S Galliou
email: serge.galliou@femto-st.fr

F Sthal

X Vacheret

R Brendel

P Salzenstein

E Rubiola Time

G Cibiel

A Program to Analyse the Origin of Noise in Ultra-Stable Quartz Crystal Resonators

In the mid 90s the quartz crystal oscillator attained a stability in the upper 10 -14 (flicker floor of the Allan deviation σ y (τ), which occurs at τ =1..10 s). As a matter of fact, the highest stability was obtained with bulk-acoustic-wave quartz crystal resonators at 5 MHz and at 10 MHz. Since, the research for higher stability seems to be at a standstill, while space applications are more and more demanding. FEMTO-ST Institute have started a research program on the origin of noise in 5 MHz and 10 MHz quartz crystal resonators, managed by The Centre National d'Etudes Spatiales (CNES). Several European manufacturers of high-stability resonators and oscillators participate. This article reports on the present status and on the future plans of this program. The first part consists in the analysis of the sensitivity of selected resonators to various externally-controlled parameters, like temperature, drive power, load impedance, series capacitance. The second part, planned, consists of listing the possible causes of noise, and of modeling their effects on frequency stability. Tests and measurements are mainly performed on an advanced phase noise measurement system, recently set up for this program. Of course, this program is a unique opportunity to test various batches of 5 MHz and 10 MHz resonators provided by the industrial partners.

INTRODUCTION

To achieve the selected missions, space applications of precise localization, navigation and sciences require frequency stabilities and spectral purity that dramatically increase. It is the case of clocks on board for PHARAO missions, and ultra stable oscillators (USO) for DORIS programs, for which the required frequency stability is about or better 1.10 -13 for τ from 1 to 10 s. These stabilities are required either for ultra stable quartz crystal oscillators (DORIS program) or atomic clocks (PHARAO project) in which the ultra stable oscillator (USO) gives the limitation of stability. In these cases, very low noise USO are required, and for this reason it is necessary to select and control the sources of noise of the quartz crystal resonator.

DORIS

program (Doppler Orbitography and Radiopositioning Integrated in Space) is a Doppler satellite tracking system developed for precise determination and precise ground location. Its ultimate aim is to achieve an accuracy of one centimetre. This instrument is on-board of TOPEX-POSEIDON, JASON1 and ENVISAT altimetric satellites, it also flew with SPOT series. Future DORIS will be embarked on JASON2, PLEIADES, ALTIKa, HY2, CRYOSAT2.

The feasibility of quartz crystal oscillators exhibiting relative frequency stabilities that can reach 5⋅10 -14 over a few seconds was clearly proven [START_REF] Besson | 10 MHz Hyperstable Quartz Oscillators Performances[END_REF]. Unfortunately, their reproducibility is still far from being systematic whereas the demand is more and more severe in terms of specifications. Indeed, it is clear that the precision of localization by means of satellites or the precision of clocks used for synchronization in telecommunication systems results in increasingly severe requirements on the performances of the USO, at the limit of the know-how of today.

To reach the level of performances required by current projects (PHARAO, JASON2, PLEIADES, ALTIKa, HY2, CRYOSAT2) and futures projects (mainly altimetric missions which need DORIS instrument), it is necessary to sort all the quartz crystal devices one by one, in terms of noise. The outputs are extremely weak (a few %) to obtain performances such as those required by PHARAO (7.10 -14 for τ = 1 s). To hope to improve the stability of USO, it is necessary to continue and go further into works of investigations on the origin of noise in resonators. Currently, the distribution of USO stability is centered on 1⋅10 -13 over a few seconds, for best crystal units from major European manufacturers. It is necessary to be able to shift it to 7, even 5⋅10 -14 , in production. This program is managed by the French space agency CNES (Centre National d'Etudes Spatiales) of Toulouse, is led by the FEMTO-Institute (UMR CNRS 6174) and involved major European manufacturers (AR Electronics Besançon France, Oscilloquartz Neuchatel Switzerland, Rakon Argenteuil France, Temex Troyes France).

II. GUIDING LINES OF THE PROGRAM

The problem is complex and requires a long-term study to end up on a noticeable improvement of the manufacturing processes of 5 and 10 MHz ultrastable resonators of 10 -14 grades. One (ambitious) aim of the study is to develop a model of the resonator noise from investigations on the physical origins of its noise. This will be performed in two main steps.

In a first step of 18 months, and before investigating physical origins of noise in resonators, we schedule to investigate correlations between actual geometrical data, external parameters of influence and the measured resonator parameters. For this study according to a macroscopic point of view, four research axes are scheduled to improve the understanding of resonator noise:

-Study of resonators sensitivity to the drive level, -Study of the load influence, -Study of the influence of the temperature (dynamic effect, influence of the operating point versus the turn over temperature), -Study of the influence of the frequency shift (pullup).

These actions are based on an intensive use of the new bench for phase noise measurement recently developed at the FEMTO-ST Institute [START_REF] Sthal | Advanced bridge instrument for the measurement of the phase noise and of the short-term frequency stability of ultra-stable quartz resonators[END_REF]. Analysis will be performed from measurements made on samples of ultrastable resonators of various industrial batches.

The second step will consist in building a noise model for bulk acoustic wave resonators from a more microscopic basis. Previous actions are necessary to any further development of such a model. Their results will condition the second step orientation. The latter will include a PhD work over duration of about 36 months.

III. MEANS OF MEASUREMENT

The first step of this study is essentially based on the use of a phase noise measurement bench (Fig. 1) recently developed at the FEMTO-ST institute, and still improved everyday [START_REF] Rubiola | On the 1/f frequency noise in ultra-stable quartz oscillators[END_REF][START_REF] Sthal | Advanced bridge instrument for the measurement of the phase noise and of the short-term frequency stability of ultra-stable quartz resonators[END_REF][START_REF] Sthal | Thermal characterization of crystal ovens used in phase noise measurement system[END_REF]. The general idea of this passive method (see Fig. 2) consists in reducing the noise of the source as much as possible. Indeed, when resonators exhibit a very weak noise, the noise of the source is always higher than that of the quartz crystal resonator. Thus, the direct feeding of the driving source signal through only one resonator does not permit to extract the resonator noise from the output resulting noise. On the other hand, the source signal can be subtracted when passing though two identical arms equipped with identical resonators (the devices under tests (DUT)). Then the contribution of the source is cancelled while inner noise of both resonators is preserved because one resonator noise is different from the other one. When the carrier suppression is achieved (less than -75 dBc is acceptable), the resulting signal only made up noise from both resonators, is strongly amplified and mixed with the source signal to be shifted down to the low frequency domain and eventually processed by the spectrum analyzer. In such a way, noise to be measured from both resonators can be brought up at a higher level than the driving source noise. Moreover, the noise floor of the bench can be measured with resistors substituted for crystal resonators. Figure 3 shows a typical result. The measured f -1 phase noise visible into the resonator bandwidth can be interpreted as a frequency to phase conversion. Basically, the frequency flicker noise generated by a resonator would be filtered by its own transfer function. Two data are extracted from this graph:

Calibration source

Xtal #A Xtal #B

Low Noise Source

1/ the resonator bandwidth equal to two times the intersection frequency of the f -1 and f -3 slopes. It gives the loaded Q-factor and, thus, the conversion coefficient of the frequency noise into phase noise. ).

) ( 2 1 ) ( 2 f S Q f S L y φ         = (1)
As a consequence, according to the following path (2), the Allan deviation of an oscillator equipped with such a noisy resonator could be calculated, assuming that the dominant phase noise in the oscillating loop is that of the resonator:

) 1 ( 2 ln 2 ) 1 ( ) 1 ( Hz f S floor Hz f S Hz f S y y y = ⋅ = ⇒ = ⇒ = σ φ (2)
Before the noise measurement, calibration must be performed by means of a calibrated noise or sideband modulation (at 0.4 Hz in our case. See Fig. 2).

Obviously, preliminary tunings are also necessary: impedance matching, series capacitor adjustment of each resonator to be at resonance at the driving source frequency, operating temperatures of each resonator. The latter have to be tuned carefully at the turning points of each frequencytemperature curve.

Presently, the resonator ovens exhibit a temperature stability of 2 µK over a measuring time of 1 s. The tuning capacitor of each resonator is also temperature-controlled. This guarantees a relative frequency stability floor better than 1⋅10 -14 for the usual operating conditions of the bench.

Main features of our bench as completed today are the following:

-Standard operating frequencies: 5 MHz and 10 MHz (at other frequencies, results depend on the driving source stability), -Noise floor: -148 dBc/Hz @ 25 µW, -154 dBc/Hz @ 100 µW, -Temperature tuning of crystal ovens: by steps of 0.05 °C over the temperature range [70 °C, 90 °C],

-Frequency tuning 1/ of each arm with: a few pF ≤ Ct ≤ a few 10 pF, 2/ of the source frequency at ≤ 0.01 Hz.

