and extended with both the results from [28] and our results. Anchoring algorithms without probabilistic data association will fail in dynamic scenarios including ambiguities as presented in this section. Anchoring with GNN data association will perform worse. The average computation time the PMHA algorithm needed per image was 29 ms on a HP EliteBook 8530w with Intel 2.8 GHz duo core for a non-optimized implementation, which allows real-time execution. Fig. 10 shows an example of the estimated ant trajectories for videos 1 and 6. All measurement to ant associations are correct. Complicating factors in these particular videos are an occlusion causing 13 subsequent missed detections of the same ant in video 1 and various occlusions among various ants in video 6. The somewhat wobbly trajectories are the result of the inaccurate position estimation during occlusions, as visualized in Fig. 9(a) .. Each hypothesis has a probability and each hypothesis represents a possible world state with a certain number of ants in the observation region. We have calculated the expected value of the number of ants based on all hypotheses in the tree and their probabilities. For videos 1 and 6, the expected value for the number of ants according to the hypothesis tree is plotted over time in Fig. 11 . The red dots indicate the number of detections at each of the frames. Even though occlusions and the poor detection algorithm cause many false negatives, the PMHA algorithms is able to correctly estimate the varying number of ants over time. This mainly is the result of the behavior models used for target tracking. Table 3 Number of ants (NOA) in each of the videos together with the results obtained by the approaches described in both [28, 5] The behavior model set M only includes low level motion models for tracking the position attribute in this example, however, an extension with other kinds of behavior models and different attributes is straightforward, as shown in the previous experiments. This section discusses literature related to the problem that was introduced in Section 1. This section describes the experiments that were performed. The experiments in Section 6.1 focus on the anchoring part of our framework. Section 6.1 includes a detailed overview of all the components in Fig. 1 and shows when the PMHA algorithms fails due to the assumptions made. In Section 6.2, a robot is confronted with an ambiguous scenario in a typical household setting scenario. The focus is on the multiple hypothesis aspect of the PMHA algorithm. Section 6.3 presents an experiment in a highly dynamic environment and, therefore, focuses on data association and some of the probabilistic features of the proposed approach.

O B I O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O B I O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O O O O O O B I O B I I O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O


Achieving Guaranteed Anonymity in GPS Traces via Uncertainty-Aware Path Cloaking Abstract-The integration of Global Positioning System (GPS) receivers and sensors into mobile devices has enabled collaborative sensing applications, which monitor the dynamics of environments through opportunistic collection of data from many users' devices. One example that motivates this paper is a probe-vehicle-based automotive traffic monitoring system, which estimates traffic congestion from GPS velocity measurements reported from many drivers. This paper considers the problem of achieving guaranteed anonymity in a locational data set that includes location traces from many users, while maintaining high data accuracy. We consider two methods to reidentify anonymous location traces, target tracking, and home identification, and observe that known privacy algorithms cannot achieve high application accuracy requirements or fail to provide privacy guarantees for drivers in low-density areas. To overcome these challenges, we derive a novel time-to-confusion criterion to characterize privacy in a locational data set and propose a disclosure control algorithm (called uncertainty-aware path cloaking algorithm) that selectively reveals GPS samples to limit the maximum time-toconfusion for all vehicles. Through trace-driven simulations using real GPS traces from 312 vehicles, we demonstrate that this algorithm effectively limits tracking risks, in particular, by eliminating tracking outliers. It also achieves significant data accuracy improvements compared to known algorithms. We then present two enhancements to the algorithm. First, it also addresses the home identification risk by reducing location information revealed at the start and end of trips. Second, it also considers heading information reported by users in the tracking model. This version can thus protect users who are moving in dense areas but in a different direction from the majority. C OLLABORATIVE sensing networks (e.g., [31] , [1] , [3] , [9] ) anonymously aggregate location-tagged sensing information from a large number of users to monitor their environment. However, sharing anonymous location-tagged sensing information from users can raise serious privacy concerns. At first glance, rendering the location traces anonymous (i.e., removing identity information) before sharing them with application service providers or third parties appears to be a suitable solution. However, a timeseries trace of anonymous location data exhibits spatiotemporal correlation between successive updates, potentially allowing an adversary to follow anonymous location updates and eventually reidentifying the users. Reidentification is possible, for example, because Global Satellite Navigation System (GNSS) location readings are often precise enough to identify a driver's home or workplace. This allows linking homeowner, telephone, or employee records with the anonymous traces. 1 Motivated by an increasing number of data breaches and the potential for these reidentification attacks at network/ application service providers, we consider the challenge of designing disclosure control algorithms for location traces. Prior privacy techniques for location data such as spatial cloaking techniques based on k-anonymity [20] , [19] and besteffort algorithms (e.g., [39] , [11] , [22] ) do not simultaneously meet both the privacy and the data accuracy requirements for collaborative sensing applications. This raises the problem of guaranteeing anonymity in a data set of location traces while maintaining high data accuracy and integrity.. To overcome these challenges, we develop a novel privacy metric, called Time-To-Confusion, to characterize the privacy implication of anonymous location traces and propose an uncertainty-aware path cloaking algorithm that guarantees a maximum time-to-confusion and provides high data accuracy. Time-To-Confusion effectively captures how long an adversary can follow an anonymous user at a specified level of confidence and depends on parameters such as sampling frequency and user density. The uncertainty-aware path cloaking algorithm then determines which location samples from a set of users can be revealed anonymously given a maximum allowable time-to-confusion parameter. As in other location privacy solutions [20] , [22] , this algorithm relies on a trustworthy privacy server, which receives location updates from all participating users and controls disclosure of samples to third-party applications. It can operate online-it does not require all traces to be complete. The algorithm also protects against home identification risks, and can handle location traces that also report directional (heading) information with each location update by taking the direction information into consideration when computing tracking uncertainty. We evaluate our proposed solution using an automotive traffic monitoring case study. The evaluation uses real GPS traces from 312 vehicles collected mostly over suburban areas of a large city in the United States.. 