Edward W N Bernroider
email: edward.bernroider@wu.ac.at

Sebastian Margiol
email: sebastian.margiol@wu.ac.at

Alfred Taudes
email: alfred.taudes@wu.ac.at

Towards a General Information Security Management Assessment Framework to Compare Cyber-Security of Critical Infrastructure Organizations

Keywords: BSC, Cyber-security, Critical Infrastructure, Design Science, Information Security Management

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Today's organizations in the private and public sectors have become increasingly dependent on Information and Communication Technologies (ICTs) to develop and offer their services and products. While these ICTs offer considerable advantages, their widespread access expose individuals, organizations and nations to risks, which in particular include Internet-related security breaches [START_REF] Gottwald | Study on Critical Dependencies of Energy, Finance and Transport Infrastructures on ICT Infrastructure European Commission[END_REF]. A missing understanding of the risk cultures and exposures related to developing and operating ICT can lead to significant negative impacts. Consequently, there is a natural interest of a wide range of stakeholders including citizens and governments [START_REF] Hare | The Cyber Threat to National Security Why Can't We Agree[END_REF] to ensure that any organization in an economy, in particular those operating critical infrastructures, manage their ICT risks ap-

propriately. An infrastructure is considered to be critical when its maintenance is essential for vital societal functions. A damage to a critical infrastructure, such as energy supply or transportation [3], may have a significant negative impact for the security of the country and the well-being of its citizens. An important and growing area of research and standard development deals with organizational-related cyber-security issues. Cyber-security has been defined by the International Communications Union (ITU) to mean "a collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment, and organization and user's assets" [START_REF] Gercke | Understanding Cybercrime: A Guide for Developing Countries[END_REF]. The term can be considered to holistically cover all ICT related threats, e.g., involve corrupting or disrupting e-services or simply the information flow between people and organizations. Organizational and user assets include all resources (information, people, technologies and systems).

When characterizing cyber-security studies, one needs to understand what is measured, why and for whom the measurement takes place [START_REF] Vaughn | Information Assurance Measures and Metrics -State of Practice and Proposed Taxonomy[END_REF]. In our case, we seek to measure critical infrastructure organizations, which are of particular importance to the stability of a nation or economy [START_REF] Hare | The Cyber Threat to National Security Why Can't We Agree[END_REF]. The motivation is to allow for a description and comparison of cyber-security in terms of overall performance of information security management (ISM) and its strategic security programs, which are the foundation for achieving security on the technical infrastructure level. While technical scores are important to understand the many facets of operational security including the configuration of firewalls, the effectiveness of intrusions detection systems [START_REF] Fink | A Metrics-Based Approach to Intrusion Detection System Evaluation for Distributed Real-Time Systems[END_REF] or the use of proxy servers, strategic scores allow for an understanding of how well risks are being predicted or managed, whether policy compliance is reached or business impact analysis is sufficient enough. Finally, we seek to feedback information to the critical infrastructure organizations and to serve external authorities and policy makers, who can support cybersecurity with a range of tools, e.g., research and development programs.

An important element of cyber-security is to protect an entity based on given security objectives against risks in the cyber-environment. Multi-dimensional framework approaches can be used to assess and control levels of performance [START_REF] Bernroider | A comprehensive framework approach using content, context, process views to combine methods from operations research for IT assessments[END_REF], in particular in relation to cyber-security [START_REF] Herath | Balanced Scorecard Implementation of Security Strategies: A Framework for IT Security Performance Management[END_REF]. The strategic and measurement focus of this study made us consider balanced scorecards (BSCs) approaches, which offer a systematic analysis linking strategy with a set of measures [START_REF] Kaplan | The Balanced Scorecard -measures that drive performance[END_REF][START_REF] Kaplan | Putting the Balanced Scorecard to Work[END_REF][START_REF] Kaplan | The Balanced Scorecard: Translating Strategy into Action[END_REF]. Such scorecards typically display the current security situation against the desired future states in an attempt to systematically manage cyber-security of an organization, which is also unit of analysis for this study.

The aim of this paper is to build and test a framework that can be used to holistically measure the quality of information security management in the context of cyber-security and allow for comparative assessments of organizations in critical infrastructure sectors. This context requires to generally include the management of ICT security in organizations with a focus on the strategic level holistically covering an entire organization. We were also interested in the typical frameworks and their metrics, measurement approaches and aggregation methods to operate a scorecard. This scorecard should consider the requirements to be able to evaluate and compare a given securitylevel, and had to be implementable by face-to-face interview techniques implemented as part of a survey. The following section gives a preliminary theoretical overview based on academic literature and standards to identify relevant prior research focused on scorecards and their constituent elements. A design science approach is used to develop an assessment framework as an artifact based on scorecard theory and fieldwork including workshops and empirical validations.

2

Theoretical Background

Balanced Scorecards (BSCs)

As the aim of this paper is to create an information security framework based on the Balanced Scorecard (BSC), we build on prior research on the BSC, which is considered a well-established management scorecard in business practice. A study on the application and popularity of different management instruments in different economic regions ranked the BSC as fifth popular management instrument worldwide. Within the EMEA economic region (Europe, Middle East and Africa) the BSC was identified to be the most popular management instrument [START_REF] Rigby | Management Tools & Trends[END_REF]. The usefulness of the BSC method was demonstrated for a variety of entities and different organizational settings including, e.g., higher education [START_REF] Lawrence | Commodification of Education and Academic LABOUR-Using the Balanced Scorecard in a University Setting[END_REF], national health service [START_REF] Protti | A proposal to use a balanced scorecard to evaluate Information for Health: an information strategy for the modern NHS (1998-2005)[END_REF], banking [START_REF] Littler | A new approach to linking strategy formulation and strategy implementation: an example from the UK banking sector[END_REF] and public sector [START_REF] Irwin | Strategy Mapping in the Public Sector[END_REF]. Another study conducted a systematic comparative research to relate the value of the BSC, and the value of specific elements of it, to the context of the application [START_REF] Southern | From Teaching to Practice, via Consultancy, and then to Research?[END_REF]. The BSC appeared to be of value to all ten organizations analyzed (although in varying degrees).

The Balanced Scorecard (BSC) is a measurement system of an entities' performance linking strategic objectives and measures across four different perspectives, and promising strategy mapping between each of these perspectives [START_REF] Kaplan | The Balanced Scorecard -measures that drive performance[END_REF][START_REF] Kaplan | Putting the Balanced Scorecard to Work[END_REF]. The original standard dimensions describe how the Learning and Growth dimension (often also referred to as future perspective) feeds into the Internal Business Process and Customer dimensions, which impact the Financial dimension. The idea of a BSC is to find a set of measures that maintain a balance between different dimensions or characteristics, such as financial and non-financial aspects, short-and long-term objectives, lagging and leading indicators, and internal and external performance perspectives [START_REF] Kaplan | The Balanced Scorecard: Translating Strategy into Action[END_REF][START_REF] Protti | A proposal to use a balanced scorecard to evaluate Information for Health: an information strategy for the modern NHS (1998-2005)[END_REF]. These measures should not only give an overview of the current or actual state of an entities' situation, but also the desired or planned state in terms of specific targets. The gap between the actual against the planned state is the performance gap, which should be closed in a certain time with an action plan that is structurally linked with the according measures in the scorecard.

However, there are also critical reflections of the BSC [START_REF] Ahn | Applying the Balanced Scorecard Concept: An Experience Report[END_REF][START_REF] Norreklit | The balance on the balanced scorecard a critical analysis of some of its assumptions[END_REF]. Some scientists question the causality between different perspectives and their suitability to monitor technological developments [START_REF] Norreklit | The balance on the balanced scorecard a critical analysis of some of its assumptions[END_REF]. In the IT area the BSC was applied for e.g. strategic information systems [START_REF] Martinsons | The balanced scorecard: a foundation for the strategic management of information systems[END_REF], in the ERP [START_REF] Roseman | Measuring the Performance of ERP Software -a Balanced Scorecard Approach[END_REF] and IT governance [START_REF] Grembergen | The Balanced Scorecard and IT Governance[END_REF] contexts, and for ebusiness development [START_REF] Bernroider | An Application of the Balanced Scorecard as a Strategic IT-Controlling Instrument for E-Business Development[END_REF]. Linked or cascading Balanced scorecards were, for example, used in IT performance management with a developmental and operational BSC [START_REF] Grembergen | The Balanced Scorecard and IT Governance[END_REF]. In the context of organizational security, the BSC has been transformed into an IT security scorecard [START_REF] Herath | Balanced Scorecard Implementation of Security Strategies: A Framework for IT Security Performance Management[END_REF][START_REF] Huang | Balancing performance measures for information security management[END_REF]. While some guidelines for the general transformation of the BSC into the IT security context were given, specific guidelines on how to design and implement metrics for different levels and characteristics of measurements are generally missing.

Due to its high diffusion rate in practice, the BSC seems to be an appropriate management instrument to capture and compare information security if it is adapted in structure and content to the specific requirements.

Security Scorecards and Recommendations

For the composition of the information security framework, scorecard based approaches and general recommendations about information security management (ISM) were taken into consideration. None of the identified sources were able to fulfill our requirements directly, however the choice of a BSC as basis model for our framework scorecard approach was supported and some of its subdomains were motivated.

