Dariusz Pa Lka
email: dpalka@up.krakow.pl

Marek Zachara
email: mzachara@agh.edu.pl

Learning Web Application Firewall -Benefits and Caveats

Keywords: web, firewall, learning, security

The paper discusses selected issues related to the implementation and deployment of the Web Application Firewall that protects the target application by verifying the incoming requests and their parameters through matching them against recorded usage patterns. These patterns in turn are learned from the traffic generated by the users of the application. Since many web applications, including these operated by the government, are prone to exploits, there is a need to introduce new easily implementable methods of protection to prevent unauthorized access to sensitive data. A Learning Web Application Firewall offers a flexible, application-tailored, yet easy to deploy solution. There are certain concerns, however, regarding the classification of data that is used for the learning process which can, in certain cases, impair the firewall ability to classify traffic correctly. These concerns are discussed on the basis of reference implementation prepared by the authors.

Introduction

According to a recent survey [27], 72% of the interviewed companies had their web sites/applications hacked during the preceding 24 months. Most of the successful attacks happen on the application layer (Layer 7 of OSI model [12]) -as this is still the most vulnerable area. Even though lower levels are not ultimately secure, over the years the network protocols have been hardened to the point where hacking them is extremely difficult and few vulnerabilities emerge. Also, the operating systems, web servers, and encryption engines are relatively secure, as they usually come from only a few vendors and each has a large enough user base to identify vulnerabilities early and get them fixed quickly.

Web applications, however, are the opposite -they are usually unique (even if they use portions of a common code -e.g. some framework) and usually maintained by or for a single client only. This results in both lower average security of the code (as the specialized knowledge is less available for each company in such fragmented market) and fewer chances to spot the vulnerability before it is exploited. This is why web application vulnerabilities still outnumber browser/operating system vulnerabilities by the ratio of 1:10 [START_REF]Microsoft Security Intelligence Report, Key Findings[END_REF] Many web applications have vulnerabilities that are extremely easy to exploit. According to the research by Web Application Security Consortium [START_REF]Web Application Security Statistics[END_REF], "More than 13% of all reviewed sites can be completely compromised automatically. About 49% of web applications contain vulnerabilities of high risk level (Urgent and Critical) detected during automatic scanning. However, detailed manual and automated assessment by a white box method allows to detect these high risk level vulnerabilities with the probability reaching 80-96%".

Unfortunately, governmental web sites and applications are no exception. Although there are no specific statistics available for the vulnerability ratios of such sites, they are subject to successful hacking attempts. For example, a recent news item has reported a large number of these sites hacked with access details available for sale on the black market [START_REF]Imperva Data Security Blog: Major websites (gov,mil,edu)[END_REF]. It is important to note that governmental sites attract not only regular cyber-crime, but also the attention of hostile governments. With incomparably larger resources that can be committed to find/exploit a vulnerability and also cover the actions, this is a significant threat that cannot be ignored. In recent years there have been a number of accusations of such actions circulating the media, yet for obvious reasons no hard proof has been presented to the public.

Common attack methods

There are numerous methods in which an attack on a web application can be conducted. Yet, there are a few distinct categories that group most of them. Some of them are explained in greater detail below. These are the types of attack that can be (to various extent) prevented with the use of the dynamic parameter evaluation described in this paper. What is important to note, however, is that the list includes all most common vulnerabilities according to SANS Top 25 CWE list [START_REF]CWE/SANS Top 25 Most Dangerous Software Errors[END_REF]. More in-depth explanation, also reffering to other categories, can be found in [START_REF] Hope | Web Security Testing Cookbook[END_REF].

Script injections, especially SQL Injections are attack vectors that attempt the execution of an arbitrary code on the target machine. In its simplest form, such vulnerability exists if a user-supplied parameter is inserted into a predefined query and sent to the target interpreter. Vulnerability to this kind of attack is usually the result of insufficient validation of input, which neither sanitizes nor rejects harmful parameter values.

Parameter tampering is a general term for modifying the parameters sent to the server with a request, usually assigning them values not expected by the server. The objective of this action is to push the application servicing the request off its usual working pattern, possibly making it behave in an unpredictable way. Script injections are an example of parameter tampering, but the attack may also center on application/server failure (DoS) or identity theft.

Forceful browsing is a method of directly accessing available server's resources by requesting specific URL's instead of following links and forms provided by the application. This way a potential attacker can get access to pages/files outside normal execution path or can bypass poorly designed authentication procedures.

Cross-site scripting refers to a specific code injection technique, where the goal of the attacker is not to attack the server itself but other users that are (or will be) connected to it. If the web application allows for user-supplied content and does not validate that content properly before making it available to other users, the attacker can post a harmful code that can be presented by the server to other users -and executed on their PCs. As a result, the attacker may gain access to confidential information -including users' session identification.

For the sake of fairness, it should be noted that there are also various other threats/attack vectors that are not affected by the methods presented in this paper. The major ones that have to be considered are:

Buffer overflows that exploit stack/heap or other limited memory allocation pools by trying to overwrite the program's data with their own code. Even though they are a serious threat in general, they usually do not affect web applications. Although theoretically possible, they would be extremely difficult to conduct because of primarily two reasons: most web applications are written in relatively 'safe' languages that implement boundary controls, and also the web applications are often customized or custom made -forcing the attacker to act 'blindly'. Because of this, it is much easier to conduct this type of attack against other components of the system -the web server, database, or even a WAFsince these are widely available components that the attacker can investigate prior to the attack.

Man in the middle is a technique that involves listening to (or modifications of) the data in transit between a client and the server. The goal is to either get access to privileged information (e.g. user's credentials) or to change it before it reaches the server (e.g. change the account number for wire transfer). So far the primary protection against this threat is an encrypted transmission with verification of digital certificates. Unfortunately, if the user's operating system is compromised, there is hardly any way to protect them against such threat.

Session hijacking, cookies tampering and other methods that target user-side data in order to gain access to user's resources (e.g. by exploiting the Session ID) are only affected if the attack vector utilizes a cross-site action (as described above). Otherwise, they are unaffected by a WAF. Generally, WAF's task is to protect the server, while the user protection granted by possible rejection of cross-site scripting attempts is an additional bonus.

Denial of Service (DoS) and Distributed DoS (DDoS) are attacks that intent to prevent a web service (a web application) from functioning. This can be achieved by either exploiting a system bug or vulnerability (e.g. shutting down the service by a means of sending special command to the server), or by utilizing system resources (e.g. saturating the bandwidth) to the point where the system becomes unresponsive. While a WAF can protect against the former scenario, little can be done to prevent the latter. Also, in most cases, the protection against resources overloading should rather be done on a lower, network level.

Attack prevention measures

Most companies live in a delusional comfort of superficial protection. According to CSI/FBI 2006 study [4]: "97% of interviewed companies and administrations were using an anti-virus, 98% have a network firewall, 69% have intrusion detection systems. However ... 65% of these organizations have undergone a viral or spyware attack, 32% have experienced unauthorized access to their internal data and even 15% have suffered from network intrusions"

To fend off attacks, two broad categories of methods are used, namely prevention and detection. Prevention is the 'first line of defense' -its task is to block harmful attempts from reaching a vulnerable spot. Prevention usually works by blocking certain user's activities on the basis of prior knowledge -considering them either harmful or unnecessary for the use of the service. Detection, on the other hand, is used to identify attack attempts that get past the blockade, usually by monitoring the traffic and identifying certain behavioral patterns. These patterns can be in turn compared to a fixed database of known types of malicious behavior (which is in a way similar to the design of most anti-virus programs), or some heuristics which identify unusual circumstances can be implemented (this is the domain of Intrusion Detection Systems [START_REF]Intrusion Detection Systems[END_REF]).

Unfortunately, the flexibility offered by heuristic solutions comes at a price of false alarms being raised in unusual, but not attack-related circumstances. A system ability to detect an unknown (undefined) attack pattern is usually a trade-off for a number of legitimate users being reported as abusers. With increased sensitivity of such a system, the number of false positive reactions increases, making it unacceptable to allow it to act (e.g. block certain users from accessing the application) on its own. Therefore, such alerts are usually forwarded to a human supervisor for a decision. On the other hand, lowering the sensitivity, which would allow for the elimination of human supervision, results in a possibly higher number of real attacks passing unnoticed.

Focusing on securing a web application, it must be noted that this is a multiobjective task. It includes secure architecture and data handling, secure implementations and securing of external systems and libraries used by an application (e.g. an external database). It is postulated by many professionals, including Microsoft [START_REF] Gallagher | Hunting Security Bugs[END_REF], to treat security as a process spanning through the application life cycle rather than a single task, yet in reality it rarely happens. Corporate management prefer to have 'security/penetration tests' checked off somewhere on the way and to move to the next tasks in a project. This increases the importance of well-defined specific solutions that would address the security issues, while being understandable and manageable by project managers in organizations. As far as web applications are concerned, the Web Application Firewall (WAF) [START_REF]Web Application Firewall[END_REF] [29] is probably the most universal solution which limits the risk of exploiting the application, yet it is rarely used. This is due to several reasons:

-Difficulty in configuring a WAF -which needs to cover every aspect of interactions between the users and the protected application -the parameters passed from the user, the logic of the page flow, etc. -Duplication of protection rules that should be implemented in the application itself. This implies acknowledging that the application may not be secure. -Constant adjustment of WAF rules as the web application grows and evolves to match the new usage scenarios.

