Szymon Gres

Martin Dalgaard Ulriksen

Michael Döhler

Johan Rasmus

Johansen

Palle Andersen

Lars Damkilde

Andreas Nielsen

Statistical methods for damage detection applied to civil structures

Keywords: Structural health monitoring, ambient excitation, damage detection, control chart-based algorithm fusion

Damage detection consists of monitoring the deviations of a current system from its reference state, characterized by some nominal property repeatable for every healthy state. Preferably, the damage detection is performed directly on vibration data, hereby avoiding modal identification of the structure. The practical aspect of using only the output measurements cause difficulties because of variations in ambient excitation due to variability in the environmental conditions, like sea, wind, and temperature. In this paper, a new Mahalanobis distance-based damage detection method is studied and compared to the wellknown subspace-based damage detection algorithm in the context of two large case studies. Both methods are implemented in the modal analysis and structural health monitoring software ARTeMIS, in which the joint features of the methods are concluded in a control chart in an attempt to enhance the resolution of the damage detection. The damage indicators from both methods are evaluated based on the ambient vibration signals from numerical simulations on a novel offshore support structure and experimental example of a full scale bridge. The results reveal that the performance of the two damage detection methods is similar, hereby implying merit of the new Mahalanobis distance-based approach, as it is less computational complex. The fusion of the damage indicators in the control chart provides the most accurate view on the progressively damaged systems.

Introduction

Online vibration-based damage detection methods are increasingly popular for detecting damages during operational time of large civil and mechanical structures. In particular, for complex public structures such as bridges [START_REF] Döhler | Structural health monitoring with statistical methods during progressive damage test of S101 Bridge[END_REF], where human safety is a priority, or for structures difficult to access and inspect, like wind turbine blades [START_REF] Ulriksen | Operational modal analysis and wavelet transformation for damage identification in wind turbine blades[END_REF] or offshore foundations [START_REF] Weijtjens | Foundation structural health monitoring of an offshore wind turbine-a full-scale case study[END_REF]. For given cases, amongst many other examples, the vibration-based damage detection relies on identification of the damage-induced deviations in the damage-sensitive quantities of the collected response signals.

A frequent practice is to use a modal approach, which presumes that the damages are fully reflected by the vibrational characteristics (natural frequencies, mode shapes or damping ratios) identified from the data and thereafter compared between the healthy and current states. However, field work questions the direct use of the modal parameters, arguing that the modal data itself is not sensitive enough to detect the local faults [START_REF] Doebling | A summary review of vibration-based damage identification methods[END_REF], especially when, in practice, the structure is excited by low-frequency inputs. One bypass to the modal framework is to use the statistical methods, where characteristic damage-sensitive quantities are derived directly from the data and evaluated for damages in a hypothesis tests [START_REF] Carden | Vibration based condition monitoring: A review[END_REF]. This paper contributes to the vibration-based statistical damage detection methods with a revision of a new Mahalanobis distance (MD)-based method presented by the authors in [START_REF]Structural Vibration Solutions A/S. NOVI Science[END_REF]. The distance metric is calculated on the output vibration data processed in the framework similar to the subspace-based methods [START_REF] Döhler | Subspace-based damage detection under changes in the ambient excitation statistics[END_REF], hereby providing an approach that is robust towards changes in the excitation covariance. As such, damage is detected as deviations of the distance from the reference test state. The proposed approach is tested on numerical simulations with a novel offshore support structure, namely, a Mono Bucket (MB) foundation, and an experimental full scale case of progressively damaged highway bridge in Austria. The performance of the MD-based damage detection approach is compared to the well-known classic and robust subspace-based techniques [START_REF] Carden | Vibration based condition monitoring: A review[END_REF][START_REF] Worden | Damage detection using outlier analysis[END_REF], which are implemented in ARTeMIS [START_REF] Basseville | Subspace-based fault detection algorithms for vibration monitoring[END_REF]. The resolution of the damage detection in both numerical and full scale cases is enhanced by a combination of both methods in a Hotelling control chart [START_REF] Van Overschee | Subspace identification for linear systems: Theory, implementation, applications[END_REF].

The structure of the paper is as follows. The basic principles of the MD-based damage detection approach are presented in Section 2. Both the comparison and joint performance of the methods, with a description of the numerical and full scale cases, are presented in Section 3. The final results are concluded in Section 4.

Mahalanobis distance-based damage detection

The square MD between the observations in the data vector 𝐱 𝑖 and a reference, baseline model with the sample mean 𝛍 and the covariance matrix 𝚺 is defined as 𝑀𝐷 𝑖 = (𝐱 𝑖 -𝛍) 𝑇 𝚺 -1 (𝐱 𝑖 -𝛍).

(

) 1
In this paper, the MD is calculated on empirical block-Hankel matrices based on output correlations and used directly as a damage indicator, see Eq. 2. The squared MD featured with the Hankel matrices of output correlations is defined as

𝑀𝐷 𝑖 = 𝑣𝑒𝑐(𝐇 ̂𝑝+1,𝑞 -𝛍(𝐇 ̂𝑝+1,𝑞 𝑅𝑒𝑓 )) 𝑇 (𝚺 𝐇 ̂𝑝+1,𝑞 𝑅𝑒𝑓 ) -1
𝑣𝑒𝑐(𝐇 ̂𝑝+1,𝑞 -𝛍(𝐇 ̂𝑝+1,𝑞 𝑅𝑒𝑓 )).

(

) 2
where 𝛍(𝐇 ̂𝑝+1,𝑞 𝑅𝑒𝑓 ) is a mean value of a baseline model and 𝐇 ̂p+1,q

Ref is a reference output block Hankel matrix determined using 𝑚 merged reference data sets. The proposed metric is robust towards the variations of the excitation covariance and can, therefore, be employed for operational measurements. The formulation of the block-Hankel matrices is adapted from the subspace-based methods. Consider the system outputs 𝑟 ,where 𝑟 is the number of sensors, and a subset of 𝑟 0 sensors denotes the number of reference channels. Each entry (𝑠, 𝑡) of the output correlation matrices 𝐂 i ∈ 𝑅 𝑟𝑥𝑟 0 yields 𝑪 𝑖 𝑠,𝑡 = Ε(𝒚 𝑘+𝑖 𝑠 𝐲 k t𝐓 )/𝝈 𝑠 𝝈 𝑡 , where 𝑠 = 1, … , 𝑟, 𝑡 comprises all reference channels, and 𝝈 𝑠 with 𝝈 𝑡 denote the standard deviation of the signals from sensors 𝑠 and 𝑡, respectively. The correlations can be structured in the block-Hankel matrix

𝐲 𝐤 = [𝑦 𝑘 1 𝑦 𝑘 2 … 𝑦 𝑘 𝑟 ] 𝑇 ∈ 𝑅
𝐇 𝑝+1,𝑞 = [ 𝐂 1 𝐂 2 𝐂 2 𝐂 3 ⋯ … 𝐂 𝑞 𝐂 𝑞+1 ⋮ ⋮ ⋱ ⋮ 𝐂 𝑝+1 𝐂 𝑝+2 … 𝐂 𝑝+𝑞 ] = Hank(𝐂 i ). (3)
𝐇 𝑝+1,𝑞 ∈ 𝑅 (𝑝+1)𝑟 𝑥 𝑞𝑟 0 where 𝑝 and 𝑞 are parameters such 𝑞 = 𝑝 + 1. Based on the assumption that the damage introduces a change in the distribution of 𝐇 ̂p+1,q Ref , it is identified 𝑇 𝑚 lengths outside the baseline state as an outlier [START_REF] Lowry | A review of multivariate control charts[END_REF], so

𝑀𝐷 𝑖 ≤ 𝑇 𝑚 → ℎ𝑒𝑎𝑙𝑡ℎ𝑦 𝑀𝐷 𝑖 > 𝑇 𝑚 → 𝑑𝑎𝑚𝑎𝑔𝑒𝑑 . ( 4
)
Here, 𝑚 designate the reference, healthy data sets and 𝑖 denotes the tested state. The threshold 𝑇 𝑚 is defined as one standard deviation above the mean value of the reference state.

Numerical simulations

The numerical tests are conducted on a finite element (FE) model of an MB foundationa new concept for a support structure for offshore wind turbines [START_REF] Houlsby | Suction Caisson Foundations for Offshore Wind Turbines and Anemometer Masts[END_REF]. The MB structure consists of a circular steel shell forming a skirt, which is installed inside the seabed and closed with a circular plate that creates air-tight conditions inside the socalled bucket. The air-tight feature allows to install the foundation with suction pumps, that is silent and fast to achieve. The shaft is connected to the foundation by steel profiles called webs, which transfer the operational load to the skirt. The welded shaft-web connection is prone to high stresses and carry a significant fatigue load, thus it is considered as a potential damage location. The damages are simulated as a progressive thickness (t) reduction of the elements in the shaft-web connection, by 1%, 5%, 15%, 40% and 85%. Each element is a square of 100mm x 100mm. The damage test scenario along with a corresponding data set is described in Table 1.

Damage detection results

The reference state is created using the first 30 data sets from the healthy state. All damage detection tests are conducted with the parameter setting 𝑞 = 𝑝 + 1 = 5. The damage indicators for the numerical test cases along with the fusion of subspace-based and MD-based methods are illustrated in Fig. 2. All methods detect the cases with 40 % and 85 % reduction of thickness, whereas the 15 % reduction is only detected by the MD-based and the robust subspace-based methods. The first phase with 5% reduction is detected by the MD-based algorithm, however, along with several false alarms triggered in the healthy state. Only the fusion of all the detection methods in the Hotelling control chart is capable of identifying each damage scenario and does not outline damages in the healthy data.

