Sonia Khetarpaul

S K Gupta

L Venkata Subramaniam

Analyzing Travel Patterns for Scheduling in a Dynamic Environment

Keywords: Spatio-temporal data mining, geographical Locations, GPS logs, Meeting Points

Scheduling a meeting is a difficult task for people who have overbooked calendars and many constraints. This activity becomes further complex when the meeting is to be scheduled between parties who are situated in geographically distant locations of a city and have varying traveling patterns. We extend the work of previous authors in this domain by incorporating some real life constraints (varying travel patterns, flexible meeting point and considering road network distance). We also generalize the problem by considering variable number of users. The previous work does not consider these dimensions. The search space for optimal meeting point is reduced by considering convex hull of the set of users locations. It can be further pruned by considering other factors, e.g., direction of movement of users. Experiments are performed on a real-world dataset and show that our method is effective in stated conditions.

Introduction

Recent advances in wireless communication and positioning devices like Global Positioning Systems (GPS) have generated significant interest in the field of analyzing and mining patterns present in spatio-temporal data. The pervasiveness of locationacquisition technologies (GPS, GSM networks, etc.) has enabled convenient logging of location and movement histories of individuals. The increasing availability of large amounts of spatio-temporal data pertaining to the movement of users has given rise to a variety of applications and also the opportunity to discover travel patterns. Managing and understanding the collected location data are two important issues for these applications.

The amount of data generated by such GPS devices is large. For example, most GPS devices collect location information for a user every 2 to 5 seconds [START_REF] Zheng | Geolife: Managing and understanding your past life over maps[END_REF]. This means that for a single user between 17000 to 44000 data points are generated in a single day. Aggregated over tens of users over several days the data size grows exponentially [START_REF] Zheng | Geolife: Managing and understanding your past life over maps[END_REF][START_REF] Zheng | Understanding mobility based on gps data[END_REF]. This is extremely rich data and a lot of useful analysis can be performed on this data, potentially giving rise to a variety of application.

The objectives of this paper is to analyze historical data, determine spatio-temporal relationships among users and predict their behavior efficiently and to determine the optimal meeting point for n users on a road network.

Different applications ranging from location-based services to computer games require optimal meeting point (OMP) query as a basic operation. For example, an educational institute may issue this query to decide the location for a institute bus to pick up the students, so that the students can make the least effort to get to the pickup point. This is also true for numerous other scenarios such as an organization that wants to find a place for its members to hold a conference. This can also be helpful for deciding common meeting points, for social networking site users, having common interests. In strategy games, a computer player may need this query as part of the artificial intelligence program, to decide the appropriate routes.

We introduce two measures to evaluate the processing cost i.e. the minimum-sumcenter and the direction of movement. These measures operate over the spatio-temporal domain of each moving objects by applying a network distance to all objects tracked. Each measure induces a spatio-temporal relation that minimizes or maximizes a property over the underlying network graph for the given measure and the given set of moving users. We develop query processing algorithms for computing the value of these measures and to determine spatio-temporal relations and the point on the road network that yields the optimal value of relation's value from the predictive graph of moving objects. Finally, we demonstrate how object movement histories and projected movement trajectories can be used to determine the optimal meeting point.

Problem Statement

The problem statement can be stated in terms of input and output as follows:

-Input : Given GPS logs of n users, proposed meeting time, road network -Output: An Optimal Meeting Point Location(Latitude,Longitude) for given n users We assume that users have travelling patterns which can be discovered from logs of their travel history. These logs are generated by standard GPS devices. We assume that these devices generates traces at the same rate and in same format(same granularity) or GPS traces can be transformed to a fixed format. We define the optimal meeting point for group of people as:

Let {u 1 , u 2 , ....., u n } be a set of n users. The users have a definite travel pattern(may be periodical) which is hidden in their logs. Let u i (t) denotes the location of user i at time instant t. It is noted that if all of these n users wish to meet at some fixed time, and the meeting point is desired as OM P , then the sum of distances would be the total cost of meeting(for all the users). It is proposed to minimize this cost.

Optimal meeting point is defined to be arg min OM P ∈N [Σd N (u i (t), OM P )], where d N (x, y) is the shortest distance between two point x and y on the road network N .

Informally, we define the optimal meeting point as a point on the road network where the sum of distances travelled by all the users is minimum. In Figure 1 total distances travelled by all users is minimum at point OM P , and is 23 K.M. We also consider predicted directions of motion of users at time t and at time t + δt to optimize the total distance covered by each user. It is considered by examining the consecutive hulls of of location points.

The rest of this paper is organized as follows. In the following subsection we describe related work and also put the work of this paper in the context of related work. Later in section 2, we introduce algorithms, describing the underlying idea to determine the optimal meeting point. In Section 3, we report the results of our experiments on realworld dataset to show the feasibility of our algorithms for the OMP queries. Finally, we conclude our paper in Section 4.

Related Work

There has been a lot of prior work on using spatio-temporal data to track movement history. There has also been work around integrating multiple users' information to learn patterns and understand a geographical region. GeoLife is a location-based socialnetworking service on Microsoft Virtual Earth. GeoLife enables users to share travel experiences using GPS trajectories [START_REF] Khetarpaul | Mining GPS Data to Determine Interesting Locations[END_REF][START_REF] Zheng | Mining correlation between location using human location[END_REF][START_REF] Zheng | Geolife: Managing and understanding your past life over maps[END_REF][START_REF] Zheng | Understanding mobility based on gps data[END_REF][START_REF] Horozov | Using location for personalized poi recommendations in mobile environments[END_REF]. It finds the top most interesting locations, classical travel sequences in a given geospatial region. In geolife to find out interesting locations in a given geospatial region HITS model (Hypertext induced topic model search) is introduced. The paper [START_REF] Jeung | A Hybrid Prediction Model for Moving Objects[END_REF] is based on Hybrid Prediction Model, which estimates an object's future locations based on its pattern information as well as existing motion functions using the object's recent movements. Other systems like and CityVoyager [START_REF] Simon | A mobile application framework for the geospatial web[END_REF] are designed to recommend shops and restaurants by analyzing multiple users' real-world location history. Mobile tourist guide systems [START_REF] Zheng | Mining correlation between location using human location[END_REF][START_REF] Simon | A mobile application framework for the geospatial web[END_REF][START_REF] Beeharee | Exploiting real world knowledge in ubiquitous applications[END_REF][START_REF] Park | Location-based recommendation system using bayesian user's preference model in mobile devices[END_REF] typically recommend locations and sometimes provide navigation information based on a user's real-time location. In contrast, our approach is based on assumption that users are moving not stationary, and follows a regular routine during weekdays. Our approach to determine users location points is based on simple statistics that applied on users historical GPS traces.

OMP problem is well studied in different forms in Euclidean space. In Euclidean space optimal meeting point is basically the Geometric median of location point set. When the Euclidean distance is adopted as the metric of distance, the OMP query is called the Weber problem [START_REF] Cooper | An Extension of the Generalized Weber Problem[END_REF], and the OMP is called the geometric median of the query point. Like various nearest neighbor queries [START_REF] Chen | Monitoring Path Nearest Neighbor in Road Networks[END_REF][START_REF] Mouratidis | Continuous Nearest Neighbor Monitoring in Road Networks[END_REF][START_REF] Cho | An Efficient and Scalable Approach to CNN Queries in a Road Network[END_REF][START_REF] Lung Yiu | Aggregate Nearest Neighbor Queries in Road Networks[END_REF], the OMP query is also fundamental in spatial databases.

