Vassilios Vassilakis
email: vasileios.vasilakis@uwl.ac.uk

Ioannis P Chochliouros

Anastasia S Spiliopoulou

Evangelos Sfakianakis

Maria Belesioti

Nikolaos Bompetsis
email: nbompetsis@oteresearch.gr3aspiliopoul@ote.gr

Mick Wilson
email: mick.wilson@uk.fujitsu.com

Charles Turyagyenda
email: charles.turyagyenda@uk.fujitsu.com

Athanassios Dardamanis
email: adardamanis@smartnet.gr

Security Analysis of Mobile Edge Computing in Virtualized Small Cell Networks

Keywords: 5G, Mobile Edge Computing (MEC), Network Functions Virtualization (NFV), security, Software Defined Networking (SDN), Small Cell (SC), virtual network function (VNF)

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

In the recent years we are witnessing a widespread use of end user devices with advanced capabilities, such as smart-phones and tablet computers, and the emergence of new services and communication technologies. Modern devices implicate for powerful multimedia capabilities and they are increasingly penetrating the global ecommunications market, thus creating new demands on broadband (wireless or mobile) access. The challenge becomes greater as devices are also expected to actively communicate with a multiplicity of equipment (such as sensors, smart meters, actuators, etc.) within a fully converged framework of heterogeneous (underlying) network infrastructure(s). This results to the emergence of new data services and/or related applications that can drastically "reshape" the network usage and all associated demands; these are also "key success factors" in order to realize an effective mobile broadband experience for the benefit of our modern societies and economies. This new evolved ecosystem, however, imposes very strict requirements on the network architecture and its functionality. Enabling low end-to-end (E2E) latency and supporting a large number of connections at the fitting level, is not possible to be accomplished in current Long-Term Evolution (LTE) networks. In fact, the fundamental limitations of current approaches lie in their centralized mobility management and data forwarding, as well as in insufficient support for multiple coexisting Radio Access Technologies (RATs) [START_REF] Demestichas | 5G on the Horizon: Key Challenges for the Radio-Access Network[END_REF] and for suitable adaptability to new architectural schemes. Today, a large variety of RATs and heterogeneous wireless networks have been successfully deployed and used. However, under the current architectural framework, it is not easy to integrate -or to "enable"a way of a suitable coordination of these technologies. Despite the fact that the coverage of such wireless and cellular networks has increased by deploying more Base Stations (BSs) and Access Points (APs), the Quality-of-Experience (QoE) of End-Users (EUs) does not increase, accordingly. For example, the current architectural approach does not enable a Mobile User (MU) selecting the "best available network" in a dynamic and efficient way. It also does not enable simultaneous and coordinated use of radio resources, from different RATs. This leads to highly inefficient use of hardware resources (wireless infrastructure) and spectrum, which is worsened even more with almost uncontrollable inter-RAT interference [START_REF] Andrews | Seven Ways that HetNets are a Cellular Paradigm Shift[END_REF]. In this paper, we build a novel architecture, proposed for next-generation cellular networks. This architecture benefits from the recent advances in Software Defined Networking (SDN) [START_REF] Nunes | A Survey of Software-Defined Networking: Past, Present, and Future of Programmable Networks[END_REF] and Network Function Virtualization (NFV) [START_REF] Mosharaf | A Survey of Network Virtualization[END_REF], which are natively integrated into the new and novel architecture. Traditionally, SDN and NFV although not dependent on each other, are seen as "closely related" and as "complementary" concepts [START_REF] Haleplidis | Towards a Network Abstraction Model for SDN[END_REF]. This integration enables good scalability in terms of supporting a large number of connections as well as heavy mobility scenarios. Also, the introduction of new services and applications becomes much easier. Decoupling control and data planes, and abstracting network functions from the underlying physical infrastructure, brings much greater flexibility to efficiently utilize radio and computing resources both in the Radio Access Network (RAN) [START_REF] Shrivastava | An SDN-based Framework for Elastic Resource Sharing in Integrated FDD/TDD LTE-A HetNets[END_REF] as well as in the Mobile Core Network (MCN). Furthermore, the new approach enables the incorporation of Mobile Edge Computing (MEC) services in an easy and straightforward way. MEC, also known as "Fog computing", is a novel concept that extends the services, typically provided by the Cloud, to the network edge [START_REF]): Mobile-Edge Computing, Introductory Technical White Paper[END_REF], [START_REF] Vaquero | Finding your Way in the Fog: Towards a Comprehensive Definition of Fog Computing[END_REF]. In case of 5G wireless networks, by the term "edge" we usually mean the RAN and some part of the Cloud services is provided by cognitive BSs. The provided services may include storage, computing, data, and application services. The available MEC infrastructure allows applications to run closer to the end user. This is expected to reduce the E2E network latency and to reduce the backhaul capacity requirements. Moreover, it enables better QoE of fast moving EUs, facilitates highly-interactive real-time applications, and even the emergence of novel applications, such as the Tactile Internet [START_REF] Fetweiss | The Tactile Internet: Applications and Challenges[END_REF]. In this work, we focus on Small Cell (SC) BSs, which include both physical BSs as well as BSs that are virtualized via NFV and SDN technologies. Our architectural assumptions are based upon the SESAME architecture, which derives from an ongoing European 5G-PPP funded research project that aims at providing enhanced multi-tenant MEC services though Small Cells coordination and virtualization [START_REF] Sesame H | 5G-PPP Project[END_REF]. However, our analysis can be easily extended to alternative network architectures and even in the cases of Macro-Cells or combinations of Macro-and Small-Cells. Thus, in the present work we perform analysis of MEC when the latter is applied upon a selective and realistic 5G scenario, enabling large multitenant enterprise services, from the security and privacy viewpoint.

Previous Relevant Works

In this section we review the most important and recent works on security and privacy for MEC. The fact that MEC is still at its infancy explains the very limited number of relevant works. These works mainly just touch the security and privacy implications of MEC and no adequate solutions have been proposed to address all the challenges, especially when considering the interaction of MEC with other technologies, such as SDN, and NFV, within the 5G networks context. In [START_REF] Lee | On Security and Privacy Issues of Fog Computing supported Internet of Things Environment[END_REF], a number of security and privacy challenges of MEC have been discussed. The considered security threats are mainly in the context of a cloud-enabled IoT (Internet of Things) environment. The study makes a classification of the available security technologies according to the involved network elements, such as technologies to secure a fog node (i.e., the MEC server) and an IoT node, as well as techniques to protect the communication. Next, two threats on the existing security mechanisms have been described, namely the man-in-the-middle (MitM) attack and malicious fog node problem. Finally, a number of high-level suggestions have been proposed to address the security concerns, such as intrusion detection; malicious node detection; data protection; and secure data management. In [START_REF] Stojmenovic | An Overview of Fog Computing and its Security Issues[END_REF], the security issues of MEC have been discussed in the context of smart grids, smart traffic lights, wireless sensor networks, and SDN. The focus of this study is the MitM attack and, in particular, the stealthy features of this attack that could be addressed by examining the Customer Premises Unit (CPU) and memory consumption of the fog node. This also addresses the assessment of authentication and authorization techniques for connecting the fog with the cloud. The applicability of existing techniques, such as signature-and anomaly-based intrusion detection has been studied.

In [START_REF] Wang | Fog Computing: Issues and Challenges[END_REF], the challenges of MEC with respect to digital forensics have been discussed. This work mainly considers sensors and various types of smart objects that require connectivity to the cloud and to each other. The focus of this work is to study processes and events that would allow reconstructing past activity for providing digital evidence. Various existing solutions, such as Virtual Machine (VM) introspection and Trusted Platform Module (TPM), have been discussed and analysed. This paper also makes a distinction between the techniques that can be applied in both fog and cloud, and between those that are only applicable in one of them. In [START_REF] Stolfo | Fog Computing: Mitigating insider Data Theft attacks in the Cloud[END_REF], the existing data protection techniques have been studied with respect to their suitability in MEC. The conferred data theft attacks include both external intrusion as well as insider attacks. The paper has proposed a novel approach for data protection, using offensive decoy technology. According to this approach, the data access is initially monitored to detect any abnormal access patterns. Next, when unauthorized access in suspected, large amounts of decoy information is returned to the attacker. Experiments in realistic scenarios indicate that such kind of approach could provide sufficient levels of data protection in MEC environments. In [START_REF] Lopez | Edge-centric Computing: Vision and Challenges[END_REF], a number of research and security challenges towards realization of MEC have been identified and analysed. One important conclusion drawn is that the MEC paradigm would need to develop security and privacy solutions to explicitly consider coexistence of trusted nodes with malicious ones in distributed edge settings. This will require the enforcement of secure and redundant routing, and trust topologies. Another implication of shifting the computation from the cloud to the edge is that the concentration of information is prevented in comparison to the centralised cloud computing approach. Hence, novel techniques are required to deal with fragmented information that is distributed over a potentially large/heterogeneous set of edge nodes. We observe that the existing works on security analysis of MEC mainly consider M2M-like scenarios while lacking of a formal methodological analysis approach and/or of security/privacy study in MEC, related to other coexisting technologies. In this work, we are trying to "fill" this gap.