The study of de Oliveira Alves, et al. [START_REF] De Oliveira Alves | Enterprise Security Governance; A practical guide to implement and control Information Security Governance (ISG). Business-Driven IT Management[END_REF] considers the governance of information security and therefore puts its primary focus on the strategic orientation. Their model is also based on the basic BSC and proposes indicators which are derived from best practice and which are also part of the CobiT and ISO/IEC 17799 frameworks. The BSC concept also constitutes the foundation of the ISScoreCard of Huang, Lee and Kao [START_REF] Huang | Balancing performance measures for information security management[END_REF] which covers information security management of the manufacturing industry. Measures for enhancement of security awareness and resilience against attacks are assigned to their potential perspective. The BSC model for information security by Herath et al [START_REF] Herath | Balanced Scorecard Implementation of Security Strategies: A Framework for IT Security Performance Management[END_REF] seeks to implement performance management in relation to IT security. The BSC study of Royer and Meints [START_REF] Royer | Enterprise Identity Management -Towards a Decision Support Framework Based on the Balanced Scorecard Approach[END_REF] covers identity management and is inspired from the IT Infrastructure Library (ITIL) [START_REF]TSO: Introduction to the ITIL service lifecycle. The Stationary Office (TSO)[END_REF], CobiT [START_REF]ISACA: COBIT -4th Edition[END_REF] and other best practice sources. The "Cybersecurity Health Check" system [START_REF] Pan | Cybersecurity Healt Check[END_REF] is also based on a BSC concept. Its aim is to determine information security by regarding the human factor, especially measures for awareness building and training of information security. This focus is anchored on the assumption that the human factor poses the weakest link of a cybersecurity chain [START_REF] Pan | Cybersecurity Healt Check[END_REF]. Another BSC based study applies selected metrics with regard to ITIL, ISO/IEC 28002 and CobiT [START_REF] Charuenporn | Qos-Security Metrics Based on ITIL and COBIT Standard for Measurement Web Services[END_REF] for assessing the quality of information security for web-services.

Two internationally accepted frameworks in the domain of information security (NIST 800-55 and ISO 27001) have high relevance for the information security domain. NIST disseminated various publications that are dedicated to information security on different levels [START_REF]NIST: Framework for Improving Critical Infrastructure Cybersecurity[END_REF]. The NIST publication 800-55, for example, addresses the performance evaluation of information security and proposes a three-step ascertainment of a target level [START_REF] Chew | NIST Special Publication 800-55 Information Security[END_REF]. The ISO published a series of standards on the topic information security under the family name ISO 27000. Whilst ISO 2700 offers a general overview about management systems for information security, 27001 is dedicated to the requirements for the establishment, operation, surveillance, maintenance and continuous improvement of an information security management system (ISMS). ISO 27002 is built on ISO standard 27001 and deals with essential activities for creating and implementing a working ISMS.

Research Approach and Process

This study presents a designed, developed, and field-tested assessment framework that followed the Design Science Research (DSR) approach by Peffers et al. [START_REF] Peffers | A Design Science Research Methodology for Information Systems Research[END_REF]. Accordingly, the research process was structured by the process steps given in Table 1. The three DSR cycles presented by Hevner [START_REF] Hevner | A three cycle view of design science research[END_REF] have been used to support different steps in the research process.

Table 1. Research Approach and Process based on Design Science [START_REF] Peffers | A Design Science Research Methodology for Information Systems Research[END_REF] For the first stage to "(1) Identify the problem and motivate", we met with industry consultants and security experts from the application domain to clarify the problem and motivation for this research (workshop 1) followed by a consultation of academic and practitioner literatures. This led to the consideration and adaptation of the BSC concept to the security context. Thus, we engaged in relevance and rigor cycles, respectively. For the second stage to "(2) Define Objectives of a Solution", we engaged again with representatives from the application domain (workshop 2) to engage in another relevance cycle. Next, we engaged in "(3) Design & Development" and revised our framework through internal and external design cycles. The third activity covers the design and development of an artifact, including a description of the artifact's desired functionality [START_REF] Peffers | A Design Science Research Methodology for Information Systems Research[END_REF]. Again, the external design cycles were supported by workshops (3-4) together with industry consultants and security experts. The stage "(4) Demonstration" was implemented by pre-testing the framework and meeting again to engage in another design cycle with the same domain experts. Activity four requires the demonstration of the use of the artifact to solve the problem, followed by an evaluation of its performance. The "(5) Evaluation" stage took place between June/2014 and October/2014 in terms of one-hour face-to-face interviews with 30 organizations, and was followed by another minor design cycle. After analyzing the results, we engaged in "(6) Communication" in terms of a formal event, where we presented and discussed the results together with policy makers and application domain experts.

Objectives, Design and Development of the Framework

Objectives of a Solution

The ISM assessment framework is intended to be a multidimensional, indicator based, information security assessment system for critical infrastructure companies taking ideas from the BSC. The most essential difference is that the BSC requires a very specific context, while we seek to develop a universal instrument to compare the cyber security states of critical infrastructure organizations (objective 1). This is the first among five general objectives that were identified as being essential in order to meet the specific requirements of this study (see Table 2). These general objective were identified as a result of the first workshop.

Table 2. Five General Framework Objectives

Objectives Description 1) General applicability

The framework has to be equally applicable for companies in the critical infrastructure sector.

2) Representation of the whole organization

The choice of perspectives and multi objective definition should provide a complete representation of the whole organization.

3) Expressiveness of sub-dimensions

Sub-dimensions should have sufficient expressiveness to identify strengths and weaknesses in order to allow for corrective measures.

4) Multidimensional measurability on homogenous scales

Each sub-dimension is represented by multiple indicators that sufficiently describe the sub-dimension with homogenous scales. Indicators need to be defined in a way that exhaustively covers the sub-dimension on desired abstraction levels.

5) Aggregation of sub-dimensions

All sub-dimensions need to be aggregable with prior defined criteria in order to enable statements on different abstraction levels as well as to provide a holistic overall assessment.

The arrangement of perspectives allows communicating the overall situation. Therefore a precise definition and appropriate amount of different, correlating, multiple dimensions and targets of security relevant factors in terms of multi criteria decision making is necessary [START_REF] Bernroider | Characteristics of the Multiple Attribute Decision Making Methodology in Enterprise Resource Planning Software Decisions[END_REF]. The measurement of scorecard dimensions is thus based on multiple modular subdomains. An aggregation of all measurements of an individual subdomain enables an overall statement of a dimension. This results in different abstraction layers.

The representation of an individual dimension provides an overview, whilst the inspections of individual and manageable sub-dimensions allows for more detailed insights, which can then be used in order to take measures [START_REF] Merz | Entwicklung einer indikatorenbasierten Methodik zur Vulnerabilitätsanalyse für die Bewertung von Risiken in der industriellen Produktion[END_REF].

An essential restriction for the choice of indicators is their measurability. The amount of indicators for describing the sub-dimensions may vary, a higher amount of indicators for a sub-dimension does not attach more value to it, but reduces the error of measurement. In order to summarize multiple indicators, scales are defined. Scaling schemes allow for quantitative measurement of different dimensions which were measured qualitative. Scales are measurement instruments that are used to numerically identify a relative amount, position or the presence or absence of a relevant unit [START_REF] Atteslander | Methoden der empirischen Sozialforschung[END_REF]. As indicators serve as basic elements, their proper definition is of high importance.

In order to receive an easy to describe result it is necessary to group results starting on indicator levels to gradually reach a higher abstraction level. (See Figure 2). For an easy aggregation of the measurement results of individual sub-dimensions, it is necessary that they are balanced. Within the dimensions, their relevant indicators are condensed to index values. For this aggregation, different approaches can be applied dependent on knowledge and measurability of indicators. A unidimensional evaluation method condenses all sub-dimensions of the framework to a single main-dimension. This method, however, leads to a loss or falsification of information. Additionally, subdimensions are not independent or mutual exclusive, what may result in a distortion. Nevertheless, the instrument is useful to classify the given degree of achieved information security of a single organization or a group of organizations.

Framework Design

The ISM assessment framework consists of four main dimensions that are illustrated in Figure 1. The first dimension was called Security Ambition (SA) and refers to the potential or future perspective of the BSC. The second dimension is called Security Process (SP) and is based on the internal process perspective of the BSC. The third Resilience (RE) perspective is based on the customer perspective of the BSC. Finally, the Business Value (BV) refers to the financial or value perspective of the BSC. These dimensions and their reasoning are described next. According to NIST recommendations [START_REF]NIST: Framework for Improving Critical Infrastructure Cybersecurity[END_REF][START_REF] Chew | NIST Special Publication 800-55 Information Security[END_REF], we included security guidelines as a starting point which are usually realized through an information security policy (ISP). This requirement is covered by the perspective "Security Ambition" within our model. As second pillar, NIST proposes to incorporate efficiency and effectiveness of the information security processes. The third pillar of NIST 800-55 covers security incidents that are directly influencing the business or mission level. This is covered by the perspective "Resilience". It is also important to assess whether the critical infrastructure organization itself realizes what additional benefit information security offers. This is realized within the "Business Value" dimension of our framework. This approach does not only cover the recommendations of the basic balanced scorecard concept, but additionally takes into consideration that investment in information security requires transparency on cost and value side alike. Table 3 shows how these different dimensions can be related to other studies or frameworks from literature.

