Search

Purpose Most developed countries have enacted privacy laws to govern the collection and use of personal information (PI) as a response to the increased misuse of PI. Yet, these laws rely heavily on the concept of informational self-determination through the “notice” and “consent” models, which is deeply flawed. This study aims at tackling these flaws achieve the full potential of these privacy laws. Design/methodology/approach The author critically reviews the concept of informational self-determination through the “notice” and “consent” model identifying its main flaws and how they can be tackled. Findings Existing approaches present interesting ideas and useful techniques that focus on tackling some specific problems of informational self-determination but fail short in proposing a comprehensive solution that tackles the essence of the overall problem. Originality/value This study introduces a model for informed consent, a proposed architecture that aims at empowering individuals (data subjects) to take an active role in the protection of their PI by simplifying the informed consent transaction without reducing its effectiveness, and an ontology that can partially realize the proposed architecture.

Artificial Intelligence (AI)- based classifiers rely on Machine Learning (ML) algorithms to provide functionalities that system architects are often willing to integrate into critical Cyber-Physical Systems (CPSs) . However, such algorithms may misclassify observations, with potential detrimental effects on the system itself or on the health of people and of the environment. In addition, CPSs may be subject to threats that were not previously known, motivating the need for building Intrusion Detectors (IDs) that can effectively deal with zero-day attacks. Different studies were directed to compare misclassifications of various algorithms to identify the most suitable one for a given system. Unfortunately, even the most suitable algorithm may still show an unsatisfactory number of misclassifications when system requirements are strict. A possible solution may rely on the adoption of meta-learners, which build ensembles of base-learners to reduce misclassifications and that are widely used for supervised learning. Meta-learners have the potential to reduce misclassifications with respect to non-meta learners: however, misleading base-learners may let the meta-learner leaning towards misclassifications and therefore their behavior needs to be carefully assessed through empirical evaluation. To such extent, in this paper we investigate, expand, empirically evaluate, and discuss meta-learning approaches that rely on ensembles of unsupervised algorithms to detect (zero-day) intrusions in CPSs. Our experimental comparison is conducted by means of public datasets belonging to network intrusion detection and biometric authentication systems, which are common IDSs for CPSs. Overall, we selected 21 datasets, 15 unsupervised algorithms and 9 different meta-learning approaches. Results allow discussing the applicability and suitability of meta-learning for unsupervised anomaly detection, comparing metric scores achieved by base algorithms and meta-learners. Analyses and discussion end up showing how the adoption of meta-learners significantly reduces misclassifications when detecting (zero-day) intrusions in CPSs.

A Cyber-Physical System-of-Systems (CPSoS) can be defined as a System-of-Systems (SoS), where its component systems are Cyber-Physical Systems (CPSs) that have been networked together for achieving a certain higher goal. Therefore, a key viability of any CPSoS is the integration of its CPSs to function as a single integrated system to support a common mission. Although such integration can be achieved relying on the exchange of information among CPSs, only few works have highlighted the importance of considering the quality of such information. Without considering Information Quality (IQ) requirements during the design of CPSoS, CPSs will be vulnerable to faults arising from depending on inaccurate, incomplete, inconsistent, and/or outdated information, which may influence the overall dependability, reliability, and performance of the CPSoS. This paper proposes a model-based approach that offers a novel UML profile, named IQCPSoS (Information Quality for Cyber-Physical System-of-Systems), which contains various stereotypes and tagged values for modeling and analyzing IQ requirements for CPSoS. The profile also proposes a set of constraints expressed in the Object Constraint Language (OCL) to be used for the verification of such models. We evaluate our approach by developing a prototype implementation and test its applicability, usability, and validity for modeling and analyzing IQ requirements for a realistic scenario concerning a Tram system.

Privacy has emerged as a key concern for business and social computing as security breaches have compromised personal data for millions. Despite this, much of existing work on privacy requirements deal with them as a special case of security requirements, thereby missing essential traits of such requirements. In this context, wrong design decisions may be made due to an insufficient understanding of privacy. The main contribution of this paper is an ontology for privacy requirements that subsumes whatever proposals exist in the literature. The ontology was obtained through a systematic literature review concerning the literature on privacy, conducted in two phases, and followed by a consolidation phase where similar concepts were combined. The proposed ontology has been developed to be used by software engineers when dealing with privacy requirements, and since it is based on a systematic literature review, it is more comprehensive in coverage than all ontologies included in our systematic review. This constitutes a preliminary validity check for the comprehensiveness of our proposal, which needs to be complemented in the future with empirical validation through controlled studies.

Context Information Quality (IQ) is particularly important for organizations: they depend on information for managing their daily tasks and relying on low-quality information may negatively influence their overall performance. Despite this, the literature shows that most software development approaches do not consider IQ requirements during the system design, which leaves the system open to different kinds of vulnerabilities. Objective The main objective of this research is proposing a framework for modeling and analyzing IQ requirements for Socio-Technical Systems (STS). Method We propose STS-IQ, a goal-oriented framework for modeling and analyzing IQ requirements in their social and organizational context since the early phases of the system design. The framework extends and refines our previous work, and it consists of: (i) a modeling language that provides concepts and constructs for modeling IQ requirements; (ii) a set of analysis techniques that support the verification of the correctness and consistency of the IQ requirements model; (iii) a mechanism for deriving the final IQ specifications in terms of IQ policies; (iv) a methodology to assist software engineers during the system design; and (v) a CASE tool, namely STS-IQ Tool. Result We demonstrated the applicability, usefulness, and scalability of the modeling and reasoning techniques within a stock market case study, and we also evaluated the usability and utility of the framework with end-users. Conclusion We conclude that the STS-IQ framework supports the modeling and analysis of IQ requirements, and also the derivation of precise IQ specifications in terms of IQ policies. Therefore, we believe it has potential in practice.

Nowadays a timely detection of relevant events and an efficient recognition of objects in an environment is a critical activity for many Cyber-Physical Systems (CPS), which may have severe impact on citizens, infrastructures or the environment when incurring malfunctions. In the automotive domain, the detection and recognition of traffic signs (TSDR) from images was and is currently being investigated as it heavily impacts the behavior of (semi-)autonomous vehicles. Despite many classifiers and feature extraction strategies applied to images sampled by webcams installed on cars have been developed throughout the years, those efforts did not escalate into a clear benchmark nor comparison of the most common techniques on multiple datasets and feature sets. This study tackles this problem by providing a comprehensive quantitative comparison of traditional supervised Machine Learning algorithms with different feature sets and Deep Learning models for the recognition of traffic signs from three publicly available datasets. A perfect classification was achieved by many ML algorithms on the German GTRSB dataset, while with the BelgiumTSC and DITS datasets no algorithms provided perfect classification.

Nowadays, Machine Learning (ML) algorithms are being incorporated into many systems since they can learn and solve complex problems. Some of these systems can be considered as Safety-Critical Systems (SCS), therefore, the performance of ML algorithms should be sufficiently safe concerning the safety requirements of the incorporating SCS. However, the performance analysis of ML algorithms, usually, relies on metrics that were not developed with safety in mind. Accordingly, they may not be appropriate for assessing the performance of ML algorithms concerning safety. This paper debates on accounting for the distribution - not just the amount - of False Negatives as an additional element to be used when assessing ML algorithms to be integrated into SCS. We empirically try to assess the properness of incorporating ML-based components (anomaly-based intrusion detectors) into SCS using both traditional and novel SSPr and NPr metrics that focus on the numbers as well as the distribution of False Negatives. Results obtained by our experiment allow discussing the potential of ML-based components to be incorporated into SCS.