SESAME-based Essential Architecture

In this section, we describe the cellular network architecture developed in the context of the SESAME project [START_REF] Mosharaf | A Survey of Network Virtualization[END_REF]. In the following, this architecture is referred to as the "SESAME architecture". One of its key elements is the incorporation of MEC concepts at the RAN level, i.e. by enhancing the BSs with MEC servers. Other important characteristic of the architecture is the support of multi-tenancy feature through cellular infrastructure virtualization and NFV. Below we describe the involved actors and their inter-relations (as schematic representation is also given in Fig. 1); afterwards, we describe the functional architecture and its essential elements.

We distinguish the following essential definitions: (i) End User (EU): It can be a mobile device (such as a smart-phone or a laptop) that consumes communication services via the cellular network; (ii) Infrastructure Owner (IO): This is the owner of the cellular infrastructure, such as SCs and macro BS. An IO could be, for example, a Venue Owner (VO) (such as mall, stadium, enterprise or municipality) or the traditional network operator; (iii) IT Equipment Vendor (ITEV): It is a legal entity/company that develops, manufactures, and/or sells IT equipment, such as BSs and servers; (iv) Small Cell Network Operator (SCNO): It is a legal entity/company that possesses the equipment so as to provide radio communications services and provides radio access to end users locally, by using SCs; (v) Virtual Small Cell Network Operator (VSCNO): It is a legal entity/company that does not possess the equipment but lease it from another one, so as to provide radio communications services and deliver services to EUs; (vi) Macro-Cell Network Operator (MCNO): It is a legal entity/company that possesses the equipment so as to provide radio communications services and provides radio access to EUs in wide areas at the macro cell level; (vii) Backhaul Provider (BP): A legal entity/company that provides the backhaul connection (either wired or wireless) of the Small Cells and Macro Cells. This could be an Internet Service Provider (ISP) or the traditional Mobile Network Operator (MNO); (viii) Service Provider (SP): This is a legal entity that produces, controls and distributes services over the MNO/VMNO. (This could include, for example, the traditional Over-the-Top (OTT) players); (ix) Virtual Function Provider (VFP): This is a legal entity/company that supplies virtual network functions and other appliances, such as gateways, proxies, firewalls and transcoders. In this way, the need for the customer to acquire, install, and maintain specialised hardware is essentially eliminated, and; (x) Spectrum Owner (SO): This is a legal entity/company that owes a particular piece of spectrum in a given geographical area. Nowadays, the SO is essentially the MNO who leases the spectrum from the relevant national authority. However, it is envisioned that in the future an independent player may owe the spectrum and lease it to an operator (such as MCNO, SCNO, VSCNO).

Fig. 1. Actors and their relationships

As shown in Fig. 1, the EU is dependent on the SP for receiving one or more services (such as the video streaming service). To provide that, the SP depends on the SCNO or the VSCNO who provide the SC connectivity, and also on the VFP who provides the required (virtual) network functions. Both, SCNO and VSCNO are dependent on the IO who owes the SC infrastructure. Finally, the VSCNO is also dependent on the BP (e.g., an ISP) who provides backhaul connectivity as well as on the MCNO who provides the macro-cell connectivity. We describe, in brief, the SESAME functional architecture, which is also illustrated in Fig. 2. Firstly, we provide the basic component definitions and afterwards we describe "how these components interact with each other". In fact, we identify the following fundamental components: (i) MEC server: It is specialised hardware that is placed inside the SC and provides processing power, memory and storage capabilities, and networking The CESC Manager also manages the radio access and "self-x" functionalities, e.g., self-optimising, self-healing and self-configuring of the Small Cells contained in each CESC cluster, in order to guarantee the service continuity and the required performance of services.

The CESCM orchestrates services and, consequently, manages the VIM to compose them with virtual resources. A CESCM is actually a functionality that will be "mapped" on to the distributed physical elements. As mentioned before, one important feature of this architecture is the distributed set of MEC servers which can logically "be grouped into clusters", thus effectively forming a Light DC at the network edge. Clusters are able to communicate with each other as well as with the mobile core network (i.e., Evolved Packet Core (EPC) in the LTE terminology). The distributed deployment of MEC servers facilitates flexible and dynamic allocation of resources in cases of flash crowd events and fast EU mobility.

Fig. 2. SESAME functional architecture

Network and system security is a very critical issue because the SESAME system is expected to support both customer enterprises and end users, who cannot tolerate financial losses or data privacy violations and, therefore, they seek the highest possible security guarantees. In the present section, the considered SESAME scenario and functional components are evaluated by using a formal methodology known as the Secure Tropos (SecTro) [START_REF] Mouratidis | Secure Tropos: A Security-Oriented Extension of the Tropos Methodology[END_REF]. Our goal is to identify, model and analyse security issues from the early stages of system design and software development as well as to model and analyse threats and vulnerabilities in existing software and protocols that will be used in the SESAME system. We aim at preventing a wide range of attacks, such as control hijacking, reverse engineering, malware injection, eavesdropping, just to name a few. At the same time, the SESAME concepts can provide invaluable opportunities of developing solutions for attack prevention, management & recovery.

Initially, the physical security of CESC infrastructure and hardware integrity has to be ensured. Hence, appropriate security controls (such as in [START_REF] Skorobogatov | Physical Attacks and Tamper Resistance[END_REF]) should be deployed by the CESC infrastructure owner, to prevent hardware tampering. Likewise, it is important to consider attacks that are initiated from the cloud side. This is particularly relevant in scenarios where multiple enterprises using private clouds are hosted. Especially in the multi-tenant environment of SESAME, the adversary per se could be a legitimate tenant interacting with network entities by using valid credentials and having privileged access to virtualised resources. Also, the emerging Bring Your Own Device (BYOD) trend [START_REF] Buetnner | Towards a New Personal Information Technology Acceptance Model: Conceptualization and Empirical Evidence from a Bring Your Own Device Datataset[END_REF] in many enterprises constitutes many conventional security solutions incapable of protecting the private network; for example, a Trojan horse, that infected an employee's device, can bypass the security of the corporate firewall. Hence, the cloud provider must ensure the physical security of the cloud infrastructure and of the data centres. This can be done, e.g., by following the recommendations from the Cloud Security Alliance [START_REF](CSA): Security Guidance for Critical Areas of Focus in Cloud Computing v2[END_REF]. Moreover, the selection of suitable cloud provider can be based on formal methodologies to ensure that the security and privacy requirements are properly met [START_REF] Mouratidis | A Framework to Support Selection of Cloud Providers based on Security and Privacy Requirements[END_REF]. This effectively means that services offered by cloud providers who do not meet the specified requirements and have not implemented the mandatory security controls, could so be restricted or even could be blocked. To ensure confidentiality and integrity of the User Equipment (UE) data, cryptographic security controls must be in place. This implicates that any adopted Public-Key scheme that enables the encryption of the communications among CESC, UE and the cloud, must be sufficiently secure. Cryptographic and privacy protection techniques are particularly important in cases where an EU receives service from multiple service or network providers, due to mobility or QoE considerations.

An important category of attacks could potentially "target" the management system (for example, if initiated inside virtualised environments and aims at taking control of the Hypervisor shown in Fig. 2). Also, the NFV Orchestrator is an attractive "attack target" due to being in the "middle" of the system model architecture; the same can be for other components of the management layer, such as the VNF Manager. Also, impersonation by the adversary of one of the VNFs or the MEC server when communicating with the management layer could be a potential threat. Considering again the virtualised environment, both host and guest Operating Systems (OSs) may be targeted, and to alleviate the impact of such an attack, adequate isolation must be enforced between guest VMs, as well as between the host and guest VMs. The adversary could attempt to break the isolation by exploiting, e.g., some flaws of the used virtualisation platform [START_REF] Stojmenovic | An Overview of Fog Computing and its Security Issues[END_REF]. Therefore, appropriate choice of the virtualisation platform that meets security and privacy requirements is of major importance.

In some cases, to launch an attack against a component, the adversary requires that this component has specific exploitable configuration or runs specific software. For example, a precondition for a Denial-of-Service (DoS) attack can be specific configuration of the CESCM with regard to the allocation of resources to tenants. Yet, some flaws in the resource allocation algorithm can allow the adversary to prevent a tenant from accessing its portion of virtual resources. The introduction of the MEC paradigm has also implications on the E2E security in 5G networks. A potential solution to deal with this problem is to facilitate the network slicing concept, according to which each application or network flow "gets" its own slide of the network. This allows the end-to-end security to be enforced within each slice by each application individually and any security breaches would not affect other applications. As security will be a fundamental enabling factor of future 5G networks, we are concerned with identifying and mitigating security threats and vulnerabilities against a broad range of targets at the intersection of MEC with "Small Cells-as a-Service" (SCaaS), SDN, and NFV. These can have crucial effect on legal and regulatory frameworks as well as on decisions of businesses, governments and end-users.