1. Basic anonymization is known to not fully protect against reidentification in many data sets. Examples are census database [36] , search engine logs [10] , and movie rating [35] .. Contributions. In summary, this paper offers the following specific contributions:. . Formal definition of a novel time-to-confusion metric to evaluate privacy in a set of location traces. This metric describes how long an individual user can be tracked. . Development of an uncertainty-aware path cloaking algorithm that can guarantee a specified maximum time-to-confusion and protect against home identification risks. . Demonstration through experiments on real-world GPS traces that this algorithm limits maximum timeto-confusion while providing more accurate location data than a random sampling baseline algorithm. In particular, it offers guaranteed protection for users that move into low-density areas. This work extends our earlier paper [25] by providing a formal definition for the time-to-confusion concept, by including heading information in the tracking uncertainty model, by addressing the additional home identification risk model, and by evaluating these extensions using the real-world GPS traces. It also includes an expanded discussion of privacy risks in anonymous GPS traces.. Overview. The remainder of the paper is structured as follows: Section 2 briefly introduces collaborative sensing applications and our specific case study, the automotive traffic monitoring system. Section 3 presents possible inference attacks on anonymous location databases and evaluates known privacy algorithms. In Section 4, we describe the threat model and introduce the time-to-confusion metric that captures the time an adversary can track with high confidence. After enumerating several existing algorithms in Section 5, we present the uncertainty-aware privacy algorithm in Section 6. Sections 7 and 8 present the experimental results obtained with real-world location traces, which demonstrate the privacy and data accuracy advantages. We then discuss limitations, extensions, and future directions in Section 9. Section 10 reviews related work, and finally, Section 11 concludes the paper. In summary, we observe the following about existing algorithms:. . Spatial cloaking algorithms that can achieve a guaranteed privacy level for all drivers fail to provide sufficient spatial accuracy for the range of user densities studied in our deployment. For k ¼ 3, spatial accuracy remains over 1,000 m, for probe deployments of 2,000 and 5,500 vehicles, one order of magnitude over the applications accuracy requirement. Thus, they are not suitable for probe vehicle systems that operate with low probe densities, or are incrementally deployed over a longer time period. . Best-effort privacy techniques such as subsampling improve privacy but fail to provide a defined level of privacy for all users. The tracking algorithm described in Section 3 will be able to track some subscribers, particularly those in lower density regions. . Similarly, best-effort privacy techniques do not fully protect against home identification. While the evaluated home identification intrusion technique suffered from many false positives, this mechanism is at least effective as an automated prefiltering step that can be followed by manual inspection. To provide a high degree of privacy protection, more sophisticated data suppression mechanisms are needed that can guarantee a level of privacy for all users while maintaining high data quality. In this paper, we have proposed the time-to-confusion metric and cloaking algorithms to address privacy in an anonymous set of time-series location traces. We considered two specific privacy risks in anonymous location tracestarget tracking and place identification-and found that these allow tracking and reidentifying data subjects in anonymous traces, particularly in areas with low user density. We quantify the tracking risk through the time-toconfusion metric and develop the uncertainty-aware path cloaking algorithm, which can filter a set of anonymous GPS traces to guarantee a maximum privacy-risk level (specified as time-to-confusion).. Using a real-world GPS data set, we measure the privacy gain and the achieved data quality for the proposed solutions compared to a baseline random sampling technique. We show that our uncertainty-aware path cloaking effectively guarantees worst-case tracking bounds (i.e., outliers), while achieving significant data accuracy improvements. Since the algorithm considers both density and driving behaviors (i.e., speed and direction), it effectively detects and removes traces that are sampled in low-density areas or could be easily tracked due to differences in driving direction from surrounding vehicles. It achieves better privacy than a random sampling technique at the same level of data quality. We also show that our solution is effective against clustering-based place identification techniques. In this section, we discuss the limitation of the data set and the experiment, the possible extensions of our proposed algorithm, and some future directions.. Ground truth. Since the real home addresses are unavailable (driver identities were omitted in the data set for privacy reasons), we manually inspected the unmodified week-long traces to identify likely home locations for use as ground truth. We overlayed the traces on satellite images for this purpose. This inspection led to 65 reference locations, shown in Fig. 9a . These were chosen because they contained a single home that stood out as a likely home location and the drivers visited this home much more frequently at night than other locations. Therefore, we believe the manual inspection provides a reasonable approximation of real home locations.. Prior knowledge on subjects. In this work, we assume that an adversary does not have any a priori knowledge about the subjects being tracked when we develop inference attack models. We cannot rule out that inferences are possible with additional information about subjects. For example, if the destination and a likely path of a subject's trip are a priori known, tracking probabilities may change and it may make it easier to link anonymous location updates to this subject. Of course, in this model, there is less sensitive information to protect because the destination is already known, but it still leaks some information about the exact timing and speed of the trip, making it possible to determine whether a subject was present at an accident site, for example. Still, we believe that the cloaking algorithm significantly raises the bar for extracting information from traces.. Relaxing trust in location server. The algorithm described so far relies on a trustworthy location server, since the algorithm needs the full GPS traces of all vehicles. A fully distributed algorithm poses a research challenge by itself, since clients would need to monitor the positions of neighboring cars, which again raises privacy and trust issues. It also appears possible, though, to relax the trust assumptions in the location server through a hybrid approach, with additional in-vehicle disclosure control based on coarser information about neighbors. Since data quality would only be marginally affected by missing updates in low-density areas, one could devise schemes to inform vehicles of the approximate probe density in their area. Then vehicles could reduce location updates to the server in the most sensitive low-density areas. To prevent spoofing of such density information, further research could investigate data crossvalidation schemes or secure multiparty computation schemes to compute density.. Data