Lecture Notes in Computer Science Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen
Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Alfred Kobsa University of California, Irvine, CA, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen TU Dortmund University, Germany Madhu Sudan Microsoft Research, Cambridge, MA, USA Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Gerhard Weikum Max-Planck Institute of Computer Science, Saarbruecken, Germany
5966
Tomasz Janowski Hrushikesha Mohanty (Eds.)
Distributed Computing and Internet Technology 6th International Conference, ICDCIT 2010 Bhubaneswar, India, February 15-17, 2010 Proceedings
13
Volume Editors Tomasz Janowski Center for Electronic Governance United Nations University International Institute for Software Technology P.O. Box 3058, Macau E-mail:
[email protected] Hrushikesha Mohanty University of Hyderabad Department of Computer and Information Sciences Central University PO, AP, Hyderabad 500 046, India E-mail:
[email protected]
Library of Congress Control Number: 2009943913 CR Subject Classification (1998): C.2.4, D.4.2, D.4.3, D.4.7, H.2.4, H.5, K.6.5 LNCS Sublibrary: SL 3 – Information Systems and Application, incl. Internet/Web and HCI ISSN ISBN-10 ISBN-13
0302-9743 3-642-11658-2 Springer Berlin Heidelberg New York 978-3-642-11658-2 Springer Berlin Heidelberg New York
This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. springer.com © Springer-Verlag Berlin Heidelberg 2010 Printed in Germany Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper SPIN: 12984480 06/3180 543210
Preface
This volume contains the papers presented at the 6th International Conference on Distributed Computing and Internet Technology (ICDCIT 2010) held during February 15–17, 2010 in Bhubaneswar, India. The conference was organized by Kalinga Institute of Industrial Technology (KIIT) University, Bhubaneshwar, India, www.kiit.org, and co-organized by the Center for Electronic Governance at United Nations University - International Institute for Software Technology (UNU-IIST-EGOV), Macao, www.egov.iist.unu.edu. In the tradition of the ICDCIT conference series, ICDCIT 2010 welcomed presentations of research ideas and results in theory, methodology and applications of distributed computing and Internet technology. In addition, the conference emphasized that research in this area can play an important role in building a foundation for the development of e-Society Applications (e-Applications) and at the same time, that e-Applications can provide the relevance and context for such research. Establishing a connection between foundational and applied research in distributed systems and Internet technology with software and services that enable e-Applications was a key feature of ICDCIT 2010. A total of 91 papers were submitted for ICDCIT 2010. Each paper was reviewed by at least two members of the Program Committee or additional referees. As a result of the review process, 12 papers were accepted as long papers, 9 as short papers and 5 as extended abstracts. All accepted papers were divided into five categories— Networking, Grid Computing and Web Services, Internet Technology and Distributed Computing, Software Engineering and Secured Systems, and Societal Applications—and included as part of the proceedings. In addition, the conference enjoyed five invited talks by Jim Davies, Manish Gupta, Maurice Herlihy, Krithi Ramamritham and R. K. Shyamasundar, with four invited papers received. The current proceedings are divided into six corresponding sections: 1. Section 1 - Invited Papers includes four papers. The paper “Transactional Memory Today” by Maurice Herlihy presents the author’s perspective on the nature of the transactional memory mechanism and the problem it is expected to address. The paper “Maintaining Coherent Views over Dynamic Distributed Data” by Krithi Ramamritham presents a scalable technique for executing continuous queries over dynamic data while making sure that correct results are always presented to users. The paper “Malware: From Modelling to Practical Detection” by R.K. Shyamasundar, co-authored with Harshit Shah and N.V. Narendra Kumar, surveys a theory behind malware in order to identify the challenges behind its detection, and proposes a new approach to malware detection. The paper “Semantic Frameworks—Meanings in the Architecture” by Jim Davies, co-authored with Jeremy Gibbons,
VI
Preface
explains how the use of semantic technologies and model-driven engineering can greatly reduce the cost of consistency and coordination in software development, in system integration and in continuous interactions with users. 2. Section 2 - Networking comprises five papers. The paper “Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks” by Anuradha Banerjee and Paramartha Dutta proposes an intelligent multicast routing scheme that takes into account estimated network evolution in terms of residual energy, link stability, position of receivers in the multicast tree, etc. The paper “On Optimal Space Tessellation with Deterministic Deployment for Coverage in Three-Dimensional Wireless Sensor Networks” by Manas Kumar Mishra and M. M. Gore identifies a model for optimal coverage in three-dimensional wireless sensor networks, with the best trade-off between performance and the number of nodes. The paper “Seamless Handoff between IEEE 802.11 and GPRS Networks” by Dhananjay Kotwal Maushumi Barooah and Sukumar Nandi proposes a new scheme that provides seamless mobility between GPRS and IEEE 802.11 (WiFi) networks. The paper “A Tool to Determine Strategic Location and Ranges of Nodes for Optimum Deployment of Wireless Sensor Network” by Amrit Kumar, Mukul Kumar and Kumar Padmanabh describes a tool developed by the authors for strategic localization and optimization of wireless sensor networks. The paper “An Efficient Hybrid Data-Gathering Scheme in Wireless Sensor Networks” by Ayon Chakraborty, Swarup Kumar Mitra and M.K. Naskar proposes a new data-gathering scheme for remote wireless sensor networks that offers the best energy and delay performance compared with existing popular schemes. 3. Section 3 - Grid Computing and Web Services comprises five papers. The paper “Introducing Dynamic Ranking on Web Pages Based on Multiple Ontology Supported Domains” by Debajyoti Mukhopadhyay, Anirban Kundu and Sukanta Sinha proposes a data structure and a pair of algorithms for efficient ranking and retrieval of Web pages. The paper “Multi-criteria Service Selection with Optimal Stopping in Dynamic Service-Oriented Systems” by Oliver Skroch presents a service selection algorithm for dynamic service composition, which is optimized on service quality and cost. The paper “Template-Based Process Abstraction for Reusable Interorganizational Applications in RESTful Architecture” by Cheng Zhu, Hao Yu, Hongming Cai and Boyi Xu proposes a template-based mechanism to abstract the similarities between business processes based on REST (Representational State Transfer) architectures. The paper “Enhancing the Hierarchical Clustering Mechanism of Storing Resources Security Policies in a Grid Authorization System” by Mustafa Kaiiali, Rajeev Wankar, C.R. Rao and Arun Agarwal enhances the use of the hierarchical clustering mechanism to store security policies for the resources available on dynamically changing grids. The paper “A Framework for Web-Based Negotiation” by Hrushikesha Mohanty, Rajesh Kurra and R.K. Shyamasundar proposes a process view on Web-based negotiations, and presents an implementation framework for such processes.
Preface
VII
4. Section 4 - Internet Technology and Distributed Computing comprises seven papers. The paper “Performance Analysis of a Renewal Input Bulk Service Queue with Accessible and Non-accessible Batches” by Yesuf Obsie Mussa and P. Vijaya Laxmi conducts performance analysis of finite buffer queues with accessible and non-accessible batches wherein inter-arrival time of customers and service times of batches are, respectively, arbitrarily and exponentially distributed. The paper “A Distributed Algorithm for Pattern Formation by Autonomous Robots, with No Agreement on Coordinate Compass” by Swapnil Ghike and K. Mukhopadhyaya addresses the problem of coordinating a set of autonomous, mobile robots for cooperatively performing a task, proposing a distributed algorithm for pattern formation when no agreement exists on coordinate axes. The paper “Gathering Asynchronous Transparent Fat Robots” by Sruti Gan Chaudhuri and Krishnendu Mukhopadhyaya proposes a new distributed algorithm for gathering a set of n (n ≥ 5) autonomous, mobile robots into a small region, assuming that the robots are transparent in order to achieve full visibility. The paper “Development of Generalized HPC Simulator” by W. Hurst, S. Ramaswamy, R. Lenin and D. Hoffman presents preliminary efforts to design an open-source, adaptable, free-standing and extendible high-performance computer simulator. The paper “Performance Analysis of Finite Buffer Queueing System with Multiple Heterogeneous Servers” by C. Misra and P.K. Swain conducts performance analysis of a finite buffer steady-state queueing system for three heterogeneous servers. The paper “Finite Buffer Controllable Single and Batch Service Queues” by J.R. Mohanty conducts performance analysis of a finite buffer discrete-time single and batch service queueing system, based on the use of recursive methods. The paper “Enhanced Search in Peerto-Peer Networks Using Fuzzy Logic” by Sirish Kumar Balaga, Haribabu K and Chittaranjan Hota proposes a fuzzy logic-based lookup algorithm for peer-to-peer file sharing networks, where each node is assigned probabilities based on its content. 5. Section 5 - Software Engineering and Secured Systems comprises seven papers. The paper “UML-Compiler: A Framework for Syntactic and Semantic Verification of UML Diagrams” by Jayeeta Chanda, Ananya Kanjilal and Sabnam Sengupta proposes a UML compiler that takes a context-free grammar for UML diagrams, and verifies the syntactic correctness of individual diagrams and their consistency with other diagrams, focusing on class and sequence diagrams. The paper “Evolution of Hyperelliptic Curve Cryptosystems” by Kakali Chatterjee and Daya Gupta explores efficient methods for selecting secure hyperelliptic curve cryptosystems and for carrying out fast operations on them. The paper “Reliability Improvement Based on Prioritization of Source Code” by Mitrabinda Ray and Durga Prasad Mohapatra proposes a metric to compute the potential of an object to cause failures in an object-oriented program, in order to prioritize the testing of such objects depending on their criticality. The paper “Secure Dynamic Identity-Based Remote User Authentication Scheme” by Sandeep K. Sood, Anil K. Sarje
VIII
Preface
and Kuldip Singh demonstrates new vulnerabilities of a well-known scheme for efficient smart card-based remote user authentication, and proposes an improved scheme to address them. The paper “Theoretical Notes on Regular Graphs as Applied to Optimal Network Design” by Sanket Patil and Srinath Srinivasa presents some theoretical results concerning regular graphs and their applications to the problem of optimal network design. The paper “Formal Approaches to Location Management in Mobile Communications” by Juanhua Kang, Qin Li, Huibiao Zhu and Wenjuan Wu presents a formal model of mobile communication systems, and carries out formal analysis of two properties related to location management on it. The paper “Automated Test Scenario Selection Based on Levenshtein Distance” by Sapna P.G. and Hrushikesha Mohanty proposes a method for selecting test scenarios generated from UML activity diagrams using the Levenshtein distance. 6. Section 6 - Societal Applications comprises two papers. The paper “Study of Diffusion Models in an Academic Social Network” by Vasavi Junapudi, Gauri K. Udgata and Siba K. Udgata proposes a framework for determining the influence of nodes in an academic social network, and the spread of such influence. The paper “First Advisory and Real-Time Health Surveillance to Reduce Maternal Mortality Using Mobile Technology” by Satya Swarup Samal, Arunav Mishra, Sidheswar Samal, J.K. Pattnaik and Prachet Bhuyan presents a risk assessment method to provide advisory and referral services to patients in rural areas through SMS or WAP devices. Many people and organizations contributed to the ICDCIT 2010 conference. We wish to thank Achuyta Samanta, Founder, KIIT University, for his continuing support of the conference. We also wish to thank the General Co-chairs and all members of the Advisory and Conference Committees for their support and help at various stages of the conference. Our most sincere thanks go to the Program Committee and additional reviewers whose cooperation in carrying out quality reviews was critical for establishing a strong conference program. We express our sincere thanks to the invited speakers—Jim Davies, Manish Gupta, Maurice Herlihy, Krithi Ramamritham and R. K. Shyamasundar—for their contributions to the program. We also sincerely thank Rilwan Basanya for his help in the editing process. We are particularly grateful for the financial and logistics support of KIIT University and UNU-IIST for hosting the conference, and we acknowledge the provision of infrastructural support to carry out this editorial work by the University of Hyderabad and UNU-IIST. We also remember, with gratitude, the assistance provided by our students: Supriya Vaddi, Rajesh Kurra and Venkatswamy. Lastly, we would like to thank Springer for publishing the ICDCIT proceedings in its Lecture Notes in Computer Science series. February 2010
Tomasz Janowski Hrushikesha Mohanty
Organization
ICDCIT 2010 was organized by Kalinga Institute of Industrial Technology (KIIT) University, Bhubaneshwar, India, www.kiit.org, and co-organized by the Center for Electronic Governance at United Nations University - International Institute for Software Technology (UNU-IIST-EGOV), Macao, www.egov.iist.unu.edu.
Patrons Achuyta Samanta
KIIT University, India
Advisory Committee Maurice Herlihy Gerard Huet David Peleg R.K. Shyamasundar
Brown University, USA INRIA, France Weizmann Institute of Science, Israel TIFR, India
Conference Committee Jim Davies S. C. De Sarkar Tomasz Janowski Hrushikesha Mohanty D. N. Dwivedy Samaresh Mishra Animesh Tripathy
University of Oxford, UK KIIT University, India United Nations University, Macao University of Hyderabad, India KIIT University, India KIIT University, India KIIT University, India
General Co-chair General Co-chair Program Co-chair Program Co-chair Finance Chair Organization Chair Publicity Chair
Program Committee Arun Agarwal Rahul Banerjee Nikolaj Bjorner Goutam Chakraborty Antonio Cerone Venkatesh Choppella Mainak Chaudhuri Yannis Charalabidis Zamira Dzhusupova Gillan Dobbie Elsa Estevez Simeon Fong
University of Hyderabad, India BITS Pilani, India Microsoft Corporation, USA Iwate Pref. University, Japan United Nations University, Macao IIITM-K Thiruvananthapuram, India IIT, Kanpur, India National Technical University of Athens, Greece United Nations University, Macao Univeristy of Auckland, New Zealand United Nations University, Macao University of Macau, Macao
X
Organization
Pablo Fillottrani N. Ganguly Manoj M Gore Veena Goswami Diganta Goswami Manish Gupta Steve Harris Chittaranjan Hota Dang Van Hung Kamal Karlapalem Michiharu Kudo Sandeep Kulakarni Vijay Kumar Ralf Klischewski Padmanabhan Krishnan Euripidis Loukis Anirban Mahanti Sanjay Madria Rajib Mall Pramod K Meher Debajyoti Mukhopadhyay G.B. Mund Sagar Naik Adegboyega Ojo Manas Ranjan Patra Srinivas Padmanabhuni Radha Krishna Pisipati Anupama Potluri Sirni Ramaswamy R. Ramanujam Abhik Roychoudhury V.N. Sastry Vivek Sarkar Pallab Saha Jaydip Sen Ashutosh Saxena Andrzej Szepietowski Maurice Tchuente A. Min Tjoa O.P. Vyas Krzysztof Walkowiak
Universidad Nacional del Sur, Argentina IIT, Kharagpur, India MNIT, Allahabad, India KIIT University, India IIT, Guwahati, India IBM Research Lab, India University of Oxford, UK BITS Pilani, India Vietnam National University, Vietnam IIIT Hyderabad, India IBM Research, Japan Michigan State University, USA University of Missouri - Kansas City, USA German University in Cairo, Egypt Bond University, Australia University of the Aegean, Greece NCIT, Australia Missouri Univ. of Science and Technology, USA IIT Kharagpur, India NTU, Singapore Calcutta Business School, India KIIT University, India University of Waterloo, Canada United Nations University, Macao Berhampur University, India Infosys, India Infosys, India University of Hyderabad, India University of Arkansas, USA IMSC Chennai, India National University of Singapore, Singapore IDRBT, India Rice University, USA National University of Singapore, Singapore TCS, India Infosys, India University of Gdansk, Poland University of Yaounde I, Cameroon Vienna University of Technology, Austria Ravishankar University, India Wroclaw University of Technology, Poland
Organization
Additional Referees Prasant K. Pattnaik Srinivas Prasad Surampudi Bapi Raju C. Raghavendra Rao
Tripathy Somanath Ashok Singh Siba K. Udgata
XI
Table of Contents
Section 1 – Invited Papers Transactional Memory Today . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Maurice Herlihy
1
Maintaining Coherent Views over Dynamic Distributed Data . . . . . . . . . . Krithi Ramamritham
13
Malware: From Modelling to Practical Detection . . . . . . . . . . . . . . . . . . . . . R.K. Shyamasundar, Harshit Shah, and N.V. Narendra Kumar
21
Semantic Frameworks—Meanings in the Architecture . . . . . . . . . . . . . . . . . Jim Davies and Jeremy Gibbons
40
Section 2 – Networking Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Anuradha Banerjee and Paramartha Dutta
55
On Optimal Space Tessellation with Deterministic Deployment for Coverage in Three-Dimensional Wireless Sensor Networks . . . . . . . . . . . . . Manas Kumar Mishra and M.M. Gore
72
Seamless Handoff between IEEE 802.11 and GPRS Networks . . . . . . . . . . Dhananjay Kotwal, Maushumi Barooah, and Sukumar Nandi
84
A Tool to Determine Strategic Location and Ranges of Nodes for Optimum Deployment of Wireless Sensor Network . . . . . . . . . . . . . . . . . . . Amrit Kumar, Mukul Kumar, and Kumar Padmanabh
91
An Efficient Hybrid Data-Gathering Scheme in Wireless Sensor Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Ayon Chakraborty, Swarup Kumar Mitra, and M.K. Naskar
98
Section 3 – Grid Computing and Web Services Introducing Dynamic Ranking on Web Pages Based on Multiple Ontology Supported Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Debajyoti Mukhopadhyay, Anirban Kundu, and Sukanta Sinha
104
Multi-criteria Service Selection with Optimal Stopping in Dynamic Service-Oriented Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Oliver Skroch
110
XIV
Table of Contents
Template-Based Process Abstraction for Reusable Inter-organizational Applications in RESTful Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cheng Zhu, Hao Yu, Hongming Cai, and Boyi Xu
122
Enhancing the Hierarchical Clustering Mechanism of Storing Resources’ Security Policies in a Grid Authorization System . . . . . . . . . . . . . . . . . . . . . Mustafa Kaiiali, Rajeev Wankar, C.R. Rao, and Arun Agarwal
134
A Framework for Web-Based Negotiation . . . . . . . . . . . . . . . . . . . . . . . . . . . Hrushikesha Mohanty, Rajesh Kurra, and R.K. Shyamasundar
140
Section 4 – Internet Technology and Distributed Computing Performance Analysis of a Renewal Input Bulk Service Queue with Accessible and Non-accessible Batches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Yesuf Obsie Mussa and P. Vijaya Laxmi
152
A Distributed Algorithm for Pattern Formation by Autonomous Robots, with No Agreement on Coordinate Compass . . . . . . . . . . . . . . . . . Swapnil Ghike and Krishnendu Mukhopadhyaya
157
Gathering Asynchronous Transparent Fat Robots . . . . . . . . . . . . . . . . . . . . Sruti Gan Chaudhuri and Krishnendu Mukhopadhyaya
170
Development of Generalized HPC Simulator . . . . . . . . . . . . . . . . . . . . . . . . . W. Hurst, S. Ramaswamy, R. Lenin, and D. Hoffman
176
Performance Analysis of Finite Buffer Queueing System with Multiple Heterogeneous Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C. Misra and P.K. Swain
180
Finite Buffer Controllable Single and Batch Service Queues . . . . . . . . . . . J.R. Mohanty
184
Enhanced Search in Peer-to-Peer Networks Using Fuzzy Logic . . . . . . . . . Sirish Kumar Balaga, K. Haribabu, and Chittaranjan Hota
188
Section 5 – Software Engineering: Secured Systems UML-Compiler: A Framework for Syntactic and Semantic Verification of UML Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Jayeeta Chanda, Ananya Kanjilal, and Sabnam Sengupta
194
Evolution of Hyperelliptic Curve Cryptosystems . . . . . . . . . . . . . . . . . . . . . Kakali Chatterjee and Daya Gupta
206
Reliability Improvement Based on Prioritization of Source Code . . . . . . . Mitrabinda Ray and Durga Prasad Mohapatra
212
Table of Contents
XV
Secure Dynamic Identity-Based Remote User Authentication Scheme . . . Sandeep K. Sood, Anil K. Sarje, and Kuldip Singh
224
Theoretical Notes on Regular Graphs as Applied to Optimal Network Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Sanket Patil and Srinath Srinivasa
236
Formal Approaches to Location Management in Mobile Communications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Juanhua Kang, Qin Li, Huibiao Zhu, and Wenjuan Wu
243
Automated Test Scenario Selection Based on Levenshtein Distance . . . . . Sapna P.G. and Hrushikesha Mohanty
255
Section 6 – Societal Applications Study of Diffusion Models in an Academic Social Network . . . . . . . . . . . . . Vasavi Junapudi, Gauri K. Udgata, and Siba K. Udgata First Advisory and Real-Time Health Surveillance to Reduce Maternal Mortality Using Mobile Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Satya Swarup Samal, Arunav Mishra, Sidheswar Samal, J.K. Pattnaik, and Prachet Bhuyan Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
267
279
283
Transactional Memory Today Maurice Herlihy Computer Science Department Brown University Providence, RI USA 02912
Abstract. The term “Transactional Memory” was coined back in 1993, but even today, there is a vigorous debate about what it means and what it should do. This debate sometimes generates more heat than light: terms are not always well-defined and criteria for making judgments are not always clear. This article will try to impose some order on the conversation. TM itself can encompass hardware, software, speculative lock elision, and other mechanisms. The benefits sought encompass simpler implementations of highly-concurrent data structures, better software engineering for concurrent platforms and enhanced performance.
1
Introduction
In 1993, Eliot Moss and I wrote a paper entitled Transactional Memory: Architectural Support for Lock-Free Data Structures, which appeared in that year’s International Symposium on Computer Architecture (ISCA) [16]. This paper mostly passed unnoticed. As illustrated in Figure 1, it had few citations for the next ten years. Then, around 2005, something changed. Today, a Googletm search for “Transactional Memory” yields about 80,000 hits, while Bingtm yields about 2.7 million hits. This article addresses two questions: what transactional memory (TM) is, and which problems it is expected to address. This article reflects the author’s opinions only. It makes no pretense of being objective, nor of providing a comprehensive survey of current work. Readers interested in up-to-date transactional memory research should consult the Transactional Memory Online web page at: http://www.cs.wisc.edu/trans-memory/
2
Background
The major chip manufacturers have, for the time being, given up trying to make processors run faster. Moore’s law has not been repealed: each year, more and more transistors fit into the same space, but their clock speed cannot be increased without overheating. Instead, attention has turned toward chip multiprocessing (CMP), in which multiple computing cores are included on each processor chip.
Supported by NSF Grant 0811289.
T. Janowski and H. Mohanty (Eds.): ICDCIT 2010, LNCS 5966, pp. 1–12, 2010. c Springer-Verlag Berlin Heidelberg 2010
2
M. Herlihy
Fig. 1. Yearly citation count for Herlihy and Moss [16]
In the medium term, advances in technology will provide increased parallelism, but not increased single-thread performance. As a result, system designers and software engineers can no longer rely on increasing clock speed to hide software bloat. Instead, they must learn to make more effective use of increasing parallelism. This adaptation will not be easy. In today’s programming practices, programmers typically rely on combinations of locks and conditions, such as monitors, to prevent concurrent access by different threads to the same shared data. While this approach allows programmers to treat sections of code as “atomic”, and thus simplifies reasoning about interactions, it suffers from a number of severe shortcomings. First, programmers must decide between coarse-grained locking, in which a large data structure is protected by a single lock, and fine-grained locking, in which a lock is associated with each component of the data structure. Coarsegrained locking is simple, but permits little or no concurrency, thereby preventing the program from exploiting multiple processing cores. By contrast, fine-grained locking is substantially more complicated because of the need to ensure that threads acquire all necessary locks (and only those, for good performance), and because of the need to avoid deadlock when acquiring multiple locks. The decision is further complicated by the fact that the best engineering solution may be platform-dependent, varying with different machine sizes, workloads, and so on, making it difficult to write code that is both scalable and portable. Second, conventional locking provides poor support for code composition and reuse. For example, consider a lock-based queue that provides atomic enq() and
Transactional Memory Today
3
deq() methods. Ideally, it should be easy to move an element atomically from one queue to another, but this kind of composition simply does not work. If the queue methods synchronize internally, then there is no way to acquire and hold both locks simultaneously. If the queues export their locks, then modularity and safety are compromised. Finally, such basic issues as the mapping from locks to data, that is, which locks protect which data, and the order in which locks must be acquired and released, are all based on convention, and violations are notoriously difficult to detect and debug. For these and other reasons, today’s software practices make concurrent programs too difficult to develop, debug, understand, and maintain.
3
Transactional Model
A transaction is a sequence of steps executed by a single thread. Transactions are atomic: each transaction either commits (it takes effect) or aborts (its effects are discarded). Transactions are linearizable [17]: they appear to take effect in a oneat-a-time order. Transactional memory (TM) supports a computational model in which each thread announces the start of a transaction, executes a sequence of operations on shared objects, and then tries to commit the transaction. If the commit succeeds, the transaction’s operations take effect; otherwise, they are discarded. Sometimes we refer to these transactions as memory transactions. Memory transactions satisfy the same formal serializability and atomicity properties as the transactions used in conventional database systems, but they are intended to address different problems. Unlike database transactions, memory transactions are short-lived activities that access a relatively small number of objects in primary memory. Database transactions are persistent : when a transaction commits, its changes are backed up on a disk. Memory transactions need not be persistent, and involve no explicit disk I/O. To illustrate why memory transactions are attractive from a software engineering perspective, consider the problem of constructing a concurrent FIFO queue that permits one thread to enqueue items at the tail of the queue at the same time another thread dequeues items from the head of the queue, at least while the queue is non-empty. Any problem so easy to state, and that arises so naturally in practice, should have an easily-devised, understandable solution. In fact, solving this problem with locks is quite difficult. In 1996, Michael and Scott published a clever and subtle solution [24]. It speaks poorly for fine-grained locking as a methodology that solutions to such simple problems are challenging enough to be publishable. By contrast, it is almost trivial to solve this problem using transactions. Figure 2 shows how the queue’s enqueue method might look in a language that provides direct support for transactions (for example, see Harris [13]). It consists of little more than enclosing sequential code in a transaction block. In practice, of course, a complete implementation would include more details (such as how to
4
M. Herlihy
class Queue
{ QNode head; Qnode tail ; public void enq(T x) { atomic { Qnode q = new Qnode(x); tail . next = q; tail = q; } } ... } Fig. 2. Transactional queue code fragment
respond to an empty queue), but even so, this concurrent queue implementation is a remarkable achievement: it is not, by itself, a publishable result.
4
Hardware Transactional Memory
Most hardware transaction memory (HTM) proposals are based on straightforward modifications to standard multiprocessor cache-coherence protocols. When a thread reads or writes a memory location on behalf of a transaction, that cache entry is flagged as being transactional. Transactional writes are accumulated in the cache or write buffer, but are not written back to memory while the transaction is active. If another thread invalidates a transactional entry, a data conflict has occurred, that transaction is aborted and restarted. If a transaction finishes without having had any of its entries invalidated, then the transaction commits by marking its transactional entries as valid or as dirty, and allowing the dirty entries to be written back to memory in the usual way. 4.1
Unbounded HTM
One limitation of HTM is that in-cache transactions are limited in size and scope. Most hardware transactional memory proposals require programmers to be aware of platform-specific resource limitations such as cache and buffer sizes, scheduling quanta, and the effects of context switches and process migrations. Different platforms provide will different cache sizes and architectures, and cache sizes are likely to change over time. Transactions that exceed resource limits or are repeatedly interrupted will never commit. Ideally, programmers should be shielded from such complex, platform-specific details. Instead, TM systems should provide full support even for transactions that cannot execute directly in hardware. Techniques that substantially increase the size of hardware transactions include signatures [32] and permissions-only caches [3]. Other proposals support
Transactional Memory Today
5
(effectively) unbounded transactions by allowing transactional metadata to overflow caches, and for transactions to migrate from one core to another. These proposals include TCC [12], VTM [28], OneTM [3], UTM [1], TxLinux [29], and LogTM [32].
5
Software Transactional Memory
An alternative to providing direct hardware support for TM is to provide software transactional memory (STM), a software system that provides programmers with a transactional model. In this section, we describe some of the questions that arise when designing an STM system. Some of these questions concern semantics, that is, how the STM behaves, and other concern implementation, that is, how the STM is structured internally. 5.1
Weak vs. Strong Isolation
How should threads that execute transactions interact with threads executing non-transactional code? One possibility is strong isolation [4] (sometimes called strong atomicity), which guarantees that transactions are atomic with respect to non-transactional accesses. The alternative, weak isolation (or weak atomicity), makes no such guarantees. HTM systems naturally provide strong atomicity. For STM systems, however, strong isolation may be too expensive. The distinction between strong and weak isolation leaves unanswered a number of other questions about STM behavior. For example, what does it mean for an unhandled exception to exit an atomic block? What does I/O mean if executed inside a transaction? One appealing approach is to say that transactions behave as if they were protected by a single global lock (SGL) [21,23,12]. One limitation of the SGL semantics is that it does not specify the behavior of zombie transactions, transactions that are doomed to abort because of synchronization conflicts, but continue to run for some duration before the conflict is discovered. In some STM implementations, zombie transactions may see an inconsistent state before aborting. When a zombie aborts, its effects are rolled back, but while it runs, observed inconsistencies could provoke it to pathological behavior that may be difficult for the STM system to protect against, such as dereferencing a null pointer or entering an infinite loop. Opacity [11] is a correctness condition that guarantees that all uncommitted transactions, including zombies, see consistent states. 5.2
Eager vs. Lazy Update
There are two basic ways to organize transactional data. In an eager update system, the data objects are modified in place, and the transaction maintains an undo log allowing it to undo its changes if it aborts. The dual approach is lazy (or deferred) update, where each transaction computes optimistically on its local copy of the data, installing the changes if it commits, and discarding them if it aborts. An eager system makes committing a transaction more efficient, but makes it harder to ensure that zombie transactions see consistent states.