Scenario: Enabling Large Multi-Tenant Enterprise Services by using MEC

To further emphasize, we consider an SCNO who is providing a radio interface to a number of distinct mobile operators, virtual mobile network operators (VMNOs) and VSCNOs. The SCNO may transmit by using licensed or unlicensed spectrum over the air interface. In addition to the provision of radio coverage in the business centre and orchestration of multi-tenancy, the SCNO offers a platform for MEC for low latency and compute intensive applications/services. The MOs, VMNOs and VSCNOs provide both in-house and third party services from OTT players or the SPs. The offered services can include inter-alia: multi-person real-time video-conferencing, virtual presence 360° video communications with meetings using virtual presence glasses/devices, and assisted reality to actively inform users of ambient interests such as danger warnings to support people with disabilities and improve interactions with their surroundings. The EUs can benefit from fast and cost-effective access to a wide variety of innovative services from third party players. MOs, VMNOs and VSCNOs can benefit from extra market share. VOs can benefit from having a single set of radio and IT equipment installed on the premises, instead of multiple installations from multiple network operators. The CESC is made up of: hardware resources, virtualisation layer, VNFs, and an Element Management System (EMS). The virtualisation layer abstracts the hardware resources and decouples the VNF software from the underlying hardware. A VNF is a virtualisation of a network function in a legacy non-virtualised network. The EMS performs management of one or more VNFs. A cluster of CESCs is managed by the CESCM that constitutes of: VIM, VNF manager and the network functions virtualisation orchestrator (NFVO). The VIM manages the interaction of a VNF with the compute, storage and network resources under its specific authority. The VNF manager is responsible for VNF lifecycle management. The orchestrator is in charge of orchestration, of management NFV infrastructure and software resources and of realising network services. In Fig. 3 we demonstrate how this scenario can be supported by the specific SESAME system. In particular, we see a CESC infrastructure provider who owns, deploys and maintains the network of CESCs inside the premises where different enterprises are hosted. The CESC provider has a Service Level Agreement (SLA) with each customer enterprise and SLAs are to enable enterprise users to a number of services offered by the CESC network; the SLA shall cover the target performance metrics for any service (or service category) required by each enterprise, supporting different tenants' requirements. Such sort of services can be categorised in data services and real-time services: these can include, inter-alia, Internet access for enterprise users, web browsing, file sharing, electronic mail service, voice communications and video conferencing. The deployment of MEC servers with high processing capabilities can enable close-to-zero latency and enhanced QoE of the enterprise users (i.e., an enhanced handling of the media flows and, consequently, an optimal QoE). In addition to the computing resources, MEC servers can provide storage resources and support content caching at the network edge. The reality is that different hosted enterprises may have different traffic patterns which may fluctuate greatly, depending on the time of the day or on special occasions, such as popular events. This leads to the requirement of a "flexible" system which can be scaled up and down, on demand. For example, most enterprises may need a higher capacity and higher quality of service (QoS) during the office hours, while a security firm providing security to the building would need a low capacity and the same service quality throughout the day. The main issues may arise from possible service disruptions and from the dynamicity of the enterprise activity. The service quality levels can be dynamic (time variant) as well. In some instants, the total capacity and the number of connected devices for a certain enterprise could rise significantly. This can be an event like an Annual General Meeting or a conference/exhibition organised by the enterprise. This extra capacity / connections may not need the same QoS and may not access the internal enterprise data, so may not need the same level of security. The main requirements are for the available capacity to be rapidly scaled up and other virtual network(s) created mainly for open access. Also in some cases, certain enterprises may downsize their operations or move out of the premise, which requires scaling down. This kind of scalability and flexibility needs to be incorporated into the design of particular use cases for this representative scenario. The enterprise scenario shown in Fig. 3 will leverage on SESAME features such as intrinsic support of multi-tenancy by enabling multiple SC operators since Small Cells operators to provide network services and connectivity over the network owned by a single CESC infrastructure provider. Furthermore, the SESAME system allows native incorporation of self-organizing network techniques, which can be adapted to network behaviour and can optimize service delivery to the enterprise users. In any case, the high level of network security as demanded by the enterprise customers will be an inherent feature of the respective SESAME solutions. We present the actors involved in the scenario, their corresponding goals as well as their dependencies. We identify four major actors involved in the scenario, namely CESC infrastructure provider, Virtual SCNO, ISP and enterprise. The enterprise depends on the SC operator which provides the wireless connectivity. The SC operator requires backhaul connectivity and access to external networks, such as Internet. This can be provided by an ISP. Finally, the SC operator aiming to provide its services to multiple enterprises depends on the CESC infrastructure which is owned and maintained by the CESC provider.

Fig. 4. Security components view for the CESC provider

In Figs. 4 and5 we present the Security Components View for two main actors of this scenario: the CESC provider and the virtual SCNO. The security component view of the CESC provider, depicted in Fig. 4, contains two "resources" that need to be protected: the Hypervisor and the Tenant's Data. A resource in the Secure Tropos terminology could be a physical or an informational entity, and in the SecTro tool is depicted as a yellow, rectangular box. A resource is required to achieve a specific "goal" of an actor (the CESC provider in this example). A goal represents an actor's strategic interests. In this example, we consider two primary goals (depicted as green ovals): operating the CESC infrastructure and enabling multi-tenancy. Both these goals require the Hypervisor as a primary resource. Also, to enable multi-tenancy, the Tenant's Data resource has to be created. A goal could be restricted by a "security constraint" (depicted as a red octagon). In this example, the CESC infrastructure operation is restricted by the requirement to protect the control plane, whereas the multi-tenancy goal is restricted by the requirement to prevent unauthorized access to another tenant's VM. Various security constraints must satisfy a number of "security objectives" (depicted as blue hexagons). In this example, the security constraints are satisfied by the two objectives: Protect the Control Plane and Prevent Access to another Tenant's VM. These objectives are implemented by using a number of "security mechanisms" (green hexagons), such as VM isolation, Data Encryption, and Server Replication. We also consider a number of "threats" (depicted as pentagons) that impact some of the resources. In this example, the Hypervisor can be impacted by the two threats: Control Hijacking and Denial of Service. The Tenant's Data resource can be impacted by the Eavesdropping threat. The security component view of the Virtual SCNO, depicted in Fig. 5, contains three resources that need to be protected: the Radio Resources, the Radio Spectrum and the EMS. In this example, the actor's primary goals (that require the above resources) are to provide wireless capacity and spectrum to the tenants. The corresponding security constraints that restrict these goals are to protect the management plane, to prevent unauthorized access to the wireless spectrum and to protect user data. These constraints must be satisfied by two security objectives: Ensure service availability and ensure data confidentiality. The corresponding security mechanisms to implement these objectives are using firewalls and access control mechanisms. Finally, a number of threats could impact the considered resources, such as DoS, control hijacking and radio jamming attacks.

  resources; (ii) Cloud Enabled Small Cell (CESC): This is the SC device which has been enriched with a MEC server; (iii) CESC cluster: A group of CESCs that are collocated, able to exchange information and properly coordinated; as a trivial case, a CESC cluster could comprise one CESC; (iv) Light Data Center (Light DC): It is a cluster of MEC servers. In particular, the Light DC is a logical entity consisting of a set of distributed MEC servers of the same CESC cluster; (v) Virtual Infrastructure Manager (VIM): This is an entity responsible for management of the virtual hardware (i.e., VMs) and networking resources of a single Light DC; in particular, the VIM manages the lifecycle, provision, placement, and operation of VMs. The VIM is also responsible for the allocation of Virtual Network Functions (VNFs) over the hardware it manages and offers functionalities to control virtual networks across VNF instances and associate storage to them. The VIM offers an aggregated view of compute, network and storage resources of the Light DC; (vi) CESC Manager (CESCM): The architectural component in charge of managing and orchestrating the cloud environment of the Light DC; it can simultaneously manage multiple clusters, a cluster or a single CESC.

Fig. 3 .

 3 Fig. 3. Scenario: Enterprise services in multi-tenant large businesses

Fig. 5 .

 5 Fig. 5. Security components view for the virtual SC network operator (SCNO)

Acknowledgments. This work has been performed in the scope of the SESAME European Research Project and has been supported by the Commission of the European Communities (5G-PPP/H2020, Grant Agreement No.671596).


Vasileios Athanasiou

Manolis Maragoudakis

Dealing With High Dimensional Sentiment Data Using Gradient Boosting Machines

Keywords: Gradient Boosting Machines, Sentiment Analysis, High-dimensional data, Modern Greek

One of the most common classification tasks that applies on textual information is sentiment analysis, i.e. the prediction of the sentiment of a given document. With the vast use of social media and internet applications such as e-commerce, e-tourism and e-government, numerous comments and opinions are broadcasted per day, thus an automatic way of analyzing them is of great importance. The present paper focuses on sentiment analysis for Greek texts, obtained from Web 2.0 platforms. Greek is a language that lacks an in-depth availability of natural language processing tools in the sense that most of them are not publicly available. The novelty of the article is that instead of utilizing preprocessing tools such as Part-of-Speech taggers, text stemmers and polarword lexica, it incorporates the translation of the Greek token as provided by the Google Translator® API. Since automatic translation of Greek sentences often results in poor translations where the meaning of the original sentence is severely deteriorated, the translation of each token individually is almost 100% correct. However, taking the translation of every Greek token poses a significant issue to the outcome of the classification process for practically any classifier, therefore, we introduce the use of a powerful ensemble algorithm that is highly customizable to the particular needs of the application, such as being learned with respect to different loss functions and thus dealing with a large number of dimensions. This algorithm is called Gradient Boosting Machines and experimental results support our claim that it surpasses other, well-known machine learning techniques with a significant improvement for our task.