The combination of these conditions, especially the need of constantly adjusting a WAF to mirror the changes in the application, theoretically makes the application developers best suited for the task -at least from the organizational/management point of view. However, this leads to the situation when they are loaded with extra work based solely on an assumption that their core work (the application) is insecure. Naturally, their reaction will be to convince the management that a WAF is not really necessary and it is better to direct the available resources towards the development to achieve better quality and functionality. Personal experience of the authors confirms that WAF adoption is very limited in commercial environments, even for critical systems like Internet banking.

Adaptive web application firewall

As it was already mentioned, the complexity and number of rules needed for setting up a WAF is probably the most important obstacle preventing its wider adoption. Therefore, a natural approach would be to try generating a rule set from a sample of legitimate traffic. In other words, to equip a WAF with the ability to learn. Before discussing the methods of creating WAF rules, it is important to outline how a HTTP request is processed. A typical request looks like this: p and type inside the URL email and password as POST data content.

POST /service/
The request also includes other pieces of important information:

the target web page: /service/admin/base1 -the previous URL visited: http://server.domain/service/admin/login Storing and analyzing this information for each target page over a period of time can lead to valuable conclusions:

Page flow of the webservice: By comparing the current Referrer URL against the statistics of the Referrer URLs collected for the page, it can be determined whether the current client's behavior matches the usual usage patterns. If the Referrer URL has not been observed before, or has been observed extremely rarely, it can be assumed that the client is not behaving correctly, i.e. can be doing something undesirable. Such request can then be rejected, providing the application with the protection against the Forceful browsing exploit scenario.

Parameters range for the page: Having a large enough set of values for each parameter supplied by clients for the page, it can be deducted whether the currently supplied value falls within what can be considered as a 'normal' range. This is a typical classification task [START_REF] Duda | Pattern Classification[END_REF] with a potential for simplification, as described later. By controlling and rejecting parameter values which do not match normal behavior patterns, the application can be protected against all kinds of Parameter tampering attacks, including SQL injections and Cross-site scripting.

Of course, the effectiveness of these methods rely heavily on the quality of the statistics which in turn rely on the number of data samples collected and the ratio of malicious or erroneous attempts against all events. This issue will be discussed in greater detail in the following section.

Concerns and Implementation issues

Despite obvious benefits of a self-learning WAF, there are still certain issues that prevent market adoption and will need to be addressed. These can be divided into two major categories.

Data Collection

Apart form purely engineering issues of gathering the HTTP traffic, there are several major issues that have been encountered during the design and implementation of the self-learning WAF. These are related to the amount of data collected, the storage of the data and the application context considered for the parameter analysis.

Data scope. One of the primary decisions that impact a WAF ability to correctly deal with incoming parameter values is the scope of historical (reference) data that is used for evaluation. Too little data and a WAF may reject legitimate values that just did not make it into the reference scope, too much data and a WAF will be a subject to over-training that impairs generalization (similarly to the effect observed in neural networks). The data retention time (DRT), over which the data is analyzed, depends primarily on clients' usage patterns that may e.g. change on a weekday basis. There seems to be no sound scientific model that could help estimate the DRT, leaving it to the experience of the system administrators. It is important to note that the shorter DRT is, the quicker a WAF will adjust itself to a changed application, yet it will also be more vulnerable to an attack that will flood the server with forged requests.

Parameter context. From the user's point of view, a web application (or parts of its functionality) is a stateful machine with its behavior and state depending on user's actions. This implies that in some cases the range or number or valid parameter's values depend on the current state. A typical example could be a money transfer, where a logged user can supply the target account number as a parameter value, but a user who is doing so without being logged will be denied. As with the data scope, the optimal context may depend on specific application needs, yet in most real cases the target page is used as the context, optionally with the referrer URL and/or session ID presence flag.

Data storage.

A WAF processes the same information which is sent by a user to the target web application. This means that it also receives sensitive personal data, including authorization data (login names and passwords). However, if a WAF is to have the ability to check the incoming values against the historical knowledge, it must retain the data over a period of time. This leads to a critical issue of storing the values on the server that contains sensitive data. Since a WAF does not know in advance which data might be sensitive, it should apply the same rules to all analyzed parameters. One possible solution is to encrypt all the data stored with a key (preferably supplied from outside a WAF on runtime). The other is to keep all the retained data in RAM only. The former solution puts a tremendous overhead on computational power required as data needs to be encrypted and decrypted constantly. The latter implies loosing all protective knowledge on each server restart -leaving a potential attack window open until enough new data is collected. A practical, yet not elegant solution is to specify parameters that contain sensitive data manually -and only these parameters are e.g. encrypted -or most often an arbitrary value pattern is defined for them by the system administrator.

Learning Patterns

As far as data collection and analysis are concerned, there are two distinct work regimes that can be discussed. One is a triggered learning (TL) scenario, and the other is a continuous learning (CL) scenario. The TL scenario requires a WAF administrator to specifically trigger on and off the learning mode. In this mode, parameter values are collected -and are either stored as reference values or possibly generalized into a reference pattern or a value set. After the learning stage is completed, a WAF is switched into 'working' mode where the learned patterns are not adjusted, only the incoming parameter values are compared against the learned knowledge. This scenario has several important benefits:

-There is no need to consider the data retention period size. The data considered for pattern evaluation is all the data gathered during the learning process. -There is no need to store all historical data. At the end of the learning period, all the data can be transformed into a matching pattern or a value set. This also eliminates the sensitive data storage concerns described earlier.

-A WAF is resistant to attacks targeting its learning process.

However, there are also considerable drawbacks:

-The learning process must be complete; i.e. include all possible usage patterns -and since all these actions must be performed by the staff, it may incur additional costs. However, as most commercial deployment of web applications include acceptance tests -which usually cover all of the application usage scenarios, this work can be utilized to train a WAF. -A WAF must be manually re-trained after each change introduced to the protected application. Again, in the commercial environment such changes usually trigger some acceptance tests that can be used for this purpose.

To summarize, this scenario is preferable for a commercial deployment, especially of web applications that do not change frequently over time (e.g. Internet banking). It may be difficult to apply to very dynamic web services (e.g. a web portal).

The CL WAF offers somehow less precise protection at the benefit of much less manual input being required. In this case, as described above, the data is collected from user-supplied input over a defined constantly moving time window. The data from the recent window is used to verify incoming parameters. The major issues implied by this scenario are as follows:

-A WAF will only accept parameter values that match recent users' behavior patterns. If these patterns change over longer periods of time, there will be a high number of false positive reports by a WAF -The firewall may be susceptible to specially engineered attacks that target its learning process (e.g. supplying malicious data slowly over a period of time in order to make a WAF accept it as a valid pattern).

Statistical Data Significance

The following considerations apply to the CL scenario only, since in the TL scenario all the learning data is considered to be valid and legitimate. Gathered data retained by a CL WAF may, however, include incorrect or even harmful parameter values -since it is collected from unknown, usually anonymous users. For a WAF to function correctly the following assumption must be met: the amount of incorrect parameter values must be an insignificantly small portion of all the analyzed values.

The reason behind this requirement is obvious: the significant amount of incorrect data will train a WAF to accept them as valid input. What is not obvious is how to set the level of 'insignificance' for a certain data set. As of now, there has not been specific research targeting the distribution and grouping/classification of web services parameter values, hence there are no clear guidelines. In most cases, this significance level will be set by the system administrator based on his experience, expected traffic and knowledge about the application.

There is, however, a certain characteristic of the parameter values that can be exploited for the benefit of classification. Based on authors' experience, a significantly large number of parameters have values that fall into one of the following groups:

-Numerical values. A large portion of users' input is numerical. Moreover, numerical values are used to control the state of the application, to point at certain database records, etc. -Selection values. These are usually tied to users' selection options. As a result, only a very limited number of values is observed.

These two groups are relatively easy to detect using simple heuristic methods. Therefore, adding appropriate algorithms to the parameter evaluation provides significant engineering benefits, although there are still parameters which will not fall into these groups (e.g. addresses), and which are at the same time a popular target for hacking attempts.

Reference Implementation

A Learning Web Application Firewall has been implemented as a module for the Apache HTTP Server. The Apache HTTP Server was selected because it is free, open source, modular and powerful software. It is also the most widely used web server -as shown by Netcraft [18], Apache is used by over 61% of 312 693 296 sites investigated in the survey. The main components of the proposed Learning WAF are presented in Fig. 1. Request Data Validator is an Apache module which registers and analyzes incoming requests from web server clients. It is located in the input filter chain right after the SSL filter which is responsible for decoding incoming SSL requests. The Request Data Validator extracts a request context and values of all request GET and POST parameters from incoming requests. The extracted data are then sent to the Data Collector and Data Validator subsystems.

