Kristian Beckers
email: kristian.beckers@paluno.uni-due.de

Stefan Hofbauer
email: stefan.hofbauer@amadeus.com

Gerald Quirchmayr
email: gerald.quirchmayr@univie.ac.at

Christopher C Wills
email: ccwills@carisresearch.co.uk

A Method for Re-using Existing ITIL Processes for Creating an ISO 27001 ISMS Process Applied to a High Availability Video Conferencing Cloud Scenario

Keywords: ITIL, ISO 27001, cloud computing, processes, standards, certification, compliance

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Before an organisation can consider becoming certified and begin applying certified standards, there must be a clarity of understanding in relation to the organisation's business processes. These processes must be defined, agreed and adopted. The organisation must understand, the service level agreements (SLA) operated by their clients or customers and which services the organisation offers as managed service provider. For audit reasons this knowledge must be reviewed twice a year and any emergent changes need to be documented.

Another important step is the introduction of a ticketing system, like open source product OTRS, to capture all customer interactions and support the processes. The ticketing system should also contain an asset inventory, where all hardware and software is itemised. Every update, addition, change or deletion must be reflected in this inventory. Additionally hardware and defined services should be monitored, perhaps with an open source software such as Nagios 6 for example.

The move towards cloud services is accelerating the rate at which companies develop and the use of such service requires the sharing of large amounts of data in a secure and scalable way. ITIL and ISO 27001 help companies to achieve customer friendliness and high quality services and support. Without standardization, a lot of manual effort, growing cost and complexity for an organization arises, as the number of their service partners grows.

An organisation should definitely start with certifying ITIL and proceed with the ISO 27001 aiming at security afterwards. The basis for the ITIL certification is an understanding of ITIL itself, quality assurance and knowledge of the business processes in place. Capacity management assures that there is no capacity shortage on the provider side, as well as on the customer side. Regular checks and warnings, based on defined thresholds help to meet the capacity requirements and plan for expected growth. Exceptionally fast growth or the adding of resources must be planned, organized and scheduled, with the cloud provider service manager. This is an important step towards supporting the client or customer. At the base of the organisational hierarchy is the first level desk, then the technical engineers, the service manager and a department manager or even chief executive officer. The involvement of these roles depends on the defined SLAs and the target-, reaction time to solve incidents.

The rest of the paper is organized as follows. Section 2 presents background on the standards ITIL and ISO 27001. Section 3 serves as structured method for Section 4, which shows how these two standards can be mapped and mutual benefit created from the synergy between each other. Section 5 shows a usage example of the method based upon a real-life example and Sect. 6 presents related work. Section 7 concludes and gives directions for future research.

Background

We illustrate the general idea of cloud computing in Sect.2.1, and our cloud system analysis pattern in Sect. 2.2. We introduce the ISO 27001 standard in Sect. 2.3 and the ITIL Standard in Sect. 2.4.

Cloud Computing

The term cloud computing describes a technology as well as a business model [START_REF] Armbrust | Above the clouds: A berkeley view of cloud computing[END_REF]. According to the National Institute of Standards and Technology (NIST) cloud computing systems can be defined by the following properties [START_REF] Mell | The NIST definition of cloud computing[END_REF]: the cloud customer can acquire resources of the cloud provider over broad network access and on-demand and pays only for the used capabilities. Resources, i.e., storage, processing, memory, network bandwidth, and virtual machines, are combined into a so-called pool. Thus, the resources can be virtually and dynamically assigned and reassigned to adjust the customers' variable load and to optimize the resource utilization for the provider.

The virtualization causes a location independence: the customers generally have no control or knowledge of the exact location of the provided resources. Another benefit is that the resources can be quickly scaled up and down for customers and appear to be unlimited, (this is called rapid elasticity). The pay-per-use model includes guarantees such as availability or security for resources via customized Service Level Agreements (SLA) [START_REF] Vaquero | A break in the clouds: Towards a cloud definition[END_REF].

The architecture of a cloud computing system consists of different service layers and allows different business models: on the layer closest to the physical resources, the Infrastructure as a Service (IaaS) provides pure resources, for example virtual machines, where customers can deploy arbitrary software including an operating system. Data storage interfaces provide the ability to access distributed databases on remote locations in the cloud. On the Platform as a Service (PaaS) layer, customers use an API to deploy their own applications using programming languages and tools supported by the provider. On the Software as a Service (SaaS) layer, customers use applications offered by the cloud provider that are running on the cloud infrastructure. Furthermore, cloud providers require a layer that monitors their customers' resource usage, e.g. for billing purposes and service assurances. Buyya et al. [START_REF] Buyya | Modeling and simulation of scalable cloud computing environments and the cloudsim toolkit: Challenges and opportunities[END_REF] introduce this layer as a middleware in their cloud model. Cloud computing offers different deployment scenarios: private clouds are operated solely for an organization, public clouds are made available to the general public or a large industry group and are owned by a third party selling cloud services. In between these scenarios are hybrid clouds where users complement internal IT resources upon demand with resources from an external vendor [START_REF] Armbrust | Above the clouds: A berkeley view of cloud computing[END_REF].

Cloud System Analysis Pattern

We propose patterns for a structured domain knowledge elicitation. Depending on the kind of domain knowledge that we have to elicit for a particular software engineering process, we always have certain elements that require consideration. For this work we use a specific context elicitation pattern, the so-called cloud system analysis pattern [START_REF] Beckers | Pattern-based support for context establishment and asset identification of the iso 27000 in the field of cloud computing[END_REF]. We base our approach on Jackson's work on Problem Frames [START_REF] Jackson | Problem Frames. Analyzing and structuring software development problems[END_REF] that considers Fig. 1. Cloud System Analysis Pattern taken from [START_REF] Beckers | Pattern-based support for context establishment and asset identification of the iso 27000 in the field of cloud computing[END_REF] requirements engineering from the point of view of a machine in its environment. The machine is the software to be built and requirements are the effect the machine is supposed to have on the environment. Any given environment considers certain elements, e.g., stakeholders or technical elements. Jackson [START_REF] Jackson | Problem Frames. Analyzing and structuring software development problems[END_REF], who describes Problem Frames as follows: "A problem frame is a kind of pattern. It defines an intuitively identifiable problem class in terms of its context and the characteristics of its domains, interfaces and requirement.". We were also informed by Fowler [START_REF] Fowler | Analysis Patterns: Reusable Object Models[END_REF]. Fowler, developed patterns for the analysis phase of a given software engineering process. His patterns describe organizational structures and processes, e.g., accounting, planning, and trading. Our patterns for the analysis phase differ from patterns concerning solutions for the design phase of software engineering like the Gang of Four patterns [START_REF] Gamma | Design Patterns: Elements of Reusable Object-Oriented Software[END_REF] or the security patterns by Schumacher et al. [START_REF] Schumacher | Security Patterns: Integrating Security and Systems Engineering[END_REF]. The reason is that we provide a means for a structured elicitation of domain knowledge for cloud computing systems. We do not provide solutions for the implementation phase of clouds. We present a short introduction of our so-called Cloud System Analysis Pattern (or short: Cloud Pattern) [START_REF] Beckers | Pattern-based support for context establishment and asset identification of the iso 27000 in the field of cloud computing[END_REF] in the following. We created the pattern for cloud-specific context establishment and asset identification compliant to the ISO 27000 series of standards. A Cloud (see Fig. 1) is embedded into an environment consisting of two parts, namely the Direct System Environment and the Indirect System Environment. The Direct System Environment contains stakeholders and other systems that directly interact with the Cloud, i.e. they are con-nected to the cloud by associations. Moreover, associations between stakeholders in the Direct and Indirect System Environment exist, but not between stakeholders in the Indirect System Environment and the Cloud. Typically, the Indirect System Environment is a significant source for compliance requirements. The Cloud Provider owns a Pool consisting of Resources, which are divided into Hardware and Software resources. The provider offers its resources as Services, i.e. IaaS, PaaS, or SaaS. The boxes Pool and Service in Fig. 1 The Legislator and the Domain (and possibly other stakeholders) are part of the Indirect System Environment. Therefore, we categorize them as indirect stakeholders. We also provide templates for each stakeholder that describe their attributes like motivation for using the cloud.