In our previous work [START_REF] Khetarpaul | Mining GPS traces to recommend common meeting points[END_REF] we have determined common meeting point from spatiotemporal graph analysis for two users in the Euclidean space. In this paper we determine the optimal meeting point from the trajectory analysis for n users on road network. This brings in several factors in the analysis, making the system flexible and more realistic to use, while adding complexity to analysis.

On the other hand, the OMP query is not well explored in terms of road networks, where the network distance is adopted as the distance metric. However, compared with the Weber problem, this is a more realistic scenario for location-based services. Recently, [START_REF] Xu | Processing Proximity Relations in Road Networks[END_REF] proposed a solution to this problem by checking all the split points on the road network. It is proved in [START_REF] Xu | Processing Proximity Relations in Road Networks[END_REF] that an OMP must exist among the split points, which leads to an algorithm that checks the split point of each query point in Q on each edge in the road network G = (V, E), and picks the split point with the smallest sum of network distances as the OMP. As a result, the search space is |Q|.|E|, which is huge. Although [START_REF] Xu | Processing Proximity Relations in Road Networks[END_REF] includes a pruning technique to skip some split points that are guaranteed not to be an OMP, the search space after pruning is still very large. Therefore, a novel road network partitioning scheme is proposed in [START_REF] Xu | Processing Proximity Relations in Road Networks[END_REF] to further prune the search space, based on the property that the OMP is strictly confined within the partition where all the objects in the query set Q are located. After that [START_REF] Da Yan | Efficient Algorithms for Finding Optimal Meeting Point on Road Networks[END_REF] proves that an OMP must exist either on vertex or on query points, there is no need to check all the split points. So search space is reduced to |Q| + |V |. To further reduce the search space two phase convex-hull-based search space pruning techniques are proposed in [START_REF] Da Yan | Efficient Algorithms for Finding Optimal Meeting Point on Road Networks[END_REF]. In contrast our approach considers that user are moving not stationary, so we are predicting user locations, the directions in which they are moving and pruning the search space based on their locations before and after the meeting. Our approach considers both spatial and temporal aspect of data. Our approach is defined in following section.

Determining Optimal Meeting Points for Multiple Users

GPS and other positioning devices generate location information every few seconds (often at the interval of two to five seconds). An individual carrying such a device potentially generates thousands of GPS points everyday. It is important to be able to aggregate all the data from multiple users and predict their location points at the given time. In this paper we will apply statistical operation to generate spatio-temporal location point prediction for each user at given time. After predicting the location points for the user optimal meeting point is determined.

We will now define the notation and also describe the problem that we are solving. We assume that there are n users whose time stamped GPS logs are available to us.

GPS Users:

We have GPS logs of n users U = {u 1 ,u 2 ,.....,u n }. GPS Point: A GPS point g i is a four field tuple, x, y, d, t where x, y are geographic coordinates (Latitude, Longitude respectively) and d, t is the timestamp (date, time respectively) represents a user's location at any point of time.

The pair (Longitude, Latitude) represents the position of the user at a particular point of time. For the purposes of standardization, we assume that each value in the pair is given in six decimal places. A value in decimal degrees to 6 decimal places is accurate to 0.111 meter at the equator [START_REF]Accuracy versus decimal places at the equator[END_REF].

GPS Trajectory: A GPS trajectory T r i is a sequence of GPS traces ordered by timestamp T r i = (g i1 , g i2 ....., g in ) of the user i.

We divide our region of interest into a grid C of m * n cells where m is number of unique δLat and n is number of unique δLng.

Cell: A cell c i is a rectangular element of grid C dividing the region of interest. They are sequenced major rowwise and minor columnwise.

Road Network Distance: Road network distance is the shortest length of path between two cells on road network. This distance is obtained using function d N (c i , c j ), it returns the length of path between two cells of grid C, c i and c j on road network. This distance function d N (c i , c j ) can be realized through google maps.

Location Point: A location point l i represents the location of the i th user on grid C at a point of time.

We determine the location points of all individual users at given point of time. Location point of a user is a predicted geographical location where the user is, at given meeting time. This prediction is done by statistical analysis of their past GPS logs.

Location Point Determination:

Most of us generally follow a specific travel pattern during working days. To determine the location point for each individual user, at a given point of time, we analyze their past GPS logs. By applying statistical operations on their past GPS trajectories, we are able to predict their locations at a given point of time. For location points analysis w.r.t. to time and space, the whole geographical space is divided into grid, where each cell c(l * w) represents a small geographical region and is assigned a number. Twenty four hours in a day are divided into small time periods of length δt. The log records are mapped on to this grid. For each user, his/her location cell number, after every δt interval of time is identified from his/her log records. User locations of many days at different time intervals are summarized to generate his/her spatio-temporal graph.

We determine the maximum and minimum value of latitude and longitude(Ar = (maxlat -minlat) * (maxlng -minlng) gives total area of city), which define our domain of interest. δlat * δlng form the area of a single cell within the grid. They are sequenced major rowwise and minor columnwise, from 1 to K, where K maximum number of cells. Location of each user is predicted in terms of a cell number. Mapping of user's GPS location into cell number and cell number into GPS location is done using following conversions.

Mapping given location (Lat i , Lng i ) to cell number: Cellno = ((Lng i -minLng)/δLng) * No. of unique δclng+((Lat i -minLat)/δLat)

Mapping given cell number to location (Lat i , Lng i ):

Cellno = lng ind * No. of unique δlng + lat ind
Where lng ind is quotient and lat ind is remainder when cellno/ (No of unique δlng)

Lat i = minLat + lat ind * δLat Lng i = minLng + lng ind * δLng
Using these mapping we are able to plot user historical traces onto grid after every δt time interval. After plotting the user traces on the grid we apply statistical mode operation (defined below) to determine the user location at given time t.

Temporal Mode of User Location Points:

The temporal mode of a set of data points is the value in the set that occurs most often during a specified time interval. The mode of i th user's historical data points M ode(U i ) is the value that occur more frequent within a specified the time. For applying the mode operation, users longitude and latitude values are mapped onto the grid so that it points to the defined geographical region. The mode operation is applied for each user.

Let U i be the set of GPS points of user i at time δt and l i be the most frequently visited location point of user for given time δt.

l 1 = M ode(U 1 ) l 2 = M ode(U 2 ) l n = M ode(U n ) L = {l 1 , l 2 , l 3 , ....., l n }
For a set of users, we can determine the cell numbers(location points) in which they are expected to be at any point of time. Let the set of location points of n users is denoted with L = {l 1 , l 2 , ....., l n } at time t.

By applying these statistics we determine the cell where an individual user is mostly present at a given point of time. We discard the cells which are visited very few number of times in long period of GPS traces.

A baseline algorithm to solve the meeting point problem is defined below.

Baseline Algorithm:

For a given set of users, let L be union of set of location points. The baseline algorithm considers all the cells |C| within the grid as the probable candidates for an optimal meeting point. The baseline algorithm evaluates the sum of distances from the location points of each user to each cell and the OMP is the cell with the minimum value of the sum.