The Data Collector sends request data to the Data Store, but due to security reasons discussed above, all request parameters must first be encoded. Request data from the Request Data Validator is also checked by Data Validator to detect and prevent web attacks. If a potential attack is detected, it can be logged and the request may be rejected. Apart from the Request Data Validator module there are also other external processes working with Request Data Store, e.g. Data Cleaner whose task is to remove old parameter values (that are past data retention window). This cleaning process prevents excessive growth of the data store.

The most important of those external processes is Model Generator whose task is to create models for the data collected from requests. If the data in the incoming request do not match the current model, an anomaly score is assigned for this request. The request with an anomaly score that exceeds an assumed threshold is treated as an attack attempt. The Models for the request data are based on the following characteristics:

the length of parameter values the character distribution of parameter values belonging to one or more predefined classes (such as numerical value, email address, URL) -belonging to an enumerated type The models mentioned above (as well as others) can be found in [START_REF] Kruegel | A multi-model approach to the detection of web-based attacks[END_REF], however unlike [START_REF] Kruegel | A multi-model approach to the detection of web-based attacks[END_REF], the method proposed in this paper can utilize a continuous learning (CL) scenario for creating the models.

In case of some attacks, the models described above are not sufficient to detect anomalies in parameter values; in such cases a model of parameter structure can be useful. To create such model it is assumed that parameter values are words belonging to a language L generated by an unknown grammar G. On the basis of those words (positive examples) grammar inference is conducted and grammar G obtained in this process is treated as a data model. Because of the complexity of the process, it is assumed that in order to describe parameter values, the simplest (in Chomsky's understanding) hierarchy regular grammar [START_REF] Ingham | Learning DFA representations of HTTP for protecting web applications[END_REF], [START_REF] Kruegel | Anomaly detection of web-based attacks[END_REF], [START_REF] Kruegel | A multi-model approach to the detection of web-based attacks[END_REF] is enough. In the worst case however, learning only from positive examples is known to be NP-complete [START_REF] Gold | Complexity of automaton identification from given data[END_REF]. Because of this, instead of identifying grammar G, other methods are used including: inference of Deterministic Finite Automaton (DFA), Nondeterministic Finite Automaton (NFA) or Hidden Markov Models (HMMs), which might be treated as probabilistic generalization of NFA. There is extensive literature on learning regular languages [START_REF] Angluin | Inductive Inference: Theory and Methods[END_REF], [START_REF] Cicchello | Inducing grammars from sparse data sets: a survey of algorithms and results[END_REF], [START_REF] Fernau | Algorithms for Learning Regular Expressions[END_REF], [START_REF] Oliveria | Efficient search techniques for the inference of minimum sized finite automata[END_REF], [START_REF] Pitt | Inductive Inference, DFAs, and Computational Complexity[END_REF], [START_REF] Sakakibara | Recent Advances of Grammatical Inference[END_REF], [START_REF] Stolcke | Best-first model merging for Hidden Markov Model induction[END_REF].

Due to a stochastic character of the sample data (incoming requests), it was decided to base the grammar inference on HMMs and use Baum-Welsh algorithm [START_REF] Rabiner | A Tutorial on Hidden Markov Models and Selected Applications in Speech Recognition[END_REF]. It should be noted, however, that creating a model based on grammar inference is time-consuming, which means that using it in a CL scenario is limited. The article discusses potential benefits of introducing a Learning Web Application Firewall for the purpose of detecting and eliminating malicious users' behavior. Making use of learning processes for the benefit of computer security is recently gaining audience among researchers [START_REF] Kruegel | A multi-model approach to the detection of web-based attacks[END_REF], [START_REF] Ingham | Learning DFA representations of HTTP for protecting web applications[END_REF], and, with the growing number and sophistication of the web attack attempts, it appears to be a logical approach to address these problems. The obvious benefit of such a WAF is the ability to fend off a large class of dangerous attack patterns directed at the web application, with a very limited set-up time.

Comparison against existing WAFs

Certainly, WAFs are not an absolute novelty. They have been available on the market for several years and there are many vendors (e.g. Cisco, Barracuda, F5) offering their commercial hardware/software products (a larger list of sample vendors is available in [START_REF]Web Application Firewall[END_REF]). There is also an open source Apache ModSecurity project that can be used to provide that functionality. Yet, all of these solutions are based on fixed rule sets, which need to be configured manually for a custom web application. The vendors often provide templates for typical services or applications, but if a custom made application is to be secured, it usually requires a lot of manual setup and on-going maintenance as described earlier in this paper. On the other hand, commercial solutions, especially those that include vendor's hardware, come with additional features, e.g. load balancing, effective SSL support, and so on. There are other systems which might be helpful in securing Web Applications, e.g. signature scanning intrusion detecting system (IDS), such as SNORT [START_REF] Roesch | Snort Lightweight Intrusion Detection for Networks[END_REF] or Bro [START_REF] Paxson | Bro: A System for Detecting Network Intruders in Real-Time[END_REF]. However, such signature based methods require frequent updates of the attack signature databases by security experts and tuning it to reduce false positive alarms. These systems also cannot detect novel (zero day) attacks.

There are also anomaly based systems which treat web servers as generic network services, and in such systems incoming and outgoing data are modelled as a stream of bytes or discrete packets. The anomaly detection can be based on packet headers [START_REF] Mahoney | Learning nonstationary models of normal network traffic for detecting novel attacks[END_REF] or on matching patterns in the first few packets of connection [START_REF] Mahoney | Network traffic anomaly detection based on packet bytes[END_REF]. In those systems no rules need to be written and they can detect novel (zero day) attacks.

The Learning WAF presented in this paper resembles the approach proposed in [START_REF] Kruegel | Anomaly detection of web-based attacks[END_REF] and [START_REF] Kruegel | A multi-model approach to the detection of web-based attacks[END_REF], however, it has been implemented as the Apache module located in the input filter chain (not as a log analyzer as in [START_REF] Kruegel | Anomaly detection of web-based attacks[END_REF] and [START_REF] Kruegel | A multi-model approach to the detection of web-based attacks[END_REF]), and, as a result, it has access to all parameters transferred through GET and POST. Additionally, it can block requests identified as attack attempts, and not only report detected threats. Another significant difference between these two approaches is the fact that instead of triggered learning used in [START_REF] Kruegel | Anomaly detection of web-based attacks[END_REF] and [START_REF] Kruegel | A multi-model approach to the detection of web-based attacks[END_REF], our learning WAF can also utilize a continuous learning process.

Fields of use

The primary advantage of a Learning WAF is its ability to secure custom applications with none or little extra setup involved. Companies that utilize commonly used products or components may be able to get a pre-defined templates for a WAF that will protect their applications, but organizations that run unique or highly customized web applications need to take care of the protective rule sets on their own.

In such cases, a Learning WAF may be the best option -providing a customized protection without much manual work required. The best environment for such a WAF is either one with high traffic, and/or where complete acceptance tests are part of the deployment. Sample types of organizations that could be considered for this solutions are:

-Portals and other high traffic, frequently changed web sites.

-Banks and institution with high financial exposure to Internet threats (but they also have a very thorough acceptance tests). -Governmental institutions -last but not least, they almost always use unique/custom web applications while often not employing security professionals to protect them (with a notable exception of military). With these applications often having access to very sensitive data (e.g. individual tax reports), they are attractive targets for crooks and the enemies of the state alike.

The major concern for the deployment of a Lerning WAF into the production environment is the quality and completeness of the data used to train a WAF before it can reliably be used to control incoming traffic. In case of a TL WAF, the only concern remaining is the completeness of the training data, as all of it comes presumably from a trusted source. A CL WAF, however, poses a much greater challenge, as it requires automated evaluation and classification of unknown data coming from untrusted sources. This does not mean that such a CL WAF would not protect the application, but it must be taken into account that it may not provide a complete protection and, under certain circumstances, might allow malicious attacks to pass through. This type of WAF thus requires further research.

Fig. 1 .

 1 Fig. 1. The Learning Web Application Firewall components

If an URL parsing module is used (e.g. Apache's mod rewrite), some parameters may be passed as part of the target URL path.


Jostein Jensen
email: jostein.jensen@idi.ntnu.no

Benefits of Federated Identity Management -A Survey from an Integrated Operations Viewpoint

Federated Identity Management is considered a promising approach to facilitate secure resource sharing between collaborating partners. A structured survey has been carried out in order to document the benefits of adopting such systems from a user and business perspective, and also to get an indication on how Integrated Operations in the oil and gas industry can benefit from identity federations. This has resulted in a set of benefit categories grouping existing claims from researchers. The literature indicates that adoption of Federated Identity Management in Integrated Operation seems like a good idea, however, there are several challenges that need to be solved. Table 1. Extract of principles governing the IO gen 2 architecture Principle

Introduction

Federated Identity Management (FIdM) is a promising approach to facilitate secure resource sharing between collaborating partners in heterogeneous (IT) environments. Such resource sharing is the essence of the ideas of Integrated Operations in the oil and gas industry, as outlined in the next section (section 2). Federation technologies "provide open, standardised and secure methods for a service provider to identify users who are authenticated by an identity provider" [START_REF] Smith | The challenge of federated identity management[END_REF]. Further, identity federations facilitate delegation of identity tasks across security domains [START_REF] Maler | The venn of identity: Options and issues in federated identity management[END_REF].

