Eric Kryski
email: epkryski@ucalgary.ca

Ehud Sharlin

Emotive Expression Through the Movement of Interactive Robotic Vehicles

Keywords: Social human-robot interaction (HRI), Vehicle personality, Emotional expression through motion

In this paper, we discuss our ongoing design of interactive personal vehicles that exhibit behavioral constructs expressed through motion in order to improve the user's commuting experience. The behavioral, personality-like traits demonstrated by the interactive vehicles are intended to be useful and helpful, as well as to stretch beyond the effectiveness into affect and emotion, creating an overall more satisfying experience for the user. This short paper presents our design goals and approach, describes the evolution of the implementation of our personal vehicle prototypes, and outlines our current preliminary design critique evaluation findings.

Introduction

Vehicle personality may seem like an abstract concept but in reality many people already treat their vehicles as social entities which possess the ability to understand and respond to their requests. Humans can have distinct emotional connections to inanimate objects, in the same way that they may have an emotional connection to a pet or child. Emotions that are evoked by these relationships can range from anger to fear to pleasure, and can play a fundamental role in the way we operate our vehicles [START_REF] Sheller | Automotive Emotions: Feeling the Car[END_REF].

Furthermore, the interactions we have with our vehicles can be viewed as a reminiscence of the symbiotic relationship between humanity and its classic modes of transportation, for example, the close relationships between handlers of camels or horses. However, although we can argue that there is some emotional connection between owners and vehicles, a connection strong enough, for example, to sometime persuade owners to name their vehicle, we believe that modern interactive vehicles could elevate this emotional connection by using synthetic personality and emotive expression. Arguably, if we can bring this heightened level of emotional connection to the way we interact with our vehicles it could potentially greatly enhance our commuting experience while simultaneously solidifying humanity's 'love affair' with our vehicles [START_REF] Sachs | For Love of the Automobile: Looking Back into the History of Our Desires[END_REF].

The purpose of our research is to design an interactive personal vehicle that exhibits emotional expression through motion, and to discover how humans will react to such a vehicle. That is, more specifically, what behavior types exhibited by the vehicle motion and movement would be acceptable to humans? Which displays of behavior are beneficial and which ones pose a negative impact on human-vehicle interaction? Our work was inspired by previous efforts in the domain, for example it has been shown that matching a driver's emotion to the perceived emotion of a simulated car voice can improve the driver performance and safety [START_REF] Nass | Improving automotive safety by pairing driver emotion and car voice emotion[END_REF]. Our work however is an attempt to explore the emotional connection between human and vehicle through a more basic and entirely non-verbal layer: emotional expression as expressed via the vehicle motion. Our intent is not to replace other modalities such as visual or auditory, but rather to discern what physical emotive cues could supplement these other modalities. In this paper we examine three different classes of behavioral constructs (semi-autonomous, cooperative, and training or taming), which we argue are applicable to emotive vehicle expression through motion. We present the personal vehicle testbed prototypes we designed and implemented in order to probe these behaviors and their effect on users, and present our preliminary evaluation of one of these classes, as a simple testcase of emotive expression exhibited through motion.

Background

Media and technology provide many examples of convincing displays of personality conveyed by seemingly inanimate objects, for example in computer games, film, and robotics. In film, viewers have been persuaded to emotionally reflect on a caring teapot, an inquisitive lamp, or a heartbroken robot. Even if these objects cannot talk or do not possess any facial features audiences were still able to associate them with personality and emotive expression. Reeves and Nass suggested that associating human characteristics to objects is an inherently human trait [START_REF] Reeves | The Media Equation[END_REF], and Heider and Simmel in their seminal research [START_REF] Heider | An Experimental Study of Apparent Behaviour[END_REF] outlined that people can relate emotion, gender, and motivation solely by perceiving an objects motion. Since movement is fundamental to robotic interfaces the above findings can provide crucial insight on how to design socially acceptable robots.

Based on this previous research, recent efforts are pursuing possible mapping between motion and emotion. In Saerbeck and Bartneck's research it was suggested that humans perceive a robot's movements in different ways, depending on the acceleration value and curvature [START_REF] Saerbeck | Perception of Affect Elicited by Robot Motion[END_REF]. Another effort presented a preliminary study about how abstract emotive actuation, when exhibited by a robot, is perceived by people [START_REF] Harris | Exploring Emotive Actuation and Its Role in Human-Robot Interaction[END_REF], showing that people made conclusions as to what an abstract object was feeling, its intent and even its gender, based upon how fast the object moved, in which directions, and how quickly it accelerated.

Classes of Behavioral Expression

Since interpersonal communication relies heavily upon body language [START_REF] Heider | An Experimental Study of Apparent Behaviour[END_REF] it is plausible to believe that motion is a primary contributing factor to people's perception of emotion and intent. It seems realistic to think that in order to simulate human emotions robotic vehicles should apply behavioral contexts that are clear and apparent to humans. This is the intent of our research: to discover which behavioral expressions, conveyed via motion, are acceptable for a vehicle, and why. We argue that physical interaction can be more subtle, but also more effective, than either visual or auditory methods. We also believe that humans are acquainted with subtleties, and that interfaces that can express these subtleties can ultimately be more effective, and enhance the interaction experience, without necessarily overruling other, less subtle, modalities. Below we introduce a proposed set of applicable behavior classes that a vehicle may be able to exhibit during emotive movement. Semi-Autonomous Behavior. During the semi-autonomous behavior the vehicle navigates or transports the user where they wish or are required to go. It is merely a reactionary behavior where the primary purpose is to transport the user but also to alarm the user, for example via abrupt motion or vibration, of any information that is of importance. This personality profile allows the user to focus on other tasks as opposed to navigating, but still maintains situational awareness via subtle motionbased expression. Taming/Training Behavior. In this behavioral state the vehicle initially begins as a blank slate that may or may not behave the way the user wishes. Similar to a puppy dog or a horse, the vehicle must be "broken" or trained to respond the way the user would like them to. The vehicle may, for example, move too fast for the user who prefers a more cautious style of movement. Conversely, the user may want the vehicle to move in a more aggressive manner with quick accelerations and more abrupt stops. The main goal of the taming/training behavioral type is not to be reckless or unsafe, but rather to afford the user with a sense of customization, companionship and pride of ownership akin to if one were to train a horse or a dog. It should be noted that similarly to training an animal, the training of an emotively expressive vehicle would also be performed in a secure environment before the vehicle is publicly exposed. Cooperative Behavior. During this behavioral state the user and the vehicle collaborate to enhance the user's experience, and help the user fulfill a predefined set of tasks (such as reaching her meetings on time). The vehicle may exhibit portions of the semi-autonomous state or may be completely passive until the user wishes to perform some action that is not in their best interest according to the vehicle's HRI awareness [START_REF] Drury | Awareness in human-robot interactions[END_REF]. The primary goal of the cooperative behavior type is to perform every action in the best interest of the user. The vehicle accomplishes this goal by utilizing a set of physical gestures or movements that subtly, or explicitly direct the user to predefined areas to complete predetermined tasks or physically removing the user from an unwanted dangerous situation.

Prototype Design

In order to practically evaluate our emotive vehicle expression through motion research question, and to examine the three behavioral types we outlined above, we designed two prototype personal robotic vehicles.

Our initial inspiration came from Segway TM but we ended up opting to use another widely used personal vehicle; an electric wheelchair. However, we did not want to limit the discussion scope to wheelchair bound individuals. As a result, we developed two prototypes based upon an electric wheelchair platform, one to be operated in the seated position and one in the standing position (Fig. 1A,1B). In order to support rapid prototyping and critical evaluation of our concept, rather than a sophisticated technical contribution, we decided to use the 'Wizard of Oz' prototyping approach [START_REF] Dahlback | Wizard of Oz Studies -Why and How[END_REF] as it greatly reduced the vehicle complexity and allowed us to develop a functional prototype in a short period of time. The shortcoming of our approach is that we deferred many of the actual complex implementation challenges associated with our interaction design, and focused our contribution only on the fundamental interaction concept.