-Ultimate Allan deviation σ y (τ) = 1⋅10 -14 for τ = 1 s. Details are given in [START_REF] Sthal | Advanced bridge instrument for the measurement of the phase noise and of the short-term frequency stability of ultra-stable quartz resonators[END_REF] IV. TASKS DESCRIPTION

The work of the first stage has been divided in tasks according to their topics but, in fact, they overlap each other.

A. Task 1: provisioning and fitting of high quality resonators

Ideally, it would be interesting to analyze couples of resonators representative of various manufacturing processes and various types of resonators. This opportunity exists because several industrial partners are involved in the first part of the program. Indeed, the study will include measurements on the following samples:

-5 MHz BVA type resonators provided by Oscilloquartz, Neuchâtel, Switzerland, -5 and 10 MHz QAS type resonators from Rakon, Argenteuil, France, -"conventional" 10 MHz resonators from AR Electronic, Besançon, France -10 MHz BVA resonators manufactured at the Institute FEMTO-ST, Besançon, France, -"conventional" 10 MHz resonators from TEMEX Frequency, Troyes, France.

In practice, the implementation of those resonators into the high stability bench ovens is not so easy because of their packaging variety, as shown in figure 4. Initially, ovens have been designed for homemade 10 MHz BVA type resonators (cold weld HC40 enclosures of height 12 mm and diameter 20 mm) (fig 4). Whereas HC6 packages can easily be put in with minor modifications, on the other hand bigger cases such as HC12 or those of 5 MHz BVA resonators are more difficult to insert without reducing thermal performances of the ovens. Specific ovens with measurement adaptations have been performed in this last case, to progress despite the limited length of time of 18 months for the first step of this program.

B. Task 2: Thermal effect

It is well-known that temperature is a parameter of influence on the frequency stability, unavoidable in the design of an oscillator as well as in a passive measurement bench. Before beginning a study on a noise model based on a physical approach, temperature effects have to be evaluated at the 10 -14 scale.

Two main causes of frequency changes due to temperature are usually identified:

-The first one is the well-known static effect linked to the real position of the operating point T op versus the turn over point T top of the cubic frequency-temperature relationship.

The relative frequency sensitivity versus temperature fluctuations ∆T around T op can be written as:

T a f f y T ∆ × = ∆ = 0 , (4)
with [ ]

2 0 3 ) ( 6 2 T T T T a top T δ γ δ γ β ⋅ + ⋅ - + =
, where  α, β, γ are respectively the first, second and third coefficients of the frequency-temperature relationship, depending on the cut angles, T 0 (usually 25°C) is the reference temperature which corresponding to the reference frequency f 0 , and

top op T T T - = δ is the temperature gap.
This is one of the most important adjustments to be done in an oven-controlled crystal oscillator (OCXO).

As an example, the usual SC cut whose controlledtemperature is set at 0.1 K (i.e. δT = 0.1 K) from its turn-over point close to T top = 85°C, exhibits a coefficient value of a T = 10 -9 K -1 . This means that its temperature has to be controlled within ∆T = 100 µK in order to get a frequency stability better than 10 -13 .

-The second cause of frequency changes linked to temperature has a dynamic origin and is commonly modeled by a phenomenological coefficient as:

dt dT a f f 0 = ∆ (6)
For the most simple SC cut resonator, the dynamic coefficient a ~ would be of a few 10 -7 K -1 s.

This phenomenon includes various effects such as:

-The thermal transfer function of the resonator, that is to say the ratio of the inner temperature of the vibrating volume, assumed to be homogeneous, and that of the crystal case also assumed to be homogeneous. This transfer function obviously depends on the mechanical mounting of the resonator according to whether the resonator is a BVA type or not for example, what are its thickness (depending on the selected overtone) and diameter, etc? -Thermal gradients. Gradients into the resonator induce strains and then frequency shifts.

Anyway, all the possible origins of temperature changes are still to be identified at the 10 -14 scale.

As previously mentioned, means used in our bench to filter and regulate the resonator temperature guarantee that ambient temperature changes are not a limiting factor of the resonator noise measurement. These means cannot be transposed directly in an oscillator structure because of their volume. So, the question of the resonator sensitivity to temperature at the 10 -14 scale, in an oscillator, is still relevant. In addition, its series capacitor used for the frequency adjustment is also temperature-sensitive. This is why; this study is the opportunity to review the theoretical aspect of temperature effects. It will be supported by a set of noise measurements on various types of resonators (conventional, QAS, BVA,…) for different remote-controlled operating temperature (the temperature step is 0.05°C). This might permit to evaluate the limit of influence of temperature in oscillators, if it exists.

C. Task 3: Influence of the tuning capacitor

The resonator frequency has always to be tuned. Into each arm of the bench as in an oscillator, this is fulfilled by a series capacitor having a pull-up effect, here so-called tuning capacitor C t (see fig. 5): using the component definitions of fig. 5, the resulting frequency becomes with a good approximation, In terms of relative frequency shift:

t x s resonance C C C f f + + ≈ 0 1 (7)
) ( 2 0 t x s C C C f f + ≈ ∆ (8)
where f s denotes the resonant frequency of the motional arm alone (i.e. L x ⋅C x ⋅(2πf s ) 2 = 1), very close to the series frequency of the resonator. As an example, the addition of a tuning capacitor C t = 100 pF to a resonator exhibiting a parallel capacitor C 0 = 2 pF, gives Temperature sensitivity. This capacitor is obviously also temperature sensitive. Thus, it induces relative frequency changes around the resonant frequency (the pulled up frequency) such as:

t t t C resonance C dC k f f ⋅ ≈ ∂ (9)
As an illustration, numerical values of the coefficient t C k are shown in Fig. 6, in the case of a commercial 5 MHz resonator. It takes values of a few 10 -6 . That means that a tuning capacitor which exhibiting a temperature coefficient of a few ppm / K will cause a relative frequency fluctuations versus temperature of a few 10 -12 K -1 .

In that case, a relative frequency stability of a few 10-14 could be reached provided that the tuning capacitor is temperature-controlled at better than 1/100 K around its operating temperature. This is not too much complicated to control but must be taken into account. Impedance sensitivity. The tuning capacitor modifies the overall impedance. In each arm of the bench, each resonator and its associated series capacitor are one element of a resistor bridge. Before beginning the noise measurement, one of the preliminary adjustments consists in tuning each series capacitor in order to get the resonance in both arms. When this operation is completed, the overall network of fig. 5 is equivalent to a resistance. In other words, its equivalent impedance

Z(f) = R(f) + X(f) is reduced to Z(f = f resonance ) = R(f = f resonance ) = R resonance ≥ R x .
Nevertheless, R resonance is no more equal to the motional resistance R x . Fig. 7 illustrates the influence of C t on Z(f). This seems obvious but leads to some consequences on values and possible noise sources if fluctuations exist :

-The impedance matching is no longer true if resistors of the bridge have values previously set.

-The dissipated power into the resonator has to be evaluated again by taking into account some correction with regard to the simple resistor R x .

-The real inner resonator temperature also depends on the real power dissipated into the resonator, as mentioned earlier.

-The loaded quality factor Q L is for R resonance > R x and not R x (see fig. 8). Into the bench,

L resonance resonance L R R R Q Q + ⋅ = (10)
where Q is Q-factor of the system {resonator + tuning capacitor} (very close to the Q-factor of the resonator alone: see below), and R L is its global load resistor. For the bench adjustments and calculations, one should be sure that these corrections are well applied. In addition, they could be noise sources if fluctuations exist. All of this is also applicable to oscillators. Q-factor sensitivity. As previously mentioned, the loaded Qfactor depends on the real equivalent resistor R resonance of the system {resonator + C t }, which is a function of C t , and on the quality factor Q of this system. But, what about Q versus C t ? Fig. 9 shows an approximation of the relative phasefrequency slope

D. Task 4: load impedance sensitivity

One can wonder about the influence of the mismatching of the bench with respect to the resonator impedance, in terms of resulting noise. This topic is obviously closely related to that of the series capacitor sensitivity onto the resonator impedance as well as to that of the power sensitivity through the drive level dependency or more simply the non linear amplitudefrequency effect.

E. Task 5: sensitivity of the resonator noise to the drive level.

The injected power into both arms of the bench is adjustable. Thus this makes possible to excite the tested resonators in a broad power range covering the operating range of those resonators in oscillators (typically a few tens of microwatts).

The correlation between noise and drive level, if it exists, could be established in such a way, for various types of resonators.

Nevertheless, one can notice that changing the power dissipated into the resonator induces changes of its inner temperature and changes of the temperature gradients, that is to say, as a consequence its resonant frequency (see § "B. Task 2: Thermal effect").