The ISO 27001 Standard

The ISO 27001 defines the requirements for establishing and maintaining an Information Security Management System (ISMS) [START_REF]): Information technology -Security techniques -Information security management systems -Requirements[END_REF]. In particular, the standard describes the process of creating a model of the entire business risks of a given organization and specific requirements for the implementation of security controls. The ISO 27001 standard is structured according to the "Plan-Do-Check-Act" (PDCA) model, the so-called ISO 27001 process [START_REF]): Information technology -Security techniques -Information security management systems -Requirements[END_REF]. In the Plan phase an ISMS is established, in the Do phase the ISMS is implemented and operated, in the Check phase the ISMS is monitored and reviewed, and in the Act phase the ISMS is maintained and improved. In the Plan phase, the scope and boundaries of the ISMS, its interested parties, environment, assets, and all the technology involved are defined. In this phase also the ISMS policies, risk assessments, evaluations, and controls are defined. Controls in the ISO 27001 are measures to modify risk. The ISO 27001 standard demands the creation of a set of documents and the certification of an ISO 27001 compliant ISMS is based upon these documents.

Changes in the organisation or technology also have to comply with the documented ISMS requirements. Furthermore, the standard demands periodic audits towards the effectiveness of an ISMS. These audits are also conducted using documented ISMS requirements. In addition, the ISO 27001 standard demands that management decisions, providing support for establishing and maintaining an ISMS, are documented as well. This support has to be documented via management decisions. This has to be proven as part of a detailed documentation of how each decision was reached and how many resources are committed to implement this decision.

The ITIL Standard

The IT Infrastructure Library (ITIL) [START_REF] Government | It infrastructure library (itil)[END_REF] is a collection of best practices for implementing an IT service management. The standard provides example processes for typical tasks regarding IT management. The standard also provides tools of how to consider planning, establishing, supporting and optimizing of IT services in order to achieve business goals.

ITIL is a defacto standard for the creation, establishment and management of critical processes. ITIL contains generic descriptions and is independent of vendors or technology. ITIL provides a set of process that contain: basic requirements for the process, goals of the process, pattern for procedures and roles, interfaces for different processes, hints for critical success factors, suggestions for measuring key performance indicators, knowledge about success criteria for deploying the process.

Method

Cost, flexibility and ease of operation are driving more and more organisations into the cloud. We differentiate here between the public cloud, with cloud services of providers such as Amazon or Salesforce and the private cloud of virtualised services running on an organisation's privately run hardware and software.

It is not easy for a huge organisation to transition everything over to the cloud at once, because then parts of the business critical systems and services are already transitioned into the cloud and some are not. Cloud integration platform help solve this issue and help unite those services.

With the cloud integration platform it becomes much easier for global cloud players to sell cloud services to their partners. We consider clouds in our method via using our cloud system analysis pattern introduced in Sect. 2.2.

ITIL

Our practical experience has been, gained in different organisations, both mid-sized to large. From this experience, we identify the following steps relevant for implementing ITIL within a company. Different roles must be introduced and are needed to comply with this standard.

Define initial Tasks for the Roles Our method requires a service manager, who is having regular service meetings with the service provider, as well as a service desk including a service manager. The service desk covers agreed service times and may also be on duty after business hours for special reasons, such as emergency incidents. A change advisory board is established, whose task is to supervise proposed changes and confirm or cancel those changes. Changes can be cancelled for instance if no fallback is available, or the risks are too high. Field engineers work closely together with external customers to help fulfil their business needs. They are part of the service desk, but most of the time, are not at the office. The service manager, together with the service desk manager is also responsible that the customer gets a SLA report at least once a month. If the SLA criteria are not met, the service provider must reimburse as defined in the service contract between these two parties. Create an Incident Response System The service desk uses a ticket system, such as OTRS for incident management, as well as capacity management and inventory management. The ticketing system also keeps track of the guaranteed reaction time and time to recover for incidents. Service engineers can use the ticketing system to record their invested support time, which can then be used for billing purposes, as well as a means to communicate with the customer through e-mails. The agreed SLA values are part of the service contract and can be further negotiated by both sides, assuming the mutual consent. Establish a Monitoring System It is the duty of the service provider to monitor their own core infrastructure as well as customer devices. If requested, the service provider can also monitor devices within the customer site. The monitoring solution automatically generates tickets, based on the occurrence of incidents. The certified service provider needs a thorough documentation of their main business processes and service processes, including revisions on a regular basis. Every change in a productive environment, whether within the service provider context or the customer side, must be documented in a change document. Escalation processes need to be in place for incidents or problems. It must be clear, when a ticket is escalated and to whom. Getting certified in the core business areas It is obviously a good idea to have trained and certified personal, because it will reduce the chance of errors as well as having a better relationship to third level partners and a better reputation against customers.

For the non-daily business, a project manager is supervising the project's tasks and can acquire additional resources or take other necessary decisions. To have a clear vision of the provided services the service provider should have a service catalog for the provided service, with responsibilities and boundaries to partners. This information must be agreed on and communicated, prior having a contract with a customer. Not only the software or hardware producer is acting as third level support, but also external consultants or other companies, partners for third level support. Additional feature requests in upcoming software releases can be wished for at software partners. Document all necessary information The provided service needs to be documented for technical as well as organizational aspects and revised, whenever there is a change. This documentation should be stored on a document management system, like Sharepoint, where it is easy to check out documents, make changes and check in the new document. For every customer, there needs to be a technical as well as sales person. The most important customer satisfaction parameters are availability, costs, service, innovation, upselling products as well as security. The security is of high importance for the provider's as well as customer's equipment. This includes the regular patching of devices and yearly external security audits.

Define boundaries to stakeholders

The customer further needs a system specification and operating procedures handbook. For customer projects a project plan, time plan and dedicated project manager is needed from service provider side. The service provider should also think about a certified quality assurance employee, who takes care after quality management and quality assurance. This person needs to communicate a lot with externals as well as all involved internal departments. If the quality of the service is not assured, it is most likely that the customer will not continue the contract or as a worst case, cancel the contract with the service provider immediately. A service provider should have a service catalog, where all provided services and the engineers' responsibilities are listed.

ISO 27001

Once an organisation has been successfully certified in the area of ITIL, it is time to seek compliance with ISO 27001. As with ITIL, the introduction of the standard within the oranisation is made up of different sub steps.