Mechanics

We have designed two prototype vehicles, a sitting (Fig. 1A) and a standing platform (Fig. 1B), both of which are based upon an electric wheelchair structure. We chose an electric wheelchair because it is already viewed as a personal vehicle, it was easy to modify for our needs, and electric wheelchairs have the ability to operate in many different environments. That is, they are not constricted by legal issues in the same way that a Segway TM or an automobile is. In order to support our 'Wizard of Oz' prototyping approach both vehicles use a Nintendo Wiimote with Nunchuk extension as input for both the user and the wizard. Each controller is connected via Bluetooth to an onboard vehicle PC. In order to get the desired wireless range, so that the wizard is not detected by the user, we used a generic class 1 bluetooth dongle, which provided an approximate operating range of 50 meters indoors.

After receiving information from the Wiimotes, the PC communicates with the vehicles' Dimension Engineering Sabertooth 2X25A motor driver via a USB to TTL cable. For safety reasons both prototypes include a momentary "on" push button kill switch, in between the battery ground and the motor driver ground, a button that the user must keep constantly pressed using their foot in order for the vehicle to operate.

Wizard-User Control

Control of our prototypes were based on a "Wizard of Oz" puppeteering method, wherein the user was unaware that the vehicle was at times controlled by another human using a second Nintendo Wiimote. The intent was to allow the 'wizard' to provide input on behalf of the vehicle, deceiving the user into thinking that it is actually the vehicle that is deciding and acting out the movements. As previously mentioned we opted for the 'Wizard of Oz' approach because it allowed us to perform rapid prototyping and it greatly reduced the complexity of the vehicle while still maintaining the ability to get user feedback [START_REF] Dahlback | Wizard of Oz Studies -Why and How[END_REF] regarding how a vehicle's motion impacts the user's perception of a vehicle's intent and emotional behavior. A negative aspect of using this technique is that the wizard needs to deceive the user, which requires considerable awareness of the user intentions and puppeteering skills, both prone to human error. This can be especially problematic when dealing with a larger robot that is responsible for transporting a human, however this risk was mitigated in part by the user's on vehicle kill switch as well as by the wizard's ability to cease the vehicle locomotion at any point. Upon initial implementation a decision was made to give the user full control until the wizard pressed a button on their Wiimote and overrode the user's control. At first glance this seemed appropriate but it quickly became apparent that when the user had no control at all they thought that there was a malfunction or they completely gave up on controlling the machine.

As an alternative to this solution we decided to, when the wizard interjects, give the user half the power of the wizard. This way the user can, if they so choose, "fight" the vehicle to an extent, which is controlled by the wizard, but the wizard will still be able to guide the vehicle in the direction that they intend. We believe that this solution will be more readily embraced by the user as it still leaves them with some sense of control over the vehicle regardless of its emotive expression.

Evaluation

For the design critique we chose to evaluate the cooperative behavior class, primarily because this behavioral expression seemed the most practical to implement and we hypothesized that users would be able to more readily grasp the concept of a "personal assistant" or "helping robotic vehicle". As well, for the prototyping effort we believed that it was the simplest to execute and the easiest to evaluate. As such, presented are two selected possible scenarios which inspired our design, both demonstrate how the cooperative behavior type may be beneficial to a user: Scenario 1. The user is at an airport and their flight has been delayed. They have decided to take their personal vehicle to peruse the shops in the airport in order to pass the time. Being preoccupied, the user is unaware of an announcement that their departure time has been moved up. The vehicle however, could be aware of the flight schedule and may begin to subtly physically nudge the user towards the direction of the departure gate. The user may decide to correct the vehicle and return to the shop but as it gets closer to the departure time the vehicle may become more persistent and assertive. Alternatively, if the user is continually correcting the vehicle's behavior, it may simply give up on its attempts and silently obey. Scenario 2. The user is operating the vehicle inside a corporate building and there is an explosion. Alarms are going off, inaudible announcements are being made over the speaker system and smoke is beginning to spread. The user is now distressed and there is public panic. Since some people have reduced rational decision making ability during times of emergency or high stress [START_REF] Saerbeck | Perception of Affect Elicited by Robot Motion[END_REF] the vehicle would assume an authority role and immediately guide the user to safety without requiring user guidance or input. The vehicle may appear protective, brave, or confident by moving in an abrupt direct manner, thus instilling confidence in the user.

During these two very different scenarios the motive displays of emotion by the vehicle, such as being brave or helpful, will vary situationally between passive and aggressive. Consequently, even though we are dealing with the cooperative behavior class the assertiveness or passiveness of the vehicle's movement is an important factor in determining the appropriate motive emotion for each situation. As such, this is something that we took into consideration when selecting the cooperative behavior class for our prototypes.

For the preliminary evaluation of our prototypes we performed a design critique using some of our design team members acting as users. The obvious limitation of our approach was that the users were informed of our prototyping approach. However, we still believe that our findings, outlined in this section, provide important insight on how to proceed pursuing our research question.

For our preliminary design critique evaluation we decided to use the cooperative personality type in lab setting, and accordingly opted to develop a scenario where it makes sense that the vehicle would exhibit a cooperative personality. As such, we devised a scenario where the user is required to complete a certain set of pre-defined daily lab tasks, such as picking up a print out from the printer room, in an allotted period of time. We constructed this scenario based on what we thought would be a meaningful and relatively valid task for most participants, that is, many people perform similar chores on a daily basis. It should be noted however, that our participants did not integrate these vehicles into their daily lives. Our rationale for selecting the cooperative behavior class was that it required the least amount of human learning and we hypothesized that users would be able to more readily associate with a cooperative behavior. The design critique was conducted with two members of our research lab and one engineering student external to our lab, using the seated platform. All of the participants were involved and familiar with our research and hence these findings can be viewed only as a design critique, not a user study.

Prototype Findings

Overall the prototypes operated quite well and both vehicles can be operated smoothly or in a jerking manner. On the mechanical end, the seated platform is quite stable, even at high speeds, but the standing platform can be quite tippy in the lateral direction. A larger base, lower center of gravity, or wider wheels will increase the force it takes to tip the standing vehicle. Taking this safety concern into consideration is why we opted to use the seated platform for the design critique.

Interaction Findings

After the initial trial we found that the participants were often unaware of the vehicle's intention, which caused them to become confused, frustrated or fearful. As such, we opted to revise the design critique scenario to get the user to perform a series of tasks in the same fashion, except that some key information required to complete some of the tasks, would be missing. Since the vehicle's intended behavior was to be cooperative, we hypothesized that having a few missing items provided a more perceivable rational motivation for why the vehicle would interject. Thus, if the vehicle's cooperative behavior is performed convincingly the participant could potentially increase their level of trust in the vehicle, and may be more in tune to its gestures. Although this approach provides a reasonable way for preliminary reflection on usability and influence of the perceived vehicle behavior on the user, it also highlighted some shortcomings. We had found that it was imperative that the taskrelated items and their locations be clearly marked and visible. When they were not, the participants became easily confused or frustrated, regardless of the vehicle's attempt to help. Also, we have found that our users overall reflection was that the seated platform was sometimes inhibiting, with participants often wishing to get out of the vehicle to look for missing items.