For high drive levels, a non linear effect, the so-called amplitude-frequency effect, also interacts on the frequency value.

When changing the power level, many possible causes of frequency drift and frequency disturbances have then to be considered (if possible!).

On very low drive level (typically -100 dBm), measurements of motional parameters will also allow continuing the investigations concerning the correlation between the drive level dependency (DLS) and noise of resonators [START_REF] Brendel | Low drive level sensitivity (DLS) of quartz crystal resonators[END_REF] V. CONCLUSION Since a few years, quartz crystal oscillators seem to have reached their limit in terms of frequency stability. They still are attractive for their volume, relatively low consumption in steady state, especially for space applications.

The goal of this program is to determine and understand the mechanisms responsible of current limitation of resonator noise in order to reduce their susceptibility and to evaluate their potentiality in a short and mean future.

To reach this goal, this program federates several major French and European entities.

Figure 1 .

 1 Figure 1. Measurement bench.

VoFigure 2 .

 2 Figure 2. Principle of the measurement bench.

Figure 3 .

 3 Figure 3. Typical phase noise result from two 5 MHz resonators under test.

  measured value at 1 Hz from the carrier gives the level of the resulting phase noise (

Figure 4 .

 4 Figure 4. On left: various resonator cases (HC40, HC12, 5 MHz BVA). On right: the lower part of one resoantor oven whose HC40 housing is visibly smaller than the 5 MHz BVA enclosure lied aside.

Figure 5 .

 5 Figure 5. Electrical model of a crystal resonator whose motional parameters are Lx, Cx and Rx. C0 is its parallel capacitor whereas Ct denotes the tuning series capacitor added to pull-up the overall resonant frequency.

Figure 6 .

 6 Figure 6. The coefficient t C k relating the relative frequency fluctuations and the relative tuning capacitor fluctuations, versus the capacitor value Ct.

Figure 7 .

 7 Figure 7. The modulus (in dB) and the phase of the equivalent impedance Z(f) of the network in fig. 5. At the resonance Z = Rresonance (the minimum value of the modulus) depends on Ct.

Figure 8 .

 8 Figure 8. An example of the relative change of Rresonance versus Ct. One easily understands that the more the fluctuations of Ct the more the implied fluctuations of Rresonance.

, 3 )Figure 9 .

 39 Figure 9. An example of the relative phase-frequency slope versus Ct, at the resonant frequency (which also depends on Ct).

I.

This program is supported by the French space agency CNES (Centre National d'Etudes Spatiales) of Toulouse. Contract # R-S06/LN-001-0005


István Marcell Fülöp

Péter Galambos
email: galambos@sztaki.mta.hu

Péter Baranyi
email: baranyi@sztaki.mta.hu

Semantic Intelligent Space for Ambient Assisted Living

Keywords: Intelligent space, ambient assisted living, semantic information, ontology, cognitive infocommunications, future Internet

Today, the research field of assisted living technologies is becoming more and more important. In this paper, an intelligent space framework is going to be presented which can be applied as a framework for assisted living. There are two beneficial properties which can improve the performance of the presented framework. The first is the use of semantic information which increases the flexibility and the autonomy of the framework so that it maximizes the collaboration possibilities between the entities of the intelligent space. The second is the relation to cognitive info-communications which makes it possible to use not only conventional channels in user interaction, but other alternative channels as well, i.e. to represent the user as a complex source and drain of several kinds of information. In this paper, it is described how these properties of the framework can be adopted in this special application field.

Introduction

Today, in the time of ageing societies, assisted living technologies are becoming more and more important fields of research. The Ambient Assisted Living Joint Programme of the EU [START_REF]Ambient assisted living joint programme[END_REF] supports half a hundred projects dealing with different aspects of AAL. These projects can be sorted in three main categories regarding the objectives: Prevention and management of chronic condition of elderly people (e.g. [START_REF]Domeo project -domestic robot for elderly assistance[END_REF]); Social interaction of elderly people (e.g. [START_REF]Elder spaces project[END_REF]); Independence of elderly and disabled people (e.g. [START_REF]AALuis -ambient assisted living user interfaces[END_REF]). Advanced technologies e.g. robotics, infocommunications, cogntive sciences or language technologies are all incorporated under the umbrella of AAL research. These technologies render really impressive results separately, however the real breakthrough seems to be far away. The high-level control of the devices is an advanced domain of AAL research. In order to realize high-level control, high-level autonomy at all levels of intelligence in devices is required as well as ergonomic methods for information-rich communication in efficient user interaction. In this paper, it is assumed that a general intelligent space framework can be fit to the special requirements of an ambient assisted living environment. In section 2, it is going to be presented, what kind of framework is needed and chosen for our purposes. Then in section 3 we present, what kinds of special requirements arise and how the general framework is extended in order to match these requirements. Section 4 describes, how the individual parts of the framework are realized, and how the different parts are related to each other. Section 5 gives simple application examples in order to show the capabilities of the framework. As a conclusion, in section 6 the capabilities of the applied technologies are evaluated.

2 Platform for connection

Physical connection

To provide a framework for the management of the intelligent space, where operations can be decomposed into configurations for the devices, the components of the framework, e.g. the wrapper components for the devices, the operation manager component, the component for user requests need to be connected together physically. The connection has to provide potential for the realization of the protocols between the components. The single components need to be added to and removed from configurations dynamically, in run time, e.g. if a wrapper component for a device is added or removed. The configurations of the components should be monitored and edited easily through some editor tool.

For these purposes, the RT-Middleware system seems to be a good solution. [START_REF] Ando | Rt (robot technology)-component and its standardization -towards component based networked robot systems development[END_REF] The RT-Middleware framework contains components, which are separate executable programs, running on computers connected to the internet. The components have their own data and service ports, which can be dynamically connected together with some editor tool. If the components of the intelligent space are considered, every component needs to have a representation of the space itself, i.e. the room, where the devices are located together with the user. It seems to be a good idea to create one common representation of the common space, and share this representation between the components. The common representation should contain all of the relevant information, e.g. the location of the single devices, the location of the user, other content of the space, which is available for all of the components.

For this goal, the VirCA platform based on RT-Middleware seems to be a better solution than RT-Middleware itself. [START_REF] Galambos | Virca as virtual intelligent space for rt-middleware[END_REF] The main feature of VirCA is virtual or real space management. The VirCA platform is based on RT-Middleware, VirCA components are RT-Middleware components as well, but the configuration of the components is different. In VirCA, there are three basic types of components. The first type is the virtual space itself, which provides space management, physics simulation, virtual objects and connection for cyber devices as real objects in the virtual space. The second type is cyber device, which is a wrapper for some real or simulated device, which can be placed in the virtual space in order to manipulate its content. The third type is the type of special components, e.g. input components for user input. The virtual space component handles basic user input as well as user output, i.e. the visualization of the virtual space.

In VirCA, different devices are not connected directly to the operation manager, but through the virtual space. The devices wrapped up into cyber devices together with the operation manager component are connected to the space manager component. Through the virtual space, components can send massages to each other. So, while cyber devices can dynamically be added to and removed from the virtual space, the devices can be connected to the operation manager through the services of the platform.

Logical connection

In the intelligent space for assisted living framework, the logical configuration of the components differs from the physical. The low-level physical configuration is intelligent space oriented. This is based on the concept of VirCA, where individual cyber devices can join a common virtual space in order to realize some collaboration. [START_REF] Galambos | Virtual collaboration arena: Platform for research, development and education[END_REF] The devices can collaborate in the sense that they are able to manipulate content that is common to the various components in virtual space. The devices can communicate through the VirCA platform as well, by sending messages to each other. The logical connection is based on this communication between components. [START_REF] Fülöp | Extending intelligent collaboration using semantic information in the virca system[END_REF] The operation manager component is connected through the virtual space with the wrapper components for individual cyber devices. Wrapper components are special cyber devices which cannot be manipulated directly by the user. On the one hand, they communicate with the operation manager in a pre-determined semantic form i.e., the operation manager can send requests to wrapper components, which would typically respond by sending back state information as well as information regarding request results (whether or not they were accepted and executed successfully) to the operation manager. On the other hand, they communicate with individual cyber devices using their normal language, i.e. they are typically used to emulate some user interaction. In order to function properly, wrapper components need to know the interaction protocol of each cyber device, as well as the specific events they need to trigger in order to perform some operation.

In the demo scenario, we were using cyber devices for humanoid NAO robots and industrial KUKA robots. The cyber devices had been developed formerly by developers of the 3D Internet based Control and Communication (3DICC) laboratory. We did not alter these cyber devices, but wrapped them up through separate wrapper cyber devices into semantic devices capable of being semantically controlled by the operation manager.