Security Ambition

This dimension covers all strategic and future-oriented ambitions to preserve or raise the security level of an organization. This includes primarily organizational factors (such as existence and quality of information security regulations and risk management), as well as procedural efforts in the domain of security awareness, training and education. The area of knowledge management covers the ability of an organization to assess development and outcome of new technologies. This ability is an essential requirement to be able to respond adequately to former unknown threats. In terms of general BSC dimensions, this category represents the future perspective [START_REF] Kaplan | The Balanced Scorecard -measures that drive performance[END_REF] and takes the fundamental importance of the information security policy according to NIST 800-55 [START_REF]NIST: Framework for Improving Critical Infrastructure Cybersecurity[END_REF][START_REF] Chew | NIST Special Publication 800-55 Information Security[END_REF] into account.

Security Processes

This dimension covers the efficiency and effectiveness of relevant information security processes of an organization. It is composed of the sub dimensions: information security management systems (ISMS) [START_REF]ISO/IEC JTC 1, Information technology, Subcommittee SC 27[END_REF], patch management, change management, identity and access management, asset management, monitoring and reporting, as well as incident management and related cause research and problem analysis. In reference to the NIST 800-55 framework [START_REF]NIST: Framework for Improving Critical Infrastructure Cybersecurity[END_REF][START_REF] Chew | NIST Special Publication 800-55 Information Security[END_REF], this dimension represents the "effectiveness/efficiency metrics of security service delivery" which assesses whether the security measures were implemented properly, perform as expected and deliver the expected outcome. NIST defines effectiveness as the robustness of the result itself and efficiency as the timeliness of the result [START_REF] Chew | NIST Special Publication 800-55 Information Security[END_REF]. According to the BSC logic, the quality of internal processes is examined, which are mapped by information security processes in the context of this study [START_REF] Kaplan | The Balanced Scorecard -measures that drive performance[END_REF].

Resilience

The resilience perspective determines an organization's resilience in regard to the required availability of service levels. This is of utterly importance for critical infrastructure organizations. An organization's ability to maintain its service delivery mainly depends on how well the incident management is realized and how often and rigorous audits and security analysis are realized. In order to be able to react on changes in the availability of service, an emergency conception is required. It is thereby relevant how well the conception is internalized and how well relevant contractual partners are incorporated into this conception. Mapped to the BSC logic [START_REF] Kaplan | The Balanced Scorecard -measures that drive performance[END_REF], resilience equals the customer perspective. The resilience perspective is further supported by the third pillar of the cybersecurity framework of NIST [START_REF]NIST: Framework for Improving Critical Infrastructure Cybersecurity[END_REF].

Business Value

This dimension reflects how much value an organization attaches to security. It captures how well information security is measured. The outcome as result of the measurement is not the main focus of this dimension, but the efficiency and effectiveness of the measuring system itself. The performance in this dimension shows whether an organization has knowledge about, measures and operates its own information security level. Additionally it is important to assess whether the costs and the value of information security are transparent. The NIST 800-55 recommendation [START_REF] Chew | NIST Special Publication 800-55 Information Security[END_REF] is therefore complemented with a dimension that, in terms of BSC logic, reflects the financial respectively the value perspective [START_REF] Kaplan | The Balanced Scorecard -measures that drive performance[END_REF].

Aggregation

Frameworks in ICT evaluation and management are usually based on additive value models. These models use multiple (often conflicting) attributes to maximize a single quantity called utility or value. To aggregate single utilities and generate a super scale or index, multiple single-attribute value functions are aggregated. This is most regularly achieved by a simple additive weighting procedure [START_REF] Yoon | Multiple attribute decision making: An introduction[END_REF], for example, in the Utility Ranking or Value Method [START_REF] Zangemeister | Nutzwertanalyse in der Systemtechnik[END_REF]. The aggregation is undertaken by a weighted sum of single-attribute value functions. In the weighted sum method the overall suitability of each alternative is thereby calculated by averaging the score of each alternative with respect to every attribute with the corresponding importance weighting.

A value aggregation is possible on each level as all values should represent independent, unified and normed target values of the given company. This procedure is called value-synthesis in context of utility analysis [START_REF] Zangemeister | Nutzwertanalyse in der Systemtechnik[END_REF]. For aggregation of the data different approaches can be applied, for example the Profile Distance Method [START_REF] Bernroider | Profile distance method -a multi-attribute decision making approach for information system investments[END_REF]. A common method is to use a weighted average with normalized indicator values [START_REF] Merz | Entwicklung einer indikatorenbasierten Methodik zur Vulnerabilitätsanalyse für die Bewertung von Risiken in der industriellen Produktion[END_REF]. Normalization in this context refers to adjusting measurements on different scales to a uniform scale. It should be noted that aggregation leads to information losses and bias.

If there is no information available for weighting, it is advisable to use a simple average, without weighting. This results in average values for each group. Our model uses a hierarchical indicator model and assumes each hierarchical level to be equally weighted. That means that each abstraction level aggregates values independent of the amount of indicators with the same weight into the aggregation. Due to easier handling and comprehensibility it is common to use a linear aggregation method. However, this assumes that all values are compensable with each other, which is does not hold in reality [START_REF] Merz | Entwicklung einer indikatorenbasierten Methodik zur Vulnerabilitätsanalyse für die Bewertung von Risiken in der industriellen Produktion[END_REF]. Individual evaluation criteria represent different features which, in sum, allow for an extensive and holistic evaluation of the information security level of a participating company. The hierarchical levels of the index are visualized in Figure 2. The numbers in the brackets refer to the number of questions within the questionnaire. The black boxes display the sub-dimension-indexes, which together form the dimension-index. In total, the scorecard is made up of 108 indicators that are grouped to 19 sub-dimensions which are subsumed to four main dimensions that finally form the overall index.

Framework Demonstration and Evaluation

The developed information security framework included contextual questions, which were used to enable an additional qualitative assessment alongside the quantitative assessments needed to create aggregate values (indices).

Pretests

Upon finalization of the framework and the underlying questionnaire, two pre-tests were carried out. The main aims of these pre-tests was to test the framework's measurement instrument via structured face-to-face interviews in real-life environments and demonstrate the validity of the instrument. It was tested whether the instrument is comprehensible and how much time it takes to answer all questions diligently. For this test run it was particularly interesting to understand whether the target person of the interview, the Chief Information Security Officer (CISO), could answer all questions by herself without consulting an additional knowledge source (colleagues or a database).

The result of these pre-tests was used to further refine the questionnaire. It was necessary to optimize the length of the questionnaire considering the time limitations to complete it. All questions that could not be answered or were likely to need a preparation time to be answered were removed. The pretests also demonstrated that is was necessary to add some more contextual questions in order to avoid misinterpretation of some index values. After all adjustments were made, a second round of pre-tests was carried out. The findings of this round did not require further refinements of the structured questionnaire. Therefore the research instrument was found to be ready to be employed.

Framework Evaluation

The data collection process with face-to-face interviews alongside a structure questionnaire was conducted during the time period from June 2014 to October 2014 in Austria. In total, 30 companies participated, eight companies of the information and communication technology industry, six companies of the energy supply sector, six transportation companies, four within the banking sector, three from the health care sector and three from other industries. Although the number of participants was not very high, a better part of Austrians critical infrastructure companies were covered.

The questionnaire comprises 108 indicators in total, 34 indicators for the dimensions "Security Ambition", 25 indicators for the Dimension "Resilience", 40 indicators for the dimension "Security Process" and 8 indicators for the dimension "Business Value". Additionally, the questionnaire uses descriptive complementary questions in open and semi-structured form. All indicators are assessed with a 5 point Likert scale with interval scaled answers ranging from 1 (excellent) to 5 (insufficient). This common scale allowed for the required uniform understanding of questions by all participants. It was openly stated to give a critical self-assessment and provide a satisfaction level for these questions. The questionnaire also comprises some contextual questions that allow for a qualitative assessment. For example the value of IT security is measured by considering the allocation of financial resources that are directly associated with service delivery of security management.

Discussion and Conclusion

This paper proposed the development of a general framework for assessing the quality of information security management driven by the needs of understanding the comparative levels of cyber-security of critical infrastructure organizations. A preliminary literature research identified the BSC as a useful base model for developing such a framework due to its wide recognition in practice, literature, its overall comprehensiveness and strategic management orientation. A design science research (DSR) approach based on the six stages by Peffers et al. [START_REF] Peffers | A Design Science Research Methodology for Information Systems Research[END_REF] was used to develop an information security framework, which took into account three DSR cycles presented by Hevner [START_REF] Hevner | A three cycle view of design science research[END_REF]. These cycles assured relevance, rigor and effective design principles. In particular, we involved subject experts and CISOs as the main stakeholders from the information security domain. The DSR research process was concluded with a presentation to all stakeholders including many of the interviewed CISOs, policy makers, and security and critical infrastructure industry experts.