Introduction

Throughout recent years, we have witnessed a remarkable rise of the Internet and the World Wide Web that has altered the way they communicate, seek for relevant information, and work on the most fundamental level. The arrival of Web 2.0 technologies has resulted in a vast popularity and ubiquity of web resources built around the ideas of social media and user-generated content (e.g., Facebook, Twitter, and LinkedIn). In the beginning such concepts were part of more traditional web resources such as online retailers (e.g., Amazon) or electronic media, in order to having their products or articles enhanced with the users' opinions. Therefore, the task of relevant information from the vast amounts of human communication information over the Internet is of utmost importance for robust sentiment analysis modules. In fact, the origin of opinionated data has caused the development of Web Opinion Mining (WOM) [START_REF] Taylor | Web Opinion Mining and Sentimental Analysis[END_REF],

as a new concept in Web Intelligence. WOM deals with the issue of extracting, analyzing and aggregating web data about opinions. The analysis of users' opinions is significant because through them it is possible to determine how people feel about a product or service and know how it was received by the market. In general, traditional sentiment analysis mining techniques apply to social media content as well, however, there are certain factors that make Web 2.0 data more complicated and difficult to be parsed. An interesting study about the identification of such factors was made by Maynard et al., [START_REF] Maynard | Challenges in developing opinion mining tools for social media[END_REF], in which they exposed important features that pose certain difficulties to traditional approaches when dealing with social media streams. Modern Greek language is posing additional obstacles to sentiment analysis since the majority of preprocessing tools for Greek such as POS tagger, stemmer and polarity lexica are not freely available.

In the present paper, we deal with modeling a sentiment analyzer for Modern Greek based on a simple, yet novel idea. We bypass the need for extensive preprocessing tools and utilize a freely available translation API that is provided by Google®, in order to augment the feature set of the training data. However, since automatic translation of sentences often suffer from poor performance, mainly due to the large degree of ambiguity, we decided to translate each Greek token individually, a process that rarely makes mistakes. The resulted feature set was of course double the original size which also poses certain difficulties to the majority of classification algorithms. Hence, we experimented with an ensemble classification algorithm named as Gradient Boosting Machines (GBM) which is theoretically proven of being able to cope with large number of features [START_REF] Natekin1 | Gradient boosting machines, a tutorial[END_REF]. According to the referenced study, "a possible explanation why boosting performs well in the presence of high-dimensional data is that it does variable selection (assuming the base learner does variable selection) and it assigns variable amount of degrees of freedom to the selected predictor variables or terms". We experimented with numerous wellknown algorithms using the initial Greek-only feature set as well as the enhanced translated one and also some basic feature reduction techniques such as Principal Component Analysis [START_REF] Shlens | A tutorial on principal component analysis, derivation, discussion and singular value decomposition[END_REF] and found that GBM are superior to any other implementation.

Related Work

The nature as well as the popularity of feedback-oriented content in domains such as news, social events, services and products is something of a duty to the human urge to post what they feel and think online. As soon as the most common type of message on Twitter is about 'me now' [START_REF] Naaman | Is it really about me?: Message content in social awareness streams[END_REF], it is evident that users talk often about their own feelings and opinions. Bollen et al., [START_REF] Bollen | Modeling public mood and emotion: Twitter sentiment and socio-economic phenomena[END_REF] stated that users express both their own mood in tweets about themselves and more generally in messages about other subjects. Another study [START_REF] Jansen | Twitter power: Tweets as electronic word of mouth[END_REF] estimates that approximately 19% of microblog messages mention a brand name and from those that do, around 20% contain sentiment.

There are numerous challenges in applying typical sentiment analysis and opinion mining techniques to social media. Short texts in social media, known as micro-posts, are, perhaps, the most challenging text type for opinion mining, given the fact that they do not contain much contextual information and take much implicit knowledge into account. Ambiguity is a common phenomenon since one cannot easily make use of co-reference information: unlike the situations of blog posts and comments, tweets do not typically follow a conversation thread, and appear much more in isolation from other tweets. They also contain much more language variation, tend to be less structured than longer posts, contain unorthodox forms of writing such as emoticons, abbreviations and hashtags, which can form an important part of the meaning. Typically, they contain extensive use of irony and sarcasm, which are particularly difficult for a machine to identify. On the contrary, their shortness can also be beneficial in focusing the topics more explicitly: it is very uncommon for a single tweet to be related to more than one topic, which can therefore contribute in disambiguation.

The research of [START_REF] Pang | Opinion mining and sentiment analysis[END_REF] presents a wide-ranging and detailed review of traditional automatic sentiment detection techniques, including many sub-components, which we shall not repeat here. In general, sentiment detection techniques can be roughly divided into lexicon-based methods (e.g. [START_REF] Taboada | Lexicon-based methods for sentiment analysis[END_REF]) and machine learning methods, e.g. [START_REF] Boiy | A machine learning approach to sentiment analysis in multilingual web texts[END_REF]. Lexicon-based methods rely on a sentiment lexicon, a collection of known and pre-compiled sentiment terms. Machine learning approaches make use of shallow syntactic and/or linguistic features [START_REF] Go | Twitter sentiment classification using distant supervision[END_REF][START_REF] Pak | Twitter Based System: Using Twitter for Disambiguating Sentiment Ambiguous Adjectives[END_REF], and hybrid approaches are also very common, with sentiment lexicons playing a key role in the majority of methods, e.g. [START_REF] Zhang | Combining Lexicon-based and Learning-based Methods for Twitter Sentiment Analysis[END_REF]. Decision Trees, Naïve Bayes and SVM (Support Vector Machine) have been applied from the supervised side [START_REF] Zhang | Combining Lexicon-based and Learning-based Methods for Twitter Sentiment Analysis[END_REF][START_REF] Bengio | Learning deep architectures for AI[END_REF]. On the unsupervised side there is a pattern-logic classification according to a lexicon. Combination of the above can characterized as semi-supervised [START_REF] Zhang | Combining Lexicon-based and Learning-based Methods for Twitter Sentiment Analysis[END_REF]. In "On Mining Opinions From Social Media" [START_REF] Politopoulou | On Mining Opinions from Social Media, Communications in Computer and Information Science, Engineering Applications of Neural Networks[END_REF] the authors confirm that Naïve Bayes outperforms a large number of other methods.

Techniques that work based on rules normally use sentiment dictionaries plus rules. [START_REF] Maynard | Automatic Detection of Political Opinions in Tweets[END_REF] 3

Gradient Boosting Machines

Generally, the boosting methods work by adding sequentially new models and in every iteration every weak base-learner is re-trained [START_REF] Natekin1 | Gradient boosting machines, a tutorial[END_REF]. The target is to reduce the total error of the model. The GBM works by constructing new baselearners which are correlated with the negative gradient of the loss function.

The loss function can be set from the user (Gaussian L2 loss function, Binomial etc.), this is the main reason that GBM is highly customizable. Suppose there is a dataset (𝑥, 𝑦) 𝑖=1 𝑁 where 𝑥 = (𝑥 1 , 𝑥 2 . . . 𝑥 𝑑 ) are the input variables and y the corresponding labels. The relation between x and y is unknown, this means it is needed to reconstruct this relation in a way to minimize a loss function.

𝑓 ̂(𝑥) = 𝑦 , 𝑓 ̂(𝑥) = 𝑎𝑟𝑔 𝑚𝑖𝑛 𝑓(𝑥) 𝛹(𝑦, 𝑓(𝑥))

Where 𝑓(𝑥) indicates the dependence between x, y, 𝑓 ̂(𝑥) is the estimation function and 𝛹(𝑦, 𝑓(𝑥)) is the loss function. The same problem expressed in terms of expectations concludes to

𝑓 ̂(𝑥) = 𝑎𝑟𝑔 𝑚𝑖𝑛 𝑓(𝑥)

𝑒𝑥𝑝𝑒𝑐𝑡𝑒𝑑 𝑙𝑜𝑠𝑠 𝐸 𝑥 [𝐸 𝑦 (𝛹[𝑦, 𝑓(𝑥])|𝑥] 𝑒𝑥𝑝𝑒𝑐𝑡𝑎𝑡𝑖𝑜𝑛 𝑜𝑣𝑒𝑟 𝑡ℎ𝑒 𝑤ℎ𝑜𝑙𝑒 𝑑𝑎𝑡𝑎𝑠𝑒𝑡

where 𝐸 𝑦 (𝛹[𝑦, 𝑓(𝑥]) is the response variable depended from x. Significant notation is that y can became from not only one distribution provides the ability for more loss functions Ψ.

In machine learning, there are cases that the data set produce a vector with very high dimensionality, for example in sentiment analysis. That means the rows of the document term matrix have very low density because the appearance of the words in every observation is very rare. GBM can to overcome this difficulty because is able to create sparse models, additionally can work with different types of base learners. The ability of use different loss functions combining the ability to use different type of learners provides great regularization capabilities. This has impact to avoid overfitting and achieve generalization to our model. Apart from the above advantages GBM algorithm has drawbacks such as memory consumption and evaluation speed. The first one has impact to the other. GBM works by doing iterations which stored in memory, easily in hard cases for the algorithm like intrusion detection systems the number if iteration can be tens of thousands. This problem appears to all ensemble algorithms.