set limitations. We need to point out that the tracking results can be affected by the choice of probe vehicles. In our data set, most drivers shared the same workplace. Thus, the workplace acted as a place of confusion, where the tracking algorithms failed. A random sample of the population would probably improve tracking performance. This would cause both our proposed algorithms and the random sampling method to remove more samples to meet the maximum TTC. The performance gap between them might also change from what we have observed in our study. In addition, our method of overlaying multiple data sets to create one high-density scenario may not be entirely faithful in representing true traffic conditions. Due to this overlay, some of the vehicles may also be driven by the same driver on similar routes, creating a further bias toward reduced tracking performance. Nonetheless, we observed that naive anonymization is problematic and our proposed algorithm filters out much less data than baseline algorithms. We still believe that our current results provide a valuable step toward understanding the tracking performance in probe vehicle scenarios.. Variants of target tracking algorithms. We also considered other possible tracking algorithms than the ones described so far. We cannot rule out that more sophisticated tracking techniques can achieve longer tracking times, but the algorithms we experimented with only showed very incremental gains compared to our tracking model.. . Linear Kalman Model: We observed that linear Kalman filtering does not enhance the tracking capability. The linear Kalman model is an effective tool to estimate the state (e.g., position, speed, and acceleration) of a system (e.g., vehicles) given a time series of noisy observations. Accurately estimated state then enables more accurate prediction of the next position of the moving target. In our data set, the noise in GPS samples on the order of a few meters was not a dominant factor compared to the relatively low sampling rate of one per minute. . Tracking with road map information: If we use road network information, we can achieve better pruning over a set of hypotheses. For example, even though two observed samples are near in euclidean distance, it may be obvious that they do not belong to a same user if they are on very different roadways. While experiments we conducted on our data set did not show significant improvements in tracking performance, we generally expect that the use of map information helps tracking. In our study, we have focused on computationally simpler algorithms that could be applied to massive number of targets traces without sophisticated knowledge such as map information or a prior knowledge on subjects to be tracked. However, it is straightforward to extend the presented privacy model and algorithm to take into account road network information. Instead of using euclidean distance in the tracking model, the algorithm could match locations to road segments and calculate the road distance between two locations. The following target tracking experiment illustrates how the path cloaking algorithm prevents an adversary from reconstructing an individual's path and locating an individual's home using the cleansed GPS traces. Specifically, we compare our uncertainty-aware privacy algorithm and its with-reacquisition version with random subsampling in terms of maximum and median TTC for configurations that produce the same number of released location samples (as a metric of data quality). Also, we compare the same algorithms in terms of home identification rate against the number of released location samples. We evaluate the effectiveness of our proposed privacy preserving algorithms by answering the following questions: Fig. 11 . Uncertainty-aware privacy algorithm removes more samples in low-density areas in which vehicles could be easily tracked. Gray dots indicate released location samples and black ones denote removed samples. (a) Snapshot of privacy preserving GPS traces generated by uncertainty-aware path cloaking at off-peak time (over 1.5 hours) in a high-density scenario. (b) Snapshot of privacy preserving GPS traces generated by uncertainty-aware path cloaking algorithm at peak time (over 1.5 hours) in a high-density scenario. Fig. 12 . Choosing k creates a trade-off between data quality and computation complexity. While reducing the computation complexity, the case of k ¼ 2 provides a lower bound on uncertainty. This leads to retaining smaller numbers of GPS samples.. . Do uncertainty-aware privacy algorithms effectively limit tracking time (i.e., guarantee time-toconfusion)? Are these limits maintained even in low user density scenarios? . How does the average tracking time allowed by path cloaking compare to the subsampling baseline, at the same data quality level? . How are the results affected by the choice of data quality metric (percentage of released location samples versus relative weighted road coverage)? . Do the proposed algorithms effectively suppress home identification risks? How efficient is it compared to the subsampling baseline for the same data quality level? . How much quality should the proposed solutions sacrifice for protecting driver's privacy against target tracking model that utilizes driving direction information? Much work has focused on exploiting GPS or cellular phone data for traffic monitoring. MIT's CarTel [26] proposed to use the unused bandwidth of open wireless hotspots to deliver the GPS-based location and speed measurements of probe vehicles to the central server for traffic data mining and locating potholes. Previous study using cell-phone-based traffic monitoring [13] investigates the use of triangulationbased positioning technology to locate phones. Because of poor quality position estimates (100 m accuracy), vehicle speeds could not be consistently determined. Recently, Yoon et al. [42] proposed to use cellular network as a delivery method of GPS-based sensing information from probe vehicles. Several systems have also been deployed [5], [6] . These projects, however, have not focused on privacy of location information, and use only basic anonymization techniques, if using privacy enhancing techniques at all. Several recent studies [32] , [24] , [21] analyzed the privacy risk of GPS traces and found that naive anonymization (i.e., omitting identifiers from a data set) does not guarantee anonymity due to a spatiotemporal correlation between periodic location updates. This raises an urgent need for stronger protection mechanisms.. Much research exists on guaranteeing anonymity in database records and k-anonymity [36] solutions are available, but their application for time-series location data set is questionable. The k-anonymity concept has been applied in location-based services [20] , [34] , [19] for single independent location updates. As shown in Section 5, these solutions can provide sufficient accuracy for applications such as point-ofinterest queries in high-density scenarios, but they do not achieve the high-accuracy requirements of traffic monitoring applications with low penetration rates. In addition, a series of cloaking boxes applied to periodic location updates still allows an adversary to follow a target [41] . Many studies have subsequently extended the k-anonymity concept to allow cloaking through the use of hilbert curves [28] , efficient cloaking of paths [41] , and cloaking algorithms for l-diversity as well as k-anonymity [40] . Bettini et al. [12] recently provided a formal framework to define attack scenarios, defense techniques, and assumptions on the amount of knowledge that is accessible by an adversary.. Privacy preserving data mining [8] and anonymous communication are also not directly applicable to timeseries location data. Random