S101 bridge

The instrumentation and employment of a structural health monitoring system on the S101 bridge was described in detail in [START_REF] Döhler | Structural health monitoring with statistical methods during progressive damage test of S101 Bridge[END_REF]. This section contains a brief review of the monitoring setup, along with a description of the damages introduced to the bridge and a comparison of the results obtained from the subspace-based methods, similar to the findings in [START_REF] Döhler | Structural health monitoring with statistical methods during progressive damage test of S101 Bridge[END_REF], and the MD-based scheme. The S101 was a prestressed concrete bridge located in Reibersdorf, Austria. With the main span of 32 m, side spans of 12 m, and a width of 6.6 m, it crossed the national highway A1 Westautobahn. Built in 1960, it had to be demolished due to structural problems and to allow space for additional lanes on the highway underneath. That created an opportunity for conducting a progressive structural damage tests. The bridge was artificially damaged and monitored within the "Integrated European Industrial Risk Reduction System (IRIS)" research project. The measurement campaign was conducted by VCE and the University of Tokyo. The purpose of the campaign was to demonstrate the impact of scientific insight and findings with regards to the rehabilitation measures and cost planning of the transportation infrastructure. Acceleration responses were recorded using 15 tri-axial sensors mounted on the bridge deck. The bridge was monitored continuously from 10-13 December 2008, with a sampling frequency of 500 Hz, hence resulting in a total of 714 data sets (with 165000 samples in each). Naturally, the bridge was closed for any traffic during the progressive damage tests. As a result the main source of ambient excitation was wind together with vibrations from the highway beneath the bridge. The structural damages introduced in the bridge were of several types and locations. Two major damage scenarios can be distinguished, as outlined in Table 2.

Damage detection results

The reference state is created using the first 100 healthy data sets. Output acceleration signals are decimated to 12.5 Hz and all damage detection tests are conducted with the parameter setting 𝑞 = 𝑝 + 1 = 16. To reduce the computational time, 4 reference, or so-called projection, channels are chosen based on [START_REF] Döhler | Structural health monitoring with statistical methods during progressive damage test of S101 Bridge[END_REF]. In total, 680 out of 714 data sets were investigated for damages. The comparison of the damage indicators for the robust subspace-based and MD-based methods is illustrated in Fig. 3.

The results on Fig. 3 shows that the MD-based method identifies the healthy state up to 150 data set, which agrees with the structural testing scheme, and classifies the damages to the respective periods seen in Table 2. When comparing the results from both methods, the MD-based damage indicators are more sensitive to the local, less significant, damages-I, J, K, whereas the major damage events-C, D, E, F are less pronounced, yet identified.

Discussion and conclusions

This paper presents a revision of a recently developed MD-based damage detection method, whose performance has been compared to well-established subspace-based damage detection approaches. The methods were tested on the basis of an FE simulation model of a novel offshore support structure and an experimental case of a full-scale artificially damaged bridge.

Despite the changes in the variance of the ambient excitation, both methods have proven to be effective in detecting the damages in both the simulations and the full scale experimental tests. The performance of the new MD-based damage detection appears similar to the robust subspace-based scheme in both cases. Both the subspace-based and MD-based algorithms successfully identify the initial point of each artificially introduced damage scenario, proving the capabilities of both methods to detect the damages and to be ready to deploy in online health monitoring systems.

Future work will focus on the use of empirical Hankel matrices based on different statistical transformations of the output data as damage sensitive quantities. The fusion of the methods enhanced the performance of damage detection, hence research on this subject will also be expanded.

Fig. 1

 1 Fig. 1 MB foundation for a mobile met. mast at Horns Rev 2 (2009) (left). FE-model of the MB for numerical simulations (right). Bi-axial xy accelerometers are illustrated by yellow dots.The structural responses are simulated by use of the FE model of the structure with a bucket diameter of 14 m and a 32 m long shaft. The translational and rotational boundary conditions are constrained to zero on the skirt plates.In total, the FE model contains 8589 first-order shell elements, 8414 nodes and, consequently, 50484 degrees of freedom (DOF). Output accelerations are simulated using white noise input of variance taken randomly from a normally distributed vector in between [1 100], acting on the nodes on top of the shaft. A single generation of the response is recorded for 250 s with a sampling frequency of 40 Hz in 5 nodes by bi-axial sensors, hereby yielding 10 acceleration channels. In total, the ambient vibrations are simulated for 45000 s, which results in 180 data sets; 50 sets from the healthy state and 130 sets representing 13 damaged scenarios. To challenge the performance of the damage detection methods, 1% of a Gaussian white noise is added to the response signals.The damages are simulated as a progressive thickness (t) reduction of the elements in the shaft-web connection, by 1%, 5%, 15%, 40% and 85%. Each element is a square of 100mm x 100mm. The damage test scenario along with a corresponding data set is described in Table1.

Fig. 2

 2 Fig. 2 MD-based damage indicators (upper left). Classic subspace-based damage indicators (upper right). Robust subspace-based damage indicators (lower left). Fusion of the subspace-based and MD-based damage indicators in the Hoteling control chart (lower right).

Fig. 3

 3 Fig. 3 MD-based damage indicators (left). Robust subspace-based damage indicators (right).

Table 1 .

 1 Damage scenarios during the simulations on the MB model.

	Annotation Description	Sets Annotation Description	Sets
	A	Healthy state	50	H	t of 4 FE in ALL connections reduced by 15%	10
	B	t of 4 FE in A reduced by 1%	10	I	t of 4 FE in A reduced by 40%	10
	C	t of 4 FE in A reduced by 5%	10	J	t of 4 FE in A and B reduced by 40%	10
	D	t of 4 FE in A and B reduced by 5%	10	K	t of 4 FE in ALL connections reduced by 40%	10
	E	t of 4 FE in ALL connections reduced by 5%	10	L	t of 4 FE in A reduced by 85%	10
	F	t of 4 FE in A reduced by 15%	10	M	t of 4 FE in A and B reduced by 85%	10
	G	t of 4 FE in A and B reduced by 15%	10	N	t of 4 FE in connections reduced by 85%	10

Table 2 .

 2 Damage scenarios during the progressive damage test of the S101 bridge.

	Damage case 1	Damages	Sets	Damage case 2	Damages	Sets
	B	First cut through the left pier	5	I	Exposing the tensioning cables, 1 st tendon cut	20
	C	Second cut through the left pier	15	J	2 nd tendon cut	178
	D	Settlement of the left pier (1 st ) -1cm	10	K	3 rd tendon cut	23
	E	Settlement of the left pier (2 nd ) -2cm	21	L	4 th tendon partly intersected	6
	F	Settlement of the left pier (3 rd ) (final settlement) -3cm 9
	G	Lifting the left pier -+6mm above the 0.00	186
	H	Strengthening the left pier with a steel plate	45


G Pouchoulin
email: gilles.pouchoulin@univ-avignon.fr

C Fredouille
email: corinne.fredouille@univ-avignon.fr

J.-F Bonastre

A Ghio

A Marques

A Giovanni

Are the unvoiced consonants relevant for dysphonia phenomenon observation?

Keywords: Voice disorder, dysphonia characterization, automatic dysphonic voice classification, automatic and manual phonetic analysis, GRBAS scale

Concerned with pathological voice assessment, this paper aims at characterizing dysphonia in the speech signal for a better understanding of related phenomena while most of the studies have focused only on improving classification systems for diagnosis help purposes. This work is focused on an automatic and manual phonetic analysis, which highlights the potential and rather unexpected relevance of unvoiced consonants in the automatic classification task of dysphonia severity grades (based on the GRBAS scale).

Introduction

In the medical domain, assessment of the pathological voice quality is a sensitive topic, involving multi-disciplinary domains: clinicians, phoneticians, and automatic speech processing specialists. Dysphonia is one of the medical terms to define phonation disorders. Currently, two main approaches are involved to deal with the phonation disorders. The first approach, the perceptual evaluation [START_REF] Dejonckere | A basic protocol for functional assessment of voice pathology, especially for investigating the efficacy of ( phonosurgical) treatments and evaluating new assessment techniques[END_REF][START_REF] Revis | Phonetic labeling of dysphonia: a new perspective in perceptual voice analysis[END_REF], consists in qualifying and quantifying the vocal dysfunction by listening to the patient's speech production. It is the most used by the clinicians currently even if it is largely debated in the literature because of an intrinsic subjectivity, a lack of a universal scale, as well as a large intra and inter-variability in the human judgments. The second methodology, the objective measurement-based analysis [START_REF] Wester | Automatic classification of voice quality: Comparing regression models and hidden markov models[END_REF][START_REF] Maguire | Identification of voice pathology using automated speech analysis[END_REF][START_REF] Kacha | Dysphonic speech analysis using generalized variogram[END_REF][START_REF] Saenz-Lechon | Methodological issues in the development of automatic systems for voice pathology detection[END_REF][START_REF] Godino-Llorente | Dimensionality reduction of a pathological voice quality assessment system based on gaussian mixture models and short-term cepstral parameters[END_REF][START_REF] Pouchoulin | Dysphonic voices and the 0-3000hz frequency band[END_REF], consists in associating acoustic, aero-dynamical and/or physiological measures with an automatic classification system to provide a reproducible and objective decision. Even if the latter has been introduced as an alternative to the perceptual evaluation, the current performance of the automatic systems has not been sufficient yet to satisfy clinicians. This paper, related to the objective measurement-based analysis, aims at characterizing phenomena due to the dysphonia in the speech signal. Here, the authors propose to analyze the performance of the automatic classification system (according to the GRBAS scale) according to different phonetic classes, mixing voiced and unvoiced components. The goal of this study is to bring a better understanding of the dysphonia phenomena in the speech signal, helpful for the enhancement of the automatic classification systems, as well as for the medical domain.

Dysphonic voice corpus

Speakers involved in this study were, on the one hand, dysphonic women (aged 17 to 50) affected by nodules, polyps, oedema, cysts, ... and, on the other hand, control women (normal voice). They were recorded in the ENT department of the Timone University Hospital, Marseille, France. The speech material is ob-tained by reading the same short text (French), which signal duration varies from 13.5 to 77.7 seconds (mean: 18.7s). The subjects' voices are perceptually classified along the G parameter of the Hirano's GRBAS scale [START_REF] Hirano | Psycho-acoustic evaluation of voice : Grbas scale for evaluating the hoarse voice[END_REF], where a normal voice is rated as grade G0, a slight dysphonia as G1, a moderate dysphonia as G2 and finally, a severe dysphonia as G3. These perceptual grades were determined by a jury composed of 3 expert listeners, by consensus between the different jury members as it is the usual way to assess voice quality by our therapist partners. The judgment was done during one session only. For the following experiments, 80 voices equally balanced among the 4 grades (20 voices per each) were selected. Due to the small amount of data, cautions have been made to provide valid protocol and experimental results by applying leave_x_out technics. The latter consists in discarding x speakers' voices from the 80 voices, using the remaining data for training and the x speakers' voices for testing. This scheme is repeated until reaching a sufficient number of tests.