4

Experimental Setup and Results

Data Collection

The corpus of data retrieved from online newspaper articles. The types of articles came from financial domain, political, society and sports in plain text type and Greek language. All articles have been selected under the condition to be able classified as positive or negative only. The corpus is balanced and two datasets have been derived from it. The first consists from the articles as gathered in Greek language (Single Dataset), the second one from the article in Greeks plus the translation in English (Mixed Dataset).

Data Preprocessing

The data included URLs, which have been automatically removed using an HTML tag identifier. As mentioned before, due to lack of availability of Greek preprocessing tools, only some base linguistic tools have been incorporated. The preprocessing phase consists of the following steps:

 Tokenization: To extract only the words, all stop-words have been removed, all letters lowercased.  Translation of each Greek token using the Google® Translation API.  Creation of a document-term matrix that contains n rows, where n equals the number of comments (n was 520 for our case, having 180 positive and 340 negative ones) and m rows where m corresponds to the size of the Greek vocabulary, almost double when applied the translation, since some tokens shared the same translation. In each cell of the document-term table, the value of the tf-idf weight of each term is contained, given by the following formula:

𝑡𝑓 -𝑖𝑑𝑓(𝑡𝑒𝑟𝑚) = 𝑓𝑟𝑒𝑞𝑢𝑒𝑛𝑐𝑦(𝑡𝑒𝑟𝑚) • 𝑙𝑜𝑔 ( 𝑚 𝑁(𝑡𝑒𝑟𝑚) + 1)
, where m is the total number of terms in the collection and N (term) is a function that returns the number of documents the term appears in.  Dimensionality reduction using the Principal Component Analysis (PCA):

This step applied only in cases we used Naïve Bayes, Decision Trees and Support Vector Machines (SVM) and not in GBM since it could cope with the large number of attributes.

PCA reduces the dimensionality by performing transformation of possibly correlated variables to a fully new dataset with linearly uncorrelated variables, called principal components. Every principal component has variance starting from the first one which has the largest value and this means the item has the biggest impact in dataset comparing the other principal components. All the principal components are the eigenvectors of the covariance matrix, that means are orthogonal.

Evaluation Criteria and Performance

For the experiments have been used three measures accuracy, precision and recall as described below:

Accuracy: , where 𝑇 𝑝 , 𝑇 𝑛 (true positive, true negative) are the correct positive and correct negative predictions respectively and 𝐹 𝑝 , 𝐹 𝑛 (false positive, false negative) are the wrongly positive and wrongly negative predictions respectively. In order to evaluate the performance for every classifier we used the 10-fold cross validation approach. The next figure illustrates the methodology in 3 sub-processes. The first two are preprocess the data. The first one produce the Single dataset. The second one produce the translated dataset, adding the Single dataset with translated dataset produces the Mixed dataset. The third sub-process applies the classifier to the input dataset.

𝑇

Classification Benchmark

In order to examine the performance of the proposed GBM method and evaluate it against other, well-known classifiers that have previously applied in sentiment analysis tasks with success, as explained in the related work section, the following classifiers that have been additionally incorporated: Decision Trees, Naïve Bayes, SVM, Gradient Boosting Machine and Deep Neural Network Learning. In the case of Decision Trees, Naïve Bayes and SVM we have experimented using two different data representation techniques, namely the original tf-idf vector representation of the document-term matrix and the reduced dataset of the PCA transformation using the first 5 principal components.

Experimental Results

As previously explained, we incorporated two different datasets based on the same set of annotated documents. The first set, called as the Single dataset contained only the Greek tokens. The second set, called as the Mixed set, contained both Greek tokens and their translation. Finally each of the aforementioned datasets was also undertaken the PCA data dimensionality technique. When applied PCA on data the performance in accuracy has been decreased more than 35%. In addition when Naïve Bayes tried on the Single dataset the performance was decreased by 5%. For SVM classifier without performing PCA technique on the Mixed dataset the outcome is depicted on Table 3 In both of the cases GBM method slightly takes precedence over Naïve Bayes. In addition GBM algorithm seems to have stable in performance in both cases positives and Negatives on the Recall measure. That means Naïve Bayes in false negatives performed differently. The GBA classifier performs well even in cases we have two languages the Mixed Dataset. The difference is 7%, in case the Naïve Bayes classifier the difference is at the same level 6%.

Conclusions

This work dealt with the issue of performing sentiment analysis on Greek texts, obtained from Web 2.0 platforms using limited NLP resources. The novelty lied on the fact that instead of utilizing a manual polarity lexicon for Greek, which would have inadequate impact on social media linguistic style, we proposed a method that takes the translation of each token as additional input features. Even though this process may seem to bear additional effort and complexity to the majority of classification algorithms, the use of GBM, a robust boosting approach that can cope with high dimensional data appeared to be beneficial for the task at hand, outperforming a family of well-known methods for sentiment analysis. In the future we can try this methodology on imbalanced dataset to see the performance. On this benchmark we can include more classifiers like Recurrent Neural Networks.

Fig. 1 .

 1 Fig. 1. Methodology flowchart

Fig. 2 .

 2 Fig. 2. Performance for GBM, Naïve Bayes and Naïve Bayes with PCA

  𝑝 +𝑇 𝑛 𝑇 𝑝 +𝑇 𝑛 +𝐹 𝑝 +𝐹 𝑛

	, Precision:	𝑇 𝑝 𝑇 𝑝 +𝐹 𝑝	, Recall:	𝑇 𝑝 𝑇 𝑝 +𝐹 𝑛

Table 1 .

 1 For reasons of space, we provide detailed outcomes for the Mixed dataset and discuss what happens when considering the other option. As regards to the Decision Tree classifier without performing PCA technique in the Mixed Dataset the outcome is depicted on Table1. Decision Trees performance on the Mixed Dataset.When applied PCA on data the performance has been decreased by 10%. In addition, when Decision Trees tried on the Single dataset the performance was decreased by 6%. The reason of this is that the Mixed dataset is has more examples thus our model trained better. For Naïve Bayes classifier without performing PCA on the Mixed Dataset the outcome is depicted on Table2.

	Accuracy 60.62%	Positive	Negative
	Precision	42.00%	64.07%
	Recall	17.80%	85.64%
	Accuracy 81.25%	Positive	Negative
	Precision	82.80%	81.94%
	Recall	65.25%	92.08%

Table 2 .

 2 Naïve Bayes performance on the Mixed dataset.

  .

	Accuracy 71.11%	Positive	Negative
	Precision	60.15%	78.84%
	Recall	66.67%	73.76%

Table 3 .

 3 SVM performance on the Mixed datasetWhen applied PCA on data the performance in accuracy has been decreased by 20%. In addition when SVM tried on the Single dataset the performance was decreased by 5%. For the GBM classifier in the Mixed Dataset the outcome is depicted on Table4.

	Accuracy 87.26%	Positive	Negative
	Precision	83.19%	89.66%
	Recall	82.50%	90.10%

Table 4 .

 4 GBM performance on the Mixed datasetIn Single dataset the performance of GBM in accuracy is 7% lower. For Deep Learning classifier in Mixed Dataset the outcome is depicted on Table5.

	Accuracy 74.69%	Positive	Negative
	Precision	62.34%	85.88%
	Recall	80.00%	71.57%

Table 5 .

 5 Deep Learning performance on the Mixed datasetIn Single dataset the performance in accuracy of Deep Learning is 5% lower. above tables shows that GBM classifier has the best accuracy, precision and recall comparing with the all of other classifiers we have used. The unique exception is in Naïve Bayes classifier recall in negatives in which the Naïve Bayes is 1% higher. The comparison of GBM and Naïve Bayes it seems clear in the next diagrams which Illustrates the performance of GBM, Naïve Bayes and Naïve Bayes after preprocessing the corpus with PCA. These diagrams are separated by the performance in Positives on the left and Negatives observations on the right.

	The


A Chytas

K Vaporidi

D Babalis

D Georgopoulos

Senior Member, IEEE, I N Maglaveras

Member, IEEE Chouvarda

Ineffective Efforts in ICU Assisted Ventilation: Feature Extraction and Analysis Platform

Intensive Care Unit (ICU) is a challenging environment, requiring continuous monitoring and treatment adaptations, raising the need for tools and platforms to support medical decisions. In this context, the focus of this work is in supporting clinicians in managing assisted ventilation intervention (AVI). In AVI the need for patient-ventilator coupling exists. Attention may be required in cases when patient's effort doesn't trigger the ventilator at all, and the assisted ventilation event is lost, i.e. when an ineffective effort (IE) event takes place. A high exposure to IEs has been related to adverse clinical outcomes. The purpose of this work is to create new features that complement the already existing IE index in terms of estimating the adverse effects of ventilation exposure. A series of tools varying from raw data handling to the creation of predictive models are created and implemented in a custom platform, utilizing open-source software.