perturbation approaches cannot provide sufficient data accuracy and noise with small variance may be sometimes filtered by advanced signal processing techniques [30] . Anonymous communication techniques can relay messages between communication partners without revealing the source and/or destination identity (e.g., [14] ), but does not protect potentially revealing information in the message payload. The work on measuring communication anonymity, however, [37] inspired us to use entropy in defining time-to-confusion.. Closest to our work are the best-effort location data protection algorithms [11] , [33] , [22] , [27] , which have in common that they create areas of confusion where the traces from several users converge. While these algorithms successfully achieve better accuracy and a defined level of privacy in such an area of confusion, they cannot provide overall privacy guarantees because these areas of confusion might not occur in lower density areas with few users. Recently, two research groups, Apu et al. [29] and Andreas et al. [31] , proposed a privacy preserving data collection architecture for collaborative sensing applications. However, both works do not consider inference attacks that utilize existing correlation between location-based updates.. Another proposed approach builds on privacy policy languages [16] and their location-oriented extensions [38] to allow users (or their automated agents) to make more informed decisions about data sharing. Such policies may be enforced through access control mechanisms, such as [18] , [43] for spatiotemporal data. Using these approaches, data can only be shared with trusted data consumers, while strong anonymization also allows more public distribution of data. Experimental data sets. Throughout the experiments, we used (offline collected) real GPS traces from 312 probe vehicles in our trace-driven simulations. In the experiments, we first applied privacy preserving techniques (i.e., the proposed one and the baseline) on the GPS traces and then measured the performance of privacy protection using target tracking and home identification techniques on these privacy-preserved GPS traces. Since target tracking typically is only effective for a short time period, we only use 24-hour GPS traces out of a set of week-long GPS traces. This approach helps create a highdensity scenario (500 and 2,000 probe vehicles on a 70 km 2 region) with a limited number of probe vehicles. We overlay GPS traces of different volunteer drivers at the same time frame (24 hours) of different dates. This overlay method has a limitation in that it generates similar routes by aggregating GPS traces from the same set of drivers. However, we still believe that it provides insights into higher density scenarios. We will revisit this limitation in Section 9.. Evaluation metrics. In our experiments, we applied the following metrics to evaluate our privacy preserving algorithms for GPS traces.. Tracking Time. Minimizing tracking time reduces the risk that an adversary can correlate an identity with sensitive locations. We use time to confusion (TTC), which we defined in Section 3 as a privacy metric, to measure the tracking duration. To better demonstrate the bounded privacy protection of our proposed algorithm, we report two statistics: the maximum value of TTC and the median value of TTC.. (Relative) Weighted Road Coverage. Through this metric, we measure the data quality that the privacy-preserved traces provide for the traffic monitoring applications. Also, this metric captures the value of each sample based on whether sampled on busier roads or not. Since privacy protection techniques, in general, incur a trade-off between privacy protection and quality of service, our proposed solution aims to provide reasonable privacy protection while delivering the same road coverage for satisfying the need of the traffic monitoring applications. In this paper, we use relative road coverage as we defined in Section 2.1. In addition to this metric, we also provide the percentage of released location sample compared to the original traces which we consider 100 percent. Note that both metrics are normalized by values of the original GPS traces.. Home Identification Rate. This metric measures the percentage of plausible home position identifications. This measure acts as a proxy for the chance of reidentifying a user. Since no ground truth is available, we have manually inspected the unmodified traces and chosen selected 65 traces, where the vehicle visited one residential building significantly more frequently than others. We marked the position of this building as a likely real home position and measure which percentage of these positions is also selected by the automated home identification algorithm based on the privacy-enhanced traces. We also measure false positives, positions selected by the algorithm that do not match the manually chosen ones, to provide an indication of the accuracy of the algorithm.

O O B O B O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B I O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O B O O O O O O O O O O O O O B O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Gauging human mobility characteristics and its impact on mobile routing performance Abstract: A new generation of "behavior-aware" services and networks are emerging in what may define future mobile social networks. It is of great importance for current set of mobility models to understand and realistically model mobile users behavioral characteristics and also realistically reproduce their effects on the performance of networking protocols. Recent work on mobility modeling focused on replicating metrics of encounter statistics and spatio-temporal preferences to improve the realism of mobility models. No studies have been conducted, however, to show whether matching these metrics is sufficient to accurately reproduce structural dynamics and mobile networking protocol performance. In this study, we address these specific problems, and attempt to show the sufficiency (or lack thereof) of existing encounter and mobility metrics in reproducing realistic effects of mobility on networking protocols. We first analyze the characteristics of two well-established mobility models; the random direction and the time-variant community (TVC) models, and study whether they capture encounter statistics and preference patterns observed in realworld traces. Second, we introduce mobile user similarity, its definition, analysis and modeling. To define similarity, we measures the difference of the major spatio-temporal behavioral trends using their association matrix. Such measure is then used to cluster users into similarity communities and compare them in the traces and the mobility models. Finally, we contrast the performance of epidemic routing on the mobility models, to that based on extensive mobility traces. We provide three main findings: (i) Careful parameterization of the models can indeed replicate the metrics in question (e.g., inter-encounter time distribution). (ii) Our results show a rich set of similar communities in real mobile societies with distinct behavioral clusters of users. This is true for all the traces studied, with the trend being consistent over time. (iii) Even carefully crafted mobility models surprisingly result in structural dynamics and protocol performance that is dramatically different from the trace-driven performance. These findings strongly suggest that similarity should be explicitly captured in future mobility models, which motivates the need to re-visit mobility modeling to incorporate accurate behavioral models in the future. The proliferation of highly capable mobile devices (e.g., laptops, smart phones, tablets) with multi-sensing capabilities greatly facilitates the