Baseline classification system

The baseline system is derived from a classical speaker recognition (ASR) system adapted to dysphonic voice classification. The ASR system is based on the state-of-the-art GMM modelling. It relies on the ASR toolkit, available in « open source » (ALIZE/SpkDet [START_REF] Bonastre | Alize, a free toolkit for speaker recognition[END_REF]) and developed at the LIA laboratory. Three phases are necessary: Parameterization: in this paper, the pre-emphasized speech signal (0.95 value) is characterized by 24 spectrum coefficients issued from a filter-bank analysis (24 filters) applied on 20ms Hamming windowed frames at a 10ms frame rate. The filters are triangular and equally spaced along the entire linear scale to yield Linear Frequency Spectrum Coefficients (LFSC). Parameters are normalized to match a 0-mean and 1-variance distribution. Modelling: Gaussian Mixture Model (GMM)-based techniques are used to build a statistical model for each dysphonia severity grade, named grade model Gg with g ∈ {0, 1, 2, 3}. A GMM is a weighted sum of M multi-dimensional Gaussian distributions, each characterized by mean vector x (dimension d), covariance matrix Σ (d x d) and weight p of the Gaussian component within the mixture (diagonal covariance matrices are used in this work). A GMM model is built on a training data set by estimating the parameters (x, Σ, p) to the EM/ML algo-(Expectation-Maximization/Maximum Likelihood). Grade model Gg is learned gathering all the voices evaluated perceptually as grade g. Two training phases are used here to cope with the lack of training data, as classically used in speaker recognition domain [START_REF] Bimbot | A tutorial on text-independent speaker verification[END_REF]

Phoneme-based classification

The authors propose in this paper to observe the behaviour of the automatic dysphonic voice classification system following different phoneme classes. Thus, system performance is provided per phoneme class in order to evaluate how the dysphonia effects may impact on phonemes or phoneme classes according to the grades.

Automatic phoneme segmentation

To perform dysphonic voice classification tests according to different phoneme classes, a phonetic segmentation is necessary for each speech signal of the corpus. This segmentation was extracted automatically by realizing an automatic text-constrained phonetic alignment. In other words, phoneme boundaries of each expected words uttered by speakers are extracted automatically in a unsupervised way. This alignment was performed by the automatic alignment system developed at the LIA laboratory. This system is based on a Viterbi decoding algorithm, a text-restricted lexicon of words associated with their phonological variants and a set of 38 French phonemes. Each phoneme model relies on a three state HMM, initially trained on a French speech corpus, produced by a set of female speakers. Since the latter has no connection with the dysphonic corpus (described in section 2), classical unsupervised adaptation techniques are applied iteratively on phoneme models for the automatic phonetic alignment to enhance and refine phoneme boundaries.

Comparative phonetic analysis

The phonetic segmentation is coupled with the automatic dysphonic classification system for the decision step. Indeed, for the classification tests and decision making, the similarity measure (see section 3) between the test voice and the grade models is computed on the restricted set of segments associated with a targeted phoneme class. Conversely, the grade models are learned on all the phonemic material available per grade in the corpus independently of the phonem class targeted. In this paper, the authors focus on three main phoneme classes: both voiced and unvoiced consonants, and vowels. These individual phoneme classes are compared with the global set, joining all the phonemes available in the corpus. Table 1 provides duration information on these different phoneme classes per voice and grade. This automatic phonetic analysis of dysphonia is close to the "phonetic labelling" proposed in [START_REF] Revis | Phonetic labeling of dysphonia: a new perspective in perceptual voice analysis[END_REF], in which a descriptive and perceptual study of pathological characteristics of different phonemes is presented.

Figure 1 presents performance of the automatic dysphonic voice classification system depending on the different phoneme classes: all phoneme set, both voiced and unvoiced consonants, and vowels. Performance is expressed in terms of Correct Classification Rates (named CCR in the rest of the paper). From this figure, it can be observed that:

• best performance (85% CCR) is obtained for grade 0 voices considering all the phoneme while other phoneme classes reach between 70 and 80% CCR. Performance of grade 3 voices is rather close (from 60 to 75% CCR) while more confusion is observed on grade 1 and 2 voices (CCR varying from 40 to 60%); • individual classes perform in the similar range of performance as considering all the phoneme set. Indeed, while CCR variation for all the phonemes is between 50 to 85%, CCR of voiced consonants vary from 45 to 75% depending on the grades, CCR of unvoiced consonants from 50 to 80%, and CCR of vowels from 40 to 70%.

• unvoiced consonant class obtains quite high CCR, compared with all the phoneme set. It outperforms the vowel class whatever the grades observed. It obtains higher CCR than the voiced consonant class for grades 0 and 1, and a similar and lower CCR for grades 3 and 2 respectively.

Discussion

The performance observed on the unvoiced consonant class is particularly surprising. Indeed, focus is generally made on voiced components in the literature while considering dysphonia since they are directly affected by this kind of pathology related to the glottic source. Sustained vowels are, for instance, extensively used in the literature by perceptual or objective approaches, since they facilite the measurement of parameters directly linked to the vocal source. In this context, two hypotheses may be proposed to explain the behaviour of the automatic classification system on the unvoiced consonant class:

• Hyp 1: phoneme boundaries are determined by the automatic text-constraint alignment system. As reported in section 4, the latter has not been developped to process pathological speech specifically. Even if unsupervised techniques have been applied to enhance the quality of the phoneme models, voice alteration due to dysphonia may decrease the system performance, degrading the quality of phoneme boundaries. Mislabelling in the phonetic alignment could involve, for instance in the case of vowel-consonant (V C) or consonant-vowel (CV ) contexts, that parts of vowels were merged with unvoiced components. In this case, previous observations would be biased.

• Hyp 2: dysphonia may have effects on the unvoiced consonant production, especially in the V C or CV contexts. Moreover, it can be assumed that this effect is gradual according to the dysphonia severity since the classification system provides satisfactory discrimination between grades.

Validation of the phonetic segmentation

This section aims at verifying the first hypothesis outlined in the previous section.

Manual phonetic segmentation

In order to be able to evaluate the performance of the automatic text-constrained alignment system regarding the unvoiced consonants, manual verification is necessary. The focus has been made on 18 unvoiced consonants among the 20 ones uttered by each speaker in the corpus 1 . The 18 unvoiced consonants are split into 8 fricatives (6 /s/, 1 /f/, 1 /ch/), and 10 plosives (2 /p/, 5 /t/, 3 /k/). A human expert listened to all the speech signal in the corpus and marked them with different information, distinguishing in some cases unvoiced fricatives from plosives:

• formant end of each vowel preceding an unvoiced consonant noted F EV (both fricatives and plosives); • voicing end of each vowel preceding an unvoiced consonant noted V EV (both fricatives and plosives); • start of noise for the fricative consonants noted SN O; • end of noise for the fricative consonants noted EN O; • plosive burst;

• voicing start of each vowel following an unvoiced consonant noted V SV (both fricatives and plosives); • formant start of each vowel following an unvoiced consonant noted F SV (both fricatives and plosives); This manual labelling was performed in a blind way, using the Praat software [START_REF] Boersma | Praat: doing phonetics by computer[END_REF]. Listening, signal visualization, spectrograms, and F0 measurements issued from Praat were utilized. No information about the boundaries determined by the automatic system was made available for the expert to avoid influence. Only rough location of unvoiced consonants in the speech signal was provided to save time. Globally, 1440 unvoiced consonants have been processed in the overall corpus, corresponding to 7840 markers potentially. Nevertheless, the human expert was not able to fix the overall set of markers, especially due to the voice quality degradation. For instance, in a few contexts, vowels have been totally devoiced, making unavailable information, and corresponding markers. 1 2 unvoiced consonants have been discarded here since they appear in particular consonantic groups: /ks/ and /tr/.

Configuration Count

V EV > ST ART 1014

V EV ∼ = ST ART 67 V EV < ST ART 107 EN D < V SV 899 EN D ∼ = V SV 199 EN D > V SV 147
Table 2: Comparison between the unvoiced consonant boundaries (ST ART and EN D) issued from the automatic text-constrained alignment system and markers fixed by a human expert (V EV represents the voicing end of the vowel preceding an unvoiced consonant and V SV the voicing start of the vowel following an unvoiced consonant). Possible configurations and their counts.

Manual vs automatic phonetic segmentation

The boundaries of unvoiced consonants, issued from the automatic text-constrained alignment system and noted ST ART and EN D are compared with both the V EV and V SV markers, in terms of time location. Assuming that boundaries of unvoiced consonants are synchronized with the end and start of vowel voicing, this comparison aims at pointing out whether parts of vowels are included in the unvoiced consonants according to the following configurations:

• V EV > ST ART : the unvoiced consonant includes the final part of the preceding vowel;

• V EV ∼ = ST ART : the start boundary of the unvoiced consonant is considered as correct;

• V EV < ST ART : the beginning part of the unvoiced consonant is missing;

• EN D < V SV : the final part of the unvoiced consonant is missing;

• EN D ∼ = V SV : the final boundary of the unvoiced consonant is considered as correct;

• EN D > V SV : the unvoiced consonant includes the beginning part of the following vowel.

Table 2, providing counts relating to each configuration, shows that the automatic text-constrained alignment system used to misplace the start of the unvoiced consonants rather systematically (1014 times on 1188 measures), including the final part of the preceding vowel. In contrast, the beginning part of the following vowel is rather excluded (included in 147 times only 1245 measures) whereas the final part of the unvoiced consonant is most of the times missing (899 times on 1245 measures).

Therefore, these results could confirm the first hypothesis, which assumes that unvoiced consonants could be mislabelled by the automatic system. Next section will verify whether this mislabelling should have an impact on the classification system performance reached by the unvoiced consonants.

Experimental validation

Experiment reported in section 4.2 is reproduced here, focusing on unvoiced consonants only. Considering manual markers, six different case studies are conducted here: • Auto1 and Auto2 : classification system is based on the automatic boundaries of unvoiced consonants for which manual markers of the preceding (Auto1) or the following (Auto2) vowels were available. These experiments provide system performance computed on the same number of unvoiced conso-

Figure 1 :

 1 Figure 1: Performance per grade in terms of Correct Classification Rate (CCR %) considering "All phonemes", both voiced and unvoiced consonant and vowel classes.

Table 1 :

 1 Total duration in seconds per phonetic class and per grade as well as the number of phonemes (nb), their averaged duration (µ) and associated standard deviation (σ). is the likelihood of signal yt given gaussian i, M the number of gaussians and pi the weight of gaussian i in the mixture.