Introduction

In an Intensive Care Unit (ICU) context, patient bio-signals are continuously monitored and displayed towards recognizing alerting events. These recordings of physiologic waveforms along with data coming from laboratory examinations and patient interaction (medications, medical procedures) can be difficult to be interpreted especially in an environment as demanding as the ICU. Thus there is a need for analysing and displaying the data in an easy-to-understand manner. Real-time analysis of patients' biosignals can be used to detect conditions that precede medical complications using both domain expert knowledge and knowledge obtained by automated procedures [START_REF] Blount | Real-Time Analysis for Intensive Care: Development and Deployment of the Artemis Analytic System[END_REF]. The ventilation dy-synchronization is a known issue; a prime example are the incidences of ineffective triggering [START_REF] Georgopoulos | Ineffective efforts during mechanical ventilation: the brain wants, the machine declines[END_REF]. Ineffective triggering, (IT) is common, but factors affecting IT vary considerably and can be contributed to patient condition and factors related to the ventilation system. As a result, the IT frequency of appearances and overall distribution varies as well.

In the medical literature, the total time spent under ineffective effort has been proposed as an index related to adverse clinical events. However, these events are sometimes not equally distributed in time. Ineffective triggering of the ventilator is frequent but highly variable among patients and during the course of mechanical support for each patient. As previously reported [START_REF] Babalis | Incidence of Ineffective Efforts in mechanically ventilated critically ill patients[END_REF], most patients have small (5minute) periods with high intensity of ineffective synchronization, i.e. ineffective efforts (IEs). It is still an open issue whether the cumulative effect of IE exposure during the total time in ventilation or the temporal patterns of IEs relate to patient deterioration.

The AEGLE [START_REF] Soudris | AEGLE: A big bio-data analytics framework for integrated health-care services[END_REF] project was created by the need to provide the tools and the necessary data for physicians and researchers to explore new data and answer research questions. The datasets and tools described in this paper will enable clinicians to explore these new features and gain new insight in the related phenomena. In this work we propose a set of features that describe the morphology of IE event time-series and complement the IE index that might be proved helpful in better describing patients and estimating their hospital prognosis, and a web-based platform that is used to perform the analysis and evaluate the outcomes.

2

The AEGLE project Approach

The design and implementation of the 1 st AEGLE platform prototype is currently underway, parallel to that, analytic tools such as the ones presented in this paper, are also being designed. Having the data providers, domain experts and analytics developers in different sites can be a hindrance in the design of novel analytics, since direct communication and information flow is of outmost importance especially in the early stages.

The solution was to expose directly to the domain experts the in-development analytics via a web-based platform, so that a feedback loop between the involved parties will be created having as a result a more efficient designing phase.

For the purpose of developing the PVI analytics we chose R, an open source and powerful scripting language. For the last few years it has been among the most common used software packages in scholarly articles, and in 2015 it became the 2 nd most used, while also being in fourth position in terms of usage growth in the same domain [START_REF] Muenchen | r4stats -6/8/16: R Passes SAS in Scholarly Use[END_REF]. That makes R the most popular free analytic software, having as an added bonus its' high flexibility in that it provides the users the ability to create custom analytics. At the same time, it benefits greatly from a large and active community that contributes to analytics and visualization libraries, and frameworks.

Methodology

Data Collection

For the purposes of this study recordings from 108 patients for multiple days were obtained from the ICU clinic of the University Hospital of Heraklion, Crete (PAGNI) using an experimental protocol; Patient-Ventilator Interaction (PVI) Monitor [START_REF] Younes | A method for monitoring and improving patient: ventilator interaction[END_REF], as well as a selection of fields from the hospital Electronic Health Records (EHR). The raw data produced is approximately 12Mb per patient per day as an average. The data providers uploaded pseudo-anonymized data as files on a secure location. Later a more appropriate solution for datasets containing time-series was used by utilizing the NoSQL Apache Cassandra, although at this point it is implemented over workstation level resources.

Preprocessing

The main problem with the dataset that hinders a frequency based analysis is that the recordings are event driven, and thus the time difference between consecutives recordings varies, and in several cases significant. We applied a pre-processing tool that first utilizes general data cleaning methods and case specific rules (e.g. no breaths or attempts in breathing for 3 minutes is considered an artefact), and afterwards resamples the data to a fixed sampling rate of 30s [START_REF] Chytas | Ineffective efforts in ICU assisted ventilation: Exploring causalities via multiscale analysis[END_REF] [START_REF] Chouvarda | Multiparametric modeling of the ineffective efforts in assisted ventilation within an ICU[END_REF].

Ineffective effort for more than 10% of total breath count is believed to cause problems and prolong hospitalization time [START_REF] Georgopoulos | Ineffective efforts during mechanical ventilation: the brain wants, the machine declines[END_REF] [START_REF] Wit | Ineffective triggering predicts increased duration of mechanical ventilation*[END_REF]. We focused on the examination of periods in which the patient was experiencing serious troubles in breathing. We call such incidents IE events [START_REF] Chytas | Ineffective efforts in ICU assisted ventilation: Exploring causalities via multiscale analysis[END_REF].

𝑀2𝐷 = 𝑃𝑜𝑤 𝑚 𝐷𝑒𝑛𝑠𝑖𝑡𝑦

Area over x: this index is based on Density and represents the percentage of samples where the patient is experiencing at least x amount of IE.

𝐴𝑟𝑒𝑎𝑂𝑣𝑒𝑟 𝑥 = 1 𝑁 ∑ { 1, 𝐼𝐸 𝑖 > 𝑥 0, 𝐼𝐸 𝑖 == 𝑥 𝑁 𝑖=1
Variation: coefficient of variation for the IE signal. VarCof = 100 𝑆𝐷(𝐼𝐸) 𝑃𝑜𝑤 𝑚 IE distance: median time distance between consecutives IE Max clean Area: percentage of the maximum IE free time period in reference to the total recording period.

Feature Extraction for IE

A common used feature for the patient-ventilator interaction is the IE index.

𝐼𝑛𝑒𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒 𝐸𝑓𝑓𝑜𝑟𝑡𝑠 𝐼𝑛𝑒𝑓𝑓𝑒𝑐𝑡𝑖𝑣𝑒 𝐸𝑓𝑓𝑜𝑟𝑡𝑠+𝐵𝑟𝑒𝑎𝑡ℎ𝑠 , (1)
It is defined as the sum of IE to the combined sum of IE and breaths over a course of period, be it the totality of the recording, or smaller time segments (e.g. 1 hour to 5 minute). It gives us a general idea on how the patient faired over a period of time. It is reported that it IEs can lead to extended ventilation time, prolonged hospitalization and that it has an impact on mortality for patients with high IE index (>10%) [2][9]. A question that arises is whether or not a patient that might have a low overall IE index over the course of hours, has increased health risks because he is subject to short periods of intense IT activity. In such cases, even a much lower IE index might be related to patient deterioration. Also, a single feature might not be enough to sufficient describe the complexity of a signal distribution.

In order to address this issue, this paper suggests a set of indices that better describe the IE signal morphology. They can be divided into two categories:

1. Indices that are calculated based on IE signal morphology and are independent from the IE even definition (table 1). 2. Indices that are calculated based on the IE event definition (table 2), and thus can vary depending on the researcher's input.

Name and Description 𝑬𝒒𝒖𝒂𝒕𝒊𝒐𝒏

Event Power: The sum of IE that belong to event period, this is also an index with limited predictive capabilities that is used to better describe other indices.

𝑷𝒐𝒘 𝒆 = ∑ 𝑷𝒐𝒘 𝒆 𝒊 𝒏 𝒊=𝟏

where n the number of events Event Duration: the total duration of all IE events combined.

𝑫𝒖𝒓 𝒆 = ∑ 𝑫𝒖𝒓

Exposing ICU Analytics via Web-based Platform

In order to make the developed tools accessible to physicians a custom web based ICU platform was created. The main goal was to present the analytic tools in a simplified way, hiding functionality from the user when the steps were already predefined while giving them the ability to parameterize tools when required. The platform supports two major functionalities (figure 1). The first functionality is a module regarding data pre-processing and processing. Currently only a PVI dataset module is in place. The physicians can upload to the database pseudo-anonymized raw data as extracted by the PVI monitor, then query raw datasets to be pre-processed as previously defined. Afterwards, the user can select either of the two analysis pipelines currently in place, the feature extraction and/or the correlation between the ventilator recorded signals and their phase delay with each-other estimation, based on wavelet coherence [START_REF] Chytas | Ineffective efforts in ICU assisted ventilation: Exploring causalities via multiscale analysis[END_REF]. The wavelet coherence analysis explores the time-series correlation with each other and produces a set of features that are expected to give insight regarding the physiological phenomena that take place at the vicinity of an IE event, either preceding it (potential causes) or following it (potential consequences). On each case, the user has the option to experiment using different thresholds regarding the IE events, thus affecting the outcome of the analysis.

The features extracted by the ventilator dataset are combined with a segment of the patients' clinical data that was retrieved offline from the hospital database.