6
5.3
M. Herlihy
Eager vs. Lazy Conflict Detection
STM systems differ according to when they detect conflicts. In eager conflict detection schemes, conflicts are detected before they arise. When one transaction is about to create a conflict with another, it may consult a contention manager, defined below, to decide whether to pause, giving the other transaction a chance to finish, or to proceed and cause the other to abort. By contrast a lazy conflict detection scheme detects conflicts when a transaction tries to commit. Eager detection may abort transactions that could have committed lazily, but lazy detection discards more computation, because transactions are aborted later. 5.4
Contention Managers
In many STM proposals, conflict resolution is the responsibility of a contention manager [15] module. Two transactions conflict if they access the same object and one access is a write. If one transaction discovers it is about to conflict with another, then it can pause, giving the other a chance to finish, or it can proceed, forcing the other to abort. Faced with this decision, the transaction consults a contention management module that encapsulates the STM’s conflict resolution policy. The literature includes a number of contention manager proposals [10,15,19,2], ranging from exponential backoff to priority-based schemes. Empirical studies have shown that the choice of a contention manager algorithm can affect transaction throughput, sometimes substantially. 5.5
Visible vs. Invisible Reads
Early STM systems [15] used either invisible reads, in which each transaction maintains per-read metadata to be revalidated after each subsequent read, or visible reads, in which each reader registers its operations in shared memory, allowing a conflicting writer to identify when it is about to create a conflict. Invisible read schemes are expensive because of the need for repeated validation, while visible read schemes were complex, expensive, and not scalable. More recent STM systems such as TL2 [9] or SKYSTM [22] use a compromise solution, called semi-visible reads, in which read operations are tracked imprecisely. Semi-visible reads conservatively indicate to the writer that a read-write conflict might exist, avoiding expensive validation in the vast majority of cases. 5.6
Privatization
It is sometimes useful for a thread to privatize [31] a shared data structure by making it inaccessible to other threads. Once the data structure has been privatized, the owning thread can work on the data structure directly, without incurring synchronization costs. In principle, privatization works correctly under SGL semantics, in which every transaction executes as if it were holding a “single global lock”. Unfortunately, care is required to ensure that privatization works correctly. Here are two possible hazards. First, the thread that privatizes the
Transactional Memory Today
7
data data structure must observe all all changes made to that data by previously committed transactions, which is not necessarily guaranteed in an STM system where updates are lazy. Second, a doomed (“zombie”) transaction must not be allowed to perform updates to the data structure after it has been privatized.
6
Motivation
Reading the TM literature, it becomes clear that TM is used to address three distinct problems: first, a simple desire to make highly-concurrent data structures easy to implement; second, a more ambitious desire to support well-structured large-scale concurrent programs; and third, a pragmatic desire to make conventional locking more concurrent. We will examine each of these areas in turn. 6.1
Lock-Free Data Structures
A data structure is lock-free if it guarantees that infinitely often some method call finishes in a finite number of steps, even if some subset of the threads halt in arbitrary places. A data structure that relies on locking cannot be lock-free because a thread that acquires a lock and then halts can prevent non-faulty threads from making progress. Lock-free data structures are often awkward to implement using today’s architectures which typically rely on compare-and-swap for synchronization. The compare-and-swap instruction takes three arguments, and address a, an expected value e, and an update value u. If the value stored at a is equal to e, then it is atomically replaced with u, and otherwise it is unchanged. Either way, the instruction sets a flag indicating whether the value was changed. Often, the most natural way to define a lock-free data structure is to make an atomic change to several fields. Unfortunately, because compare-and-swap allows only one word (or perhaps a small number of contiguous words) to be changed atomically, designers of lock-free data structures are forced to introduce complex multi-step protocols or additional levels of indirection that create unwelcome overhead and conceptual complexity. The original TM paper [16] was primarily motivated by a desire to circumvent these restrictions. 6.2
Software Engineering
TM is appealing as a way to help programmers structure concurrent programs because it allows the programmer to focus on what the program should be doing, rather than on the detailed synchronization mechanisms needed. For example, TM relieves the programmer of tasks such as devising specialized locking protocols for avoiding deadlocks, and conventions associating locks with data. A number of programming languages and libraries have emerged to support TM. These include Clojure [18], .Net [7], Haskell [14]. Java [20,25], C++ [6], and others. Several groups have reported experiences converting programs from locks to TM. The TxLinux [29] project replaced most of the locks in the Linux kernel with
8
M. Herlihy
transactions. Syntactically, each transaction appears to be a lock-based critical section, but that code is executed speculatively as a transaction (see Section 6.3). If an I/O call is detected, the transaction is rolled back and restarted using locks. Using transactions primarily as an alternative way to implement locks minimized the need to rewrite and restructure the original application. Damron et al. [8] transactionalized the Berkeley DB lock manager. They found the transformation more difficult than expected because simply changing critical sections into atomic blocks often resulted in a disappointing level of concurrency. Critical sections often shared data unnecessarily, usually in the form of global statistics or shared memory pools. Later on, we will see other work that reinforces the notion the need to avoid gratuitous conflicts means that concurrent transactional programs must be structured differently than concurrent lock-based programs. Pankratius et al. [26] conducted a user study where twelve students, working in pairs, wrote a parallel desktop search engine. Three randomly-chosen groups used a compiler supporting TM, and three used conventional locks. The best TM group were much faster to produce a prototype, the final program performed substantially better, and they reported less time spent on debugging. However, the TM teams found performance harder to predict and to tune. Overall, the TM code was deemed easier to understand, but the TM teams did still make some synchronization errors. Rossbach et al. [30] conducted a user study in which 147 undergraduates implemented the same programs using coarse-grained and fine-grained locks, monitors, and transactions. Many students reported they found transactions harder to use than coarse-grain locks, but slightly easier than fine-grained locks. Code inspection showed that students using transactions made many fewer synchronization errors: over 70% of students made errors with fine-grained locking, while less than 10% made errors using transactions. 6.3
Lock Elision
Transactions can also be used as a way to implement locking. In lock elision [27], when a thread requests a lock, rather than waiting to acquire that lock, the thread starts a speculative transaction. If the transaction commits, then the critical section is complete. If the transaction aborts because of a synchronization conflict, then the thread can either retry the transaction, or it can actually acquire the lock. Here is why lock elision is attractive. Locking is conservative: a thread must acquire a lock if it might conflict with another thread, even if such conflicts are rare. Replacing lock acquisition with speculative execution enhances concurrency if actual conflicts are rare. If conflicts persist, the thread can abandon speculative execution and revert to using locks. Lock elision has the added advantage that it does not require code to be restructured. Indeed, it can often be made to work with legacy code. Azul Systems [5] has a JVM that uses (hardware) lock elision for contended Java locks, with the goal of accelerating “dusty deck” Java programs. The run-
Transactional Memory Today
9
time system keeps track of how well the HTM is doing, and decides when to use lock elision and when to use conventional locks. The results work well for some applications, modestly well for others, and poorly for a few. The principal limitation seems to be the same as observed by Damron et al. [8]: many critical sections are written in a way that introduces gratuitous conflicts, usually by updating performance counters. Although these are not real conflicts, the HTM has no way to tell. Rewriting such code can be effective, but requires abandoning the goal of speeding up “dusty deck” programs.
7
Conclusions
Over time, transactional memory has been the subject of various criticisms. One criticism is that STM systems are too inefficient. While it is true that early STM systems had high overhead, they have improved substantially, and it remains to be seen how efficient they will eventually become. In the long run, the advent of HTM may help speed up STM, the same way hardware assists helped to speed up virtual memory. Another criticism is that TM requires writing in a different style than the one programmers are used to. This claim is supported by the evidence, described above, that it is not always easy to convert lock-based programs to use transactions because lock-based programs often contain gratuitous data conflicts. Nevertheless, such conversion does provide benefits in some cases, and user studies
Fig. 3. The Gartner Hype Cycle
10
M. Herlihy
suggest that moving forward, transactional programs may be easier to write correctly than lock-based programs. Many of the criticisms directed toward TM can be explained by the “Gartner Hype Cycle” illustrated schematically in Figure 31 . At the “technology trigger”, the community becomes aware of an idea. At the “peak of Inflated Expectations”, the promise of the idea generates unrealistic expectations. When problems and limitations emerge, and the idea fails to meet these expectations, the “trough of disillusionment” generates a reaction. Researchers quietly continue to develop the idea and address these problems during the “slope of enlightenment.” Finally, an idea reaches the “plateau of productivity” as its benefits become demonstrated and accepted. Today, I think TM is half-way up the slope of enlightenment.
References 1. Ananian, C.S., Asanovi´c, K., Kuszmaul, B.C., Leiserson, C.E., Lie, S.: Unbounded transactional memory. In: Proceedings of the 11th International Symposium on High-Performance Computer Architecture (HPCA 2005), San Franscisco, CA, February 2005, pp. 316–327 (2005) 2. Attiya, H., Epstein, L., Shachnai, H., Tamir, T.: Transactional contention management as a non-clairvoyant scheduling problem. In: PODC 2006: Proceedings of the twenty-fifth annual ACM symposium on Principles of distributed computing, pp. 308–315. ACM, New York (2006) 3. Blundell, C., Devietti, J., Lewis, E.C., Martin, M.: Making the fast case common and the uncommon case simple in unbounded transactional memory. In: International Symposium on Computer Architecture (June 2007) 4. Blundell, C., Lewis, E.C., Martin, M.M.K.: Deconstructing transactions: The subtleties of atomicity. In: Fourth Annual Workshop on Duplicating, Deconstructing, and Debunking (June 2005) 5. Click, C.: Experiences with hardware transactional memory, http://blogs.azulsystems.com/cliff/2009/02/and-now-some-hardwaretransactional-memory-comments.html 6. Corporation, I.: C++ stm compiler, http://software.intel.com/en-us/articles/intel-c-stm-compilerprototype-edition-20/ 7. Corporation, M.: Stm.net, http://msdn.microsoft.com/en-us/devlabs/ee334183.aspx 8. Damron, P., Fedorova, A., Lev, Y., Luchangco, V., Moir, M., Nussbaum, D.: Hybrid transactional memory. In: ASPLOS-XII: Proceedings of the 12th international conference on Architectural support for programming languages and operating systems, pp. 336–346. ACM, New York (2006) 9. Dice, D., Shalev, O., Shavit, N.: Transactional locking ii. In: Proc. of the 20th Intl. Symp. on Distributed Computing (2006) 10. Guerraoui, R., Herlihy, M., Pochon, B.: Toward a theory of transactional contention managers. In: PODC 2005: Proceedings of the twenty-fourth annual ACM symposium on Principles of distributed computing, pp. 258–264. ACM, New York (2005) 1
Image from http://en.wikipedia.org/wiki/Hype cycle
Transactional Memory Today
11
11. Guerraoui, R., Kapalka, M.: On the correctness of transactional memory. In: PPoPP 2008: Proceedings of the 13th ACM SIGPLAN Symposium on Principles and practice of parallel programming, pp. 175–184. ACM, New York (2008) 12. Hammond, L., Carlstrom, B.D., Wong, V., Hertzberg, B., Chen, M., Kozyrakis, C., Olukotun, K.: Programming with transactional coherence and consistency (TCC). ACM SIGOPS Operating Systems Review 38(5), 1–13 (2004) 13. Harris, T., Fraser, K.: Language support for lightweight transactions. In: Proceedings of the 18th ACM SIGPLAN conference on Object-oriented programing, systems, languages, and applications (OOPSLA 2003), pp. 388–402. ACM Press, New York (2003) 14. Harris, T., Marlow, S., Peyton-Jones, S., Herlihy, M.: Composable memory transactions. In: PPoPP 2005: Proceedings of the tenth ACM SIGPLAN symposium on Principles and practice of parallel programming, pp. 48–60. ACM, New York (2005) 15. Herlihy, M., Luchangco, V., Moir, M., Scherer, W.: Software transactional memory for dynamic-sized data structures. In: Symposium on Principles of Distributed Computing (July 2003) 16. Herlihy, M., Moss, J.E.B.: Transactional memory: Architectural support for lockfree data structures. In: International Symposium on Computer Architecture (May 1993) 17. Herlihy, M.P., Wing, J.M.: Linearizability: a correctness condition for concurrent objects. ACM Transactions on Programming Languages and Systems (TOPLAS) 12(3), 463–492 (1990) 18. Hickey, R.: The clojure programming language. In: DLS 2008: Proceedings of the 2008 symposium on Dynamic languages, pp. 1–1. ACM, New York (2008) 19. Scherer III, W.N., Scott, M.L.: Contention management in dynamic software transactional memory. In: PODC Workshop on Concurrency and Synchronization in Java Programs (2004) 20. Korland, G.: Deuce stm, http://www.deucestm.org/ 21. Larus, J.R., Rajwar, R.: Transactional Memory. Morgan and Claypool (2006) 22. Lev, Y., Luchangco, V., Marathe, V., Moir, M., Nussbaum, D., Olszewski, M.: Anatomy of a scalable software transactional memory. In: TRANSACT 2009 (2009) 23. Menon, V., Balensiefer, S., Shpeisman, T., Adl-Tabatabai, A.-R., Hudson, R.L., Saha, B., Welc, A.: Single global lock semantics in a weakly atomic stm. SIGPLAN Not. 43(5), 15–26 (2008) 24. Michael, M.M., Scott, M.L.: Simple, fast, and practical non-blocking and blocking concurrent queue algorithms. In: PODC, pp. 267–275. ACM Press, New York (1996) 25. S. Microsystems. Dstm2, http://www.sun.com/download/products.xml?id=453fb28e 26. Pankratius, V., Adl-Tabatabai, A.-R., Otto, F.: Does transactional memory keep its promises? results from an empirical study. Technical Report 2009-12, University of Karlsruhe (September 2009) 27. Rajwar, R., Goodman, J.R.: Speculative lock elision: enabling highly concurrent multithreaded execution. In: MICRO 34: Proceedings of the 34th annual ACM/IEEE international symposium on Microarchitecture, Washington, DC, USA, pp. 294–305. IEEE Computer Society, Los Alamitos (2001) 28. Rajwar, R., Herlihy, M., Lai, K.: Virtualizing Transactional Memory. In: International Symposium on Computer Architecture (June 2005)
12
M. Herlihy
29. Rossbach, C.J., Hofmann, O.S., Porter, D.E., Ramadan, H.E., Aditya, B., Witchel, E.: Txlinux: using and managing hardware transactional memory in an operating system. In: SOSP 2007: Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles, pp. 87–102. ACM, New York (2007) 30. Rossbach, C.J., HofmannD, O.S., Witchel, E.: Is transactional memory programming actually easier? In: Proceedings of the 8th Annual Workshop on Duplicating, Deconstructing, and Debunking (WDDD) (June 2009) 31. Spear, M.F., Marathe, V.J., Dalessandro, L., Scott, M.L.: Privatization techniques for software transactional memory. In: PODC 2007: Proceedings of the twentysixth annual ACM symposium on Principles of distributed computing, pp. 338–339. ACM, New York (2007) 32. Yen, L., Bobba, J., Marty, M.R., Moore, K.E., Volos, H., Hill, M.D., Swift, M.M., Wood, D.A.: Logtm-se: Decoupling hardware transactional memory from caches. In: HPCA 2007: Proceedings of the 2007 IEEE 13th International Symposium on High Performance Computer Architecture, Washington, DC, USA, pp. 261–272. IEEE Computer Society, Los Alamitos (2007)
Maintaining Coherent Views over Dynamic Distributed Data Krithi Ramamritham Department of Computer Science and Engineering, Indian Institute of Technology Bombay [email protected] Abstract. Data delivered today over the web reflects rapid and unpredictable changes in the world around us. We are increasingly relying on content that provides dynamic, interactive, personalized experiences. To achieve this, the content of most web pages is created dynamically, by executing queries dynamically, using data that changes dynamically from distributed sources identified dynamically. A typical web page presents a "view" of the world constructed from multiple sources. In this paper, we examine the nature of dynamics of distributed data and discuss fresh approaches to maintain the coherency of the views seen by the users. Achieving such coherency while developing scalable low-overhead solutions poses challenges in terms of delivering data with the required fidelity in spite of data dynamics. How these challenges can be met by the judicious design of algorithms for data dissemination, caching, and cooperation forms the crux of our work. Keywords: Views, Dynamic Data Dissemination, Web, Internet Scale Algorithms, Data Coherency.
1 Introduction The web is becoming a universal medium for information publication and usage. Such information is becoming more and more dynamic and usage is varying from simple tracking to online decision making in real time. Applications include auctions, personal portfolio valuations for financial decisions, route planning based on traffic information, etc. For such applications, data from one or more independent data sources may be aggregated to determine if some action is warranted. Given the increasing number of such applications that make use of highly dynamic data, there is significant interest in systems that can efficiently deliver the relevant updates automatically. In this paper we summarize our work related to the topic of executing continuous queries over dynamic data so that correct results are always presented to users. Specifically, we present low-cost, scalable techniques to answer continuous aggregation queries using a Content Distribution Network (CDN) of dynamic data items. In such a network of data aggregators (DAs), each data aggregator serves a set of data items at specific coherencies. Just as various fragments of a dynamic web-page are served by one or more nodes of a CDN, serving a query involves decomposing a client query into sub-queries and executing sub-queries on judiciously chosen data aggregators with their individual sub-query incoherency bounds. T. Janowski and H. Mohanty (Eds.): ICDCIT 2010, LNCS 5966, pp. 13–20, 2010. © Springer-Verlag Berlin Heidelberg 2010
14
K. Ramamritham
2 Caches and Views Seen in the Web context, websites have transitioned from a static content model, where content is served from ready-made files, to a dynamic content model, where content is generated on demand. Dynamic content generation allows sites to offer a wider variety of services and content. But, as Internet traffic continues to grow and websites become increasingly complex, performance and scalability are major issues for website owners and users. Web 3.0 techniques provide website visitors with dynamic, interactive, and personalized experiences. However while serving dynamic content, two types of latencies are encountered: 1) 2)
Network Latency -- Latency due to communication between users and data sources and numerous nodes in the network (e.g., routers, switches) and Content Creation Latency -- Latency due to computationally-intensive logic executed at multiple tiers within the sources or within the nodes that lie between the client and the sources.
A widely used existing approach to address WWW performance problems is based on the notion of content caching. These content caching approaches store content at various locations outside the site infrastructure and can improve website performance by reducing content generation delays. Dynamic pages are typically designed according to a template, which specifies layout and content of page wherein pages are decomposed into fragments; fragments and templates are cached at the edge and pages are assembled from fragments, on demand. Alternatively, page layout can itself be generated at run-time [1]. Thus, caching can be done at either (a) the page level, which does not guarantee that correct pages are served and provides very limited reusability, or (b) the fragment level, which is associated with several design level and runtime scalability issues. To address these issues, several back-end caching approaches have been proposed, including query result caching and fragment level caching. In general cached content includes media files (pictures, audio, video) or dynamically generated page fragments; Content generated for one user is saved, and used to serve subsequent requests for the same content. A fragment is a portion of a web page, or at the granularity of a programmatic object. This type of cache works with a dynamic content application to reduce the computational and communication resources required to build the page on the site, thus reducing server-side delays. The holy grail of dynamic content caching is the ability to cache dynamic content at finer granularities outside the site’s infrastructure. Such an approach would provide the benefits of caching finer granularities of content (e.g., greater reusability), while simultaneously achieving the benefits associated with proxy-based caching (e.g., reduced bandwidth, reduced firewall processing). In databases, views are created to avoid repeated execution of sub-expressions that occur in queries. Which views to create and how to maintain them, i.e., make sure that the materialized forms of the views are up-to-date, thereby reflecting the current values of the base relations that contribute to the views, are part of the query optimization problem. In the systems context, cached values represent values evaluated once, but used multiple times. Whereas cache units have historically been physical entities like pages or cache lines, more recently the notion of logical caches has become commonplace, making a cache element similar in scope to a
Maintaining Coherent Views over Dynamic Distributed Data
15
view. In a distributed systems context view maintenance or keeping a cache element up-to-date involves making sure that the “value” or a view is the same irrespective of whether the cached/materialized form of the view is used/seen or the view/cache is constructed at the time it is used/seen. The challenge in ensuring this arises due to the distributed nature of the data sources which in turn implies communicating changes in the sources to the views so that views are up-to-date. In this paper, we offer a set of techniques for view/cache maintenance wherein o
instead of invalidating (typically, cache maintenance is invalidation-based since it is simple to just mark a cached element invalid whenever the source has changed), we refresh a cached fragment. •
o
instead of refreshing after each update, we refresh in a use-specific manner. •
o
by continuous refresh of the cache fragment, the cache/view can always be kept in a usable state.
by developing selective refresh mechanisms, overheads of view maintenance can be minimized.
instead of a dynamic fragment being refreshed by the source, we use a peer cache’s content for refresh. •
by constructing data dissemination networks data accuracy requirements of a large number of clients can be satisfied in a scalable manner.
3 Data Coherency Not every update at the source of data d leads to a refresh message being sent to a node that caches d. This is because, data usage usually can tolerate some incoherency. In most real-world applications, strong coherency, whereby a client and source always are in sync with each other, is neither required nor affordable. Several relaxations of strong coherency have been proposed: o Time domain: Δt - coherency •
The client is never out of sync with the source by more than Δt time units, e.g., traffic data not stale by more than a minute
o Value domain: Δv - coherency •
The difference in the data values at the client and the source are bounded by Δv at all times, e.g., user is only interested in temperature changes > 1 degree; user is only interested in changes in traffic load > 100 messages/sec
Formally, let si(t) denote the value of the ith data item at the data source at time t. Let the value of the ith data item known to the user be di(t). Then the data incoherency is given by |si(t)-di(t)|. For a data item which needs to be refreshed at an incoherency bound C, a data refresh message is sent to the user if data incoherency |si(t)-di(t) | > C.
16
K. Ramamritham
4 Dynamic Content Distribution Network of Data Aggregators Refreshes occur from data sources to the clients through a network of aggregators. In hierarchical data dissemination network, a higher level aggregator guarantees a tighter incoherency bound (i.e., a lower value of C) compared to a lower level aggregator. For maintaining a certain incoherency bound, a data aggregator (DA) gets data updates from the data source or some higher level DA so that the achieved data incoherency is at least as stringent as the specified data incoherency bound. From a data dissemination capability point of view, each DA is characterized by a set of (Si, ci) pairs, where Si is a data item which the DA can disseminate at an incoherency bound ci. Each DA in the network can be seen as providing a Sources view over the dynamic data provided by the sources. Consider a network of data aggregators managing data items S1-S4. Aggregators can be characterized asNetwork of d1: {(S1, 0.5), (S3, 0.2)} data d2: {(S1, 1.0), (S2, 0.1), (S4, aggregators 0.2)} Aggregator d1 can serve values of S1 with an incoherency bound greater than or equal to 0.5 whereas d2 can disseminate the same data item at a looser Clients incoherency bound of 1.0 or more. In such a dissemination netData Dissemination Network work of multiple data items all the nodes can be considered as peers since a node d1 can be child of another node d2 for a data item S1 (incoherency bound at d1 is greater than that at d2) but the node d1 can be parent of d2 for another data item S2. Given the data and coherency needs of DAs, how should they configure themselves and cooperate to satisfy these needs? How should DAs refresh each other’s data such that data coherency requirements are satisfied? Consider the design and building of a dynamic data distribution system that is coherence-preserving, i.e., the delivered data must preserve associated coherence requirements (the user-specified bound on tolerable imprecision) and must be resilient to failures. To this end, we consider a system in which a set of DAs cooperate with each other and the sources, forming a peer-to-peer network. In this system, necessary changes are pushed to the users so that they are automatically informed about changes of interest. In [3] we present techniques to determine when to push an update from one repository to another for coherence maintenance, to construct an efficient dissemination tree for propagating
Maintaining Coherent Views over Dynamic Distributed Data
17
changes from sources to cooperating repositories, and to make the system resilient to failures. We experimentally demonstrate that 1) careful dissemination of updates through a network of cooperating repositories can substantially lower the cost of coherence maintenance, 2) unless designed carefully, even push-based systems experience considerable loss in fidelity due to message delays and processing costs, 3) the computational and communication cost of achieving resiliency can be made to be low, and 4) surprisingly, adding resiliency can actually improve fidelity even in the absence of failures. Now we move our attention from individual data items to queries over these data items. Continuous aggregate queries over dynamic data. Consider the following specific applications involving continuous queries used to monitor changes to time varying data and to provide results useful for online decision making. These aggregation queries are long running queries as data is continuously changing and the user is interested in notifications when certain conditions hold. Thus, responses to these queries are to be refreshed continuously, respecting the coherency requirements associated with the queries. For tracking portfolios, we execute the following types of queries. o portfolio query involving shares in stock exchanges in a country Σ (Number of shares of company i × current price of share of company i) o global portfolio query involving stocks in exchanges in different countries Σ (Number of shares of company i × current price of share of company i in country j × currency exchange rate with country j) both the stock price in the foreign currency and the currency exchange rate change continuously. For monitoring network traffic to capture unusual activity such as network bombardment or denial of service attacks, given a condition involving data from certain sources, or certain destinations, each monitoring node evaluates Σ frequency count of messages satisfying the condition Finally, consider monitoring dynamic physical phenomena using sensor networks. Suppose a disaster management team is interested in tracking an oil spill with the help of sensors. Sensors track the perimeter of the “circular” spill. Center of the spill (x0, y0) can be approximated by the average of the points on the perimeter. By tracking (xi, yi) points on the perimeter, area under the spill can be calculated by continuously evaluating the expression: Π ((xj – x0)2 + (yj - y0)2) . Given a data dissemination network and above queries over the dynamic data contained in the nodes, the following interrelated questions arise:
18
K. Ramamritham
Given a set of continuous queries at a DA how should we assign accuracy bounds for each data item? Whereas the above work considers networking DAs with specific data, [4] considers the problem of assigning data accuracy bounds to these data items. Assigning data accuracy bounds for data used by non-linear queries poses special challenges. Unlike linear queries, data accuracy bounds for non-linear queries depend on the current values of data items and hence need to be recomputed frequently. So, we seek an assignment such that a) if the value of each data item at C is within its data accuracy bound then the value of each query is also within its accuracy bound, b) the number of data refreshes sent by sources to C to meet the query accuracy bounds, is as low as possible, and c) the number of times the data accuracy bounds need to be recomputed is as low as possible. In [4], we couple novel ideas with existing optimization techniques to derive such an assignment. Specifically, we make the following contributions: (i) Propose a novel technique that significantly reduces the number of times data accuracy bounds must be recomputed; (ii) Show that a small increase in the number of data refreshes can lead to a large reduction in the number of re-computations; we introduce this as a tradeoff in our approach; (iii) Give principled heuristics for addressing negative coefficient polynomial queries where no known optimization techniques can be used; we also prove that under many practically encountered conditions our heuristics can be close to optimal; and (iv) Experimentally demonstrate the efficacy of our techniques in handling large number of polynomial queries. Given the data and the coherency available at DAs, and a set of continuous queries, how do we plan the query executions, that is, how do we divide the query into sub-queries, and allocate the query incoherency bound among them? In case of a CDN, web page’s division into fragments is a page design issue, whereas, for continuous aggregation queries, this issue of dividing a query into sub-queries has to be handled on per-query basis by considering data dissemination capabilities of DAs. Consider a portfolio query Q1 = 50 S1 + 200 S2 + 150 S3 , with a required incoherency bound of 80 (in a stock portfolio S1, S2, S3 can be different stocks and incoherency bound can be $80). We want to execute this query over the DAs, minimizing the number of refreshes. There are various options for the client to get the query result: 1) The client may get the data items S1, S2 and S3 separately. The query incoherency bound can be divided among data items in various ways ensuring that query incoherency is below the incoherency bound. In this paper, we show that getting data items independently is a costly option. This strategy ignores the fact that the client is interested only in the aggregated value of the data items and various aggregators can disseminate more than one data item. 2) If a single DA can disseminate all three data items required to answer the client query, the DA can construct a composite data item corresponding to the client query (Sq = 50 S1 + 200 S2 + 150 S3) and disseminate the result to the client so that the query incoherency bound is not violated. It is obvious that if we get the query result from a single DA, the number of refreshes will be minimum (as data item updates may cancel out each other, thereby maintaining the query results within the incoherency bound). As different DAs disseminate different subsets of data items, no DA may have all the data items required to execute the client query. Further, even if an aggregator can refresh all the data items, it may not be able to satisfy the query
Maintaining Coherent Views over Dynamic Distributed Data
19
coherency requirements. In such cases the query has to be executed with data from multiple aggregators. 3) Divide the query into a number of sub-queries and get their values from individual DAs. In that case, the client query result is obtained by combining the results of multiple sub-queries. For the DAs given earlier, Q1 can be divided in two alternative ways: Plan1: Result of sub-query 50 S1 + 150 S3 is served by d1 whereas value of S2 is served by d2. Plan2: Value of S3 is served by d1 whereas result of sub-query 50 S1 + 200 S2 is served by d2. In both the plans, combining the sub-query values at the client gives the query result. Selecting the optimal plan among various options is not-trivial. Intuitively, we should be selecting the plan with lesser number of sub-queries. But that is not guaranteed to be the plan with the least number of messages. Further, we should select the sub-queries such that updates to various data items appearing in a sub-query have more chances of canceling each other as that will reduce the need for refresh to the client. In the above example, if updates to S1 and S3 are such that when S1 increases, S3 decreases, and vice-versa, then selecting plan1 may be beneficial. In [2] we give a method to select the query plan based on these observations. While solving the above problem, we ensure that each data item for a client query is disseminated by one and only one DA. Although a query can be divided in such a way that a single data item is served by multiple DAs (e.g., 50 S1 + 200 S2 + 150 S3 is divided into two sub-queries 50 S1 + 130 S2 and 70 S2 + 150 S3); but in doing so the same data item needs to be processed at multiple aggregators, increasing the unnecessary processing load. By dividing the client query into disjoint sub-queries we ensure that a data item update is processed only once for each query (for example, in case of paid data subscriptions it is not prudent to get the same data item from the multiple sources). Sub-query incoherency bounds are required to be found using the query incoherency bounds such that, besides satisfying the client coherency requirements, the chosen DA (where the sub-query is to be executed) is capable of satisfying the allocated sub-query incoherency bound. For example, in plan1, incoherency bound allocated to the sub-query 50S1 + 150S3 should be greater than 55 (=50*0.5+150*0.2) as that is the tightest incoherency bound which the aggregator d1 can satisfy. Clearly, the number of refreshes will depend on the division of the query incoherency bounds among sub-query incoherency bounds. In [2] we provide a technique for getting the optimal query plan (i.e., set of subqueries with their incoherency bounds and DAs where the sub-queries will be executed) which satisfies client query’s coherency requirement with least cost, measured in terms of the number of refresh messages sent from aggregators to the client. For estimating query execution cost, we build a continuous query cost model which can be used to estimate the number of messages required to satisfy the client specified incoherency bound. Performance results using real-world traces show that our cost based query planning leads to queries being executed using less than one third the number of messages required by existing schemes.