Furthermore, the wizard had to be extremely skilled with the joystick control and adapting to the participant's actions. The wizard must be very aware of when the right time to interject is and how much force to apply. If the timing is incorrect or the force is too strong the participant may think that there is a vehicle malfunction. Ultimately there is the very real possibility that the participant will not even understand that the vehicle is trying to hint at anything as opposed to just behaving abnormally.

Finally, we discovered that without an initial process of gaining trust in the vehicle the participant was generally unaware of what the movements could mean. There is some learning by the participant that should take place before the vehicle's interjection movements can become meaningful. The participant must be able to recognize that the movement by the vehicle is intentional, and discern what its intent is. Initially this is unclear and for some participants we discovered that the process is almost bound to fail, unless there is a mechanism that allows them to gain trust in the vehicle.

Conclusion

We think that the new emerging area of human vehicle interaction can benefit from the introduction of emotive layers of interaction between the user and the vehicle. We believe that our work on emotive expression through movement can potentially introduce a subtle dimension to how we interact with our vehicles, and might lead to further research that can help strengthen the bond we have with our transportation means. Humans have had personal connections with their horses or camels for centuries because of the simple fact these modes of transportation are alive, and behave as such. The animal exhibits personality, has a mind of its own and expresses emotions, but respects the power of its master. The human is responsible for the wellbeing of the animal so in turn they both serve each other functionally, as well as, to some extent, emotionally. If we can emulate that same experience with future vehicles we believe that humans could start to develop stronger, more affectionate bonds with their vehicles, similar to those that exist historically with other zoological modes of transportation. We believe that such bonds can improve the commuting experience, make it more interactive, more effective, and ultimately more enjoyable.

The implementation effort we have reported in this short paper is preliminary, and needs to be improved. In the long run we would like to replace the Wizard of Oz with an autonomous vehicle. Furthermore, it would be beneficial to further explore the other proposed behavioral classes we envisioned: semi-autonomous and training or taming.

We believe that trust will play an inherently important role in interaction with vehicular robots. When a machine is responsible for safely transporting users, taking control of their movement through space, trust becomes essential. Thus, in order to build trust while expressing behavior or emotion through movement, the vehicle must be able to convey the intent of a movement to the user. We believe that users would then be inclined to assign some emotion to the movement of the vehicle, whether it be angry, lazy or confused as long as they are not thinking the vehicle is simply malfunctioning. Unfortunately, especially without familiarity, an unforeseen movement is generally interpreted as an error. We believe that based on our preliminary findings the main challenge facing the design of emotive expression through motion in robotic vehicles is getting over the trust barrier. However, like any relationship this may simply be a matter of time and patience, and repeated exposure to the vehicle may be beneficial to users as it would increase familiarity and hopefully eventually increase trust as well.

Figure

  Figure 1A. Seated Platform Figure 1B. Standing Platform


Martin Molina
email: martin.molina@upm.es

Enrique Parodi
email: enrique.parodi@fi.upm.es

Amanda Stent
email: stent@research.att.com

Using the Journalistic Metaphor to Design User Interfaces that Explain Sensor Data

Keywords: Intelligent user interface, multimedia presentation, interactive data exploration, user interface for web applications

Facilitating general access to data from sensor networks (including traffic, hydrology and other domains) increases their utility. In this paper we argue that the journalistic metaphor can be effectively used to automatically generate multimedia presentations that help non-expert users analyze and understand sensor data. The journalistic layout and style are familiar to most users. Furthermore, the journalistic approach of ordering information from most general to most specific helps users obtain a high-level understanding while providing them the freedom to choose the depth of analysis to which they want to go. We describe the general characteristics and architectural requirements for an interactive intelligent user interface for exploring sensor data that uses the journalistic metaphor. We also describe our experience in developing this interface in real-world domains (e.g., hydrology).

Introduction

Today, organizations are collecting large quantitative datasets from distributed sensors including GPS devices, RFID tags, and point of purchase devices. There exist advanced visualization systems to help domain experts analyze, interpret and understand data from sensor networks [START_REF]Readings in Information Visualization -Using Vision to Think[END_REF] [START_REF] Keim | Information visualization and visual data mining[END_REF]. Non-expert users can also benefit from analyses of sensor network data. Web-based systems that automatically construct textual, spoken or multimedia explanations of the meaning of sensor data using nontechnical language can facilitate access by non-expert users and consequently increase the utility of sensor network infrastructures.

An example of this situation in the hydrological domain is sensor network with real time data about water levels, water flows and other meteorological information. In contrast to a specialized system that only presents graphics and quantitative results of analyses to expert hydrologists, an interactive web application with additional text and multimedia explanation capabilities is potentially useful to a wide range of non-expert users (e.g., municipalities, civil protection, engineering consultants, and educators). Other examples of large quantitative datasets potentially useful for different communities of users are environmental data from ship traffic [23], crime statistics [22], and wildlife tracking data [START_REF]Obis-Seamap[END_REF].

The addition of text explanations to visualizations of sensor data can facilitate better understanding and more effective use of the data. The automatic generation of presentations combining text and graphics is a well-known but complex problem [START_REF] Carenini | A strategy for generating evaluative arguments[END_REF][7] [START_REF] Kopp | Towards integrated microplanning of language and iconic gesture for multimodal output[END_REF]. In this paper we analyze two particular questions: [START_REF] André | The generation of multimedia presentations[END_REF] what presentation style (combining text and graphics) can be used to help non-expert users analyze sensor data, and ( 2) what techniques can be used to support the automatic generation of this type of presentation. Our answer to the first question is to use the journalistic metaphor, because the journalistic layout and presentation style are widely understood. Our answer to the second question is a general design that combines and adapts techniques from multimedia presentation systems and intelligent data analysis.

In the following sections, we first describe our concept of an user interface following the journalistic metaphor. Then, we describe the main components of a general architecture to support this type of interface. Finally, we describe applications that we developed to evaluate our approach, and a comparison with related work.

A user interface based on the journalistic metaphor

Journalists, who face the challenging task of presenting complex situations to nonexperts in a way that quickly and effectively promotes understanding, have converged on practical guidelines for effective communication to wide audiences. We use these journalistic guidelines to design a user interface that explains sensor data to wide audiences. In general, the journalistic style uses non-technical language understandable by general users and follows guidelines such as the following:  Writing using the inverted pyramid. A news story is usually structured to put essential information first, with supporting information following in order of diminishing importance. The headline captures the user's attention and quickly communicates the main idea of the story. Then, the text body develops the headline. The text body is structured to put essential information first, with supporting information following in order of diminishing importance. It is structured so that the user can stop at any point with a high-level understanding, or continue to read to get more detailed analysis.  Effective use of graphics to elaborate on the text. A feature story is often accompanied by illustrations including 2D maps and timelines, bar charts, line charts, pie charts, and images. Figure captions summarize the content of the figure. Figure legends explain the meaning of certain symbols and act as quick references to subsets of the data identified during data analysis. The text body also explains the meaning of the data analyses displayed in the graphics.  Page layout to organize related information. A newspaper organizes news stories into different sections, with the most important stories on the first page. Graphics and text may be presented in a one-column layout (with graphics located near the relevant text), or in multi-column layouts (with graphics running parallel to the text).

The Polar Star research vessel goes to the Arctic ocean every summer

The Polar Star goes to the Arctic ocean every summer and to the Atlantic ocean every winter (Fig. 2). The Polar Star recorded temperature data for the last 6 years (Fig. 3). The vessel recorded values for air temperature that ranges from -26 C to 19 C with an average of -3 C.

Values for dew point temperature range from -26.7 C to 18.4 C with an average of -6.88 C. Values for sea surface temperature range from -1.5 C to 18.12 C with an average of 5.54 C.

Values for wind speed range from 0 Km/h to 99 Km/h with an average of 6.73 Km/h. Values for visibility range from 91 Km to 98 Km with an average of 97.43 Km. Values for sea pressure range from 0 to 999.5 with an average of 15.93.