The resulting information security framework is deemed capable of realizing a general information security status evaluation, which can be used to compare critical infrastructure organizations. For this purpose, we used a range of 108 indicators that are grouped to 19 sub-dimensions. However, in order to give these metrics additional meaning and support understanding, it was necessary to complement the quantitative questions with open qualitative questions that capture the special contextual situations. More precisely quantitative evaluation serves to benchmark, whereas qualitative questions can be used to explain and interpret scores. The scorecard in terms of the quantitative estimators alone does not portray the complete security status. An example for an open question is "Who reports to the management? -Describe the reporting structure". In contrast, a typical index question consists of an evaluation of the quality of, for example an emergency concept, and the significance that is given to it by upper (business level) management.

An important issue that needs to be clarified prior to the application of the assessment framework, is to accept it as comparative learning and assessment tool to reveal relative weaknesses and strengths. As the questionnaire is based on a self-assessment, it would easily be possible to whitewash potential problems. This has to be clarified prior to its implementation on the organization and individual levels. As the CISO is the main target person for the questionnaire, she is prone to experience a social desirability bias. This bias refers to the tendency to give socially desirable responses [START_REF] Grimm | Social Desirability Bias[END_REF].

Future work could include an evaluation of possible social desirability bias in order to control it in data analysis. A further enhancement would be an incorporation of companies' resource dependencies in regard to cyber-security. This would result in a more holistic view. It should be possible to cascade the framework for multiple companies. Other future research could extend our work by comparing the proposed framework with others in terms of applicability and accuracy. The proposed framework needs a constant refinement in terms of both structure and suggested metrics that can be applied throughout all different sectors within the critical infrastructure sector to allow for comparisons. Additionally, different aggregation approaches could be used, in particular to account for different weighting profiles.

Fig. 1 .

 1 Fig. 1. Structure of the Information Security Management (ISM) assessment framework

Fig. 2 .

 2 Fig. 2. Hierarchical levels of the ISM framework

Table 3 .

 3 Models and Frameworks Related to ISM Framework Dimensions

	Reference	Dimensions (Number of indices)	Frame-work
	Enterprise	Risk Management (6)	SA
	Security	Policy Compliance (10)	SA, BV
	Governance -	Asset Management (5)	RE
	Security Dash-	Knowledge Management (8)	SA
	board	Incident Management (7)	RE
	[25]	Continuity Management (10)	SP
		Security Infrastructure (8)	SP, BV
	Security	Financial (5)	BV
	Performance	Customer (5)	RE
	(BSC)	Internal process (11)	SP
	[24]	Learning & growth (14)	SA
	Enterprise Iden-	Financial/monetary (3)	BV
	tity	Business process (3)	SP
	Management	Supporting process and ICT infrastructure (3)	SP
	[26]	Information security, risk and compliance (3)	SA, BV
	Cybersecurity	Protection Requisitions (2)	SP, BV
	Health Check	Defense-in-Depth Implementation (3)	SP
	[29]	ISMS Establishment (4)	SA
		Security Awareness & Education (3)	SA
	Quality of	Compliance (0)	BV
	Service	Integrity (0)	RE
	Security	Reliability (0)	RE
	[30]	Availability (2)	RE
		Confidentiality (3)	SP
	NIST	Implementation of security policy	SA
	Publication 800-	Effectiveness/efficiency metrics of security services delivery SP
	55 [31, 32]	Impact metrics of security events on business/mission level	RE
	ISO/IEC	Security policy	SA
	27001/2	Organizing information security	SA
	(ISO 17799)	Asset management	SP
	[38, 42]	Human resources security	SP
		Physical and environmental security	SP
		Communications and operations management	SA
		Access control	SP
		Information security acquisition development & maintenance RE
		Information security incident management	RE
		Business continuity management	SA
		Compliance	BV

Acknowledgment. We would like to thank Michael Stephanitsch for conducting the interviews and especially Wolfgang Gattringer, Heiko Borchert and Wolfgang Rosenkranz for hosting the workshops and engaging in the discussions.


Ildikó Szabó

Katalin Ternai

Semantic Audit Application for Analyzing Business Processes

Keywords: audit, business process management, text mining, process ontology, ontology matching

Standard regulations are used to assess the compliance of business operations by auditors. This procedure is too time-consuming and Computer Assisted Audit Tools lack of the feature of processing documents semantically in an automatic manner. This paper presents a semantic application which is capable of extracting business process models in the shape of process ontologies from business regulations based on reference process ontologies transformed from process models derived from standard regulations. The application uses ontology matching to discover deviations of a given business operation and creates a transparent report for auditors. This semantic tool has been tested on one of the Internationalization processes in the respect of Erasmus mobility.

Introduction

Auditing information systems and business processes provide a valuable feedback about business management. Constraints derived from regulations, guidelines, standards provide compliance requirements. In the light of them, auditors have to investigate information reflecting business operations. This information can be extracted from transaction data stored in operational databases, data warehouses or resides in internal regulations, handbooks, event logs, waiting for their interpretation.

Computer Assisted Audit Tools and Techniques (CAATTs) support auditors by reports resulted from data analysis. Their main functions are to investigate internal logic of an application directly with testing transactional data produced by an IT application after feeding it with real or dummy data or by executing parallel simulation. Moreover there are indirect methods like Generalized Audit Systems and embedded audit modules for scrutinizing the compliance of an application. The latter focuses on monitoring transactions within the application. GAS are used to extract and analyze data. Two GAS systems -ACL and IDEAwere widely used among participants of the study conducted by Braun and Davis [START_REF] Braun | Computer-assisted audit tools and techniques: analysis and perspectives[END_REF] The lack of CAATs that they do not investigate the compliance of business processes directly and use only fact data provided by an information system. Evaluation based on processing business regulations is missing from them.

But regulations hide processes per se which can be extracted from them with creating process models or executing text mining. Process models extracted from business and standard regulations provide a basis to discover deviations between actual business operation and requirements articulated in regulations. Discovering deviations requires structural investigation of these processes within a context-dependent environment. Ontology-based approach using text mining is one way to fulfil this requirement. Because the aim of creating ontologies is to specify a conceptualization of a given domain and text mining can help to build ontologies in a semi-automatic manner, hence ontologies can reflect contexts and their concepts unambiguously. Process ontologies preserve business process elements from the models in a unified way. Ontology matching can enhance structural and semantic investigation of process ontologies.

These techniquescreating process ontologies with text mining, running ontology matching and interpreting its resultcan underlie a tool which is capable of processing business regulations, standard regulations and revealing discrepancies and similarities between them, focusing on the meaning of these documents. This feature is missing from the computer assisted audit tools, hence this application can be regarded as a solution to fill this gap.

This paper presents an application that melts these techniques down and provides a transparent report from discovered knowledge for auditors. Several countries have adopted quality audits in their higher education system. The process of quality audit in the education system focuses primarily on procedural issues rather than on the results or the efficiency of a quality system implementation. Internationalization is part of the quality culture of a higher education institution, as well. The institutions are getting increasingly motivated to participate in an internationalization audit, that's why this domain was selected as a use case of this application.

The aim of this paper is to show a semantic application using text mining which is to assist institutions with valuable feedback about their international activities and to improve the chance of their international accreditation. Section 2 presents the abovementioned semantic techniques (process ontology, text mining on this field, ontology matching). The process along this application works is showed in Section 3. The results of this implemented application are explained by the one of the Internationalization processes in the respect of Erasmus mobility in Section 4

2

Semantic theoretical background

All organizations represent their processes based on general and specific characteristics which are conditioned to locations, ranges or antecedents. The boundary conditions and restrictions turn up environmental makings maybe regulatory elements or best practices from the levels of business process maturity. Business process management (BPM) provides support for managing the processes of organizations and facilitating their adaptation to dynamic changing environment. BPM encompasses methods, techniques, and tools to design, enact, control, and analyze operational business processes involving humans, organizations, applications, documents, and other sources of information [START_REF] Van Der Aalst | Workflow Patterns[END_REF]. Modern BPM suites are evolving to automate the modeling, monitoring and redesign of complex processes, although there are still many open issues to be addressed. Conceptual model captures the semantics of a process through the use of a formal notation, but the descriptions resulting from conceptual model are intended to be used by humans. The semantics contained in these models are in a large extent implicit and cannot be processed. With the web-based semantic schema such as Web Ontology Language (OWL), the creation and the use of the conceptual models can be improved, furthermore the implicit semantics being contained in the models can be partly articulated and used for processing [START_REF] Hepp | The Semantic Web: Real-World Applications from Industry[END_REF] Ontologically represented process models allow querying on a relatively high level of abstraction.

The usage of Semantic Web technologies like reasoners, ontologies, and mediators promises business process management a completely new level of possibilities. This approach is known as semantic business process management (SBPM). [START_REF] Koschmider | Ontology based business process description[END_REF] When a new regulation is established the business process has to comply with this regulation. In SBPM the business processes as well as the new regulation are defined in a way that a machine is able to understand, therefore no manual work is needed to verify that the business processes comply with the new regulation.

Process ontologies

Process ontologies are created in order to describe the structure of a process, whereas organization related ontologies provide a description of artefacts or actors that are utilized or involved in the process. The domain ontologies provide additional information specific to an organization from a given domain.