Agree on an IT security policy In order to become certified in the field of ISO 27001 an organisation has to adopt the following steps. The first requirement is that of a company security policy, which handles topics, such as choosing a secure password, rights of usage of the Internet and corporate e-mail, locking of the computer, data leakage and prevention, social engineering, storage of data and confidence regarding data and information. Regular awareness training for users and administrators is provided by instructors, in order to familiarize key personal with the security policy. After the security policy training, the attendees should give their written consent, in order that the security policy can be instituted. Establish the position of a CISO Furthermore, the position of a Chief Information Security Officer (CISO) is required. This position can be led by a person, who is also responsible for other topics within the company. The tasks of a CISO includes policies, standards, procedures, architecture and guidelines for the organisation's business. The first priority is the establishment of an information security function to ensure that all the organisation's information assets are well protected and mitigations are adequately implemented. The CISO will also manage the ongoing execution of the security operation in all of the organisation's information technology areas such as applications, data protection, data communications systems as well as all information systems. Other tasks carried out by the CISO drive the overall direction of the information, application and operational security architecture as well as creating an understanding of risks by analysing and forecasting threats to information security. Moreover, the CISCO role includes managing security monitoring, analysis, detection and going through incident response processes fostering information security awareness and promoting a culture of information security and privacy. Document all changes A change log document helps in keeping track of every change on productive systems for traceability and clearness. The service provider needs physical and IT security in place to defend the data centre from intruders. Therefore centre personnel need to be trained regularly. Part of these controls, are access control of the data centre and video surveillance of the server rooms. It must be clear, who has had access to which server rack at which time. Normally, video recording tapes are digitally stored for 24 hours and when there is no reported incident, they are erased. Plan on business continuity and disaster recovery The service provider's data centre needs physical and logical redundancy for all IT equipment (software and hardware) as well as a disaster recovery and business continuity plan for the data centre. The service provider should formulare a disaster recovery plan together with partners, at least once a year. A thorough documentation of all relevant security processes builds the basis for an ISMS that supports the execution of the security policy. Ensuring effective risk management Identify the information assets within the company that need to be protected and conduct an accurate risk assessment on them. With risk management, the risk can be handled or even accepted, when the costs for preventive measurements are too high. Before conducting a risk assessment it is well known to first classify the information assets based on their relevance and company impact. The assessor must know if their Confidentiality, Integrity or Availability can be compromised and to which extent. Produce a control list consisting of action items The controls are made up of the risk assessment again and the overall approach for mitigating or leaving risks. Selected controls should be mapped to Annex A of the standard, which consists of 133 controls in 11 domains. A review of Annex A is used to figure out, if any control areas have been missed out in the compliance process.

A Mapping between ITIL and ISO 27001 action items

The two standards, ITIL and ISO 27001 are capable of mappings between them. We are using steps from the ITIL process as input for the ISO 27001 process. With these inputs, an output can be generated. Which means that the result of the ITIL process serves as input for the ISO 27001 activities. There are different action items regarding countermeasures within the ITIL and ISO 27001 standards. So how can the company compliance still be assured after the mapping between the ITIL and ISO 27001 processes took place? It is a matter of compliance regarding the privacy and legislation of the involved participants and entities. ITIL and ISO 27001 have in common that they are both based on the Plan-Do-Check-Act (PDCA) model. From ITIL point of view, nearly all security controls in ISO 27001 are part of ITIL service management. It is also in the ITIL standard, chapter on service design that there is a reference on ISO 27001. The advantage of this approach is that the company's information security department is in line with the risk management department regarding which ITIL processes have been implemented through ISO 27001. The information security department can also easily identify which ISO 27001 objectives are already met through the use of ITIL and which still must be handled. Using this hybrid approach, considering ITIL and ISO 27001 together, companies can save a lot on time and money using mutual synergies and knowledge in this area. The need to use both standards at the same time is to establish a well-known information security process that covers all relevant aspects. If doing so, a company can rely on acceptable security levels, effectively manage risks and reduce overall risk levels. We propose a mapping between ITIL and ISO 27001 action items based on the points in Sect. 3.1 and Sect. 3.2. Point 1 of ITIL, Define initial tasks for the roles is mapped to point 1 of ISO 27001, named Agree on an IT security policy. So starting with the initial tasks and roles, a security policy can be written and agreed on. The creation of an incident response system, point 2 of ITIL is the basis for establishing the position of a CISO in a company. So it is technical means, which is the base for organizational duties of a CISO position. Moreover, step 1 of ISO 27001, the establishment of a security policy is needed to have a CISO on duty. So there are not only relations between the standards but also within one standard. Point 3 of ITIL, the establishment of a monitoring system, serves as input for action item 5 of ISO 27001, ensuring effective risk management.

Only with a thorough configured monitoring and alerting system it is possible to conduct effective risk management. The goal is to mitigate risks and be aware of new risks. A classification of the monitored assets is important to easily identify the severity of an incident. Reaction times, escalation times, contact with partners and producers and time to recover are heavily dependant on the severity of an incident. The higher the severity is, the faster is the required reaction times, escalation times, communication with partners and producers and recovery time. Only if an organisation is certified in its core business areas, can it be able to embark upon business continuity and disaster recovery planning. Certified personnel as well as experience and knowledge in the matter of subjects are a plus. Input for this is the documentation of all necessary information and changes. The documentation must be extended and kept up to date at every chance. It is important to define boundaries to stakeholders and produce a control list consisting of action items as well. The boundaries to stakeholders serve as input for Annex A of the ISO 27001 standard.

High Availability Video Conferencing Service Provider

Our example is based on a high availability video conferencing service provider, who is supporting customers with their company video infrastructure. Thus it needs high availability and fast response times to the end client.

Instantiate the Cloud Pattern

To illustrate our approach, we use the example of a service provider. This company wants to offer video conferencing services to its customers. The video conferencing services are planned to be implemented via a cloud system.

Figure 2 shows an instance of the extended cloud pattern for the description in the following: The cloud provider is a company called Alpha. The main goal of the cloud provider is to maximize profit by maximizing the workload of the cloud. Therefore its sub-goals are to increase the number of cloud customers and their usage of the cloud, i.e. to increase the amount of data as well as the number and frequency of calculation activities. Fulfilling security requirements is only an indirect goal to acquire cloud customers and convince them to increase the subset of processes they outsource. The pool of the cloud is instantiated with Alpha's data centers that consist of servers, network, and virtualization software. The data centers are located in Germany and the US. Alpha uses the internal help desk of its data centre as cloud support and the internal data centre IT services unit as cloud administrator. Alpha implements the Alpha cloud table as cloud database and the Alpha hypervisor as cloud hypervisor. The cloud customer is instantiated with a technology company that plans to outsource the effected IT processes to the cloud to reduce costs and scale up their system for a broader number of end customers. Customer data such as IP addresses, names, and transaction log history are stored in the cloud. Transactions such as booked meetings are processed in the cloud. We instantiate the cloud developer with an internal software development unit of the technology company. This unit develops solutions for video conferencing in the cloud. The internal development unit installs and configures web-and application servers in virtual machines. The resulting cloud programming interface is the foundation for the video conferencing service. The technology company uses the cloud to conduct his/her financial business.

Describe relevant Business Processes

The business process in our scenario is made up of a cloud customer, who demands the service of a video conferencing suite, especially made for VIP customers. To maintain such a high available solution, the cloud customer requests the following services from the cloud provider: A state of the art video conferencing system, using HD video quality and a fast and reliable connection between the video participants and conducting a penetration test against the video conferencing site once a year with a detailed report.