The recruiting country for the Polar Star research vessel (Fig. 1) and its registered country is the United States of America. Its call sign is WAGB-10, the speed is 15 knots and the type is Heavy Icebreaker. The length of the Polar Star is 122 m, the displacement is 13,194 long tons, and its rage is 28,275 nmi. Figure 1 shows an example presentation in a user interface that we developed following the journalistic metaphor. This presentation is based on a large set of environmental information collected by ships over the last ten years as part of the international VOSclim project [23]. This data set includes tens of measures for each of hundreds of thousands of events for hundreds of ships. Our web-based, interactive interface works as a virtual newspaper that automatically generates multimedia news stories that highlight and explain analyses of sensor data.

Reporting data for 6 years

Automatic generation of presentations

To implement a user interface that explains sensor data using the journalistic metaphor, we need to simulate tasks that human journalists perform to construct presentations. These tasks are: analyze the data and find the important elements, create a plan to present the information to the reader, generate the text in natural language using general terminology, generate graphics that complement the text, and generate a logically consistent layout for the presentation. In order to automatically perform these tasks, we have designed a general architecture that combines and adapts solutions from the fields of multimedia presentation systems and intelligent data analysis. Figure 2 shows the main components of our architecture.

This architecture shares some general components of multimedia presentation systems [START_REF] André | The generation of multimedia presentations[END_REF] (e.g, content planning and presentation generation). Some original contributions of our design are: (1) data analysis of large spatio-temporal datasets, i.e. we automatically analyze large datasets with spatio-temporal information to find patterns and perform aggregations (e.g., spatial and temporal aggregations), (2) explanatory multimedia descriptions, i.e. we automatically construct complex descriptions (with multi-paragraph natural language summaries and graphics) with informative and persuasive discourses that summarize and explain the sensor data (here, we follow the journalistic metaphor which provides a guide to structure the presentation), and (3) interactive exploration, i.e. our user interface supports a mixedinitiative approach to interactive data exploration.

Our architecture includes a database that efficiently stores sensor data (thousands or millions of events) and the results of data analyses. The database represents raw sensor readings as observed events, each characterized by a set of attribute values. Our architecture also includes a component for data analysis to find abstractions over the input sensor data. The data analyzer uses general data mining algorithms to cluster, analyze trends, and describe the data in terms of the most common feature values, example instances, and exceptions. The automatic application of geospatial, temporal and domain-specific knowledge bases to the observed events produces extended and aggregated events, with new attribute values corresponding to abstractions of the observed attribute values. In order to generate multimedia descriptions using the journalistic metaphor, our system must select from numerous potential ways of describing the input data. Therefore, it is not practically possible to use a few templates that help to generate these descriptions. Instead, we use a more flexible solution with a discourse planner in combination with natural language generation and graphics generation. Our discourse planner is conceived as a knowledge-based hierarchical planner. The knowledge base includes partial discourse patterns in the journalistic style, together with conditions for selecting each discourse pattern. The generated discourse plan includes information about the rhetorical structure of the discourse (with rhetorical relations [START_REF] Mann | Rhetorical Structure Theory: Toward a functional theory of text organization[END_REF]) and information about propositions in the discourse, represented as references to subsets of the input data (Figure 3). In our architecture the discourse planner operates in a loop with the data analyzer. The discourse planner invokes specific prefixed data analysis functions using the knowledge base of discourse patterns and the results of previous data analyses to progressively construct the discourse plan.

The component for presentation generation receives as input the discourse plan output by the discourse planner. The presentation generator generates interactive hypermedia presentations (in HTML and JavaScript) accessible by remote web browsers through the Internet. Our user interface supports a mixed-initiative approach to interactive data exploration. Some data analysis tasks are chosen and performed automatically by the system, and presented to the user as an inter-connected collection of multimedia stories through which the user can browse. The user can invoke other tasks herself by clicking on hyperlinks in a story or selecting subsets of the data via manipulation of a graphic. Headline: [START_REF] André | The generation of multimedia presentations[END_REF] The Polar Star research vessel goes to the Arctic ocean every summer Text body: [START_REF] André | The design of illustrated documents as a planning task[END_REF] The Polar Star goes to the Arctic ocean every summer [START_REF] Bateman | Towards Constructive Text, Diagram, and Layout Generation for Information Presentation[END_REF] and to the Atlantic ocean every winter. [START_REF] Barbosa | Robust sentiment detection on Twitter from biased and noisy data[END_REF] The Polar Star recorded temperature data for the last 6 years [START_REF]Readings in Information Visualization -Using Vision to Think[END_REF] The vessel recorded values for air temperature […] [START_REF] Carenini | A strategy for generating evaluative arguments[END_REF] The recruiting country for the Polar Star research vessel [START_REF] Demberg | Information presentation in spoken dialogue systems[END_REF] and its registered country is the United States […] Captions:

[C1] Figure 1 The generation process involves picking elements off of the discourse plan and invoking text or graphics generation components accordingly. The text generator produces natural language text using two components, sentence planning and surface realization [START_REF] Reiter | Building Natural Language Generation Systems[END_REF]. The figures that accompany texts are constructed on the fly by the graphics generator. The graphics generator can make use of several publicly available graphics tools, such as Google Charts, Dygraphs, SIMILE Widgets, and OpenStreetMaps.

Applications and related work

We developed a real-world application in the domain of hydrology following the user interface design described in this paper, using sensor data from a national information system (SAIH: Spanish acronym for Automatic Information System in Hydrology) in Spain. The application generates 20-30 pages of news every hour summarizing 44,736 sensor readings across Spain. For example, Figure 4 shows one of the generated pages with a headline (light rain at a few places in the Guadiana basin), text body (with hyperlinks), and two graphics: an animated illustration (the movement of a storm), and an interactive map. We evaluated the practical utility by comparing our application with existing web applications that present hydrological sensor data. The results of this evaluation showed that, with this system, users take up to 4.45 hours less to confirm the information in a summary of the hydrological data than they do given other existing systems for this data (with an average value of 3:45 hours for typical emergency scenarios). The application in the hydrologic domain followed the journalistic style described in this paper. It also included a preliminary version of our architecture with domain specific knowledge bases and abstraction methods (more details about this application domain can be found at [START_REF] Molina | A presentation model for multimedia summaries of behavior[END_REF]). We have also applied our design partially to other domains: ship data from the VOSclim project [23], Twitter data with measures of sentiment [START_REF] Barbosa | Robust sentiment detection on Twitter from biased and noisy data[END_REF], general geographical movements [START_REF] Molina | A knowledge-based method for generating summaries of spatial movement in geographic areas[END_REF], and aircraft data [START_REF] Molina | Combining text and graphics for interactive exploration of behaviour datasets[END_REF]. As a result of these applications, we generalized some components of our design as they are described in this paper. We are currently working on a complete implementation of this design using different domains for evaluation with spatio-temporal data from sensors.

Our solution is related to multimedia presentation systems such as WIP [START_REF] André | The design of illustrated documents as a planning task[END_REF], COMET [START_REF] Mckeown | Interactive multimedia explanation for equipment maintenance and repair[END_REF], Autobrief [START_REF] Green | AutoBrief: an Experimental System for the Automatic Generation of Briefings in Integrated Text and Information Graphics[END_REF], and Dart bio [START_REF] Bateman | Towards Constructive Text, Diagram, and Layout Generation for Information Presentation[END_REF]. Compared to these systems, our system is original in the following aspects: (1) it is designed for a different problem (generation of descriptions about the meaning of sensor data), (2) it follows the journalistic style and constructs complex multi-page presentations, (3) it includes complex and interactive graphics (animations, maps, etc.), and ( 4) it has been evaluated in real-world domains (e.g., hydrology).