20
K. Ramamritham
5 Conclusions Users today are increasingly relying on content that provides dynamic, interactive, personalized experiences. A typical response from the web today presents a "view" of the world constructed from multiple sources. We discussed several challenges and associated approaches to maintain the coherency of the views seen by the users. The approaches involve the judicious design of algorithms for view identification, data dissemination, caching, and cooperation. Details of our work related to dynamic data dissemination can be found at http://www.cse.iitb.ac.in/~krithi/ddd.html. Acknowledgments. I would like to thank all my Masters and Ph.D. students, especially Shetal Shah and Rajeev Gupta, for their contributions to this project.
References 1. VanderMeer, D., Datta, A., Dutta, K., Thomas, H., Ramamritham, K.: Proxy-Based Acceleration of Dynamically Generated Content on the World Wide Web. ACM Transactions on Database Systems (TODS) 29 (June 2004) 2. Gupta, R., Ramamritham, K.: Optimized Query Planning of Continuous Aggregation Queries in Dynamic Data Dissemination Networks. In: WWW 2007, Banff, Canada (May 2007) 3. Shah, S., Ramamritham, K., Shenoy, P.: Resilient and Coherency Preserving Dissemination of Dynamic Data Using Cooperating Peers. IEEE Transactions on Knowledge and Data Engineering 16(7), 799–812 (2004) 4. Shah, S., Ramamritham, K.: Handling Non-linear Polynomial Queries over Dynamic Data. In: Proc. of IEEE International Conference on Data Engineering (ICDE) (April 2008)
Malware: From Modelling to Practical Detection R.K. Shyamasundar, Harshit Shah, and N.V. Narendra Kumar School of Technology and Computer Science Tata Institute of Fundamental Research Homi Bhabha Road, Mumbai 400005, India {shyam,harshit,naren}@tcs.tifr.res.in
Dedicated to the memory of Amir Pnueli: 1941-2009 A Computer Science Pioneer and A Great Human being Abstract. Malicious Software referred to as Malware refers to a software that has infiltrated to a computer without the authorization of the computer (or the owner of the computer). Typical categories of malicious code include Trojan Horses, viruses, worms etc. Malware has been a major cause of concern for information security. With the growth in complexity of computing systems and the ubiquity of information due to WWW, detection of malware has become horrendously complex. In this paper, we shall survey the theory behind malware to provide the challenges behind detection of malware. It is of interest to note that the power of the malware (or for that matter computer warfare) can be seen in the theories proposed by the iconic scientists Alan Turing and John von Neumann. The malicious nature of malware can be broadly categorized as injury and infection analogously in the epidemiological framework. On the same lines, the remedies can also be thought of through analogies with epidemiological notions like disinfection, quarantine, environment control etc. We shall discuss these aspects and relate the above to notions of computability. Adleman in his seminal paper has extrapolated protection mechanisms such as quarantine, disinfection and certification. It may be noted that most of the remedies in general are undecidable. We shall discuss remedies that are being used and contemplated. One of the well-known restricted kind of remedies is to search for signatures of possible malwares and detect them before getting it through to the computer. Large part of the current remedies rely on signature based approaches that is, heavy reliance on the detection of syntactic patterns. Recent trends in security incidence reports show a huge increase in obfuscated exploits; note that in the majority of obfuscators, the execution behaviour remains the same while it can escape syntactic recognitions. Further, malware writers are using a combination of features from various types of classic malwares such as viruses and worms. Thus, it has become all the more necessary to
The work was partially supported under Indo-Trento Promotion for Advanced Research.
T. Janowski and H. Mohanty (Eds.): ICDCIT 2010, LNCS 5966, pp. 21–39, 2010. c Springer-Verlag Berlin Heidelberg 2010
22
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar take a holistic approach and arrive at detection techniques that are based on characterizations of malware behaviour that includes the environment in which it is expected to execute. In the paper, we shall first survey various approaches of behavioural characterization of malware, difficulties of virus detection, practical virus detection techniques and protection mechanisms from viruses. Towards the end of the paper, we shall briefly discuss our new approach of detecting malware via a new method of validation in a quarantine environment and show our preliminary results for the detection of malware on systems that are expected to carry a priori known set of software.
1
Introduction
Malicious code is any code that has been modified with the intention of harming its’ usage/user. Informally, destructive capability of malware is assessed based on how well it can hide itself, how much loss it can inflict on the owner/user of the system, how rapidly it can spread, etc. Malware attacks result in tremendous costs to an organization in terms of cleanup activity, degraded performance, damage to its reputation, etc. Among some of the direct costs incurred are, labour costs to analyze and cleanup infected systems, loss of user productivity, loss of revenue due to direct losses or degraded performance of system, etc. According to a report on financial impact of malware attacks [35], the direct damages incurred in 2006 were USD 13 billion. Although the trend shows a decline in direct damages since 2004 (direct damages in 2004 and 2005 were USD 17.5 billion and USD 14.2 billion respectively), this decline is attributed to a shift in the focus of malware writers from creating damaging malware to creating stealthy, fast-spreading malware so that infected machines can be used for sending spams, stealing credit-card numbers, displaying advertisements or opening a backdoor to an organization’s network. This increase in the indirect and secondary damages (that are difficult to quantify) explains why malware threat has worsened in recent years despite a decline in direct damages. Malware can be primarily categorized [15] as follows: – Virus - Propagates by infecting a host file. – Worm - Self-propagates through e-mail, network shares, removable drives, file sharing or instant messaging applications. – Backdoor - Provides functionality for a remote attacker to log on and/or execute arbitrary commands on the affected system. – Trojan - Performs a variety of malicious functions such as spying, stealing information, logging key strokes and downloading additional malware - several further sub categories follow such as infostealer, downloader,dropper,rootkit etc. – Potentially Unwanted Programs (PUP) - Programs which the user may consent on being installed but may affect the security posture of the system or may be used for malicious purposes. Examples are Adware, Dialers and Hacktools/hacker tools (which includes sniffers, port scanners, malware constructor kits, etc.)
Malware: From Modelling to Practical Detection
23
– Other - Unclassified malicious programs not falling within the other primary categories. The breakdown of malware as per the study reported in [15], is summarized in Table 1. It shows that Trojan comprised a major class of malware in 2008. This is indicative of attacker’s preference to infect machines so that a host of malicious activities (advantageous to the attacker) can be launched from them. Signature based scanning techniques for malware detection are highly inadequate. With increased sophistication in detection techniques, stealth techniques employed by malware writers have also witnessed huge sophistication. Table 1. 2008 Malware trends Malware Class Percentage Trojan 46 Other 17 Worm 14 Backdoor 12 PUP 6 Virus 5
The theory of computer viruses was developed much before the actual instances of it were seen in wild. The foundations were laid by Cohen’s formal study [10] of computer viruses based on the seminal theory of self-reproducing automata invented by John von Neumann [26]. In this paper, we first survey1 some of the important theoretical results on computer viruses, several detection techniques, and protection mechanisms. Finally, we briefly discuss our recent study for detecting the presence of malwares in systems like embedded systems where we know a priori the software that is loaded in them.
2
Formal Approaches to Virus Characterization
Informally, a virus can be defined as any program that propagates itself by infecting a host file (trusted by the user). The infected host file when executed, in addition to performing its’ intended job it also selects another program and infects it thereby spreading the infection. Cohen [10] was the first to formalize and study the problem of computer viruses. The following definition intuitively captures the essence of a virus as defined by Cohen [10]. Definition 1. A computer virus is a program that can infect other programs, when executed in a suitable environment, by modifying them to include a possibly evolved copy of itself. 1
For an excellent detailed exposition of computer viruses from theory to practice, the reader is referred to [14].
24
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar
We now present the pseudo-program of a possible structure of a computer virus as presented in [9]. program virus:= {1234567; subroutine infect-executable:= {loop: file = get-random-executable-file; if first-line-of-file = 1234567 then goto loop; prepend virus to file; } subroutine do-damage:= {whatever damage is to be done} subroutine trigger-pulled:= {return true if some condition holds} main-program:= {infect-executable; if trigger-pulled then do-damage; goto next;} next:} Although the above pseudo-program of a virus includes a subroutine to perform damage, the ability to perform damage is not considered a vital characteristic of a virus by Cohen. Cohen’s formal definition of a virus was based on the Turing machine computing model. The possibility of a virus infection comes from the theory of self-reproducing automata defined by Jon Von Neumann [26]. Every program that gets infected can also act as a virus and thus, the infection can spread throughout a computer system or a network. Cohen identifies the ability to infect as the key property of a virus, thus allowing it to spread to the transitive closure of information sharing. Given the widespread use of sharing in current computer systems, viruses can potentially damage a large portion of the network. Recovering from such a damage will be extremely hard and perhaps often impossible. Thus, it is of great importance to detect and protect systems from viruses. Cohen’s formalization was remarkable, because it captures the intuition that a program is a virus only when executed in a suitable environment. However, Cohen’s formal definition does not fully capture the relationship between a virus and a program infected by that virus. Soon after Cohen’s formalization of viruses, Adleman (Cohen’s Ph.D advisor) proposed a formalization of viruses using recursive functions computing model. Before providing Adleman’s definition of viruses, let us set up some basic notation and concepts as given in Adleman [1].
Malware: From Modelling to Practical Detection
25
A virus can be thought of as a program that transforms (infects) other programs. Definition 2. If v is a virus and i is any program, v(i) denotes the program i upon infection by virus v A system on which a program is executing can be characterized by giving the set of data and programs that are present in the system. A program can be thought of as a state transformer. If i is a program, d is a sequence of numbers that denotes the data in a system and p is a sequence of numbers that denotes the programs in a system then i(d, p) denotes the state resulting when program i executes in the system. Together d and p tell us the state of the system. Definition 3. We say that state (d1 , p1 ) is v-related to state (d2 , p2 ), denoted (d1 , p1 ) ∼ =v (d2 , p2 ) iff – – – –
d1 = d2 and p1 = p2 i.e. p1 and p2 differ number of programs in p1 and p2 are the same and either the ith program in p1 and the ith program in p2 are the same or the ith program in p2 results when the ith program in p1 is infected by virus v
Intuitively Adleman’s definition of a virus can be stated as follows: Definition 4. A program v, that always terminates, is called a virus iff for all states s either 1. Injure: all programs infected by v behave the same when executed in state s 2. Infect or Imitate: for every program p, the state resulting when p is executed in s is v-related to the state resulting when v(p) is executed in s Adleman’s definition of a virus characterizes the relationship between a virus and a program infected by it. However, there is no quantification or characterization of injury and infection. Although the notion of injury appears explicitly in his definition of a virus, Adleman considers the ability to infect to be the core of a virus (Remark 2 in Adleman [1]). Based on this definition he arrives at a classification of viruses2 into the four disjoint classes benign, Epeian, disseminating and malicious. Intuitively, benign viruses are those which never injure the system nor infect other programs. Consider a program p, that compresses programs to save disk space, and adds a decompression routine to its binary so that the program gets decompressed during execution. p is an example of a benign virus. Epeian viruses cause damage in certain conditions but never infect other programs. Boot sector viruses and other programs that delete some key files of the system are examples of Epeian viruses. 2
For immunological analogies between computer and biological viruses, the reader is referred to[17].
26
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar
Disseminating viruses spread by infecting other programs but never injure the system. Internet worms like Netsky, Bagle, Sobig, Sober, MyDoom, Conficker etc., are examples of disseminating viruses. Malicious viruses are those programs that cause injury in certain conditions and propagate themselves by infecting other programs in certain conditions.
3
Techniques for Detecting Viruses
Cohen [9] considers the problem of detecting a computer virus and proves that it is undecidable in general to detect a virus by its appearance (static analysis). We now give an intuitive (informal) account of Cohen’s result Theorem 1. Detecting a virus by its appearance is undecidable. Proof. Proof is by contradiction. Let us assume to the contrary that there exists a procedure D that can tell whether a program is a virus or not. Let there be a program p which infects other programs if and only if D would have called it benign. Given p as input, if D calls it benign, then p infects – thus leading to a contradiction. If on the other hand D calls it a virus then p does not infect, again leading to a contradiction. All the possibilities lead to contradiction. Thus, it is not possible to have a procedure such as D. The above theorem illustrates that if we know what defense mechanism is used by the defender, we can always build a virus that infiltrates into the system i.e., fools the defender. No defense is perfect. Similarly, given a virus, there is always a defense system that defends against that particular virus. Adleman considers the problem of detecting whether a program is a virus or not and proves it undecidable. We present the theorem as in [1]. Theorem 2. For all Godel numberings of the partial recursive functions {φi } V = {i|φi is a virus} is 2 −complete What this theorem implies is that it is impossible to always correctly tell whether a given program is a virus or not. However, it is very important to be able to detect viruses and nullify them before they carry out the damage. Having had a glance of the possibilities, let us look at widely used methods for detecting viruses. 3.1
Signature Based Detection
In signature based detection of viruses, we have a database of known malicious patterns of instructions. Whenever a file is scanned the detection algorithm compares the sequence of symbols present in the file with the database of known malicious patterns. If the algorithm finds a match it declares the file to be a virus.
Malware: From Modelling to Practical Detection
27
Note that signature based detection algorithm critically depends on the database of known malicious patterns. This database is created by analyzing known viruses by extracting sequences of instructions present in them and removing any sequences from them that are typical of benign programs. If we remove very little, we are in danger of not being able to identify even minor modifications of the virus. If we remove too much, then we are in danger of marking genuine programs as viruses. Since a lot of discretion is needed to remove benign patterns, this process of building the database is very hard to automate and is typically compiled by human experts. For this reason it takes reasonable time (even 4 to 5 days) for adding the signature of a newly detected virus to the database, and by this time the virus would have spread wide and caused damage. Thus, signature based detection techniques work well for known viruses but cannot handle new viruses. This inability limits their effectiveness in controlling the spreading of new malware. Because of their syntactic nature, these techniques are susceptible to various program obfuscation techniques that preserve the program behaviour but change the program code in such a way that the original program and the modified program look very different. In [6], Chrisodorescu et al., reveal gaping holes in signature-based malware detection techniques employed by several popular, commercial anti-virus softwares. In their technique, a large number of obfuscated versions of known viruses are created and tested on several anti-virus softwares. The results demonstrate that these tools are severely lacking in their ability to detect obfuscated versions of known malware. An algorithm to generate signatures used by different anti-virus softwares to detect known malware is also presented. Results show that in many cases, the whole body of the malware is used as a signature for detection. This inability to capture malware behaviour comprehensively explains their failure to detect obfuscated versions of malware. IBM Internet Security Systems X-Force 2009 Mid-Year Trend and Risk Report [16] states that the level of obfuscation found in Web exploits and in PDF files continues to increase while some of these obfuscation techniques are even being passed to multimedia files. The amount of suspicious obfuscated content has nearly doubled from Q1 to Q2 of 2009. In the following, we discuss obfuscation techniques. Program Obfuscation Techniques Program obfuscation techniques modify a program in such a way that its behaviour remains the same but analysis of the obfuscated program becomes difficult. The main objective for such transformations is to prevent/make difficult reverse engineering in order to protect intellectual property or to prevent illegal program modifications. Several popular techniques for program obfuscation are code reordering, instruction substitution, variable renaming, garbage insertion and data and code encapsulation. An exhaustive list of obfuscating transformations and measures to gauge their efficacy are presented in [11]. Obfuscation techniques are heavily used by malware programs to evade detection.
28
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar
Substantial research has been done on theoretical aspects of program obfuscators. In [2], Barak et al., present impossibility results for program obfuscation with respect to “virtual black box” intuition which states that anything that can be computed efficiently from an obfuscated version of program, can be computed efficiently with just an oracle access to the program. On the positive side, much of the interesting information about programs is hard to compute. In fact, Rice’s theorem [29] states that any non-trivial property of partial recursive functions is undecidable. In [11], Collberg et al., use the result that different versions of precise static alias analysis are NP-hard [19] or even undecidable [28] to construct opaque predicates – whose values are known to the obfuscator but are hard to compute by static analysis. In [4], authors present a control-flow obfuscation technique that implants an instance of a hard combinatorial problem into a program. Polymorphism Generators / Mutation Engines A better technique to evade detection is adopted by polymorphic and metamorphic viruses. Polymorphic viruses exhibit a robust form of self-encryption wherein the encryption and decryption routines are themselves changed. Thus, the virus body is the same in all the versions but the encrypted versions appear different. In metamorphic viruses, the contents of the virus itself are changed rather than the encryption and decryption routines. In order to achieve this objective, metamorphic viruses make use of obfuscation techniques like code reordering, instruction substitution, variable renaming and garbage insertion. For example, Chameleon, the first polymorphic virus, infects COM files in its directory. Its’ signature changes every time it infects a new file. This makes it difficult for anti-virus scanners to detect them. Other polymorphic viruses are Bootache, CivilWar, Crusher, Dudley, Fly, Freddy, etc. 3.2
Static Analysis of Binaries
Static analysis techniques are used to determine important properties like control flow safety (i.e., programs jump to and execute valid code), memory safety (i.e., program only uses allocated memory) and abstraction preservation (i.e., programs use abstract data types only as far as their abstractions allow). Type systems are usually employed to enforce these properties. Although Java Virtual Machine Language (JVML) also has the ability to type-check low-level code, it has several drawbacks like semantic errors between the verifier and its’ English language specification and also the difficulty in compiling high-level languages other than Java. In [23], authors present a Typed Assembly Language (TAL) which is a low-level statically-typed target language that supports memory safety even in the presence of advanced structures and optimizations; TALx86 is targeted at Intel architectures. In [34], authors present a technique to instrument well-typed programs with security checks and typing annotations so that the resulting programs obey the policies satisfied by security automata [30] and can be mechanically checked for safety. This technique allows enforcement of virtually all safety policies since it uses a security automata for policy specification. In
Malware: From Modelling to Practical Detection
29
[24], authors present a technique for protecting privacy and integrity of data by extending Java language with statically-checked information flow annotations. An interesting approach to establish safety of un-trusted programs is presented in [25]. In this approach referred to as Proof Carrying Code, the code producer provides a proof along with the program. The consumer checks the proof along with the program to ensure that his safety requirements are met with. Main objective of PCC was to be able to extend a system with a piece of software that was certified to obey certain memory safety properties. Though proof generation is quite complex and is often done by hand, proof verifier is relatively small and easy to implement. This technique has been applied to ensure safety of network packet filters that are downloaded into operating system kernel. An application to ensure resource usage and data abstraction in addition to memory safety for un-trusted mobile agents was also provided. An interesting approach to detect variants of a known virus by performing static analysis on virus code and abstracting out its behaviour is presented in [5]. We now describe their architecture for detecting variants of a known virus [5]: 1. Generalize the virus code into a virus automata with uninterpreted symbols to represent data dependencies between variables, 2. Pattern-definitions are internal representations of abstraction patterns used as alphabet by the virus automata, 3. The executable loader transforms the executable into a collection of control flow graphs (CFG’s) one for each procedure, 4. Annotator takes a CFG from the executable and the set of abstraction patterns and produces an annotated CFG as an abstract representation of a program procedure, and 5. Detector computes whether the virus (represented by the virus automata) appears in the abstract representation of the executable (represented as a collection of annotated CFG’s) using tools for language containment and unification. Note that for the above algorithm to work, abstraction patterns have to be provided (manually constructed) for each kind of transformation (code transportation, dead-code insertion etc). Once these are provided the rest of the algorithm is automatic. Thus, such an architecture works well for recognizing those variants of known viruses for which abstraction patterns are provided. In conclusion, this approach works better than signature based matching, but still has the drawback that it cannot recognize new viruses. 3.3
Semantics Based Detection
In [8], authors formalize the problem of determining whether a program exhibits a specified malicious behaviour and present an algorithm for handling a limited set of transformations. Malicious behaviour is described using templates, which are instruction sequences where variables and symbolic constants are used. They
30
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar
abstract away the names of specific registers and symbolic constants in the specification of the malicious behaviour, thus becoming insensitive to simple transformations such as register renaming. They formalized the notion of when an instruction sequence contains a behaviour specified by a template, to match the intuition that they should have the same effect on the memory upon execution. A program is said to satisfy a template iff the program contains an instruction sequence that contains a behaviour specified by the template. The algorithm to check whether a program satisfies a given template proceeds by finding, for each template node, a matching node in the program. Once two matching nodes are found, one needs to check whether the define-use relationships true between template nodes also hold true in corresponding program nodes. If all the nodes in the template have matching counterparts under these conditions, the algorithm is said to have found a program fragment that satisfies the template. The above approach performs better than the static analysis based approach, since it incorporates semantics of instructions. Templates is a better form of abstraction than abstraction patterns. However, note that still templates have to be constructed by hand by looking at known malicious programs. In [7] authors present a way of automatically generating malware specifications by comparing the execution behaviour of a known malware against the execution behaviours of a set of benign programs. Algorithm [7] for extracting malicious patterns (malspecs) proceeds as follows 1. Collect execution traces. In this step, traces are collected by passively monitoring the execution of each program. 2. Construct dependence graphs. In this step, they construct dependence graphs from the traces to include def-use dependence and value-dependence. 3. Compute contrast subgraph. In this step, they extract the minimal connected subgraphs of the malware dependence graphs which are not isomorphic to any subgraph of the benign dependence graph. For using malspecs for malware detection, they consider the semantics aware malware detector described above and convert malspecs into templates that can then be used by the detection algorithm.
4
Protection Mechanisms
In the preceding section, we have studied the problem of detecting viruses. We have seen theoretical results indicating that the problem is undecidable in general. We have also seen some algorithms that can detect particular viruses. In this section, we will study the possibility of restricting the extent of damage due to an undetected virus. Cohen [9] identifies three important properties of usable systems sharing, transitivity of information flow and generality of interpreting information. Sharing is necessary if we want others to use the information produced by us. For sharing information, there must be a well-defined path between the users. Once we have a copy of the information, it can be used in any way, particularly we can pass it
Malware: From Modelling to Practical Detection
31
on to others. Thus, information flow is transitive. By generality of information, we mean that information can be treated as data or program. If there is no sharing, there can be no information flow across boundaries and hence, viruses cannot spread outside a partition. This is referred to as isolationism. Cohen [9] presents partition models that limit the flow of information. These models are based on well studied security properties like integrity and confidentiality/secrecy. These properties when enforced in tandem result in partitioning the set of users into closed subsets under transitivity of information flow. However precise implementations are computationally very hard (NP-complete). Isolationism is unacceptable in this inter-networked world. Without generality of interpreting information viruses cannot spread since infection requires altering the interpreted information. However, for building useful systems we must allow generality of interpreting information. Adleman [1] studies the conditions under which a virus can be isolated from the computing environment. We present an intuitive account of his study. Definition 5. The infected set of a virus v, denoted Iv is defined as the set of those programs which result from v infecting some program. Definition 6. A virus v is said to be absolutely isolable iff Iv is decidable. If a virus v is absolutely isolable, then we can detect as soon as a program gets infected by v and we can remove it. Thus, if a virus is absolutely isolable then we can neutralize it. For example, using this method we can neutralize viruses which always increase the size of a target program upon infection. Unfortunately, not all viruses are absolutely isolable as noted in the theorem below [1]. Theorem 3. There exists a program v which always terminates such that 1. v is a malicious virus 2. Iv is semi-decidable To deal with the viruses of the kind described in the above theorem, Adleman introduces the notion of germ set of a virus. Definition 7. The germ set of a virus v, denoted Gv is defined as the set of those programs which behave (functionally) the same as a program infected by v. Germs of a virus are functionally the same as infected programs, but are syntactically different. They are not resulted from infections, but they can infect other programs. Definition 8. A virus v is said to be isolable within its germ set iff there exists a set of programs S such that: 1. Iv ⊆ S ⊆ Gv 2. S is decidable
32
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar
If a virus v is isolable within its germ set by a decidable set S, then not allowing programs in the set S to be written to storage or to be communicated will stop the virus from infecting. Moreover, isolating some uninfected germs is an added benefit. Unfortunately, not all viruses are isolable within their germ set. Adleman [1] suggested the notion of a quarantine as another protection mechanism. In this method, one executes a program in a restricted environment and observe its behaviour under various circumstances. After one gains sufficient confidence in its genuineness, it can be introduced into the real environment. Several techniques are developed based on this idea. Application sandboxing and virtualization are some of the widely studied methods. Virtualization Techniques and Sandboxing The most important aspect of malware detection is being able to observe malware behaviour without being detected by malware. Malware detector typically runs in the same machine/environment as the malware. Thus, it is susceptible to subversion by malware. To overcome this limitation, several techniques use a virtual machine for malware detection. In this scenario, the host OS runs a Virtual Machine Monitor (VMM) that provides a virtual machine with guest OS on top of it. Another alternative is to have the VMM run directly on the hardware instead of the host OS. VMM provides strong isolation and protects the host from damage. Therefore, malware-detector can be used outside the virtual machine without the fear of being compromised by malware. In [20], authors present a technique for detecting malware by running it in a virtual environment and observing its behavoiur from outside. In order to reconstruct the semantic view from outside, the guest OS data structures and functions are cast on VMM state (which is visible to the malware detector). Using this technique, the authors were able to view volatile state (e.g., list of running processes) and persistent state (e.g., files in a directory) of the virtual machine. This allowed them to detect rootkits like FU3 , NTRootkit4 and Hacker Defender5 that hide their own files and processes. As compared to this, the malware detection program running inside the virtual machine could not detect the rootkits. Another approach for malware detection via hardware virtualization is presented in [12]. In this approach, the authors present requirements for transparent malware analysis and present a malware detection mechanism that relies on hardware virtualization extensions. The advantage of using hardware virtualization extension is that it provides features like higher privilege, use of shadow page tables and privileged access to sensitive CPU registers. These techniques offer better transparency. However, virtual machine techniques are not completely foolproof. Malware writers employ sophisticated techniques to detect whether the program is running inside a virtual machine. Whenever a virtual environment is detected, malware can modify its behaviour and go undetected. In [18] and [27], authors outline various anomalies that exist in virtualization techniques that can be exploited 3 4 5
http://www.rootkit.com/board project fused.php?did=proj12 http://www.megasecurity.org/Tools/Nt rootkit all.html http://hxdef.czweb.org
Malware: From Modelling to Practical Detection
33
by malware to detect the presence of a virtual environment. Among the various anomalies presented are: discrepancies between interfaces of real and virtual hardware, inaccuracies of execution of some non-virtualized instructions, inaccuracy due to difficulty in modeling complex chipsets, discrepancies arising out of shared physical resources between guests and timing discrepancies. Even with hardware virtualization extensions, several timing anomalies can be easily detected. Thus, VM techniques do not offer complete transparency. In [21] an application of virtualization to launch a rootkit is presented. This rootkit installs a virtual machine under the current OS and then hoists the original OS into this virtual machine. These Virtual Machine Based Rootkits (VMBRs) can support other malicious programs in a separate OS that is isolated from the target system. VMBRs are difficult to detect because software running on the target system cannot access their state. Sandboxes are security mechanisms to separate running programs by providing a restricted environment in which certain functions are prohibited (e.g., chroot utility in UNIX that allows one to set the root directory for a process). In this sense, sandboxes can be viewed as a specific example of virtualization (e.g., Norman Sandbox6 that analyzes programs in secure, emulated environments). Sandboxes restrict the effects of a program within a specific boundary. For example, CWSandbox7 , uses API hooking technique to re-route the system calls through monitoring code. Thus, all relevant system calls made by un-trusted programs are monitored at run-time, their behaviour is analyzed and automated reports are generated. We have developed a similar sandboxing technique for Linux OS [32] wherein we monitor the system calls made by an un-trusted program and restrict its activities at run-time. We provide a guarded command based policy specification language to encode security policies. This language is as expressive as a Security Automata [30] and can express complex policies that depend on temporal aspects of system call trace. Whenever a system call is intercepted, it is allowed to go through only when it is deemed safe with respect to the policy at hand. Sandboxes also suffer from limitations described above for the virtualization techniques.