In contrast to wrapper components, the operation manager component is capable of directly communicating with the user. This can happen directly through the default input devices of the VirCA platform, e.g. the voice recognition component. The communication can happen through special input devices as well, which can be developed for special user needs. The special input devices use the standard input interfaces of VirCA. There is no restriction for their operation, as arbitrary input devices can be developed.

3 On the fly solutions

Matching of devices

If assisted living technologies are applied at the home of elderly persons, one possible solution is to replace the existing devices with intelligent ones, e.g. to replace a normal refrigerator with one that can keep track of what it contains, open its door automatically, etc. One other possible solution is to use the existing devices with other intelligent devices, e.g. mobile robots, which can use these devices designed for human usage, i.e. perform actions and motions like humans. If the latter possibility is chosen, then it also becomes necessary to develop devices that can play the role of the human user.

One other aspect is that applied devices cannot be standardized in the sense that devices may differ from household to household. Because of this, the concrete configuration for the execution of a given operation cannot be determined a priori. There is need for an operation manager service, which looks for the available devices in the intelligent space and gathers a list of their functionalities. If a request for an operation occurs, the operation manager tries to decompose the operation into parts in such a way that the parts can be performed by the available devices in the intelligent space. The operation manager component relies on the description of the capabilities of the devices. Because of the exponential number of possible configurations, it cannot be determined a priori that a single configuration will best suit some given operation. So, if a configuration is found, it has to be executed before it is possible to decide whether the configuration is operable or not.

If a configuration is found to be operable, only then is it confirmed for further use. If a configuration is not operable, the original descriptions of the devices are extended in order to prevent the future decomposition of the same operation into the same configuration.

In the demo scenario, a transportation problem is introduced. There are NAO and KUKA robots, which can transport the medicaments of an elderly woman, and the NAO robots can transport the stick of her. In the first demonstration, the medicaments need to be transported from one room to another, which cannot be solved by a single robot. For the solution of this problem, transportation chains are introduced. Not only one robot can transport an object from a starting to a destination point, but more robots in a chain as well. The first robot of the chain can transport the object from the starting to an intermediate point and so on, the last robot of the chain from an intermediate to the destination point. It can be inferred, to which points one after the other an object can be transported, and which robots one after the other are required for the transportations. This inference over the ontology representation with the help of some inference engine happens in the conceptual space, i.e. this universal intelligence is not bounded to the single devices. If the applied devices are replaced with other ones, the intelligence in the conceptual space remains the same.

Communication

The availability of individual devices in the intelligent space is also not known a priori. The operation manager should therefore scan for semantic wrapper devices on-the-fly and query the capabilities of the devices connected to them. The cumulative capabilities of the semantic intelligent space are as a result subject to constant change. The configuration of the space can be dynamically changed, devices can be inserted and removed. Because of the architecture of VirCA, communication does not need to be managed by the single components. If some device is added to the virtual space, it can be automatically addressed through VirCA.

VirCA can be considered as a space for knowledge sharing, "market of functions" as well. The single RT-Middleware components are not connected together directly, only through VirCA. Their knowledge is shared in a semantic form, which servers as the basis of the problem solving inference. VirCA helps to realize a collaboration between the devices connected to it in a non-semantic form. With the semantic extention introduced in this paper, this mediation between the needs and the capabilities can be enhanced.

Matching of ontologies

If semantic information is used for the description and the operation of devices, different devices can use different representations, i.e. different low-level ontologies can be applied for the same target scope. In this case, some kind of mediation is needed between the different ontologies in order to provide for efficient inference, i.e. to be able to resolve user requests.

The high-level VirCA core ontology can be extended with the low-level ontologies of individual devices. The special classes and properties of the low-level ontologies are inherited from the classes and properties of the high-level ontology. Two subclasses of two different ontologies can be identical, disjoint, intersecting or in a class-subclass relationship. The relationship between the two classes should be determined on the basis of the natural language description stored in their ontologies using conventional, non-semantic methods. User supervision is definitely needed in this process. The user can either choose from the proposition of the system or set the relationships manually. The results of this matching process are translator functions between the single devices and the whole ontology.

4 Build-up of the framework

Components

The framework for assisted living consists of two main parts, the components for the interaction between the user and devices, and the components for ontology management. [Fig. 1] The components of the former part are standard components in the VirCA platform, which are connected to the VirCA core component through standard interfaces. The interaction with the devices connected to VirCA happens through the wrapper components which establish a semantic connection between the single devices and the operation manager component. The wrapper components have two main functions: they forward operation requests from the operation manager to the device and send back state updates from the device to the operation manager. The interaction with the user happens logically through the operation manager component, but the operation manager has no own physical interface to the user. Therefore, the user can either use the visual interface of the VirCA core component to pass on user requests through the menu system, or use other arbitrary input components, e.g. speech recognition, which establish a semantic connection between the user and the operation manager. In the reverse direction, the operation manager can use either the built-in functions of VirCA to send information back to the user, or other arbitrary output components, e.g. emotion display, which are in physical connection with the user. The operation manager component has four main functions: on the one hand, it receives user requests from the user through input devices and sends back information about their execution through output devices; on the other hand, it sends operation requests to the devices and receives back state updates from them.

The connection between the platform of intelligent space and cognitive infocommunications (CogInfoCom) is established in such a way that the information flow through the input and output devices is extended with non-verbal information as well. [START_REF] Csapó | An application-oriented review of coginfocom: the state-ofthe-art and future perspectives[END_REF] In the conventional approach, some representation of verbal information is communicated between the user and the components, e.g. image of text, sound of speech, including some simple matchings, e.g. clap means turn the light on, ring means cooling water is too hot, etc. In the CogInfoCom approach, input devices are applied to retrieve more information from the user while output devices are applied to pass on more information to the user. [Fig. 2] The non-verbal information is not directly related to the verbal information. For instance, in the case of voice recognition, besides the recognition of the command, the sound tone of the user can also be processed and information related to the emotions of the user can be forwarded to the operation manager. In the case of free text voice recognition, based on the method of dictionaries for different styles, the information related to the style of the user can be forwarded as well. [START_REF] Fülöp | Emotion dependent dialogues in the virca system[END_REF] Back to the user, output devices can communicate non-verbal information as well based on the state not of the single devices, but the whole system. The operation manager matches the output devices with the dimensions of the system state based on the capabilities of the devices. The connection between the abilities and state updates of the devices, the state updates of the virtual space, the user requests and the user feedbacks is established in the ontology, the decomposition of the needs into operation of the single devices happens in the ontology based on the state of the whole intelligent space together with the devices. Therefore, an ontology manager component is required as an active element which manages the updates and retrievals of information, inference on the instances and special actions. The operation manager component is connected to the ontology manager component. The operation manager sends state updates, device descriptions, user requests and other user inputs to the ontology manager together with retrieval triggers, i.e. what kind of information is expected as a result. The ontology manager sends back operation requests, user feedback and other user output to the operation manager. The functions of the operation manager and the ontology manager are not logically separate, the two components are two interfaces of one logical unit. It is rather so that the operation manager is more VirCA oriented while the ontology manager is more ontology oriented.

In the demo scenario, the VirCA core itself, the cyber devices for the robots, the wrapper components and the operation manager are standard Windows executable RT-Middleware components, while the ontology manager component is a Java executable RT-Middleware component, as it uses the Protege-OWL Java API to access the ontology. In the state of the development, some facts are inserted manually into the ontology, e.g. the need that the human useran elderly woman -should take her medicaments and the capability that she can walk only with her stick. The capabilities of the robots are inserted as well concerning the transportation of the objects. Based on the facts in the ontology, an inference is made in order to find possible solutions. The ontology manager scans the ontology for transportation actions, which are needed to be and can be performed as well. If such an action of transportation is found, the ontology manager instructs the operation manager to perform the action. The operation manager instructs the single wrapper components of the robots, which translate the commands to the own "language" of the cyber devices. After the operations had been performed, the wrapper components send back state updates to the operation manager, which forwards them to the ontology manager, which updates the ontology based on them.

Ontology

For the ontology representation, the OWL-DL of OWL 1.0 was chosen, because it is expressive enough for usage, but still simple enough for inference. For some general framework for editing and inference, the Protege platform was chosen, because its very user and developer friendly operation. [Fig. 3] The OWL-DL representation was extended with the use of first order logic in the form of SWRL rules, with the help of which effective inference can be realized over the ontology. For this inference, the Jess rule engine was chosen, which can easily be integrated with the Protege platform. [Fig. 4] In the state of the development, the inference was performed in the Protege platform itself, then the result was saved into the ontology, which was scanned by the ontology manager component.

The ontology of the framework for assisted living consists of the general VirCA-core ontology on the one hand and of a human ontology developed for assisted living on the other. The VirCA-core ontology is applied for the matching of operation requests and suitable devices, i.e. the decomposition of high-level user requests into low-level tasks, which can be performed by the devices available in the intelligent space.