Process ontologies have no precise definition in the academic literature. Some refer to process ontology as a conceptual description framework of processes [START_REF] Hepp | An Ontology Framework for Semantic Business Process Management[END_REF]. In this interpretation process ontologies are abstract and general. Contrary, task ontologies determine a smaller subset of the process space, the sequence of activities in a given process. In our approach the concept of process ontologies is used, where ontology holds the structural information of processes with multi-dimensional meta-information partly to ground the channeling of knowledge embedded in domain ontologies. We present an approach for representing business processes semantically, by translating them into process ontology that captures the implicit and explicit semantics of the process model. We have also implemented a translation tool to convert business process model to its OWL representation, serving as a basis for further analysis.

We elaborated a method for extracting a business process in the shape of a process ontology with using semantic text mining from documents. Two process ontologies are served as a basis for detecting deviations in business processes. Ontology learning and matching techniques were integrated into our application.

2.2

Ontology learning

The objective of ontology learning is to generate ontologies with using natural language processing and machine learning techniques. Text mining techniques like similarity measures, pattern recognitions etc. are used to extract terms and their relationships to build ontology [START_REF] Maedche | Ontology Learning Part Oneon Discovering Taxonomic Relations from the Web[END_REF].

Methontology is one of the most known methodologies for ontology construction, supplying a set of reference tasks necessaries to build an ontology. It is a general, domain independent methodology, which defines the main activities of the ontology construction process and specifies the steps for performing them. [START_REF] Corcho | Building Legal Ontologies with METHONTOLOGY and WebODE[END_REF] Some approaches construct domain ontologies that reflects the domain covered by the input texts, and not top level, highly abstract ontologies or lexicalized ontologies (WordNet). A couple of realization for excample: Text2Onto -Text2Onto [START_REF] Cimiano | Text2Onto -a Framework for Ontology Learning and Data-driven Change Discovery[END_REF] OntoLearn -TermExtractor, WCL System [START_REF] Velardi | A taxonomy learning method and its application to characterize a scientific web community[END_REF], and SPRAT -SPRAT [START_REF] Maynard | Sprat: a tool for automatic semantic pattern-based ontology population[END_REF]. The relevant techniques for automating, the conceptualization are:

1. Build glossary of terms (term extraction), 2. Build concept taxonomies, 3. Identify ad-hoc relations. Other techniques cover also other tasks for excample: Describe rules [START_REF] Buitelaar | Ontology learning from text: an overview[END_REF] Term extraction is usually supported by linguistic and statistical of technique used jointly. For building concept taxonomies structural and contextual of techniques are often used. For identify ad-hoc relations , pattern based techniques are often used. Relevant tools combine several techniques resulting a hybrid method.

Ontology matching

Alasoud et al. [START_REF] Alasoud | An Effective Ontology Matching Technique[END_REF] define ontology matching problem identifying semantic correspondences between the components of the entities of ontologies.

Element-level matching techniques focus on matching entities and its instances without any information about their relationships with other entities and instances. Structure-level matching techniques address to scrutinize not only matching entities but their relations with other entities and instances as well [START_REF] Otero-Cerdeira | Ontology matching: A literature review[END_REF].

To build our semantic audit application requires an ontology matching tool that fulfill the following criteria:

-It must be customized to adapt the changes of new or improved process models into the audit report. -It must be integrated with other components to ensure that ontology building and matching procedures can work together. -Technical report provided by this tool must be structured texts in order to process them automatically. -It must handle different languages of process ontologies (RDF, XML, OWL). Ontology Alignment Evolution Initiative contest inspires researchers to develop new ontology matching tools. LOGMap, Yam++ and Protégé 4 OWL Diff were investigated based on these criteria in [START_REF] Szabó | Future Development: Towards Semantic Compliance Checking[END_REF]. Though Protégé 4 OWL Diff is capable of just running structure-level investigation but it provides libraries to handle different ontology languages, provide open source codes and well-structured technical reports. This tool was used to develop this semantic audit application.

Semantic Audit Application

Auditors have to collect evidence that operations of companies comply with requirements articulated in guidelines, standards, policies etc. These evidences are settled in document or data provided by information systems. As we have seen in Section 1, CAATTs tools are usually not capable of processing documents semantically. The main functional requirements of this semantic audit application are the following ones. It must be capable of:

-Processing organizational documents in an automated manner -Focusing on semantic contents of these documents -Interpreting these contents in the respect of the requirements extracted from reference documents -Comparing semantic contents of organizational and reference documents -Presenting the result of this comparison into an interpretable and transparent report. The process of this semantic audit application is presented in Fig 1 .  The first phase is to create an Adonis process model from the standard regulation (1) and transform it into the Reference Process Ontology (RPO) (3) with using XSLT transformation (2) [START_REF] Ternai | Semi-automatic Methodology for Compliance Checking on Business Processes[END_REF].

ADONIS is a graph-structured Business Process Management language. Its main feature is the method independence. Our approach is principally transferable to other semi-formal modeling languages. The semantic annotation for specifying the semantics of the tasks and decisions in the process flow explicitly is important in our method.

For conceptualization, several parameters have to be set or defined when modeling a business process. Vertically, we can specify operational areas only, or process areas, process models, sub processes, activities, or even deeper; the algorithms. Horizontally, extra information can be modeled within the business process: organizational information can be specified in an organogram; the roles can be referred in the RACI (Responsible, Accountable, Consulted, Informed) matrix of the process model, the input and the output documents in the document model and the applied IT system elements can be added to the IT system model as well. In the second step (2), the mapping of the conceptual process models to process ontology concepts will be shown. The transformation procedure follows a meta-modeling approach. The links between model elements and ontology concepts have been established. The process ontology describes both semantics of the modeling language constructs as well as semantics of model instances.

In order to map the conceptual models to ontology concepts, the process models are exported in the structure of ADONIS XML format. The converter maps the Adonis Business Process Modeling elements to the appropriate Ontology elements in metalevel. The model transformation aims at preserving the semantics of the business model.

The general rule followed by us is to express each ADONIS model element as a class in the ontology and its corresponding attributes as attributes of the class. This conversion is performed with an XSLT script and results the Reference Process Ontology (RPO). … <Declaration> <Class IRI="#Actor"/> </Declaration> <Declaration> <Class IRI="#Process_step"/> </Declaration> <Declaration> <Class> <xsl:attribute name="IRI">#<xsl:value-of select="$baseClassName" /></xsl:attribute> </Class> </Declaration> <Declaration> <ObjectProperty IRI="#belongs_to"/> </Declaration> <Declaration> <ObjectProperty IRI="#followed_by"/> </Declaration> …

To represent the business model in the ontology, the representation of ADONIS model language constructs and the representation of ADONIS model elements have to differentiate. ADONIS model language constructs are created as classes and properties and the ADONIS model elements can be represented through the instantiation of these classes and properties in the ontology. The linkage of the ontology and the ADONIS model element instances are accomplished by the usage of properties.

Fig. 1. Reference process ontology

The second phase is to build the Organizational process ontology (OPO) with the help of the RPO from organizational documents within the process ontology building component [START_REF] Koschmider | Ontology based business process description[END_REF]. The first step of its algorithm is to identify process element of the RPO (like S tu d en t , Co or d in a t or as a specific R ol e) -excluding process stepsor discover new ones within a given document and add them to the OPO as subclasses of the appropriate super classes like R o l e, D oc um en t etc. New process elements are discovered with the help of semantic text mining. The algorithm focuses on finding patterns shaped into open queries. Relations are regarded as ordered pairs. The algorithm assumes that certain expressions can represent a given relation within the document e.g. produces_output(Process_step, Document) relation suggests that something must be happen with a document e.g. it is submitted or signed. That's why the algorithm wants to find x submit y pattern within the document, where y is a document. It seeks "submit"term and collects few words after that. It adds this expression as subclass of the D oc um ent class to the OPO.

The second step in the building of the OPO is to identify the process steps of RPO within the document and connect them to the nearest process elements already existed in the OPO. The algorithm seeks every terms of a given process step within each sentences of the document and counts the hits. If the number of the hits is greater than a given threshold, the identified process step will be added to the OPO as subclass of the Pr oc es s s t ep class and it will be connected to other process elements identified nearby (namely in a given radius of words) within the text.

Having created the OPO (5), its full or tailored version as a result of a DL Query will be compared to the appropriate version of the RPO within the ontology matching component. Its technical report is processed by a report generator to create a transparent report for auditors which contains information about the number of tasks, filtered roles, missing, unnecessary or common organizational process elements. Hence auditors can discover areas requiring deeper investigations in the next phase when leaders are interrogated by them.

Fig. 2. Processes of the Semantic Audit Application

This application is a Java application that uses the libraries of OWL API, DLQueryExample and the SVN Repository of Protégé 4 OWL Diff. The following section presents how this system works on the field of Internationalization of higher education institutions.

Its implementation on the Erasmus mobility field

An example run of this application will be showed in this section. It uses Student Application process as standard process from the Erasmus Mobility Handbook. Erasmus mobility calls represent the organizational documents. The following questions were investigated during an audit procedure conducted in the life of some Hungarian higher education institutions.

How effective are the current mechanisms? What kind of communication channels exist between the various levels managing internationalization activities? How effective are they? What are the missing functions of the internationalization units? Which units are less efficient? Why? [START_REF] Temesi | Nemzetköziesítés a magyar felsőoktatási intézményekben[END_REF] In the modeling phase reference process models have been formalized from Eras-mus+ Programme Guide 1 and process models were implemented by using BOC ADONIS modeling platform 2 . The reference business process model detailed with the above mentioned parameters can be seen in Figure 3. The Reference Process Ontology transformed from this model and an Erasmus call of a Hungarian higher education institution were used to present the applicability of this solution in the respect of the next audit questions. These questions aim at investigating the effectiveness of the current mechanisms.