	Phonetic		Grades		Info. per class
	classes	G0	G1	G2	G3	nb	µ	σ
	Consonant 135.1 139.2 149.8 167.3 6395 0.092 0.045
	. Voiced	88.8 90.6 95.4 106.6 4719 0.081 0.039
	. Unvoiced 46.3 48.7 54.5 60.7 1676 0.125 0.046
	Vowel	103.6 98.8 103.5 109.8 5586 0.074 0.046
	All phonemes 241.5 241.0 256.7 280.5 12140 0.084 0.046
	mum a posteriori).
	All GMM models are composed of 128 gaussian components
	with diagonal covariance matrices. It has to be noted that all the
	voices used for the grade model training are excluded from the
	test trials in order to differentiate the detection of the pathology
	from the speaker recognition.

: (1) training of a generic speech model estimated by the EM/ML algorithm on a large population of speakers; (2) training of the grade model, derived from the generic speech model by applying adaptation techniques (MAP, Maxi-Decision: For dysphonic voice classification, decision is made by selecting the grade g of the model Gg (among the four grade models) for which the largest similarity measure is computed given a test voice. The similarity measure relies on likelihood value as follows: L(yt|X) = P M i=1 pi Li(yt) where Li(yt)

nants as the rest of study cases;

• V EV 1 : similar to Auto1 except that segmentation of unvoiced consonants for which the beginning part is missing (107 cases) is corrected according to the manual markers;

• V EV 2 : similar to V EV 1 except that segmentation of unvoiced consonants which include the final part of the preceding vowels (V EV > ST ART 1014 cases) is corrected;

V SV 1 : similar to Auto2 except that segmentation of unvoiced consonants for which the final part is missing (899 cases) is corrected; • V EV 2 : similar to V SV 1 except that segmentation of unvoiced consonants which include the beginning part of the following vowels (EN D > V SV : 147 cases) is corrected; • V EV -V SV : segmentation of unvoiced consonants is directly issued from the manual markers : V EV and V SV . Tables 3 and4 report classification system performance in terms of CCR% and global durations of unvoiced consonants related to each case study respectively. Very few variation in terms of system classification performance can be observed comparing the different case studies. the segmentation of the unvoiced consonants by discarding all the mislabelled components (ie the vowel components) permits to reach very similar performance to the one obtained in section 4.2. This enables to invalidate the first hypothesis raised previously, highlighting the second hypothesis : dysphonia may have impact on the unvoiced consonant production, especially in the V C or CV contexts.

Conclusion

This paper aims at studying the characterization of dysphonia voices through an automatic classification system coupled with a phonetic analysis. Comparing system performance according to vowel, voiced and unvoiced consonant classes shows that unvoiced consonants outperform vowels and reach relatively high classification performance. The first hypothesis, raised by the authors to explain this quite surprising behaviour and directly linked to the quality of the automatic phonetic segmentation has been invalidated thanks to a manual correction done by a human expert. Indeed, additional experiments have still demonstrated the relevance of unvoiced consonants in the classification task. The second hypothesis, raised by the authors, assuming that dysphonia may impact on the unvoiced consonant production, especially in the vowel-consonant V C or consonant-vowel CV contexts is therefore emphasized. Further work will consist in examining unvoiced consonant components of the speech corpus manually with the help of phonetician experts.


G Pouchoulin
email: gilles.pouchoulin@univ-avignon.fr

C Fredouille
email: corinne.fredouille@univ-avignon.fr

J.-F Bonastre

A Ghio

A Giovanni

Dysphonic Voices and the 0-3000Hz Frequency Band

Keywords: Voice disorder, dysphonia characterization, automatic dysphonic voice classification, frequency analysis

Concerned with pathological voice assessment, this paper aims at characterizing dysphonia in the frequency domain for a better understanding of related phenomena while most of the studies have focused only on improving classification systems for diagnosis help purposes. Based on a first study which demonstrates that the low frequencies ([0-3000]Hz) are more relevant for dysphonia discrimination compared with higher frequencies, the authors propose in this paper to pursue by analyzing the impact of the restricted frequency band ([0-3000]Hz) on the dysphonic voice discrimination from a phonetical and perceptual point of views. A discussion around the frequency band limitation of telephone channel is also proposed.

Introduction

Assessment of dysphonic voice quality is an important issue, resulting in a large amount of multidisciplinary research. Two main approaches can be considered. The first methodology, the perceptual evaluation [START_REF] Dejonckere | A basic protocol for functional assessment of voice pathology, especially for investigating the efficacy of ( phonosurgical) treatments and evaluating new assessment techniques[END_REF][START_REF] Revis | Phonetic labeling of dysphonia: a new perspective in perceptual voice analysis[END_REF], consists in qualifying and quantifying the vocal dysfunction by listening to the patient's speech production. It is currently the most used by the clinicians. However, it is largely debated in the literature because of an intrinsic subjectivity, a lack of a universal scale, a large intra and intervariability in the human judgments and finally a large cost in time and human resources when an expert jury is involved to reduce its subjectivity. The second methodology involved in the dysphonic voice assessment is the objective measurementbased analysis. This approach has been introduced as an alternative to the perceptual evaluation in order to cope with its drawbacks. In this context, acoustic, aero-dynamical and/or physiological measures are associated with an automatic classification system to provide a decision. Most of the studies proposed in the literature aims at improving automatic system performance since current systems are not sufficiently efficient from clinician point of view [START_REF] Maguire | Identification of voice pathology using automated speech analysis[END_REF][START_REF] Saenz-Lechon | Methodological issues in the development of automatic systems for voice pathology detection[END_REF]. Conversely, a few studies have been dedicated to the characterization of the dysphonia phenomena in the speech signal [START_REF] Godino-Llorente | Dimensionality reduction of a pathological voice quality assessment system based on gaussian mixture models and short-term cepstral parameters[END_REF][START_REF] Kacha | Dysphonic speech analysis using generalized variogram[END_REF]. This analysis should be useful for a better understanding of dysphonia impact in speech production or simply to enhance performance of the automatic classification by exploiting more relevant information. As dysphonia is essentially relating to the vocal source, most of the studies have focused on parameters directly linked to this vibrator (FO stability, intensity, jitter, shimmer, harmonics to noise ratio, etc [START_REF] Schoentgen | Acoustic analysis of dysphonic voices: descriptors and methods[END_REF][START_REF] Wuyts | The dysphonia severity index: an objective measure of vocal quality based on a multiparameter approach[END_REF][START_REF] Yu | Objective voice analysis for dysphonic patients: a multiparametric protocol including acoustic and aerodynamic measurements[END_REF]). Other studies have been related on the global tone of the voice, assuming that the acoustic characteristics of dysphonia are uniformly distributed on the whole spectrum. Finally, information issued from long-term spectral analysis was also investigated many years ago, leading to different pathological voice classifications [START_REF] Yanagihara | Significance of harmonic changes and noise components in hoarseness[END_REF]. This paper pursues work reported in [START_REF] Pouchoulin | Frequency study for the characterization of the dysphonic voices[END_REF] in which the authors have investigated the characteristics of dysphonia in the frequency domain, especially by studying relating phenomena through a frequency subband analysis. In this context, the authors have shown that the [0-3000]Hz frequency subband tends to carry more relevant information for dysphonic voice discrimination, compared with higher frequency subbands as well as with the [0-8000]Hz full band. Here, the authors propose to extend investigation on the [0-3000]Hz frequency band by examining three different axes: (1) the analysis of the restricted frequency subband on the dysphonic voice discrimination from a phonetical point of view, (2) its effects on the perceptual judgment carried out by an expert jury, and finally (3) a parallel with the frequency band limitation involved by the telephone channel.

Dysphonic voice corpus

The corpus used in this study is composed of reading speech pronounced by both dysphonic subjects (affected by nodules, polyps, oedema, cysts, ...) and control group. The subjects' voices are classified according to the G parameter of the Hirano's GRBAS scale [START_REF] Hirano | Psycho-acoustic evaluation of voice : Grbas scale for evaluating the hoarse voice[END_REF], where a normal voice is rated as grade 0, a slight dysphonia as 1, a moderate dysphonia as 2 and finally, a severe dysphonia as 3. The corpus was supplied by the ORL department of the "Timone" University Hospital (Marseille -France). It is composed of 80 voices of females aged 17 to 50. The speech material is obtained by reading the same short text (French), which signal duration varies from 13.5 to 77.7 seconds (mean: 18.7s). The 80 voices are equally balanced among the 4 grades (20 voices per each). These perceptual grades were determined by a jury composed of 3 expert listeners, by consensus between the different jury members as it is the usual way to assess voice quality by our therapist partners. The judgment was done during one session only. This corpus is used for all the experiments presented here. Due to its small size, cautions have been made to provide statistical significance of the results by applying specific methods like leave_x_out technics.

Baseline classification system

The baseline system is derived from a classical speaker recognition (ASR) system adapted to dysphonic voice classification. The ASR system is based on the state-of-the-art GMM modelling. It relies on the ASR toolkit, available in « open source » (LIA_SpkDet and ALIZE [START_REF] Bonastre | Alize, a free toolkit for speaker recognition[END_REF]) and developed at the LIA laboratory. Three phases are necessary (see [START_REF] Pouchoulin | Frequency study for the characterization of the dysphonic voices[END_REF]): Parameterization: the pre-emphasized speech signal (0.95 value) is characterized by 24 spectrum coefficients issued from a filterbank analysis (24 filters) applied on 20ms Hamming windowed frames at a 10ms frame rate. The filters are triangular and Here, the similarity measure relies on a likelihood value as follows:

L(y t |X) = M i=1 p i L i (y t )
where L i (y t ) is the likelihood of signal y t given gaussian i, M the number of gaussians and pi the weight of gaussian i.

[0-3000]Hz and phonetic analysis

In [START_REF] Pouchoulin | Frequency study for the characterization of the dysphonic voices[END_REF], the authors have studied how the acoustic characteristics of dysphonia are spread out on the overall frequency space by analyzing the performance of the automatic dysphonic voice classification (described in section 3) on different frequency subbands. The latter were obtained by filtering signal of the dysphonic corpus (defined in section 2) according to the following ranges: [0-3000]Hz, [3000-5400]Hz and [5400-8000]Hz. The classification tests applied on the different filtered corpora outline that the [0-3000]Hz frequency subband tends to be the most interesting zones (compared with the other frequency subbands as well as with the full band), leading to an homogeneous and better discrimination between voices. To investigate further, the authors propose in this paper to observe the behaviour of the automatic dysphonic voice classification system following different phoneme classes. This behaviour will be analyzed according to the full frequency band and the [0-3000]Hz frequency subband. Indeed, performance of the classification system will be analyzed per phoneme class and per frequency range in order to evaluate how the dysphonia effects may impact on phonemes or phoneme classes in particular frequency bands according to the grades. This phonetic analysis is very close to the "phonetic labelling" proposed in [START_REF] Revis | Phonetic labeling of dysphonia: a new perspective in perceptual voice analysis[END_REF], in which a descriptive and perceptual study of pathological characteristics of different phonemes is presented.