The approach is presented in Algorithm 1 where function d N computes shortest distance between a location point l i and cell c j on road network using any standard procedure (in our case Google Maps API).

The baseline algorithm has very high computational complexity O(nK), where n number of users and K is the number of cells, as it considers the entire grid as the search space. It is required to prune the space to overcome this problem. We propose the use of a two level convex hull pruning to reduce the search space, and there by improving the efficiency.

OM P ← N U LL mincost ← +∞ foreach ci ∈ C do sum ← 0 foreach lj ∈ L do sum ← sum + dN (ci, lj) cost ← sum if cost < minCost then mincost ← cost OM P ← ci Return(OM P )
So baseline approach is to consider all the cells on the grid as a search space to determine the optimal meeting point. In our approach we are using two level convex hull pruning to reduce the search space and to improve the efficiency of search.

Convex Hull Based Pruning:

The convex hull H(L) of a set L is the intersection of all convex sets of which L is a subset. It is also the union of all straight lines joining all pairs of points in L [START_REF]Convex Hull and properties[END_REF]. It can be observed that given a set of location points L, a minimum distance point from all location points of set L, i.e., argmin x [Σd E (l i , x )] always lies inside the convex hull H(L), where function d E (x, y) returns Euclidean distance between points x and y. It can be deduced from the property of a convex object that its centroid lies within the object [START_REF]Convex Hull and properties[END_REF]. But, as shown in figure 2(a), it may not be always true for road network.

To ensure this property for road network, we calculate the shortest route between every two location points using function shortRoute(x, y), all the points that lies among the routes are merged with location points set as described in figure 2(b). After that we take the convex hull of this set.

According to the baseline algorithm, OMP must exist among one of cells in the Grid. It is not necessary to check all the cells in the grid. The search space can further be pruned. We check only those cells that are in the smallest partitioned grid enclosing all cells of the user's location points. We define a convex hull based pruning technique in Algorithm 2, where convexHull(L) computes the convex hull of the point set L using Andrew's Monotone Chain algorithm [START_REF] Preparata | Computational Geometry:An Introduction[END_REF] and takes O(|P |log|P |) time where P is the number of points. All the cells those lie within the hull, we collect them into set P . Now to determine the OMP we check only those that are belong to set P .

foreach li ∈ L do foreach l k ∈ L do OCells ← shortRoute(li, l k ) Ln ← L ∪ OCells P ← 0 H ← ConvexHull(Ln) foreach ci ∈ C do if ci ∈ H then P ← P ∪ ci else Discard ci Return(P )
The search space is significantly reduced using convex hull based pruning. It is further possible to trace the direction of movement from the user data. We can further reduce the search space by considering the direction of movement of the Users'.

Direction of Movement Based Pruning:

Let L(t) = {l 1 , l 2 , . . . , l n } be the set of location points of users at time t and let P be the set of cells of the grid lying within the convex hull of L(t). Similarly, let L (t+δt) = {l 1 , l 2 , . . . , l n } be the set of location points at time t + δt and P be the set of cells of the grid lying within the convex hull of L (t + δt). By analyzing the two consecutive convex hulls, it is found that two cases are possible.

Case 1: The two convex hulls are intersect or overlap. In this case, the meeting point among the cells is assumed to lie inside the intersection/overlapped region. Figure 3 depicts the intersecting and figure 4 depicts the overlapped convex hulls of four users. It may be noted that this case also covers the case if a convex hull is completely contained in the other convex hull shown in figure 5. In this case, we assume that the meeting point would lie in the smaller convex hull. We take meeting point inside the intersection because it reduces the sum of total distance travelled by users before and after the meeting. Case 2: The two convex hulls are disjoint of each other (i.e. they have zero intersection). In this case, we assume that the meeting point would lie in the first convex hull. We take meeting point inside the intersection because it reduces the sum of total distance travelled by users to reach the meeting point.

These two levels of convex hull pruning prune the search space to P , a considerably reduced set. A complete algorithm 4 is developed to determine optimal meeting point in such a scenario. Function Map(OMP,OMPLoc) converts cell designated as OMP into (Latitude,Longitude) pair represented by OMPLoc.

Experiments

In this Section, we first present details about the GPS dataset used [START_REF] Zheng | Mining correlation between location using human location[END_REF][START_REF] Zheng | Geolife: Managing and understanding your past life over maps[END_REF][START_REF] Zheng | Understanding mobility based on gps data[END_REF]. Next we present the results of applying statistical operations on the temporal aspect of GPS data for predicting user location points at a given time. Then, as stated, two level of pruning are used to determine OMP. We compare the results of our approach with two other approaches in terms of total distance travelled by users before and after the meeting and number of cell searched. First approach is when we do not consider the direction of movement of users and second approach is when we consider all location points before and after the meeting i.e. L and L simultaneously.

GPS trajectory dataset

The GPS trajectory dataset [START_REF] Zheng | Mining correlation between location using human location[END_REF][START_REF] Zheng | Geolife: Managing and understanding your past life over maps[END_REF][START_REF] Zheng | Understanding mobility based on gps data[END_REF] is a repository of real life data collected by Microsoft Research. The data was collected by 165 users in a period of over two years (from April 2007 to August 2009). A GPS trajectory of this dataset is represented by a sequence of time-stamped points, each of which contains the information of latitude, longitude, height, speed and heading direction, etc. These trajectories were recorded by different GPS loggers or GPS-phones, and have a variety of sampling rates. 95 percent of the trajectories are logged in a dense representation, e.g., every 2 ∼ 5 seconds or every 5 ∼ 10 meters per point, while a few of them do not have such a high density being constrained by the devices. This dataset recorded a broad range of users' outdoor movements at different time intervals over a day, including not only life routines like going home and going to work but also some entertainment and sports activities, such as shopping, sightseeing, dining, hiking, and cycling etc. In the data collection program, a portion of users carried a GPS logger for more than two years, while some of them may have carried a logger for few weeks. We worked on 126 users from the above dataset and worked on their GPS traces. This subset consists of a total of 68612 days data with 5,832,020 GPS points. The total area covered by the GPS logs exceeded 3,880,951 Sq. kilometers. The majority of the data was created in Beijing, China. A large part also came from Hangzhou. We have partitioned the total area covered by users into grid. Following subsections explain the grid formation for further processing.

Determining grid:

The major portion of this dataset belongs to Beijing, China. A grid is defined over this area, which is approximately 38972.068 Sq. kilometers, with minLat=38.0, minLng=115.0 and maxLat=40.0, maxLng=117.0. This is further divided into small cells of (222 meter * 219 meter) area with δLat=0.002 and δLng=0.025. Thus we have a total of 1,80,00,00 cells. These cells are sequenced major rowwise, minor columnwise and identified by unique numbers from 1 to 1800K. Users GPS points are mapped into these cells and their location points are predicted.

After partitioning the city into the grid, the aim is to compute the user locations at a given point of time and map them onto grid.

Predicting User Location Points:

Recent one month historical data of a user is analyzed to predict his/her location at a given time. For example if we have to predict the user location for 18 April at 10 am. then we extract his last month data points for the time interval 9:45 to 10:15 am. Data points are mapped on to grid and temporal mode operation is applied to determine the cell with maximum frequency of data points. This cell is marked as location point for the user at 10 am.

