Search

The emerging field of visual analytics changes the way we model, gather, and analyze data. Current data analysis approaches suggest to gather as much data as possible and then focus on goal and process oriented data analysis techniques. Visual analytics changes this approach and the methodology to interpret the results becomes the key issue. This paper contributes with a method to interpret visual hierarchical heavy hitters (VHHHs). We show how to analyze data on the general level and how to examine specific areas of the data. We identify five common patterns that build the interpretation alphabet of VHHHs. We demonstrate our method on three different real world datasets and show the effectiveness of our approach.

Tag-Based Authorization (TBA) is a hybrid access control model that combines the ease of use of extensional access control models with the expressivity of logic-based formalisms. The main limitation of TBA is that it lacks support for policy administration. More precisely, it does not allow policy-writers to specify administrative policies that constrain the tags that users can assign, and to verify the compliance of assigned tags with these policies. In this paper we introduce TBA2 (Tag-Based Authorization & Administration), an extension of TBA that enables policy administration in distributed systems. We show that TBA2 is more expressive than TBA and than two reference administrative models proposed in the literature, namely HRU and ARBAC97.

Systems of systems are dynamic coalitions of distributed, autonomous and heterogeneous systems that collaborate to achieve a common goal. While offering several advantages in terms of scalability and flexibility, the systems of systems paradigm has a significant impact on systems interoperability and on the security requirements of the collaborating systems. In this chapter we introduce POLIPO, a security framework that protects the information exchanged among the systems in a system of systems, while preserving systems’ autonomy and interoperability. Information is protected from unauthorized access and improper modification by combining context-aware access control with trust management. Autonomy and interoperability are enabled by the use of ontology-based services. More precisely, each authority may refer to different ontologies to define the semantics of the terms used in the security policy of the system it governs and to describe domain knowledge and context information. A semantic alignment technique is then employed to map concepts from different ontologies and align the systems’ vocabularies. We demonstrate the applicability of our solution with a prototype implementation of the framework for a scenario in the maritime safety and security domain.

Systems of systems are coalitions of autonomous and heterogeneous systems that collaborate to achieve a common goal. The component systems of a system of systems often belong to different security domains, which are governed by different authorities (hereafter called parties). Furthermore, systems of systems are mostly dynamic, with systems joining and leaving a coalition at runtime. An example of system of systems is the anti-piracy operation headed by the European Union (EU) that is currently taking place in the Horn of Africa, which involves ships from different EU countries. The security challenges in systems of systems are different from those affecting centralized systems. In a dynamic, inter-organizational coalition of systems, parties might not "know" each other beforehand, might employ different data and organizational models and speak different languages. Nevertheless, they must be able to collaborate for the success of the coalition. We identify four main requirements that an access control framework for systems of systems should satisfy: (1) regulate the access to sensitive information exchanged within a coalition and protect the confidentiality of the collaborating parties’ security policies, (2) preserve the autonomy of parties in the choice of organizational models and vocabulary, and (3) guarantee interoperability among parties. In addition, (4) the framework must be easy to use and to deploy into existing systems of systems. Several security frameworks for systems of systems have been proposed in the literature. These frameworks can be divided into two categories: semantic frameworks and trust management (TM) frameworks. Semantic frameworks rely on ontologies for the specification of access control policies and the definition of domain knowledge and context information. This enables interoperability among parties at the cost of limiting the expressive power of the policy language, which does not allow the specification of several types of security constraints (e.g., separation of duty). On the other hand, TM frameworks rely on an attribute-based approach to access control where access decisions are based on digital certificates, called credentials. TM frameworks employ expressive policy languages to regulate the access to sensitive information. However, they either assume all parties in a system of systems to use the same vocabulary, or do not provide a mechanism to align different vocabularies. Furthermore, most TM frameworks compromise the confidentiality of the parties’ security policies in the process of deriving the credentials required for an access decision. Thus, none of the existing frameworks satisfies all the security requirements of systems of systems. In this thesis we present an access control framework for systems of systems satisfying all the aforementioned requirements. The framework regulates the access to sensitive information by combining context-aware access control models with TM. Autonomy and interoperability are enabled by the use of ontology-based services. More precisely, parties may refer to different ontologies in the specification of their policies and to describe domain knowledge and context information; this allows each party to employ the organizational model and terminology that they consider more appropriate within their system. A semantic alignment technique is then employed to align their vocabularies, allowing for mutual understanding. A novel distributed algorithm enables parties to derive the credentials required for an access decision without compromising the confidentiality of their policies. The applicability of the proposed framework is demonstrated by a prototype implementation for a scenario in the maritime safety and security domain. In the prototype, all components and services have been implemented following the serviceoriented architecture paradigm to facilitate their integration and deployment into existing systems of systems. The modularity of the framework allows for the integration of additional services to support the evaluation of policies and provide additional functionalities (e.g., a key performance indicator service). Even though our solution has been mainly tested in the maritime safety and security domain, its characteristics make it suitable for many other domains. For example, we have deployed a prototype implementation of the framework also in systems of systems in the e-health and the employability domains. Furthermore, the integration of the framework with ontology-based services makes it a valid candidate for the protection of information on the semantic web.

Trust Management (TM) is an approach to distributed access control where access decisions are based on policy statements issued by multiple principals and stored in a distributed manner. Most of the existing goal evaluation algorithms for TM either rely on a centralized evaluation strategy, which consists of collecting all the relevant policy statements in a single location (and therefore they do not guarantee the confidentiality of intensional policies), or do not detect the termination of the computation (i.e., when all the answers of a goal are computed). In this paper we present GEM, a distributed goal evaluation algorithm for TM systems. GEM detects termination in a completely distributed way without the need of disclosing intensional policies, thereby preserving their confidentiality. We demonstrate that the algorithm terminates and is sound and complete w.r.t. the standard semantics for logic programs.

This chapter presents VHHH: a visual data mining tool to compute and investigate hierarchical heavy hitters (HHHs) for two-dimensional data. VHHH computes the HHHs for a two-dimensional categorical dataset and a given threshold, and visualizes the HHHs in the three dimensional space. The chapter evaluates VHHH on synthetic and real world data, provides an interpretation alphabet, and identifies common visualization patterns of HHHs.