capture of mobility traces (Helmy, et al., 2010; Kotz, et al., 2005) and the direct exchange of information through encounters. Mobility traces can then be used as guidelines for modeling purposes. More realistic mobility models have been created, by mimicking encounter statistics (Chaintreau, et al., 2007; Karagiannis, et al., 2007) or mobile user location visitation preferences (Hsu, et al., 2009) . Much of the recent modeling work focused on encounter metrics; such as inter-encounter and hitting time distribution (Chaintreau, et al., 2007) , meeting duration (Chaintreau, et al., 2007; Hsu, et al., 2009 ), or spatio-temporal profiles (Hsu, et al., 2009 ). These metrics are generally considered important to the operation of mobile networks in general, including DTNs, adhoc and sensor networks.. DTNs are characterized by intermittent connectivity, limited end-to-end connectivity and node resources. Future social networks are expected to have classes of applications that are aware of mobile users' behavioral profiles and preferences and are likely to support peerto-peer mobile networking including DTNs. A new generation of protocols is emerging, including behavioraware communication paradigms (such as profile-cast (Hsu, et al., 2008) ) and service architectures (such as participatory sensing (Nazir, et al., 2010; Shilton, et al., 2008) ). Such behavior-aware communication paradigm leverages user behavior and preferences to achieve efficient operation in DTNs (e.g., interestbased target message forwarding; encounter-based routing, mobile resource discovery). Accurate models of mobile user behavioral profiles are essential for the analysis, performance evaluation, and simulation of such networking protocols. Hence, there is a compelling need to understand and realistically model mobile users behavioral profiles, similarity and clustering of user groups.. Earlier work on mobility modeling presented advances in random mobility models (e.g., RWP, RD (Camp, et al., 2002) ), synthetic models that attempt to capture spatial correlation between nodes (e.g., group models (Bai et al., 2008) ) or temporal correlation and geographic restrictions (e.g., Freeway, Manhattan, Pathway Models (Bai et al., 2008) ). More recent models tend to be trace-driven and some account for location preferences and temporal repetition (Hsu, et al., 2009 ). However, similarity characteristics between clusters of nodes, which lie in the heart of behavioraware networking, have not been modeled explicitly by these mobility models. Hence, it is unclear whether (and to which degree) similarity between mobile nodes is captured, and more importantly, how closely can such models be fine-tuned to replicate "social structures", such as groups with distinct behavior observed from real traces.. Also, no studies have been conducted to show whether matching metrics is sufficient to accurately reproduce DTN protocol performance. In this study, we thoroughly examine this specific problem, and attempt to show, for the first time, the sufficiency (or lack thereof) of existing encounter and mobility metrics in reproducing realistic effects of mobility on structural dynamics and the performance of networking protocols.. In this paper, first we analyze spatio-temporal properties and encounter statistics of two realistic wireless measurement traces. We then evaluate the same characteristic on the synthetic traces produced by two different mobility models; the random direction model (Royer, et al., 2001 ) and the time-variant community (TVC) model (Hsu, et al., 2009 ). Specifically, we analyze two commonly used encounter statistics; inter-meeting time and meeting duration, in addition to two spatiotemporal metrics; periodic re-appearance and location visitation preference. Our results show that models mimic such statistics if carefully tuned.. Second, we address issues related to mobile user similarity, its definition, analysis and modeling. Similarity, in this study, is defined by mobility preferences, and is meant to reflect the users interests to the extent that can be captured by wireless measurements of on-line usage. To define similarity, we adopt a behavioral-profile based on users mobility and location preferences using an on-line association matrix representation, and then use the cosine product of their weighted Eigen-behaviors to capture similarity between users. This quantitatively compares the major spatiotemporal behavioral trends between mobile network users, and can be used for clustering users into similarity groups or communities. Note that this may not reflect social ties between users or relationships per se, but does reflect mobility-related behavior that will affect connectivity and network topology dynamics in a DTN setting.. We analyze similarity distributions of mobile user populations in two settings. The first analysis aims to establish deep understanding of realistic similarity distributions in such mobile societies. It is based on real measurements of over 8860 users for a month in four major university campuses, USC (Helmy, et al., 2010) IBM Watson , Dartmouth (Kotz, et al., 2005) and UF. It may be reasonable to expect some clustering of users that belong to similar affiliations, but quantification of such clustering and its stability over time is necessary for developing accurate similarity models. Furthermore, on-line behavior that reflects distribution of active wireless devices may not necessarily reflect work or study affiliations or social clustering. For DTNs, online activity and mobility preferences translate into encounters that are used for opportunistic message forwarding, and this is the focus of our study rather than social relations per se. The second similarity analysis we conduct aims to investigate whether existing mobility models provide a reasonable approximation of realistic similarity distributions found in the campus traces.. Our results show that among mobile users, we can discover distinct clusters of users that are similar to each other, while dissimilar to other clusters. This is true for all campuses, with the trend being consistent and stable over time. We find an average modularity of 0.64, clustering coefficient of 0.86 and path length of 0.24 among discovered clusters. Surprisingly, however, we find that the existing mobility models do not explicitly capture similarity and result in homogeneous users that are all similar to each other (in one big cluster). This finding generalizes to all other mobility models that produce homogeneous users, not only the mobility models studied in this paper. Thus the richness and diversity of user behavioral patterns is not captured in any degree in the existing models. Our findings strongly suggest that unless similarity is explicitly captured in mobility models, the resulting behavioral patterns are likely to deviate dramatically from reality, sometimes totally missing the richness in the similarity distribution found in the traces. Furthermore, this indicates our current inability to accurately simulate and evaluate similarity-based protocols, services and architectures using mobility models.. Finally, we perform epidemic routing (Vahdat, et al., 2000) on the synthetic (model generated) traces and real network traces and compares their network performance. Surprisingly, through systematic analysis, we find that even when mobility models reflect equivalent spatio-temporal and encounter statistics, they exhibit large DTN routing performance discrepancy with the real scenarios. Furthermore, they clearly show the insufficiency of existing encounter and preference metrics as a measure of mobility model goodness. Systematically establishing a new set of meaningful mobility metrics should certainly be addressed in future works. This also motivates the need to re-visit