This experiment is performed for hundreds times and prediction is made for days for which data is already available. It is observed that 73% of times predicted cell is same as actual location of user. For all prediction made a mean square error of 0.238 was determined. Figure 6 shows a mean square error detected for 104 prediction made. After computing users locations our aim is to determine a meeting point for them on road network.

Determining Optimal Meeting Place:

To check the efficiency and accuracy of our approach, we conducted experiments to determine optimal meeting point in three different ways, described below.

OMP by considering set L(No Directions): In this case, we determine the meeting point, for a given meeting time, by considering only set L. For example, if the meeting time is at 10 am, then search space is pruned by considering users' location at 10 am only. A convex hull of current location points L is calculated and the optimal meeting point is determined within this convex hull.

OMP by considering set L and L simultaneously: In this case, we determine the meeting point, for a given meeting time, by considering both set L and L at the same time. For example, if meeting time is at 10 am and meeting duration is one hour, then we prune the search space by using both sets of user locations at 10 am and at 1l am simultaneously. Convex hull of all location points is calculated and the optimal meeting point is determined within this convex hull.

OMP by considering Direction of Movement of Users with Time: In this case, we consider the direction of movement of users to determine the meeting point. For example, if meeting time is 10 am and meeting duration is one hour, then we prune the search space by considering users' location points at 10 am and at 11 am. We first determine the convex hull of locations points at 10 am and then we determine the convex hull of user locations at 11 am. An optimal meeting point is determined within the intersecting/overlapped area of two convex hull.

A table 1 summarizes the average distance travelled by all users and average number of cells to be searched in each of these three cases is given below. Experiment is performed 50 times for different number of users and Optimal meeting point is determined in each of these three cases. Figure 7 shows the graph of total distance travelled by users in each of these three cases. The X-axis shows the average distance travelled by users. Graph shows that users have to travel much more distance in case 1, when we do not consider direction of movement of users. In case 2 and case 3 these distances are nearly same.

Figure 8 shows the graph of number of cells to be searched to determine the optimal meeting point in each of these three cases. Graph shows that more number of cells are required to be search in case 1 and case 2 as compare to case 3. It shows that the search space is significantly reduced if we apply the two-level convex hull pruning.

Conclusions

Scheduling a meeting is a difficult task for people who have overbooked calendars and many constraints. The complexity increases when the meeting is to be scheduled between parties who are situated in geographically distant locations of a city and have varying travel patterns.

In this paper, we investigated the problem of identifying a common meeting point for a group of users who have temporal and spatial locality constraints that vary over time. We solved the above problem for a number of users on road network by using the GPS traces of the users.

We begin by mining historical GPS traces of individual user and mapped their locations onto predefined grid and predicted their location points for the given meeting time. We then applied two levels of convex hull based pruning to reduce the search space and determine the optimal meeting point. We have used predicted future direction of movement of the users to reduce total distance travelled by users before and after the meeting.

The method was evaluated on a large real-world GPS trace dataset and showed the effectiveness of our proposed method in identifying a common meeting point for an arbitrary number of users on the road network.

Fig. 1 :

 1 Fig. 1: Optimal Meeting Place

Algorithm 1 :

 1 BaseLine Algorithm(L,C) Data: Location points L = {l1, l2, . . . , ln} of n users at given time Ti on the Grid containing |C| cells Result: Optimal Meeting Place-A cell on the Grid OM P (Lat, Lng) begin

Fig. 2 :

 2 Fig. 2: Counter example

Algorithm 2 :

 2 ConvexHullPruning(LocationPoints,Cells) Data: Location points L = {l1, l2, . . . , ln} of n users at given time Ti on the Grid consists of cells C Result: Set of Grid Cells P lying inside the Convex Hull begin OCells ← 0

Fig. 3 :

 3 Fig. 3: Intersecting Hulls

Fig. 4 :

 4 Fig. 4: Overlapped Hulls

Fig. 5 :

 5 Fig. 5: Inner Hull

Algorithm 4 :

 4 OMP Algorithm(L,L',C) Data: Location points L = {l1, l2, . . . , ln} and L = {l 1 , l 2 , . . . , l n } of n users at given time Ti and Ti + δTi on the Grid G containing |C| cells Result: Optimal Meeting Place-A cell on the Grid OM P Loc(Lat, Lng) begin P ← ConvexHullP runing(L, C) P ← ConvexHullP runing(L , C) P ← DirectionP runing(P, P ) mincost ← +∞ foreach ci ∈ P do sum ← 0 foreach lj ∈ P do sum ← sum + dN (ci, lj) cost ← sum if cost < minCost then mincost ← cost OM P ← ci M ap(OM P, OM P Loc) Return(OM P Loc)

Fig. 6 :

 6 Fig. 6: Prediction Error

Fig. 7 :

 7 Fig. 7: Distance Travelled by users

Table 1 :

 1 Distance Travel and Cells to be searched in 3 different Cases

	Without Directions		All Location Points		With Directions
	Avg.Distance1 Avg.Cells1 Avg.Distance2 Avg.Cells2 Avg.Distance3 Avg.Cells3
	35.032	454.925	31.00505	407.375	31.94225	74.125


Åsmund Ahlmann Nyre
email: asmund.a.nyre@sintef.no

Martin Gilje

Seeking Risks: Towards a quantitative risk perception measure

Existing instruments for measuring risk perception have focused on an abstract version of the concept, without diving into the the details of what forms the perception of likelihood and impact. However, as information security risks become increasingly complex and difficult for users to understand, this approach may be less feasible. The average user may be able to imagine the worst case scenario should an asset be compromised by an attacker, but he has few means to determine the likelihood of this happening. In this paper we therefore propose a different approach to measuring risk perception. Based on well established concepts from formal risk analysis, we define an instrument to measure users' risk perception that combines the strengths of both traditional risk perception and formal risk analysis. By being more explicit and specific concerning possible attackers, existing security measures and vulnerabilities, users will be more able to give meaningful answers to scale items, thereby providing a better and more explanatory measure of risk perception. As part of the instrument development we also elaborate on construct definitions, construct types and the relationship between these and the corresponding risk perception instrument. Although it remains to be verified empirically, the validity of the measure is discussed by linking it to well established theory and practice.

Introduction

There is a fundamental relationship between risk exposure and the perceived need for protection. If there are no risks, then there is nothing that needs protection either. That is why users' intention to adopt a security measure is tied directly to the perceived risk [START_REF] Nyre | On the adoption of usage control technology in collaborative environments[END_REF]. However, when faced with However, the problem is that perceived risk is highly subjective, and therefore varies greatly between people. There are many risk assessment methodologies, but as a rule they are quite complex, and not suitable for use by a layperson. In order to measure a layperson's risk perception, we need a simpler instrument that helps splitting the difficult question "what is the risk to your system" into manageable pieces. Even more importantly, though, the instrument should help to explain why the risk is perceived as it is.

A better understanding of regular users' risk perception would be an important basis for improving security technology, awareness-raising and ultimately also the uptake of security technology. This user-centric approach to risk allows security technology to focus on the risks important to the user, and thereby both gaining acceptance and motivation for its usage. The approach lends its idea from user-centric design of software systems, in that it is the users' perception that guides the design and presentation, rather than the designer's perception. This is not to say that security professionals' risk analysis should be discarded, but rather that the presentation to users should be based on their perceived risk. With a deeper understanding of the motivations behind the risk perception, it is also easier to spot misconceptions which can skew the perceived risk.