There are different perspectives on Identity Management (IdM) [START_REF] Ahn | Information assurance in federated identity management: Experimentations and issues[END_REF], where the first is the traditional way of doing IdM, and the next two are alternatives for Federated Identity Management:

-Isolated IdM is the way IdM is commonly done today. Each company establishes, uses and maintains a local user repository where credentials are stored and used for authentication purposes to access company internal resources.

-Centralised IdM is one architectural model to realise Federated Identity Management. User data is registered in a central repository. User authentication is performed by this central entity, which issues identity assertion upon a successful authentication process. These assertion, or security tokens, can then be used to access distributed services across company borders.

-Distributed IdM is the opposite of the previous alternative. Each collaborating company or service provider keeps a local user repository. Authentication is performed locally, but the issued security token can be used to prove identity, and as such get access to, distributed services across company borders.

This illustrates the point that FIdM is about inter-organisation and interdependent management of identity information rather than identity solutions for internal use, and that it has emerged with the recognition that individuals frequently move between corporate boundaries [START_REF] Bhargav-Spantzel | Establishing and protecting digital identity in federation systems[END_REF]. The federation model enables users of one domain to securely access resources of another domain seamlessly, and without the need for redundant user login processes [START_REF] Arias Cabarcos | Enabling saml for dynamic identity federation management[END_REF]. According to Balasubramaniam et al. [START_REF] Balasubramaniam | Identity management and its impact on federation in a system-of-systems context[END_REF] an Identity Management solution consists of the following functionality attributes: 1) Identity provisioning, 2) Authentication and authorisation, 3) Storage, management, 4) query/retrieve and indexing of identity information, 5) Certification of identity and credentials, 6) Single-sign-on/singlesign-off, 6) Audit capabilities.

Smith [START_REF] Smith | The challenge of federated identity management[END_REF] has observed that the predictions of rapid acceleration in the industrial uptake of FIdM technology have not been fulfilled. This is despite the fact that the technological building blocks have been developed for years, and that the technology is relatively mature and well understood. This paper presents partial results of a research project to understand why FIdM processes and tools have not been widely adopted in industry, and what should be done to increase the adoption rate, and/or if there is an actual industrial need for it at all. A company's management need to be convinced of the benefits, challenges and cost of adopting a technology before they make the investment. So as a starting point, we wanted to identify what benefits of deploying FIdM have been reported in scientific literature. The following research questions were stated in this respect, and will be answered in this paper: RQ1: What are the reported benefits of adopting Federated Identity Management from a user perspective? RQ2: What are the reported benefits of adopting Federated Identity Management from a business perspective? RQ3: How can an Integrated Operations scenario benefit from using Federated Identity Management?

The last question is related to the case for the ongoing research project, which is an Integrated Operation (IO) scenario in the Norwegian oil & gas sector. This scenario is presented in the following section. Section 3 presents how the research leading to the the presented results was carried out, while section 4 presents a list of benefit categories obtained by analysing the literature, as well as a discussion on how an IO scenario can benefit from FIdM. Section 5 discuss our results before the paper is concluded and directions for further work are given in section 6.

In mid 1990, oil and gas companies operating on the Norwegian Continental Shelf (NCS) started developing and deploying mechanisms for simple remote operation of offshore installations. In 2002, the Norwegian Oil Industry Association (OLF) initiated a project group to look into this development, and consider the potential benefits and consequences of such initiatives. This resulted in a report [START_REF] Lilleng | edrift på norsk sokkel -det tredje effektiviseringsspranget[END_REF] describing future scenarios and visions for oil and gas operations in the North Sea. Prior to the remote management initiatives, there had been a distinct separation between onshore and offshore installations. Now, OLF saw that there was an increasing amount of data being made available and shared real-time. With new processes and tools these data could be utilised in decision support processes that would change the way work was organised. They envisioned that the workload between offshore and onshore installations would be changed, and virtual teams would emerge. The operations would be more integrated, and thus the term Integrated Operations (IO) emerged.

The concept of Integrated Operations has been refined and widely deployed in the companies operating on the NCS. Land-based operation centers monitor and control large portions of the daily oil and gas production. However, the current focus has been on intra-organisational collaboration, meaning that systems (more or less) only allow interaction between humans and systems within a single company. One of the visions in the OLF report referred to was, on the other hand, also to enable inter-organisational collaboration where partners (see Figure 1 for an overview of IO participants) could share information and knowledge seamlessly across company borders.

In 2008 a new OLF report was released: Reference Architecture of IT systems for OLF's IO G2 [START_REF]Reference architecture of it systems for olfs io g2[END_REF]. This report sketched the reference architecture for a common service platform supporting inter-organisational collaboration. The enhanced collaborative capacity has been seen as the next generation of IO systems and as such is referred to as IO gen 2. A Service Oriented Architecture (SOA) has been proposed to facilitate this collaboration.

The OLF architecture report [START_REF]Reference architecture of it systems for olfs io g2[END_REF] lists various governing principles for the future IO architecture, including those shown in Table 1 3 Method A structured literature review approach inspired by Kitchenham [START_REF] Kitchenham | Procedures for performing systematic reviews[END_REF] was used as research method leading to the results presented in this paper. The focus has been on performing the search phase with rigor. The aim of this systematic survey was to identify scientific literature that could provide answers to our research questions listed in the previous section. Comment

Loose coupling between systems Systems should be independent of changes in other systems A service provider and a service consumer must be able to interact with each other

Reachability is an essential prerequisite for service interaction.

Conform to open standards Roles and corresponding responsibilities must be defined Roles and responsibilities must be described to see who needs what in the patterns Access should be role and asset based Users need to be allocated a role for an asset (e.g. an oil field) so that it is possible to see what access is allowed against that asset for that person. Authentication should be at the local company Authenticated at his or her own company, for use anywhere. Build on existing infrastructure A service should be reusable Designed to be used by multiple customers, and also to be used in different contexts (within the scope if its intended use)

Identification of research

The starting point for the survey was a research protocol where the research questions and the search strategy were defined. A rigorous and comprehensive search was key to identify relevant scientific literature. We used the following online databases for scientific literature to search for studies:

-IEEE Xplore 1 -ACM Digital Library 2 -Compendex 3 -SpringerLink 4
For each of these databases we used the following search phrase: "federated identity management". The total amount of papers after this search was 684. Papers were then filtered based on title and abstract after the search, and duplicate publications were removed. All papers clearly not relevant for this study were taken out of the reading list. This process led to 113 remaining papers. The last selection of papers were read in the full, and text indicating benefits of using Federated Identity Management was extracted. This resulted in a total of 30 primary studies considered within the frame of this paper.

Results

This section presents the results after analysing all citations reported as benefits of using FIdM. The reported benefits were first split in two categories: those reporting benefits from a user perspective, and those reporting benefits from a business perspective. A further analysis led to categories of benefits as summarised in Table 2.

Benefits from a user perspective

In this section benefits of using FIdM from a user perspective are reflected, and indicates answers to RQ1.

Increased Privacy Protection Several researchers agree that the use of FIdM can increase the ability to protect personal privacy. Ahn et al. [START_REF] Ahn | Information assurance in federated identity management: Experimentations and issues[END_REF] [2] even say that "The main motivation of FIM [FIdM] is to enhance user convenience and privacy " , which is also supported by Gomi et al. [START_REF] Gomi | A delegation framework for federated identity management[END_REF]. Both Landau et al. [START_REF] Landau | Achieving privacy in a federated identity management system[END_REF] and Bertino et al. [START_REF] Bertino | Standards for web services security[END_REF] claim that FIdM technology can facilitate users to control their personal data, and what is being sent to a service provider. Requirements related to minimal disclosure of information can be fulfilled. Squicciarini et al. [START_REF] Squicciarini | Privacy policies compliance across digital identity management systems[END_REF] say that: Federated identity management systems [...] enable organizations to provide services to qualified individuals; and empower them with control over the usage and sharing of their identity attributes within the federation.

Better Security FIdM may lead to improved security for users. According to Wolf et al. [START_REF] Wolf | A message meta model for federated authentication in service-oriented architectures[END_REF] users are released from remembering several credentials due to the single sign-on feature facilitated by FIdM systems. Madsen et al. [START_REF] Madsen | Federated identity management for protecting users from id theft[END_REF] argue that the reduced number of authentication operations will make it practical for users to choose different and stronger passwords at their Identity Providers. This is also supported by Bhargav-Spantzel et al. [START_REF] Bhargav-Spantzel | Establishing and protecting digital identity in federation systems[END_REF]. Fewer and stronger authentication events will also help to minimise the risk of ID theft [START_REF] Bertino | Standards for web services security[END_REF].

With the FIdM model, credentials do not need to be sent to/via Service Providers. It is sufficient to send asserted claims [START_REF] Madsen | Federated identity management for protecting users from id theft[END_REF]. As such the credentials are better protected [START_REF] Landau | Achieving privacy in a federated identity management system[END_REF] [START_REF] Scudder | Personal federation control with the identity dashboard[END_REF].