5
A New Approach: Validating Behaviours of Programs
In this section, we present a promising future direction [33], for protection from computer viruses. Our idea is based on validating as opposed to verification in the context of compilers [3,22]. The validation approach is based on comparing whether one program is as good or as bad as the other. Such an approach lies on the notion of bisimulation due to David Park and Robin Milner; these concepts are very widely used in the context of process algebra and protocol verification. Recollect that viruses spread by infecting trusted programs. When an infected program is executed, the program in addition to performing its intended job 6 7
http://www.norman.com/technology/norman sandbox/ http://www.cwsandbox.org/
34
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar
(observable by the user) also results in damage (happens in the background without the users knowledge/consent). Based on this observation we divide the behaviour of a program into two parts: external behaviour (behaviour observable from outside) and internal behaviour (behaviour observable from inside the system with the help of a monitor). We further note that if the infection caused by the virus modifies the external behaviour then the user will suspect and remove the program. Therefore, it is reasonable to assume that infection modifies only the internal behaviour of programs. We therefore suggest that we must monitor the internal behaviour of trusted programs and validate them against their intended behaviour in an environment. For the class of transactional reactive programs, we can define the external behaviour as the sequence of interactions that happen between the user and the program. For example, if we consider a vending machine as our system, one possible external behaviour is given by place-coin ˆ choose-item ˆ receive-item. We also observe that during execution of a program p with external behaviour t, the main process may spawn child processes internally (not necessarily observable to the user) for modularly achieving/computing the final result. Thus, the total (internal + external) behaviour can be denoted by a tree with processes, data operations etc denoted as nodes and directed edges. We can now define the internal behaviour of a program as the process tree generated during execution together with the associated system calls made by each process (vertex/node) in the tree. Based on this model of the internal behaviour, we can derive an algorithm for model-checking whether a program behaviour simulates a given behaviour. If the observed behaviour of a program simulates its’ intended behaviour, then we say that the program is uninfected else we say that it is infected. We can use this method to detect if and when a trusted program is infected. We have performed a lot of experiments and obtained encouraging results. We present some of the experiments and our observations in this section. We performed our experiments on a machine with Linux (Ubuntu distribution) OS. We monitored (unobtrusive) the sequence of system calls made (using strace tool), when the genuine text editor nano is used to edit a file. Note that system calls act as an interface between the application and the underlying hardware devices (can be thought of as services). We have also noted the % of time spent in various system calls, the number of processes created during execution, total running time, CPU and other resources used during this operation. We have collected similar information for the genuine ssh program starting from the time the service is started to the time the user logged in and completed the session. We executed an infected version of nano program and collected the observable information during its execution. We then compared it with its intended behaviour and we easily concluded from the observations made that the version of nano we executed is infected. Moreover we were also able to identify the instructions added due to infection to the program. Summary of differences in the system call profiles of the genuine nano vs the infected nano:
Malware: From Modelling to Practical Detection
35
1. original program made 18 different system calls whereas the infected version made 48 2. infected program made network related system calls like socket, connect, etc. whereas the original program made none 3. infected program spawned 3 processes whereas the original program did not spawn any process 4. there is a huge difference in the number of read and write system calls 5. we observed a difference in the timing information provided by strace summary (when both the versions were run only for a few seconds). Original program spent around 88% on execve system call and 12% on stat64 whereas the infected version spent 74.17% on waitpid, 10.98% on write, 6.28% on read, 4.27% on execve and negligible time on stat64. This indicates that the infected program spent more time waiting on children than in execution. This increased percentage of time spent on writing and reading by infected program indicates malfunction. We executed an infected ssh program and collected the observable information during its execution. We then compared it with its intended behaviour and found that infected program modified the authentication module of the ssh program. Infected ssh would enable an attacker to successfully login to our host using a valid username with a magic-pass. In this case the infection has removed certain instructions from the program. At a high level we can describe the expected behavior of ssh as follows 1. 2. 3. 4. 5. 6.
start sshd service wait for a connection and accept a connection authenticate the user prepare and provide a console with appropriate environment manage user interaction and logout stop sshd
Summary of differences in behavior between genuine ssh and the infected ssh: 1. start sshd service – Genuine sshd uses the keys and config files from /etc/ssh whereas the infected ssh obtains these from a local installation directory 2. authenticate the user – Genuine sshd used kerberos, crypto utilities and pam modules which the infected ssh does not use – The infected ssh uses the config and sniff files (local/untrusted resources) which the genuine sshd does not use To test the resilience of our approach to the simple syntactic transformations, that the virus writers are resorting to evade detection, we have compiled the virus responsible for infection under various levels of optimization. gcc compiler performs several simple syntactic transformations like loop unrolling, function inlining, register reassignment etc. We have executed the infected programs nano (similarly ssh) compiled under different optimization levels and collected the
36
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar
observable information during execution. What we observed was that barring very minor changes these programs produced the same traces of system calls. One difference we observed was the way in which contents of a file were buffered into and out of memory. Optimized program read in chunks of size 4096 whereas lower level of optimization resulted in reading chunks of a smaller size. These experiments demonstrate that the various obfuscators would have little impact on our approach and we will be able to catch infections. To summarize, we have presented an approach in which we benchmark the intended behaviours of trusted programs in an execution environment and whenever we want to validate whether the installation of the trusted program in a similar environment is tampered, we collect the observable information during runtime and compare it with its intended behaviour. If there is a significant difference between the two, then we say that the program is infected. We have also showed that the method is resilient to obfuscation. We are conducting experiments to see the effect of polymorphic and metamorphic viruses on our approach. Note that the method we presented will also be very useful for validating the embedded systems because typically the software and the hardware configurations of an embedded system are very few. In our study so far, the above approach seems to be very fruitful for checking un-tampering of devices of network communication and automobile software [31]. In fact, our study shows that our above approach does not need the constraints imposed in [31] or their related works on Pioneer and swatt protocols. The work is under progress and will be reported elsewhere.
6
Discussion
Malware has been a major cause of concern for information security. Today malicious programs are very widely spread and the losses incurred due to malware is very high (in some cases they result in financial loss while in some other cases they spoil the reputation of an organization). It is argued in [13] that the financial gain from criminal enterprise has lead to large investments of funds in developing tools and operational capabilities for the attackers on net transactions. Thus, it is imperative to develop mechanisms to defend ourselves from malware attacks. To develop sound defense mechanisms it then becomes necessary that we understand the fundamental capabilities of virus. In this paper, we have surveyed various efforts to formalize the notion of a virus/malware and characterize the damage due to them. We presented theoretical results based on the formalizations to show that detection of viruses in general is an undecidable problem. We presented a variety of detection mechanisms which are widely deployed to detect viruses in limited cases. We have also established the shortcomings of these detection mechanisms and discussed different techniques which the virus writers are resorting to evade detection. We then went on to survey some methods to limit the damages due to unidentified viruses. Unfortunately these methods end up being too complex to implement or force us towards unusable systems (systems with no sharing for example). It may be pointed out that the malware can be exploited for criminal activities.
Malware: From Modelling to Practical Detection
37
We have also presented a promising new direction for protecting from malware. Our approach is based on the observation that malware infect trusted programs to include a subroutine for damage to be carried out in the background without the users consent. We proposed a framework based on runtime monitoring of trusted programs and the notion of bisimulation to validate their behaviour. We presented various experimental results to demonstrate the efficacy of the approach and showed its resilience to program obfuscation techniques.
Acknowledgement The authors are grateful to L.M. Adleman, and F Cohen who founded the excellent theory of computer viruses. One of the authors (Harshit Shah) was supported under ITPAR II project from DST, Govt. of India.
References 1. Adleman, L.M.: An abstract theory of computer viruses. In: Goldwasser, S. (ed.) CRYPTO 1988. LNCS, vol. 403, pp. 354–374. Springer, Heidelberg (1990) 2. Barak, B., Goldreich, O., Impagliazzo, R., Rudich, S., Sahai, A., Vadhan, S.P., Yang, K.: On the (im)possibility of obfuscating programs. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 1–18. Springer, Heidelberg (2001) 3. Bhattacharjee, A.K., Sen, G., Dhodapkar, S.D., Karunakar, K., Rajan, B., Shyamasundar, R.K.: A system for object code validation. In: Joseph, M. (ed.) FTRTFT 2000. LNCS, vol. 1926, pp. 152–169. Springer, Heidelberg (2000) 4. Chow, S., Gu, Y., Johnson, H., Zakharov, V.A.: An approach to the obfuscation of control-flow of sequential computer programs. In: Davida, G.I., Frankel, Y. (eds.) ISC 2001. LNCS, vol. 2200, pp. 144–155. Springer, Heidelberg (2001) 5. Christodorescu, M., Jha, S.: Static analysis of executables to detect malicious patterns. In: SSYM 2003: Proceedings of the 12th conference on USENIX Security Symposium, Berkeley, CA, USA, pp. 12–12. USENIX Association (2003) 6. Christodorescu, M., Jha, S.: Testing malware detectors. In: ISSTA 2004: Proceedings of the 2004 ACM SIGSOFT international symposium on Software testing and analysis, pp. 34–44. ACM, New York (2004) 7. Christodorescu, M., Jha, S., Kruegel, C.: Mining specifications of malicious behavior. In: Crnkovic, I., Bertolino, A. (eds.) ESEC/SIGSOFT FSE, pp. 5–14. ACM, New York (2007) 8. Christodorescu, M., Jha, S., Seshia, S.A., Song, D.X., Bryant, R.E.: Semanticsaware malware detection. In: IEEE Symposium on Security and Privacy, pp. 32–46. IEEE Computer Society, Los Alamitos (2005) 9. Cohen, F.: Computer viruses: theory and experiments. Comput. Secur. 6(1), 22–35 (1987) 10. Cohen, F.: Computer Viruses. PhD thesis, University of Southern California (1986) 11. Collberg, C., Thomborson, C., Low, D.: A taxonomy of obfuscating transformations. Technical Report 148, Department of Computer Science, University of Auckland (July 1997), http://www.cs.auckland.ac.nz/ collberg/Research/Publications/ CollbergThomborsonLow97a/index.html
38
R.K. Shyamasundar, H. Shah, and N.V.N. Kumar
12. Dinaburg, A., Royal, P., Sharif, M., Lee, W.: Ether: malware analysis via hardware virtualization extensions. In: CCS 2008: Proceedings of the 15th ACM conference on Computer and communications security, pp. 51–62. ACM, New York (2008) 13. Dittrich, D.: Malware to crimeware: How far they gone, and how do we catch up? Login, The USENIX Magazine 34(4), 35–44 (2009) 14. Filiol, E.: Computer Viruses from Theory to Applications. IRIS International Series. Springer, France (2005) 15. IBM X Force Threat Reports. IBM Internet Security Systems X-Force, trend and risk report (2008), http://www-935.ibm.com/services/us/iss/xforce/trendreports/ 16. IBM X Force Threat Reports. IBM Internet Security Systems X-Force, mid-year trend and risk report (2009), http://www-935.ibm.com/services/us/iss/xforce/trendreports/ 17. Forrest, S., Hofmeyr, S.A., Somayaji, A.: Computer immunology. CACM 40(10), 88–96 (1997) 18. Garfinkel, T., Adams, K., Warfield, A., Franklin, J.: Compatibility is not transparency: Vmm detection myths and realities. In: HOTOS 2007: Proceedings of the 11th USENIX workshop on Hot topics in operating systems, Berkeley, CA, USA, pp. 1–6. USENIX Association (2007) 19. Horwitz, S.: Precise flow-insensitive may-alias analysis is np-hard. ACM Trans. Program. Lang. Syst. 19(1), 1–6 (1997) 20. Jiang, X., Wang, X., Xu, D.: Stealthy malware detection through vmm-based “outof-the-box” semantic view reconstruction. In: CCS 2007: Proceedings of the 14th ACM conference on Computer and communications security, pp. 128–138. ACM, New York (2007) 21. King, S.T., Chen, P.M., Wang, Y.-M., Verbowski, C., Wang, H.J., Lorch, J.R.: Subvirt: Implementing malware with virtual machines. In: SP 2006: Proceedings of the 2006 IEEE Symposium on Security and Privacy, Washington, DC, USA, pp. 314–327. IEEE Computer Society, Los Alamitos (2006) 22. Kundaji, R., Shyamasundar, R.: Refinement calculus: A basis for translation validation, debugging and certification. Theoretical Computer Science 354, 156–168 (2006) 23. Morrisett, G., Crary, K., Glew, N., Grossman, D., Samuels, R., Smith, F., Walker, D., Weirich, S., Zdancewic, S.: Talx86: A realistic typed assembly language. In: Second Workshop on Compiler Support for System Software, pp. 25–35 (1999) 24. Myers, A.C.: Jflow: practical mostly-static information flow control. In: POPL 1999: Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 228–241. ACM, New York (1999) 25. Necula, G.C.: Proof-carrying code. In: POPL 1997: Proceedings of the 24th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 106– 119. ACM, New York (1997) 26. Von Neumann, J.: Theory of Self-Reproducing Automata. University of Illinois Press, Champaign (1966) 27. Raffetseder, T., Kr¨ ugel, C., Kirda, E.: Detecting system emulators. In: Garay, J.A., Lenstra, A.K., Mambo, M., Peralta, R. (eds.) ISC 2007. LNCS, vol. 4779, pp. 1–18. Springer, Heidelberg (2007) 28. Ramalingam, G.: The undecidability of aliasing. ACM Trans. Program. Lang. Syst. 16(5), 1467–1471 (1994) 29. Rice, H.G.: Classes of recursively enumerable sets and their decision problems. Transactions of the American Mathematical Society 74(2), 358–366 (1953)
Malware: From Modelling to Practical Detection
39
30. Schneider, F.B.: Enforceable security policies. ACM Trans. Inf. Syst. Secur. 3(1), 30–50 (2000) 31. Seshadri, A., Luk, M., Perrig, A., van Doorn, L., Khosla, P.: Externally verifiable code execution. CACM 49(9), 45–49 (2006) 32. Shah, H.J., Shyamasundar, R.K.: On run-time enforcement of policies. In: Cervesato, I. (ed.) ASIAN 2007. LNCS, vol. 4846, pp. 268–281. Springer, Heidelberg (2007) 33. Shyamasundar, R., Shah, H., Kumar, N.N.: Checking malware behaviour via quarantining (abstract). In: Int. Conf. on Information Security and Digital Forensics, vol. City University of London, Full manuscript under submission process (September 2009) 34. Walker, D.: A type system for expressive security policies. In: POPL 2000: Proceedings of the 27th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pp. 254–267. ACM, New York (2000) 35. www.computereconomics.com 2007 malware report: The economic impact of viruses, spyware, adware, botnets, and other malicious code, http://www.computereconomics.com/page.cfm?name=Malware%20Report
Semantic Frameworks—Meanings in the Architecture Jim Davies and Jeremy Gibbons Computing Laboratory, University of Oxford http://www.comlab.ox.ac.uk
Abstract. In most applications of information technology, the limiting factor is neither computational power nor storage capacity; nor is it connectivity. Hardware can be obtained at commodity prices, and software infrastructure can be downloaded free of charge. The limiting factor is the cost of consistency and coordination: in software development, in systems integration, and in continuing interaction with users. This paper explains how the use of semantic technologies and model-driven engineering can greatly reduce this cost, and thus increase the quality, interoperability, and suitability of information technology applications.
1
Introduction
The prediction made in 1965 by Gordon Moore, later enshrined as “Moore’s Law”, still holds true: “The complexity for minimum component costs has increased at a rate of roughly a factor of two per year. . . there is no reason to believe it will not remain nearly constant for at least ten years” [10]. This complexity, and hence the power, capacity, and connectivity of our computing infrastructure, continues to increase at an exponential rate, and is likely to do so for at least another ten years [4]. This law will one day cease to apply. As Moore himself has said, “It can’t continue forever. The nature of exponentials is that you push them out and eventually disaster happens.” [2]. However, we have already reached the point where every piece of information that we might hope to record using pen and paper could easily be stored and processed in computing systems. We could be living in the world of the “paperless office”, predicted in an editorial for Business Week back in 1975. [16]. We could be living in a world in which information technology allowed scientists, businesses, and governments to work together, seamlessly, and effectively, combining their resources to address the challenges of a new century. Instead, we are still living in a world in which most scientific data is unshared, many business systems are incompatible, and ‘joined up government’ is little more than an electoral promise [8]. The reason for this—the limiting factor on progress and application—is neither a lack of computational power nor one of storage capacity; nor is it a lack of connectivity. It is, quite simply, the cost of consistency and coordination: in software development, in systems integration, and in continuing interaction with users. T. Janowski and H. Mohanty (Eds.): ICDCIT 2010, LNCS 5966, pp. 40–54, 2010. c Springer-Verlag Berlin Heidelberg 2010
Semantic Frameworks—Meanings in the Architecture
41
It can be expensive to develop software whose behaviour is consistent with requirements. A typical ‘requirements process’ will involve analysis of existing systems, processes, and constraints, and agreement upon a specification for the new system. This specification then forms a basis for software design and development, and also for subsequent evaluation of the delivered system. All too often, it is only at the point of delivery that we discover that requirements have been inadequately specified, misinterpreted, or misunderstood. It can be expensive also to reconcile requirements, or to coordinate software development, so that different systems are able to work together. Inconsistency at lower levels of abstraction—hardware, networking protocols, file formats—may be irritating, but is easily accommodated through software drivers, wrappers, and converters. At a higher, semantic level, however, differences in approach and interpretation can lead to situations in which meaningful integration—of systems or data—would be impossible. Finally, it can be expensive to provide appropriate training and documentation, or to develop a sufficiently intuitive interface, that people will be consistent in their use of the system: recording information in the same way, making use of the same functions, and adopting compatible interpretations of the data presented. And yet if they do not, then the meaning of the data in the system may be quite inconsistent with any specification, and may depend upon information that has not been recorded. This can greatly reduce the value and utility of the system, and the data it contains. In each case, we can reduce costs by making interpretations and meanings more accessible and more computable: taking them out of the heads of the customers, developers, and users, and recording them in a way that supports not only manual inspection, but also automatic incorporation in the design, integration, and operation of our systems. To make this possible, we require a structure for the creation and management of terms, definitions, and usages—a standard means of describing semantics.
2
Semantics
In computing, the notion of ‘semantics’ is used in two senses. When we talk of programming language semantics, or the semantics of a modelling notation, we mean the intended interpretation of the language features—often expressed in terms of some other notation whose meaning is already understood. When we talk of semantic integrity, or of the semantic web, we mean the intended interpretation of data or behaviour in terms of entities in the real world. For example: we might give a semantics to the statement x := x + 1 in a programming language in terms of a mathematical function upon relations representing states; and if a travel booking system were to record both currentDate and dateOf T ravel information, we should not be surprised to find a semantic integrity constraint stating that the values of these attributes for the same booking enquiry should satisfy the < (less than) relation.
42
J. Davies and J. Gibbons
These two usages of the word are closely related. A computable representation of a ‘real world’ semantics will be expressed using modelling notations and programming languages, and the ‘language’ semantics will tell us how to break down that expression into simpler, component parts. However, while we might expect a language semantics to be a single, static document, generally agreed, we should expect our real world semantics to be a varying composition of documents and models, specific to a particular situation or purpose. Furthermore, whereas a language semantics might hope to present a total, complete account of the meaning of a particular construct, expressed still in some abstract, discrete mathematical domain, a real world semantics will always be partial and incomplete. Consider, for example, the semantics of a data item collected on the US I-94W visa waiver form [14], against the question: “have you ever been arrested. . . for a violation related to a controlled substance. . . ?”. The value of the data item might be “yes” or “no”, or some value indicating that the question was not properly answered. Its semantics may include the text of the question, the version of the form concerned, any guidance notes supplied, and the date of completion. It may include also the nationality of the individual named on the form, as this might conceivably influence the interpretation of the phrase “controlled substance”. In general, there will be no limit upon the amount of contextual information that might have some bearing upon our interpretation of a data item or function. And as that context is constantly changing, we might sensibly regard any real world semantics as transient, consisting simply of whatever additional information we present for the purpose in hand. This information we will refer to as the semantic metadata for the item concerned. To ensure that the behaviour of our systems is consistent with requirements, we can: provide a rich collection of semantic metadata for the specification document, and make this accessible to both customers and developers; make use of this semantic metadata in the automatic generation of part (or even all) of the implementation. We refer to this as semantics-driven development. To coordinate the design of different systems, we can develop each with reference to common semantic metadata: that is, with reference to some collection of ‘standard’ interpretations. The transient, unbounded nature of real world semantics means that any standard at this level will be limited in scope, applicable only to a certain audience, and only for a certain time. We must therefore support multiple, evolving ‘standards’, by developing a standard means of publishing, managing, and relating semantic metadata: a semantic meta-standard. To ensure that the operation of our system is consistent with the designers’ intentions, and to coordinate the actions and interpretations of the users, we can make the semantic metadata available at run-time: not merely by incorporating it into the design of the system, but also by making it accessible through the user interface. In every interaction with the system, a user’s actions may be informed—and related computations may be initiated, or even automatically performed—on the basis of the semantics of the data items involved. We refer to this principle of transparency as open semantics.
Semantic Frameworks—Meanings in the Architecture
43
In each case, we are aiming to ensure that each and every artifact present in our system—an attribute name in a design document, a method name in an interface, a question on a screen, an element of a drop-down list—comes with a reference to some useful semantic metadata. Such a reference may be accessed by a computer program: for example, to examine an XML description of a particular web service. Or it may be followed by a human, who wishes to learn more about the interpretation of an answer before they select it from a list. To make this work in practice, we require an implementation of a semantic meta-standard: a standard way for developers, customers, and users to publish, manage, and relate semantic metadata. We require also, for any particular application domain, a collection of metadata conforming to that standard, comprising both the constructive descriptions needed for semantics-driven development, but also the documentation needed for an open semantics. We will refer to such a collection as a semantic framework.
3
Semantic Frameworks
At the heart of any semantic framework will be a collection of value domains, each describing a range of possible values that might be associated with a data item. The importance of agreement upon the range and interpretation of values, including the units employed, cannot be overstated. As an example, consider the case of the NASA Mars Climate Orbiter [11], which was lost after messages between two different systems were misinterpreted: the first was sending values in US units (lbf-s), the second was expecting values in SI units (Ns); the result was an orbit 170km lower than planned—23km below survivable height. A further, cautionary example is provided by the range of different interpretations for the same ‘10 codes’ across the emergency services in the United States. Almost any viewer of US television will be aware that ‘10–4’ means ‘okay’ or ‘received and understood’ (although, as an aside, we might observe that this code has been reported as meaning ‘please repeat previous message’ in New Zealand [17]). However, other codes have widely differing meanings, even for agencies with overlapping jurisdictions. The code ‘10-47’ means ‘nuclear substance incident’ for New York City emergency response, but ‘road repair’ for New York State. While this might be cause for amusement, the fact that ‘10-33’ means ‘traffic delays’ for the highway patrol in Missouri, but ‘officer down’ to local police in the state could have had fatal consequences for an injured officer [13]. Following reviews of emergency services coordination, the US Department of Homeland Security has asked emergency services not to use these and other codes in radio communication. It is inevitable that we should wish to place differing interpretations upon the same codes. The effort required to achieve and maintain a consistent interpretation increases rapidly with the number of codes involved, and yet each agency or community will have its own priorities regarding standardisation: an agency working in a cold climate might agree a set of terms pertaining to snow-related incidents, but these terms would be irrelevant elsewhere.
44
J. Davies and J. Gibbons
Fig. 1. BA Special Meals
In business, organisations will adopt new terms and new meanings as part of a process of differentiation, in seeking competitive advantage. Or they may adopt a different interpretation out of necessity, being unable to find an existing set of values that meets their operational needs. As an example, consider the value domain shown in Figure 1, which describes the list of special meals that can be requested by British Airways (BA) passengers. Each item of text, such as “Asian vegetarian”, comes with a brief explanation of its intended meaning: a description of a particular class of meal. A full, computable definition of this value domain would specify also the representation (a text string of a particular length), and may be associated with other resources, such as documents or even menus: this would allow the open presentation of the definition at the point where the customer or their agent makes a selection. Each usage of a value domain is associated with one or more data elements: templates for the collection of data against a specific value domain. A data element must have a unique identifier; it may have also a set of names and an informal description, elaborating upon the semantics provided by the value domain. For example, a data element for meal choices might be defined as identifier: 1777777-14-72-131-424 name: special meal option description: [ ... ] value domain: 1777777-14-72-131-001
Semantic Frameworks—Meanings in the Architecture
SpecialMealRequest
45
<<1777777-14-72-131-424>> mealPreference
mealRequest
PassengerNameRecord
FrequentFlyerPreferences
Fig. 2. Using a Common Data Element
where 1777777-14-72-131-001 corresponds to the definition of value domain shown in Figure 1. Note that value domains and data elements are both classifiers, in that our documents, programs, and systems include items identified as instances of this value domain, or that data element. For example, a UML model showing a particular usage of the data element introduced above is shown in the class diagram of Figure 2, a partial description of the information architecture used by the airline. In the diagram, a UML class is tagged with a reference to the registered data element, indicating that it should implement the corresponding data type, and that its usage should be consistent with the corresponding semantics. In this model, both mealRequest and mealPreference are instances of the data element 1777777-14-72-131-424. They are also elaborations upon its meaning: we may regard this UML model as an additional item of semantic metadata, telling us more about how the BA meal choice data element is used, and thus more about its meaning. A developer working on a new system for the company or for one of its business partners might achieve greater consistency by re-using, or making reference to, this model, as well as to the definitions of the data element and value domain. We may expect any semantic framework to include a number of models that represent classifications of data elements and value domains—or even of other models. These models support the discovery and re-use of common data elements in different contexts, and may add to their semantics by declaring and constraining relationships between them. Some of these will have a specific, administrative role: indicating which of a range of elements may be preferred for a specific purpose, or recording versioning and supercession information. The most important kind of model, in terms of potential reductions in the cost of consistency and coordination, is the domain metamodel. This is a model of models, a pattern for software development, or systems integration and operation, within a particular domain. For example, we might imagine a metamodel for airline booking systems, which includes an element describing special meal requests. Different airlines might instantiate that element in different ways—see,
46
J. Davies and J. Gibbons
Religious Meals – Kosher Meal Pre-packed and sealed; contains meat – Muslim Meal No alcohol/pork/ham/bacon – Hindu Meal No beef, veal, pork, smoked or raw fish but can contain other types of meat. – Vegetarian Meals − Raw Vegetarian Meal Only raw fruits and vegetables − Vegetarian Oriental Meal No meat or seafood of any sort; can contain dairy products; cooked Chinese-style − Vegetarian Indian Meal (non-strict) No meat of any sort; can contain dairy products; cooked Indian-style − Vegetarian Jain Meal (strict; suitable for Jain) No meat of any sort; no onion, garlic, ginger and all root vegetables; cooked Indian-style − Western Vegetarian (non-strict; ovo-lacto) No meat of any sort; can contain dairy products; cooked Western-style − Vegetarian Vegan Meal (strict) No meat of any sort; no dairy products; cooked Western-style
Fig. 3. SQ Special Meals
for example, Figure 3, which describes the meal choices available on Singapore Airlines—but we would still be able to locate and read, automatically, the value domain corresponding to meal selections. Furthermore, a metamodel provides a basis for defining transformations at the model level. We might register, as part of our semantic framework, a model transformation that translates between the BA and Singapore domains; this could then be automatically discovered and applied on demand. Of course, we might expect to choose between one of several possible transformations, according to the specific context or purpose. For example, if we were interested in vegetarians who consume dairy products but are strict in their avoidance of seafood, then we might wish to ignore all but the first two categories of vegetarian meals from the Singapore Airlines list: these are the only two that explicitly exclude seafood. Alternatively, we might assume that the phrase “no meat of any sort” excludes seafood, and hence that any of the categories could apply. Any integration or analysis represents a context in itself, an additional, specific semantics for the information; we may wish to record this to explain our actions or results—in scientific terms, to provide for the repeatability of the experiment. If we wished to conduct a number of similar analyses, then we might define a metamodel for the analysis of data in this domain, and instantiate this with each specific set of assumptions.