The second functionality is to provide a set of analytics and exploratory visualization, offering a set of commonly used analytics. The platform is designed agnostic of the data type it is provided, although it requires them to be on a tabular format. The user can apply data cleaning methods (out of bound, missing values, etc.) either automatically or manually by the use of UI elements. There, the physicians can run the statistical analytic functions they select among the available ones and evaluate the clinical outcomes they choose. For this segment, R packages that implement well known and established algorithms were utilized.

Web-based Platform Implementation

The web based platform was developed with Shiny, an R framework focused on creating web applications. An important part of the platform was the data visualization. In order to convey the information in a meaningful way based on the user ever-changing needs, we decided to focus on interactive visualization tools. Thus, we examined tools that are available as R packages. As it turned out there wasn't a single package that could cover the entirety of our needs, so we choose the packages described in table 3. A single type of chart (Heatmap) that is highly customizable [START_REF] Cheng | d3heatmap: Interactive Heat Maps Using 'htmlwidgets' and 'D3[END_REF] Specifically, for the Google charts, a custom function was created for the visualization of an entire column based data frame, as individual columns and the relation with each other (figure 1). For an N column data frame, a single mega-chart was created that consists of 𝑁 × 𝑁 individual charts. Each sub-chart 𝐶 𝑖𝑗 (𝑖, 𝑗 1, … , 𝑁) depicts the relationship between the variables residing in column i and column j of the data frame, with appropriate visualization that depends on the combination of the variable types. In the cases where 𝑖 == 𝑗, a single variable is depicted.

Results

Both the platform and the algorithms are currently used by physicians at PAGNI, the functionality and the interface was evolved based on their input. The following two figures show instances of the platform running an exploratory statistical analysis (figure 2) and a data processing pipeline.

Based on analysis enabled by the platform, the optimal threshold for defining respiratory events that relate to adverse outcomes is found to be 10 IE per minute for a time span of at least 3 minutes. On the current state of this research, performing multivariate analysis, adjusting for age and severity while setting the significance levels at .05 had as results that:

 three indices are found to be related to ICU mortality  four indices are found to be related to hospital mortality  two indices are found to be related to the number of days' spent ventilation.

Discussion

As the data collection phase proceeds, there will be an increase to the amount of data available (Volume), by including additional equipment recordings such as ICU monitors (recording bio-signals such us Electrocardiogram with a much higher sampling rate than the PVI) and also by increasing the amount of patients whose data are recorded.

Provided that the research questions answered by the AEGLE platform yields useful results regarding patient clinical outcome, our goal is to support streaming data and combine them with the acquired knowledge in order to build a decision support system that will require constant processing (the wavelet-based analysis previously described requires 2 to 10 seconds on workstation level resources depending on IE event duration) of live streaming data (Velocity) . Either way, we are gradually stepping into Big Data territory and performance will be an issue.

In order to address this, and as the AEGLE project moves towards the integrated platform, we are shifting our focus on the analytic integration and optimisation, so we can take advantage of the distributed storage and distributed processing that the combination of RHadoop and SparkR frameworks provide.

The knowledge acquired from this analysis, powered by the platform, can generate alarms thresholds that might be eventually applied on a clinical level.

Figure 1 .

 1 Figure 1. Overview of platform architecture

Figure 2 .

 2 Figure 2. Mass visualization of 5 variable and their combinations( 3 numerical and 2 categorical). Red colored charts represent the diagonal (a single-variable chart).

Table 1

 1 INDICES OF 1 st CATEGORY

	Name and Description	Equation
		𝐷𝑒𝑛𝑠𝑖𝑡𝑦 =
	1 𝑁	∑ { 𝑁 𝑖=1	1, 𝐼𝐸 𝑖 > 0 0, 𝐼𝐸 𝑖 == 0

Power: the sum of all IE, this is a helping index used to describe others 𝑃𝑜𝑤 𝑡𝑜𝑡 = ∑ 𝐼𝐸 Mean: the average of the IE. Also descriptive index for others 𝑃𝑜𝑤 𝑚 = 1 𝑛 ∑ 𝐼𝐸 Density: the percentage of samples in which the patient is experiencing at least one IE. , where 𝑖 = 1, … , 𝑁 the samples of the IE signal Mean to Density: Utilizing the previous indices we define this new one. For two patients having the same Mean score, the patient with the lowest Density score (same percentage of IE but more concentrated) will end up with a higher Mean to Density score, thus differentiating between those two.

Table 2

 2 INDICES OF 2 nd CATEGORY

Table 3

 3 Visualization Packages

	Visualization	Description
	Packages
	GoogleVis	R interface to Google Charts API, a great collection of charts, but the
		time-series libraries were somewhat lacking[10]
	Dygraphs	R interface to the 'dygraphs' JavaScript charting library. It focus on
		depicting time-series on highly costumizable charts[11]
	D3Heatmap


Emmanouil Stergiadis

Athanassios M Kintsakis

Fotis E Psomopoulos

Pericles A Mitkas

A scalable Grid Computing framework for extensible phylogenetic profile construction

Current research in Life Sciences without doubt has been established as a Big Data discipline. Beyond the expected domain-specific requirements, this perspective has put scalability as one of the most crucial aspects of any state-of-the-art bioinformatics framework. Sequence alignment and construction of phylogenetic profiles are common tasks evident in a wide range of life science analyses as, given an arbitrary big volume of genomes, they can provide useful insights on the functionality and relationships of the involved entities. This process is often a computational bottleneck in existing solutions, due to its inherent complexity. Our proposed distributed framework manages to perform both tasks with significant speed-up by employing Grid Computing resources provided by EGI in an efficient and optimal manner. The overall workflow is both fully automated, thus making it user friendly, and fully detached from the end-users terminal, since all computations take place on Grid worker nodes.

Introduction

Over the last decade, the amount of available data in the life sciences domain has increased exponentially and is expected to keep growing at an ever accelerating pace. This significant increase in data acquisition leads to a pressing need for scalable methods that can be employed to interpret them; a scaling that cannot be met by traditional systems as they cannot provide the necessary computational power and network throughput required. Several efforts are evident in recent literature towards developing new, distributed methods for a number of bioinformatics workflows through the use of HPC systems and paradigms, such as MapReduce [START_REF] Overbeek | The use of gene clusters to infer functional coupling[END_REF]. However most, if not all, of these efforts necessitate the setup of a rather complex computing system, as well as the expertise to manage and update an independent software project, since most implementations radically differ from their vanilla counterparts. This is in stark contrast with the situation for most life science researchers who lack the expertise needed to use and manage those systems. As a result, and despite the overall advantages of these frameworks, their ultimate use is fairly limited.

In order to overcome these issues, while at the same time providing the much needed computing power for complex analyses, we developed a bioinformatics framework on top of a Grid architecture that is able to perform common comparative genomics workflows at a massive scale using EGI resources. Special care has been taken to make the framework as automated as possible, increasing the user friendly factor in order to further facilitate wider use by the scientific community. Moreover, every major submodule in the framework utilizes the latest vanilla version available to the community, in order to ensure that the framework can always stay up-to-date through automatically consuming updates of its individual vanilla parts.

The rest of this paper is structured as follows; Section 2 provides an overview of the concepts and technologies used throughout this work. Section 3 outlines the proposed framework, with particular focus on the requirements driving the current implementation. Section 4 establishes the technical aspects of the implementation, including the different modes of operations and the expected input and output. In Section 5, the efficiency of the framework is validated for all supported execution modes and finally, Section 6 provides some insights towards future steps in this direction.

Background

Comparative Genomics

BLAST Algorithm BLAST has become the industry and research standard algorithm for sequence alignment. An open source implementation is provided by the NCBI organization which produces all alignments, as well as a number of parameters defining the significance of the alignment. A comprehensive list of the available parameters, as well as an in-depth description of the algorithm can be found in the online manual of the application. Our framework relies in particular on one of these parameters, namely the e-value e for each match. The e-value refers to the number of alignments expected to happen by chance. Therefore, a low e-value indicates a high statistical significance of an alignment.

Phylogenetic profiles Although the BLAST algorithm has been designed to readily identify and quantify sequence similarity, it will inherently miss any information that is not directly tied to this aspect. In particular, given a pair of protein sequences that may exhibit a high functional correlation (e.g. similar domains, active sites etc.) while at the same time do not expose any significant similarity in their composition, BLAST will fail to detect their interesting relationship. An alternative way to detect and quantify such relations, is to observe the joint presence or absence of sequences across a common set of genomes, for example protein sequences which only appear in the same family of genomes are highly likely to be related to that familys distinct functionality.

Phylogenetic profiles are vectors that characterize each sequence. Specifically, they indicate the sequence's homologs with every genome found in a given dataset. Each element in the vector corresponds to presence (denoted as the number 1) or absence (denoted as the number 0) of any homologue of the protein sequence under study in the respective genome. Beyond the standard (binary) phylogenetic profiles, an extended version may be constructed by replacing the presence/absence attribute by the actual number of homologs between that sequence and a target genome.