The cloud customer network is maintained by the cloud provider, who is responsible for the security and non-disclosure of data. For HD video quality, the customer will need at least a 2 Mbit connection and preferably more bandwidth. It is also a good idea to have a single point of contact, globally reachable video support number that is used as the primary place to go for first level incidents. It is of course a good idea to have the WAN connections and the video conferencing service from the same cloud provider.

There are not many providers who can offer both services on a worldwide basis. Once a week there needs to be ongoing discussion between the cloud provider and the customer concerning new video system installations and the incidents recorded at the first level support. The cloud provider is also responsible for keeping up maintenance and service contracts of the video endpoints. If the first level support is not successful or it takes too long a time to recover, the case is escalated to second and third level. The second level can be within the cloud provider or local IT at the customer site. The third level is the producer of the video equipment, which can be a partner of the cloud provider and/or customer. The customer needs proofed processes in place for scenarios, such as a video conference room installation or the hardware replacement of a video endpoint.

Describe Services in Detail

In our example, the video conferencing service is provided to the customers by the cloud provider. It consists of the dial-in bridge and one-to-one movie connections as well as security mechanisms. If a change occurs, such as that caused by the installation of a security update on the management server, customers are redirected to a backup system, which indicates that the main site is under maintenance and will be back in production soon. If an incident outside a maintenance window occurs, the responsible IT manager of the cloud customer will contact the service delivery manager of the cloud provider. The given incident has to be handled and restored to normal working conditions in accordance to the time frames specified in the agreed Key Performance Indicators (KPIs). If this is not possible, the cloud provider has to pay a penalty for the non delivery of the managed service. For the compliance with the KPIs, service reports with the availability expressed in percentage of the provided service are delivered to the customer. To further analyze the quality of the service, end-to-end monitoring from the customer network to the login server can be applied. The end-to-end monitoring reports can be accessed from the cloud customer via a separate web page. The task of the endto-end monitoring is to supervise the availability and response time of the login service and alert the provider as well as the customer in case of exceeding defined thresholds.

The system further distinguishes between warnings and errors and is capable of alerting status changes. The end-to-end monitoring procedure stimulates the user experience and does so by executing a macro of user transactions constantly 5 times per hour. The security requirements for the retrieval of these monitoring reports involve the use of certificates and encryption as well as a complex algorithm used for client authentication. This algorithm shall consist of a combination of 3 different authentication mechanisms.

First, the unique username, second user input by finishing a capture picture and third a unique password corresponding to the user. The certificate in use must be trusted by an authorized third party company, who issues the certificate and have an encryption standard of 256 bits. For VIP customers immersive, telepresence video rooms are used. This needs the involvement of different parties at the customer side, for example facility (cooling, heating, electrician,...) and the local video team. Once, all physical tasks have been carried out, the video system can be certified, prior to using it. The certification takes place between the customer site, who initiates a connection to the cloud provider and vice versa. Parts of this test includes presentation sharing, movement of people, taking a screenshot and having a stable connection for at least 15 minutes. The quality of the connection can be seen during the connection in the quality details. The technicians should have a look at parameters, such as delay, jitter and packet loss. A common issue can also be one way audio or video, which is mostly because of missing firewall configuration on one participant side.

Instantiate ISMS Policies

First an assessment is conducted by the cloud customer in order to select a cloud provider that best fits his requirements. Normally such a selection is done through a bidding procedure. The cloud customer is describing the services he wants to consume as well as availability values and response times for incidents. The cloud customer should also check if the cloud provider has a qualified 24x7 support team in place, which the customer can call, when there is a major incident or outage. Another important point is to clarify if the provided infrastructure is solely in use for the customer and not part of a multi tenant solution. Further, disaster recovery on the hardware side (e.g.: VMware HA, VMware Vmotion) and the existence of a fallback data centre should be clarified. It is also interesting in which country the data centre resides and where the customer data is actually stored. This is important as which national law applies and where the court jurisdiction resides. Which security mechanisms does the cloud provider have in use and which quality of cooling, electricity venues are in the field. It should also be clear, if the cloud provider will monitor the customer's servers and be responsible for data backups. Generally speaking, the service quality should be constantly monitored by the cloud provider. This can for instance be done with an end-to-end monitoring solution, where end user behavior is simulated. Such a solution measures the availability from the customer point of view as well as response times and network monitoring. End-toend monitoring solutions are collating these KPIs through measuring scripts running on separate machines crawling through the productive environment. The monitoring results are then reported to the cloud customer once a month for every single service in use. The measurement criterion for the service delivery and maintenance duties are the KPI and are based on the overall availability, availability of customer processes and customer satisfaction. The monitoring results are to be delivered to the customer for quality assurance at the beginning of the month. For service delivery, references of customers (success stories), partner management (which partners support the cloud provider) and a sample contract can be requested. The contract duration, opt-out criterion as well as price models for the services are necessary.

Conduct an internal and external Security Audit

The cloud provider of course will get the chance to improve their offer in the second phase. A feedback process from the cloud customer to the cloud provider after the first phase is recommended. The services provided to the customer are defined in a contract between the two parties involved. In this contract the service levels are expressed in SLA, as well as the response times during business hours and after business hours are defined. A high customer satisfaction rate is assured through security, availability and confidence in the cloud provider. The cloud provider has established processes and policies that maintain the security of the customer data. A confident handling of customer information and infrastructure is based on the consequent implementation of rules and processes, which are embedded in policies and specified in standards and operational guidelines. Implementing these guidelines is the duty of the cloud providers' employees. Based on these policies, responsibilities, roles, behavior, process definitions and supporting technologies are derived.

Implement Change Management

For the change log within the service delivery, all changes in the productive environment must be logged. The structure of the change log is as following: The first column is filled with an incremental ID, followed by the name of the change owner. The initiator of the change, which can vary, comes next. After that, the change cause, described in words or referring to a support ticket is listed. Next is the hostname, where the change is carried out, following the change description in descriptive language as well as the configuration changes itself in computer language. The category of the change is classified in regular, emergency and standard. It has to be defined, which duties belong to a standard change. If a change is non-standard, it is qualified by the engineer as a non-standard change. All productive changes have to be scheduled and appropriate configuration and fallback procedures in place prior to executing the change. The last possibility is a non-operational relevant change. This means changes in non productive environments and no scheduling of the change is needed. The risk of the change can vary from low to medium to high. At the end, a control check is performed, where the name of the change approver as well as the date the change was approved and the date the change was carried out, are documented. Last, but not least, a flag is inserted stating whether the change was successful or not. Changes are executed, following a four eye principle.With this feature, errors can be minimized and the overall availability and customer satisfaction is high. Urgent changes or emergency changes can be delivered faster, but require the consent of the Change Advisory Board (CAB).

Related Work

Calder [START_REF] Calder | Implementing Information Security based on ISO 27001/ISO 27002: A Management Guide[END_REF] and Kersten et al. [START_REF] Kersten | ITSicherheitsmanagement nach ISO 27001 und Grundschutz[END_REF] provide advice for an ISO 27001 realisation. In addition, Klipper [START_REF] Klipper | Information Security Risk Management mit ISO/IEC 27005[END_REF] focuses on risk management according to ISO 27005. This works do not consider relations to other standards like ITIL. Cheremushkin et al. [START_REF] Cheremushkin | An application of integral engineering technique to information security standards analysis and refinement[END_REF] [16] present a UML-based metamodel for several terms of the ISO 27000, e.g., assets. These meta-models can be instantiated and, thus, support the refinement process. However, the authors do not present a holistic approach to information security. The work mostly constructs models around specific terms in isolation. We support the establishment of an ISO 27001 ISMS using the processes in the ITIL standard.