Experimental protocol

To perform dysphonic voice classification tests according to different phoneme classes, a phonetic segmentation is necessary for each speech signal of the corpus. This segmentation was extracted automatically by realizing an automatic text-constrained phonetic alignment. This alignment was performed by using the LIA alignment system, based on a Viterbi decoding algorithm, a text-restricted lexicon of words associated with their phonological variants and a set of 38 French phonemes. The phonetic segmentation is coupled with the automatic dysphonic classification system for the decision step only i.e this segmentation is not used for both the parameterization and training phases. In the latter case, all the grade models are learned on all the phonemic material available per grade in the corpus. Indeed, for the classification tests and decision making, the similarity measure (see section 3) between the test voice and the grade models is computed on the restricted set of segments associated with a given phoneme class. Table 1 provides the targeted phoneme classes available through the dysphonic voice corpus as well as information on their durations. Results provided in this section are expressed in terms of Correct Classification Rates (named CCR in the rest of the paper).

Comparative phonetic analysis [0-8000] vs [0-3000]Hz

This section presents performance of the automatic dysphonic voice classification system depending on the frequency bands: [0-8000]Hz and [0-3000]Hz frequency bands, and on different phoneme classes: on the one hand, all phoneme set, consonant and vowel classes illustrated in figure 1 and more specific consonant and vowel classes like liquid, nasal, fricative, plosive and oral vowels illustrated in figure 2 on the other hand. From these figures, it can be observed that:

• CCR is improved for the global consonant class (fig. 1) on the [0-3000]Hz for most of the cases (e.g. from 50 to 70% for the grade 2), except for the grade 3 (from 85 to 75% CCR). Nevertheless, the behaviour of the individual consonant classes (fig. 2) is rather different, with a CCR improvement observed uniquely for the liquids on both the grades 0 and 1, for the nasal consonant on the grade 2, for the fricative on the grade 1 only, and for the plosive on both the grade 0 and 2. Regarding the grade 3, the reduction of the frequency band affects CCR of most of the consonant classes, except CCR of both plosive and fricative consonants, which remains unchanged. • CCR is slightly improved for the global vowel class on the [0-3000]Hz. However, the analysis per grade reveals balanced behaviours between the 0 and 2 grades, for which a quite significant improvement is observed, and the 1 and 3 grades. Results per grade reported for the oral vowels follow the same scheme.

• CCR of the consonant class is higher in [0-3000]Hz than the vowel consonants in most of the cases (equal for the grade 2). Specific consonant and vowel classes tend to exhibit similar behaviour, notably while comparing CCR of plosive and fricative consonants with oral vowels. Nasal consonants seem to be the least relevant phoneme class here. These different observations permit to draw some assumptions about the discrimination of dysphonic voices (according to the GRBAS scale): first, vowel formants (variably located in the [0-3000Hz] frequency band) may not carry sufficient information to discriminate grade 1 voices, contrary to the grades 0 and 2. Secondly, consonants seem to bring, amazingly, more useful information for dysphonic voice discrimination in this context.

[0-3000]Hz and perceptual judgment

If the baseline automatic classification system (described in section 3) tends to be positively sensitive to the frequency band reduction (from [0-8000] to [0-3000]Hz), the question which can be raised is: "Which effects can this reduction have on perceptual judgment carried out by an expert jury ?". To be able to bring some responses to this question, the [0-3000]Hz filtered corpus of dysphonic voices (described in section 2) was perceptually analyzed following the same rules as the original corpus (evaluated on the full frequency band). In this way, the perceptual judgment was carried out by consensus involving the same expert jury as previously for one session only.

Experimental Results

The analysis of the perceptual evaluation done on the [0-3000]Hz filtered corpus of dysphonic voices permits to draw up different comparisons involving the perceptual evaluation done on the original corpus as well as the automatic classification system. In this way, figure 3 presents agreement rates (1) between both the perceptual assessment conditions, (2) between the automatic classification system and the [0-8000]Hz perceptual judgment, and (3) between the automatic classification system and the [0-3000]Hz perceptual judgment. Table 2: Confusion matrix of the [0-3000]Hz filtered dysphonic corpus perceptual judgment against the original perceptual judgment ([0-8000]Hz dysphonic corpus).

G0 G1 G2 G3 RG0 16 4 0 0 RG1 2 14 4 0 RG2 0 1 19 0 RG3 0 0 1 19
The case (1) reveals 85% of overall agreement of the [0-3000]Hz perceptual judgment with the [0-8000]Hz one, exhibiting very high agreement rates (95%) for the grades 2 and 3, high agreement rate (80%) for the grade 0 and moderate agreement rate (70%) for the grade 1. If the overall agreement rate of 85% could be due to the intra-listener variability accross sessions, it is interesting to highlight that disagreements mainly occur for normal and slight dysphonic voices as illustrated by the confusion matrix given in table 2. This tends to show that the reduction of the frequency band, resulting in more lowpitched voices, may affect the expert jury's judgments, inducing an overestimate of dysphonia level for normal and slight dysphonic voices.

Regarding the cases (2) and (3), the automatic classification obtains higher agreement rates with the [0-8000]Hz perceptual judgment. Only the grade 3 agreement rate is slightly more favorable for the [0-3000]Hz perceptual judgment (73.7% vs 70%), due to a unique grade 3 voice reclassified in grade 2 in the latter. It is interesting to remark that the agreement rate for the grade 1 is quite low for the [0-3000]Hz perceptual judgment with only 47% against 65% for the [0-8000]Hz perceptual judgment. This behaviour is strongly correlated to observations made in the case (1) regarding the low agreement rate for the grade 1. Indeed, a large part of dysphonic voices rated as 1 for the [0-8000]Hz perceptual judgment and well classified by the automatic system has been rated differently for the [0-3000]Hz perceptual judgment (4 voices in grade 0 and 6 in grade 2). Finally, it seems meaningful that the agreement rates are globally higher between the automatic system and the [0-8000]Hz perceptual judgment, since the latter was used as reference for the grade model training.

[0-3000]Hz and telephone band

One of the issues of speech transmitted through the telephone channel is the restriction of the frequency band to [300-3400]Hz.

It is well-known that this limitation strongly disturbs automatic systems related to speech (e.g. automatic speech and speaker recognition).

Considering in this paper the [0-3000]Hz frequency band, it makes sense to examine the disturbance of the telephone band restriction to the automatic dysphonic voice classification. Consequently, signals related to the dysphonic corpus have been filtered according to the [300-3000]Hz frequency band and processed in the same way as described in section 3.

Experimental Results

Table 3 provides the confusion matrices issued from the automatic classification of the dysphonic voices for both the [0-3000]Hz and [300-3000]Hz frequency bands. Here, this classification has been compared with the original perceptual judgment (full band corpus). As expected, it can be observed that all the grades are affected by discarding the low frequency subband [0-300]Hz, resulting in an absolute overall CCR loss of 10% (from 72.5 to 62.5% CCR). Indeed, confusion with adjacent grades is drastically increased, notably for the grade 3. By extrapolating the disagreement between the perceptual judgments carried out on both the [0-3000]Hz and [0-8000]Hz dysphonic corpora, it might be assumed that the telephone band may affect the perceptual judgment similarly. Finally, considering the other issues of the telephone channel such as the amplitude signal distorsion and noise, a more significant CCR decrease may be expected in real conditions.

Conclusion

This paper aims at exploring the characterization of dysphonia voices in the frequency domain. It pursues a first study, in which the authors have shown that the [0-3000]Hz subband tends to be the most relevant zone for the automatic discrimination of dysphonic voices in the proposed context. First, focus is made on the effects of this frequency band reduction from a phonetic viewpoint. This study has underlined that consonant classes tend to be more relevant than vowel classes for the automatic dysphonic voice discrimination task. Moreover, this analysis has revealed a better discrimination of 0 and 2 rated voices observed on the vowel classes compared with the 1 and 3 ones. Secondly, perceptual judgments involving the dysphonic voice corpus, in its original form as well as filtered in the [0-3000]Hz frequency band have been compared. This comparison has shown that expert jury has been affected by the limitation of the frequency band, notably for 0 and 1 rated voices, inducing an overestimate of dysphonia level in this case. Fi-nally, a parallel between the [0-3000]Hz frequency band and the band limitation of telephone channel has been proposed. As expected, automatic classification rates have been affected when considering the [300-3000]Hz frequency band. Making connection with the perceptual judgment study, it can be assumed that the telephone band may also affect the perceptual judgment provided by an human expert similarly, especially in real conditions for which additional signal damages have to be taken into account like the signal amplitude distorsion and noise.

  equally spaced along the entire linear scale to yield Linear Frequency Spectrum Coefficients (LFSC). Parameters are normalized to match a 0-mean and 1-variance distribution. Modelling: Gaussian Mixture Model (GMM)-based techniques are used to build a statistical model for each dysphonia severity grade, named grade model Gg with g ∈ {0, 1, 2, 3}. Grade model G g is learned gathering all the voices evaluated as grade g. It can be noted that all the voices used for the grade model training are excluded from the test trials in order to differentiate the detection of the pathology from the speaker recognition. All GMM models are composed of 128 gaussian components with diagonal covariance matrices. Decision: In the context of dysphonic voice classification, the classification decision is made by selecting the grade g of the model Gg (among the four grade models available) for which the largest similarity measure is computed given a test voice.

  8000] -[0-3000]Hz Grade 1 [0-8000] -[0-3000]Hz Grade 2 [0-8000] -[0-3000]Hz Grade 3 [0-8000] -[0-3000]Hz Total [0-8000] -[0-3000]Hz % CCR All phonemes Consonants Vowels First three columns => [0-8000]Hz Second three columns => [0-3000]Hz

Figure 1 :

 1 Figure 1: Performance per grade in terms of Correct Classification Rate (CCR %) considering "All phonemes", consonant and vowel classes, for both the [0-8000]Hz (each first set of three columns) and [0-3000]Hz (each second set of three columns) frequency bands.

  five columns => [0-3000]Hz First five columns => [0-8000]Hz

Figure 2 :

 2 Figure 2: Performance per grade in terms of Correct Classification Rate (CCR %) considering specific consonant and vowel classes, for both the [0-8000]Hz (each first set of three columns) and [0-3000]Hz (each second set of three columns) frequency bands.