An even stronger evolutionary link between two sequences can be inferred through the use of best bidirectional hits (BBH). By definition, the best hit of a given sequence seq A derived from genome A to a target genome B, is the sequence seq B in genome B that represents the best match, i.e. a homologue scoring lower e-value e than all other hits produced. This particular match is also bidirectional if the seq A is also the best hit for seq B . A bidirectional best hit represents a very strong similarity between two sequences, and is considered evidence that the genes may be orthologs arising from a common ancestor [START_REF] Overbeek | The use of gene clusters to infer functional coupling[END_REF]. A graphical representation of the two cases of phlyogenetic profiles is show in Figure 1. Grid Computing A computer Grid is a system that coordinates resources that are not subject to centralized control using standard, open, general-purpose protocols and interfaces to deliver non-trivial quality of service [START_REF] Foster | What is the grid?-a three point checklist[END_REF]. A grid computing architecture can bring massive processing power to bear on a problem, as SETI (Search for ExtraTerrestrial Intelligence) and other similar projects have shown [START_REF] Anderson | Boinc: A system for public-resource computing and storage[END_REF], [START_REF] Anderson | Seti@ home: an experiment in public-resource computing[END_REF]. An additional abstraction layer, called middleware, makes creating and controlling grids easier.

The European Grid Infrastructure (EGI) is the result of pioneering work that has, over the last decade, built a collaborative production infrastructure of uniform services through the federation of national resource providers that supports multidisciplinary science across Europe and around the world. Our framework is deployed on the HellasGrid infrastructure, part of EGI, which offers high performance computing services to Greek universities and research institutes.

HellasGrid is also the biggest infrastructure for Grid computing in the area of South-East Europe.

Framework Description

We designed and implemented a framework capable of performing sequence alignment and phylogenetic profiling in a time-efficient and user-friendly manner, by utilizing EGI resources. These processes were both scaled to resources and automated due to the fact that they comprise an essential part in a plethora of biological analysis pipelines including, but not limited to: species identification, DNA mapping and domain localization [START_REF] Pellegrini | Using phylogenetic profiles to predict functional relationships[END_REF][START_REF] Marcotte | Localizing proteins in the cell from their phylogenetic profiles[END_REF]. The overall design and ultimate implementation of our framework has been dictated by the following requirements:

-Optimal efficiency -Fully automated and robust against system failures -Reusable output for building on top of previous results -Reuse of existing, optimized and tested submodules Workflow efficiency was maximized through an optimal use of EGI resources, minimizing queue delays as well as potential load failures that lead to resubmission of computational jobs [START_REF] Vrousgou | A grid-enabled modular framework for efficient sequence analysis workflows[END_REF]. The workflow does not require any interaction from the user after the initial submission phase; instead everything runs automatically in the background thus releasing the end-users' machine and allowing for better utilization of the local resources until the analysis is finished. Possible system errors are also handled automatically, with the possible exception of fatal errors. The final output is presented in a simple, widely accepted format that can be either consumed as a final output or used as an intermediate step to the next steps of any analysis pipeline. Finally, instead of reinventing the wheel, our framework utilizes well documented and maintained vanilla implementations of its submodules when available in order to accommodate both updates as well as support any further development of the framework through targeted extensions.

Program flow

As outlined earlier in the requirements of the framework, the workflow is fully automated. A Grid job is submitted for each file in the query directory corresponding to a genome to be examined, meaning that the number of submitted jobs is equal to the number of genomes we are interested in. Job submission is in reverse order to the size of the query file, thus ensuring that the most computationally expensive jobs are submitted first. Given that the total time needed for our analysis is equal to the worst time of its parallel counterparts, minimizing the delay of the lengthier jobs results in a notable improvement in efficiency, namely 20-30 hours for large queries as shown in the experiments performed (Section 5). In order to minimize the uploading time from the user's UI, as well as be able to handle an arbitrarily large database file, we exploit the Grid's storage services. Specifically, we upload the database only once to a Storage Element (SE), and provide each worker node with its qualified name. The worker node is thus able to retrieve the database directly downloading from the SE. Finally, each job runs BLAST to align its specific genome file with the database (which is common for all jobs).

The alignments produced by BLAST are then used to construct the phylogenetic profile of any type requested and for each sequence in the query genome. Since the computation at each node is completely independent of other nodes, no blocking occurs which qualifies the procedure as "embarrassingly parallel". Finally, the output of every job is returned to the users terminal and combined in a way that facilitates visualization as well as post processing. An instance of a job handler script is launched in the background for each of those jobs in order to monitor their state and resubmit them in case of failure caused by stability or load issues that the Grid might face at a given time. 4 Technical overview

Modes of operation

The driving use case for the proposed framework is to provide users with the means to run an independent analysis. Specifically, the user specifies both the sequences under study as well as the set of genomes against which the sequences are going to be aligned and consequently profiled. Beyond this information and during the initialization phase, additional parameters can be configured such as the type of phylogenetic profiles to be constructed (BBH or plain, extended or binary), the type of the input sequence data type (nucleotides or aminoacid) etc.

Moreover, our framework provides support for building upon previous results; due to the frequent appearance of such analyses in typical biological workflows, the framework provides the ability to combine new results (i.e. new genomes) with any previously computed results. Therefore, and instead of running the whole process from scratch, the framework can expand the previous query without recalculating all involved alignments and phylogenetic profiles' elements.

Expected Input

The input for every analysis comprises of the database file, including the sequences of every genome in our dataset, and a set of files corresponding to the genomes under study. The former files will be referred to as query files and should reside in a common directory, namely the query directory. It is important to note that both the query files and the database file must comply to the FASTA specification. The user must also supply a text file mapping each genome found in his database with a unique identifier. Finally, the user fills in a properties file in which the exact mode of operation and its parameters are configured.

Framework output

The output is comprised of the BLAST alignment results and the phylogenetic profile for each sequence. The framework also includes a library of usual post processing utilities that the user might use to visualize the output. These include a) filters that are able to isolate the most significant lines of the output, such as alignments with a top e-value score or profiles with specific matches, as well as b) reducers to collapse profiles at the genome level, i.e. present the phylogenetic profile of a whole genome instead of a profile at the sequence level.

Experiments and results

The framework has been implemented within a standard UNIX environment in mind, i.e any Debian based version of Linux. This restriction has been placed as a requirement of the underlying Grid infrastructure. The basic workflow is comprised of scripts to exploit the machines native calls, whereas complementary functionalities are designed in an object oriented manner using the Java programming language. In order to validate our framework for scalability we employed a test case, performing an all-vs-all analysis, since this is the most computationally demanding mode of operation. The total of 30 genomes used comprised a BLAST database including 544,538 sequences.

Our experiment involves the creation of BBH profiles for a total of 30 Genomes (all-vs-all operation). It can be seen in Figure 3 that the total time for each job is comprised of 3 parts. First, there is the submission delay. As explained before, we attempt to minimize the number potential job failures, by inserting a 1-hour delay between consecutive submissions. We take special care to ensure that bigger jobs are scheduled first, thus minimizing the total time for the lengthier jobs. Since the total query time equals that of its most demanding job, this method results in a huge efficiency boost as shown above. The green part corresponds to the scheduling time, which is usually minimal. However, there exist situations where a job fails and has to be resubmitted multiple times, resulting in extended waiting time such as the case of job number 17. Lastly, we can see the running time on each WN. This demonstrates significant variance, caused not only by input anomalies, but also by the heterogeneity of hardware resources employed by the Grid infrastructure. Finally, the produced phylogenetic profiles can be readily used for any further analysis, including functional correlations, pangenome approaches and evolutionary studies. Figure 4 provides some preliminary results through the use of BBH phylogenetic profiles. The ever increasing biological big data that need to be processed and interpreted in almost every modern bioinformatics workflow, require extreme computational power, storage capability and network throughput that only large-scale distributed systems can offer. The proposed framework exploits the native nature of the Grid infrastructure to achieve parallelization at the data layer instead of the software layer, allowing us to utilize well known vanilla implementations of comparative genomics tools. This allowed the framework to achieve significant speed-up without requiring any user effort, or introducing additional maintenance and setup concerns for the end user. This aspect, along with the fact that the main functionality offered poses a significant role in a wide range of diverse biological workflows, can potentially provide an easy solution to researcher in the wider scientific community.

Finally, the modular nature of the frameworks inner workings not only allows for the automatic updating of its submodules, but can also facilitate the addition of new features, such as a user friendly GUI, through integration with existing visualization platforms like Galaxy [START_REF] Giardine | Galaxy: a platform for interactive large-scale genome analysis[END_REF].

Fig. 1 .

 1 Fig. 1. Graphical overview of the general hit and bidirectional hit profiles, given a set of example sequences.

Fig. 2 .

 2 Fig. 2. (A) Diagram of the workflow from the users point of view (B) Diagram of the workflow taking place at each WN.

Fig. 3 .

 3 Fig. 3. Execution times in a 30 genome all-vs-all BBH profile construction query.

Fig. 4 .

 4 Fig. 4. Visual representation of the BBH profiles produced by the all-vs-all comparison of 30 genomes. Each cell corresponds to the number of BBH that have been identified in the respective pair of genomes. Moreover, the matrix has been hierarchically clustered in order to produce evolutionary meaningful clusters of genomes, as evident by the highly intra-correlated groups (bottom left, middle and top right).

Acknowledgements

This work used the European Grid Infrastructure (EGI) through the National Grid Infrastructure -HellasGrid.