In order to gain a better understanding of risk perception, we need a model of how risk perception is formed and how it can be measured. This paper contributes a theoretical foundation and the initial step towards such a measurement instrument. To this end, we combine results from research on risk perception and well established concepts from formal risk analysis methodologies.

The remainder of this paper is organised as follows. In Section 2 we provide an overview of related work on measuring risk perception in IT. Next, in Section 3 we provide some background on previous research on judgments under uncertainty, risk perception, and risk analysis frameworks. In Section 4 we present our risk perception model and a preliminary instrument for measuring risk perception. Then we discuss the validity of our instrument in Section 5, before we give our concluding remarks in Section 6.

Related work

Work on risk perception has been seen when investigating the factors that affect IT technology adoption in general, and information security technology in particular. For instance Featherman and Pavlou [START_REF] Featherman | Predicting e-services adoption: a perceived risk facets perspective[END_REF][START_REF] Pavlou | Consumer acceptance of electronic commerce: Integrating trust and risk with the technology acceptance model[END_REF] showed that risk perception have a negative effect on consumers' intention to engage in online shopping. Risk perception was measured by the different facets of risks, including time risk, performance risk, financial risk and privacy risk. According to the definitions of these terms, they do not explicitly include the risks associated with active attackers. In a similar study, Kim, Ferrin and Rao [START_REF] Kim | A trust-based consumer decision-making model in electronic commerce: The role of trust, perceived risk, and their antecedents[END_REF] used the perceived privacy and security protection as well as familiarity, reputation, trust disposition and the presence of privacy seals to predict intention to adopt online shopping. The measure of privacy protection does include a scale item concerning "unautorized users (i.e. hackers)" [START_REF] Kim | A trust-based consumer decision-making model in electronic commerce: The role of trust, perceived risk, and their antecedents[END_REF], but for the most part the measure concerns the integrity and honesty of the vendor. Hörst, Kuttschreuter and Gutteling [START_REF] Horst | Perceived usefulness, personal experiences, risk perception and trust as determinants of adoption of e-government services in the netherlands[END_REF] and Belangr and Carter [START_REF] Bélanger | Trust and risk in e-government adoption[END_REF] both used a measure of risk perception in determining the intention to adopt e-government services. Both studies use a high level measure of perceived risk that neither caters for the different facets of risks nor active attackers.

Studies of adoption of information security technology such as anti-spyware software [START_REF] Chenoweth | Application of protection motivation theory to adoption of protective technologies[END_REF], data backup software [START_REF] Crossler | Protection motivation theory: Understanding determinants to backing up personal data[END_REF] and wireless security settings [START_REF] Woon | A protection motivation theory approach to home wireless security[END_REF] have used a decomposed measure of risk to predict adoption intention. That is, based on the Protection Motivation Theory (PMT) [START_REF] Rogers | A protection motivation theory of fear appeals and attitude[END_REF], these studies measure the perceived vulnerability (likelihood) and severity (impact) of an adverse event, rather than the perceived risk. The same approach is also found in research on antecedents of employees' security policy compliance [START_REF] Siponen | Employees' adherence to information security policies: An empirical study[END_REF][START_REF] Herath | Protection motivation and deterrence: a framework for security policy compliance in organisations[END_REF][START_REF] Bulgurcu | Information security policy compliance: An empirical study of rationality-based beliefs and information security awareness[END_REF]. Although the measures used are more specific on security threats and also include adversaries, they do not include perceptions of current security measures or adversaries. The foundations for risk perception in psychology is further discussed in the upcoming section.

There is an abundance of risk analysis frameworks that describe in varying degree of detail the considerations that should be taken when analysing risks. Examples of such frameworks include the OWASP Testing guide [START_REF]OWASP: OWASP testing guide v3. Tech. rep., The Open Web Application Security Project[END_REF], OCTAVE Allegro [START_REF] Caralli | Introducing octave allegro: Improving the information security risk assessment process[END_REF], NIST RMF [START_REF] Stoneburner | Risk management guide for information technology systems[END_REF] and CORAS [START_REF] Lund | Model-Driven Risk Analysis: The CORAS Approach[END_REF]. The focus of these frameworks is to guide corporations or security professionals in performing thorough, comprehensive and reliable risk analyses. The aim is therefore to capture a more objective assessment of security risks. For the purpose measuring subjective risk perception, these frameworks cannot be applied directly. However, they do provide valuable insights into the concept of risk and provide an important basis on which we build our risk perception instrument.

Our work differ from previous research in that it attempts to bridge the gap between risk perception measures and risk analysis methodologies. The risk perception measure we propose maintains the subjective notion of risk while being more concrete and more detailed concerning the risk concept itself. Thus we extend risk perception measures to include the common concepts of risk found in formal risk analysis methodologies.

Background

Since risk is all about handling uncertainties, we provide a brief introduction to the psychological process of judgement under uncertainty. The cognitive processes form a basis for understanding the existing theories of risk perception. Finally, we give an overview of the main common concepts of risk found in existing risk analysis methodologies. This is by no means intended as a complete review of either area, but rather to identify some important concepts that we use when devising a risk perception measure.

The psychology of judgment under uncertainty

There seem to be general consensus among researchers that the cognitive process may be regarded as two separate, although connected, systems [START_REF] Kahneman | A perspective on judgment and choice: Mapping bounded rationality[END_REF]. One is the fast and effortless intuition while the other is the slow and time consuming reason. Epstein [START_REF] Epstein | Integration of the cognitive and the psychodynamic unconscious[END_REF] have called these systems the experiental system and the rational system, whereas others including Kahneman and colleagues [START_REF] Kahneman | Representativeness revisited: Attribute substitution in intuitive judgment[END_REF][START_REF] Kahneman | A perspective on judgment and choice: Mapping bounded rationality[END_REF] refer to them simply as system 1 and system 2. These two systems are assumed to operate quite differently. The intuition creates the initial judgment, whereas the rational system monitors and correct obvious mistakes. Intuition is fast, automatic, effortless, emotional and capable of parallel operations, whereas the rational system is slow, effortful, conscious and controlled. Thus, intuitive judgments can be made in parallel with other tasks, without giving it much conscious thought, while rational cognition requires more attention and therefore often interrupts other cognitive tasks. That is seemingly why the intuitive system always attempts to make a suggestion, while the rational system monitors and corrects the judgments that are obviously wrong. In general Kahneman reports five ways in which a judgment is made [START_REF] Kahneman | A perspective on judgment and choice: Mapping bounded rationality[END_REF]:

1. An intuitive judgment or intention is initiated, and (a) Endorsed by the rational system; (b) Adjusted (insufficiently) for other features that are recognized as relevant; (c) Corrected (sometimes overcorrected) for an explicitly recognized bias; or (d) Identified as violating a subjectively valid rule and blocked from overt expression. 2. No intuitive response comes to mind, and the judgment is computed by the rational system.

Whenever our cognition fails, it is therefore not only the failure of one system, but both. First, the intuition fails to give proper judgment, either by giving an erroneous one or by not giving one at all. Next, the rational system fails to correct the initial intuitive judgment or fails to compute a proper judgment if no initial intuitive response was created.