Improved Usability Users can benefit from increased simplicity with FIdM solutions [START_REF] Landau | Achieving privacy in a federated identity management system[END_REF] [START_REF] Scudder | Personal federation control with the identity dashboard[END_REF]. It is especially the Single-sign-on (SSO) feature that is emphasised in this respect, and Madsen et al. [START_REF] Madsen | Federated identity management for protecting users from id theft[END_REF] highlight this feature as the archetypical example of a federated application. With SSO users can log in once and access different resources at different service providers [START_REF] Shim | Federated identity management[END_REF] [START_REF] Ranga | Identity and access management for the distribution of social grants in south africa[END_REF] [21] [START_REF] Kang | A peer-to-peer federated authentication system[END_REF], without needing to remember multiple ways of authenticating at each site [START_REF] Landau | Achieving privacy in a federated identity management system[END_REF] and potentially by only remembering one password [START_REF] Han | A generic construction of dynamic single sign-on with strong security[END_REF].

Seamless access to resources, and the elimination of redundant user login processes leads to improved user experience [START_REF] Almenarez | Towards dynamic trust establishment for identity federation[END_REF]. Satchell et al. [START_REF] Satchell | Beyond security: implications for the future of federated digital identity management systems[END_REF] add that instead of having several identities at different service providers, FIdM allows all these to be gathered under one umbrella. This does "not only provide users with vital cohesion but contributes to digital environments that are easily traversable spaces". Scudder and Jøsang [START_REF] Scudder | Personal federation control with the identity dashboard[END_REF] also state that identity federations release users from the burden of managing an increasing number of online identities.

From this we can deduce that users can experience improved usability since multiple services can be accessed as a unified whole [START_REF] Landau | Achieving privacy in a federated identity management system[END_REF].

Benefits from a business perspective

This section presents reported benefits of FIdM with respect to a business perspective, and as such indicates answers to RQ2.

Reduced Cost Several statements from researchers indicate that introduction of FIdM can lead to reduced cost with respect to identity management for an organisation [START_REF] Ranga | Identity and access management for the distribution of social grants in south africa[END_REF] [18] [START_REF] Chadwick | Federated identity management[END_REF]. Madsen et al. [START_REF] Madsen | Federated identity management for protecting users from id theft[END_REF] claim that the administrative costs of account maintenance for service providers can be reduced, and Ahn et al. [START_REF] Ahn | Information assurance in federated identity management: Experimentations and issues[END_REF] say that FIdM allows businesses to share the identity management cost with its partners. Bertino et al. [START_REF] Bertino | Standards for web services security[END_REF] explain the cost saving a bit more: Costs and redundancy is reduced because organisations do not have to acquire, store and maintain authorisation information about all their partners' users. Also Kang and Khashnobish say that the redundancy problem in user administration may be solved with FIdM, while Smith [START_REF] Smith | The challenge of federated identity management[END_REF] claims that multiple corporations in theory can share a single [FIdM] application, and that the consolidation can result in cost savings.

Improved Data Quality Since identity data is essential to make correct access control decisions it is paramount that they are correct and up to date. FIdM can help improve the overall quality of this data. Bertino et al. [START_REF] Bertino | Standards for web services security[END_REF] argue that identity information can be made available on demand and with low delay in a distributed environment in a FIdM scenario. They also claim that the user data will be more up-to-date and consistent compared to a scenario where user data is stored and maintained several places. Hoellrigl et al. [START_REF] Hoellrigl | A consistency model for identity information in distributed systems[END_REF] and Han et al. [START_REF] Han | A generic construction of dynamic single sign-on with strong security[END_REF] present similar views. Both groups claim that the strength is that the administrative burden of user management is moved from the service provider to the Identity Provider. As such, redundancy and information inconstancies in identity information can be avoided [START_REF] Hoellrigl | A consistency model for identity information in distributed systems[END_REF], and the exchange of user's identity information can be optimised.

Increased Security There are several security aspects that are facilitated by FIdM solutions. Bertino et al. [START_REF] Bertino | Standards for web services security[END_REF] claim that a federation prevents the problem of 'single point of failure'. However, this assumes that a distributed IdM model is followed. Speltens and Patterson [START_REF] Speltens | Federated id management -tackling risk and credentialing users[END_REF] call it the 'true holy grail' of Federation, that applications become fully claims aware, and that access control decisions are based on claims. In such a situation the 'minimal disclosure' of information principle can be satisfied in that only required data needed to access a service have to be transmitted to a business partner [START_REF] Bertino | Standards for web services security[END_REF]. Further, a claims based system can facilitate fine-grained authorisation [START_REF] Rieger | User-centric identity management in heterogeneous federations[END_REF]. Also Satchell et al. [START_REF] Satchell | Beyond security: implications for the future of federated digital identity management systems[END_REF] highlight that FIdM facilitates the assignment of access rights and privileges, and Sharma et al. [START_REF] Sharma | Survey on federated identity management systems[END_REF] add that it facilitates possibilities for detailed audit trails. Finally, Balasubramaniam et al. [START_REF] Balasubramaniam | Identity management and its impact on federation in a system-of-systems context[END_REF] give a general comment that FIdM will lead to minimisation of privacy and security violations.

Simplified/Improved User Management Federated Identity management can simplify the complex process of managing user accounts [START_REF] Landau | Achieving privacy in a federated identity management system[END_REF]. User management tasks can be decentralised among identity and service providers [START_REF] Ahn | Information assurance in federated identity management: Experimentations and issues[END_REF] [2] [START_REF] Gomi | A delegation framework for federated identity management[END_REF], without being worried that the work of managing user identities and attributes is doubled [START_REF] Elberawi | Privacy-preserving identity federation middleware for web services (pifm-ws)[END_REF]. There is a clear link between this point and Improved Data Quality and Increased Security. User account provisioning [START_REF] Almenarez | Towards dynamic trust establishment for identity federation[END_REF] is simplified, and with a holistic view of users' identity data, deprovisioning of user accounts is also better facilitated [START_REF] Wolf | A message meta model for federated authentication in service-oriented architectures[END_REF].

Reduced Complexity for Service Providers By separating identity management tasks from the service providers, they can focus fully on delivering high quality services, while at the same time reducing the complexity [START_REF] Almenarez | Towards dynamic trust establishment for identity federation[END_REF] [START_REF] Arias Cabarcos | Enabling saml for dynamic identity federation management[END_REF]. Identity management tasks can be outsourced to a separate IdP.

Facilitate cooperation

In the literature on FIdM there are several researchers arguing that federated solution will facilitate cooperation. Sharma et al. [START_REF] Sharma | Survey on federated identity management systems[END_REF] say that FIdM technologies will allow companies to share applications without needing to adopt the same technologies for directory services and authentication. Similarly Brossard et al. [START_REF] Brossard | Aspects of general security & trust[END_REF] state that enterprises can offer services across domain boundaries to users and other services not controlled or defined internally. The technology offers an opportunity to create new business relationships and realise business goals at a lower cost [START_REF] Satchell | Beyond security: implications for the future of federated digital identity management systems[END_REF]. The typical usecase is cross-domain single-sign-on [START_REF] Arias Cabarcos | Enabling saml for dynamic identity federation management[END_REF], where a user's identity information can be used across multiple organisations [START_REF] Zuo | Towards a dynamic federation framework based on saml and automated trust negotiation[END_REF] [START_REF] Schell | Performance evaluation of identity and access management systems in federated environments[END_REF]. FIdM help share this information in a protected way based on contractual and operational agreements [START_REF] Bertino | Standards for web services security[END_REF]. Sliman et al. [START_REF] Sliman | Single sign-on integration in a distributed enterprise service bus[END_REF] add to the above that final authorisation decisions can be kept at the end application or service, even though user data is stored and authentication is performed in a remote location.

Benefits from an IO perspective

As presented in section 2, Integrated Operation is all about inter-organisational resource sharing and collaboration, in a complex environment. In the following we give a brief view on how IO can benefit from adopting a FIdM model (RQ3).

Figure 1 shows part of the complexity associated with implementing IO; there are several actors involved. Examples of collaborative events include, vendors who may need remote access to the equipment they have delivered in order to read status reports and plan maintenance, and authorities who need access to drilling reports to monitor the production [START_REF]Reference architecture of it systems for olfs io g2[END_REF]. Today, isolated IdM models are realised by the IO actors. As such, e.g. the Oil and Gas company needs to provision a local user identity to the Vendor representative before he can remotely access equipment in the production environment. This raises several questions, such as: What are the procedures to keep user data up-to-date? What are the procedures when the vendor representative quits his job or changes position? What is the time delay before this is registered at the Oil and Gas company so that they can remove or update access rights?

The whole IO scenario seems as a good match for implementing the ideas of Federated Identity Management, especially considering the reported benefits from a business perspective. Independent of the chosen federation model (see section 1) user data will be registered once. This will simplify the user management process, which has the important effect that the quality and correctness of user data is always as good as they are collected at the primary source, and synchronisation issues are eliminated. This again is key to maintain a high security level in that access is given based on updated data. Instead of spending resources on managing external users, the IO actors can focus on maintaining dynamic access policy sets, and improve the granularity of access constraints based on identity attributes/claims.

With the large number of IO actors it is an unrealistic scenario that all of them will invest in identical infrastructure related to Identity Management. However, selecting a FIdM model using standardised protocols and interfaces will facilitate cooperation and make system integration less difficult.