Semantic Frameworks—Meanings in the Architecture
4
47
Application
This notion of semantic frameworks has been informed by several years of work in a particular application domain: that of clinical research informatics. The wide variations in biology and physiology within a population, and the variety of factors affecting health, mean that it is difficult to infer anything based upon one person’s response to a particular treatment. As a result, clinical trials, systematic studies of large populations, are essential to progress in medicine. In the case of the anti-cancer treatment Tamoxifen [3], the integration of data from 400 different trials allowed researchers to identify the subset of the population responsive to the drug, and indicated the optimum period of treatment. The adoption of compatible experimental protocols, with a common set of observations—data elements and value domains—produced an evidence base that changed clinical practice in the UK and elsewhere, and reduced mortality from operable breast cancer by 24%. This kind of integration is more often impossible: different studies make different observations, record the same information in different ways, or leave the precise meaning of the data unclear. A recent attempt at integrating 75 studies in ovarian cancer [5] was more representative in its outcome, failing due to inconsistencies in the choice of clinical and molecular variables, together with a lack of critical information about the experimental processes. It is unrealistic to expect different trials to be conducted to the same design: each represents a fresh context for observations, and we would expect designs to change as scientific knowledge advances, novel techniques are developed, and new technologies become available. However, not only can we identify standard collections of data elements and value domains for use across multiple trials—as in the case of Tamoxifen—but we can identify also commonalities between trial designs, patterns that every trial of a certain kind must conform to. The Consolidated Standards of Reporting Trials (CONSORT) statement [9] is an account of best practice in trials design. As part of the UK CancerGrid project [1], we were able to develop a domain metamodel for trials based upon this statement: a template that could be instantiated to produce a specific trial design. The process of instantiation consists in selecting data elements and value domains for the trial in question, some of which might be novel, and can be published for future reference. As clinical trials are experiments upon humans, a design document must describe the proposed trial in considerable detail, sufficient to allow a committee to determine it would be ethical to proceed. An instantiated trial model can be used as the basis for the automatic generation of the software needed to support trial execution: the forms for data entry, the services for subject and data management, and the transformations needed to extract the information needed to meet particular reporting requirements. The automatic generation of software artifacts can be crucial to the success of a semantic framework: it reduces the cost of software production to the point where we can overcome the inertia of existing systems and processes, replacing manual production of systems that are not interoperable with the automatic
48
J. Davies and J. Gibbons
production of systems that are. Furthermore, the models used as the basis for automatic generation are necessarily accurate depictions of usage, and hence are themselves accurate, up-to-date representations of semantic information. The semantic framework produced by the CancerGrid project is now being extended as part of the US cancer Biomedical Informatics Grid (caBIG) initiative [15], linking clinical trial designs, data sets, and analytical tools produced by a global community of cancer researchers. The cancer Data Standards Registry and Repository (caDSR) that sits at the heart of caBIG is the largest example of a semantic framework currently in use: it contains more than 12,000 data elements, whose definitions are linked to an underlying thesaurus of more than 60,000 biomedical terms. Other examples include the Metadata Online Registry (METeOR) maintained by the Australian Institute of Health and Welfare, the Canadian Institute for Health Information, the National Information Exchange Model (NIEM) from the US Departments of Homeland Security and Justice, and the US Health Information Knowledgebase. All of these, and the CancerGrid framework, implement the ISO 11179 [6] standard for metadata registries—an example of the kind of meta-standard required for the description of semantic information. However, the use of semantic frameworks in the design and development of software systems is still in its infancy, and there are many engineering issues to be addressed. Indeed, semantic frameworks may be seen as posing a collection of ‘grand challenges’: one for each application domain, in defining an appropriate base set of semantic metadata for collaboration, including domain metamodels for software generation; and one for computing itself, in providing an appropriate architecture for the realisation of these frameworks.
5
A Domain Challenge
As an example of a domain-specific grand challenge, we may consider that of information-driven health. Advances in analysis and imaging techniques, and progress in genomic, proteomic, and metabonomic science, allow us to obtain detailed information about the health of an individual. The automatic integration of this data, based upon a computable representation of its meaning or semantics, will revolutionise both medical and clinical research, and the impact on healthcare delivery will be dramatic. This revolution will come not only in personalised medicine, informed by the new biology, but also in the very nature of national and international healthcare systems. Agencies will be able to work faster and more effectively in adapting to changes in the circumstances, from advances in the body of medical knowledge to public health emergencies. Their agility will be limited only by the human capacity of ideas and understanding. To explain what it may be realistic to expect, within the next decade, we present three simple scenarios, each addressing a different aspect of informationdriven health:
Semantic Frameworks—Meanings in the Architecture
5.1
49
Scenarios
On-demand Collaboration. A researcher in breast cancer receives automatic notification of a paper in their specific topic of interest. The paper reports the results of a meta-analysis, a synthesis of independent but related studies, looking at the effectiveness of two different therapies. The two therapies appear equally effective, and a clinician would thus have no clear basis for selecting one over the other, in the treatment of a particular patient. However, the researcher believes that they may have access to additional data—genetic profiles and details of serious adverse events—that could contribute to the analysis. This is confirmed by means of a query to the relevant systems, which establishes a match—at the necessary level of detail—between this additional data and the datasets used in the meta-analysis. Automatically performing a simulation based upon the metadata, the systems suggests that the combined data would be enough for a statistically significant result. The researcher contacts the authors of the study, who are excited at the prospect of refining their meta-analysis with the new hypothesis. It turns out that they do not have access to enough genetic data to complete the combined analysis, but they work together on a proposal for retrieving and testing the samples required. The creation, submission, and review of the proposal is expedited by the automatic generation of the study protocol, the evidence of the statistical power of the calculation, an account of the potential benefit to health, and a projection of the costs. Provisional ethical approval is established automatically by reference to previous decisions, and this is countersigned by chairs of the respective ethics committees. Upon approval, the proposal is forwarded to the funding body, who agree to pay for the tissue processing costs. As the potential impact of the research can be quantified, various journals make offers to publish the results; on this occasion, the researchers accept the conditional offer from Nature Publishing. The results of the additional analysis show a clear correlation between specific gene expression, efficacy and adverse responses. The researchers upload their paper to Nature, together with the datasets, automatically processed to conform to the ethical approval. Much of the paper has been generated automatically from the hypotheses and design encoded in the proposal. Control of Infectious Diseases. A person suffering from flu-like symptoms accesses the national web portal for advice, and is guided through a quick checklist to establish whether or not they should seek medical attention. Based upon the severity and precise nature of the symptoms, there appears to be cause for concern, and the person is offered a choice of local appointments. The reason for prioritisation is that the symptoms appear to be indicative of H1N1. The portal has been automatically configured to take account of upto-date information about this and other diseases, including the geographical location of recent, confirmed cases. The questions asked are targeted; the responses, drawn from a controlled vocabulary, add to the information base.
50
J. Davies and J. Gibbons
Upon arrival at the clinic, the subject is seen by a physician already primed with information regarding the suspected diagnosis. As a result of the consultation, the physician requests urgent tests, and an ambulance is called to take the subject into precautionary quarantine. Real-time case reporting for these incidents is provided, with data parameterised by levels of certainty. As a result of the new case, the portal and other information systems are reconfigured to ask questions, based upon the reported symptoms, characteristic of a particular strain. Clinical testing equipment, including hand-held diagnostic devices and interfaced systems, will be automatically configured to look for this disease even when testing for other conditions. The national health protection agency obtains information about the subject, including any information about recent movements. If consent and authority are available, then the agency will access and integrate data from a variety of sources, including telecommunications, financial, and immigration records. The results of the subsequent analysis will further inform the dynamic re-configuration of the healthcare information systems. Improving Research Efficiency. An oncologist wishes to start trials on a new treatment for pancreatic cancer. Positive results have been obtained in early phase studies, and the next step is to propose a randomised Phase III trial. However, with an incidence of 1 in 9000, the target recruitment of 1000 represents one-tenth of the cases reported annually; it may be impossible to initiate more than one such trial in pancreatic cancer each year. As part of the reviewing process, the research council asks a collaborative group to consider the data requirements of the proposal in the context of other research on this disease. The group proposes a number of modifications—extended eligibility criteria, some additional items of data, and the different value domain for one of the data items—that would allow the same data to be used to support other research: in particular, genetic studies for the untreated disease. The group is able to do this, quickly and reliably, because the proposal includes a detailed, computable specification of the trial protocol. The protocol includes detailed descriptions of standard operating procedures for the collection of tissues and body fluids, together with downstream assays, to be used for pharmacodynamic endpoints. These endpoints may be used as assays (predictive biomarkers) for future individualisation of therapy if validated in the trial. An international portal for pancreatic cancer provides services for registering studies, datasets, and protocols along with the precise definitions of the data elements involved; it is thus possible to identify, automatically, aspects of the proposed trial that overlap with or complement other work. When the research council decides to fund the proposed trial, the majority of the infrastructure required is generated automatically from the final, approved version of the proposal: forms for registration, eligibility, serious adverse event reporting, treatment, and follow-up; supporting services for randomisation, sample handling, patient timetabling, clinician management; documentation for procedures and workflows.
Semantic Frameworks—Meanings in the Architecture
51
The automatic generation of supporting software makes it easier to guarantee the quality and and compatibility of the data collected, and greatly reduces the cost of trial start-up. Furthermore, as the proposal includes a computable description of the proposed analysis, the necessary statistical tools can be automatically configured and tested. As a result, interim and final analyses can be performed as soon as the actual data is available. Data from this study can then be combined with data from two similar randomized studies elsewhere in the world, allowing the biomarkers to be robustly validated. 5.2
Challenges
The automatic integration of data from different studies, and the facilitation of collaborative science based upon shared metadata—models of the studies themselves—has benefits across the whole of medical research and practice. For example, in vaccinology, if variations in a gene that codes for one part of the immune system are found to strongly influence the response to a vaccine, then we know that that part of the immune system is fundamental in the response, and that could help target that part of the immune system for future vaccine development. This is an area where large numbers of subjects are needed, and effective collaboration between researchers is essential. Increasing travel, global trade, and changing climate have meant that infectious diseases, along with other threats to public health, are emerging, and spreading, faster than ever before. The World Health Report 2007 [19] from the World Health Organisation, argues strongly that effective data sharing across organisational and national boundaries is essential to global public health. The International Health Regulations (2005) [18] “provide the framework for improved international public health security, laying out new obligations devised to collectively respond to international public health challenges of the 21st Century, taking advantage of new developments in [. . . ] information technology, such as rapid data sharing. Unprecedented tools are now available to rapidly detect, assess, and respond to events. . . ”. These regulations entered into force in June 2007, and should be fully implemented by June 2012: by this date, systems must be in place for timely and reliable notification, consultation, and verification; in most cases, a period of 24 hours is specified. This will not be achieved without advances in enabling, software technologies for automatic, metadata-driven data sharing and integration. Proactive management of a research portfolio requires detailed information not only about results obtained, but also about studies that are still at the design stage. The size of the portfolio, the complexity of the research, and the dynamic nature of the translational process mean that effective information technology support is essential. The availability of detailed, computable information about study design supports not only operational portfolio management but also the evaluation and demonstration of impact. The grand challenge for information-driven health is to make semantics-driven management of data standard practice across the whole spectrum of healthcare and medical research.
52
6
J. Davies and J. Gibbons
A Grand Challenge in Informatics
There has been considerable emphasis upon the computational challenges encountered in the analysis of data, and much progress has been made in this respect: in particular, within the projects funded as part of the various national “e-Science” programmes. However, there is growing recognition that the large-scale sharing and integration of data from dynamic, heterogeneous sources requires computable representations of the semantics of data, and it is here that a significant challenge lies. Natural language or informal understanding is sufficient for such a semantics only when the concepts are straightforward, the community is small or homogeneous, and the period of time over which understanding must be maintained is short. For problems of any complexity, communities of any size, or initiatives that are intended to last for many years, a formal approach is required. The semantics has to be amenable to automatic processing, and this processing has to be automatically linked to the processing of the data itself. Semantic frameworks of the kind described above, whether for informationdriven health research and practice or for any other domain, present significant software engineering challenges. These challenges fall into two categories: those of data semantics in representing models, and those of model-driven development in generating system artifacts—queries, scripts, programs, services, forms, and interfaces—from these models. There are solid foundations on which to build, many developed under the banner of the Semantic Web: notations for representing models, such as the Extensible Markup Language (XML), Resource Description Framework (RDF), and description logics; and notations for expressing model transformations, such as the Structured Query Language (SQL), Extensible Stylesheet Language Transformations (XSLT), and Gleaning Resource Descriptions from Dialects of Languages (GRDDL). However, much remains to be done. In particular, a continuously evolving context forces a raising in the level of abstraction, above that achieved in current implementations of the Model-Driven Architecture (MDA) approach [7]. It has been a tenet of this approach that system artifacts are inherently transient, and should be generated automatically from models rather than laboriously crafted by hand, but in a dynamic context even the transformations that generate these artifacts are transient: these too should be constructed by automatic refinement of models into code. The ‘transformations of transformations’ that we require are most naturally expressed in terms of higher-order and datatype-generic functional programming, but these techniques need further development. The research problems in the area of data semantics involve metadata, ontologies, models, security, and analysis. To support diverse and dynamic data communities, techniques are needed for the construction, federation and versioning of metadata repositories, and the establishment and maintenance of multiple, purposed ontologies over the same vocabulary and mappings between them. In order to model sophisticated standards such as the CONSORT [9] statement faithfully, progress is required in expressing and composing workflow fragments—the
Semantic Frameworks—Meanings in the Architecture
53
dynamic aspects of a model, as well as the static aspects. To derive the full benefit from the semantic framework, the facility is needed for semantics-driven data analysis: metamodels of analytic techniques, enabling the automatic configuration of analytic software. Finally, sensitive domains such as healthcare have stringent security requirements, particularly regarding privacy, and these could be significantly enhanced by exploiting the semantics of data, rather than mere syntax. Furthermore, critical software systems require validation and testing, even if they are generated automatically, and work is needed in exploiting the data semantics to facilitate and enrich this process.
Acknowledgements The authors would like to thank Charles Crichton, Steve Harris, Aadya Shukla, and Andrew Tsui for their contributions to work on semantic technologies at Oxford. The airline meals example used in Section 3 is a refinement of an example presented in [12]. The semantic framework developed for the CancerGrid project of Section 4 is explained in more detail in [1]. The scenarios in Section 5 were developed in discussion with James Brenton, Steve Harris, and Matthew Snape. We are grateful to the UK Engineering and Physical Sciences Research Council and to Microsoft External Research for their support.
References 1. Crichton, C., Davies, J., Gibbons, J., Harris, S., Tsui, A., Brenton, J.: Metadatadriven software for clinical trials. In: ICSE Workshop on Software Engineering in Health Care. IEEE, Los Alamitos (2009) 2. Dubash, M.: Moore’s Law is dead, says Gordon Moore. Techworld (April 2005) 3. Early Breast Cancer Trialists’ Collaborative Group. Tamoxifen for early breast cancer: An overview of the randomised trials. Lancet 351 (1998) 4. Geelan, J.: Moore’s Law: “We See No End in Sight”, Says Intel’s Pat Gelsinger. Java Developer’s Journal (May 2008) 5. Hall, J., Paul, J., Brown, R.: Critical evaluation of p53 as a prognostic marker in ovarian cancer. Expert Reviews in Molecular Medicine 6(12) (2004) 6. International Organization for Standardization (ISO). Information technology specification and standardization of data elements (2009), http://www.iso.org/ 7. Kleppe, A., Warmer, J., Bast, W.: MDA Explained, The Model Driven Architecture: Practice and Promise. Addison-Wesley, Reading (2003) 8. Di Maio, A.: Move ‘joined-up government’ from theory to reality. Gartner Research (2004) 9. Moher, D., Schulz, K.F., Altman, D.G.: The CONSORT statement: Revised recommendations for improving the quality of reports of parallel-group randomised trials. Lancet 357 (2001) 10. Moore, G.: Cramming more components onto integrated circuits. Electronics 38(8) (April 1965) 11. NASA. Mars Climate Orbiter Mishap Investigation Board Phase I Report (1999)
54
J. Davies and J. Gibbons
12. Shukla, A., Harris, S., Davies, J.: Semantic interoperability in practice. In: 43rd Hawaii International Conference in Systems Sciences. IEEE, Los Alamitos (2010) 13. Sullivan, L.: Plain talk eases police codes off the air. US National Public Radio (October 2009) 14. US Customs and Border Protection. Arrival-Departure Record, CBP Form I-94W, for Visa Waiver Program (October 2009), www.cbp.gov 15. US National Cancer Institute. Cancer Biomedical Informatics Grid (caBIG) (October 2009), cabig.nci.nih.gov/ 16. Business Week. The Office of the Future. Executive Briefing (June 1975) 17. Wikipedia. Ten-code (article) (October 2009) 18. World Health Organisation. International Health Regulations (2005). WHO (2005), http://www.who.int/csr/ihr 19. World Health Organisation. World Health Report — A Safer Future: Global Public Health Security in the 21st Century. WHO (2007), http://www.who.int/whr
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks Anuradha Banerjee1 and Paramartha Dutta2 1
Kalyani Govt. Engg. College, Kalyani, Nadia, West Bengal, India [email protected] 2 Visva-Bharati University, Santiniketan, West Bengal, India [email protected]
Abstract. Ad hoc networks are collections of mobile nodes communicating using wireless media without any fixed infrastructure. Existing multicast protocols fall short in a harsh ad hoc mobile environment, since node mobility causes conventional multicast tree to rapidly become outdated. The amount of bandwidth required for building up a multicast tree is less than that required for other delivery structures, since a tree avoids unnecessary duplication of data. In this article, we propose FSIM, a fuzzy controlled source-initiated intelligent multicast routing scheme that takes into account estimated network evolution in terms of residual energy, link stability, position of receivers in the multicast tree etc. Extensive simulation experiments have been conducted to compare performance of FSIM with state-of-the-art tree and mesh-based multicast protocols. The results with respect to a wide range of input parameters show that FSIM attains significantly higher packet delivery ratio at much lesser cost than its competitors. Keywords: Ad hoc networks, multicasting, pivot node, stability, tree.
1 Introduction Ad hoc networks are collections of mobile nodes communicating using wireless media without any fixed infrastructure. Conventional multicast routing protocols are inadequate in a harsh mobile environment, as mobility can cause rapid and frequent changes in network topology [1-14]. Frequent state changes require constant updates, reducing the already limited bandwidth available for data and possibly never converging to accurately portray the current topology. Mobility represents the most challenging issue to be addressed by multicast routing protocols. Broadly, the class of multicast protocols in ad hoc networks can be categorized into tree-based and mesh-based approaches. ODMRP (On-demand multicast routing protocol [1]) is the most popular representative of mesh-based ones, whereas MAODV (Multicast on-demand distance vector [2]) and ITAMAR (Independent tree ad hoc multicast routing [3]) are significant among tree-based protocols. PAST-DM (Progressively adapted sub-tree in dynamic mesh [4]) is a special multicast routing protocol which inherits the flavour of both tree-based and mesh-based protocols. ODMRP requires control packets originating at each source of a multicast group to be flooded T. Janowski and H. Mohanty (Eds.): ICDCIT 2010, LNCS 5966, pp. 55–71, 2010. © Springer-Verlag Berlin Heidelberg 2010
56
A. Banerjee and P. Dutta
through out the network. The control packet flood helps in repairing the link breaks that occur between floods. Limitations of ODMRP consist of network-wide control packet floods and sender initiated construction of mesh. This method of mesh construction results in a much larger mesh as well as numerous and unnecessary transmission of packets. DCMP [7] and NSMP [9] are extensions of ODMRP aiming to restrict the flood of control packets to a subset of entire network. However, both of them fail to eliminate entirely, ODMRP’s drawback of multiple control packets per group. From the point of view of bandwidth efficiency, tree-based protocols are better than mesh-based protocols, since only one path exists between any pair of nodes [1015]. However, a multicast tree is more subject to disruption due to link failure and node mobility than meshed structures. It has already been established that although performance of MAODV is very good for small groups, low mobility and high traffic loads its performance degrades sharply once the values of group size, mobility or traffic load crosses a threshold, with the reason being a sharp increase in the number of control packets transmitted to maintain the structure. ITAMR and PAST-DM also suffer from these problems. In this paper, we propose FSIM, a fuzzy-controlled source-initiated intelligent multicast routing algorithm for ad hoc networks, which takes into account the estimated network state evolution in terms of residual energy of nodes, velocity affinity between sender and receiver of each wireless link, position of receivers etc. Relative movements among nodes are statistically tracked to capture their dynamics, in order to construct a very long lasting multicast tree. Three fuzzy controllers, namely PPE (Pivot Performance Evaluator), LSI (Link Stability Indicator) and MRS (Multicast Route Selector) are embedded in each node to inculcate rationality in selection of optimal multicast route to each receiver.
2 Description of FSIM 2.1 Overview According to the distributed algorithm implemented in FSIM, source of the multicast group issues route-request messages to each member of the group independently. Utilizing the rationality incorporated in nodes by fuzzy controllers PPE, LSI and MRS, each receiver evaluates performance of all the paths through which routerequests have arrived from the multicast source, selects best two of them and embeds the corresponding sequence of intermediate nodes or routers in their route-reply messages. Sine radio-ranges of different nodes are different, traversal path of route-reply messages may be different from the path of route-requests. For each multicast receiver, source node selects the best two paths for acknowledgements according to the logic of above-mentioned fuzzy controllers. Corresponding sequence of intermediate nodes are transmitted back to them along with the first multicast information message. In this context, FSIM proposes the concepts of pivot nodes, independent and dependent multicast receivers. Their definitions are described below. Definition 1: Pivot node A pivot node is one, which has got at least two downlink neighbors – either both of them are multicast receivers or one of them is a multicast receiver while the other is a
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks
57
pivot node or predecessor of some pivot node at lower level. A receiver may be a pivot node. Definition 2: Dependent multicast receiver A dependent multicast receiver is one, which is connected to source through some other multicast receivers of the same group. Definition 3: Independent multicast receiver In a multicast tree, all multicast receivers who are not dependent are called independent multicast receivers. Definition 4: Ideal multicast tree Based on the assumptions that H is maximum allowable hop count in the present ad hoc network and the multicast source resides at level 1 in a multicast tree, the tree will be termed as ideal, provided it satisfies the following conditions. i) ii) iii)
There exists at least one level l in the multicast tree, where l < √H/2, all non-receiver nodes are pivot. Difference between two consecutive pivots in each row, must be less than √H. At least one pivot node must exist in last but one level. 1 2
4
5
3
7
6
8
9
10
12 11
13
14
15 19
16
17
18 27
20
21 24
22
23
25 26
Fig. 1. Demonstration of pivot nodes, independent and dependent multicast receivers
For illustration of all the above mentioned definitions, please refer to fig 1. The root of the multicast tree i.e. the node with identification number 1, is the multicast sender. Receivers are the nodes with identification numbers are 7, 12, 13, 14, 16, 17, 18, 20, 22, 23, 24, 25 and 26. All other nodes are intermediate nodes. Pivot nodes are with identification numbers 8, 9, 10, 11, 18 and 19. Node 19 is pivot since it is directly connected to three multicast receivers. Similar reason is applicable for nodes 9, 11 and 18 also. Node 10 has two downlink neighbors – nodes 15 and 16. Node 16 is
58
A. Banerjee and P. Dutta
itself a multicast receiver whereas node 15 is predecessor of 19, which is a pivot. Hence, node 10 is also pivot. Node 8 is pivot for three reasons – node 11 is a pivot, node 12 is a receiver and node 10 is predecessor of the pivot 19. Please note that, among all these, node 18 is a pivot as well as multicast receiver. Assuming that maximum hop count of the underlying ad hoc network is 25, the multicast tree in fig 1 is an ideal one because all non-receiver nodes at level 4 (level of root node is 1) are pivots and 4 < √25. At level 6, which is last but one, pivot nodes 18 and 19 exist. Last level in a multicast tree is also denoted as level 0. As far as input and output parameters of the fuzzy controllers LSI, PPE and MRS are concerned, they are presented in table 1. Table 1. Parameters of LSI, PPE and MRS Name of fuzzy controller LSI
PPE
MRS
Object node / link
Input parameter
Output parameter
link from node nls to node nlr, link cardinality up to nls
residual energy impact of nlr velocity affinity of the link proximity of the link bidirectional characteristic of the link
stability of the link
independent receiver cardinality impact of np dependent receiver distance-cardinality impact of np reliability of np
pivot performance of np
output of LSI of all links in S
route performance of S
pivot node np
route S
link cardinality ratio of the route up to nlr
output of PPE of all pivots in S
2.2 Description of Input Parameters of LSI 1. Residual energy impact – According to the discharge curve of batteries heavily used in ad hoc networks [17], following two observations are very important from the point of view of multicast communication. 1. 2.
At least 40% of total charge is required to remain in operable condition. 65% and above residual charge provide sufficient support for communication.
Energy requirement for pivot nodes is stricter than others because they have at least two downlink neighbors to transmit information messages. So, residual energy ei(t) of any node ni at time t is formulated differently for pivot and ordinary nodes. Relevant mathematical expressions appear in (1), (2) and (3).
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks
ei(t) =
eipv(t)
if ni is a pivot node
eior(t)
otherwise
(1)
(εi(t) / (εimax(t)+1)) exp Γt(i,j,k) eipv(t)
=
59
(εi(t) /
εimax)
(εi(t) /
εimax+1)
if εj(t) < εi(t) ≤ εk(t)
if εj(t) = εk(t) exp |N′p(t)|
(2) if εi(t) = εj(t) < εk(t)
where Γt(i,j,k) = ((εk(t) - εi(t)) / (εk(t) - εj(t)) N′(i,t) = ((2 + |Ni(t)|) eipv(t) / (1 + |Ni(t)|)) N′(i,t)
if N′(i,t) > 1
1
Otherwise
eior(t) =
(3)
Here εi(t), εimax indicate remaining charge of node ni at time t and maximum battery charge of the node, respectively. np specifies predecessor of ni in the multicast tree. Np(t) is set of downlink neighbors of np at time t. N′p(t) is set of nodes nv ∈{ Np(t) – ni} s.t. the condition ((εv(t) / εvmax) ≥ 0.65 is true if nv is pivot. On the other hand, if nv is an ordinary node, the required condition is ( εv(t) / εvmax) ≥ 0. εj(t) = min { ∀nq ∈ Np(t) εj(t)} and εk(t) = max { ∀nq ∈ Np(t) εj(t)}. Determination of residual energy depends on two important decisions – the first one is that whether the best one among all available downlink neighbors have been selected and the second one is, what percentage of energy remains in that node compared to its own battery charge. In expression (2), the part ((εi(t) - εj(t)) / (εk(t) - εj(t))) establishes the first decision while the exponentiated portion represents the second one. The situation εi(t) = εj(t) indicates that ni is the worst possible choice among all alternatives. But it may happen that the worst possible choice is sufficient for communication i.e. (εi(t) / εimax) ≥ 0.65 if ni is a pivot node and (εi(t) / εimax) ≥ 0.4 if ni is ordinary. So, ni deserves a nonzero weight directly proportional to (εi(t) / εimax+1) and inversely with the number of better choices turned down i.e. | N′p(t)|. 1 is added with to enforce the effect of εimax even if εi(t) = εimax. On the other hand, the situation εj(t) = εk(t) denotes that no alternative better than ni exists. In that case, weight of ni should be proportional to (εi(t) / εimax) only. Please note that, if ni is a pivot node, it may have to forward information message to at least 2 and at most | Ni(t)| downlink neighbors i.e. on an average, number of downlink neighbors is (1 + |Ni(t)| /2). On the other hand, if ni is an ordinary node, it may transmit information message to at least 1 and at most | Ni(t)| downlink neighbors i.e. on an average, number of downlink neighbors is (1 + |Ni(t)|) / 2. So, eior(t) is (2 + |Ni(t)|) eipv(t) / (1 + |Ni(t)|) or 1 whichever is lesser. For each node, residual energy impact ranges between 0 and 1.