Mondetino et al. investigate possible automation of controls that are listed in the ISO 27001 and ISO 27002 [START_REF] Montesino | Information security automation: how far can we go?[END_REF]. Their work can complement our own. Fenz et al. [START_REF] Fenz | nformation security fortification by ontological mapping of the iso/iec 27001 standard[END_REF] introduce an ontology-based framework for preparing ISO/IEC 27001 audits. They provide a rule-based engine which uses a security-ontology to determine if security requirements of a company are fulfilled. This work also does not consider the ITIL standard.

Conclusion and Future Work

We have established a method that helps with mapping ITIL action items to ISO 27001 action items. The method works in a compliant way, also after this mapping has been done. Our contribution is intended to help organisations, which are already certified or are thinking becoming certified.

Our approach offers the following main benefits:

-A structured method to map ITIL action items with ISO 27001 action items -Systematic identification of relevant action items and determining compliance mechanisms for them -Improving the outcome of business processes by adding benefits from mapping between standards -Re-using the structured techniques of ITIL and ISO 27001 for supporting business processes in order to be compliant with current legislation and demands of law As standardization is not an easy step for companies, we came up with suggested steps to help companies become certified. We presented a combination of technical and organizational means to master this process. Our cloud analysis pattern is the basis for the high availability video conferencing solution operating in the cloud. We apply our pattern on both, ITIL and ISO 27001 standards. Our hybrid approach, using the synergies from both certifications is shown in the mapping between them. In our example we present the whole life-cycle, the instantiation of the cloud pattern, the description of the relevant business processes, the description of the managed service in detail, the instantiation of ISMS policies, conducting internal and external securtity audits and finally, the implementation of change management within the organisation.

The work presented here is based on [START_REF] Beckers | Pattern-based support for context establishment and asset identification of the iso 27000 in the field of cloud computing[END_REF] and is further extended with the use of ITIL and our cloud-specific analysis pattern. Future work will involve the mastering of security and privacy questions within this context. The legislative framework in connection

  are hatched, because it is not necessary to instantiate them. Instead, the specialized cloud services such as IaaS, PaaS, and SaaS and specialized Resources are instantiated. The Cloud Developer represents a software developer assigned by the Cloud Customer. The developer prepares and maintains an IaaS or PaaS offer. The IaaS offer is a virtualized hardware, in some cases it is equipped with a basic operating system. The Cloud Developer deploys a set of software named Cloud Software Stack (e.g. web servers, applications, databases) into the IaaS in order to offer the functionality required to build a PaaS. In our pattern PaaS consists of an IaaS, a Cloud Software Stack and a cloud programming interface (CPI), which we subsume as Software Product. The Cloud Customer hires a Cloud Developer to prepare and create SaaS offers based on the CPI, finally used by the End Customers. SaaS processes and stores Data input and output from the End Customers. The Cloud Provider, Cloud Customer, Cloud Developer, and End Customer are part of the Direct System Environment. Hence, we categorize them as direct stakeholders.

http://www.nagios.org

with both the cloud provider and the customer side must be examined in more detail. We think that this paper builds a stable basis for all of these challenges.


Shagufta Scanlon
email: s.a.scanlon@student.bradford.ac.uk

Mick Ridley
email: m.j.ridley@bradford.ac.uk

A Fully Reversible Data Transform Technique Enhancing Data Compression of SMILES Data

Keywords: SMILES, Data Transform, Data Compression

The requirement to efficiently store and process SMILES data used in Chemoinformatics creates a demand for efficient techniques to compress this data. General-purpose transforms and compressors are available to transform and compress this type of data to a certain extent, however, these techniques are not specific to SMILES data. We develop a transform specific to SMILES data that can be used alongside other general-purpose compressors as a preprocessor and post-processor to improve the compression of SMILES data. We test our transform with six other general-purpose compressors and also compare our results with another transform on our SMILES data corpus, we also compare our results with untransformed data.

Introduction

The Simplified Molecular Input Line Entry System (SMILES) language was developed to represent two-dimensional molecular structures in a concise and compact way allowing for storage and processing improvements. General-purpose compressors allow for further reductions in storage and processing costs [START_REF] Weininger | SMILES, a Chemical Language and Information System. 1. Introduction to Methodology and Encoding Rules[END_REF], [START_REF]Daylight Theory Manual[END_REF].

With the continuous expansion of chemical databases [START_REF] Kristensen | Using Inverted Indices for Accelerating LINGO Calculations[END_REF] and the need for efficient storage and searching of molecular structure representations, such as SMILES [START_REF] Weininger | SMILES, a Chemical Language and Information System. 1. Introduction to Methodology and Encoding Rules[END_REF], [START_REF]Daylight Theory Manual[END_REF], storage and processing costs of these representations need to be further improved.

Data can be transformed by exploiting the specific information contained in the data to its advantage. Transformed data can be used alongside general-purpose compression techniques to further improve compression results [START_REF] Skibiński | Two-Level Directory Based Compression[END_REF], [START_REF] Carus | Fast Text Compression Using Multiple Static Dictionaries[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF].

We make the following contributions in this paper:

 We present our SMILES-specific transform designed to enhance the compression of SMILES data when used with other general-purpose compressors.  We provide results from using general-purpose compression techniques on a breakdown of different SMILES transform scenarios and a combination of techniques used in our SMILES transforms.

 We provide a comparison of the results from our SMILES transforms with Word Replacing Transforms (WRT) [START_REF] Skibiński | Two-Level Directory Based Compression[END_REF], [START_REF]Homepage of Przemysław Skibiński[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF] optimized for different compression algorithms and also on untransformed data.

The remainder of this paper is structured as follows. Section 2 discusses molecular structure representations and how compression has been used on SMILES data. Sections 3 to 5 introduce the SMILES chemical language, general-purpose compression and data transformation techniques, respectively. Section 6 illustrates our SMILESspecific transform design, grammar and architecture. Section 7 provides details of the experiments conducted, including the data collected, testing environment, metrics computed, experiment methodology and results. The results shown demonstrate the benefits of using compression over transformed data. The actual transformation results themselves have been omitted to help maintain the focus of this paper, which is to improve the compression of SMILES data using SMILES-specific transforms, and also due to space limitations. Section 8 discusses the key findings and concludes this paper.