Audit question 1: Are the same role responsible for performing this process?

The answer requires filtering the ontology by Roles. The report created from the technical report provided by the Protégé 4 OWL Diff ontology matching component presents that the University was mentioned as role in the organizational document instead of the Coordinator. In the Erasmus mobility call, it was mentioned that "Qualified applicants will be invited to take the entrance examination organized by the university". It reveals such problem that who is the responsible person for organizing this entrance examination. To answer it, the ontologies were filtered by the 'performed_by only (Student)' DL Query. The result is presented on Fig. 5.

Fig. 5. Report about not mentioned tasks

This report shows that to sign of support contract is not a task of a student or it is not mentioned in the organizational document. We found that the latter event happened.

These reports revealed that a role and a task were missing in this Erasmus mobility call, so this Student Application process do not comply with the requirement of the Erasmus mobility handbook. The process is not effective, because students do not know about their responsibility for singing the contract, so they will be informed in a latter phase of this process which makes this process more slow. The auditor has to investigate that the source of this problem is a document that does not reflect well the process or the process itself.

Conclusion and future work

Nowadays Campus Mundi projects are to improve higher education processes in Hungary. The audit guideline elaborated for investigating compliance checking of Internationalization activities wants to detect "how the current mechanisms are effective". Our semantic audit application can help to compare institutional processes with standard processes articulated in the Erasmus Mobility Handbook. The Student Application process was used to test this application. Erasmus mobility calls represent the organizational documents. This test was executed on ten different sources. 3 The first chart presents that the algorithm identified at least one roles within each organizational documents. These roles were mostly interpretable (like Student, Coordinator, and University etc.) except only in the 6 th case. We can state that the "by the" semantic rule being responsible for identifying rules can be applied, because its false discovery rate is low. The second chart shows that there is a notable differentiation between tasks performed by students within the institutions and according the handbook. It implies that our algorithm identifies these tasks not well, so we have to improve it. Or different institutions obligate students to perform such kind of tasks that are not mentioned in the handbook, maybe these tasks belong to another role. This is the problematic of segregation of duties that must be investigated by the auditors.

Fig. 6. Results of this application

This application can be used to process business regulations semantically instead of manually, that spares time for auditors. It provides a report that shows deviations within managing business, if they exist. Auditors can use this knowledge to seek information with more focus or ask managers relevant questions during the next phase of the audit procedure.

We can use more metrics to test the precision of the algorithm of this application. The organizational process ontology (OPO) stores several text parts used to identify the above-mentioned process elements. These text parts can be used to calculate hit rates like false or true positive/negative rates. Based on these information we can improve this algorithm. The complexity of process models and the granularity of organizational documents influence the scalability of this system. The ten above-mentioned materials were processed within similar time period, but they were not too large documents. Testing the scalability of this system is a future work.

Fig. 3 .

 3 Fig. 3. The Reference process model

Fig. 4 . 2 :

 42 Fig. 4. Report of the Role investigation

http://erasmus.yasar.edu.tr/student-mobility/outgoing-students/ http://www.ciim.ac.cy/outgoing-students https://www.international.tum.de/en/going-abroad/students/erasmus/...etc.

Acknowledgements

The authors wish to express their gratitude to Dr. András Gabor, associate professor of the Corvinus University of Budapest, for the great topic and the powerful help provided during the development process.

"This work was conducted using the Protégé resource, which is supported by grant GM10331601 from the National Institute of General Medical Sciences of the United States National Institutes of Health."


Ana Fernandes
email: anavilafernandes@gmail.com

Henrique Vicente
email: hvicente@uevora.pt

Margarida Figueiredo

Nuno Maia
email: nuno.maia@mundiservicos.pt

Goreti Marreiros
email: goreti@dei.isep.ipp.pt

Mariana Neves
email: jneves@di.uminho.pt

José Neves
email: maneves@deloitte.co.uk

A Case-base Approach to Workforces' Satisfaction Assessment

Keywords: Human Resources Management, Logic Programming, Case-Based Reasoning, Knowledge Representation and Reasoning, Decision Support Systems

It is well known that human resources play a valuable role in a sustainable organizational development. Indeed, this work will focus on the development of a decision support system to assess workers' satisfaction based on factors related to human resources management practices. The framework is built on top of a Logic Programming approach to Knowledge Representation and Reasoning, complemented with a Case Based approach to computing. The proposed solution is unique in itself, once it caters for the explicit treatment of incomplete, unknown, or even self-contradictory information, either in terms of a qualitative or quantitative setting. Furthermore, clustering methods based on similarity analysis among cases were used to distinguish and aggregate collections of historical data or knowledge in order to reduce the search space, therefore enhancing the cases retrieval and the overall computational process.

Introduction

In a global and competitive world either organization is under a constant state of worry and urgency, and to survive may need to adapt to new economic, organizational and technological sceneries. Undeniably, the organizations should create innovative strategies to promote their own competitive advantages. A company's staffs are a key asset and play an important role in order to undertake its objectives [START_REF] Elena | Human Resources Motivation -An Important Factor in the Development of Business Performance[END_REF][START_REF] An | Employee Satisfaction as an Important Tool in Human Resources Management[END_REF]. Definitely, a company's productively is toughly related to its people and their strategies or, in other words, workers' satisfaction stands for a significant instrument in human resources management, leading to [START_REF] Elena | Human Resources Motivation -An Important Factor in the Development of Business Performance[END_REF][START_REF] An | Employee Satisfaction as an Important Tool in Human Resources Management[END_REF]:  Enhanced quality of the offered products and services;  Positive attitude towards the company;  Better observance of deadlines;  Low personnel fluctuation;  Small absenteeism rates; and  Creativity and assuming of responsibilities.

The management of workers' satisfaction encompass factors like training (aiming the development of the workers' skills), and the creation of work environments that encourage the productivity, commitment and motivation. In this way, the organizations reveal major concerns in promoting practices which give some support to its employees, seeking the possible balance between professional and private lives [START_REF] Alfes | The link between perceived human resource management practices, engagement and employee behaviour: A moderated mediation model[END_REF][START_REF] Berman | Human Resource Management in Public Service: Paradoxes, Processes, and Problems[END_REF].

The present study addresses the theme of the Human Resources Management, in particular with regard to Workers' Satisfaction. However, the assessment of workers' satisfaction is a complex phenomenon that involves a large number of factors, some of which depend on the worker in itself, and even on the organisation [START_REF] Alfes | The link between perceived human resource management practices, engagement and employee behaviour: A moderated mediation model[END_REF][START_REF] Berman | Human Resource Management in Public Service: Paradoxes, Processes, and Problems[END_REF][START_REF] Petrescu | Human resource management practices and workers' job satisfaction[END_REF]. Because of this, it is difficult to assess the Workers' Satisfaction since it is necessary to consider different conditions with complex relations among them, where the available data may be incomplete/unknown (e.g., absence of answers to some questions presented in the questionnaire), or even contradictory (e.g., questions relating to the same issue with incongruous answers). In order to overcome these difficulties, the present work reports on the founding of a not common approach to Knowledge Representation and Reasoning [START_REF] Neves | A logic interpreter to handle time and negation in logic databases[END_REF], complemented with a Case Based attitude to computing [START_REF] Aamodt | Case-based reasoning: Foundational issues, methodological variations, and system approaches[END_REF][START_REF] Richter | Case-Based Reasoning: A Textbook[END_REF].

Undeniably, Case Based (CB) provides the ability to solve new problems by reusing knowledge acquired from past experiences [START_REF] Aamodt | Case-based reasoning: Foundational issues, methodological variations, and system approaches[END_REF][START_REF] Richter | Case-Based Reasoning: A Textbook[END_REF], i.e., CB is used especially when similar cases have similar terms and solutions, even when they have different backgrounds [START_REF] Carneiro | Using Case-Based Reasoning and Principled Negotiation to provide decision support for dispute resolution[END_REF]. Its use may be found in many different arenas, namely in Online Dispute Resolution [START_REF] Carneiro | Using Case-Based Reasoning and Principled Negotiation to provide decision support for dispute resolution[END_REF] or Medicine [START_REF] Guessoum | Respidiag: A Case-Based Reasoning System for the Diagnosis of Chronic Obstructive Pulmonary Disease[END_REF][START_REF] Quintas | A Case Based approach to assess Waiting Time Prediction at an Intensive Care Unity[END_REF].

This paper involves five sections. In the former one a brief introduction to the problem is made. Then the proposed approach to Knowledge Representation and a CB view to computing are introduced. In the fourth and fifth sections it is assumed a case study and presented an answer to the problem. Finally, in the last section the most relevant conclusions are described and possible directions for future work are outlined.