60
A. Banerjee and P. Dutta
2. Velocity affinity – Assuming that ni is a downlink neighbor of np at time t, velocity affinity a′p,i(t) of the link from np to ni at time t is expressed in (4). Affinity is also determined based on two decisions – whether it is the best option and how good is the option actually.
a′p,i(t) =
((vp,k(t) - vp,i(t)) / (vp,k(t) - vp,j(t)+1)) if ni may remain downlink neighbor of np up to σ′p,i m(t) (4) ((vp,k(t)-vp,i(t))/(vp,k(t)-vp,j(t)+1))exp((1–1/up,i(t))(σp,i /σ′p,i m(t))) otherwise
For each node np, υp(t) denotes its velocity at time t. up,i(t) is the time duration for which ni has been within neighborhood of np in the current session up to time t. Coordinate positions of both ni and np are statistically estimated for timestamps t+1, t+2, t+3, … up to σ′p,i m(t) where m(t) is the remaining number of packets to be sent by the multicast sender and σ′p,i is the maximum transmission delay among all the routes from sender to multicast receivers through ni. If ni is statistically estimated not to stay within neighborhood of np throughout the interval t to σ′p,i , then let σp,i is the timestamp within the above mentioned interval up to which ni will remain downlink neighbor of np. As per the formulation in (4), 0≤ a′p,i(t) <1. High values of it indicate high link stability as per the relative velocities of the involved nodes. 3. Proximity – Assuming that ni is a downlink neighbor of np at time t, proximity xp,i(t) of ni w.r.t. np at time t is expressed in (5). Like above mentioned parameters, proximity is also determined based on two factors – nearness between the nodes at time t and radio-range of np compared to minimum and maximum radio-ranges in the network. xp,i(t) = (1–Dp,i(t)/Rp) exp ((Rmax - Rp) / (Rmax – Rmin +1))
(5)
Dp,i(t) specifies distance between ni and np at time t. Rmax and Rmin are the minimum and maximum radio-ranges of the network, respectively. Proximity lies between 0 and 1. High proximity of ni w.r.t. np increases likelihood of ni to remain downlink neighbor of np. In spite of low velocity affinity, a link may survive for some time provided proximity is close to 1. 4. Bidirectional characteristic - Let ni be a downlink neighbor of np at time t. The link will be termed bidirectional provided np is a downlink neighbor of ni at that time. Bidirectional characteristic b′p,i(t) of the link from np to ni at time t is expressed in (6). 1 if ni ∈ Np(t) and np ∈ Ni(t) b′p,i(t) =
(6) 0 otherwise
A bidirectional link may be used during traversal of acknowledgements.
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks
61
2.3 Description of Input Parameters of PPE 1. Independent receiver cardinality impact – Assuming that ni is a pivot node, its independent receiver cardinality impact Ii(t) at time t is given by, Ii(t) = φi(t) / |G|
(7)
φi(t) is the number of independent multicast receivers connected to ni as direct downlink neighbors. G is the group of multicast receivers. From the formulation of Ii(t) in (7), it is evident that (1/ |G|) ≤ Ii(t) ≤ 1. Values of it closer to 1 increases importance of ni in the multicast tree and also prioritizes those routes which pass through its receiver successors. 2. Dependent receiver distance - cardinality impact – Given that ni is a pivot node, its dependent receiver distance-cardinality impact Lλi(t) in route λ at time t is given by, Lλi(t) = (|δλi(t)| / |G|)2 (( ∑ (h~-ηλj,k(t))) / (h~ |δλi(t)|)) nj ∈ δλi(t)
(8)
δλi(t) is set of dependent receivers connected to ni through independent receiver nk (nk ∈ Ni(t)) in multi-hop paths in route λ. For each nj ∈ δλi(t), ηλj,k(t) denotes number of intermediate nodes between nj and nk. G is the set of all multicast receivers. h~ indicates level of the farthest multicast receiver in the multicast tree. 0 ≤ Lλi(t) < 1. Values closer to 1 increase credit of ni and also route λ. Please note that, unlike independent receiver cardinality impact, (|δλi(t)| / |G|) has been squared here. The reason is that, if a pivot node is connected to multiple dependent receivers, the situation is not as good as being connected to same number of independent receivers. It is desirable in multicast communication that all receivers receive same multicast message at approximately same time, which is terribly hampered by long-distant dependency among the receivers. 3. Reliability – For a pivot node ni and its predecessor np in the multicast tree, reliability Ai(t) of the link from np to ni, is set to 1 provided np has stored active paths excluding ni, to all successors of ni at time t (this condition will be referred to as Cp,i(t) in expression (10)). Otherwise it is 0. 1
if Cp,i(t) is true
Ai(t) =
(9) 0
otherwise
2.4 Description of Input Parameters of MRS 1. 2.
Stability of component links – This is output of LSI of all nodes in the multicast tree. Link cardinality ratio - Link cardinality ratio Uλ(t) of a route λ at time t, is mathematically expressed in (10). Uλ(t) = gλ(t) / H
(10)
62
A. Banerjee and P. Dutta
Here gλ(t) is total number of communication links in route λ at time t and H is maximum allowable hop count in the underlying network. Please note that gλ(t) is output of LSI. Sender initializes it to 0. Each node on route λ increments it till the lowest level in the route is reached. From the formulation in (10), it is evident that 0 ≤ Uλ(t) ≤ 1. Values closer to 0 increase agility of transmission through the associated route. 3. Overall pivot performance - Overall pivot performance Vλ(t) of a route λ at time t is given by, Vλ(t) = ∑ βj(t) / |ψλ(t)| nj ∈ ψλ(t)
(11)
ψλ(t) is set of pivot nodes in route λ at time t. βj(t) is the output of PPE of nj. Values of Vλ(t) lie between 0 and 1. Values closer to 1 indicate reusability of certain portion of this route for multiple multicast receivers. 2.5 Fuzzy Rule Bases of LSI Table 2 shows crisp ranges of input parameters of LSI with corresponding fuzzy variables. According to the discharge curves of heavily used batteries in ad hoc networks, at least 40% of total battery power is required to remain in operable condition. It is represented by fuzzy variable a. The range from 40% to 65% (fuzzy variable b) is considered satisfactory, while 65% to 85% (fuzzy variable c) provides adequate support for communication. Fuzzy variable d indicates the best option i.e. 85% to full battery capacity. Although that both residual energy and velocity affinity are equally significant and indispensable in determination of life of a wireless link, we are more strict in range distribution of velocity affinity (fuzzy variables a and b represent the ranges 0-0.50 and 0.50-0.70 respectively for velocity affinity compared to 0-0.40 and 0.40-0.65 respectively, for residual energy). The reason is that, several statistical estimations are involved in determination of velocity affinity compared to none in case of residual energy. These estimations may introduce errors. To reduce their effects, we have followed a restricted range division for velocity affinity. As far as computation of proximity of a link is concerned, no statistical predictions are involved in it. Moreover it is less important than residual energy and velocity affinity, because two lively nodes having excellent velocity affinity may be able to maintain their neighborhood relation even if their proximity is close to 0. Fuzzy variable a represents the range 0-0.30. Ranges 0.30-0.60, 0.60-0.80 are denoted by fuzzy variables b and c, respectively. Fuzzy variable d represents the best possible proximity range i.e. 0.8-1. The output parameter link stability is assigned uniform distribution between 0 and 1. Effects of residual energy e and velocity affinity a′ are combined in table 3 producing temporary variable t1. Both are assigned equal weight. Table 4 unifies the impact of t1 and proximity X generating next temporary output t2. Then it is united with bidirectional characteristic b′ in table 5 giving rise to link stability α. Please note that, table 4 gives more priority to t1 because it is produced by two parameters both of which are more important than proximity.
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks
63
Table 2. Crisp ranges of parameters of LSI and corresponding fuzzy variables Residual Energy 0-0.40 0.40-0.65 0.65-0.85 0.85-1.00
Velocity Affinity 0-0.50 0.50-0.70 0.70-0.85 0.85-1.00
Proximity
Link Stability 0-0.25 0.25-0.50 0.50-0.75 0.75-1.00
0-0.30 0.30-0.60 0.60-0.80 0.80-1.00
Fuzzy Variable a b c d
Table 3. Fuzzy combination of e and a′ producing t1 a′→ e↓ a b c d
a
b
c
d
a a a a
a b b b
a b c c
a b c d
Table 4. Fuzzy combination of t1 and X producing t2 t1→ X↓ a b c d
a
b
c
d
a a a b
b b b c
c c c d
d d d d
Table 5. Fuzzy combination of t2 and b′ producing t1 t2→ b′ ↓ 0 1
a
b
c
d
a b
b c
c d
d d
2.6 Fuzzy Rule Bases of PPE Table 6 shows crisp ranges of input parameters of PPE with corresponding fuzzy variables. According to the definition of a pivot node, at least one multicast receiver must be directly connected to it. Hence, assuming that G is the set of all multicast receivers, minimum and maximum value of I are 1/|G| and 1. Intermediate values are distributed uniformly. As far as maximum number of dependent receivers are concerned, it is |G|-2, because one receiver is connected to the current pivot node in single or multi-hop paths while other child of the pivot is an independent receiver on whom the others depend. According to the definition of dependent receiver distance cardinality impact and its expression in (8), its lowest and highest values are 0 and ((|G|-2)/ |G|)2. Values within this range are divided uniformly. Output β of PPE is assigned uniform distribution between 0 and 1.
64
A. Banerjee and P. Dutta Table 6. Crisp ranges of parameters of PPE and corresponding fuzzy variables
Independent receiver cardinality impact 1/|G| - (|G|+3)/4|G| (|G|+3)/4|G| - (|G|+1)/2|G| (|G|+1)/2|G| - 3(|G|+1)/4|G| 3(|G|+1)/4|G| - 1.00
Dependent receiver distance cardinality impact 0 - ((|G|-2)/ |G|)2/4 ((|G|-2)/ |G|)2/4 - ((|G|-2)/ |G|)2/2 ((|G|-2)/ |G|)2/2 - 3((|G|-2)/ |G|)2/4 3((|G|-2)/ |G|)2/4 - ((|G|-2)/ |G|)2
Output 0-0.25 0.25-0.50 0.50-0.75 0.75-1.00
Fuzzy Variable a b c d
Effects of independent receiver cardinality impact I and Dependent receiver distance cardinality impact L are combined in table 7 producing temporary variable t3. Fuzzy composition of t3 and reliability A in table 8 produces output β of PPE. Table 7. Fuzzy combination of I and L producing t3 a′→ e↓ a b c d
A
b
c
d
A A B C
b b c c
c c d d
d d d d
Table 8. Fuzzy combination of t3 and A producing β t3→ A↓ 0 1
a
b
c
d
a b
b b
c c
d d
2.7 Fuzzy Rule Bases of MRS Consider a multicast communication path source = ni → ni+1 → … → nj = destination. Let, fuzzy performance of a link from ni+k′-1 to ni+ k′ (k′ ≤ j-i) is denoted as αi+k′-1, i+k′ and fuzzy performance of the route up to ni+ k′ is given by γi+ k′. Table 9 combines the effects of α i,i+1 and α i+1,i+2 producing γi+1 while table 10 accepts α j-1,j and γj-1 as inputs for generation of γj. All links of the route, except the first and last one, influence stability of the route as per table 11. It is actually a general form of j-i-2 number of different tables. Entries in table 11 are weighted average of those in tables 9 and 10. Assuming that, ι = (k – 1) / (j – i –2), the weight is measured in terms of length of the path already traversed and its full length from source to destination. Stability of a link nearer to source than destination, will contribute more in performance of the path, compared to a link nearer to destination. Closeness of a link to destination denotes that maximum portion of the path has already been traversed and its strength in terms of stability is almost decided. Hence, it is difficult now to change stability of the route. Please note that γ follows uniform distribution between 0 and 1, as shown in link stability column of table 2.
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks
65
Table 9. Fuzzy combination of α i,i+1 and α i+1,i+2 producing γi+1 α i,i+1 → α i+1,i+2 ↓ a b c d
a
b
c
d
a a b c
a b c c
b c d d
c c d d
Table 10. Fuzzy combination of γj-1 and α j-1,j producing γj
γj-1→ α j-1,j ↓ a b c d
a
b
c
d
a a a a
b b b b
c c c c
c d d d
Table 11. Fuzzy combination of γi+k-1 and α i+k-1,i+k producing γi+k (2 ≤ k ≤ (j-i-2))
γj-1→ α j-1,j ↓ a b c d
a
b
c
d
a a ƒ(0.375 - 0.25 ι) ƒ(0.625 - 0.50 ι)
ƒ(0.125 + 0.25 ι) b ƒ(0.625 - 0.25 ι) ƒ(0.625 - 0.25 ι)
ƒ(0.375 - 0.25 ι) c ƒ(0.875 - 0.25 ι) ƒ(0.875 - 0.25 ι)
c ƒ(0.625 - 0.25 ι) d d
Please note that at intersection of c-th row and a-th column, table 9 contains b while table 10 contains a. Since j-i-2 number of intermediate tables is there, b changed to a in j-i-2 number of steps. The function ƒ fuzzifies a value for γ as per link stability column of table 2. According to it, fuzzy variable a ranges from 0 to 0.25, whereas b ranges from 0.25-0.50. Assuming that amid and bmid denote exact middle values of respective ranges, their values come out to be 0.125 and 0.375, in that order. Numeric deviation between those middle values in j-i-2 number of steps is 0.25. Hence the deviation from 0.375 in k-th table i.e. in k-1 steps, is 0.25ι where ι = (k – 1) / (j – i – 2), which leads to the resultant value (0.375 - 0.25ι) with corresponding fuzzified version being ƒ(0.375 - 0.25ι). Other entries in table 11 can be explained similarly. In table 12, γj is combined with U generating temporary output t4. Composite effect of V and t4 is presented in table 12 deriving ultimate performance Z of the route. Table 12. Fuzzy combination of γj and U producing t4
γj→ U↓
a
b
c
d
a b c d
b a a a
b b b b
c c c c
d d d d
66
A. Banerjee and P. Dutta Table 13. Fuzzy combination of t4 and V producing Ζ
γj→ U↓
a
b
c
d
a b c d
a a a b
a b b c
b c d d
c d d d
2 Simulation Results We compared performance of FSIM, against the performance of ODMRP [1], MAODV [2], ITAMR [3] and PAST-DM [4], which are well-known representatives of state-of-the-art multicast routing protocols for ad hoc networks. Qualnet 3.5 has been used for simulations. Table 14 describes the simulation environment. The metrics used in our evaluation are packet delivery ratio, agility and control overhead. Packet delivery ratio is defined as the number of data packets successfully delivered, divided by the total number of data packets actually transmitted. Agility indicates the total time delay required to deliver packets to each receiver, divided by total number of packets. Control or message overhead is defined as the number of control packets transmitted, divided by the number of data packets transmitted. Figures 2-7 graphically illustrate the benefit of our model and emphasize that FSIM produces highly improved throughput and agility at much lesser message cost. Table 14. Simulation Environment Total number of nodes Simulation time for each experiment Simulation area Node placement Mobility model Radio-range Channel capacity MAC protocol Data packet size Number of simulation runs
100, 500, 1000, 2500, 5000 1000 sec, 2000 sec, 4000 sec 1000 m x 1000 m Random Random waypoint 25 m – 100 m, 100 m – 350 m, 5 m – 500 m 66 Mbps, 100 Mbps IEEE 802.11g 512 bytes, 1024 bytes 30
Among the above-mentioned competitors of FSIM, ODMRP is mesh-based whereas all others are tree-based. None of these consider stability of component links. Hence, possibility of link failure and consequently, flooding of route-request packets is very huge for them. High message cost results in increased packet collision. Automatically, percentage of successful delivery of packets at the multicast destinations reduces. Also additional delays are introduced during repairing of link breaks. Sourceinitiated tree-based protocols are, in general, better than destination-initiated mesh-based protocols. The reason is that, tree-based protocols maintain only one route between the source and each multicast destination. On the other hand, in meshbased protocols multicast destinations create a mesh and elect a core, which directly
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks
Agility vs. packet load (number of senders = 10)
1.2
160
1
140
MAODV 0.8
120
ODMRP
0.6
PAST-DM ITAMR
0.4
FSIM
PAST-DM
60
ITAMR
40
0
20
5
10
15
ODMRP
80
0.2
1
MAODV
100
Agility
Packet delivery ratio
Packet delivery ratio vs. number of senders (packet load = 10 pkts/sec)
67
FSIM
0
20
10
20
Number of senders
30 40 Tr af f ic load
50
Fig. 2. Graphical demonstration of packet de- Fig. 5. Graphical demonstration of agility livery ratio vs.number of senders vs. traffic load Control overhead vs. number of senders (packet load = 10 pkts/sec)
Packet delivery ratio vs. packet load (number of senders = 10)
140 120
1
MAODV
0.8
ODMRP
0.6
PAST-DM
0.4
ITAMR FSIM
0.2
Control overhead
Packet delivery ratio
1.2
MAODV
100
ODMRP
80
PAST-DM 60
ITAMR
40
FSIM
20
0 10
20
30
40
0
50
1
5
Traffic load in pkts/sec
10
15
20
Number of senders
Fig. 3. Graphical demonstration of packet de- Fig. 6. Graphical demonstration of control livery ratio vs.traffic load overhead vs. number of senders Control overhead vs. packet load (number of senders = 10)
A gilit y vs. number of senders (packet load=10 pkt s/sec)
160
160
140
Agility
120
MAODV
100
ODMRP
80
PAST-DM
60
ITAMR FSIM
40
Control overhead
140
120
MAODV
100
ODMRP
80
PAST-DM
60
ITAMR
40
FSIM
20
20
0 10
0 1
5 10 15 Number of senders
20
20
30 Traffic
40
50
load
Fig. 4. Graphical demonstration of agility vs. Fig. 7. Graphical demonstration of control number of nodes overhead vs. traffic load
68
A. Banerjee and P. Dutta
communicates with the source. More than one path may exist between each receiver and the core due to the underlying mesh structure. Along with that, an additional route is required between the core and sender of the multicast message. If the receivers are long distant from one another, mesh structure does not help, even in case of multiple senders. FSIM rigorously analyzes performance of all the available routes by associated receivers parallely. The nodes are equipped with fuzzy controllers to take intelligent routing decisions. FSIM also proposes the concepts of pivot node and ideal multicast tree. All these help to restrict message overhead significantly compared to others. The improvement also propagates to packet delivery ratio and agility of transmission.
3 Mathematical Analysis Lemma 1. In an ideal multicast tree, number of intermediate nodes (except the sender and multicast receivers), is O(√H|G|) where H is maximum possible hop count in the network and G is the set of multicast receivers. Proof: Let, in an ideal multicast tree T, pivot nodes exist in the levels ω1, ω2, ω3, … , ωl; corresponding number of pivot nodes at those levels are ζ1, ζ2, ζ3, … , ζl, respectively. In worst case, the following scenario prevails: i) ii) iii)
Only one receiver is connected as direct downlink neighbor to each pivot node. Reuse of the links from source to a pivot node is minimal. (ω2 - ω1), (ω3 - ω2), … ,(ωl - ωl-1) all are less than or equal to √H.
For illustration of the above-mentioned situations, please refer to fig. 8. It shows portion of an ideal multicast tree starting from a pivot at level ζj where 0 < j < l. The pivot node ni is at level ζj. Since the tree is ideal and we are considering maximum number of intermediate nodes, pivot successor np of ni is at level ωj+k where (j+k) ≤ l and (ωj+k - ωj) ≤ √H. Please note that the receivers in figure 8 are childless. This enforces minimal reuse of the path from source of the multicast operation, to ni. Since exactly one receiver is downlink neighbor of each pivot node, total number of pivot nodes is equal to number of multicast receivers. The relation is mathematically expressed in (12). ζ1+ζ2+ζ3+…+ζl=|G|
(12)
Maximum number of intermediate nodes between the levels ω1 and (ω1+√H) in the ideal multicast tree is ζ1(ω1+√H - ω1 – 1) i.e. ζ1(√H – 1). Similarly, number of intermediate nodes for other levels can be computed. Hence, total number of intermediate nodes IR(ω1,0,T) in portion of tree T starting from level ω1 till the end (0 indicates last level in the tree while level of the root is assumed to be 1 in FSIM) is given by, IR(ω1,0,T) = ζ1(√H – 1) + ζ2(√H – 1) + … + ζl-1(√H – 1) i.e. IR(ω1,0,T)=(√H–1)(|G|-ζ)
(13)
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks
69
Since T is ideal and its pivoting started at level ω1 (ω1 < √H/2), maximum number of intermediate nodes IR (1,ω1,T) from multicast source up to that level is ω1|G| < √H|G|/2. Therefore, total number of intermediate nodes IR (1,0,T) is given by, IR (1,0,T) = IR (1,ω1,T) + IR(ω1,0,T) i.e. IR (1,0,T) = √H|G|/2 + (√H – 1) (|G| -ζl ) i.e. IR (1,0,T) < 3√H|G|/2 i.e.IR(1,0,T) is O(√H|G|)
z(14).
ni
. . .
np
. . .
Fig. 8. Demonstration of maximum possible intermediate node situation in an ideal multicast tree
Hence, it is proved that total number of intermediate nodes in an ideal multicast tree is O(√H|G|). Please note that here we have not restricted length of the path from root of an ideal multicast tree to a receiver; it is as large as maximum allowable hop count H. It is also evident from this lemma that pivot nodes alone can impose an upper limit in number of routers. Lemma 2. The advantage of maintaining a stable link compared to the cost of messages for link breakage is O(HC2(μ-1)+ HC3(μ-1)2+…+(μ-1)H-1) where average number of downlink neighbors at each step is μ.
70
A. Banerjee and P. Dutta
Proof: In worst case, length of a stable link is as large as H. As far as link breakage is concerned, flooding is the only process to recover from it. So, cost of link breakage is actually cost of flooding. For estimation of message cost in flooding, we assume that average number of downlink neighbors of each node is (1+θ), where, from practical point of view θ > 0. Otherwise, the situation will be equivalent to unicasting. Moreover, in today’s era of highly dense ad hoc networks, probability that a node will have exactly one downlink neighbor is very negligible. Hence, a tree is created during flooding where each node floods control messages to (1+θ) number of other nodes. Among them, each and every node repeats the process until value of hop count reaches H. The resultant message cost M is given by, M = (1+θ) + (1+θ)2 + (1+θ)3 + … + (1+θ)H-1 i.e. M = ((1+θ)H –1) / θ The advantage ϑ of maintaining a stable link compared to flooding is given by (M-H) s.t., ϑ = ((1+θ)H –1) / θ - H i.e. ϑ = HC2θ + HC3θ2+…+θH-1 Putting, (μ-1) in place of θ in (15), we get ϑ = HC2(μ-1)+ HC3(μ-1)2+…+(μ-1)H-1 Hence the lemma is proved.
4 Conclusion FSIM is a fuzzy-controlled multicast scheme that aims at constructing an ideal multicast tree with as much pivot nodes and independent receivers as possible along with stable links in terms of residual energy, velocity affinity, reliability etc. characteristics of nodes. Pivot nodes help to restrict the number of ordinary routers up to a certain threshold. Extensive simulation experiments have been conducted to establish its supremacy over state-of-the-art competitors.
References [1] Lee, S.J., Gerla, M., Chian: On demand Multicast Routing Protocol. In: Proceedings of W.C.N.C. (September 1999) [2] Royer, E., Perkins, C.: Multicast operation of the ad hoc on demand distance vector routing protocol. In: Proceedings of Mobicom (August 2003) [3] Haas, Z., Sajama: Independent Tree Ad Hoc Multicast Routing (ITAMAR). Mobile Networks and Applications 8(5), 551–566 [4] http://www.springerlink.com/index/475127G162353467.pdf [5] Ji, L., Corson, M.S.: A light-weight adaptive multicast algorithm. In: IEEE GlobeComm (December 2006) [6] Jetcheva, J.G., Johnson, D.B.: Adaptive demand driven multicast routing in multi-hop wireless networks. In: ACM MobiHoc (October 2004) [7] das, S.K., Manoj, B.S., Rammurthy, C.S.: A dynamic core-based multicast routing protocol for ad hoc wireless networks. In: ACM Mobihoc (June 2002)
Fuzzy-Controlled Source-Initiated Multicasting (FSIM) in Ad Hoc Networks
71
[8] Sinha, P., Shivkumar, R., Bhargavan, V.: Mcedar: Multicast core extraction in distributed ad hoc routing. In: WCNC, September 1999, pp. 1317–1319 (1999) [9] Lee, S., Kim, C.: Neighbor supporting ad hoc multicast routing protocol. In: Mobihoc (August 2002) [10] Lee, S.J., Su, W., Gerla, M.: A performance comparison study of wireless multicast protocols. In: Proceedings of IEEE Infocom, Tel. Aviv., Israel (March 2002) [11] Wu, C.W., Tay, Y.C.: Amris: A multicast protocol for ad hoc wireless networks. In: Proceedings of IEEE Milcom (October 1999) [12] Devarapalli, V., Sidhu, D.: MZR: A multicast protocol for mobile ad hoc networks. In: Proceedings of ICC 2001 (2001) [13] Xie, J., McAuley, A.: Amroute: Ad Hoc Multicast Routing Protocol, Monet (December 2002) [14] Jie, L., Corson, M.S.: Differential destination multicast, a manet multicast routing protocol for small groups. International Journal on Systems Science and Applications 3, 51–57 (2003) [15] Scalable network technologies, Qualnet 3.5, http://www.scalable-networks.com/ [16] Banerjee, A., Dutta, P.: Fuzzy-controlled energy-efficient management of selfish users in mobile ad hoc networks. In: ICIIS 2006 (2006) [17] Ross, T.J.: Fuzzy Logic with Engineering Applications. Tata Mc. Graw Hill Publications (1997) [18] Banerjee, A., Dutta, P.: Fuzzy Rule Based Cost –Effective Communication In a Mobile Environment. In: CSI-EAIT (2006) [19] Kawasaki, N.: Design of adaptive fuzzy controllers, M.S. Thesis, Dept. of Electronics, Osaka [20] Chang, J.H.: Energy-conserving routing in wireless ad hoc networks. In: Proc. of INFOCOM, Tel. Aviv., Israel (March 2000) [21] Ibrahim, A.M.: An introduction to applied fuzzy electronics, PHI INDIA. [22] Freeman, J.A.: Neural Networks. Pearson Education, India [23] Zaruda, J.M.: Introduction To Artificial Neural Systems. Jaico Publishing House (1999) [24] Kov, D.: An Introduction To Fuzzy Control, PHI India
On Optimal Space Tessellation with Deterministic Deployment for Coverage in Three-Dimensional Wireless Sensor Networks Manas Kumar Mishra and M.M. Gore Department of Computer Science & Engineering Motilal Nehru National Institute of Technology, Allahabad, India {manasmishra,gore}@mnnit.ac.in
Abstract. Coverage is one of the fundamental issues in Wireless Sensor Networks. It reflects how well the service volume is monitored or tracked by its participant sensors. Sensing ranges of nodes are assumed to be of spherical shape, which do not tessellate space. To address this problem, we need to model the sensing range of nodes as space tessellating polyhedra. In this paper, we analyze four such polyhedra, the Cube, Hexagonal Prism, Rhombic Dodecahedron, and Truncated Octahedron based on the number of nodes needed for tessellation, amount of overlapping achieved, and symmetry of lattice. We defined a trade off ratio between the amount of overlapping achieved and the number of nodes deployed. We used this ratio to identify Rhombic Dodecahedron as the polyhedron model for optimal 1-coverage. We also show the scalability of this polyhedron model for K-coverage with deterministic deployment.
1
Introduction
Wireless Sensor Networks (WSNs) have attracted a great deal of research attention due to their potential in wide range of applications. They provide a new class of computing environment and drastically expand the ability to interact with the physical world [8]. Thus, WSNs can substantially transform the way we manage our homes, factories, and the environment without being on-site. The primary objective of a WSN is to sense the phenomena occurring in the vicinity of the deployed sensor nodes, and to communicate these facts to the base station. The ability to sense and communicate the parameters primarily depends on the sensing range and the transmitting range of a sensor node, respectively. But, the deployment strategy is also an important factor in both these issues. Most of the WSNs research assume that, the sensor nodes are deployed on a twodimensional (2D) plane. In these models, the height of the network is considered negligible as compared to the length and the breadth of it. This approximation holds true for the applications where sensor nodes are deployed on earth surface and the height of the network to be established is relatively smaller than the transmission radius of a node. Further, the phenomenon that can be observed by the network are restricted to those, occurring predominantly along the surface area. However, in cases where the implemented WSN is intended to observe T. Janowski and H. Mohanty (Eds.): ICDCIT 2010, LNCS 5966, pp. 72–83, 2010. c Springer-Verlag Berlin Heidelberg 2010
On Optimal Space Tessellation for Coverage in 3D WSN
73
the phenomenon that requires a significant height of coverage, the assumptions related to the 2D nature of the network become a handicap. Under water, atmospheric and space applications are examples of such cases. Underwater WSNs can be applied for oceanographic data collection, pollution monitoring, offshore exploration, disaster prevention, assisted navigation, tactical surveillance, and mine reconnaissance applications. Atmospheric applications like fire prevention in natural surroundings, monitoring rain forests. Space applications like surveillance of airspace with aerial vehicles unmanned and with limited sensing range. These applications require the observation to be performed in a three-dimensional (3D) space, rather than a 2D plane. Although such application scenarios are relatively rare at present, but the increasing commonness of these can’t be ignored in the near future. The prime issue in any sensor network is the ability to sense data over an area/volume. This aspect is called the coverage of the WSN. This is addressed by the sensing ranges of the participating nodes. A WSN is considered to be fully covered when any point in the target area(2D)/volume(3D) falls under the sensing range of any node. These points may be either 1-covered or K-covered depending on the number of independent nodes that cover the point under consideration. The sensing ranges of the nodes are considered to be spherical in case of 3D WSN. But, as spheres do not tessellate space, the sensing ranges need to overlap with each other to cover the entire volume. An alternative is, to model the sensing range as one of the space tessellating polyhedra. The sensing range of the node is treated to be the circumsphere of the polyhedron used. In case of 1-covered WSN, the sensing ranges of the nodes are allowed to have the minimum overlapping needed for tessellation, so that the number of nodes required to fully cover the network is minimum. On the other hand, for all K-covered WSN, the objective is to cover each point with an optimum number of nodes, the k value, and ask for maximum possible common overlapping volume among these nodes. Apart from this, the accuracy in estimation of the phenomenon largely depends on the precision and reliability of the sensed data. Having a K-coverage model rather than a 1-coverage model for a WSN operating in 3D space is being advocated based on the following reasons [13]. 1. Estimation about the location of an event that is being detected, will largely depend on the number of nodes covering that particular event. This estimation can be made relatively easy with more than one node covering the event. 2. The detection of an event and it’s occurrence can be more precisely estimated with a highly covered WSN. The accuracy of tracking can also be improved. 3. The high packet loss in the case of multi-hop WSNs requires a K-covered model. The detection of an event by more sensors compensates the loss incurred due to the multi-hop nature of transmission. 4. The erroneous detection of an event can also be reduced by K-covered model. Therefore, it is not only important to achieve full coverage with minimum number of nodes, but also to achieve maximum possible overlapping between sensing ranges of nodes in order to gain in accuracy in detection of an event. Hence,
74
M.K. Mishra and M.M. Gore
for all practical purposes, the model to be adopted for space tessellation and subsequent coverage of a 3D WSN needs to have a trade off between the gain in accuracy in detection by maximizing the possible overlap, and the minimum number of nodes required for full coverage. We compare four space tessellating polyhedra as unit cells representing the sensing range of a node, and identify the polyhedra which has the best trade off. In [14,15], the authors proposed the models for 3D WSN, using body centric nodes, and advocated the Truncated Octahedron as the most efficient space-filling polyhedron as unit cell. We demonstrate that, this polyhedra fails to retain the most efficient status when we take in to account the accuracy, and reliability of the sensed data as well as the probability of generation of coverage holes due to boundaries and obstacles. The organization of the rest of the paper is as follows. Section 2 discusses some of the similar works presented in literature. Section 3 elaborates the problem addressed in this work. The proposed perspective for optimal coverage model has been presented in the subsequent section 4. Section 5 presents the analysis based on the proposed perspective. Section 6 presents the conclusions drawn to end the paper.