Therefore, the VirCA-core ontology contains concepts for processes, which can be required by the user and which can be performed by the devices. [Fig. 5] The former is expressed with the concept of need related to some process and agent, and the latter is expressed with the concept of ability related to some process and agent. Based on the a priori information stored in the ontology about the devices which are available at the moment, an on-the-fly decomposition of the user request can be performed. The solutions of this decomposition are process configurations. If there are possible solutions, the appropriate configurations will be connected to the concept of the need as possible solutions of the user request.

The human ontology developed for assisted living contains concepts for the description of the mental, emotional and intentional state of the user. For this, the concept of attitude is introduced, which represents the relation of the agent towards some arbitrary object. The attitude can represent some knowledge, assumption, belief of the user towards some expression, which is some proposition about entities of the target scope. The attitude can represent emotions of the user towards entities of the target scope. Emotions can be basic emotions, such as joy, sadness, anger and fear, but can also be higher-level, complex emotions based on lower-level emotions. The attitude can represent intentions of the user towards some change of the virtual space. From these intentions, specific requests of the user can be derived, but not every abstract intention leads to a specific request, and any specific request can be the result of several single intentions.

In the demo scenario, the capabilities were represented that the KUKA and NAO robots could transport the medicaments, and the NAO robots could transport the stick of the elderly woman in their workspace. The need of taking the medicaments and the walking capabilities of the elderly woman were represented as well together with the priorities based on the instructions of the doctor concerning the amount of walking of the lady. The representation was extended with the possibilities of chain transportation, i.e. whether more robots can transport some object through intermediate places.

Application example

For the presentation of the capabilities of the system, a simple demo scenario was compiled. [Fig. 6] In the scenario, the location is a flat, where there are stairs between two rooms, which have an offset of height. There are two humanoid NAO robots in the scenario, one in the "upper" room and one in the "lower" room, which can transport light objects in their hands. Unfortunately, the NAO robots are not smart enough to climb the stairs, because it requires too complex algorithms. For that very reason, there are two industrial KUKA robot arms at the stairs, which can grip small objects and transport them between the two floors of different height, i.e. between the two rooms.

In the scenario, the human -who is attended by the intelligent space -is an elderly woman, who is found in the upper room. The situation is, that she should take her medicaments at a formerly defined time. The medicaments are located in the lower room. The NAO robots and the KUKA robots can transport the medicaments as well, so they can be transported to the old woman, if it is required. The capabilities of the elderly woman are represented, e.g. she can walk only with a stick. The sanitary instructions of the family doctor of the elderly woman are represented as well, e.g. whether she should walk a little with a stick or rather not walk at all.

If it is time for the elderly woman to take her medicaments, the system infers that the elderly woman and her medicaments need to be at the same place. If the doctor instructed the elderly woman not to walk, the systems infers that the medicaments need to be transported to her. But if the doctor instructed her to walk a little, the system infers that she needs to walk to the medicaments. Based on the fact that the elderly woman can walk only with a stick, in the latter case, the system infers that her stick needs to be transported to her. The stick is found in the upper room, but at a different place.

In the scenario, the facts are inserted that the NAO and the KUKA robots can transport the medicaments of the elderly woman, and the NAO robots can transport the stick of her. The locations of the robots, the medicaments, the stick and the elderly woman are inserted as well. The single robots alone cannot transport the medicaments to the lady as the NAO robots cannot climb the stairs, but the inference can be made in the conceptual space that a transportation chain can be constructed of the single robots, i.e. the NAO robot in the lower room can transport the medicaments to the stairs, one of the KUKA robots can take them from the bottom of the stairs and put them to the top, so finally the NAO robot in the upper room can transport them to the lady.

In the first demonstration, we insert the fact that the doctor forbids the lady to walk too much, and the fact that she should take her medicaments. It is inferred that the medicaments need to be transported to the lady, and a chain of the NAO and KUKA robots can transport them to her. Based on this result, the ontology manager component instructs the operation manager to perform the chain of transportation, so the operation manager instructs the single robots of the chain the perform their single actions. Therefore, the medicaments are finally transported to the lady.

In the second demonstration, we insert the fact that the doctor instructs the lady to walk, and the fact again that she should take her medicaments. It is inferred that the lady should walk to the medicaments, her stick need to be transported to her, and a NAO robot can transport it. Based on this result, the ontology manager component instructs the operation manager to perform this transportation, so the operation manager instructs the NAO robot to perform the action. Therefore, the stick is finally transported to the lady.

Conclusion

The intelligent space approach presented in this paper was successful in the sense that the general intelligent space platform could be adopted to the special requirements of assisted living. The use of semantic information demonstrated that in the case of dynamic, on-the-fly solutions, the semantic extension can enhance the current system performance and intelligence. In the field of cognitive infocommunications, further researches would be needed to determine what kind of alternative communication channels could enhance the use efficiency and ergonomy. The possibility is still there to apply the results of these future research in the intelligent space framework.

Fig. 1 .

 1 Fig. 1. Architecture of the framework.

Fig. 2 .

 2 Fig. 2. Cognitive info-communications channels.

Fig. 3 .

 3 Fig. 3. Inferred properties of the instances in the Protege editor.

Fig. 4 .

 4 Fig. 4. Running the Jess inference engine in the Protege editor.

Fig. 5 .

 5 Fig. 5. Semantic decomposition of an action.

Fig. 6 .

 6 Fig. 6. Demo scenario in the RT-Middleware editor.

Acknowledgment

The research was supported by the Hungarian National Development Agency, NAP project, (NAP-1-2005-0021, KCKHA005, OMFB-01137/2008).


Ákos Ludányi
email: akos.ludanyi@aut.bme.hu

Tamás Lukovszki
email: lukovszki@inf.elte.hu

Péter Ekler
email: peter.ekler@aut.bme.hu

Simulating network coding for accelerating Tit-for-Tat in peer-to-peer content sharing 1

Keywords: network coding, P2P, deterministic network coding, content sharing, network simulation

The deterministic network coding has several advantages over random network coding methods, like lower communication overhead and faster linear independence check. We would like to create a P2P content sharing simulation environment, where nodes communicate with deterministic network coding to observe the different properties of deterministic source coding. Our simulator is based on the Peersim generic P2P simulation framework. We examine the diversity of block combinations, as this property is the key for increasing the P2P network reliability.

Introduction

In network coding the nodes sends linear combinations of data. This technique has several benefits: better bandwidth usage, faster download speed, increase fault tolerance, etc. For accelerating tit-for-tat piece exchange in BitTorrent like systems Locher et al. [START_REF] Locher | Rescuing Tit-for-Tat with Source Coding[END_REF] proposed special network coding at the seeders. The deterministic network coding was introduced in [START_REF] Balaton | A new deterministic source coding method in peer-to-peer systems[END_REF] as an alternative solution. The authors used special coding vectors, such that any M different coding vectors form a Vandermonde matrix, where M is the number of blocks in a segment. It is a well-known property of a Vandermonde matrices over field (finite or infinite) is that those Vandermonde matrices are non-singular (see e.g. [START_REF] Mcwilliams | The Theory of Error-Correcting Codes[END_REF] Ch. 4 Lemma 17), i.e. after receiving M different coded blocks the decodeability is guaranteed. We would like to create a P2P content sharing simulation environment to measure the different properties of deterministic network coding.

Related work

Network coding is typically used in systems where robustness is a key requirement. This technique allows handling the failures of nodes and links efficiently. In [START_REF] Chou | Practical Network Coding[END_REF] the authors propose a distributed scheme for practical network coding. The result of their research is a practical system for network coding that is robust to random packet loss and delay as well as robust to any changes in the network topology or capacity due to joins, leaves, node or link failures, congestion, and so on. Another researches [START_REF] Roetter | An algebraic approach to network coding[END_REF][START_REF] Li | Linear network coding[END_REF] focuses on linear network coding, they have proven that linear coding suffices to achieve the optimum in multicast environments.

In order to bridge theory with practice, in [START_REF] Chou | Practical Network Coding[END_REF] the authors discuss about practical issues and proposed a distributed scheme that does not need centralized need knowledge of the network topology. They showed that the proposed new architecture for wireless mesh networks largely increased network throughput. Another research [START_REF] Fitzek | Cooperation in Wireless Networks: Principles and Applications[END_REF] shows different ways of cooperation in large network environment, where network coding can also be applied efficiently. In our research we focus on deterministic network coding and we propose a simulator that can be used in different measurements and research areas.