Background

Many approaches to Knowledge Representation and Reasoning have been proposed using the Logic Programming (LP) epitome, namely in the area of Model Theory [START_REF] Kakas | The role of abduction in logic programming[END_REF][START_REF] Pereira | Evolution prospection[END_REF] and Proof Theory [START_REF] Neves | A logic interpreter to handle time and negation in logic databases[END_REF], [START_REF] Neves | The halt condition in genetic programming[END_REF]. In the present work the Proof Theoretical approach in terms of an extension to the LP language is followed. An Extended Logic Program is a finite set of clauses, given in the form:

, , , , , , ? , , , , , , 0 
, where the first clause stand for predicate's closure, "," denotes "logical and", while "?" is a domain atom denoting falsity, the p i , q j , and p are classical ground literals, i.e., either positive atoms or atoms preceded by the classical negation sign  [START_REF] Neves | A logic interpreter to handle time and negation in logic databases[END_REF]. Indeed,  stands for a strong declaration that speaks for itself, and not denotes negation-byfailure, or in other words, a flop in proving a given statement, once it was not declared explicitly. Under this formalism, every program is associated with a set of abducibles [START_REF] Kakas | The role of abduction in logic programming[END_REF][START_REF] Pereira | Evolution prospection[END_REF], given here in the form of exceptions to the extensions of the predicates that make the program, i.e., clauses of the form:

, , 0 ,
that stand for data, information or knowledge that cannot be ruled out. On the other hand, clauses of the type: ? , , , , , , 0 also named invariants, allows one to set the context under which the universe of discourse has to be understood. The term scoring value stands for the relative weight of the extension of a specific predicate with respect to the extensions of peers ones that make the inclusive or global program.

Knowledge Representation and Reasoning -Quantitative Knowledge

On the one hand, the Quality-of-Information (QoI) of a logic program will be understood as a metric that will be given by a truth-value ranging between 0 and 1 [START_REF] Lucas | Quality checking of medical guidelines through logical abduction[END_REF][START_REF] Machado | Quality of service in healthcare units[END_REF]. Indeed, QoI i = 1 when the information is known (positive) or false (negative) and QoI i = 0 if the information is unknown. For situations where the extensions of the predicates that make the program also include abducible sets, its terms (or clauses) present a QoI i ϵ ]0, 1[, which will be given by:

1 (1)
if the abducible set for predicates i and j satisfy the invariant:

? ; , ;
where ";" denotes " logical or" and "Card" stands for set cardinality, being i  j and i, j  1 (a pictorial view of this process is given in Fig. 1(a), as a pie chart).

On the other hand, the clauses cardinality (K) will be given by , if there is no constraint on the possible combinations among the abducible clauses, being the QoI acknowledged as:

1 , , 1 (2)
where is a card-combination subset, with Card elements. A pictorial view of this process is given in Fig. 1(b), as a pie chart.

However, a term's QoI also depends on their attribute's QoI. In order to evaluate this metric let us look to the Fig. 2, where the segment with limits 0 and 1 stands for every attribute domain, i.e., all the attributes range in the interval [0, 1]. [A, B] denotes the scope where the unknown attributes values for a given predicate may occur (Fig. 2). Therefore, the QoI of each attribute's clause is calculated using:

where ||A-B|| stands for the modulus of the arithmetic difference between A and B. Thus, in Fig. 3 is showed the QoI's values for the abducible set for predicate i . Under this setting, a new metric has to be considered, which will be denoted as DoC (Degree-of-Confidence), that stands for one's confidence that the argument values or attributes of the terms that make the extension of a given predicate, having into consideration their domains, are in a given interval [START_REF] Fernandes | Artificial Neural Networks in Diabetes Control[END_REF]. The DoC is figured using √1 ∆ , where ∆ stands for the argument interval length, which was set to the interval [0, 1] (Fig. 4).

Thus, the universe of discourse is engendered according to the information presented in the extensions of such predicates, according to productions of the type:

, , , , (4)
where , m and l stand, respectively, for set union, the cardinality of the extension of predicate i and the number of attributes of each clause [START_REF] Fernandes | Artificial Neural Networks in Diabetes Control[END_REF]. The subscripts of QoIs and DoCs, x 1 , …, x l , stand for the attributes values ranges.

n i i i QoI p QoI Card K n       1 1 n i i i QoI p QoI Card K n       1 1 2 n i i i QoI p QoI K n       1 1 2 n i i i QoI p QoI K n       1 1 2 n i i i QoI p QoI K n       1 1 2 n i i i QoI p QoI K n       1 1 n i i i QoI p QoI K n      1 1 n i i i QoI p QoI K n      (b)
Fig. 4. Evaluation of the Degree of Confidence.

Knowledge Representation and Reasoning -Qualitative Knowledge

In present study both qualitative and quantitative data/knowledge are present. Aiming at the quantification of the qualitative part and in order to make easy the understanding of the process, it was decided to put it in a graphical form. Taking as an example a set of n issues regarding a particular subject (where the possible alternatives are none, low, moderate, high and very high), a unitary area circle split into n slices is itemized (Fig. 5). The marks in the axis correspond to each of the possible choices. If the answer to issue 1 is high the area correspondent is π

A Case Based Methodology for Problem Solving

The CB methodology for problem solving stands for an act of finding and justifying a solution to a given problem based on the consideration of similar past ones, by reprocessing and/or adapting their data/knowledge [START_REF] Aamodt | Case-based reasoning: Foundational issues, methodological variations, and system approaches[END_REF][START_REF] Richter | Case-Based Reasoning: A Textbook[END_REF]. In CB -the cases -are stored in a Case Base, and those cases that are similar (or close) to a new one are used in the problem solving process. The typical CB cycle presents the mechanism that should be followed, where the former stage entails an initial description of the problem. The new case is defined and it is used to retrieve one or more cases from the Case Base.

Despite promising results, the current CB systems are neither complete nor adaptable enough for all domains. In some cases, the user cannot choose the similarity(ies) method(s) and is required to follow the system defined one(s), even if they do not meet their needs. Moreover, in real problems, the access to all necessary information is not always possible, since existent CB systems have limitations related to the capability of dealing, explicitly, with unknown, incomplete, and even self-contradictory information. To make a change, a different CB cycle was induced (Fig. 6). It takes into consideration the case's QoI and DoC metrics. It also contemplates a cases optimization process present in the Case Base, whenever they do not comply with the terms under which a given problem as to be addressed (e.g., the expected DoC on a prediction was not attained). This process that uses either Artificial Neural Networks [START_REF] Vicente | Prediction of the Quality of Public Water Supply using Artificial Neural Networks[END_REF][START_REF] Haykin | Neural Networks and Learning Machines[END_REF], Particle Swarm Optimization [START_REF] Mendes | Watch thy neighbor or how the swarm can learn from its environment[END_REF] or Genetic Algorithms [START_REF] Neves | The halt condition in genetic programming[END_REF], just to name a few, generates a set of new cases which must be in conformity with the invariant: ,

i.e., it denotes that the intersection of the attribute's values ranges for cases'set that make the Case Base or their optimized counterparts (B i ) (being n its cardinality), and the ones that were object of a process of optimization (E i ), cannot be empty (Fig. 6).

Methods

Aiming to develop a predictive model to assess workers' satisfaction a questionnaire was designed specifically for this study and applied to a cohort of 236 employees of training companies. This section describes briefly the data collection tool and how the information is processed.

Questionnaire

The questions included in the questionnaire aimed to evaluate the degree of worker's satisfaction. The respondents participated in the study voluntarily and the questionnaires were anonymous to ensure the confidentiality of information provided. The questions included in the questionnaire were organized into five sections, where the former one includes the general questions related with workers' age, gender, length of service and functional area. The second one comprises questions related with the workers' opinions about the received training (Table Training Related Factors in Fig. 7), while the third section is about occupational medicine service (Table Occupational Medicine Related Factors in Fig. 7). Finally, the fourth and fifth sections comprise issues related with the workers' opinions about the resources (Table Resources Related Factors in Fig. 7) and organizational climate (Table Organizational Climate Related Factors in Fig. 7), respectively.

Workforces' Satisfaction Knowledge Base

It is now possible to build up a knowledge database given in terms of the extensions of the relations (or tables) depicted in Fig. 7, which stand for a situation where one has to manage information aiming to estimate the workers' satisfaction. Thus, the General Information, Training, Occupational Medicine, Resources, and Organizational Climate Related Factors tables are populated with the responses to the issues presented in the questionnaire, where some incomplete, default and/or unknown data is present. For instance, in the former case the Functional Area is unknown (depicted by the symbol ), while the opinion about the Applicability of the Training Received in the Daily Work is not conclusive (High/Moderate). The Length of Service column of the Satisfaction table is populated with 0 (zero), 1 (one), 2 (two) or 3 (three) that stands, respectively, for a length of service lesser than a year, comprised in the range [1, 3[, ranging between [3, 5[, and with more than 5 years. The Functional Area column, in turns, is filled with 0 (zero), 1 (one), 2 (two), 3 (three) or 4 (four) that denotes human resources, quality, marketing, financial and commercial issues, respectively. In the Gender column 0 (zero) and 1 (one) stand, respectively, for female and male.