Our system also shares architectural elements with other data-to-text generation systems (for weather forecasting [START_REF] Reiter | Choosing words in computer-generated weather forecasts[END_REF], or medicine [START_REF] Hunter | Using natural language generation technology to improve information flows in intensive care units[END_REF]). However, we use a different data analysis approach, directed by the discourse planning process; and we produce multimedia presentations. Our system can also be related partially to user interface generation using high level models [START_REF] Falb | Fully automatic user interface generation from discourse models[END_REF]. Compared to this, our solution also uses high level models (discourse plans with rhetorical relations) to generate output presentations.

Our proposal is also related to the field of computational journalism. In this field, our solution can be compared to research work related to automatic generation of news (e.g., [START_REF] Radev | NewsInEssence: Summarizing online news topics[END_REF]). In this type of solution, news is generated using text-to-text summarization techniques and web mining. In contrast, our system creates news stories from quantitative measures of sensor data, and automatically generates coordinated presentations of text and interactive graphics.

Conclusions

In this paper we have described an intelligent user interface, conceived as an automatically generated virtual newspaper, for interactive exploration of sensor datasets that combine text summaries and graphics. We have adopted the journalistic metaphor to make the results of data analyses easily understandable by non-expert users. This metaphor provides general criteria to automatically construct presentations (with headlines, types of discourse patterns, illustrations and specific page layouts). To support this type of interface, we have identified the main components of a general architecture combining and refining solutions from multimedia presentation systems and intelligent data analysis. We have applied this solution to real-world domains and shown its practical utility. This type of user interface is an effective solution to improve the utility of sensor networks.

The implementation of our architecture uses general-purpose reusable components. However, it also requires the development of certain domain-specific components, more specifically, domain-specific discourse patterns, knowledge bases and data analysis methods. Our future work includes the generalization of these domainspecific elements to facilitate reuse, as well as evaluation in different domains.

Figure 1 .

 1 Figure 1. The Polar Star research vessel.Figure 2. The Polar Star goes to the Arctic ocean.

Figure 2 .

 2 Figure 1. The Polar Star research vessel.Figure 2. The Polar Star goes to the Arctic ocean.

Figure 3 .Fig. 1 .

 31 Figure 3. The Polar Star recorded temperature data for the last 6 years.

1

 1

ListFig. 3 .

 3 Fig. 3. Discourse structure of the presentation (simplified example).

Fig. 4 .

 4 Fig. 4. Example presentation in hydrology.

Acknowledgements. The research leading to these results has received funding from the European Union Seventh Framework Programme (FP7/2007-2013) under grant agreement PIOF-GA-2009-253331 (Project INTERACTIVEX). This work was also partially supported by the Ministry of Science and Innovation of Spain within the VIOMATICA project (TIN2008-05837).


Elyes Muhammad Awais Javed

Ben Hamida

Ala Al-Fuqaha

Bharat Bhargava

Adaptive Security for Intelligent Transport System Applications

come   L'archive ouverte pluridisciplinaire

I. INTRODUCTION

In the current era of connectivity, a number of transportation applications are envisaged to utilize mobile and wireless technologies. Traffic management and passenger safety are important domains where ubiquitous connectivity between vehicles can play a vital role. In Jan. 2016, The Wall Street Journal published an article that indicates that the US federal government is planning to spend $4 billion over the next ten years to encourage the development of autonomous and semiautonomous vehicles [1]. Moreover, M-City at the University of Michigan provides 32 acres and 3000 test vehicles to study the different aspects of Connected Vehicles.

Intelligent Transportation Systems (ITS) are expected to provide safer travel to commuters, manage traffic to reduce road congestion, and offer various infotainment services. Using data exchange between different ITS entities such as vehicles, road side units (RSUs) and traffic management centers, a reliable traffic management system will be developed. With a decade of research that has been conducted in the field of Vehicular Ad-hoc Networks (VANETs), ITS standards have already been finalized and many ITS applications are set to become reality.

Muhammad Awais Javed is with the Electrical Engineering Department, COMSATS Institute of Information Technology, Pakistan. (e-mail: awais.javed@comsats.edu.pk ) Elyes Ben Hamida is with the Institute for Technological Research Sys-temX, France. (e-mail: elyes.ben-hamida@irt-systemx.fr) Ala Al-Fuqaha is with the with the Computer Science Department, Western Michigan University, USA. (e-mail: ala.al-fuqaha@wmich.edu ) Bharat Bhargava is with the Department of Computer Sciences, Purdue University, USA . (e-mail: bb@cs.purdue.edu ) Security and privacy of data shared between the different entities of an ITS is a key technical challenge [START_REF] Fuentes | Handbook of Research on Mobility and Computing[END_REF]. With the plethora of applications offered by ITS, there exists a susceptibility to network attacks by malicious nodes [START_REF] Javed | Security in intelligent transport systems for smart cities: From theory to practice[END_REF]. Particularly, applications that involve human safety such as those that impact vehicle driving decisions could be at greater security risk. Therefore, it is important to provide data integrity, authenticity, confidentiality and non-repudiation for all smart city applications. Moreover, each ITS entity should maintain its privacy and anonymity.

Since ITS rely on developing secure communications between different ITS entities, denial of service (DoS) attacks could severely disrupt its functionality by congesting the network with bogus messages. Furthermore, malicious nodes could pretend to be real vehicles or infrastructure units disseminating inaccurate or false information about vehicle locations, traffic densities, etc. within the ITS network. Another possible attack involves eavesdropping where vehicles could listen to secret communications between users or passengers' private data while making mobile online transactions. Finally, hardware sensors could also experience a fault, generating inaccurate data and impact the functionality of various applications.

To counter the security threats related to ITS applications, security procedures and algorithms have been defined in the IEEE Wireless Access for Vehicular Environments (WAVE) standard in the United States and European Telecommunications Standards Institute (ETSI) TC ITS standard in Europe [START_REF]IEEE standard for wireless access in vehicular environments (WAVE) -Security services for applications and management messages[END_REF], [START_REF]The European Telecommunications Standards Institute[END_REF]. Elliptic Curve Cryptography (ECC) based algorithms are the chosen schema for digital signature, certification and encryption. Secure messages can be transmitted using the default wireless technology for ITS (i.e., IEEE 802.11p). With the pervasive deployment and use of ITS applications, significant traffic load is introduced in the network. Hence, QoS becomes more critical with the presence of many bandwidth hungry applications. A key challenge is thus to satisfy the network requirements of each application. Security algorithms may enhance protection against network attacks but they also incur a cost in terms of packet overhead and security processing delay. This could defeat the purpose of reliable transmission of data within the ITS network if communications is secured but the packets are not delivered within the latency requirements. Therefore, it is critical to study this security-QoS tradeoff in the context of ITS and chalk out a dynamic approach in this regard.

The objective of this article is to review the challenges and opportunities in the domain of security-QoS tradeoff for ITS applications. We first introduce the communications architecture of ITS followed by the security and QoS design challenges. After that, we implement the ETSI ITS security standard as per the latest technical specifications (i.e., ETSI TS 103 097 [START_REF]The European Telecommunications Standards Institute[END_REF]) and present experimental benchmark results for security processing delay. We also develop an online tool to show detailed benchmark results for various security parameters. We further present simulation results that summarize the impact of security on ITS applications' QoS. We then present an adaptive signature verification mechanism from our previous work [START_REF] Hamida | Channel-aware ECDSA signature verification of basic safety messages with k-means clustering in VANETs[END_REF] to demonstrate how the conflicting security-QoS requirements can be balanced for ITS safety applications. We also show how adaptive signature verification can help vehicles to use cheaper processors with lower clock rates. At the end of article, we highlight future research directions to jointly improve the security and QoS of ITS applications.