Rational risk perception

Fischhoff, Slovic et al. [START_REF] Fischhoff | How safe is safe enough? a psychometric study of attitudes towards technological risks and benefits[END_REF][START_REF] Slovic | Rating the risks[END_REF][START_REF] Slovic | Why study risk perception?[END_REF][START_REF] Slovic | Perception of risk[END_REF] have studied antecedents or dimensions of risk perception and their influence on the perception of risk and benefit, and found that these dimensions were highly correlated. For instance, it seemed that risks that where perceived to be controllable also was perceived voluntary. Based on the correlation between dimensions, Fischoff and Slovic proposed two sets of dimensions, or factors, affecting risk perception. This has later been termed the psychometric approach and have been one of the key approaches to understanding risk perception. High risk is characterized by factor 1 as events which are unobservable and new, have unknown risk and delayed effect. On factor 2 high risk is characterized as events that are uncontrollable, involuntary and difficult to prevent, and have catastrophic fatal consequences involving considerable dread. The psychometric approach is based to a large extent on the idea that risk perception is a conscious deliberate rational process. That being said, dread, being intimately associated with intuition, was found to be one of the dominant dimensions of this approach. Still, as explained by Slovic later the focus of the research was on rational cognition [START_REF] Slovic | The Feeling of Risk -New perspectives on risk perception[END_REF].

Critics of the approach [START_REF] Sjöberg | Explaining risk perception: An evaluation of the psychometric paradigm in risk perception research[END_REF] have pointed to a number of weak points, particularly the fact that factor analysis is done on average ratings of dimensions, Benefit Affect Fig. 1: The affect heuristic [START_REF] Slovic | Risk as analysis and risk as feelings: Some thoughts about affect, reason, risk, and rationality[END_REF][START_REF] Slovic | The affect heuristic[END_REF] instead of individual ratings. Although this does not necessarily mean that the factors identified in the psychometric approach are wrong, it implies that there could be many more factors than what originally was found.

Risk and affect

From the theory of decisions under uncertainty it is apparent that intuition also plays a vital part in understanding risk perception. Affect was identified as part of the psychometric approach (e.g. dread and fear), but has later thought to be more important in determining risk perceptions. Alhakami and Slovic (reported in [START_REF] Slovic | The affect heuristic[END_REF]) found that although risk and benefit often are positively correlated in real life (i.e. great risk comes with great benefits), people's perception of risks and benefits are often negatively correlated. This discovery led them to propose that risk and benefit perceptions were guided by the affective impression of activity or technology in question. Later, this effect was termed the affect heuristic for risk perception [START_REF] Finucane | The affect heuristic in judgements of risks and benefits[END_REF][START_REF] Slovic | Risk as analysis and risk as feelings: Some thoughts about affect, reason, risk, and rationality[END_REF][START_REF] Slovic | The affect heuristic[END_REF]. The basic idea of this heuristic is that people record representations of prior events that are labeled according to the affective response they generate. Thus, whenever a judgment is to be made, people consult the recordings and are guided by the positive or negative affective label attached to it [START_REF] Finucane | The affect heuristic in judgements of risks and benefits[END_REF]. Positive feelings yield high perceived benefit and low perceived risk (see Fig. 1).

Finucane et al. [START_REF] Finucane | The affect heuristic in judgements of risks and benefits[END_REF] provided empirical evidence for the affect heuristic by giving different information concerning the risks and benefits of nuclear power. The study showed that whenever participants were informed of the benefits, they perceived the risks to be lower than when not receiving such information. In the same paper, the authors also used time limitations to demonstrate the affect heuristic, since system 1 operates much faster than system 2, the study suggests that under time pressure, people will rely on affect for their risk judgments.

Anticipated outcomes

Cognitive evaluation

Feelings

Subjective probability

Other factors

Behaviour Outcomes

Fig. 2: Risk as feelings model [START_REF] Loewenstein | Risk as feelings[END_REF] Loewenstein et al. [START_REF] Loewenstein | Risk as feelings[END_REF] propose the "risk as feelings"-hypothesis that feelings and cognitive evaluations are mutually influenced by each other and they both have a direct effect on behaviour, positing that emotions often produce behaviour that is in conflict with optimal behaviour. Fig. 2 illustrates these close interconnections of the two systems on risky behaviour.

Risk analysis

As mentioned in Section 2 there are several existing frameworks for conducting risk analyses. Although they are generally unsuitable to be directly transferred to a risk perception measure, the fundamental concepts on which they rely are useful. We therefore outline the predominant definitions of risk and discuss the contents of the main concepts of information security risk.

Definitions Although there are many definitions of risk in the area of information security, they all share the basic concepts of likelihood and impact. For example, ISO defines the level of risk as the "magnitude of a risk, expressed in terms of the combination of consequences and their likelihood" [START_REF]Information technology -Security techniques -Information security risk management[END_REF], whereas the the Open Web Application Security Project (OWASP) denotes this product of likelihood and impact as risk. Similarly, NIST defines risk as "the net mission impact considering (1) the probability that a particular threat-source will exercise (accidentally trigger or intentionally exploit) a particular information system vulnerability and (2) the resulting impact if this should occur" [START_REF] Stoneburner | Risk management guide for information technology systems[END_REF]. Despite the different wording the general concept that risk concerns the combined likelihood and impact of an adverse event is generally agreed upon (see Fig. 3).

Impact The impact constitutes the negative effects an adverse event would have. The OWASP testing guide [START_REF]OWASP: OWASP testing guide v3. Tech. rep., The Open Web Application Security Project[END_REF] distinguishes two separate kinds of impacts Impact Risk Likelihood Fig. 3: The basic risk model when determining the overall risk. Technical impact includes a breach of one or more of the security attributes such as loss of confidentiality, integrity or availability. Business impact on the other hand, is concerned with the resulting specific damage to the business or organisation. ISO-27005 [START_REF]Information technology -Security techniques -Information security risk management[END_REF] and NIST 800-30 [START_REF] Stoneburner | Risk management guide for information technology systems[END_REF] refer to the impact as the business impact and use breach of information security (goals) for the technical impact. The meaning however remains largely the same.

The technical impact is largely unaffected by the context or domain in question. Data theft will always yield loss of confidentiality (or we would not call it theft) as the technical impact, but the impact this will have on the business is very much dependent on the domain, organisation and context in which the adverse event occurred. Since the technical impact of adverse events remains relatively stable across organisations and domains it is difficult to dispute it, whereas the impact on the business may be much less obviously identified and hence often also disputed and debated. Finally, it requires security knowledge to identify the technical impact, whereas business knowledge is required to identify the corresponding business impact. Table 1 gives an overview of these differences.

There are several factors that could be investigated in order to assess the business impact. OWASP lists four such factors; financial damage, reputation dam-age, non-compliance and privacy violations 3 . There could potentially be many more, depending on the domain in question. In a previous study we have shown that loss of competitiveness is seen as the most important business impact of the oil and gas industry [START_REF] Nyre | Usage control in inter-organisational collaborative environments -a case study from an industry perspective[END_REF]. Other potential impact factors include operational discontinuity, legal liability, customer dissatisfaction or harm to personnel.

Likelihood The other main aspect of risk is the likelihood of an adverse event occurring. However, unlike classical safety problems there are few ways of gaining reliable statistical data to accurately calculate the probability. Metrics such as Mean Time To Failure (MTTF) are inherently difficult whenever it involves an actual non-random attacker. The problem is not only that any assessment of attack likelihood is to a great extent dependent on subjective opinions, but that it may be difficult to even have an opinion. What is the likelihood of foreign intelligence agencies conducting espionage in my company? Unless you have actually experienced it happening, it is very difficult to know what to think.