2
Related Work
The coverage and connectivity issues in 2D WSNs have been addressed in the literature such as [1,5,6,11]. A few papers such as [2,3,9,10,14] have focused on solving coverage problem for 3D WSN. The solutions for coverage and connectivity issues are closely related to the mode of deployment of nodes. The deployment of nodes can be random or deterministic. Next we discuss few solutions for coverage problem with random deployment. In [2], the authors have modeled and simulated 3D WSN. They presented the analysis and design of networks of wireless sensors. And analyzed the behavior of these networks depending on the different cover and connectivity ranges and demonstrated that, how long a network can be alive is dependent on the number of nodes that are being used. The authors in [3] formulated the coverage problem as a decision problem, whose goal is to determine whether every point in the service area of the sensor network is covered by at least α sensors, where α is a given parameter and the sensing regions of sensors are modeled by balls (not necessarily of the same radius). The authors in [9] have used the 3D network model to detect the sensor density λ in terms of the volume of the spherical sensing range and the probability f of any point being covered by a node. They also presented an approach to detect redundant nodes to make them sleep, to save energy. In [10], the authors have considered the spherical model. They proposed and analyzed the coverage based on a distributed algorithm with random deployment. The optimal number of active nodes were determined based on the thickness of intersection between the sensing ranges. If the sensing range of any node is fully covered by other nodes, then that node can remain deactivated to make the coverage energy efficient.
On Optimal Space Tessellation for Coverage in 3D WSN
75
Though, random deployment is generally used in analysis of coverage and connectivity, and evaluation of various algorithms, it is considered too expensive as compared to optimal deterministic deployment patterns while deploying sensors [7,12]. The work in [14], is based on deterministic deployment. They suggested the sensor deployment pattern that creates the Voronoi tessellation of Truncated Octahedral cells in 3D space. The suggestion is directly from Kelvins conjecture. The numerical data in [14] illustrates Truncated Octahedron tessellation is better than the tessellation of Cube, Hexagonal Prism, and Rhombic Dodecahedron. Further, in [15], they extended their work to address the connectivity issue also.
3
Problem Elaboration
The focus of this work is to identify the polyhedron model for optimal 1-coverage of a 3D WSN with the best trade off between the gain in performance due to overlapping and the number of nodes required to tessellate the service space. 3.1
Objectives
We have focused on two aspects, one to define an unit cell which will tessellate the space with minimum nodes, and the other to maximize the overlapping of the sensing ranges of the nodes in each cell to improve performance. So, the objectives of the work are defined as follows: – To compare the space filling polyhedra on the basis of number of nodes required to tessellate, amount of overlapping achieved, symmetry of lattice, and scalability to K-coverage. – To identify the most suitable polyhedra for space tessellation for 1-covered 3D WSN with a trade off among the above mentioned criteria. These objectives have been worked upon based on the following assumptions. 3.2
Assumptions
Homogenous Nodes: All nodes are homogeneous in nature. This means, that all the nodes have identical sensing ability, computational ability, and the ability to communicate. We also assume that, the initial battery power of the nodes are identical at deployment. Spherical Sensing Range: All nodes have identical sensing range R. Sensing is omnidirectional and the sensing region of each node can be represented by a sphere of radius R, having the sensor node at its center. Arbitrarily placeable: For static deployment we assume their location to be arbitrary. For mobile nodes, the nodes are randomly deployed initially, and their movement is unrestricted.
76
4
M.K. Mishra and M.M. Gore
Proposed Perspective for Optimal Coverage
With deterministic deployment, the nodes are placed at predefined positions. Therefore, the selection of these positions is critical for the coverage problem of WSN. In general, the solutions for coverage problem of 3D WSN focus on finding the minimum number of nodes required to fully cover the service volume. The authors in [14], were the first to propose a solution for the coverage problem in 3D WSN in terms of models using space filling polyhedra. The Truncated Octahedral unit cell model was identified as the best model for 1-covered 3D WSN. This selection was made based on the metric called Volumetric Quotient, which is an indicator of the portion of volume of the spherical sensing range occupied by the polyhedral unit cell. Truncated Octahedral unit cell occupied 68.329% of the spherical sensing range, and thus, identified as the best model. To achieve full coverage of the service volume with the minimum number of nodes, the spherical sensing ranges of nodes are allowed to have minimum overlapping. But, in all cases there will be patches of volume which are common to more than one node. These √ K-covered (K ≥ 2) patches enhance the tracking of an event by a factor of K [4], in the volume of multi coverage. Further, the assumed spherical shape of the sensing ranges of nodes may be deformed due to boundaries and obstacles. These deformations will largely affect the extreme points to be covered by a node, which is the surface points of the sensing range, either on the sphere or on the modeled polyhedral unit cell. This type of deformation can produce coverage holes in the WSN. The presence of overlapped volume in the sensing ranges will provide a padding volume against generation of such kind of holes. Hence, the existence of these patches and their impact in gain in performance cannot be ignored. But, with the increase in volume of such patches, the number of nodes required to tessellate the service volume will also increase. Therefore, the optimal solution to the coverage problem in 3D WSN should have a balance between the gain in performance and the number of nodes required to space tessellate any given target volume. Apart from this, for critical applications, the WSN to deployed need to be K-covered. Though, the solution for 1-covered 3D WSN is able to provide patches of K-covered volume, but, to make the entire service volume K-covered, the model used for 1-coverage should be scalable to higher degrees of coverage. Once K-coverage is achieved, the power consumption at nodes can be reduced by implementing a duty cycle to keep the number of nodes active at any instance to toggle between 1 to K. This duty cycle can have an simpler implementation, if the polyhedron used as unit cell generates symmetry lattice in space tessellation. Besides coverage, connectivity is another related issue with the deployment of nodes. The more a node is connected with other nodes, the better will be the data transfer. Therefore, we propose to analyze the space filling polyhedra on these issues based on the following queries/observations for newer and greater insight. Observation 1: Does the polyhedral model provide a trade off between the gain in performance metrics due to optimum overlapping and the number of nodes required for space tessellation?
On Optimal Space Tessellation for Coverage in 3D WSN
77
Observation 2: Is the proposed model for space tessellation best scalable to K-coverage with deterministic deployment? Observation 3: If any duty cycling is done on the nodes, does the proposed model has the symmetry in lattice to facilitate a simpler implementation? Observation 4: Does the proposed model provide any resilience to the coverage hole formation? Observation 5: How does the model scale on the connectivity issue? In the next section, we analyze various space filling polyhedra and provide justification for the optimal model based on the above-mentioned observations.
5
Analysis
In this section, we will analyze the results to identify the most stable polyhedron for 1-covered 3D WSN. The various parameters we will be concentrating on, are: – Number of nodes required to tessellate any given space to make 1-covered WSN. – Overlapping volume and its gain in terms of multi covered patches, and resilient to reduction in sensing range. – Trade off between patches of overlapping volume and the number of nodes deployed. – Scalability to K-coverage with deterministic deployment. – Symmetry in lattice to simplify duty cycling with K-coverage. – Transmission radius for connectivity with all neighbor nodes. The polyhedron model for the unit cell having a major share in these parameters will qualify as the optimal and stable model for space tessellation in 1-covered WSNs. The space-filling property in a polyhedron is the ability to tessellate a 3D space. The Cube is the only Platonic solid possessing this property. However, there are five space-filling convex polyhedra with regular faces: the Triangular Prism, Hexagonal Prism, Cube, Truncated Octahedron, and Gyrobifastigium. The Rhombic Dodecahedron and Elongated Dodecahedron are also space-fillers. The Cube, Hexagonal Prism, Rhombic Dodecahedron, Elongated Dodecahedron, and Truncated Octahedron are all ”primary” parallelohedra. Elongated Dodecahedron also known as the Extended Rhombic Dodecahedron is constructed by stretching a Rhombic Dodecahedron until the middle ring of rhombi become regular hexagons. As Elongated Dodecahedron is constructed from Rhombic Dodecahedron, we consider the Cube, Hexagonal Prism, Rhombic Dodecahedron, and Truncated Octahedron for our analysis. For each polyhedron unit cell, we consider that, the node is placed at the body center of the polyhedra, and the sensing range of the node will be equivalent to the circumscribing sphere of it. However, for analysis we will consider the sensing range to be that of a spherical shape.
78
M.K. Mishra and M.M. Gore
The analysis is independent of the placement strategy to be followed. However, the placement of nodes must follow an approach with one of the four polyhedra as unit cell, such that, it provides complete space tessellation of the target volume. One such approach has been discussed in [14]. 5.1
Trade Off between the Gain due to Overlapping and the Number of Nodes Required to Space Tessellate
The Volumetric Quotient in [14] has been defined as the ratio between the volumes of the polyhedron unit cell and the corresponding circumsphere, the sensing range of the node. It represents the effectiveness of any polyhedron unit cell in uniquely occupying the volume of the corresponding spherical sensing range, the circumsphere of it. Table 1 presents this quotient values from [14] for the four polyhedron models. It shows an increase of 43.25%, 43.25%, and 85.9% in the number of nodes required for tessellation with respect to Truncated Octahedron model, for models using Rhombic Dodecahedron, Hexagonal Prism, and Cube respectively. This means that Truncated Octahedron model is able to capture and utilize 68.329% of the spherical sensing volume of the participating sensor nodes. Hence, the minimum requirement of nodes for coverage. Thus, the model using Truncated Octahedron is selected as the most efficient one, if the objective is to deploy the minimum number of nodes to fully cover a 3D WSN target volume. Table 1. Volumetric Quotient for all polyhedron models, and the number of nodes required in percentage of the number of nodes required by Truncated Octahedron model as unit cell Polyhedron model
Volumetric Quotient Number of nodes required to tessellate a given volume
Cube Hexagonal Prism Rhombic Dodecahedron Truncated Octahedron
0.36755 0.477 0.477 0.68329
185.9 143.25 143.25 100
However, because of the inability of the spherical sensing volumes to space tessellate, there will be patches of multi-covered volumes in the WSN due the overlapping in each polyhedron model. These patches are ignored in deriving the minimum number of nodes required for 1-coverage 3D WSN. However, the presence of such patches adds to the performance of the WSN. Table 2 presents the overlapping volume in fraction of the sensing ranges of nodes. It also tabulates these gains in percentage of the gain by the model using Truncated Octahedron as unit cell. The overlapping volume presented in Table 2, actually is doubled for each pair of neighbor nodes sharing a face. Because, the penetration of one sphere into another results in a convex lens shaped intersection volume [16], which is bisected by the chord, the common face in this case. Hence, the effective volume
On Optimal Space Tessellation for Coverage in 3D WSN
79
Table 2. Volume of spherical sensing range of any node overlapped by neighboring node’s sensing range for different polyhedron as unit cell Polyhedron model
Overlapping volume in Gain in percentage of the fraction of sensing volume gain by Truncated Octahedron model
Cube Hexagonal Prism Rhombic Dodecahedron Truncated Octahedron
0.63245 0.523 0.523 0.31671
199.694 165.135 165.135 100
with multi coverage is doubled. As we have taken the gain by other models in percentage of the gain by one model, the overall effectiveness does not get affected. Multi covered state of any volume results in redundant detection of an event in that particular volume. This increases the accuracy in detection of an event’s occurrence, as well as provides reliability in case of failure of any node covering that particular volume. Apart from this, the overlapping volume also provides a scope for being resilient against generation of coverage holes in case the boundaries and obstacles results in a reduction of the sensing range of a node. The more the existence of such overlapping patches, the better is the gain in performance. Table 2, reveals that the Hexagonal Prism, and Rhombic Dodecahedron both have same overlapping volume. But, the Cube has the highest overlapping volume of multi coverage. But, the gain due to overlapping of volume should not cost dearly in terms of the number of nodes required for tessellation. Therefore, it is of interest to estimate the trade off ratio between the gain in performance due to overlapping and the number of node required for space tessellation. The estimation of this trade off ratios are presented in Table 3. The trade off ratio between gain in performance and the number of nodes required to space tessellate, indicates that both Hexagonal Prism and Rhombic Dodecahedron models are the best gainers. But, in case of Rhombic Dodecahedron model, only 4 out of 14 vertices lie on the circumsphere surface. And, for every Table 3. Ratio of Gain in performance to number of nodes for tessellation for different polyhedron as unit cell Polyhedron model
Gain in percentage of the gain by Truncated Octahedron model (A)
Number of nodes re- Trade off ratio quired in percentage of (A/B) the number of nodes required by Truncated Octahedron model (B)
Cube Hexagonal Prism Rhombic Dodecahedron Truncated Octahedron
199.694 165.135 165.135 100
185.9 143.25 143.25 100
1.07420 1.15277 1.15277 1
80
M.K. Mishra and M.M. Gore
node there are 12 neighboring nodes sharing a common face, thus there will be some patches of volume which will be 3-covered, resulting in more gain. 5.2
Scalability to K-Coverage with Deterministic Deployment
The sensing range of a node is assumed to be spherical in shape. To make the WSN 1-covered, we use polyhedron unit cells for space tessellation, which are assumed to be inscribed in the sensing range. But, there will be patches of multi covered volumes in the network. Whenever the network is made to increase the degree of coverage, the overlapping volumes draw attention. And, generally the optimal overlapping approach is preferred for deployment. The deployment may be random or deterministic. In case of Random deployment, the overlapping volume and the degree of coverage can be estimated using some approach as in [3]. Once estimated, the minimum common degree over the entire network is identified as the degree of coverage for that network. To achieve maximum overlapping with minimum node deployment, the deployment has to be deterministic. The deterministic deployment draws advantage from the fact that the nodes can be placed at the key points in the lattice. In deterministic approach for K-coverage, the strategic positions need to be identified for deployment of add-on nodes. Such positions are generally the common points between the neighboring nodes, so that the added node will have equal effect on the neighboring nodes and can generate maximum symmetric overlapping. The common vertex, and the center points on the common edge or the common face are examples of such potential points. These points lie on various spheres associated with the polyhedron, like circumsphere, midsphere, and insphere. Therefore, it is of interest to analyze the circumsphere radius, the midsphere radius, and the insphere radius of these polyhedron models. These radius for the four polyhedra are presented in Table 4. The Cube and Hexagonal Prism have neighbors with all the three types of sharing (shared vertex, shared edge, and shared face). Rhombic Dodecahedron has neighbors with the later 2 types of sharing, where as Truncated Octahedron has neighbors only sharing faces, but these may be hexagonal faces or square faces. Both Cube, and Rhombic Dodecahedron have equi-distance neighbors in all cases, which reflect lattice symmetry. But, both Hexagonal Prism, and Truncated Octahedron have neighbors with varied distances in different cases reflecting Table 4. Circumsphere, Insphere, and Midsphere Radius in terms of Sensing Range (R) for different polyhedron as unit cell Polyhedron model
Distance from Distance from center center to any to any face (Insphere vertex (Circum- Radius) sphere Radius)
Distance from center to any edge (Midsphere Radius)
Cube Hexagonal Prism Rhombic Dodecahedron Truncated Octahedron
1 1 1, 0.866 1
0.8165 0.91287, 0.8165 0.82916 0.9487
0.57735 0.70710, 0.57735 0.70710 0.89443, 0.7746
On Optimal Space Tessellation for Coverage in 3D WSN
81
conditional lattice symmetry. Apart from this, the kissing number for 3D is 12 as per [17], which is identical to the number of faces in Rhombic Dodecahedron. With Rhombic Dodecahedron as the unit cell, the number of neighboring nodes for any node will be 12, identical to that of the kissing number. Further, to make the WSN K-covered, we can place nodes at the center of each face in an unit cell. The vertices of the Cuboctahedron, dual polyhedron of Rhombic Dodecahedron can represent the positions of these nodes. Cuboctahedron is a quasiregular polyhedron, therefore, Rhombic Dodecahedron model is the best scalable model for K-coverage. 5.3
Symmetry in Lattice for Simple Duty Cycling with K-Coverage
With K-coverage, to reduce the power consumption at nodes, a duty cycling is generally adopted such that the coverage can toggle between 1 to K, whenever needed. This duty cycle can have an simpler implementation, if the polyhedron used as unit cell generates lattice symmetry in space tessellation. The Cube, and Rhombic Dodecahedron shows lattice symmetry in space tessellation. This property is represented by Table 4, with the distance from neighboring nodes being constant for these polyhedra. Hence, both these polyhedra models support a simpler implementation of a duty cycle. 5.4
Resilient to the Coverage Hole Formation
The space tessellation is achieved by all the polyhedron models with neighboring nodes sharing faces (most of the cases). As a pair of neighboring nodes meet at the common face, the spherical part of the sensing range of one node beyond the face gets penetrated into the sensing range of the neighbor node and vice-versa. This results in an intersection of both the sensing spheres of the neighboring nodes. The volume of intersection is of a shape of convex lens and the thickness of it is twice the difference between circumsphere radius and insphere radius for that polyhedron. Whenever the sensing range of a node gets reduced due to boundaries and obstacles, the vertices which are at the surface of the circumsphere starts getting truncated and the shape of the polyhedron gets deformed. This makes us infer that, the polyhedron which has the maximum difference between the circumsphere radius and insphere radius will be best suitable for providing resilience to generation of coverage holes due to this truncation. The results in Table 4 indicate that, the Cube has the highest difference, followed by Hexagonal Prism, and Rhombic Dodecahedron. Truncated Octahedron has the least difference in radius, hence, most vulnerable to such truncation holes. Further, Rhombic Dodecahedron has a specific characteristic among the four polyhedra, that is, it has only 4 out of 14 vertices on the circumsphere surface. As 10 vertices of it stay well inside the sphere, this leads to patches of volume with 3-coverage, and less prone to vertex truncation. 5.5
Connectivity
The coverage and connectivity issues in WSN go hand in hand, and both depend largely on the deployment strategy and the position of the nodes. While the
82
M.K. Mishra and M.M. Gore
sensing range drives the coverage issue, the transmission range dictates the connectivity property of the network. But, the degree of coverage may not be equal to the degree of connectivity. The higher the degree of connectivity, the faster and better is the transfer of the sensed data over the network. The transmission range required for effective communication with all the neighboring nodes of an unit cell is equal to the distance between the pairs of neighboring nodes. This is equal to twice of the insphere radius (presented in Table 4) of the polyhedron model. The transmission range required for effective communication with all the neighboring nodes of an unit cell with a given sensing range R for different polyhedron model are presented in Table 5. Table 5. Transmission Range in terms of Sensing Range (R) needed to communicate to any neighbor node for different polyhedron as unit cell Polyhedron model
x axis
Cube Hexagonal Prism Rhombic Dodecahedron Truncated Octahedron
1.1547 1.4142 1.4142 1.7889
y axis R R R R
1.1547 1.4142 1.4142 1.7889
z axis R R R R
1.1547 1.1547 1.4142 1.5492
Maximum transmission range R R R R
1.1547 1.4142 1.4142 1.7889
R R R R
The transmission range requirements for both the Cube and Rhombic Dodecahedron are same along all the axes and for all types of neighbor pairs. But, for Hexagonal Prism, and Truncated Octahedron, the transmission range requirements are different in different directions. These results show that least transmission radius is required by the Cube, followed by Hexagonal Prism and Rhombic Dodecahedron. The Truncated octahedron needs the highest transmission radius. From all the above subsections, it is found that the Rhombic Dodecahedron, and the Hexagonal Prism have same gain in overlapping, same trade off ratio, and transmission range. The Cube also has the highest gain in overlapping, is scalable to K-coverage, and has symmetry. But, it fails to trade off between the gain and the number of nodes. Therefore, on the basis of the trade off between the gain and the number of nodes deployed, symmetry and scalability to Kcoverage, the Rhombic Dodecahedron emerges as the most stable and optimal polyhedron model for 1-covered 3D WSN.
6
Conclusion
We analyzed four polyhedra having the space filling property, to be used as unit cells for a 1-covered 3D WSN, and identified Rhombic Dodecahedron as the optimal model. We, defined a trade off ratio between the amount of overlapping achieved along side the 1-coverage solution to the number of nodes deployed. And, used this ratio to identify Rhombic Dodecahedron as the optimal model.
On Optimal Space Tessellation for Coverage in 3D WSN
83
The future work will be, to analyze different deterministic approaches for multi coverage of the WSN, and to validate the identified model based on these approaches. The other direction of work is to use this deterministic model for 1-coverage to adapt to random deployment.
References 1. Ghosh, A., Das, S.K.: Coverage and connectivity issues in Wireless Sensor Networks: A survey. Pervasive and Mobile Computing 4(3), 293–334 (2008) 2. Ortiz, C.D., Puig, J.M., Palau, C.E., Esteve, M.: 3D Wireless Sensor Network Modeling and Simulation. In: Proceedings of SensorComm 2007, pp. 297–312 (2007) 3. Huang, C.-F., Tseng, Y.-C., Lo, L.-C.: The Coverage Problem in ThreeDimensional Wireless Sensor Networks. In: Proceedings of the Global Telecommunications Conference, vol. 5, pp. 3182–3186 (2004) 4. Hall, D.L., Llinas, J.: Handbook of Multisensor Data Fusion. CRC Press, Boca Raton (2001) 5. Ammari, H.M., Das, S.K.: Clustering-Based Minimum Energy Wireless m Connected k -Covered Sensor Networks. In: Verdone, R. (ed.) EWSN 2008. LNCS, vol. 4913, pp. 1–16. Springer, Heidelberg (2008) 6. Ammari, H.M., Das, S.K.: Promoting Heterogeneity, Mobility, and Energy-Aware Voronoi Diagram in Wireless Sensor Networks. IEEE Transaction on Parallel Distributed Systems 19(7), 995–1008 (2008) 7. Zhang, H., Hou, J.C.: Is Deterministic Deployment Worse than Random Deployment for Wireless Sensor Networks? In: Proceedings of the 25th IEEE International Conference on Computer Communications, INFOCOM, pp. 1–13 (2006) 8. Akyildiz, I.F., Su, W., Sankarasubramaniam, Y., Cayirci, E.: Wireless sensor networks: a survey. Computer Networks 38(4), 393–422 (2002) 9. Rao, L., Wenyu, L., Guo, P.: A coverage algorithm for three-dimensional large-scale sensor network. In: ISPACS 2007, pp. 420–423 (2007) 10. Watfa, M.K., Commuri, S.: The 3-Dimensional Wireless Sensor Network Coverage Problem. In: Proceedings of the 2006 IEEE International Conference on Networking, Sensing and Control, pp. 856–861 (2006) 11. Ahmed, N., Kanhere, S.S., Jha, S.: Probabilistic Coverage in Wireless Sensor Networks. In: Proceedings of the IEEE Conference on Local Computer Networks, pp. 672–681 (2005) 12. Balister, P., Kumar, S.: Random vs. Deterministic Deployment of Sensors in the Presence of Failures and Placement Errors. In: Proceedings of the 28th IEEE International Conference on Computer Communications, INFOCOM, Rio de Janeiro, Brazil, pp. 2896–2900 (2009) 13. Kumar, S., Lai, T.H., Balogh, J.: On k-coverage in a mostly sleeping sensor network. In: Proceedings of the 10th annual international conference on Mobile computing and networking, pp. 144–158 (2004) 14. Nazrul Alam, S.M., Haas, Z.: Coverage and Connectivity in Three-Dimensional Networks. In: Proceedings of ACMMobiCom 2006, pp. 346–357 (2006) 15. Nazrul Alam, S.M., Haas, Z.: Coverage and Connectivity in Three-Dimensional Underwater Sensor Networks. Wireless Communication and Mobile Computing (WCMC) Journal 8(8), 995–1009 (2008) 16. http://www.mathworld.wolfram.com/Sphere-SphereIntersection.html 17. http://en.wikipedia.org/wiki/Kissing_number_problem
Seamless Handoff between IEEE 802.11 and GPRS Networks Dhananjay Kotwal, Maushumi Barooah, and Sukumar Nandi Department of Computer Science and Engineering, Indian Institute of Technology Guwahati, Assam, India
Abstract. In this paper we propose a scheme which provides seamless mobility between GPRS and IEEE 802.11 (WiFi) networks. In the proposed scheme, we envision a single Service Provider, who provides Cellular (GPRS), WLAN (WiFi) as well as data (Internet) services. The Service Provider’s network consists of an ‘Intermediate Switching Network’ (ISN), placed between the data services and the GPRS-WiFi networks. The ISN uses MPLS and MP-BGP to switch data traffic between GPRS and WiFi networks, as per the movements of the user.
1
Introduction
Cellular Wireless technologies offer voice and data services over large coverage areas, but at lower data rates. Wireless LAN technologies offer higher data rates, but over smaller coverage areas (‘HotSpots’). Users would prefer to use WLAN whenever possible and continue existing data sessions as they move in and out of HotSpots (ubiquitous data service). This can be achieved if we have seamless mobility between Cellular and WLAN technologies. Existing approaches for handoff between GPRS and WLAN networks can be broadly classified into ‘Loosely Coupled ’ and ‘Tightly Coupled ’ approaches. In ‘Loosely Coupled ’ approach, handoff is carried out by using technologies like Mobile IP [1]. This approach suffers from sub-optimal routing, increased handover latency and end-to-end delay for the packets. In ‘Tightly Coupled ’ approach, integration is done using a translation gateway [2]. This approach gives faster handover but suffers from limited data rates and extra network equipment (translation GW). A study presented in [3] finds that handover from GPRS to WLAN takes less time than the other way due to delay during set up of PDP Context in the GPRS network.A U.S patent #6,680,923 states a system for hybrid communication which provides voice, data and video information over the Internet at approximately 760kbps. It incorporates a transceiver assembly on Bluetooth technology(2.4 GHz spread spectrum). It allows auto-switching capabilities and enables a connection and communication wirelessly via short-range ad hoc networks and support upto eight peripheral devices in a piconet which may be defined as two or more bluetooth or equivalent technology units shatring a common channel. We need a handover scheme that avoids the drawbacks of ‘Tightly Coupled ’ & ‘Loosely Coupled ’ approaches. In this paper we achieve this goal by placing an Intermediate Switching Network T. Janowski and H. Mohanty (Eds.): ICDCIT 2010, LNCS 5966, pp. 84–90, 2010. c Springer-Verlag Berlin Heidelberg 2010
Seamless Handoff between IEEE 802.11 and GPRS Networks
85
(ISN) between the data services (Internet) and the GPRS-WiFi networks. The ISN is based on a Mobility Label Based Network (MLBN) detailed in [4] and is used to switch data traffic between GPRS and WiFi. The Mobile Node, is a high end device (PDA or Smart Phone) which is equipped with two interfaces (for GPRS and WiFi) and can be used simultaneously.
2
Proposed GPRS-WiFi Integration
As shown in Fig. 1 the ISN consists of MSF-LERs, which are Label Edge Routers with a Mobility Support Function (MSF) associated with them. Each of the MSF-LERs is a BGP speaker and a BGP Peer to every other MSF-LER in the ISN, thus forming a complete mesh. The MSF-LERs are connected with each other via Label Switched Path (LSP) tunnels. The integration points of ISN with GPRS and WiFi network are the GGSN (GGSN/MSF-LER) and Access Point (AP/MSF-LER) respectively. MSF-LER1 acts as the point at which IP Datagrams are entering the ISN. At GGSN, MSF operates between MPLS and GTP layers. At AP, MSF operates between MPLS and LLC layers. MN has a dual stack with MSF operating between IP and SNDCP layers for GPRS and between IP and LLC layers for WiFi.