Simulation environment

For our simulation we have used PeerSim [START_REF] Peersim | [END_REF], which is an open source simulator. We have done some simulations to test, weather our tit-for-tat implementation is working as expected in our simulator. There were 1000 nodes in the network. The upload bandwidth of a node was randomly determined by Gaussian distribution with 5 block/sec expected value and variance 4. The maximum download speed was 20 block/sec. There were 8 segments each segment consisted of 8 blocks. The coding was done over , where 2 1 (the largest 31 bit prime). We have measured the elapsed time between the first block arrival and the last block arrival. With tit-for-tat, we expect that peers, which uploaded more, will receive segments faster. On Fig. 1. b), we can see the average block download time as a function of upload blocks. As one would expect, nodes, which uploaded more, are usually downloading faster. The number of samples line shows, how many nodes have uploaded the given amount of blocks. As the number of samples decreases, the average download time becomes noisier.

A segment consists of M blocks. We send linear combination of blocks to other nodes, the combination is described by the coding vector. To retrieve the original data, a node needs exactly M linearly independent blocks. As discussed in [START_REF] Ekler | Extending mobile BitTorrent environment with network coding[END_REF] rare block problem can occur in BitTorrent (that does not combine blocks), the authors suggested using network coding to avoid the problem. This way, the number of possible coding vector is exponentially increased, so the possibility of a rare piece is significantly decreased, by using more distinct coding vectors. Note that we only require any set of M linearly independent block for decoding.

Assume the segment consists of N blocks, let T denote the number of different block combinations. We assume that the blocks are distributed uniformly at random in the network, each block has the same frequency. Let p be the probability that (all instances of) a block combination becomes unavailable in the network. Then if at most N-1 different block combinations are available in the network, the nodes will not be able to reconstruct the original data. Let P be the probability of the event that nobody can reconstruct the original data. Then:

∑ 1 . (1)
P is binomially distributed. It is well known if N is large enough the binomial distribution can be approximated with normal distribution: , 1 . The tail of this distribution decreases exponentially if T increases. Fig. 2. a) shows, how P decreases, when the diversity (T) is increased. When (this is also the case without network coding), if a single block disappears from the network, the file can not be downloaded anymore. In our simulation 20. By increasing the diversity, we see that even if p is a (high) constant (0.5), 4 results in a system, where the peers almost surely can reconstruct the file. Our simulations support this dependence.

Using RLNC [START_REF] Ho | A Random Linear Network Coding Approach to Multicast[END_REF] based network coding a node can recombine the received blocks, and forward them to other nodes immediately, thus probably increasing the number of different coding vectors in the network. On the other hand the deterministic network coding cannot recombine the received data immediately, because the sum of two rows from the Vandermonde matrix is not a valid row of any Vandermonde matrix. So a node has to wait till it can decode the data. However, until the node cannot decode, it can still forward the received blocks without recombining them, unfortunately the diversity of blocks in the network will not increase. We have created a simulation environment, for measuring the diversity of coded blocks in the network. In the simulation each node was connected randomly to other 5 nodes. We used a single segment for measurement. The network consisted of 1000 nodes, the examined segment consisted of 20 blocks. As the number of seeders increases, the diversity is also increasing. We can say the connection between them is linear.

Conclusions and future work

We have created a P2P content sharing simulator that uses deterministic network coding based on a well-known P2P simulator framework. We have simulated how the diversity is affected by deterministic network coding. Currently all nodes stay active during the simulation, we are planning to measure, how the diversity is influenced, when nodes leave the network.

Fig. 1 .

 1 Fig. 1. a) Segment finish timing histogram b) average segment download speed as a function of uploaded blocks

Fig. 2 .

 2 Fig. 2. a) P as a function of T, 20 b) Diversity of combined blocks in the network as a function of time.

Acknowledgment: This work is connected to the scientific program of the " Development of quality-oriented and harmonized R+D+I strategy and functional model at BME" project. This project is supported by the New Hungary Development Plan (Project ID: TÁMOP-4.2.1/B-09/1/KMR-2010-0002, TÁMOP-4.2.1/B-09/1/KMR-2010-0003).


Zoltán Czirkos
email: czirkos@eet.bme.hu

PhD Gábor Hosszú
email: hosszu@eet.bme.hu

Enhancing Collaborative Intrusion Detection Methods Using a Kademlia Overlay Network

Keywords: peer-to-peer, intrusion detection system, collaborative intrusion detection, attack correlation, attack aggregation

The two important problems of collaborative intrusion detection are aggregation and correlation of intrusion events. The enormous amount of data generated by detection probes requires significant network and computational capacity to be processed. In this article we show that a distributed hash table based approach can reduce both network and computational load of intrusion detection, while providing almost the same accuracy of detection as centralized solutions. The efficiency of data storage can be improved by selecting Kademlia as the underlying overlay network topology, as its routing can easily adapt to the dynamic properties of such an application.

Introduction

In the early days of the Internet, all communication was built upon trust among users. However, with e-commerce emerging and the number of hosts connected to the network increasing to tens and hundreds of millions, serious security concerns came into prominence: sensitive information stored on-line makes hosts a target for a wide range of attacks.

Attacks, being both manually and automatically controlled, have become ever more sophisticated, originating from multiple entities or targetting multiple hosts. Various worm programs replicate themselves to spread malicious code to vulnerable systems, or scan network nodes to find vulnerabilities. Others compromise hosts of home users to build botnets, to deliver spam e-mail to addresses collected from the web or other infected users' mail applications or to carry out distributed denial of service attacks. These are usually referred to as large-scale coordinated attacks. Sophisticated attacks are generally problematic to detect as the pieces of evidence are spread across multiple hosts. In order to recognize such attacks, one has to aggregate (collect) the evidence as well as correlate (analyze) the pieces collected from different subnetworks. This poses various communication related problems.

In this paper we present a distributed intrusion detection system, which organizes its participants to a peer-to-peer (P2P) based distributed hash table (DHT) using the Kademlia topology [START_REF] Czirkos | Novel Applications of the Peerto-Peer Communication Methodology[END_REF]. This overlay network is used to store intrusion detection data with balancing the load of storage of intrusion data and correlation of events amongst its nodes. The network traffic generated by the system is considered, and the implications of using different DHT topologies are discussed.

The rest of this paper is organized as follows. In Section 2, we first review existing research of distributed intrusion detection systems. We present the architecture of our distributed intrusion detection system based on the Kademlia DHT in Section 3. The results of the intrusion detection method and statistics of detection are highlighted in Section 4. Research is concluded in Section 5.

Related Work

Attackers, having different goals, use various approaches for intrusion of computer network systems. These leave different tracks and evidences, called the manifestation of attacks [START_REF] Kemmerer | Intrusion detection: a brief history and overview[END_REF], and require different methods to detect. In the following, the terms below are used for discussion [START_REF] Debar | Aggregation and Correlation of Intrusion-Detection Alerts[END_REF]: Attacks Real intrusion attempts, which are used to gain access to a host or disturb its correct functioning. Events Primary intrusion detection data generated by probes. These events are not necessarily attacks by themselves, but can be part of a complex attack scenario.

Several types of large-scale attacks can only be detected by collecting and correlating events from a number of detector probes. The collection of evidence has to be extended to primary events as well. To achieve this, various collaborative intrusion detection systems (CIDS) have been proposed, for which an extensive overview can be found in [START_REF] Zhou | A survey of coordinated attacks and collaborative intrusion detection[END_REF].

Centralized and Hierarchical Approaches

The earliest collaborative detection systems were centralized. The advantage of centralization is that a single server receives and processes all data that can be gathered, e.g. it has all the information necessary to recognize the attack. However, the approach has two disadvantages: scalability and having a single point of failure (SPOF). The high amounts of data to be collected and correlated cannot be handled for large networks by a single server. Moreover, this correlation server is a possible target for shutting down the entire intrusion detection system. The Internet Storm Center DShield project collects firewall and intrusion detection logs, either automatically or by manual upload from users. The log files are then analyzed centrally. The NSTAT system [START_REF] Kemmerer | Nstat: A model-based real-time network intrusion detection system[END_REF] is more advanced in the sense that it is automatic and real-time. In this system the detection data is filtered and preprocessed before being sent to a central server for correlation, as seen on Figure 1. The order of events are then analyzed using using a state transition mechanism with predefined scenarios.

Correlation can be carried out by using various methods. SPICE [START_REF] Valdes | Probabilistic Alert Correlation[END_REF] and CIDS [START_REF] Zhou | A Peer-to-Peer Collaborative Intrusion Detection System[END_REF] group events by their common attributes. The LAMBDA [START_REF] Cuppens | LAMBDA: A language to model a database for detection of attacks[END_REF] system aims to fit detected events, which are described using a common language, into pre-defined and known scenarios. The JIGSAW system [START_REF] Templeton | A requires/provides model for computer attacks[END_REF] maps prerequisites and consequences of events in order to find out their purposes.