When performing risk assessments it is thus common to instead look at the factors that affect the likelihood, instead of the actual likelihood itself. The OWASP testing guide [START_REF]OWASP: OWASP testing guide v3. Tech. rep., The Open Web Application Security Project[END_REF], ISO27005 [START_REF]Information technology -Security techniques -Information security risk management[END_REF] and NIST 800-30 [START_REF] Stoneburner | Risk management guide for information technology systems[END_REF] provide three sets of factors of risk likelihood:

-Vulnerability: Is it easy for an attacker to discover the vulnerability? If it is discovered, is it easy to exploit? Is the vulnerability common knowledge? -Attackers or Threat agents: Are the potential attackers skilled to perform an attack? Do they have a motive? How often does the opportunity to exploit the vulnerability present itself? How many possible attackers are there? -Existing controls: To what extent do the current security measures reduce the likelihood of exploiting the vulnerability? Is it likely that an exploit can be detected?

In the OWASP guide existing controls are not explicitly part of the guidance. However, implicitly it may be argued that detection mechanisms may very well be considered a control mechanism. Some of these factors are highly inter-connected, such as how easy it is to exploit a vulnerability and how skillful the threat agents are. If the exploit is difficult, the threat agents must be very skillful in order to launch an attack; if the exploit is easy, it really does not matter how skillful the threat agents are.

Towards a model and measure of risk perception

Risk can be modelled in many different ways. It is common to first model a construct and next worry how to operationalize and measure it. However, as noted by Jarvis et al. [START_REF] Jarvis | A critical review of construct indicators and measurement model misspecification in marketing and consumer research[END_REF] and Petter et al. [START_REF] Petter | Specifying formative constructs in information systems research[END_REF], it is useful to look at these two issues combined rather than in isolation. In this section we define the constructs of a risk perception model that is needed to create a corresponding measurement instrument. In doing so, we discuss the different types of constructs and their implications for the instrument.

Construct types

There are fundamentally three different ways in which constructs can be modelled: reflective, formative or multidimensional [START_REF] Jarvis | A critical review of construct indicators and measurement model misspecification in marketing and consumer research[END_REF]. The way in which a construct is modelled also affects the way in which the construct can be measured. Below we present the main differences between these different types of constructs.

A reflective construct is used to denote a one-dimensional construct (i.e. has no sub-constructs) where the same aspect of the construct can be measured in different ways. In a standard questionnaire-type measure, this would mean that all items or questions measure the same underlying phenomenon and therefore all items are supposed to covary. Therefore, a respondent scoring low on one scale item is more likely to score low on the other scale items of the construct. Further, the scale items should be replaceable and removing one should not affect the overall measure of the construct. Reflective constructs are the predominant in Information Systems Research [START_REF] Petter | Specifying formative constructs in information systems research[END_REF] A much less used type of construct is the formative construct [START_REF] Petter | Specifying formative constructs in information systems research[END_REF], where the measurement items are combined to form the construct. From its definition, a formative construct is defined through its measurement items [START_REF] Jarvis | A critical review of construct indicators and measurement model misspecification in marketing and consumer research[END_REF] such that changing one of the items would yield a changed construct. Unlike the reflective constructs, the items of a formative measure are supposed to tap into different aspects of the construct in order to "cover" the entire construct. Hence, the measures are not required to and often not intended to covary.

Multi-dimensional constructs are modeled as a composite of its sub-constructs where the construct is defined through its sub-constructs. Each sub-construct may in turn be modeled as either reflective, formative or multidimensional. Thus, measuring a multidimensional construct means to combine the measures of all its sub-constructs, representing a kind of divide-and-conquer strategy to modelling.

A risk perception model

The model of risk perception we propose is based on the concepts identified in common risk analysis frameworks and previous research on risk perception. The model is depicted in Fig. 4. Below, we describe the different constructs of the model and suggest which type of construct would be appropriate. Determining the correct type of construct depends on the purpose of the model and of course how it is intended to be measured. Thus, it may be perfectly sensible to model the constructs of our model differently, if the purpose was different.

Risk is in current literature and among security professionals typically defined as the combination of likelihood and impact (see Section 3). If we were to model risk as reflective, the corresponding measure would have to be on the form "How risky is it to ... ?". There would be no way to capture the likelihood impact of Fig. 4: Concepts of information security risk a threat. Thus, for our purposes, it is evident that risk should either be formative or multi-dimensional. The difference between these two types are more subtle, since it really depends on whether affect, likelihood and impact are just three measures that jointly form risk perception, or if they are seperate constructs to be measured on their own. As we base ourselves on the concepts of risk analyses, we believe the latter to be the case and hence model risk perception as a multidimensional construct.

The concept of affect is commonly viewed in risk perception literature as the "experienced feeling states associated with positive or negative qualities of stimulus" [32, p. 4]. Although seldom explicitly labeled as such, it is typically assumed to be reflective. That is, measuring feelings such as fear or worry all tap into the same aspects of a concept (the negative qualities).

Likelihood is similar to risk perception in that there are different concepts that make up the likelihood (Fig. 4). However, a notable difference is that likelihood is not commonly defined as the combination of the vulnerabilities, attackers and existing controls. These three concepts influence the likelihood, although not necessarily simultaneously. I.e., it is perfectly conceivable that there may exist serious vulnerabilities and no motivated or skilled attackers at the same time. Thus, the vulnerabilities, attackers and existing measures are not required to covary and hence a formative or multi-dimensional construct seems appro-priate. For multi-dimensional constructs it is assumed that the sub-constructs themselves are distinct [START_REF] Jarvis | A critical review of construct indicators and measurement model misspecification in marketing and consumer research[END_REF], so that measurements of each sub-construct do not capture each other. In other words, there should be a clear and definite separation between the sub-constructs. Vulnerabilities and existing security measures do however have commonalities even though the concepts themselves are not identical. E.g., the lack of a security measure may increase the vulnerability. Similarly, vulnerabilities and attacker motivation/skill also share some of the ideas. A vulnerability that is easy to exploit would not require the attacker to be very skillful, and hence the two concepts also tap into one another. Therefore, it appears that modeling likelihood as a formative construct may be the better option, such that vulnerabilities, attackers and existing controls denote different aspects of likelihood, rather than complete constructs of their own.

Impact is perhaps the most difficult concept to model, because it depends to a large extent on the threat in question and the context in which it exists. If we are considering the threat of credit card fraud against individual users, it safe to assume that reputation damage is not relevant. However, if we are considering the same threat from the perspective of a payment company, then the reputation damage may be very relevant. The possible impacts (financial damage, reputation damage, non-compliance and privacy violation) in our model are by no means exhaustive, there could be several other impacts that are important for the context at hand. We have previously shown [START_REF] Nyre | Usage control in inter-organisational collaborative environments -a case study from an industry perspective[END_REF] that users collaborating across company borders are focused on the loss of competitive advantage impact. Thus, the aspects of impact that we list in Fig. 4 are to be treated as a starting point on which context-dependent impact aspects may be added. Since there is no reason to assume that the different possible impacts covary, it does not seem appropriate to model the construct as reflective. Further, it is also noted that financial damage and reputation damage may overlap, in the sense that damage to ones reputation yields reduced sales and thus financial loss. Therefore, we suggest that the impact construct be regarded as a formative construct.