II. COMMUNICATIONS IN ITS BASED SMART CITIES

ITS is a pivotal technology with major transportation, efficiency and safety applications [START_REF] Wang | Performance evaluation of ieee 802.15.4 nonbeacon-enabled mode for internet of vehicles[END_REF]. To form an ITS network, vehicles exchange information with each other, geographical infrastructure road-side units and human sensors as shown in Fig. 1. A lot of standardization work has been completed in the ITS domain including the IEEE WAVE and the ETSI ITS standards that define the functionalities of the data generation, data dissemination and security procedures for ITS applications.

The typical data that is generated in an ITS includes periodic safety messages containing vehicle position, heading and speed information known as Basic Safety Messages (BSMs) in the IEEE WAVE standard and Cooperative Awareness Messages (CAMs) in the ETSI TC ITS standard. These messages help vehicles to build a local database of the neighborhood traffic called Local Dynamic Map (LDM) facilitating them to take critical driving decisions such as lane change and applying brakes. Other types of data that are generated in ITS include warning notifications, efficient route guidance for traffic management and Internet-based entertainment and convenience services such as access to multimedia files and banking transactions.

With the Internet connectivity feature in the form of ITS, vehicles could benefit from many potential infotainment and IoT applications. For example, using Internet collected data with machine learning techniques, vehicle dynamic and power terrain modules could be controlled to reduce energy consumption of vehicles. Moreover, vehicles could be remotely monitored by the authorities in terms of their registration and operational management. In addition, applications such as realtime fleet management, optimized logistics and infotainment solutions could be enabled using ITS.

Each application in ITS as defined in ETSI standard [START_REF]The European Telecommunications Standards Institute[END_REF] has its own set of system requirements in terms of communications modes, transmission range, transmission frequency, critical latency and level of required security as shown in our proposed Data integrity Data confidentiality afford a higher delay and work well with a medium level of security. On the other hand, Global Internet services that are not time critical and have lesser impact on human safety can use a light weight cryptography. Pedestrian comfort applications such as vehicle-pedestrian collision avoidance also require a high level of security. Applications that provide electronic commerce are prone to security threats and even though their transmission requirements are not that strict, they require data confidentiality and encryption to secure the user private data.

III. SECURITY AND QOS DESIGN CHALLENGES FOR ITS

Security and QoS are network services that are interlinked and have an impact on each other [START_REF] Qu | A security and privacy review of VANETs[END_REF]. Some of the key security and QoS design challenges for ITS applications are discussed below.

A. Key Security Design Challenges

Security is a vital requirement for a reliable data exchange in ITS. Applications that involve vehicle safety or sharing personal information are prone to security threats and need to be secured against network attacks. Generally speaking, ITS needs to ensure the following security requirements and take the appropriate measures.

• Data Integrity and Authenticity: To ensure that the data transmission in ITS is free of any unapproved alteration by a malicious user, it is necessary to sign messages with a digital signature. This allows receivers to verify the message authenticity and integrity. • Data Confidentiality: Access to the data packets shared in ITS should be restricted to prevent information leakage to unauthorized users. This can be achieved with the help of data encryption which makes it intelligible only to the approved nodes. • Privacy and Anonymity: Identification of drivers and their vehicles should be not disclosed and user shall retain the right to control sharing of his personal information. • Identity and Non-repudiation: Each ITS entity should have a distinct identity so that the identity of the message originator can be verified. A centralized certificate authority should issue digital certificates that can be used to verify the identity of sending nodes in ITS. • Security overhead: The security overhead is defined as the cost incurred to implement a security procedure (e.g., signature, encryption, verification, decryption, etc.) in terms of packet size. The security overhead affects network metrics such as packet delivery ratio and endto-end delay. Since most applications in ITS require realtime availability of information, it is important to select a light-weight cryptographic algorithm which incurs a low security overhead while still ensuring data security. • Security robustness: Security robustness is defined in terms of strength of the employed security algorithms against network attacks. A more robust security algorithm (with a higher key size) requires a higher security overhead; however, it also provides greater resilience against malicious nodes. The level of security robustness in terms of the use of digital signatures, certificates, encryption or a combination of these, should be decided based on the application. For example, safety ITS applications such as cooperative awareness must use a digital signature with every message to avoid getting false negatives/positives. Similarly, an online payment for phone bill or parking payment in ITS should use encryption to prevent access to the credit card information. Certain other non-safety applications such as multi-player games may work well even with a reduced level of security.

B. Key QoS Design Challenges

QoS defines network requirements in terms of performance, service availability and scalability. ITS target a wide range of applications, use-cases and requirements, for example, in terms of communications mode, messaging type, critical latency, communications range and so on. Thus, the ITS protocol stack should be able to adapt to context changes and support different levels of QoS. The major ITS design challenges in terms of performance and QoS are as follows:

• Frequent Context Changes: ITS exploit different types of communications modes (e.g., multi-hop Vehicle-to-Vehicle (V2V), vehicle-to-infrastructure (V2I), short/long IV. IMPACT OF SECURITY ON QOS IN ITS The interdependency of security and QoS impacts the application's performance in ITS. The security procedure in ITS works in a two-step process. At the transmitter, packets are signed and/or encrypted and a certificate is eventually attached to the packets before sending them over the wireless channel. At the receiver side, each packet is verified and/or decrypted before passing it to the application layer. The ITS standards including the IEEE WAVE and the ETSI ITS define the use of Elliptic Curve Cryptography (ECC) based algorithms for digital signature and encryption of messages [START_REF]IEEE standard for wireless access in vehicular environments (WAVE) -Security services for applications and management messages[END_REF], [START_REF]The European Telecommunications Standards Institute[END_REF]. The data generated in ITS is signed using the Elliptic Curve Digital Signature Algorithm (ECDSA NIST-P256 with SHA 256) and encryption is achieved with the help of Elliptic Curve Integrated Encryption Scheme (ECIES NIST-P256 with AES-CCM-128). Note that the latest IEEE 1609.2 standard [START_REF]IEEE standard for wireless access in vehicular environments (WAVE) -Security services for applications and management messages[END_REF] also includes an option to sign ITS packets using elliptic curve brainpoolP256r1, which is not considered as part of this paper.

From the point of view of computational cost associated with the security procedure, three parameters are important including security overhead, ENCAP delay (for signature/encryption operations) at the transmitter, and DECAP delay (for security verification/decryption) at the receiver. A higher security overhead increases the packet size and hence the packet transmission time and channel utilization. ENCAP delay is the time required for preparation of the secured message at the transmitter. DECAP delay is the time required at the receiver to verify and/or decrypt the packet. It is a vital parameter since vehicles receive many packets simultaneously and a higher DECAP delay would result in congestion at the receiver.

A. Test-bed and Experimental Benchmark

To evaluate security processing parameters for ITS applications, we used a cryptographic API known as Bouncy Castle to implement ECDSA and ECIES security procedures as per the ITS standards. The cryptographic procedure included the ETSI security header, certificate format and security profiles according to latest version of ETSI ITS standard [START_REF] Javed | Security in intelligent transport systems for smart cities: From theory to practice[END_REF]. Our cryptographic implementation was tested and validated using the web validator named Fraunhofer FOKUS ETSI TS 103 097 during the 4 th ETSI ITS Plugtest event.

Compared to the IEEE 802.11p standard, the ETSI ITS standard defines additional facilities layer and extended network layer to include geonetworking functionality. The facilities layer collects, stores and provides safety information which is required by many ITS applications. The geoNetworking protocol layer defines the network routing functions using the geographical location information of nodes. We integrated these two layers through standard compliant service access points; thus, developing a stand-alone software module as shown in Fig. 2a [3].