Internet
1 0 00 11
CN Router Handover
MSF−DB1
MSF−DB1
{IP}
{IP}
MSF−LER2 IP
MSF−LER2 IP
L1
MSF−LER3 IP
L2
ML1
ML1
MSF−LER1
FTN
MSF−LER3 IP
L1
MSF−LER2 IP
L2
MSF−LER3 IP
FTN
LSR
IP Datagram ML1
L1
L2
LSR
AAA Server
LSR
ML1 IP Datagram
DHCP Server
ISN MN2 MN1 GGSN/MSF−LER2
DHCP Relay
AP2/MSF−LER3
DHCP Relay
AP1/MSF−LER4
IEEE 802.11 (N/W 2) HLR
MN1
SGSN BSC
BTS
MN2
GPRS (N/W1)
BTS
Fig. 1. Integrating ISN, GPRS & WiFi
86
D. Kotwal, M. Barooah, and S. Nandi
Intial Registraion with ISN − Start (MN starts up in IEEE 802.11) 802.11 AP1 Signal Strength Above Threshold MN Associates with 802.11 AP1 ICMP Solicitation (No Mobility Label, MN IP,MAC Addr,...) ICMP Advt (Mobility Label−ML1,AP1/MSF−LER IP,...) BGP Update (Mobility Binding) (MN IP,ML1,AP1/MSF−LER IP)
BGP Update (Mobility Binding) (MN IP,ML1,AP1/MSF−LER IP)
Activate Uplink PDP Context (PDP Address, Qos Profile − lower data rates, NSAPI etc)
ICMP Solicitation (Dummy Registration)
Activate Alternate PDP Context PDP Context (PDP Address,QoS Profile − lower data rate, NSAPI etc)
ICMP Advertisement (Dummy Registration)
Intial Registraion with ISN − End Data Traffic from ISN using L2 path (IEEE 802.11 MAC)
Data Traffic from ISN
MN About to move out of 802.11 coverage Signal Strength of AP1 below Threshold − Scanning for new AP New AP not found
Handover IEEE 802.11 −> GPRS − Start ICMP Solicitation (Registration) (ML1, MN IP,...) ICMP Advt (Registration Accept) (ML1,GGSN/MSF−LER IP,..)
BGP Update (Mobility Binding) (ML1,MN IP,GGSN/MSF−LER IP) BGP Update (Mobility Binding) (ML1,MN IP,GGSN/MSF−LER IP)
Data Traffic from ISN using L2 path (Alternate PDP Context)
Data Traffic from ISN
Handover IEEE 802.11 −> GPRS − End
Activate PDP Context for Data Traffic(PDP Address, QoS Profile − higher data rates, NSAPI,etc)
Data Traffic from ISN using L2 path (Desired PDP Context)
Data Traffic from ISN
MN moves back into coverage area of 802.11 network AP1 Signal Strength above threshold − MN Associates with AP 1
Handover GPRS −> IEEE 802.11 − Start ICMP Solicitation (ML1, MN IP, MAC Addr, ...) ICMP Advt (ML1, AP1 MSF/LER IP,...)
BGP Update (Mobility Binding) (ML1,MN IP,AP1/MSF−LER IP)
BGP Update (Mobility Binding) (ML1,MN IP,AP1/MSF−LER IP) Data Traffic from ISN using L2 path (IEEE 802.11 MAC)
Data Traffic from ISN
Handover GPRS −> IEEE 802.11 − End AP1 Signal Strength below Threshold AP2 Signal Strength above Threshold MN Associates with AP2
Handover IEEE 802.11 −> IEEE 802.11 − Start ICMP Solicitation (Registration) (ML1, MN IP,...) ICMP Advt (Registration Accept) (Same ML1,AP2/MSF−LER IP,..) BGP Update (Mobility Binding)
BGP Update (Mobility Binding) (ML1,MN IP,AP2/MSF−LER IP)
(ML1,MN IP,AP2/MSF−LER IP) Data Traffic from ISN using L2 path (IEEE 802.11 MAC)
Handover IEEE 802.11 −> IEEE 802.11 − End
Mobile Node
GPRS/MSF−LER
AP1/MSF−LER
Fig. 2. Handover Procedures
AP2/MSF−LER OR Other MSF−LERs
Seamless Handoff between IEEE 802.11 and GPRS Networks
2.1
87
Handoff between GPRS – WiFi Networks
Handover between GPRS - WiFi networks is initiated by MN depending on the presence of a stable WiFi network. Fig 2 gives the handover procedures between GPRS and WiFi Networks. Initial Registration (ICMP messages) – MN starts up in WiFi and sends registration message containing the pair [MN IP Addr,MAC Addr] to AP/MSFLER. AP/MSF-LER generates a Mobility Label (ML) and sends it back to MN. The ML is used by ISN to uniquely identify the MN. AP/MSF-LER generates a Mobility Binding [ML, MN IP Addr, AP IP Addr] and distributes it to all other MSF-LERs for storage, using BGP update message [4]. MSF-LER1 forwards IP Datagrams destined for MN IP Address to AP/MSF-LER using LSP tunnels, with the ML pushed at the bottom of label stack. AP/MSF-LER uses ML to identify the MAC Addr for MN and forwards packets to MN using L2 path (IEEE 802.11 MAC). Registration here also contains the setting up of an Alternate PDP Context (lower data rates) in GPRS network (Dummy ICMP messages). The Alternate PDP Context is used to temporarily transfer data traffic to MN till a Desired PDP Context (higher data rates) is set up. Handover IEEE 802.11 to GPRS – MN moves out of WiFi and registers with ISN via GGSN/MSF-LER using Alternate PDP Context. This contains the pair [Same ML, MN IP Address]. In GPRS network the L2 path is provided by the PDP Context. GGSN/MSF-LER associates the PDP Context information with the ML. It then creates the Mobility Binding [same ML, MN IP Addr,GGSN IP Addr] and sends it to other MSF-LERs using BGP update message. MSFLER1 now uses LSP tunnels to redirect traffic to the GGSN. At the GGSN, MSF uses ML from label stack to get the (Alternate) PDP Context and uses it to forward the IP Datagrams to MN. Simultaneously, MSF at GGSN also starts the creation of a Desired PDP Context (having higher data rates). Once Desired PDP Context is established, it is used to forward IP Datagrams instead of Alternate PDP Context. Handover GPRS to IEEE 802.11 – When MN moves into WiFi network, the registration process using the same ML is carried out again with AP/MSF-LER. The Mobility Binding sent out by AP/MSF-LER now prompts MSF-LER1 to switch traffic to AP/MSF-LER which forwards packets to MN using WiFi MAC Address.
3
Simulations
The proposed scheme was implemented using Qualnet Network Simulator. Use of same IP address in both networks can be made possible by using a central DHCP server in the ISN, with DHCP relays in GPRS and WiFi networks (Fig. 1). However, in Qualnet both interfaces cannot be assigned same IP Address. The change in IP address will cause existing data sessions to break. To overcome
88
D. Kotwal, M. Barooah, and S. Nandi
this, the destination IP of IP datagrams received at MN is used as the source IP for IP Datagrams being sent from MN, for a session. MN transmits these IP Datagrams over the same interface with which it is registered with ISN. Scenario Setup – The scenario setup is as shown in Fig. 1. We study the effects on UDP traffic, as MN moves between GPRS and WiFi network. The behavior of UDP traffic was analyzed based on - 1) Handover Duration (Cumulative UDP Packets vs Simulation time (seconds)). 2) End-To-End Delay for UDP Packets. 3) Packet Loss. (Analysis & Graphs for End-To-End delay are not included in the paper). The scenario is executed twice – 1)Path of MN1 2)Path of MN2. The scenario parameters are given in Fig. 3(a). Handover from GPRS to WiFi – Fig 3(b) During handover, there is no break in arrival of packets as MN receives packets on its GPRS interface. The Mobility Binding Update finishes at 1005.35s. The surge in graph is seen as MN simultaneously receives en-route data packets in GPRS network and packets from Handover GPRS -> IEEE 802.11 - CBR (100kbps) - ISN (3 hops)
UDP Packets (Cumulative)
48290
48280
48270
48260
48250
1004.8
(a)
1005
1005.2
1005.4
1005.6
1005.8
Simulation Time (Seconds)
(b)
Handover IEEE 802.11 -> GPRS - CBR (100kbps) - ISN (3 hops)
Handover IEEE 802.11 -> IEEE 802.11 - CBR (100kbps) - ISN (3 hops) 64670
29900
UDP Packets (Cumulative)
UDP Packets (Cumulative);
64660 29880
29860
29840
64650
64640
64630
64620
64610 29820
64600
64590 636.5
637
637.5
638
1331.8
Simulation Time (Seconds)
1332
1332.2
1332.4
1332.6
1332.8
1333
1333.2
1333.4
Simulation Time (Seconds)
(c)
(d)
(e) Fig. 3. (a)Scenario Parameters (b)Handover - GPRS to WiFi (c)Handover - WiFi to GPRS (d)Handover - WiFi to WiFi (d)Handover Duration Summary (100Kbps)
Seamless Handoff between IEEE 802.11 and GPRS Networks
89
WiFi network. In order to accommodate the en-route packets, GPRS interface should be kept active for certain duration. This duration can be found using GPRS data rate and by sending a probe packet to CN. Handover from WiFi to GPRS – (Fig 3(c)) From 636.7073s to 636.7637s MN scans for new AP. From 636.7637s to 636.7891s, MN carries out registration with GGSN/MSF-LER. Now GGSN/MSF-LER starts using the Alternate PDP Context (Desired PDP Context not in place) and receives first packet at 636.871s. During this entire period MN does not receive any packets (packet loss). The Alternate PDP Context is used till time 637.4501s. This causes packets to be buffered in GPRS network(low data rates). At 637.4501s, Desired PDP Context is setup, and traffic switches over to Desired PDP Context. A surge in data rate is now observed as packets from both the Alternate (buffered packets) and Desired PDP Contexts are received simultaneously. Handover from WiFi to WiFi – (Fig 3(d)). For performing horizontal handoff, MN starts scanning, associates with new AP/MSF-LER and completes Registration procedure for new AP/MSF-LER. For this entire period, the MN does not receive any packets, which are dropped. This is shown by a gap in graph.
4
Conclusion
In this paper we proposed the use of an Intermediate Switching Network (MLBN [4]) for switching traffic between GPRS and WiFi networks. The ISN was integrated with the GPRS and WiFi network at the GGSN and AP respectively. The use of the switching network avoids sub-optimal routing [5] and also allows the user to experience higher data rates when in the WiFi network. Switching of traffic based on MPLS and MP-BGP reduces the handoff delay. During handoff from WiFi to GPRS, the high handoff latency experienced due to the need for creating a PDP Context, was reduced by the pro-active creation of an Alternate PDP Context. The Simulations carried out show that no packet loss is experienced during handoff from GPRS to WiFi. During handoff from WiFi to GPRS/WiFi network some packet loss is experienced due to the scanning time taken by the MN. The proposed scheme provides a means for seamless mobility between GPRS and WiFi networks, while reducing handoff latency, packet loss and allowing the user to use the network which offers best data rates.
References 1. Chen, J.-C., Chen, W.-M., Lin, H.-W.: Design and analysis of GPRS-WLAN mobility gateway (GWMG). In: 2005 IEEE International Conference on Communications, ICC 2005, May 16-20, vol. 2, pp. 918–923 (2005) 2. Fredson, P., Murthy, M.: WLAN-GPRS Tight Coupling Based Interworking Architecture with Vertical Handoff Support. Wireless Personal Communications 40, 137–144 (2007)
90
D. Kotwal, M. Barooah, and S. Nandi
3. Bernaschi, M., Cacace, F., Iannello, G., Za, S., Pescape, A.: Seamless Internetworking of WLANs and Cellular Networks: Architecture and Performance Issues in a Mobile IPv6 Scenario. IEEE Wireless Communications 12, 73–80 (2005) 4. Berzin, O., Malis, A.: Mobility Support Using MPLS and MP-BGP Signaling. Network Working Group - Internet-Draft, October 29 (2008) 5. Berzin, O., Daryoush, A.: Mobility Label Based Network: Support for Mobility using MPLS and Multi-Protocol. In: 2008 IEEE BGP: adio and Wireless Symposium, January 22-24, vol. 52(9), pp. 511–514 (2008) 6. McGuiggan, P.: GPRS in Practice: A Companion to the Specifications. Wiley, West Sussex England (2004)
A Tool to Determine Strategic Location and Ranges of Nodes for Optimum Deployment of Wireless Sensor Network Amrit Kumar, Mukul Kumar, and Kumar Padmanabh Software Engineering and Technology Labs Infosys Technologies Ltd, Bangalore, India {amrit_kumar,mukul_kumar03,kumar_padmanabh}@Infosys.com
Abstract. The deployment of wireless sensors is very challenging, yet it is one of the most unexplored areas of this domain. In most of the WSN applications, the sensing location is fixed. In this paper, we are describing a deployment tool we have developed for strategic localization and network optimization. Even before going into field deployment, this tool can be used to calculate precisely the location of the nodes and transmission range while considering line of sight and obstacle into account. The JPEG image of the terrain or floor plan and line of sight or obstacle are the input parameters. The algorithm used in this tool addresses two aspects of the problems: how to minimize the range of the sensor nodes while still forming a well connected network and how to find the location of the forwarding nodes such that the energy required in communication is minimum. Based on these algorithms we have developed a tool to calculate the network parameters such as minimum numbers of forwarding nodes, minimum range for each node required to form a well connected mesh network and minimize the power consumption. Our initial experiments with google maps give very encouraging results. Keywords: Deployment Tool, Network Optimization, Power Management, Range Optimization.
1 Introduction Fundamentally any WSN architecture [1] is characterized by four key features; viz self-organization, local decision making, wireless communications and traffic flow towards the ‘sink’. WSNs have been widely used in habitat monitoring, surveillance systems, environmental monitoring, military, building and home automations.[2]. In a typical wireless sensor network the locations of the sensing points are fixed and determined by that particular application. This is one basic assumption in planning the deployment of WSN to be considered henceforth. Finding the deployment parameter such as locations, number of nodes required, the transmission range of the nodes, maximum number of available path etc manually is rigorous and inefficient. In simple applications where the surveillance area is small, trial and error techniques can be used. However, with the increase in ‘area of monitoring’, the T. Janowski and H. Mohanty (Eds.): ICDCIT 2010, LNCS 5966, pp. 91–97, 2010. © Springer-Verlag Berlin Heidelberg 2010
92
A. Kumar, M. Kumar, and K. Padmanabh
complexity in deployment increases and hence the determination of a system to control the parameters of the network is almost impossible. These factors impose the challenge of planning and deployment of WSN as very critical for the next generation wireless sensor network deployments. There is limited literature available on planning and deployment of WSN’s. Architectures such as POWER have been suggested by authors in [3]. However, none of them have considered each individual node as a different entity. We propose a system to deploy a Wireless sensor network in any environment, Industrial, field or home automation or wherever there is a need for scalable wireless sensor network deployment and planning. The battery life, an important aspect of consideration in a wireless sensor network depends largely on the transmission range of the sensor nodes or motes. Our system optimizes the deployment in three phases. We propose to first identify the sensing locations in the Initialization phase. In the network formation phase, we run an indigenous algorithm to find the optimum range for each mote while ensuring the reliability of the network. In the third phase, we find the additional nodes (or repeaters) required by the network and the location of the additional nodes as a function of the physical geography of the “area of monitoring”. It also determines the network parameters (e.g minimum range, friend’s list or redundant links, location coordinates. for the repeaters and the results of the system are then applied for deployment. In essence, the system aims for • Accelerated deployment of WSN. • Optimizing the network parameters number of neighbors and most importantly the range of each node. • Reduction of cost of deployment in terms of time, effort and maintenance. In what follows we describe the system model and key consideration in the paper in section-2, tour proposed algorithm in section-3 and experimental result in section-4 and finally conclusion and future work in section-5.
2 Key Considerations and Our System Parameter Though the maximum transmission ranges of the nodes are inherent characteristics of the hardware, however the actual transmission range of the node is a configurable parameter. How many numbers of repeater will be required in a particular deployment is completely dependent on the geographical parameter (distance, atmospheric condition). For the large deployment we cannot go to the field and determine the location of repeaters and transmission ranges of all individual nodes. Therefore, the best idea will be to do it offline, get the coordinates and transmission ranges of the nodes and use the same. We intend to use the floor plan or terrain map of the geographical area .We will locate the sensing point and then our tool will determine the network parameters. The key points which need to be addressed during the planning of WSNs are: Location of the nodes. To sense effectively the sensors must be placed as close to event of interest as possible to record the event closely. For most practical purposes we shall assume that
A Tool to Determine Strategic Location and Ranges of Nodes
d [li , le ] ≤ r
93
(1)
Where, li is the location of node ‘ i’ and le is the location of event of interest and ‘r’ is maximum distance from the which the event of interest can be sensed correctly. Communication Range of a node (R). This is the range of transmission, a configurable parameter of a node. Typically the maximum range of a wireless sensor node is limited by the hardware used to manufacture the node. The cost of the node increases with higher . (2) Further in the paper, we shall refer communication range
as ‘range’ of a node.
Battery Life of a node. This is one of the key parameters in the WSN deployment. d=
∂E ∂t
(3)
The nodes have limited battery power. The battery drain for any operation by the node is defined as the energy consumed by the node in that operation. A node performs three tasks which accounts for its battery drain a) sensing the event of interest b) processing the event of interest c) sending the packet generated over the RF channel. The amount of battery drain in a) and b) is negligible in comparison to c [6].
d α R4
(4)
Where, d is the battery drain and R is the range of the node. Thus it is important that the range of the nodes must be kept at minimum to have increased battery life of the node.[6] Forwarding nodes. The wsn applications determine the sensing locations and hence the geographical coordinates of the location where ambient parameters will be sensed. However due to limitations of the transmission range, all nodes placed at the sensing point may not form a connected network. Other nodes known as forwarding nodes or repeaters are needed to fill the gap to form well connected network. Network Architecture and Connectivity of each node. WSN network consists of sensor nodes. Nodes are connected to each other in mesh topology. However every sensor node is connected to the outside world via a powerful node known as base station. For simplicity and without loss of generality, we shall consider one base node in our network located at the origin of the network.
3 Proposed Algorithm The system workflow is mentioned in figure-1(c). The algorithm has two prime objectives: 1) to find the minimum range required for the node while ensuring the connectivity requirement specified by the WSN application. 2) To find the optimum location/coordinates of the forwarding nodes, while considering base station at the
94
A. Kumar, M. Kumar, and K. Padmanabh
origin. The algorithm works in three phases: network initialization, network formation and network optimization. 3.1 Network Initialization
The initialize network phase evaluates the sensing locations depending on the location of the area of interest. These locations are the initial location of the deployment system and act as an input to the subsequent phase. These locations satisfy the equation (1) defined above. 3.2 Network Formation
Once the sensing locations are defined, the next task is to form a network based on desired network redundancy and reliability and the topology of the Floor plan. The network formed should have a predictable reliability and the maximum battery life. Network Reliability: It is defined as the measure of the probability of successful communication of a packet from a node to the base station in the network. Reliability ( of a packet to be delivered successfully to the HECN (5) ,
,
,
Battery Life: The battery drain communication of the node.
of a node is inversely proportional to the range of ,
(6)
Thus to have increased battery life, range of the nodes should be minimal Obstacle Management: Sensor network is not limited to the line of sight. It means two nodes can communicate across a concrete wall. However, signal strength gets decreased. This is resulted in reduced transmission range in case of the obstacle. An obstacle is defined as any hindrance in the space between two nodes such that the communication capability between them is reduced partially or fully. One solution to overcome the loss of communication is to increase the range of communication of the nodes. While calculating the range of the nodes, this must be taken into account. For simplicity, we state that any obstacle with thickness “t” introduces a factor say μ such that .μ
.t
(7)
μ can be determined by experimentation for any obstacle such as glass door, cardboard, humid environment etc and the range obtained by the algorithm-1 in fig1(a) can be adjusted according to the equation above. For our experiment, we shall set the parameter μ 1.0, without any loss of generality.
A Tool to Determine Strategic Location and Ranges of Nodes
95
In summary, the network formed must have high reliability and higher battery life. To achieve an optimum network, the trade-off between higher reliability and battery life, must be made. 3.3 Network Optimization
The network optimization takes into account, the maximum range permissible for any node, the minimum no of friends required and the obstacle range enhancement. Network Optimization determines the number of repeaters or forwarders required in the network and re-calculate the modified ranges for each of the nodes Fig1b. Base station at[0,0],All n nodes at [x,y],NL[] – Network list D[n,n] – distance matrix which gives the distance between each node. Q[] – Queue,k = proximity mimimum or least no of friends required for each node.R[0,1,2….n] = range of each node. Step1 : Arrange n nodes in increasing order of their distance from base station in Vector V[0,1-----,n] such that V[0] =0 (base station) Step2 : Calculate the distance matrix D[n,n] for each node. Step3: For each node i in V[0,1,2…….n] Add V[i] to NL[] If (size(NL[]) =1) // whenonly root is present in NL { //Select k nodes at minimum distance from V[i] using D[V[i],n] counter =0,max = 0 While (counter !=k) { Find the next node NN at minimum distance from V[i]; Add NN to Network list NL R[NN] = D[NN,V[i]]//Calculate range for NN // Enqueue side effect queue Insert NN to Q[];max = Max(max,R[NN]) Counter <- counter+1 } R[V[i]]= max; // Calculate range R[V[i]] While(Q[] is not empty] // Build side effect chain { SideNode= Pop[Q[]]; Find node NM such that D[NM,Sidenode] is least and NM not in NL Add NM to Q[] Add NM to NL } If (size(NL[]) !=1) // not for root node {//Select k nodes from NL such that distance[V[i],each of k]is least counter =0, max = 0 While (counter !=k) {Find the next node NN in NL at minimum distance from V[i]; Add NN to Network list NL max = Max(max,D[V[i],NN); Counter <- counter+1 // Enqueue side effect queue Insert NN to Q[] } R[V[i]] = max // Build side effect chain While(Q[] is not empty] { SideNode= Pop[Q[]]; Find node NM such that D[NM,Sidenode] is minimum and NM is not present in Network List NL Add NM to Q[]; Add NM to NL }} Step 4 : Plot the ranges R[0,N] and the final network.
Fig. 1a. Network Formation Algorithm
Algorithm 2 : Optimixation Base station at[0,0] All n nodes at [x,y] NL[] – Network list D[n,n] – distance matrix which gives the distance between each node. Q[] – Queue k = proximity mimimum or least no of friends required for each node. R[0,1,2….n] = range of each node. x1,x2,y1,y2 Step 1: From the range matrix R[0,n] find those i for which R[i] > Rmax and the edge e for which the Ri is maximum If i <- Null go to Step 5 Add i and e to Q[];x1 = ex1 x2 = ex2;y1 = ey1 y2 = ey2 Step 2: Place a router node at the location (xr,yr) xr = (ex1+ex2)/2 and yr = (ey1+ey2)/2 Step 3 : Run Algorithm 1 Step 4 : Proceed through step1 Step 5 : Draw the network
Fig. 1b. Network Optimization Algorithm
Initialize Network
N.F
N.O
WSN Deployment
Fig. 1c. System Workflow
96
A. Kumar, M. Kumar, and K. Padmanabh
4 Experimental Results The simulator facilitates uploading different geographical map on the system. The system records the sensing location by user click action and assigns a virtual sensor node in blue to the clicked coordinates [Fig 2a]. The base node is assumed at the centre of the map in this simulation having the origin as the coordinates. The user also defines the maximum range for the nodes constrained by the hardware (in this epoch 75), the minimum number of friends for each node (in this epoch -3) as constrained by the application and hardware used. In the network formation phase [Fig 2b] algorithm 1[Fig 1a] ensures that each node has a range just sufficient to connect it to a minimum no of reliable links closest to the base station, both for forward and reverse channel communication. For Green links, the required network conditions have been met and the minimum range required for the node adjoining the link are < . Dashed Links in red represent that, the minimum range required for the node has exceeded the maximum permissible range for that node. Hence optimization is required. In the Network Optimization phase, Algorithm 2 [Fig 1b] is run to find the placement of repeaters. This serves as an input to Algorithm 1[Fig 1a] and the process is repeated to remove all dashed red links.
Fig. 2a. Network Initialization Fig. 2b. Network Formation Fig. 2c. Network Optimization
Fig 3a shows the result of the deployment phases (network formation and final network optimization). There is significant reduction in the ranges of the nodes from formation to optimization while the numbers of neighbouring nodes i.e. the redundant links being almost same in both formation and optimization. The drain measure according to equation 6 is calculated for each node and is depicted in Fig 3b for the stages, formation and optimization. The number of forwarding nodes added to the network in optimization phase [fig 1b and fig 1c] in this epoch is 7 (node 54 to node 60). Fig 3c demonstrates the final range of the nodes when the application has different reliability requirements i.e. different number of minimum friends. nRange graph means requirement of minimum ‘n’ friends for each node.
A Too ol to Determine Strategic Location and Ranges of Nodes
97
Fig. 3a. Range and Friendss Fig. 3b. Battery drain at Nodes Fig. 3c. Range with ‘n’ friennds Results
5 Conclusions and Future F Work The deployment system pro ovides a holistic approach for any WSN planning with the evident benefits of speedy planning and deployment. The user defined reliability and the constraints of range and d location of the sensing points are taken into account whhile calculating the optimum raange for the nodes and hence optimizing the battery lifee of the nodes. The output givess the instant results for the location, range, of each senssing and repeater nodes. The algorithms [fig 1a] and a [fig 1b] are being adapted for dynamic wireless sennsor networks in which the sen nsing locations are not fixed and the nodes are mobilee. It poses new challenge of com mputation of algorithms in Fig 1a and Fig 1b at runtime.
References 1. Estrin, D., Govindan, R., Heidemann, J., Kumar, S.: Next century challenges: scalaable coordination in sensor neetworks. In: ACM/IEEE International Conference on Moobile Computing and Networking archive, pp. 263–270. ACM Press, Seattle (1999) 2. Jourdan, D.B.: Wireless Seensor Network Planning with Application to UWB Localizatioon in GPS Denied Environmentts, Department of Aeronautics and Astronautics, Massachussetts Institute of Technology (Ju une 2006) 3. Li, J., Bai, Y., Ji, H., Maa, J., Qian, D.: The Architecture of Planning and Deploym ment Platform for Wireless Sen nsor Networks. In: Wireless Communications, Networking and Mobile Computing, WiCOM 2006 (2006) 4. Li, J., Bai, Y., Ji, H., Ma, J., Tian, Y., Qian, D.: POWER: Planning and Deploym ment Platform for Wireless Sensor Networks. In: Grid and Cooperative Computing Workshops, GCCW apos 2006 (2006) 5. Tang, F., Li, M., Weng, C., C Zhang, C., Zhang, W., Huang, H., Wang, Y.: Adances in G Grid and pervasive Computing. In: Combining Wireless Sensor Network with Grid for Intelliggent city Traffic, http://www w.springerlink.com/content/r56j28x64186157 7r/ 6. Padmanabh, K., Roy, R.: Maximum Lifetime Routing in Wireless Sensor Networkk by minimizing Rate Capacity Effect. In: IEEE ICPP-W 2006 (2006)
An Efficient Hybrid Data-Gathering Scheme in Wireless Sensor Networks Ayon Chakraborty1, Swarup Kumar Mitra2, and M.K. Naskar3 1 Department of CSE, Jadavpur University, Kolkata, India Department of ECE, MCKV Institute of Engineering, Howrah, India 3 Department of ETCE, Jadavpur University, Kolkata, India {jucse.ayon,swarup.subha}@gmail.com, [email protected] 2
Abstract. For time-sensitive applications requiring frequent data gathering from a remote wireless sensor network, it is a challenging task to design an efficient routing scheme that can minimize delay and also offer good performance in energy efficiency and network lifetime. In this paper, we propose a new data gathering scheme which is a combination of clustering and shortest hop pairing of the sensor nodes. The cluster heads and the super leader are rotated every round for ensuring an evenly distributed energy consumption among all the nodes. We have implemented the proposed scheme in nesC and performed simulations in TOSSIM. Successful packet transmission rates have also been studied using the interference-model. Compared with the existing popular schemes such as PEGASIS, BINARY, LBEERA and SHORT, our scheme offers the best “energy × delay” performance and has the capability to achieve a very good balance among different performance metrics. Keywords: Data Gathering, Network Lifetime, Interference Model, Energy x Delay.
1 Introduction Wireless Sensor Networks (WSNs) are usually self-organized wireless ad hoc networks comprising of a large number of resource constrained sensor nodes. One of the most important tasks of these sensor nodes is systematic collection of data and transmit gathered data to a distant base station(BS) where the data is processed. But once the nodes are deployed it is often undesirable or infeasible to replace or recharge them. Hence network lifetime becomes an important parameter for efficient design of data gathering schemes for sensor networks. E