Figure 3 :

 3 Figure 3: Agreement rate (in %) between both [0-3000]Hz and [0-8000]Hz perceptual evaluation and between automatic grade classification and perceptual evaluations.

Table 1 :

 1 Total duration in seconds per phonetic class and per grade -Information per phoneme class : count (nb) with duration mean (µ) and standard deviation (σ).

	Phonetic		Grades		Info. per class
	classes	G0	G1	G2	G3	nb	µ	σ

Consonant 135.13 139.21 149.83 167.28 6395 0.092 0.045 Liquid

34.56 34.01 36.04 43.03 2181 0.068 0.033 Nasal 29.72 30.17 31.85 33.42 1279 0.098 0.039 Fricative 31.77 32.32 35.07 40.70 1144 0.122 0.057 Occlusive 39.08 42.71 46.87 50.13 1791 0.100 0.039 Vowel 103.58 98.77 103.46 109.79 5586 0.074 0.046 Oral 84.37 80.45 85.22 93.66 4862 0.071 0.044 All phonemes 241.

51 240.96 256.66 280.52 12140 0.084 0.046

Table 3 :

 3 Confusion matrix of the automatic classification system onboth the [0-3000]Hz and [300-3000]Hz filtered dysphonic voices.

	[0-3000]Hz		[300-3000]Hz
	G0 G1 G2 G3	G0 G1 G2 G3
	TG0 18	1	1	0	TG0 17	2	1	0
	TG1 1	13	6	0	TG1 3	11	5	1
	TG2 0	6	13	1	TG2 0	7	11	2
	TG3 0	2	4	14	TG3 0	2	7	11


Jenni Reuben

Leonardo A Martucci

Simone Fischer-Hübner

Automated Log Audits for Privacy Compliance Validation: A Literature Survey

Keywords: Log audit, privacy violation detection, privacy compliance, privacy audits, automation

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Compliance is a practice to ensure that the implemented practices and the execution of business processes of an organization is in accordance with regulations, legislations, industrial standards or agreed upon commercial contracts and policies. In particular, the practice to ensure the execution of business processes on personal data in accordance with enterprise policies thus data protection regulations is referred to as privacy compliance [START_REF] Kahmer | Automating privacy compliance with expdt[END_REF] or privacy audits.

Compliance is a perpetual and an essential practice for an organization, and it takes time, resources and cost [START_REF] Bace | Understanding the Components of Compliance[END_REF]. As result of advancement in information technology (it), the task of realizing compliance is increasingly automated [START_REF] Kahmer | Automating privacy compliance with expdt[END_REF][START_REF] Sackmann | A classification model for automating compliance[END_REF]. However, in an organizational setting automating the businesses processes to comply with regulatory requirements is not straight forward. A hierarchical approach is presented in [START_REF] Sackmann | A classification model for automating compliance[END_REF] to facilitate compliance automation from the abstract regulatory constraints down to the concrete it systems level. According to Sackmann et al. [START_REF] Sackmann | A classification model for automating compliance[END_REF] there are two approaches to achieve compliance, one is a preventive approach and the other one is a detective approach. In the preventive approach the obligations (constraints derived from data protection laws in case of privacy compliance) are strictly enforced in the it operations and thus non-compliant events are prevented from occurring. Whereas in the detective approach, activities of the system are monitored and validated against the compliance obligations. In this paper, we focus on the detective approach for achieving privacy compliance.

In the detective approach, compliance adherence is mainly validated through automated audits where the business process executions are recorded and retrospectively analyzed for policy conformance. This approach of realizing compliance demonstrates responsibility and thus accountability, provides flexibility in process executions, helps to validate future obligations, and deters policy violations. The key idea behind the automated audits, which automatically verifies the events that are registered in the logs against specifications is thus similar to intrusion detection methods. However in the context of privacy compliance, privacy principles and concepts, unlike security functions, are less well defined [START_REF] Cavoukian | The Security-privacy Paradox: Issues, Misconceptions and Strategies[END_REF]. Hence, intrigued by the idea of privacy compliance verification we aim to synthesize the state-of-the-art auditing techniques that are used to realize privacy compliance by detection.

Research in automatic verification of privacy compliance has been ad hoc and diverse, ranging from well-evaluated proof-of-concepts to theoretical research ideas that propose approaches for validating the data handling practices of an organization. To the best of our knowledge, no scientific review has been done that describes the state-of-the-art in automated audits for privacy compliance validation. We reviewed existing streams of work in this field using the systematic literature review for summarizing the state-of-the-art. Major contributions of this paper are as follows:

-We systematically synthesize the existing technical knowledge of this research domain to provide a consolidated view of the state-of-the-art and explain its conceptual relationships. We present the consolidated view as a taxonomy, which is based on the auditing techniques. (section 3). -We qualitatively analyze the motivations for log-based automated privacy audits and derive a second taxonomy. which is based on privacy audit objectives (section 4). -Based upon the insights gained from the above two taxonomies, we conceptualize a set of initial guidelines for utilizing log-based automated privacy audits (section 5).

To provide an in-depth overview of the state-of-the-art, we used a systematic literature review process [START_REF] Kitchenham | Procedures for performing systematic reviews[END_REF]. This process provides methodological rigor in terms of planning, conducting and reporting the literature review.

As the initial step, a research protocol was designed following [START_REF] Kitchenham | Procedures for performing systematic reviews[END_REF]. The research protocol specifies the objectives of the review, the search strategy to identify relevant literature, and a strategy to classify the primary studies (the identified sources of this review) for evaluation. The following subsections describes each steps in detail.

Identification of Objects

A thorough and unbiased search for relevant literature is the essence of a systematic literature review. For the scientific literature sources, we used our university library's one-search serviceebsco discovery service1 mainly to ensure that disciplines other than information technology were not overlooked. Prior to the search, keywords, free texts and their synonyms were identified from the following objectives.

-What are the technical approaches that have been proposed to validate privacy compliance or to detect privacy non-compliance? -What are the motivations for performing privacy compliance verification through log audits? -Could privacy concerns be detected from log audits, if so what are the privacy concerns that can be validated? -What are the limitations of the current approaches? Table 1 lists the search strings used for this study. The identified search strings were combined appropriately during the search to locate as many relevant articles as possible. The search process was stopped when the different combination of the search strings were not returning any new results.

The search was performed during week 51 in 2014 and yielded 1723 results in total to be evaluated for relevance.

Selection of Primary Studies

The articles returned by the search were examined for relevance from the title, abstract, and subject headings following these exclusion criteria As a result a total of 25 articles were identified and imported to endnote2 a bibliography management tool. Next, we performed a backward (i.e searching the citations of the identified articles) and a forward search (i.e locating the papers that cites the identified articles) on the identified articles to ensure fullest coverage of related work. All the relevant literature resulted from the forward and backward search was further narrowed following a second set of inclusion and exclusion criteria, which are listed below:

-Include the most completed and related version, if there exist several related studies by the same authors or by the same research group. -Exclude short papers where the technical description of the solutions were not described. -Exclude if the privacy-compliance auditing was discussed in parts of the proposed prototype but clearly was not the main focus, because in most of these cases the verification part is not automated. -Exclude if the privacy-compliance verification is performed by other means than the log audits.

This step resulted in a reduction in the number of the primary studies. The total number of relevant literature identified and reviewed for this work are 14, full texts of the 14 articles were located and imported to endnote for further processing.

Quality Assessment, Classification and Synthesis

As the next step in the process, all the primary studies were carefully analyzed. The aim of the study is to bring together existing but divergent research for two purposes; 1) to give a snapshot of the field revealing the design foundations, which will help future researchers in this field to position their research and 2) to analyze the privacy requirements that are accounted for in the stateof-the-art thus indicating the uncovered privacy requirements. Classification systems and the resulting classification are proven to be an effective strategy for deconstructing the foundations of a domain [START_REF] Nickerson | A method for taxonomy development and its application in information systems[END_REF]. The taxonomy3 focuses on the characteristics of this particular research area and its conceptual relationships rather on the evolutionary relationships. Therefore a broad set of characteristics are extracted from the primary studies to inductively analyze the conceptual relationships. This follows though not rigorously4 the taxonomy development framework proposed by Nickerson et al. [START_REF] Nickerson | A method for taxonomy development and its application in information systems[END_REF], which is based on a three-level indicator model suggested by Bailey et al. [START_REF] Bailey | A Three-Level Measurement Model[END_REF]. We used particularly the empiricalto-conceptual approach, where the characteristics of each object under study are observed and analyzed for similarities in order to form categories.

After identifying the purpose of the taxonomy, which is to provide a scientific understanding of the state-of-the-art, the meta-characteristics [START_REF] Nickerson | A method for taxonomy development and its application in information systems[END_REF] were specified to drive the development of a taxonomy. The meta-characteristic identified for the taxonomy that is presented in section 3 is technical design. Hence the characteristics to be extracted from each primary study are algorithms, inputs and outputs of the algorithms, their performance, scalability and technical limitations. In addition, design principles such as the aim of the solution, system settings, users of the system were extracted, which are helpful to deduce the nature of each category. These extracted characteristics are later qualitatively analyzed for the taxonomy presented in section 4.

A Taxonomy of Audit Techniques

Following the approach described in the subsection 2.3, seven to eight different characteristics are extracted and observed from each primary study. Some of the characteristics are not clearly determined from the primary studies, hence related abstract notions are identified, simplified and analyzed. In order to develop a taxonomy of technical approaches to privacy-compliance verification, the main criterion that drives the taxonomy development is identified as detection (verification) algorithm, given the events and the privacy specifications. As mentioned earlier, checking the system activities registered in the logs for detecting non compliance is thus similar to intrusion detection systems (ids), which is evident from the detection algorithms used in the primary studies. The technical architecture of these detection algorithms are analyzed to derive functional dimensions. Within the 14 technical designs, 6 of the solutions specify patterns for detection prior to the verification phase, where five in six solutions define patterns for compliance and one solution defines patterns for non-compliance. The remaining 8 solutions train a classifier to learn the compliant state, which is further used to detect outliers. Evidently, this follows the two primary types of IDS techniques, namely misuse-based ids and anomaly-based ids. Further sub dimensions of the taxonomy are derived based on the verifying characteristics of the detection algorithms. Figure 1

Privacy Misuse Detection

As mentioned earlier, the common characteristic of the technical architecture in this category of solutions is, the privacy misuse patterns (either compliant or noncompliant) that are used for detection are expressed explicitly. Generally these patterns are known in advance, and are looked up in the logs for a mismatch in case of compliant patterns or a match in case of non-compliant patterns to detect violations. Three different checking approaches are observed in the technical design of the primary studies within this category, namely, pattern matching, query-based reasoning, and model checking.