Most communication will go through the Oil and Gas Company, meaning that they will experience most of the overhead related to the current Isolated IdM model. Cost savings may thus be considerable for these companies, while the economic incentive to move to a FIdM model might not be as large for the other actors.

In addition to this, FIdM may also facilitate the realisation of the architectural principles for IO as outlined in Table 1 . Systems and services can be loosely coupled, and identity and authentication services will be decoupled from functionality services. FIdM facilitates communication and interaction between service providers and service consumers in that identity data is sent in a standardised way designed for distributed systems. Access may be role based, but can also be made at more granular levels based on claims. Next, the distributed FIdM model is designed for keeping identity data at the local company, and performing local authentication of users.

Discussion

A lightweight version of Kitchenham's guide to structured surveys has been used to obtain the results presented in this paper. We have been less strict in the paper selection phase (as there have only been one researcher involved) and data synthesis phase (papers were read, raw data collected and grouped once, without iteration) than what is recommended to pass the strict requirements of the guide. Further, the search phrase we used may prevent us from identifying an exhaustive literature list on the topic; there might e.g. be papers talking about identity federations without mentioning our exact search phrase. Yet, we argue that the process is sufficient to answer the stated research questions, as it allows to get a representative view on existing research on the topic.

Next, it is important to be aware of the fact that the benefit categories listed in this paper are a result of analysing claims from researchers in the field. These claims must to a large extent be considered as expert opinions, which are not necessarily backed up by existing research. E.g. several researchers mention cost savings as a possible benefit of FIdM, however, none of the cited papers report from case studies where real cost savings are presetend.

This being said, FIdM seems like a promising approach to support interorganisational collaboration, and there seems to be a good match between the reported benefits and the architectural principles for IO in the Oil and Gas sector. However, there are considerable challenges still to be solved, and which might hinder adoption. Trust among the participants in a Federation is one [START_REF] Scudder | Personal federation control with the identity dashboard[END_REF]. Baldwin et al. [START_REF] Baldwin | Assurance for federated identity management[END_REF] point to the fact that stakeholders might have different assumptions and risk appetite, and as such different requirements with respect to the level of assurance associated with identity claims. These trust challenges are related to people, processes and technology. According to Scudder and Jøsang [START_REF] Scudder | Personal federation control with the identity dashboard[END_REF] the degree of needed trust does not foster large-scale federations. Smith [START_REF] Smith | The challenge of federated identity management[END_REF] raises the issue of liability. What will happen if one of the federation partners fails to follow a proper process for identification of their employees? Another aspect of implementing FIdM is the consequences of single-sign-on functionality if a digital identity is stolen, or a password compromised [START_REF] Maler | The venn of identity: Options and issues in federated identity management[END_REF]. In such cases not only internal resources are compromised, but also potentially those of the federation partners. There are also technological challenges. Wolf et al. [START_REF] Wolf | A message meta model for federated authentication in service-oriented architectures[END_REF] point to complexity with respect to standardisation of FIdM protocols and data formats among the collaborators, and that this is essential to reach the goal. These challenges indicate that RQ3 can not be answered by looking at the reported benefits alone. A deeper analysis to answer this question, and a cost benefit analysis, should be done after all challenges are considered, and a risk assessment has been carried out.

Conclusion and Further Work

In this paper we report benefits of adopting Federated Identity Management systems from a user and business perspective, and a high-level view on perspectives of adopting FIdM in an Integrated Operations environment. Our conclusion is that there is a good match between the benefits of adopting FIdM and the architectural principles suggested for IO. However, we have also mentioned considerable challenges of adopting FIdM, and more research is needed to facilitate adoption in an industrial setting.

As part of a larger ongoing work on FIdM to facilitate IO, similar work as presented in this paper will be carried out with respect to documentation of reported challenges in the near future. The combined results will be used as input to a large case study including the stakeholders on different levels (management, IT operations, system users), from the various actors shown in Figure 1. This case study will result in empirical evidence as to what the enablers for FIdM adoption are, and whether it is realistic in an IO setting or not.

Fig. 1 .

 1 Fig. 1. Collaborating actors. Adapted from [1]

Table 2 .

 2 Benefit categories from a user and business perspective

	User perspective	Business perspective
	Increased privacy protection	Reduced cost
	Better security	Improved data quality
	Improved usability	Increased security
		Simplified/Improved user management
		Reduced complexity for service
		providers
		Facilitate cooperation

http://ieeexplore.ieee.org/Xplore/dynhome.jsp

http://portal.acm.org/dl.cfm

http://www.engineeringvillage2.org/

http://www.springerlink.com

Acknowledgment

This work is supported by grant 183235/S10 from the Norwegian Research Council, and the GoICT project.


Tomasz Hachaj
email: tomekhachaj@o2.pl

Marek R Ogiela
email: mogiela@agh.edu.pl

Augmented reality approaches in intelligent health technologies and brain lesion detection

Keywords: Pattern recognition, cognitive analysis, dynamic brain perfusion, volume rendering, gradient estimation, augmented reality

In this paper authors present their new proposition of system for cognitive analysis of dynamic computer tomography perfusion maps (dpCT). The novel contribution of this article is introducing an augmented reality visualization module that supports real time volume rendering (VR) of derived data. Authors also presents the results of their researches on optimization of VR algorithm memory usage by dynamic computation of volume gradient instead of pre-generation of gradient Authors compare five different discrete gradient computation schemas taking into account image quality and processing speed on two VR algorithms: volume ray casting and texture based visualization with view aligned slices.

Introduction

The ensuring of patient security during the health care is one of the basic duties of medical personnel [START_REF] Jara | An Initial Approach to Support Mobility in Hospital Wireless Sensor Networks based on 6LoWPAN (HWSN6)[END_REF]. Nowadays many dedicated diagnosis support systems (DSS) emerge on purpose to help physicians in everyday practice. The modern DSS has to satisfy many requirements in order to be accepted in medical society. It has to be not only a reliable tool (low total error rate coefficient) but also quickly generates the support information and has intuitive interface. In this article authors present their new proposition of system for cognitive analysis of dynamic computer tomography perfusion maps (dpCT) that satisfies all of those requirements. The proposed solution is the extension of previous works [START_REF] Hachaj | CAD system for automatic analysis of CT perfusion maps[END_REF], [START_REF] Hachaj | Computer -assisted diagnosis system for detection, measure and description of dynamic computer tomography perfusion maps[END_REF], [START_REF] Hachaj | A system for detecting and describing pathological changes using dynamic perfusion computer tomography brain maps[END_REF]. The novel contribution of this article is introducing an augmented reality visualization module that supports real time volume rendering (VR) of derived data. Authors also present the results of their researches on optimization of VR algorithm memory usage. The huge amount of GPU memory may be saved by dynamic computation of volume gradient instead of pre-generation of gradient. Authors compare five different discrete gradient computation schemas taking into account image quality and processing speed on two VR algorithms: volume ray casting and texture based visualization with view aligned slices. Many similar researches on the field of gradient reconstruction for VR were previously reported (for example in [START_REF] Bentum | Frequency Analysis of Gradient Estimators in Volume Rendering[END_REF], [START_REF] Mihajlovic | Gradient of B-splines in volume rendering[END_REF], [START_REF] Csébfalvi | Prefiltered Gradient Reconstruction for Volume Rendering[END_REF]). Authors intention was to compare the speed of two most popular VR algorithms with pre-generated and dynamically computed volume gradient on clinical data using different transfer function [START_REF] Engel | Real-Time Volume Graphics[END_REF] in order to justify using one (or both) of them in their diagnosis support program. Despite the fact that transfer function is the factor that might highly affect the speed of the VR (especially when rendering algorithms utilizes acceleration techniques like early ray termination or empty-space skipping [START_REF] Krüuger | Acceleration Techniques for GPU-based Volume Rendering[END_REF]) we did not found papers in which transfer function was taken into account during dynamic gradient computation. Because of that the presented comparison is also important contribution to state of art of VR visualization.

Diagnosis support system architecture

The authors system enables the quantitative and quality analysis of visualized symptoms like head injuries, epilepsy, brain vascular disease, ischemic and hemorrhagic stroke that changes blood perfusion. The new implementation of the DMD (detection measure and description system [START_REF] Hachaj | CAD system for automatic analysis of CT perfusion maps[END_REF]) also includes intuitive augmented reality visualization module derived from [START_REF] Hachaj | Augmented reality interface for visualization of volumetric medical data[END_REF]. The schema of the system is presented in Figure 1. The patient's data (1) is kept in DICOM repository. It is consisted of neuroradiology images like dpCT, CT (computer tomography) and MR (magnetic resonance). The dpCT is used for generation of perfusion CBF and CBV maps [START_REF] Hachaj | CAD system for automatic analysis of CT perfusion maps[END_REF]. The next step (3) is detection of perfusion abnormalities and generation of ischemia prognosis for infarcted tissues. The CT (or RM) data is processed and visualized with VR algorithms [START_REF] Hachaj | A system for detecting and describing pathological changes using dynamic perfusion computer tomography brain maps[END_REF]. The data from ( 3) is superimposed into the 3D object [START_REF] Bentum | Frequency Analysis of Gradient Estimators in Volume Rendering[END_REF]. The result date is superimposed with augmented reality environment (6) onto image captured by digital camera [START_REF] Csébfalvi | Prefiltered Gradient Reconstruction for Volume Rendering[END_REF].