Molecular Structure Representations

Several molecular structure representations have been implemented over the years. The most popular linear representations include SMILES, which is human-readable, and International Chemical Identifier (InChI), which is machine-readable. Other linear representations include Wiswesser Line Notation (WLN), Representation of Organic Structures Description Arranged Linearly (ROSDAL), SYBYL Line Notation (SLN), Modular Chemical Descriptor Language (MCDL) and InChIKey [START_REF] Karthikeyan | Encoding and Decoding Graphical Chemical Structures as Two-Dimensional (PDF417) Barcodes[END_REF], [START_REF] O'boyle | Towards a Universal SMILES Representation -A Standard Method to Generate Canonical SMILES Based on the InChI[END_REF], [START_REF] Engel | Basic Overview of Chemoinformatics[END_REF]. Other types of representations include MOL and SDF formats for single and multiple molecules, respectively. MOL and SDF consist of coordinates and connections between atoms [START_REF] Karthikeyan | Encoding and Decoding Graphical Chemical Structures as Two-Dimensional (PDF417) Barcodes[END_REF]. The authors in [START_REF]Daylight Theory Manual[END_REF] suggested that SMILES representations use between 50% and 70% less storage space in comparison to their equivalent connection tables [START_REF]Daylight Theory Manual[END_REF]. The authors in [START_REF] Karthikeyan | Encoding and Decoding Graphical Chemical Structures as Two-Dimensional (PDF417) Barcodes[END_REF] developed a molecular structure representation using barcodes in SMILES format. Barcodes were chosen to handle errors and SMILES was chosen due to its human-readability and compact nature in comparison to other molecular representations, such as MOL and SDF. However, they argued that in the future with the potential increase in error correction levels required, the compression of SMILES would be inevitable to avoid an increase in data storage. They discussed the use of Lempel-Ziv-Welch (LZW), a lossless dictionary-based compression algorithm, and found that data reduction with LZW can be achieved approximately by a factor of two. As well as compression, the authors also discussed the use of a more compact representation to SMILES instead, known as the Automatic Chemical Structure (ACS). ACS provides a condensed representation of a molecular structure by assigning unique identifiers to molecular substructures or fragments. However, as molecular information from a SMILES representation is omitted from the ACS encoded barcode, backward mapping from ACS to SMILES is important [START_REF] Karthikeyan | Encoding and Decoding Graphical Chemical Structures as Two-Dimensional (PDF417) Barcodes[END_REF].

SMILES Data

SMILES is a linear chemical notation language originally developed by Weininger in 1988 [START_REF] Weininger | SMILES, a Chemical Language and Information System. 1. Introduction to Methodology and Encoding Rules[END_REF] and further extended by Daylight Chemical Information Systems [START_REF]Daylight Theory Manual[END_REF]. It is used by practitioners in the Chemoinformatics field to represent a linear form of twodimensional molecular structures [START_REF] Weininger | SMILES, a Chemical Language and Information System. 1. Introduction to Methodology and Encoding Rules[END_REF].

Table 1 provides a summary of the basic representation rules for SMILES notations and some examples. SMILES notations are essentially represented using ASCII characters in linear format with no spaces. Molecular structures can have several different and valid SMILES representations and SMILES representations are not unique. Although, unique representations can be generated using a canonicalization algorithm [START_REF] Weininger | SMILES, a Chemical Language and Information System. 1. Introduction to Methodology and Encoding Rules[END_REF], [START_REF]Daylight Theory Manual[END_REF].

Atomic symbols are used to represent atoms. Non-organic atoms can be represented inside square brackets, also included in the brackets are the number of Hydrogen atoms and charges declared for the atoms. The range of elements within the organic subset can be depicted with the square brackets omitted, this indicates that Hydrogen atoms are present for these atoms even without the square brackets. Aliphatic and aromatic atoms are represented in uppercase and lowercase characters, respectively [START_REF] Weininger | SMILES, a Chemical Language and Information System. 1. Introduction to Methodology and Encoding Rules[END_REF], [START_REF]Daylight Theory Manual[END_REF].

Neighboring atoms are attached to each other by single bonds or aromatic bonds, which can be excluded, unless otherwise specified by double or triple bonds. Branches are parenthesized and can be characterized as nested or stacked. To symbolize a cyclic structure, a single bond must be broken inside a cyclic ring. Cyclic ring opening and closing are determined by numbers assigned following the ring opening and ring closing atomic symbols. A period characterizes the separation of disconnected structures [START_REF] Weininger | SMILES, a Chemical Language and Information System. 1. Introduction to Methodology and Encoding Rules[END_REF], [START_REF]Daylight Theory Manual[END_REF].

Table 1. Generic SMILES Representation Rules and Examples [START_REF] Weininger | SMILES, a Chemical Language and Information System. 1. Introduction to Methodology and Encoding Rules[END_REF], [START_REF]Daylight Theory Manual[END_REF] 4

General-Purpose Data Compressors

General-purpose compressors can be used to universally compress data of textual format [START_REF] Carus | Fast Text Compression Using Multiple Static Dictionaries[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF]. Table 2 shows a summary of the compression algorithms and techniques used in each general-purpose compressor used in our experiments. Lossless compression techniques preserve the integrity of data by ensuring the original data is fully reconstructed from the compressed data on decompression [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF]. Two common forms of lossless compression techniques are statistical and dictionarybased approaches. Statistical approaches to compression include the Huffman encoding algorithm which is a technique that involves the substitution of frequent characters with shorter codewords [START_REF] Carus | Fast Text Compression Using Multiple Static Dictionaries[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF]. Dictionary-based approaches involve the substitution of words or phrases with their corresponding indices in the dictionary. The Lempel-Ziv compression schemes which include LZ77, LZ78, LZW and LZMA to name a few, are all dictionary-based approaches [START_REF] Carus | Fast Text Compression Using Multiple Static Dictionaries[END_REF], [START_REF] Ratanaworabhan | Fast Lossless Compression of Scientific Floating-Point Data[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF].

Within dictionary-based approaches, static dictionaries can be suitable when information about the data being processed is already known and can be prepared in advance. They have the potential to improve compression results as the technique is one-pass, so an information gathering phase prior to compression would not be required, and the information would be readily available in the dictionary to process. However, the fixed nature of the dictionaries have the potential to negatively impact storage costs. A semi-static dictionary approach uses two-passes, the first to gather statistics from the data source and prepare the dictionary and the second to actually compress the data. The adaptive dictionary technique dynamically rebuilds the dictionary during compression [START_REF] Carus | Fast Text Compression Using Multiple Static Dictionaries[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF].

Table 2. General-Purpose Compressors

Data Transform Techniques

Data transformation can be added as an extra pre-processing and post-processing step during data compression to enhance compression results. Where general-purpose compressors can be used to treat all types of data as text and compress them accordingly, modelling a data transformation technique on a specific type of data can provide far better compression results when used alongside other compressors [START_REF] Skibiński | Two-Level Directory Based Compression[END_REF], [START_REF] Carus | Fast Text Compression Using Multiple Static Dictionaries[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF]. Data-specific transforms have been developed for this purpose for different types of data. For example, to transform textual data, WRT was developed by Skibiński [START_REF] Skibiński | Two-Level Directory Based Compression[END_REF], [START_REF]Homepage of Przemysław Skibiński[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF] to pre-process English language text based on matching words in the dictionary and replacing them with codewords. It uses capital conversion techniques, dictionary sorting according to word frequency, q-gram replacement whereby frequent q consecutive characters are replaced with shorter symbols, End-of-Line (EOL) symbol conversion to spaces, data protection techniques such as using a data filter, and encloses words with spaces. WRT was extended to Two-Level Word Replacing Transform (TWRT) to add data dictionaries that were specific to the type of data being processed, for example a dictionary containing commands from a Java programming language [START_REF] Skibiński | Two-Level Directory Based Compression[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF]. WRT transforms optimized for BWT, LZ77, PAQ and PPM [START_REF]Homepage of Przemysław Skibiński[END_REF], [START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF] have been compared with our SMILES transforms in our experiments.

SMILES-Specific Data Transform

We have developed a transform language specific to SMILES notations in order to improve the compression of SMILES data. The design and techniques used in this transform was aimed at providing a good balance between data storage and processing costs, whilst maintaining data integrity. As with the use of general techniques such as the substitution of n-grams and the addition of prefixes, SMILES-specific techniques such as substituting atomic symbols with their equivalent atomic numbers was used. The atomic symbol conversion to atomic numbers, used in stage three of our transform, has an advantage as it allows the practitioner to process the data in its transformed state on decompression.