Pattern matching. The system settings of these detection algorithms are integrated it systems offering web-enabled it services, self-service identity management feature of an application, etc. Individuals release data items while interacting with these systems. The inherent characteristic of these systems is that individuals can specify privacy preferences that define conditions and obligations for their data usage. Activities of the system, i.e every action on the data items, are recorded in a log file (audit trails) for later review. During the review (audit) the actions recorded in the logs are matched against the applicable rules in the privacy preferences. There are two primary studies which fall under the pattern matching approach, Accorsi [START_REF] Accorsi | Automated Privacy Audits to Complement the Notion of Control for Identity Management[END_REF] and Accorsi et al. [START_REF] Accorsi | Automated Privacy Audits Based on Pruning of Log Data[END_REF]. Accorsi [START_REF] Accorsi | Automated Privacy Audits to Complement the Notion of Control for Identity Management[END_REF] proposes a matching approach based on counterexamples. Prior to the verification step, potential violations are derived from the privacy preferences of individuals. These patterns are later used to find a match in the log view that corresponds to an individual. A violation is detected if a match is identified.

Accorsi et al. [START_REF] Accorsi | Automated Privacy Audits Based on Pruning of Log Data[END_REF], propose a novel approach for pattern matching to improve the efficiency of the log audits. In the first step of the audit process, individualized audit trails are transformed into an action tree which is a hierarchical representation of activities based on the structure of the data items. In the second step, the algorithm sequentially processes the rules in the privacy preferences of individuals and searches for a node in the tree that corresponds to the data item referred to in the rule. When such a node is determined, the actions recorded in the node are checked for agreement with the applicable rule in the privacy preference. This process is iterated and at the end of each iteration, matched actions are pruned from the action tree. At the end of the audit, the nodes that remain constitute the sum of violations pertinent to the privacy preferences.

Query-based Reasoning. The system setting of this solution is very similar to the setting mentioned above, where the individuals can formulate privacy preferences for their data usage. Privacy related events are logged when subjects (processes, softwares, participants) of the system act upon the managed data items. Samavi et al. [START_REF] Samavi | L2TAP+SCIP: an Audit-based Privacy Framework Leveraging Linked Data[END_REF] propose a query based reasoning approach to derive obligations applicable to an access request and to verify the fulfillment of these obligations. They define two ontologies in their framework, namely l2tap (linked data log to transparency, accountability and privacy) and scip (simple contextual integrity privacy). l2tap ontology allows logging of events such as changes in the privacy preferences, and information related to access requests and access activities. This ontology provides provenance assertions (when and by whom), which are associated with the activity that triggers the change. scip ontology provides semantics for the events logged in l2tap logs, and uses sparl queries with rdfs reasoning support for auditing. The first step in the auditing process is to use sparl queries to identify all the obligations linked to an individual's privacy preferences that match the access requests. In the next step the status (fulfilled, pending, violated) of the linked obligations are identified using sparl queries to determine the compliance of the access request. In case of multiple obligations that are linked to an access request a series of sparl queries are used to evaluate the combined effect of these obligations in order to determine the overall compliance of the access request.

Model checking. The system setting of this approach is enterprise computing solutions and the design objective is to validate compliance of the system in accordance with privacy regulations, or enterprise policies, or data protection directives. These specifications are expressed in logical forms, and the actual usage of personal data recorded in the logs are also represented as models. Given this, a model-checking algorithm verifies whether a given formula is satisfied by the model. The auditing algorithms of three primary studies use the modelchecking approach. Garg et al. [START_REF] Garg | Policy Auditing Over Incomplete Logs: Theory, Implementation and Applications[END_REF] formalize all the 84 disclosure-related clauses of the health insurance portability and accountability act (hipaa) 5 Privacy Rule using first-order logic. Additionally, in their framework the audit trails are expressed as partial structures. During the audit, the auditing algorithm iteratively checks for a violation, given the policy and the audit trails. It is iterative because sometimes information contained in the logs is insufficient for determining whether a policy is satisfied or not (for e.g in case of future obligations), hence the algorithm runs iteratively when more information is available. Banescu et al. in [START_REF] Banescu | Measuring Privacy Compliance Using Fitness Metrics[END_REF] formalize the business processes of an enterprise. During the audit, the modeled system events which are generated during the execution of the business process are replayed over the business process model to identify violations, which are later quantified. The events are classified during this process to identify the type of violation in regard to the business process model. Butin et al. [START_REF] Butin | Log Analysis for Data Protection Accountability (Extended Version)[END_REF] adopt a similar approach; they express parts of the eu data protection directive 6 and the audit trails in logical form. For the verification of the state of the logs, its compliance properties are derived and defined from the formalized eu data protection directive. A log trace (audit trails) is compliant if it satisfies all its compliance properties. The audit framework proposed by Butin et al. operates on "privacy friendly" logs and they mathematically proves the correctness of the log analysis that verifies the compliance to the data protection obligations.

Privacy Anomaly Detection

The common characteristic of the technical architecture of the solutions presented in this category is that the detection is anomaly-based. The system setting of these solutions are similar to system setting of privacy misuse detection solutions, but the design objective is to detect unexpected attempts. The anomalybased detection systems identify events that deviate from an abnormal profile in the case of supervised method, or from the other items in a dataset in the case of unsupervised method. A combination of statistical, machine learning and data mining techniques are observed in eight primary studies irrespective of the anomaly detection method. Venter et al. [START_REF] Venter | Pids: A Privacy Intrusion Detection System[END_REF], Bhattacharya et al. [START_REF] Bhattacharya | Privdam: Privacy Violation Detection and Monitoring Using Data Mining[END_REF], Boxwala et al. [START_REF] Boxwala | Using statistical and machine learning to help institutions detect suspicious access to electronic health records[END_REF], Gupta [START_REF] Gupta | Modeling and Detecting Anomalous Topic Access in EMR Audit logs[END_REF] and Heatley et al. [START_REF] Heatley | Data Mining Computer Audit Logs to Detect Computer Misuse[END_REF] use the supervised anomaly detection method. The training set required to train the classifier is built manually for two of the solutions but Bhattacharya et al. [START_REF] Bhattacharya | Privdam: Privacy Violation Detection and Monitoring Using Data Mining[END_REF] use an association rule data mining technique to generate patterns of violations for the training set. Similarly Heatley et al. [START_REF] Heatley | Data Mining Computer Audit Logs to Detect Computer Misuse[END_REF] and Gupta [START_REF] Gupta | Modeling and Detecting Anomalous Topic Access in EMR Audit logs[END_REF] use statistical methods like decision tree induction technique and latent dirichlet allocation (lda) respectively to build the training set, which contains the "normal" and the "abnormal" behavior. Given the model (training data set), the classifier using statistical techniques such as k -nearest neighbor, logistic regression (lr) and support vector machine (svm) predicts the probability for the access request to be an outlier.

However, Chen et al. [START_REF] Chen | Detection of Anomalous Insiders in Collaborative Environments via Relational Analysis of Access Logs[END_REF] present an unsupervised anomaly detection method for system settings where building a clearly labeled training set is difficult. In their approach, the first step is to aggregate the features in the audit trails into community structures using a combination of statistical methods such as graphbased modeling and dimensionality detection. In the second step the deviation probability of the elements from its closest neighbor is determined using the knearest neighbor algorithm. Fabbri et al. [START_REF] Fabbri | Explanation-based Auditing[END_REF] describe an approach similar to that of Chen et al. for forming aggregated social structures but use the social graph to explain clearly the context of the events in an audit trail. The basis for this is that these explanations are later reviewed by the privacy officers to detect violations. Similarly Duffy [START_REF] Duffy | Facilitating Patient and Administrator Analyses of Electronic Health Record Accesses[END_REF] defines a framework that combines anomaly detection algorithms such as the one proposed by Chen et al. and two other algorithms (patient-flow anomaly detection systems (pfads) and specialized network anomaly detection (snad)) to provide contextual explanations thus allowing patients and privacy officers to have better understanding of the access logs.

Implications of Intrusion Detection Approach to Privacy Audits

As illustrated and depicted in Figure 1, the approaches to validate privacy compliance follows intrusion detection techniques and hence inherit the underlying limitations yet bring intrinsic challenges. For instance, misuse detection algorithms match specific patterns from the audit trails for detecting misuse, under the assumption that all the patterns for validation are known in advance. However relying on well-known patterns degrade the purpose of the validation algorithms. Moreover, the patterns for privacy invasion are difficult to define primarily because privacy invasive incidents are mostly context dependent.

Furthermore, the expressiveness of the compliance requirements as patterns is constrained by the limitations of the formal languages, for instance, purpose(s) need to be explicitly expressed for each data item. In addition, human intervention is generally required for deciding policy violations, and for providing additional semantics besides the information registered in the logs.

Anomaly detection algorithms on the other hand are not concerned with known notable events but with the abnormal system or user behavior. However, in order to detect outliers (abnormality), the classifier in the case of supervised learning method requires a fair amount of training data set to model what is normal for each subject (could be a user, a process, and a software) in a system in order to decide on how probable the activity of a given subject is abnormal. In the case of unsupervised learning though, it is important to model appropriate clusters for detecting outliers that is abnormal from rest of the members in a cluster. Nevertheless, similar to well-known patterns the signals of privacy invasions are challenging to discern because under a slightly different context a system or user behavior would have been legitimate. This may result in many false positives or many false negatives offsetting the purpose of the automation process.

Furthermore, in the literature review we observed that there are more privacy anomaly detection solutions than the privacy misuse detection solutions. This is because, in the case of anomaly-based detection the concept of normality is difficult, if not impossible to transfer from one system setting to another system setting. Although all the solutions in this category target health-care systems, a slightly different condition such as collaborative health-care systems require different training techniques or clustering for modeling expected behaviors.