The testbed on which cryptographic procedures were implemented include three different CPU architectures including Intel i7, Intel Xeon and CubieBoard. We performed experiments at different levels of security depending on whether packet is only signed and/or encrypted with or without a certificate. The realistic values of security processing parameters including security overhead, ENCAP delay and DECAP delay based on our experimental studies are listed in an online tool developed by us as shown in Fig. 2b. Fig. 3 illustrates the average number of ENCAP operations per seond (i.e., number of security signature and/or encryption operations per second that can be performed by a particular CPU processor) using different CPU processors. The cryptographic key size and other security parameters are set as recommended per the ETSI standard. It can be seen that a faster processor with higher clock rate performs more security operations per second. For example, a 3GHz Intel i7 processor can perform more than 8000 signature operations per second whereas a 1.3GHz CubieBoard processor can only perform less than 500 signature operations per second. Fig. 4 illustrates the average number of DECAP operations per second (i.e., number of security verification and/or decryption operations per second that can be performed by a particular CPU processor) using different CPU processors. A CubieBoard processor of 1.3GHz can only perform 38 -52 security processing operations per second and hence, incurs a very high security processing time. In comparison, Intel Xeon processor with a speed of 2.9GHz, is able to process 255 -348 packets per second and a more powerful 3GHz Intel i7 processor improves the security processing rate to 1120 packets per second. Since the "decrypt and verify"' security operation is the most complex security operation, a CPU can The security processing rate also depends on the level of security added to a packet. For example, if a packet is both signed and encrypted along with a certificate, it takes the highest time to process at the receiver. Therefore, such a security level should only be restricted to critical applications. For complete set of security parameters including ENCAP and DECAP delays, readers can refer to our online tool [START_REF]Safeits project: ETSI ITS security performance benchmark[END_REF].

B. Simulation Results

To study the impact of security on QoS, we perform simulations in NS-3 simulator for a safety ITS application where each vehicle periodically broadcasts CAMs to inform neighboring vehicles of its mobility information. Each transmitted CAM is signed using the ECDSA algorithm whereas certificate information is sent only once per second as per the ETSI ITS standard [START_REF]The European Telecommunications Standards Institute[END_REF]. The received CAMs which cannot be verified within 100ms time interval are dropped. We use a vehicle The packet inter-arrival time of CAMs is shown at different transmitter-receiver distances in Fig. 5. Without using security, the message inter-arrival time remains below 150ms within a Tx-Rx distance of 300m. Since CAMs are sent every 100ms, the increased inter-arrival time is the result of packet loss due to collisions and fading. The message inter-arrival time further increases if security signature is added to the packets. The ENCAP delay, DECAP delay and security overhead contribute to the increased packet inter-arrival times. Particularly, for Intel Xeon whose security processing time is approximately 3 times higher than Intel i7 results in a packet inter-arrival time of 321ms at a Tx-Rx distance of 300m. In comparison, Intel i7 maintains a packet inter-arrival time of less than 170ms within this distance.

Since safety messages in ITS are transmitted at a maximum rate of 10 packets per second, a high density scenario results in vehicles receiving hundreds (or thousand) of packets for security processing [START_REF] Darwish | Traffic density estimation in vehicular ad hoc networks: A review[END_REF]. While a powerful processor in the vehicle reduces the security processing time resulting in reduced packet latency, it will increase the cost of on board unit in the vehicle. For instance, for some hardware security modules (HSM), the cost is even more than the cost of an entrylevel car. Therefore, vehicles require a cheaper processor that can provide relatively acceptable security processing times. Additionally, to achieve the security-QoS balance, adaptive security techniques and congestion control mechanisms should be developed.

V. ADAPTIVE SECURITY IN ITS

To achieve the required QoS for ITS applications without compromising security, adaptive mechanisms are required. Specifically for safety applications, messages are signed using ECDSA algorithm before transmission. At the receiver, these messages are placed in a security queue and verified on a first-come, fist-served basis. In high traffic density scenarios, vehicles could receive more packets than they can verify, causing high latency and packet losses due to timeout (taken as 100ms) also known as cryptographic packet loss.

A. Machine Learning Based Adaptive Signature Verification in ITS

To overcome the problem of cryptographic packet loss, an adaptive machine learning based signature verification technique for safety ITS applications can be utilized as proposed in our previous work [START_REF] Hamida | Channel-aware ECDSA signature verification of basic safety messages with k-means clustering in VANETs[END_REF]. The central idea of the adaptive technique is to assign verification priority to the packets from nearby vehicles that are a source of greater safety danger. On the other hand, verification of messages from vehicles farther away could be delayed or discarded without impacting safety.

Since the transmitting vehicle's position cannot be evaluated before the safety message is authenticated, transmitter-receiver distance is unknown. As a solution to this challenge, received signal strength can be used [START_REF] Meireles | Experimental study on the impact of vehicular obstructions in vanets[END_REF]. Experimental studies have shown a correlation between received signal strength and transmitter-receiver distance [START_REF] Hamida | Channel-aware ECDSA signature verification of basic safety messages with k-means clustering in VANETs[END_REF]. Vehicles can classify the geographical region around them into several safety areas (SA). Using the received signal strength, safety messages can be mapped to their corresponding SAs. As vehicles change their position, neighboring vehicles in the SAs change, however this mapping function remains the same. Another advantage of using received signal strength to find vehicle position is that malicious users can not launch location spoofing attack.

This mapping can be further improved by the CAM classifier module that utilizes the k-means clustering algorithm and a feedback of valid CAMs that have been verified correctly at the receiver as shown in Fig. 6. Based on a set of valid CAM observations (c 1 , c 2 , ..., c n ), where each observation is a one-dimensional vector which contains the CAM received signal strength (P m , ∀m, 1 ≤ m ≤ n), k-means clustering aims to partition the n CAM observations into k (≤ n) safety areas sets SA = {SA 1 , SA 2 , ..., SA k } so as to minimize the within-cluster sum of squares (i.e., least-squares estimator)

arg min SA k l=1 Pm∈SA l ||P m -µ l || 2 (1)
where µ l is the mean of points in SA l (i.e., mean received signal strength). Vehicles compute accurate received signal strength to safety area mapping after a training phase of few iterations. The safety messages are further dispatched to a Multi-Level Priority Queue (MLPQ) in order to optimize their verification as depicted in Fig. 6. Each message is placed in the corresponding safety area queue (SAQ) to assign priority. Every time a new packet is to be verified, the first packet in the highest safety area queue is extracted. As a result, messages originating from closer vehicles are verified first and latency for critical packets is improved.

B. Performance Improvement

The simulation configuration used for our evaluation experiments is described in Sec. IV-B. We display the average cryptographic packet loss (CPL), percentage of packets which could not be verified within 100ms, at different transmitterreceiver distances in Fig. 7. The five selected SAs are marked as 50m, 100m, 150m, 200m, and > 200m. The adaptive security technique is compared against two mechanisms, namely a static security mechanism that verifies packets without any priority and a random security mechanism that randomly picks a packet out of the security queue for verification. The marked numbers in the figure indicate the total CPL within a safety area. Since fresh messages are sent every 100ms, the packets which could not get verified within this time are dropped from the security queue due to timeout (i.e., slow security verification).

Both static and random security techniques result in large CPL for closer safety areas. The peak in CPL at 40 -50m distance bins indicates the highest number of packets received from this region, hence resulting in more CPL. However, the adaptive security mechanism verifies the packets from nearby vehicles with priority, hence reducing the CPL. Particularly, within a distance of 150m, this loss is below 1% for the adaptive mechanism compared to 12 -14% for the other techniques. Beyond this distance, the CPL for the adaptive technique is increased, which however does not effect the safety application.