mobility modeling to incorporate accurate behavioral models in the future.. The paper is structured as: In section 3, we describe various types of wireless traces used in this study, in section 4, we discuss mobility models used to compare against real-world traces. We study human mobility characteristics in the section 5 and compare the routing performance in section 6. Finally, we discuss the results in section 7 and concludes this paper in section 8. In this paper, we show that existing model demonstrate spatio-temporal and encounter statistics seen in real traces. We analyzed the spatio-temporal behavioral similarity profiles among mobile users. We define mobility profiles based on users association matrices, and then use a SVD-based-weighted-cosine similarity index to quantitatively compare these mobility profiles. Analysis of extensive WLAN traces from four major campuses reveals rich similarity distribution histograms suggesting a clustered underlying structure. Application of modularity based clustering validated and further quantified the clustered behavior in mobile societies. Similarity graphs exhibit an average modularity of 0.64, and clustering coefficient of 0.86, which indicates potential for further small world analysis.scrutinize mobility models on routing performance benchmarks. We compared similarity characteristics of the traces to those from existing common and community based mobility models to capture similarity. Surprisingly, existing models are found to generate a homogeneous community with one cluster and thus deviate dramatically from realistic similarity structures. We also testify that despite models capture realistic human behavioral patterns; their routing performance deviate from reality. We used the same synthetic traces to run epidemic routing and measure performance. By doing so, we find that mobility models performance is not analogous to reality. The synthetic mobility traces' indeed carry no structural similarity. These dramatic deviations from realism indicate serious flaws in the existing models and their inadequacy as testbed tools for any kind of performance evaluation purposes. In this paper, we limit our work in verifying epidemic routing against two well-known mobility models. In future, we are looking to test other routing protocols and models that parameterize. We elaborated on the presence of similarity among mobile users and the detection of collective behavior via community detection in wireless networks. We showed the gap between reality and current mobility models in demonstrating collective behavior. In our on-going work, we are developing a multi-dimensional mobility framework that helps scientists to develop mobility metrics and verify current models against realistic settings and provide guidelines to develop new models. We are looking into a global perspective of clustering and mobility coefficient and maintaining structural properties and performance by revisiting mobility modeling, which is vital for the evaluation and design of next-generation behavior-aware protocols. Mobility models are designed with a particular scenario in mind. However, in this study we would like to question the efficacy those metrics that are widely adopted or expected to be vital in closing the performance gap between modeling and reality. Now, there is an immense need to identify them and a perception should be made to use them for correct estimation. Our results show current metrics like spatio-temporal preferences and encounter statistics are inadequate; because models completely miss out on the structure and performance criteria. We believe it is important for the researchers to search for fundamental characteristics that drive the dynamics in challenged networks. Not only we should maintain the current characteristic but also look out for structural semblance and topological realisms between simulation and similarity. A good research direction would be look into measures that affect globally in a similar way routing decision are made. Delay Tolerant Networks (DTNs) are essentially opportunistic networks. These types of networks do not demand permanent connectivity between source and destination; instead attempt to make best use of any scheme available that can get the message across. Mobility of the nodes is often realized for transferring the messages. Design of any communication protocols for DTNs is heavily dependent on how well the underlying mobility is understood (Bai et al., 2003; Spyropoulos, et al., 2006a) . There are two elemental ways to design and test the protocols for DTNs, namely Trace-Based and Mobility Model based (Bai et al., 2008) . In case of trace based design and evaluation, a mobility trace can be downloaded from a limited number of trace repositories (Helmy, et al., 2010; Kotz, et al., 2005) . These trace are from the real world and capture real mobility patterns of the users belonging to the traces. For the trace collection environment, testing the protocol on the traces would produce most realistic results. But there are quite a few drawbacks of using real traces such as limited number of traces, not capturing all scenarios and inability to generalize the results based on a few traces. Due to these drawbacks, researchers have proposed models that capture key characteristics of human mobility and produce synthetic traces.. Due to the complexity of understanding human mobility and modeling it, models are created to reproduce few characteristics from real traces such as inter-encounter time (Cen, et al., 2008) , regularity (Costa, et al., 2008) and community behavior (Eagle, et al., 2006; Cen, et al., 2008; Hsu, et al., 2009; Girvan, et al., 2002; Kotz, et al., 2005) . In most cases, a synthetic trace is validated by comparing a few key characteristics against the real trace. This validation we think is not the best, as it does not test the application oriented parameters of the generated trace.. A new paradigm of protocols that relies on the human behavioral patterns has gained recent attention in DTN-related research. In these studies, researchers attempt to use social aspects of human mobility to derive new services and protocols (Chaintreau, et al., 2007; Fall, et al., 2002; Horn, et al., 1990; Hsu, et al., 2006a) . As an example, researchers created a behaviororiented service, called profile-cast, that relies on spatiotemporal similarities between the users (Ekman, et al., 2008) . Profile-cast provides a systematic framework to utilize implicit relationships discovered among mobile users for interest-based message efficient forwarding and delivery in DTNs. Participatory sensing (Kumar, et al., 2010; Mtibaa, et al., 2010; Nelson, et al., 2007) provides a service for crowd sourcing using recruiting campaigns using mobile user profiles (Fall, et al., 2002) . All these works rely on and utilize similarity of mobile user profiles. In all the above scenarios how can we be sure that a given mobility model can capture all the characteristics needed to test these protocols.. In an attempt to answer the above question, in this work, we have taken a novel approach for evaluating the mobility models; which is to compare the performance of routing protocols on synthetic trace and on real trace whose characteristics were utilized to create/validate the mobility model. This approach allows us to test and create mobility models while keeping the applicability of the generated traces. In this work, as a case study, we consider a complex mobility model TVC (Hsu, et al., 2009 ) (along with random direction mobility model (Hsu, et al., 2005) ). This model generates the non-homogeneous behaviors of mobile users in both space and time. The traces generated by this model show (i) skewed location visiting preferences; (ii) time dependent periodical reappearance of mobile users as seen in WLAN measurements along with other encounter statistics such as average node degree and meeting time. It uses several real traces to validate the correctness of its design. 