A Taxonomy of Audit Objectives

In Section 3 we presented a taxonomy based on the auditing techniques that validate adherence to the privacy compliance requirements. We observe that the utilization of different auditing techniques are highly influenced by the audit objectives. Hence, in addition to the taxonomy of the technical approaches (see Figure 1), in this section we attempt to conceptualize the state-of-the-art in terms of compliance objectives. Whereby, we provide an analysis of the motivational trends for privacy compliance. There are three compliance objectives deduced from the state-of-the-art for engaging in a log-based automated privacy audits, they are; -Audit for ex-post obligations -Audit for permitted exceptions -Audit for access legitimacy Audit for ex-post obligations Privacy compliance requirements, which cannot be checked by a policy engine beforehand but are determined after the fact, are realized using automated log audits. Temporal Obligations such as "Delete the stored personal attributes after 2 years" and perpetual obligations such as "Send notice to the end-users every time there is a change in the enterprise policy" indicate after-the-fact compliance actions. To automatically realize these requirements, data handling processes are persistently monitored in the form of audit trails for subsequent actions. The granularity level of the audit trails greatly impact the achievable degree of automation of these requirements.

Audit for permitted exceptions In the health care applications, it processes such as access control are often lenient to allow for emergency. Herein, patient care and safety outweigh the permission restrictions. However, unauthorized access to patient information arise from the misuse of "break glass policies" may jeopardize the personal integrity of the patients. Therefore, these access exceptions must be supervised regularly in order to handle the risk of misuse. Audit for permitted exceptions helps to both detect and deter violation of these exceptions.

Audit for access legitimacy In service based applications, end-users are allowed to set access preferences to certain data objects that are under the control of the service providers or information fiduciaries such as identity management providers. However, regulation such as the proposed eu general data protection regulation (gdpr) 7 and agreed upon end-user agreements mandate service providers' accountability, i.e. require the service providers to demonstrate the exercised responsibilities instead of just promising that the end-user preferences will be honored. To automate this requirement, related actions of the system are recorded in the logs, compared and verified using the log audits for compliance to the conditions arising from the end-users' privacy access preferences. Further, the log audits that validate compliance to laws and regulations also include access and disclosure compliance. Therefore, the solutions that provide mechanisms for validating compliance in accordance with the laws, and regulations are also included in this category.

Figure 2 shows the categorizations of the primary studies in accordance with the audit objectives listed above.

Taxonomy of audit objectives point out how well each objectives are covered (or not covered yet) by the state-of-the-art. Further, Figure 3 illustrates the mapping of the privacy audit techniques to the privacy audit objectives.

Pattern matching, and query-based reasoning algorithms provide solutions to determine if the permissions set by the end-users are indeed respected. From Section 3.1, we note that the model checking algorithms present auditing solutions to model the observable state of a system and validate if the system is compliant as expected. Hence, model checking solutions also address accountability requirement for access and disclosure activities.

Further, from our literature review, we observe that privacy anomaly detection mechanisms provide auditing solutions for supervising the risk integrated in the enforceable policies (for e.g "break glass"). It can be noted that anomaly detection algorithms could as well suitable for access legitimacy audit. However, as mentioned earlier the inherent limitations of anomaly detection algorithms such as high number of false positives and impractical conditions for transferring the state of normality makes the anomaly detection algorithms less reliable. Nonetheless, the practical usefulness of anomaly detection for other privacy audit objectives may be a new potential research direction to investigate further.

Access legitimacy audit

[2], [START_REF] Accorsi | Automated Privacy Audits Based on Pruning of Log Data[END_REF], [START_REF] Samavi | L2TAP+SCIP: an Audit-based Privacy Framework Leveraging Linked Data[END_REF], Permitted exceptions audit [START_REF] Bhattacharya | Privdam: Privacy Violation Detection and Monitoring Using Data Mining[END_REF], [START_REF] Boxwala | Using statistical and machine learning to help institutions detect suspicious access to electronic health records[END_REF], [START_REF] Chen | Detection of Anomalous Insiders in Collaborative Environments via Relational Analysis of Access Logs[END_REF], [START_REF] Gupta | Modeling and Detecting Anomalous Topic Access in EMR Audit logs[END_REF], [START_REF] Heatley | Data Mining Computer Audit Logs to Detect Computer Misuse[END_REF], [START_REF] Venter | Pids: A Privacy Intrusion Detection System[END_REF] [ [START_REF] Duffy | Facilitating Patient and Administrator Analyses of Electronic Health Record Accesses[END_REF][START_REF] Fabbri | Explanation-based Auditing[END_REF] Ex-post obligations audit [START_REF] Banescu | Measuring Privacy Compliance Using Fitness Metrics[END_REF], [START_REF] Butin | Log Analysis for Data Protection Accountability (Extended Version)[END_REF], [START_REF] Garg | Policy Auditing Over Incomplete Logs: Theory, Implementation and Applications[END_REF] Fig. 2. Three audits objectives in the context of privacy

Guidelines

Compliance by detection approaches are long established IT processes in an organizational setting. However, in the context of privacy compliance requirements there is no one size fit all solution. In this section, we tentatively provide initial guidelines based upon our analysis of the state-of-the-art for aiding implementation of responsible log-based automated privacy audits.

-Any organization providing service to consumers usually processes information or data. An assessment procedure to classify the type of data is an essential point of departure. The classes of data such as private, public, sensitive or non-sensitive are very much context-dependent, i.e. the context of the application domain and various features of the service are need to be considered. -Depending on the classification of the data and the application domain, applicable regulations, standards, and laws must be reviewed in order to derive the privacy compliance requirements. -Classify the privacy-compliance by detection requirements into afore mentioned audit objectives. It is important to note that the list of objectives presented in section 4 are the privacy audit directions inferred from the stateof-the-art. There could be different objectives for employing privacy audits depending on the class of the data, classification domain, and jurisdiction. -Based on the identified privacy audit objectives, employ the respective algorithms as depicted in figure 3.

Access legitimacy audit

Query-based Reasoning [START_REF] Samavi | L2TAP+SCIP: an Audit-based Privacy Framework Leveraging Linked Data[END_REF] Pattern Matching [START_REF] Accorsi | Automated Privacy Audits to Complement the Notion of Control for Identity Management[END_REF][START_REF] Accorsi | Automated Privacy Audits Based on Pruning of Log Data[END_REF] Permitted exceptions audit Privacy Anomaly Detection [START_REF] Bhattacharya | Privdam: Privacy Violation Detection and Monitoring Using Data Mining[END_REF], [START_REF] Boxwala | Using statistical and machine learning to help institutions detect suspicious access to electronic health records[END_REF], [START_REF] Chen | Detection of Anomalous Insiders in Collaborative Environments via Relational Analysis of Access Logs[END_REF], [START_REF] Gupta | Modeling and Detecting Anomalous Topic Access in EMR Audit logs[END_REF], [START_REF] Heatley | Data Mining Computer Audit Logs to Detect Computer Misuse[END_REF], [START_REF] Venter | Pids: A Privacy Intrusion Detection System[END_REF] [ [START_REF] Duffy | Facilitating Patient and Administrator Analyses of Electronic Health Record Accesses[END_REF][START_REF] Fabbri | Explanation-based Auditing[END_REF] Ex-post obligations audit Model Checking [START_REF] Banescu | Measuring Privacy Compliance Using Fitness Metrics[END_REF], [START_REF] Butin | Log Analysis for Data Protection Accountability (Extended Version)[END_REF], [START_REF] Garg | Policy Auditing Over Incomplete Logs: Theory, Implementation and Applications[END_REF] Fig. 3. Privacy audit objectives and respective techniques

Conclusions

We systematically reviewed and classified the existing privacy compliance validation solutions in relation to the auditing techniques and the audit objectives. In this paper we attempt to deconstruct the theoretical foundations of the state-ofthe-art in order to explain the conceptual relationships of the existing solutions. Nonetheless, we recognize that the presented taxonomies are itself artifacts hence subject to evaluation. We attempt to conceptualize the presented taxonomies for mutually exclusivity and explanatory, to ensure they are extendible when more objects show up in the future. Privacy compliance validation plays a very important role for success of any business. Despite the recognition of the importance of compliant to privacy requirements, the state-of-the-art has not matured proportionately with the growing privacy expectations. Furthermore, the feasibility of automating the privacy expectations in order to demonstrate compliance is practically restricted by two factors. First, the degree of expressiveness of regulations, laws, standards, and user-laid preferences in a machine-readable form. Second, the level of granu-larity of the information logged in the audit trails, and the impractical conditions to automatically log certain system activities such as "informed consent". Hence, as a next step, in our future work, we are interested in studying a privacy-aware log design for privacy compliance validation.

Fig. 1 .

 1 Fig. 1. Technical taxonomy of privacy-compliance by detection solutions.

Table 1 .

 1 Search strings

	Phrases	Synonyms
	(Including free texts)
	privacy concerns
	privacy analysis	privacy audit
	privacy compliance	privacy enforcement
	privacy non compliance	privacy violation
	access logs
	audit trails
	-Exclude if the focus of the proposed approach is clearly not a privacy-
	compliance by detection.
	-Exclude if the focus of the paper is not technical but relates to constitutions,
	legislation and regulations.

  depicts the resulting classification, which consists of 2 dimensions of the technical designs observed from the existing privacy-compliance by detection solutions.

			Privacy-
			Compliance
			by Detection
		Privacy	Privacy Anomaly
		Misuse	Detection
		Detection	[7, 8, 11-13,
			15, 16, 22]
	Pattern	Query-Based	Model
	Matching	Reasoning	Checking
	[2, 3]	[21]	[6, 9, 14]

This research was funded by A4Cloud and SmartSociety, two research projects of the Seventh Framework Programme for Research of the European Community under grant agreements no. 600854 and no. 317550.

ebsco discovery service is a gateway to access various scholarly databases (with and without full text) in many different disciplines and it also includes electronic resources like e-magazines, e-books and etc. The complete list of resources indexed by the discovery service can be found at[START_REF]Databases in onesearch[END_REF]. The updated version of the list is not available yet, hence recently added database such as ACM is missing in the out dated list.

http://endnote.com/, accessedMarch 11, 2016.

In this paper the words classification and taxonomy are interchangeably used to mean the result of the classification process.

For example, the cycles of our taxonomy revision process was intuitive, there was no ending conditions such as objective and subjective endings were specified to terminate the iteration.

http://www.hhs.gov/ocr/privacy/, accessed onMarch 11, 2016

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046: en:HTML, accessed onMarch 11, 2016

http://ec.europa.eu/justice/data-protection/document/review2012/com_ 2012_11_en.pdf, accessed onMarch 11, 2016

Acknowledgments. This work benefits from the invaluable comments, inputs from Rose-Mharie Åhlfeldt and from the anonymous reviewers.