The DOMINO system can be used to detect worm activity. It is built on an unstructured P2P network with participants grouped into three levels of hierarchy [START_REF] Yegneswaran | Global intrusion detection in the domino overlay system[END_REF]. The nodes on the lowest level generate statistics only hourly or daily, so they induce small network traffic.

The PROMIS protection system (and its precedessor, Netbiotic) uses the JXTA framework to build a partially decentralized overlay network to share intrusion detection data [START_REF] Vlachos | A PRoactive Malware Identification System based on the Computer Hygiene Principles[END_REF]. The nodes of this system generate information for other participants about the number and frequency of detected events. This information is used to fine-tune the security settings of the operating system and the web browser of the participants. While this method creates some level of general protection against worms, it also decreases the usability of the systems.

The Indra system is built on the assumption that attackers will try to compromise several hosts by exploiting the same vulnerability [START_REF] Janakiraman | Indra: A Peer-to-peer Approach to Network Intrusion Detection and Prevention[END_REF]. If any of these attempts get detected by any participant of the Indra network, others can be alerted. Participants of this system can therefore enhance their protection against known attackers, rather than developing general protection.

Intrusion Detection Based on P2P Networks

The scalability and SPOF problems of centralized solutions can be solved by using structured P2P application level networks [START_REF] Androutsellis-Theotokis | A survey of peer-to-peer content distribution technologies[END_REF]. These enable one to reduce network load compared to the hierarchical networks presented above.

The CIDS system [START_REF] Zhou | A Peer-to-Peer Collaborative Intrusion Detection System[END_REF] uses the Chord overlay network [START_REF] Stoica | Chord: A scalable peer-to-peer lookup service for internet applications[END_REF] for implementing a publish-subscribe style application. Nodes of this system store the attacker IP addresses in a list, and they subscribe in the network for events of these addresses. If the number of subscribers to a given IP address reaches a predefined threshold, they are alerted of the possible danger. The Chord network ensures that the messages will be evenly distributed among the participants. However, the instability of Chord under churn [START_REF] Krishnamurthy | A statistical theory of chord under churn[END_REF], and IP address blacklist being the only correlation method used in CIDS does not allow its wide deployment.

The Komondor System Architecture

In this section we present our novel intrusion detection system named Komondor. The most important notion of this system is that it uses the DHT named Kademlia [START_REF] Maymounkov | Kademlia: A Peer-to-peer Information System Based on the XOR Metric[END_REF] to store intrusion data and to disseminate information about detected intrusions. The purpose of the overlay is the efficient detection and quick dissemination of alerts: when the analyzing of the collected events indicates the fact of an attack, the Komondor nodes start an alert procedure notifying other nodes of the possible danger.

Distributing Load Among Multiple Correlacion Units

The Komondor application level network consists of multiple nodes. All nodes have the responsibility to collect and correlate intrusion data and to report attacks discovered to other nodes of the network. This means that all participants of the Komondor network can serve as intrusion detection units and correlation units as well. When replacing the central correlation server with a number of correlation units, care must be taken to ensure that:

pieces of intrusion evidence which are correlated must be sent to the same correlation unit, so that it can gather all the information about the attack, and that pieces which are part of different ongoing attacks should preferably be sent to different correlation units.

The latter balances load among the units and improves the overall reliability of the system. Komondor achieves the above by assigning keys to preprocessed intrusion data, as seen on Figure 2. Keys are used as storage keys in the DHT. For different attackers or attack scenarios, a different key is generated, and data is therefore stored at different nodes. Pieces of evidence which might be correlated to each other must be assigned the same key, and by that sent to the same Komondor node for correlation.

The Komondor system has a middle layer inserted into the intrusion detection data path shown on Figure 1. The nodes of the DHT act as correlation units, which can implement the same correlation methods as their centralized versions. However, correlation starts as soon as the preprocessing stage, where events are tagged with a key in conformance of the correlation method used, and the key is used for sending the attack report to the correct correlation unit.

The structured overlay therefore has the advantages of distributed and centralized detection systems as well. Event data collected is generally sent to a Fig. 2. Distributed collection and distributed correlation of intrusion evidence from various probes. The Komondor system assigns keys to pieces of evidence so that data can be stored efficiently in a distributed hash table. By using these keys, computational load of correlating can be distributed among several units.

single collector node only (this would not be possible with an unstructured overlay, as those cannot have global rule to map a key to a node.) Moreover, when Komondor nodes are under multiple but independent attacks, the network and computational load of both aggregation and correlation is distributed among nodes. The system has no single point of failure, as the overlay will reconfigure itself when a node quits or becomes unreachable. The structured overlay can also be used to disseminate other type of information as well, for example the attack alerts which enable node create protection.

Selection of Keys in the Komondor System

The accuracy of detection, also network and computational load balancing depends on the proper selection of keys. Detection efficiency can be increased by assigning more keys, and sending evidence to multiple correlation units, should an event be suspected to be a candidate for being part of different attacks or attack scenarios. However, every subsequent key assigned increases network load as well.

In order to select the correct keys, the inner working of correlation methods has to be known. For every attack method and scenario, a different key selection mechanisms are feasible. Consider the network scan types, as categorized in [START_REF] Yegneswaran | Global intrusion detection in the domino overlay system[END_REF]:

Horizontal port scan Different hosts are scanned by a attackers, but the port number is the same. In this case, a blacklist of attackers can be built using the collection and correlation of detected attempts. The key for collection of events should be the identifier of the vulnerability. Vertical scan A single host is under attack. The attack originates from a single host, too. If this is the case, the attacker is known and hosts can protect themselves against it, should it try to attack another host to be protected.

The key is the IP address of the attacker.

Mixed mode scan Multiple attackers use their network capacity to launch an attack against a single host or a subnetwork. This is the usual scenario for the DDoS (distributed denial of service) attacks. The key for the evidence storage in the DHT in this case is the subnetwork address attacked. By analyzing the data collected in this scenario, hosts can automatically detect the fact of the network scale attack, e.g. they can discover that the problem is not only related to a single host but a complete subnetwork or organization.

Kademlia as the DHT Topology of Komondor

The nodes of Komondor create a Kademlia based DHT overlay network. This is the topology, which can adapt its routing tables to the dynamic properties of traffic generated by the intrustion detection module. Event data stored in the overlay can generate significant overlay traffic that may load nodes along the path from the detector to the correlator node as well. However, if the events are in correlation with the same attack, the key is likely to be the same. The distribution of keys in store messages is therefore highly uneven. By using Kademlia, network traffic can be significantly reduced in this scenario. The reason for this is that any arbitrarily selected node can be inserted to the routing tables of any other Kademlia node while still conforming the rules of the Kademlia protocol. Routing tables of other DHT overlays like CAN or Chord are much more rigid, and therefore the routing algorithm of those cannot optimize store requests with the same key sent in a short time.

Table 1 compares the number of messages generated by the intrusion detection. In Chord, messages are forwarded by helper nodes in the overlay along the path from the source to the destination of the message. On the other hand, in Kademlia the storing of a key; value pair by a node is started by first looking up the IP address of the destination node by successively querying nodes closer to the destination. After finding out its address, data is sent directly from the source and the destination. This also implies that the key; value pair to be stored (e.g. the payload of the message) is contained in every message of Chord, and only in the last message of Kademlia.

To store a detection event in Chord, the number of messages generated in the overlay would be in the order of log 2 N , where N is the size of the overlay. For Kademlia, the looking up of the address of the destination also takes log 2 N messages. The payload requires one more message (+1). However, if multiple events have to be stored which are detected by the same probe, the lookup procedure can be optimized away, as the key and therefore the collector node is the same, too. For sending data of n events, the number of messages generated is only n + log 2 N for Kademlia and n • log 2 N for Chord, which is worse at the factor of n for the latter one. The limit of messages per event will drop to 1 for Kademlia in this scenario.

Overlay Services Used by Komondor and the Effect of Churn

The Komondor system uses no data lookup in the DHT as other applications do, only the data store mechanism is used. Stored events are never looked up, rather the node storing them has to process incoming events to recognize attackers. The collector nodes have the responsibility to start a broadcast if an attack is recognized. The topology of the overlay can be used to send the broadcast message to all nodes in a time frame that is logarithmically proportional to the size of the overlay network [START_REF] Czirkos | Peer-to-peer Based Intrusion Detection[END_REF].

As with other P2P systems, node churn can degrade the performance of the application: detection accuracy might decrease in the event of a collector node disappearing from the overlay network. However, considering the typical key patterns generated by attacks and used in the intrusion detection, the effect of churn can be minimized for the case when a node deliberately and gracefully quits the overlay network, or when a new node appears in the system.