3 Data Set and Trace Analysis. In this section, we discuss the details of the traces used. One set of traces contain WLAN session logs. The other type of traces contain logs of bluetooth encounters among mobile devices.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B I O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B I B O O O O O O O O O O O O O O O O O O O O B I O O O O O O B O O O O O O O O O O O O B I O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Automatic tag expansion using visual similarity for photo sharing websites Abstract In this paper we present an automatic photo tag expansion method designed for photo sharing websites. The purpose of the method is to suggest tags that are relevant to the visual content of a given photo at upload time. Both textual and visual cues are used in the process of tag expansion. When a photo is to be uploaded, the system asks for a couple of initial tags from the user. The initial tags are used to retrieve relevant photos together with their tags. These photos are assumed to be potentially content related to the uploaded target photo. The tag sets of the relevant photos are used to form the candidate tag list, and visual similarities between the target photo and relevant photos are used to give weights to these candidate tags. Tags with the highest weights are suggested to the user. The method is applied on Flickr (http://www.flickr.com). Results show that including visual information in the process of photo tagging increases accuracy with respect to text-based methods. In this paper we described and analyzed the automatic photo tag expansion method, TagSuggestr. We have used a large test collection from Flickr by including famous touristic places in five cities as well as a small set of randomly chosen photos. From our experiments, we have concluded that comparison of suggested tags with original tags does not reflect the true performance. As a result, a user-study was conducted in order to generate a proper set of ground-truth tags. Six visual features have been included in the analysis. Our evaluations have shown that tag expansion using mentioned visual features achieve higher precision values as opposed to text-based approach.. As a future work for better annotation suggestions, photos to be annotated can be categorized into some classes according to their visual content, and the tag expansion method with the most appropriate visual similarity can be performed. Effective use of invariant keypoints in photos will enable our system to identify human-made objects and logos/emblems in a photo. Furthermore, for systems where visual similarity is involved as ours, it is likely that better visual analysis is required to improve the performance Social tagging of media has brought a requirement for analysis and management of large amounts of tags. This challenge is addressed in several recent studies on nonvisual media resources as for del.icio.us, 1 last.fm, 2 etc. [4, 8, 22, 37] .. Flickr, being among the most widely used social media sites, is a rich source for visual data. Due to the limitations of Content Based Image Retrieval (CBIR) methods [28, 30] , other than some recent efforts for web-scale retrieval [10] , accessing the content through tags is still the most commonly used way. However, since the tags are subjective and limited, automatic generation of tags is required.. As extensively analysed in [19] , Flickr has some differences compared to other social media resources and therefore requires different strategies for automatic tagging. Images are most commonly tagged only by their owners, therefore tags usually represent personal aspects, and come in limited numbers. Therefore, mining the tag usage from group profiles is not in consideration, and usage of a single user's profile is not sufficient to describe the visual content required for better access, since subjectivity limits the vocabulary.. Recent studies in automatic annotation of visual data is promising [1-3, 5-7, 9, 12, 14, 20, 23, 24, 26, 35, 36] . However, most of these methods usually work on small amount of data compared to the resources on the web, and usually only a few keywords are assigned to images which may not be sufficient to describe the rich visual content of the web images.. In some approaches proposed for web images, only text-based methods are used for generation of tags. In [29] , co-occurrence information for tags, obtained from a large pool of Flickr images, are used to recommend additional tags to a photo with initial user-defined tags. Since only text cues are used for generation of new tags without considering visual information, photos having same initial tags will always be tagged with the same set of new tags [15] .. Recently, methods that combine textual and visual techniques have been proposed. In [16] , at the first step, images are classified into a set of concepts by a multiclass SVM. At the next step, tags of visually similar photos are propagated. Since the method requires trained concepts, it can only work on specific catagories and is limited.. The work presented in [27] collects geo-tagged images from Flickr and clusters them using textual, visual and spatial cues. Using frequent itemset mining techniques, relevant word combinations are found for each cluster which are then also used to link the clusters to Wikipedia entries.. In some studies tagging by multiple users is simulated through finding similar images that can be considered as the same resource, and then learning the tagging behaviour from the tags associated with this set. The common approach is, over a large number of pre-collected pool of images, to find the neighbor images which are most visually similar to a target image, and then ranking the tags inside this set either using only frequency of tags or by incorporating visual similarities [15, [31] [32] [33] .. In these approaches, visual similarities are considered as a first step to collect a set of candidate images from which the tags are used. However, this process requires the construction of a large pool of fixed images (usually in the order of millions), and computation of image similarities in such a large collection to obtain a smaller candidate set.. This cost can be overcome with the help of minimal number of textual cues provided during the query time. A few initial tags allow to collect a set of candidate images which are likely to be relevant to the target image. Visual similarities can then be further considered in order to prune this set.. In [18] , given co-occurrence information of tags, for each pair including the userdefined-tag a classifier is trained. The degree of memberships of the images for a list of classifiers are then used to find the relevance of tags for recommendation. This method is very costly since a separate classifier must be built for each pair in a precollected co-occurrence list.. In [34] , starting with a textual query, among semantically similar images, content based image search is used to find images which are also visually similar. This set is clustered, and related words for each cluster are extracted to be used as recommended tags. Since the images are pruned, and then a cluster-based assignment is performed, there is a possibility to loose some important tags. Step 0 Obtain target photo and corresponding initial tags from user. Let I t be the target photo to be uploaded, and T init = {t init1 , t init2 } be the initial tags for this photo.. Step 1 Connect to Flickr server and fetch the first m relevant photos

O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O