Detection of perfusion abnormalities

The process of an analysis of dpCT proposed by authors is a fusion of image processing, pattern recognition and image analysis procedures. All of these stages will be described in this paragraph. The input data for the algorithm is cerebral blood flow, cerebral blood volume and CT image.

Image processing. Image processing step is consisted of lesion detection algorithm and image registration algorithm. The algorithm used for detection of potential lesions is The Unified Algorithm detailed described in [START_REF] Hachaj | CAD system for automatic analysis of CT perfusion maps[END_REF]. Lesion detection algorithm finds potentially pathologic tissues (regions of interests -ROI). Image registration algorithm is used for creating of deformable brain atlas in order to make detailed description of visible tissues. Potential lesions are compared with corresponding CT / MR image in order to check its presence there. This process enables proper treatment planning. For registration purpose authors have chosen free-from deformation algorithm proposed in [START_REF] Parraga | Non-rigid registration methods assessment of 3D CT images for head-neck radiotherapy[END_REF]. The detailed (AA based) description of image in authors system has been presented elsewhere [START_REF] Hachaj | The registration and atlas construction of noisy brain computer tomography images based on free form deformation technique[END_REF].

Image analysis. Defining the features of entire image after lesion detection step is an easy task. Algorithm measures some important from (medical point of view) features:

-Perfusion in ROI in left and right hemisphere.

-Relative perfusion (perfusion in ROI in left hemisphere divided by perfusion in ROI in right hemisphere and perfusion in ROI in right hemisphere divided by perfusion in ROI in left hemisphere). -Size of ROI. The scaling factors between perfusion map and "real brain" can be derived directly from DICOM files.

Pattern recognition.

In pattern recognition step algorithm determinate what type of lesion was detected and in which hemisphere. In order to do it is necessary to gather medical knowledge about average perfusion values. After image processing step two symmetric regions are detected in left and right hemisphere. Authors' algorithm compares perfusion in left and right (symmetrical) ROI with average perfusion norms and place potential lesion in hemisphere where modulus of difference between average and ROI value is greater. After this it is an easy task to determinate the type of lesion (hemorrhagic or ischemic) simply by checking if perfusion in ROI is greater or smaller than average. The last step done by the algorithm is to state prognosis for lesion evolution in brain tissues. CBF and CBV have prognostic values in evaluation of ischemic evolution. In many cases simultaneous analysis of both CBF and CBV perfusion parameters enables accurate analysis of ischemia visualized brain tissues and predict its further changes permitting a not only a quality (like CT angiography) but also quantitative evaluation of the degree of severity of the perfusion disturbance which results from the particular type of occlusion and collateral blood.

The algorithm analyze both perfusion maps simultaneously in order to detect:

-Tissues that can be salvaged (tissues are present on CBF and CBV asymmetry map and values of rCBF did not drop beyond 0.48 [START_REF] Koenig | Quantitative assessment of the ischemic brain by means of perfusion-related parameters derived from perfusion CT[END_REF]). -Tissues that will eventually become infracted (tissues are present on CBF and CBV asymmetry map and values of rCBF did drop beyond 0.48 [START_REF] Koenig | Quantitative assessment of the ischemic brain by means of perfusion-related parameters derived from perfusion CT[END_REF]). -Tissues with an auto regulation mechanism in ischemic region (decreased CBF with correct or increased CBV). Summing up, the output data of the algorithm is consisted of: regions of perfusion abnormalities, AA description of brain tissues, measures of perfusion parameters and prognosis for infracted tissues. That information is superimpose onto volumetric CT data and displayed to radiologist.

GPU-based volume rendering

Volume rendering describes a wide range of techniques for generating images from three-dimensional scalar data [START_REF] Engel | Real-Time Volume Graphics[END_REF]. These techniques are originally motivated by scientific visualization, where volume data (three dimension arrays of pixels) is acquired by measurement or numerical simulation of natural phenomena. Typical examples are medical data of the interior of the human body obtained by computed tomography (CT) or magnetic resonance imaging (MRI). The scalar data (often monochromatic) is mapped to color space by transfer function that is often implemented as lookup table. The power of GPUs is currently increasing much faster than that of CPUs. That trend forces many computer programmers to move the burden of algorithm computation to GPU processors. Also the hardware support for interpolation of not only 2D but also 3D texture data enables the rendering of complex volumetric images in real time. Nowadays graphic programmers utilize high-level languages that support implementation of highly parallel algorithms that runs on programmable GPU's shaders. The main obstacle that must be overcome during creation of volume rendering algorithm is the fact that contemporary computer hardware still does not support direct rendering of volumetric data. There are two main groups of the algorithms that support fast visualization of volumetric data with hardware accelerated interpolation. The first group is ray-casting algorithms the second one texture-based algorithms. Both groups are capable to produce almost identical visualization results but they have quite different schemas. Moreover algorithms differs much in performance speed, which is important factor that must be taken into account in case of augmented reality environment [START_REF] Kutter | Real-time Volume Rendering for High Quality Visualization in Augmented Reality International Workshop on Augmented environments for Medical Imaging including Augmented Reality[END_REF]. All algorithms described below use tri-linear interpolation hardware support.

Volume ray-casting algorithms. In ray-casting process for each pixel in the image to render, algorithm casts a single ray from the eye through the pixel's center into the volume, and integrates the optical properties obtained from the encountered volume densities along the ray. Algorithm uses standard front to back blending equations in order to find color and opacity of rendered pixels: The popular approach proposed in [START_REF] Krüuger | Acceleration Techniques for GPU-based Volume Rendering[END_REF] includes standard acceleration techniques for volume ray casting like early ray termination and empty-space skipping. By means of these acceleration techniques, the framework is capable of efficiently rendering large volumetric data sets including opaque structures with occlusions effects and empty regions.

src src dst dst dst C C C α α ) 1 ( - + = (1) src dst dst dst α α α α ) 1 ( - + =
Texture-based algorithms. The ray casting approach is a classical image-order approach, because it divides the resulting image into pixels and then computes the contribution of the entire volume to each pixel [START_REF] Engel | Real-Time Volume Graphics[END_REF]. Image-order approaches, however, are contrary to the way GPU hardware generates images. Graphics hardware usually uses an object-order approach, which divides the object into primitives and then calculates which set of pixels primitive influences. In order to perform volume rendering in an object-order approach, the resampling locations are generated by rendering proxy geometry with interpolated texture coordinates. The most basic proxy geometry is a stack of planar slices, all of which are required to be aligned with one of the major axes of the volume (either the x, y, or z axis) [START_REF] Engel | Real-Time Volume Graphics[END_REF]. During rendering, the stack with slices most parallel to the viewing direction is chosen. In order to minimize the switching artifacts inter-slice interpolation ought to be included [START_REF] Engel | Real-Time Volume Graphics[END_REF]. The more complex proxy geometry is slices aligned with the viewport [START_REF] Engel | Real-Time Volume Graphics[END_REF]. Such slices closely mimic the sampling used by the ray-casting algorithm. The sufficient number of slices required for accurate visualization can easily be adjusted during algorithm performance.

Augmented reality

Augmented reality (AR) is a technology that allows the real time fusion of computer generated digital content with the real world. Unlike virtual reality (VR), that completely immerses users inside a synthetic environment, augmented reality allows the user to see three-dimensional virtual objects superimposed upon the real word [START_REF] Haller | Emerging Technologies of Augmented Reality: Interfaces and Design[END_REF]. Augmented reality shows its usefulness especially in the field of the medicine [START_REF] Yang | Medical Imaging and Augmented Reality[END_REF]. The most notable examples are deformable body atlases, AR surgical navigation systems, interfaces and visualization systems. Pre, intra and post -operative visualization of clinical data is a major source of information for decision making.

Augmented Reality aim at lifting this support to a new level by presenting more informative and realistic three-dimensional visualizations [START_REF] Denis | Integrated Medical Workflow for Augmented Reality Applications[END_REF]. In our system AR is used as intuitive interface that enable easy and reliable manipulation of visualized objects. Augmented reality environment used by authors utilizes size -known square markers. The transformation matrices from these marker coordinates to the camera coordinates are estimated by image analysis. The details of the algorithm can be found in [START_REF] Haller | Emerging Technologies of Augmented Reality: Interfaces and Design[END_REF].

Gradient reconstructions for VR

Illumination and shading within volume rendering refers to the same illumination models and shading techniques used in polygon rendering. The goal is to enhance the appearance of rendered objects, especially to emphasize their shape and structure, by simulating the effects of light interacting with the object [START_REF] Grimm | Real-Time Mono-and Multi-Volume Rendering of Large Medical Datasets on Standard PC Hardware[END_REF]. The most common local illumination model, which calculates light per pixel, is the Phong [START_REF] Phong | Illumination for Computer Generated Pictures[END_REF] lighting model. The Phong model is made up of three parts, ambient, diffuse and specular.

specular diffuse ambient L L L L + + = (3) ambient ambient ambient K I L ⋅ = (4)
Where ambient I is the constant intensity of the ambient light and ambient K is the coefficient of the ambient reflection of the surface. The ambient term is a constant, which simulates indirect light on the parts of geometry where there is no direct light, they would otherwise be entirely black.