A node intending to quit might store intrusion detection data, which must be transferred to its neighbors before leaving the overlay. As the unhashed keys of the events are known by this node, it can recalculate the distance of the keys to other known nodes in the NodeID address space, and remap them to other nodes in the system, as described in [START_REF] Karger | Consistent hashing and random trees: distributed caching protocols for relieving hot spots on the world wide web[END_REF].

The keys remapped might originate from different nodes. Those nodes, having looked up the IP address to the node currently quitting, have cached that information for the lookup request optimization. As the node currently quitting is the closest node to those keys, the source nodes of these events must be notified, in order to inform them that the IP address of the quitting node is to be cleared from the cache. A new lookup request is to be started by them before sending any further data.

The same procedure can be applied to newly joined nodes. As described in [START_REF] Maymounkov | Kademlia: A Peer-to-peer Information System Based on the XOR Metric[END_REF], new nodes are put into the routing tables of their closest neighbors. These must recalculate the distance of their stored events' keys to the NodeID of the new node. If any of those are closer to the new one, the key must be remapped, and the source node of those events must be notified to send data to the newly joined node rather than the one previously cached for that key.

Results and Discussion

In this section we present statistics of intrusion attempts detected using the implemented Komondor system. The statistics are evaluated to show, which types of attacks this system can be used to detect.

Network and Computational Load Balancing

The Komondor reference implementation used a similarity based correlation method, using the source IP address of offending packages as a key. The primary events were detected by three probes on participating hosts: (I) the opensource Snort intrusion detection system [START_REF]Snort -open-source intrusion detection system[END_REF], (II) a built-in module of Komondor which examined the operating system log files, (III) the packet log of the firewalls of the systems. We selected common event types from the Snort database and also tagged events with a severity level in the interval [0; 10]. Intrusion alert was triggered when the sum of scores reached the predefined threshold level 10. (An attack of severity level 10 immediately triggers a response alert.) Receiving the alert instructed the participant nodes to automatically block the attacker through their own firewalls, which were configured to log dropped packets as well. This method enabled us to determine the efficiency and reliability for known attack types presented here, and also to estimate the ratio of attacks, which were continued by the attackers even after the Komondor system having noticed their activity. Figure 3 shows invalid passwords detected for SSH login attempts on various hosts. Every dot on the graph is an individual attack, e.g. it represents one or more event that originated from a single IP address. The y axis shows the number of events or the number of invalid passwords detected. The duration of an attack is the time interval between the first and the last event detected, and seen on the x axis. Several attackers were detected by multiple Komondor probes, because the SSH worm that intended to gain access to the subnetwork tried to login all hosts it found. Attacks which were only detected by one probe are shown in the left hand side graph, and attacks detected by multiple probes in the right hand side graph. Attacks detected by multiple probes usually suggest automatic worm programs using dictionary attacks.

This experience suggests that distributed intrusion detection can benefit from the advantages of DHTs. As multiple hosts were attacked, by recognizing an attacker at any node of the Komondor network, several hosts can be protected at the same time. Moreover, as attack evidence came from multiple probes, one attack is likely to be associated to thousands or tens of thousands of events, which must be stored and processed in the distributed detection system. This type of load can be handled by a DHT fairly well.

Network Cost of Intrusion Detection

Intrusion attempts issued against a host generate network traffic, regardless their success or failure. For example, for an SSH login attempt, the victim of the attack has to answer the request: a TCP connection is negotiated, encryption keys are exchanged etc. When collaborative intrusion detection is used, sharing intrusion data will also increase the unnecessary trafic, making legitimate connections less responsive. Therefore, the network traffic induced by the intrusion detection system should be kept down to a minimum.

Table 2 shows measured traffic rates for SSH worm attacks, and the response traffic of Komondor hosts. For the tests, we used SSH-2.0-OpenSSH_5.5 on the server side, SSH-2.0-OpenSSH_5.8p1 on the client side, and WireShark 1.6.2 packet capture software for packet inspection and statistics generation. The SSH server software was configured to abort connection on every third invalid login attempt, which means that attackers must reconnect the server on every third tested password. As Table 2 shows, every tested password costs the attacker 1518 bytes of traffic on the wire (i.e. including packet headers), and it costs the victim 1140 bytes.

The traffic generated by Komondor will also load the victim's network. The estimations here are calculated for an overlay of 2 10 = 1024 nodes. The Kademlia version of Komondor will initiate a node lookup on the first attack event detected. After the lookup is completed, each stored attempt only cost the overlay 103 bytes of traffic in our measurements. This optimization could not be achieved using Chord or CAN or other overlay topologies with rigid routing networks. Our estimation is that storing an attack event would cost the overlay 1030 bytes (on each event), if we would have used Chord for storage. The optimization of lookup requests greatly reduces the traffic generated by the overlay. Actual packet sizes, of course, would depend on the exact size of the overlay, as well as the exact type of attack information to be stored.

Efficiency of Detection and Protection

Table 3 shows various attack types and the efficiency for the Komondor system regarding protection. The types listed are as follows:

php-my-admin This shows the activity of a worm scanning for open MYSQL administration web interfaces. cyberkit-ping ICMP packets generated by the CyberKit Windows software [START_REF] Duffield | Rule-based anomaly detection on ip flows[END_REF]. sql-overflow Infection attempt by the Slammer worm [START_REF] Moore | Inside the slammer worm[END_REF]. sshd-* Various login attempt failures detected by the OpenSSH software: broken connections (port scans), failed passwords for existing users and login attempts with invalid user names. vsftpd-fail-login Invalid login attempts on the FTP servers.

The protection column shows the number of attacks for each type, for which the attack continued after it was blocked on the firewall, and the activity of the attacker was detected by another Komondor node of the same subnetwork. For these attacks, the collaborative intrusion detection can greatly enhance the protection of hosts.

The usefulness of the collaborative detection provided by the Komondor system varies with the approach used by the attackers or worm software in question. The Slammer worm randomly generates IP addresses to be attacked, and therefore it is highly unlikely that the same worm instance will attack two nodes of a Komondor network in a short timeframe. On the other hand, a port scan can usually be detected by many hosts on the same subnetwork using this method.

Conclusions

Attacks on the Internet are a constantly growing problem. To detect sophisticated attacks promptly and correctly, intrusion data must be collected and analyzed automatically. In this article we have presented the Komondor intrusion detection system, which enables current attack correlation methods to be upgraded to work in a distributed fashion, thereby improving their efficiency in case of for large-scale deployment. We achieved this by inserting a middle layer into the intrusion detection datapath, in which a key is attached to detected events. This key is then used to send the events for correlating to several correlation units that are organized as a DHT. This mechanism can be used to reduce network and computational load and increase reliability of the system, while still retaining the advantages of centralized approaches of intrusion detection.

Fig. 1 .

 1 Fig.1. Intrusion detection with centralized collection and correlation of data from various probes. Every piece of information is sent to a server which handles the correlation.

Fig. 3 .

 3 Fig. 3. Number of invalid password events detected for various attacks (y axis) plotted by the duration of the attack (x axis). The left hand side figure shows the attacks which were only detected by one probe, whereas the attacks shown in right hand side figure were detected by multiple probes.

Table 1 .

 1 Number of messages in structured overlays for intrusion detection

	Overlay	Chord	Kademlia
	Node lookup	0	O(log 2 N )
	First event stored	O(log 2 N )	O(1 + log 2 N )

n events with the same key

O(n • log 2 N ) O(n + log 2 N ) Number of messages per event O(n • log 2 N )/n O(n + log 2 N )/n

Messages per event with n → ∞ O(log 2 N ) O

Table 2 .

 2 Analysis of network traffic cost of SSH password attacks, for attackers, victims and the Komondor intrusion detection network. The table includes TCP control packets, as well as the count of header bytes. The bottom rows show the traffic overhead generated by intrusion detection, compared to the SSH server responses.

	Traffic source	Packets Bytes
	Attacker	7 1518
	Victim	6 1140
	Komondor lookup (Kademlia)	20 2020
	Komondor data (Kademlia)	1	103
	Komondor data (Chord, model based estimation)	10 1200
	Overhead (Kademlia)	20% 10%
	Estimated overhead (Chord, model based)	166% 90%

Table 3 .

 3 Number of all attacks and attacks for which protection could be built by Komondor, for each attack types.

	Type of attack	Attacks Protection Ratio
	php-my-admin	107	71 66%
	cyberkit-ping	546	515 94%
	sql-overflow	4355	15	0%
	sshd-conn-lost	490	321 65%
	sshd-failed-password	546	219 40%
	sshd-invalid-user	51	47 92%
	vsftpd-fail-login	46	2	4%

Acknowledgement

The work reported in the paper has been developed in the framework of the project "Talent care and cultivation in the scientific workshops of BME". This project is supported by the grant TÁMOP -4.2.2.B-10/1-2010-0009.