In order to quantify the information present in the Training, Occupational Medicine, Resources, and Organizational Climate Related Factors tables the procedures already described above were followed. Applying the algorithm presented in [START_REF] Fernandes | Artificial Neural Networks in Diabetes Control[END_REF] to the table or relation's fields that make the knowledge base for workers' satisfaction assessment (Fig. 7), and looking to the DoCs values obtained as described before, it is possible to set the arguments of the predicate satisfaction (satis) referred to below, whose extensions denote the objective function regarding the problem under analyze:

: , , , , , , , 0, 1
where 0 (zero) and 1 (one) denote, respectively, the truth values false and true. The algorithm presented in [START_REF] Fernandes | Artificial Neural Networks in Diabetes Control[END_REF] encompasses different phases. In the former one the clauses or terms that make extension of the predicate under study are established. In the subsequent stage the arguments of each clause are set as continuous intervals. In a third step the boundaries of the attributes intervals are set in the interval [0, 1] according to a normalization process given by the expression / , where the Y s stand for themselves. Finally, the DoC is evaluated as described in section 2.1.

Exemplifying with a term (worker) that presents the feature vector (Age = 37, G en-

der = 0, L ength o f S ervice = , F unctional A rea = 2, O ccupational M edicine R elated F actors = [0.45, 0.55],
T raining R elated F actors = [0.65, 0.8], R esources R elated F actors = 0.67, O rganizational C limate R elated F actors = [0.58, 0.75]), one may have: approach and the typical CB one relies on the fact that not only all the cases have their arguments set in the interval [0, 1], but it also caters for the handling of incomplete, unknown, or even self-contradictory data or knowledge. Thus, the classic CB cycle was changed (Fig. 6), being the Case Base given in terms of the following pattern:

, When confronted with a new case, the system is able to retrieve all cases that meet such a structure and optimize such a population, having in consideration that the cases retrieved from the Case-base must satisfy the invariant present in equation ( 5), in order to ensure that the intersection of the attributes range in the cases that make the Case Base repository or their optimized counterparts, and the equals in the new case cannot be empty. Having this in mind, the algorithm described above is applied to a new case, that in this study presents the feature vector (Age = , G ender = 1, L ength o f S ervice = 2, F unc- tional A rea = 1, O ccupational M edicine R elated F actors = 0.7, T raining R elated F actors = [0.5, 0.7], R e- sources R elated F actors = [0.67, 0.75], O rganizational C limate R elated F actors = 0.75). Then, the computational process may be continued, with the outcome:

1,0 , 1, 1 , 1, 1 , 1, 1 , 1, 1 , 1, 0.98 , 1, 0.99 , 1, 1 1 0.87
Now, the new case may be portrayed on the Cartesian plane in terms of its QoI and DoC, and by using clustering methods [START_REF] Figueiredo | A data mining approach to study the impact of the methodology followed in chemistry lab classes on the weight attributed by the students to the lab work on learning and motivation[END_REF] it is feasible to identify the cluster(s) that intermingle with the new one (epitomized as a square in Fig. 8). The new case is compared with every retrieved case from the cluster using a similarity function sim, given in terms of the average of the modulus of the arithmetic difference between the arguments of each case of the selected cluster and those of the new case. Thus, one may have:

1,1 , 1, 1 , 1, 1 , 1, 1 , 1, 1 , 1, 1 , 1,

New Case

Assuming that every attribute has equal weight, for the sake of presentation, the dis(imilarity) between case and the , i.e., case 1 , may be computed as follows: 0 1 0.98 1 0.99 1 1 0.95 8 0.14

Thus, the sim(ilarity) for is set as 1 -0.14 = 0.86. Regarding QoI the procedure is similar, returning 1. Thus, one may have: , 1 0.86 0.86 a value that may now be object of a reading by part of experts. These procedures should be applied to the remaining cases of the retrieved cluster(s) in order to obtain the most similar ones, which may stand for the possible solutions to the problem. However, there is yet a problem, i.e., when meeting the situation of multiple experts and multiple assessment methods, how to integrate them?

In order to answer to this question, let us consider that one has p (p ≥ 2) experts and the making e i /domain i , where e i stands for expert i , and domain i denotes the metrics or methods used by expert i to read the study outcome, i.e., the pair (QoI i , DoC i ), here given in terms of , , where "j" stands for the case j in the cluster(s) of retrieved cases. domain i may be, for example, a set (e.g., {low, moderate, high, very high}), an interval (e.g., [80,90]), a number (e.g., 80), or an unknown value (e.g., ).

A pictorial view of the process is given by Fig. 9 (that sets the relation experts/readings), and Fig. 10 (that sets the overall assessment). 10. The overall assessment that is given by the areas`sum. e 1 /{low, moderate, high, very high} e 2 /[0, 100]  e p / [20, 40] In order to evaluate the performance of the proposed model the dataset was divided in exclusive subsets through the ten-folds cross validation [START_REF] Haykin | Neural Networks and Learning Machines[END_REF]. In the implementation of the respective dividing procedures, ten executions were performed for each one of them. Table 1 presents the coincidence matrix of the CB model, where the values presented denote the average of 20 (twenty) experiments. A perusal to Table 1 shows that the model accuracy was 92.4% (i.e., 218 instances correctly classified in 236). Thus, the predictions made by the CB model are satisfactory, attaining accuracies higher than 90%. The sensitivity and specificity of the model were 95.0% and 87.0%, while Positive and Negative Predictive Values were 93.8% and 89.3%, respectively. The ROC curve is shown in Fig. 11. The area under ROC curve (0.91) denotes that the model exhibits a good performance in the assessment of workers' satisfaction.

Conclusion

The workers' satisfaction assessment is not only an inestimable practice, but something of utmost importance in the organization efficiency context. To meet this challenge it is necessary that the organizations optimize their efficiency in order to achieve excellence practices. However, it is difficult to assess the workers' satisfaction since it is necessary to consider different variables and/or conditions, with complex relations entwined them, where the data may be incomplete, contradictory, and even unknown. In order to overcome these difficulties this work presents a Decision Support System to estimate the workers' satisfaction. The methodology followed was centred on a formal framework based on LP for knowledge representation and reasoning, complemented with a CB approach to computing. It may set the basis for an overall approach to such systems in this arena. Indeed, it has also the potential to be disseminated across other prospective areas, therefore validating an universal attitude. Indeed, under this line of thinking the cases' retrieval and optimization phases were heightened when compared with existing tactics or methods. Additionally, under this approach the users may define the cases weights attributes on-the-fly, letting them to choose the appropriate strategies to address the problem (i.e., it gives the user the possibility to narrow the search space for similar cases at runtime). Finally, it was presented a solution to the question: when meeting the situation of multiple experts and multiple assessment methods, how to integrate them? This is quite important, for example, in-group(s) construction and in the assessment of their outcomes.

Fig. 1 .

 1 Fig. 1. QoI's values for the abducible set for predicate i with (a) and without (b) constraints on the possible combinations among the abducible clauses.

Fig. 2 .

 2 Fig. 2. Setting the QoIs of each attribute's clause.

Fig. 3 .

 3 Fig. 3. QoI's values for the abducible set for predicate i with (a) and without (b) constraints on the possible combinations among the abducible clauses. ∑⁄ denotes the QoI's average of the attributes of each clause (or term) that sets the extension of the predicate under analysis. n and p i stand for, respectively, for the attribute's cardinality and the relative weight of attribute p i with respect to its peers ( ∑ 1 .

.n

  , i.e., 0.75/n (Fig.5(a)). Assuming that in the issue 2 are chosen the alternatives high and very high, the correspondent area ranges between π . n, π n , i.e., 0.75/n, 1/n (Fig.5(b)). Finally, in issue n if no alternative is ticked, all the hypotheses should be considered and the area varies in the interval 0, π n , i.e., 0 , 1/n (Fig.5(c)). The total area is the sum of the partial ones (Fig.5(d)).

Fig. 5 .

 5 Fig. 5. A view of the qualitative data/information/knowledge processing.

Fig. 6 .

 6 Fig. 6. The updated view of the CB cycle.

Fig. 7 .

 7 Fig. 7. A fragment of the knowledge base for workers' satisfaction evaluation.

Fig. 8 .

 8 Fig. 8. A case's set divided into clusters. 0.5 1 QoI

Fig. 9 .

 9 Fig. 9. The relation experts/readings.

Fig.

  Fig.10. The overall assessment that is given by the areas`sum.

Fig. 11 .

 11 Fig. 11. The ROC curve regarding the proposed model.

Table 1 .

 1 The coincidence matrix for CB model.

	Target	Predictive True (1) False (0)
	True (1)	151	8
	False (0)	10	67

QoICard  (a) (b)

Acknowledgments. This work has been supported by COMPETE: POCI-01-0145-FEDER-007043 and FCT -Fundação para a Ciência e Tecnologia within the Project Scope: UID/CEC/00319/2013.

Begin DoCs evaluation

The predicate's extension that sets the Universe-of-Discourse for the case term under observation is fixed , , The attribute's boundaries are set to the interval 0, 1 , according to a normalization process that uses the expression / , , ,

, ,

` 1 0, 1 0, 1

A Case Based approach to Computing

The framework presented previously shows how the information comes together and.

In this section, a soft computing approach was set to model the universe of discourse, where the computational part is based on a CB approach to computing. Contrasting with other problem solving tools (e.g., those that use Decision Trees or Artificial Neural Networks), relatively little work is done offline [START_REF] Carneiro | Using Case-Based Reasoning and Principled Negotiation to provide decision support for dispute resolution[END_REF]. Undeniably, in almost all the situations, the work is performed at query time. The main difference between this new