Blind identification of multichannel FIR blurs and perfect image restoration Abstract-Despite its practical importance in image processing and computer vision, blind blur identification and blind image restoration have so far been addressed under restrictive assumptions such as all-pole stationary image models blurred by zero-or minimum-phase point-spread functions. Relying upon diversity (availability of a sufficient number of multiple blurred images), we develop blind FIR blur identification and order determination schemes. Apart from a minimal persistence of excitation condition (also present with nonblind setups), the inaccessible input image is allowed to be deterministic or random and of unknown color or distribution. With the blurs satisfying a certain co-primeness condition in addition, we establish existence and uniqueness results which guarantee that single-input/multiple-output FIR blurred images can be restored blindly, though perfectly in the absence of noise, using linear FIR filters. Results of simulations employing the blind order determination, blind blur identification, and blind image restoration algorithms are presented. When the SNR is high, direct image restoration is found to yield better results than indirect image restoration which employs the estimated blurs. In low SNR, indirect image restoration performs well while the direct restoration results vary with the delay but improve with larger equalizer orders.Index Terms-Blind blur estimation, blind image restoration, multichannel image restoration. I N many applications, multiple blurred renditions of a single image become available while the original image and the blurs remain unknown. Some of these applications, such as electron microscopy and imaging through the atmosphere, require image restoration to remove the effects of the blur (see [9] and [26] , [17] ), while others, such as machine vision, require blur identification for depth-from-defocus estimation (see, e.g., [3] and [20] ). With a priori knowledge of the blurs or the input and output (cross-) power spectra, there exist many multichannel image restoration techniques based on different constraints such as minimum mean-square error restoration [4] , [19] , least-squares restoration [5] , and iterative constrained least squares [9] , [13] . When an accurate estimate of the input image is available, or the blurs are known, techniques for range estimation based on depth-from-defocus techniques are available [3] , [20] . To estimate the blurs and/or the original image for these algorithms using traditional single-input single-output blind techniques (see [22] for a review of such techniques), it is necessary to employ restrictive assumptions on the image-blur model such as an all-pole stationary image blurred by zero-or minimum-phase point-spread functions. Such blind techniques do not exploit the extra information provided by the diversity of degraded images.. Research in one-dimensional (1-D) signal processing has shown that in a single-input multiple-output system it is possible to use the second-order statistics estimated from the multichannel output data to identify nonminimum phase FIR filters [25] . Of interest are [6] , [25] , and [28] , which propose methods for blind channel identification (the 1-D equivalent of blur identification) and [8] , [24] which propose methods for direct estimation of FIR equalizers. Universally, these algorithms require that the multiple FIR channels are co-prime. This makes extension of these ideas to two-dimensional (2-D) signal processing especially challenging since in two-dimensions factor co-primeness (weak co-primeness) and zero co-primeness (strong co-primeness) are different unlike the 1-D case.. In this paper, we show that when at least three images are available, it is possible to exploit the properties of single-input multiple-output image data in order to derive algorithms for blind blur identification, blind order determination, and blind image restoration. The blind blur identification algorithm is based on a relationship between outputs, also observed in [28] for 1-D signals, and is derived in both the spatial and frequency domains. The blurs are found either as the eigenvector corresponding to the minimum eigenvalue of a particular data matrix, or, through a least-squares solution. Factor co-primeness of the blurs and a mild persistence-of-excitation condition on the input image are shown to be sufficient conditions for uniqueness of the solution. Blind order determination is accomplished by examining the relationship between the rank and the dimension of a particular data matrix. For image restoration, the existence and uniqueness of a set of FIR restoration filters is characterized. This description is used for blind image restoration in an indirect and a direct method. The indirect method requires first finding the blurs and then employs (perhaps regularized) inverses to find the restoration filters. The direct method finds these restoration filters directly from the output data under a stronger persistence-of-excitation condition on the input and again factor co-primeness of the blurs.. Compared to other works which employ the single-input single-output (SISO) image-blur model [16] , our approach fully uses the information from the diversity of output channels. Other deterministic SISO blind approaches are typically iterative, requiring such constraints as positivity, and/or piecewise smoothness on the input image or the blur function [1] , [17] , [19] . Additionally, convergence is not guaranteed in the iterative methods since the proposed objective functions typically contain a number of minima. In contrast, the novel deterministic approach in this paper allows the original image to be nonstationary with unknown color or distribution eliminating restrictive assumptions on the input image [22] . Existence of multichannel deconvolution operators for continuous space was addressed in [2] without consideration of the blind problem and neglecting the important practical case of discrete-index FIR blurs and FIR restoration filters (which are guaranteed to be stable) as addressed in this work. The cyclostationary viewpoint of [7] though based on a similar blind 1-D algorithm [6] , did not specify identifiability and perfect restoration conditions developed herein.. The organization of this paper is as follows. In Section II, we present the 2-D single-input multiple-output model assumed throughout this work and use this to clearly define the problem statement. In Section III, we show the conditions for existence and uniqueness of 2-D perfect restoration filters. In Section IV, we derive a procedure for blindly estimating the maximum order of the blurs and two procedures for blindly estimating the blurs. Once the blurs have been identified, we show in Section V how these blurs can be used in image restoration. Alternatively, in Section VI we use the existence and uniqueness results from Section III to derive an approach for either estimating two sets of restoration filters corresponding to different lags, or all possible sets of restoration filters simultaneously from the output data. Existence and uniqueness of these solutions are appropriately characterized. We also explore the optimality of the direct restoration filters in the presence of noise. Section VII shows simulations that demonstrate our blind order determination, blind blur identification, and direct and indirect blind restoration techniques. Simulations are presented in the presence of additive white Gaussian noise, addressing other questions such as the restoration quality when different delays and orders of restoration filters are chosen. Finally, Section VIII summarizes our developments with some concluding remarks.

O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O