SMILES Transform Properties

The following highlights the properties held by the developed transform:

 Storage Costs Reduction -Ensures a reduction in storage costs when the transformed data is compressed with other general-purpose compressors.  Processing Time Reduction -Compression and decompression times are reduced when compression is used over the transformed data.  No Ambiguity -Handles any ambiguous SMILES tokens, particularly with aromatic elements.  Fully Reversible -Data is fully reversible with data integrity preserved.

SMILES Transform Phases

The following shows the techniques used in the different phases of the transform:

1. N-Grams1 -Frequent SMILES tokens from two to eleven characters in length are replaced with either other frequently used characters already used in the data, or with other unused characters. 2. Number Prefixes -Prefixes are added to SMILES tokens of numerical format using either other frequently used characters in the data or other unused characters.

Note that this step is carried out prior to the next phase in order to avoid ambiguity and conflicts with atomic numbers. 3. Atomic Numbers and Prefixes -SMILES tokens that contain atomic symbols are matched and converted to their corresponding atomic numbers in the periodic table to ensure that there is no ambiguity. Atomic numbers are also prefixed with either other frequently used characters in the data ensuring no ambiguity or other unused characters. Aromatic elements are also converted to their corresponding atomic numbers to ensure consistency and are transformed last preserving the no ambiguity property.

SMILES Transform Representations

Table 3 illustrates the grammar used for our SMILES transform. Note that 2-grams have only been used for testing the first transformed representation to reduce entropy.

In order to distinguish between aromatic elements and other elements, it is assumed that SMILES tokens that contain any aromatic elements would only do so in a manner that they do not conflict and cause direct ambiguity with any other elements. For example, the atomic symbol for Cobalt is Co, if this symbol was to appear in a SMILES string, then for our transform it has been assumed that this would be a twoletter symbol for Cobalt and not symbols for aliphatic Carbon, C, and aromatic Oxygen, o. The following are examples of SMILES data and their equivalent transform representations to illustrate the transform scenarios further:

SMILES Transform Architecture

Figure 1 illustrates the SMILES transform architecture developed in Java. The transform parses the input SMILES tokens, stores the converted n-grams into a dictionary, uses regular expressions for adding prefixes to numbers, and stores the converted atomic elements along with their prefixes in dictionaries. The dictionaries created are static as the information is already known to us regarding which n-grams to use and the atomic numbers to use to replace the atomic symbols. It is intended that this technique will be extended to use semi-static or adaptive dictionaries in future work to further improve compression.

Data Collection

The experiments in this study were carried out on SMILES data extracted from 41 publicly available toxicology datasets. The datasets 3 were obtained from Bergstrom Melting Point [START_REF]Chemoinformatics[END_REF], Carcinogenic Potency Database [START_REF]Chemoinformatics[END_REF], CPDB [13], DSSTox 4 [9], Fathead Minnow Acute Toxicity [START_REF]Chemoinformatics[END_REF], FDA's Carcinogenicity Studies [START_REF]Chemoinformatics[END_REF], Fontaine Factor Xa [START_REF]Chemoinformatics[END_REF], HERG [START_REF]Chemoinformatics[END_REF], Huuskonen [START_REF]Chemoinformatics[END_REF], Karthikeyan Melting Point [START_REF]Chemoinformatics[END_REF], Li Blood-Brain-Barrier Penetration [START_REF]Chemoinformatics[END_REF], National Toxicology Program [START_REF]Chemoinformatics[END_REF], Stahl [START_REF]Chemoinformatics[END_REF] and Tox-Benchmark [START_REF]Benchmark Data Set for In Silico Prediction of Ames Mutagenicity[END_REF]. The SMILES data from all these files were combined into a single file and then multiplied to create a total of 12 files of sizes ranging from 1.71MB to 20.48MB. These files formed the basis of the data used in our experiments. In total, our data corpus consisted of 384 files. 288 files were used to provide a breakdown of our SMILES transform scenarios, these included 228 n-gram, 24 number prefix and 36 periodic number transformed files. 96 files were used to compare our SMILES transforms with other transformed and untransformed files, these included 36 SMILES and 48 WRT transformed files and 12 untransformed files.

Testing Environment

The following testing environment was used for the experiments:

 Operating System: Windows 7 Professional 64-bit OS.  Processor: Intel(R) Core(TM) i5-3320M CPU @ 2.60GHz.  Memory: 6.00GB (5.88GB usable).

Compression Metrics

The following metrics were computed in Java for these experiments:

 Compression Ratios -The size of the compressed files divided by the size of the uncompressed files.  Compression Times -The average time taken for each compressor to compress the transformed files and untransformed files.  Decompression Times -The average time taken for each compressor to decompress the compressed files.

Methodology

The compressors used on all transformed files were 7Zip [1], BZip2 [START_REF]BZip2 for Windows[END_REF], GZip [START_REF]The GZip Home Page[END_REF], PPMd [START_REF]Compression.ru Project[END_REF], PPMVC [START_REF]Homepage of Przemysław Skibiński[END_REF] and ZPAQ [24]. All compressors were used with their default settings, it is intended that these settings will be changed in future work to provide for more detailed storage and processing results and further comparisons. The following SMILES-specific transforms were tested for all the compression metrics:  AvgStorage -This transform provides an average transformed file size and uses 8-gram_chars, prefix_chars and periodic_stars in its transform.  WorstStorage -This transform provides the worst transformed file size and uses 10-gram_brackets, prefix_equals and periodic_brackets in its transform.

Compression metrics were also computed for the following to compare our SMILESspecific transforms against:

 WRT-BWT [START_REF]Homepage of Przemysław Skibiński[END_REF] -WRT transform optimized for BWT compression.  WRT-LZ77 [START_REF]Homepage of Przemysław Skibiński[END_REF] -WRT transform optimized for LZ77 compression.  WRT-PAQ [START_REF]Homepage of Przemysław Skibiński[END_REF] -WRT transform optimized for PAQ compression.  WRT-PPM [START_REF]Homepage of Przemysław Skibiński[END_REF] -WRT transform optimized for PPM compression.  Untransformed -Untransformed data.

Results

Figures 2 to 10 illustrate the results and the key findings have been highlighted below:

─ SMILES Transform Scenarios -The periodic_brackets transform scenario provided the best compression ratios for all compression algorithms except for PPMVC, where prefix_equals provided the best compression ratios for this algorithm. 2-gram_chars provided the worst compression ratios for all compression algorithms except for PPMVC, where 4-gram_chars gave the worst compression ratios for this algorithm. 2-gram_chars provided the best compression times for 7Zip, GZip, PPMVC, ZPAQ, along with 3-gram_chars for BZip2, and 8-gram_brackets for PPMd. Periodic_brackets gave the worst compression times for all compression algorithms. 6-gram_chars provided the best decompression times for 7Zip, together with 2-gram_chars for BZip2, PPMd, PPMVC and 4-gram_chars for GZip and ZPAQ. Periodic_brackets provided the worst decompression times for all compression algorithms except for GZip, where prefix_chars gave the worst times. ─ Overall SMILES Transform Scenarios -For all transform scenarios 7Zip provided the best compression ratios overall. PPMVC and ZPAQ gave good compression ratios. GZip gave the worst compression ratios. BZip2 and PPMd also provided worse compression ratios. PPMd provided the best compression times. BZip2, GZip, PPMVC and ZPAQ gave good compression times. 7Zip provided the worst compression times overall. GZip provided the best decompression times overall. 7Zip and ZPAQ gave good decompression times. BZip2 and PPMd both provided worse decompression times. PPMVC provided the worst decompression times. ─ Transform Comparisons -The WorstStorage SMILES transform provided the best compression ratios compared to all the other transforms tested and untransformed data when used with 7Zip. The WRT-LZ77 transform provided the worst compression ratios when used with GZip. The WRT-PAQ transform gave the best compression times when used with PPMd. The transform with the worst compression times was the WorstStorage SMILES transform when used with 7Zip. The untransformed files gave the best decompression times with GZip. The WorstStorage SMILES transform gave the worst decompression times with PPMVC.