An instrument for measuring risk perception

The motivation for modelling risk perception is to devise a measurement framework that can more accurately capture the risk perception of regular users. For this, we propose a self-report questionnaire to let users respond to statements regarding the risk of specific ICT threats. Here we present a preliminary sketch of the instrument, currently with excessive redundancy in the questions. Readers should take care not to treat any of these questions as tested and verified.

In Table 2 we have listed some example questionnaire items for measuring two of the sub-constructs of risk perception; likelihood and impact. The statements are supposed responded to by indicating the degree to which respondents agree with the statements (e.g.on a five-point scale from "strongly agree" to strongly disagree). Since risk perception is modeled as a multi-dimensional construct, there are no measurement items for the risk perception itself. Instead, it is to be computed from its sub-constructs, which in turn are measured through their supporting concepts rather than directly. Hence, we have not included questions or statements directly targeting likelihood for instance. The example questionnaire items do not include measures of affect, as there are several tested and validated measurement instruments that can be used (e.g., Crites et al. [START_REF] Crites | Measuring the affective and cognitive properties of attitudes: Conceptual and methodological issues[END_REF]). What becomes apparent when creating measurement instruments is that the threat and potential impact must be specified to a certain detail. It is difficult to say anything about attacker motivation, unless you know who the attacker is. Thus, for the risk perception measure to work, there needs to be a serious effort up front to determine the possible attackers, vulnerabilities, threats and the possible resulting impact. However, by expanding and extending this framework of risk perception measures, the effort required for adapting measurement instruments will steadily decline.

Discussion

In this section we discuss some of the difficult issues of validity and trust.

Construct validity

A central aspect to any model and measurement is their validity. Does the model actually represent risk perception? Does the measurement actually measure risk perception? Both the model and the measures are based on extensively used and agreed-upon concepts for conducting risk analysis. Our risk perception model is therefore tightly coupled with the information security communities definition of risk. The central point here is whether the concepts of risk analysis can meaningfully be applied to risk perception. Or to put it in other terms: Do people actually consider attackers' motivation as part of their risk perception? In our experience regular users often refer to possible attacker motivations or skills. Statements like "who would want my information" or "it is very difficult to make use of our source code" are indeed not uncommon and clearly demonstrate that users consciously consider the motivation and skills of potential attackers.

Another thing to consider is that the systematic approach of risk analysis attempts to identify objective risk, that is free from subjective judgments. That is, risk analysis is supposed to trigger the rational system, not the intuitive system. Whereas our risk perception measure also consider affect or intuition. A central concept in the risk as feelings theory (see Section 3) is the mutual relationship between the cognitive and affective response to risk. That is, that the rational system both influence and is influenced by the intuitive system.

Our model and corresponding instrument for measuring risk therefore have a sound basis in theory. It is worth noting that the measurement instrument needs to be tested and properly evaluated before definitive statements can be made regarding the validity of the constructs.

Content validity

A potential problem with our framework is that it requires identification of the specific threats, vulnerabilities, attackers and potential damages to be assessed. We have already discussed the implications of this in terms of reusing measurement instruments and the effort required to identify and prioritize the concepts. However, a perhaps more severe problem is the potential threat to validity it poses. That is, how do we know that the identified threats, vulnerabilities, attackers and potential damages are appropriate and sufficient? It may be that an important group of attackers are omitted or disregarded from the measurement instrument, which again may give an invalid result. This may happen even if the the statements (or scale items) used have previously been tested and verified. This further strengthens our belief that a risk perception measure should be treated as a starting point and would require great care to address the validity concerns when applied to other contexts..

Convergent and discriminant validity

Our model, constructs and corresponding measures are supported by existing theory and practice. However, it is common to test a new measure for convergent and discriminant validity. That is, to ensure that our measure of risk correlates with other measures that it theoretically should correlate with, while at the same time be unrelated to other measures that theoretically should be unrelated.

However, there are no well established measures of risk perception other than the pure reflective measure risk commonly used (see related work in Section 2). We have postulated that these measures are not particularly good for ICT risk perception as they are too abstract to meaningful for our purposes. Normally one would have liked our measure to have high convergent validity with these other risk perception measures. However, this may indicate that our measure is equally poor as the existing ones. On the other hand, if our measure and the other measures demonstrate discriminant validity (they are unrelated) that could would indicate that one of the measures are invalid, but not which one.

Another method to indicate such validity would be to measure risk perception in relation to another construct. The protection motivation theory for instance postulates that there is a relation between the perceived risk and the intention to use protective technology. Hence, if our measure fits such a model, it would strengthen the argument that the measure is indeed valid.

Relation to trust

Risk perception is to some extent related to trustworthiness and trust. There are several trust models that incorporate risk [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF], and intuitively trust also imply a certain degree of risk. However, as noted by Mayer, Davis and Schoorman [START_REF] Mayer | An integrative model of organizational trust[END_REF], risk is an outcome of trust and therefore "differentiates the outcomes of trust from general risk-taking behaviors because it can occur only in the context of a specific, identifiable relationship with another party" [START_REF] Mayer | An integrative model of organizational trust[END_REF]. Since we propose a general purpose adaptable instrument for risk perception measurement, we have omitted trustworthiness as part of our risk perception. However, in specific contexts where there are indeed identifiable relationships between parties, trustworthiness may well be included as a factor that affect risk perception.

Conclusion

In this paper we have presented a risk perception model and a preliminary measure of the risk perception of ordinary ICT users. Our approach is based on a combination of prior research on general risk perception and common practices in the risk analysis field. The risk perception measure focus on measuring aspects on which ordinary users can be expected to have an opinion. The validity of the construct is promising since it is based on solid existing theory and practice. However, great care should be taken to address the threats to content validity for different risks.

In further work we will employ our instrument in a larger study, testing the validity of our risk perception measure in a larger population.

Table 1 :

 1 Technical and business impact

	Technical impact	Business impact
	Breach of security attribute	Breach of business goals
	Domain and context insensitive Domain and context sensitive
	Security knowledge	Business/domain knowledge

Table 2 :

 2 Example questionnaire items for the multi-dimensional risk perception construct

	Construct Concept	Statement/Question
	Likelihood Vulnerability	"Exploiting vulnerability is easy"
			"The vulnerability is well known"
		Attacker	"Attackers have the necessary skills to exploit the
			vulnerability"
			"Attackers have financial interest in exploiting the
			vulnerability"
		Existing controls	"Existing security measures prevent attackers from
			exploiting the vulnerability"
			"Existing security measures can detect attackers ex-
			ploiting the vulnerability"
	Impact	Financial damage "Attackers exploiting vulnerability would result in fi-
			nancial damage"
		Reputation damage "Attackers exploiting the vulnerability would damage
			the company's reputation"
		Privacy violation "Attackers exploiting the vulnerability would cause a
			breach of customer's privacy"

Although the OWASP testing guide[START_REF]OWASP: OWASP testing guide v3. Tech. rep., The Open Web Application Security Project[END_REF] does not explicitly define financial damage, we use it here to denote direct monetary losses as a result of an adverse event. This is to prevent confusion with business impact.