Fig. 8 illustrate the average inter-arrival delay between two consecutive CAMs (within a safety area of 150m) using different processor speeds. As expected, the adaptive security mechanism results in a significant improvement of around 70 -80ms in inter-arrival delay when compared to both the static and random security techniques. Through prioritized verification of packets from nearby vehicles, the adaptive mechanism results in a quicker update of the mobility information about neighboring vehicles as received in the CAMs.

It can also be noted that a fast processor (Intel i7) results in a significant reduction of CAM inter-arrival delay. This is because a faster processor can perform more DECAP operations per seconds as shown in Fig. 4. Another key point here is that the adaptive security technique enables vehicles to use cheaper CPUs with lower clock rates. For example, in this case, the adaptive security can provide 10 -15ms lower interarrival delay even with a mid range processor as compared to static and random security techniques with a fast processor.

Finally, we show the awareness quality level (AQL) metric (within a safety area of 150m) as proposed by the authors in [START_REF] Feiri | The impact of security on cooperative awareness in vanet[END_REF]. The AQL metric provides a measure of how many of the actual neighbors of a vehicle are aware of it at any given time. As shown in Fig. 9, the adaptive security mechanism improves the AQL metric by 22 -24% within 150m when compared to the static and random security techniques. By using a fast processor, the adaptive security mechanism provides a AQL of greater than 84%. The remaining loss is due to packet collisions in the considered high density scenario and multi-path fading. Nonetheless, the adaptive security technique maintains a much better level of awareness for vehicles within the vicinity. Note that in this paper, we do not consider memory size of OBU transceiver that can limit the number of CAMs that can be stored in the security queue.

VI. OPPORTUNITIES AND CHALLENGES

Maintaining security and satisfying QoS requirements are essential to achieve the task of reliable communications in ITS. The following are some of the opportunities and challenges in this domain.

A. Cryptographic Hardware Accelerators

To minimize the impact of security on the application's QoS and achieve an important speedup in handling secure ITS communications, one way is to delegate all the cryptographic operations to dedicated Hardware Security Modules (HSM) or Trusted Platform Modules. Vehicles OBUs should be equipped with such hardware modules, as security co-processors. As shown in Fig. 4, the usage of higher CPU frequencies can enable the handling of a higher number of cryptographic operations, such as ECDSA signature verifications. Even though this scheme can achieve security and QoS gains, the additional cost of a separate HSM could be costly. An important challenge is to design a cryptographic hardware module with a special focus on ITS applications. Such a module should provide implementation of light weight cryptographic algorithms suited for ITS applications and available at an affordable price.

B. Adaptive Security-QoS Schemas

Existing ITS standards have a static selection of the security schemas which are based on expensive cryptographic operations and are uncapable of handling a large amount of messages, without impacting the systems critical latency. As already shown in this article, adaptive security algorithms can significantly enhance the application's QoS. Moreover, adapting the security schemas and algorithms based on context changes (e.g. wireless channel conditions, available resources, etc.) can improve the scalability of ITS systems, but at the cost of lower security levels.

A joint security-QoS adaptation mechanism can assist ITS applications to maintain their QoS while ensuring security of data exchanges. Vehicles can continuously monitor their QoS indicators and adjust their security in terms of key management, key lengths, algorithm types and security levels accordingly. Moreover, vehicles can also adapt and optimize their priority mechanism depending on the type of application. For example, for non-safety applications, priority could be assigned based on application criticality instead of receivertransmitter distance. Vehicles could also use dynamic adaptation of safety areas according to application requirements.

In addition, decentralized congestion control mechanisms as defined in the ETSI standard can also be used to adaptively adjust transmission parameters according to traffic densities on the roads [START_REF] Sepulcre | Integration of congestion and awareness control in vehicular networks[END_REF]. For example, in a high density scenario, ITS applications could reduce the packet generation rate or transmit power in order to accommodate security overheads. Dynamic optimization of the networking services, in terms of optimal service differentiation schemes, access categories and priorities can also help maintain security-QoS balance in ITS. In summary, an intelligent security-QoS framework is required to combine the various techniques to adjust security and QoS according to application's needs.

C. Social Network based reputation

In ITS, vehicles interact with their neighboring vehicles and infrastructure to form a transportation social network. Moreover, other entities in ITS such as pedestrians, passengers, etc. exhibit social affiliations and exchange data with their social peers [START_REF] Yang | Toward trustworthy vehicular social networks[END_REF]. In fact, a reputation system can be deployed on ITS entities to select security levels based on the social interactions and reputation of the nodes. For example, nodes with high centrality and strong ties are less prone to be malicious.

VII. CONCLUSION

In this article, we highlight the relationship between security and QoS for ITS applications. We present the generic communications model of ITS and discuss the major design challenges related to security and QoS. We benchmark the security processing times required for standard-compliant security procedures and analyze the QoS of secured ITS safety applications. To improve the safety application's QoS while keeping the security intact, we discuss a machine learning based adaptive signature verification scheme. Finally, we discuss some of the future opportunities on how dynamic adaptation of security and QoS can benefit ITS.

Fig. 1 :

 1 Fig. 1: Communications in ITS.

  (a) ETSI TC ITS Compliant Security Module (BeagleBone version). (b) Online tool for ITS Security Performance Benchmark [10].

Fig. 2 :

 2 Fig. 2: ETSI TC ITS Security Standard Compliant Experimental Test-Bed and Online Tool.

Fig. 3 :

 3 Fig. 3: Number of ENCAP operations per second for different security procedures and processor speeds using the ETSI standard.

Fig. 4 :

 4 Fig. 4: Number of DECAP operations per second for different security procedures and processor speeds in ETSI standard.

Fig. 5 :

 5 Fig. 5: Average Inter-CAM Delay (95% confidence interval).

Fig. 6 :

 6 Fig. 6: Adapting Security and QoS in ITS by using k-means clustering and Safety Area Queues (SAQ).

Fig. 7 :

 7 Fig. 7: Average Cryptographic Packet Loss (95% confidence interval).

Fig. 8 :

 8 Fig. 8: Average CAM Inter-arrival Delay.

Fig. 9 :

 9 Fig. 9: Awareness Quality Level.

Table . I

 . . Active safety applications have stringent requirements of latency as well as security because they involve human safety. So, they need to maintain data integrity, keep privacy and anonymity of the vehicle identities, and non-repudiation. Traffic efficiency applications such as route guidance can

TABLE I :

 I System Requirements of ITS Applications.

	Application	Use Cases	Communication Modes	Tx Range	Tx Frequency	Critical Latency	Security Requirements
	Active Road Safety	Cooperative awareness Collision warning Emergency notification	Broadcast Single-hop/Multi-hop	300m to 1km	10 Hz	<100ms	Data integrity Privacy and Anonymity Non-repudiation
	Traffic Efficiency	Route guidance	Broadcast	1km	2 Hz	<500ms	Data integrity
		Optimal green light advisory	Multi-hop				Privacy and Anonymity
	Global Internet Services	Multimedia download	Unicast	1km	1 Hz	<1s	Data integrity
		Multiplayer games	Multi-hop
	Pedestrian Comfort	Pedestrian crossing	Broadcast Single-hop	500m	5Hz	<200ms	Data integrity Privacy and Anonymity Non-repudiation
	Electronic Commerce	Online transactions	Unicast	1km	1Hz	<500ms
			Multi-hop

ACKNOWLEDGMENT

This article was made possible by NPRP grant #[7-1113-1-199] from the Qatar National Research Fund (a member of Qatar Foundation). The statements made herein are solely the responsibility of the authors.