Discussions and Conclusions

In this paper we presented a SMILES-specific transform designed to enhance the compression of SMILES data when used with other general-purpose compression techniques. We tested general-purpose compression techniques on a breakdown of different SMILES transform scenarios and a combination of SMILES transforms. We compared our results with WRT transforms optimized for different compression algorithms and also on untransformed data.

The following can be concluded from the results:

─ In terms of the SMILES transform scenarios tested, the results demonstrated that generally the number prefix and atomic element to atomic number transforms provided better compression ratios than n-gram substitution. However, n-gram substitution provided better compression times than number prefix and atomic element to atomic number transforms, except for PPMd. Decompression times were also generally better than the number prefix and atomic element to atomic number transforms, except for GZip and PPMd. ─ It can also be noted that overall substituting data with existing characters in the data provided slightly better compression ratios than using unused characters, except for PPMVC. Whilst, many compression and decompression times for n-gram substitutions overall were better when using unused characters, the results also showed that using existing characters in some cases was better. Although, for number prefix and atomic number transforms using unused characters generally provided slightly better compression times than using existing characters. Using unused characters also provided slightly better decompression times mainly for number prefix and atomic number transforms, however, some also displayed slightly better results when using existing characters. ─ The results also illustrate that generally ZPAQ provided good and balanced compression ratios, compression times and decompression times for all SMILES transform scenarios tested. ─ Comparing the SMILES transforms developed with WRT optimized transforms and untransformed data, it can be concluded that all the SMILES transforms tested provided better compression ratios compared to all the WRT optimized transforms and untransformed data. Also, the WorstStorage SMILES transform provided better compression ratios than the AvgStorage and BestStorage SMILES transforms. However, all the WRT optimized transforms and untransformed data provided better compression and decompression times compared to the SMILES transforms. ─ Overall, 7Zip and PPMVC provided the best compression ratios for all transforms and untransformed data. GZip gave the worst compression ratios overall. PPMd and ZPAQ provided the best compression times overall and 7Zip gave the worst compression times. 7Zip, GZip and ZPAQ provided the best decompression times, whilst PPMVC provided the worst decompression times overall.

In general, it can be concluded that transforms developed for specific data can enhance compression when used with other compressors. Transforming files prior to compression can result in larger file sizes, however, as the results have shown, compression can still be enhanced despite this. We must also not forget that transforming files incurs additional pre-processing and post-processing times prior to compression and after decompression in order to return the file back to its original state. However, in our transform it is possible to process or use the files to a certain extent without detransforming them. This can be achieved simply because the atomic element number to atomic symbol mapping, and vice-versa, is based on the information available in the periodic table. Users can refer to the periodic table for references to the atomic number in question and process these files without de-transformation.

A final point, it is important to note when designing transform or compression techniques that providing better storage impacts compression and decompression times, as can be seen with our SMILES transforms, and vice-versa, providing better compression and decompression times can impact compression storage. It is better to try and balance storage with performance if possible.

Future work will involve further research into data transformations and compression. The transform techniques developed will be further improved, and these experiments will be extended to provide further comparisons with compression techniques and more datasets.

 7 -

 7 Grams: ─ SMILES: C1CC(CNCCCCCCC)CCC1CNCCCCCCC ─ 1st Transform: C1CC(CN¬)CCC1CN¬ ─ 2nd Transform: C1CC(CN())CCC1CN() ─ SMILES: C(N)(=O)OC(C#C)(C1=CC=CC=C1)C2=CC=C(Cl)C=C2 ─ 1st Transform: C(N)(=O)OC(C#C)(|C=C1)C2=CC=C(Cl)C=C2 ─ 2nd Transform: C(N)(=O)OC(C#C)([]C=C1)C2=CC=C(Cl)C=C2  Number Prefixes: ─ SMILES: C1=CC=CC(=C1)CCN(C)N=O ─1stTransform: C£1=CC=CC(=C£1)CCN(C)N=O ─ 2nd Transform: C==1=CC=CC(=C==1)CCN(C)N=O  Atomic Numbers: ─ SMILES: CCC(Br)(CC)C(=O)NC(=O)NC(C)=O ─ 1st Transform: ~6~6~6(:35)(~6~6)~6(=~8)~7~6(=~8)~7~6(~6)=~8 ─ 2nd Transform: *6*6*6(**35)(*6*6)*6(=*8)*7*6(=*8)*7*6(*6)=*8 ─ 3rd Transform: [[6[[6[[6([[[35)([[6[[6)[[6(=[[8)[[7[[6(=[[8)[[7[[6([[6)=[[8

Fig. 1 .

 1 Fig. 1. SMILES Transform Architecture

 2 -

 2 Gram_Chars to 11-Gram_Chars -N-grams using unused characters.  3-Gram_Brackets to 11-Gram_Brackets -N-grams reusing existing characters.  Prefix_Chars -Number prefix addition using unused characters.  Prefix_Equals -Number prefix addition reusing existing characters.  Periodic_Chars -Atomic symbol to number conversion using unused characters.  Periodic_Stars -Atomic symbol to number conversion using unused characters.  Periodic_Brackets -Atomic symbol to number conversion reusing existing characters.  BestStorage -This transform provides the best transformed file size and uses 2-gram_chars, prefix_chars and periodic_chars in its transform.

Fig. 2 .Fig. 3 .Fig. 4 .Fig. 5 .Fig. 6 .Fig. 7 .Fig. 8 .Fig. 9 .Fig. 10 .

 2345678910 Fig. 2. Average Compression Ratios per SMILES Transform Scenarios

Table 3 .

 3 SMILES Transform Grammar Applied to Different Scenarios 2

The concept of using N-Grams was taken from[START_REF] Cavnar | N-Gram-Based Text Categorization[END_REF],[START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF] and[START_REF] Skibiński | Two-Level Directory Based Compression[END_REF].

The prefixes added to the atomic numbers in the second transform grammar was based on the star encoding '*' scheme proposed in[START_REF] Kruse | Preprocessing Text to Improve Compression Ratios[END_REF] and also described in[START_REF] Skibiński | Reversible Data Transforms that Improve Effectiveness of Universal Lossless Data Compression[END_REF].

All whitespaces were removed.

SMILES data was taken from the Structure SMILES column rather than the Parent SMILES column. Any incomplete or non-SMILES strings were removed.

Acknowledgements. We would like to thank all the authors of publicly available datasets, compression and transformation tools that made this study possible. We are also very grateful to the anonymous reviewers for their valuable comments and suggestions that helped to improve this paper.

Data

Compression, http://mattmahoney.net/dc/zpaq.html