   < ⋅ ⋅ = otherwise K I L diffuse diffuse diffuse 0 90 ), cos( o α α (5)
Where diffuse I is light source intensity, diffuse K is a material constant describing color and α is the angle between light source and surface normal. The diffuse term calculates the reflection of light from a surface without shininess, called a matte surface. The light is reflected at the same angle as it is striking the surface relative to the surface normal.

   < ⋅ ⋅ = otherwise K I L m specular specular specular 0 90 ), ( cos o β β (6)
where specular I is the intensity of the incident light, specular K is the coefficient of specular reflection for the material, β is the angle between the reflection vector and the viewing vector and m controls the extension of the highlight. The specular term is added to simulate the shininess of surfaces, it creates highlights, which give the viewer cues of light source positions and geometry details. An essential part of the illumination model is the surface normal. In VR case a surface normal is replaced by the gradient vector calculated at all points of interest [START_REF] Jonsson | Volume rendering[END_REF].

        = ∇ dz df dy df dx df z y x f , , ) , , ( (7)
There are several methods for calculating the gradient vector. The most common are (see Appendix: 3D discrete gradient operators):

-Intermediate difference operator (8) [START_REF] Jonsson | Volume rendering[END_REF].

-Central difference operator (9) [START_REF] Jonsson | Volume rendering[END_REF].

-Neumann gradient operator ( 10) [START_REF] Jonsson | Volume rendering[END_REF].

-Zucker-Hummel operator (11) [START_REF] Ballard | Confocal Volume Rendering: Fast Segmentation-Free Visualization of Internal Structures[END_REF].

-Sobel operator (12) [START_REF] Grimm | Real-Time Mono-and Multi-Volume Rendering of Large Medical Datasets on Standard PC Hardware[END_REF], [START_REF] Chan | Perception-Based Transparency Optimization for Direct Volume Rendering[END_REF]. Intermediate difference gradient takes as input four neighboring voxels, Central difference gradient takes as input six neighboring voxels, the rest of operators take as input 26 or 27 neighboring voxels. The 26/27 neighbors give usually a better estimation of the gradient, but take more time to calculate. Another disadvantage is that additional smoothing might be introduced [START_REF] Pommert | Surface Shading in Tomographic Volume Visualization[END_REF]. There are two basic methods of gradient computation strategy [START_REF] Csébfalvi | Prefiltered Gradient Reconstruction for Volume Rendering[END_REF]: pre-generation of volume gradient and passing it to GPU memory by 3D texture or dynamic computation during rendering process. The first method requires large amount of memory (for each volume voxel the three gradient coefficients must be stored). The second method does not require additional memory (that means it uses even four times less memory then pre-generation) but is more expensive computationally as the components are calculated separately. Capacity of GPU memory is still bottleneck in VR algorithm even in visualization of typical medium-sized medical data. The question that we answered in the next paragraph is what is the performance speed of VR algorithms with pre-generated versus dynamically computed volume gradient on typical (off-the-shelf) graphical hardware and if it is sufficient for our needs.

Results and discussion

The five gradients calculation methods from the previous paragraph where compared using three volume data (real CT images) of the size 256x256x221, 256x256x212 and 256x256x207 voxels. All of those models were rendered with two transfer function: transfer function with huge amount of semi transparent pixels (Figure 2, top row) and function without semi transparent pixels (Figure 2, bottom row). Those are two boundary cases that might be considered in medicine practice. For rendering purpose authors used two VR algorithms: volume ray casting (with early ray termination and empty space skipping) and texture based algorithm with view-aligned slices. The algorithms were implemented in .NET C#, XNA Framework 2.0 (Direct X 9.0) with HLSL and executed on Intel Core 2 Duo CPU 3.00 GHz processor, 3.25 GB RAM, Nvidia GeForce 9600 GT graphic card with 32 -bit Windows XP Professional OS. The performance speed of VR was computed for three volume datasets mentioned above and then averaged. The gradient calculation methods were pre-computation and dynamic computation with 4-points, 6-point and 27-point method. The results are presented in Table 1 and Figure 3.

Table 1. Average performance speed (fps) of 3D models as a function of rendering algorithm type, gradient computation method and transfer function. The most time demanding operation is retrieving image data (voxel values) from 3D texture in GPU for computing of a gradient. This is the reason why algorithms with dynamic computed gradients are slower than with their pre-computed versions. The more points are needed for gradient calculation the slower the whole algorithm is. The very important factor that highly affects performance is a transfer function that is used for volume rendering. Volume ray casting is the fastest algorithm if the transfer function do not have many semi-transparent pixels. It is caused by the fact that in that case early ray termination quickly finishes the ray lookup loop. The texture-based algorithm has to render all slices no matter if there are visible or not. On the other hand if there are many semi-transparent pixels the empty space skipping and ray termination will not help the ray casting to improve program speed. The number of computation and references to 3D texture memory is higher than in texture-based algorithm, which becomes quicker.

Transfer function Rendering algorithm

Gradient computation method

The second factor that we took into account during comparison of gradient computation methods is a quality of gradient reconstruction (Figure 4). The results was similar to those described in [START_REF] Bentum | Frequency Analysis of Gradient Estimators in Volume Rendering[END_REF]. The intermediate difference and central difference operator are good low-pass filters. There are also highly visible quality differences between those two methods: intermediate difference generates much more lighting artifact then the 6-point methods. The Sobel gradient estimation method, as well as other 26/27-pixels gradient estimation approaches, produces less fringing artifacts than other methods. The differences between Sobel, Neumann, Zucker-Hummel are nearly invisible and does not affect the image analysis process. What is more important the differences of quality (when taking into account fringing artifacts) between central difference and the high order estimation methods do not disqualify the 6-points method. Also visualization with central difference operator is 3 to 4 times faster than with high quality kernels. Knowing all of those results we decided to use in our solution both visualization algorithms with a dynamic central difference gradient computation method. After determining the transfer function an algorithm decides which of those method runs faster and uses it during session with program. That approach enables the visualization to run with the speed oscillating near 30 fps, which is an accepted value for our needs. The example visualization of superimposition of dpCT onto volume CT data in AR with our program is shown in Figure 5.

Conclusions and future work

This papers presents and summarizes the results of the integration of cognitive image analysis and patter recognition algorithm with a high quality hardware accelerated volume renderer into an augmented reality visualization environment. Augmented reality supplies the system with more informative and realistic three-dimensional visualizations offering very intuitive image manipulation interface. The performance of the presented techniques was demonstrated and evaluated in several experiments by rendering real human CT data with different rendering techniques. The authors also took into account the quality and speed of volume gradient estimation methods considering transfer function type. There are many important aspects which future work should focus on. Superimposition the dpCT data onto volume CT / MR enables to perform more detailed diagnosis for example taking into account not only dynamic perfusion but also the state of the vascular system (brain angiography). The further researches should also be done in the field of real time large volume visualization that might be needed during superimposition of medical data of several modalities. Our augmented reality system should also be replaced by marker-less solution that would be more convenient for the end user.

k j i k j i k j i k j i k j i k j i k j i z y x f z y x f z y x f z y x f z y x f z y x f z y x f (8) Central difference operator:           - - + - - + - - + = ∇ ) 1 , , ( ) 1 , , ( ), , 1 , ( ) , 1 , ( ), , , 1 ( ) , , 1 ( 2 1
) , , (

k j i k j i k j i k j i k j i k j i k j i z y x f z y x f z y x f z y x f z y x f z y x f z y x f (9)
The kernel of Neumann gradient operator:

                    - - -           - - -           - - - = ∇ 2 0 2 3 0 3 2 0 2 3 0 3 6 0 6 3 0 3 2 0 2 3 0 3 2 0 2 52 1 : x                - - -           - - -           - - - = ∇

Figure 1 .

 1 Figure 1. Data flow in DMD system with augmented reality visualization module. Detailed description in text.

  α are the color and opacity values of the rendered pixels and src C and src α are the color and opacity values of the incoming fragment.

Figure 2 .

 2 Figure 2. Three different models based on volume CT data. Top row -models with transfer function with semi transparent pixels. Bottom row -same models with transfer function without semi transparent pixels.

Figure 4 .

 4 Figure 4. Volume rendering of example model with different methods of gradient estimation. From left to right: intermediate difference, central difference, Sobel, Neumann and Zucker-Hummel.

Figure 5 .

 5 Figure 5. The example visualization of superimposition of dpCT onto volume CT data in AR. (A) CBF map with marked perfusion abnormalities. (B) The detailed view of CBV and prognostic image. In the left top side of each image description done by DMD system. (C) The detailed view of prognostic image. In the left top side of each image description done by DMD system. (D) From left to right: CBV, CBF and Prognostic image.

Acknowledgments. This work has been supported by the Ministry of Science and Higher Education, Republic of Poland, under project number N N516 511939.

Appendix: 3D discrete gradient operators

Intermediate difference operator: