Rita Zougheib

Jocelyn Habib

Fawzi Khattar

Elias Abboud

Houssam Kanso

Reine Abou Sleiman

Rafik Abdallah

Youssef Fawaz

Elie Abdel Massih

Ralph Abou Zeid

Ahmad Khalil

CaSPI Context-aware Semantic reasoning for Privacy risk Inference

I owe my deepest gratitude to Remie Sarkis for sharing the ups and downs of this journey with me, encouraging me to work toward my dreams, picking me up when I struggled, and sharing my happiest moments.

I have to acknowledge the huge

and confident acknowledge this help with gratitude." -Alfred North Whitehead Foremost, I would like to express my deepest gratitude to my advisors Pr. Richard Chbeir and Dr. Philippe Arnould, and to my collaborators Dr. Mahmoud Barhamgi and Pr. Djamal Benslimane. I want to thank Richard for believing in me, helping me make the most of my abilities, and insisting on elevating my skills and overall approach towards research. His guidance, unwavering support, bright ideas, and immense knowledge made this work possible. My sincere heartfelt appreciation also goes to Philippe. He made things simple, easy, and comforting. This journey would not have been that enjoyable without him. He always motivated me and gave me great advice and constructive comments. My greatest gratitude also goes to Mahmoud for his valuable guidance, profound belief in my abilities, trust, and continuous encouragement during the completion of my Doctorate. My sincere thanks also go to Djamal for his assistance at every stage of my research project and his insightful comments and suggestions. It is a pleasure to have known them, and I look forward to possibly working with them again in the future. I would also like to express my sincere gratitude to Pr. Esma Aimeur and Pr. Allel Hadjali for the time and effort they devoted to the examination of my dissertation.

I also thank them for their valuable and helpful comments, suggestions, and feedback. I am also grateful to the rest of my thesis committee Pr. Djamal Benslimane, Dr. Mahmoud Barhamgi and Pr. Bechara Al Bouna for their presence, valuable questions, insightful comments, and encouragement. I am highly thankful to Bechara for his valuable help to get this opportunity and his encouragements to pursue my career in research.

I am thankful for being part of the LIUPPA laboratory. I specifically appreciate the seminars and scientific gatherings organized by its administration. I owe my gratitude to the "Communauté d'Agglomération du Pays Basque".

Nothing would have been possible without its financial support and interest in promoting science.

I would also like to thank all the technical and administrative staff of the "IUT de Bayonne et du Pays Basque" for the warm and convivial atmosphere and their sympathy. A special thanks to Pr. Philippe ANIORTE for his support and positive vibes. I acknowledge the moral and emotional support provided by Sabri Allani, Elio Mansour, Khouloud Salameh, Nathalie Charbel, Lara Kallab, Wissam Bejjani,

Résumé

Ces dernières années, les technologies de détection, de communication et de gestion de données ont connu de progrès rapides, ouvrant la voie à la croissance phénoménale des environnements connectés intelligents (bâtiments, villes intelligentes). Ces environnements fournissent actuellement des applications intéressantes et utiles qui aident les utilisateurs dans leurs tâches quotidiennes (augmenter le confort, réduire la consommation d'énergie). Cependant, de telles applications nécessitent de collecter, échanger, stocker et traiter une grande quantité de données à granularité fine qui sont souvent sensibles pour leurs utilisateurs (localisation, consommation d'énergie), d'autant plus que leur analyse permet aux consommateurs de données de révéler des informations sensibles (état de santé, préférences des utilisateurs).

Par conséquent, la participation des utilisateurs dans la gestion de leur vie privée fait l'objet d'une grande attention. Néanmoins, diverses améliorations sont encore nécessaires. Par exemple, comment sensibiliser les utilisateurs des risques pour la vie privée liés au partage de leurs données et/ou imposés par leurs environnements.

De même, comment permettre aux utilisateurs d'évaluer leur situation et de prendre des décisions optimales concernant l'utilité des données et le respect de la vie privée en conséquence.

Dans cette thèse, nous nous concentrons sur six défis principaux: (i) représenter des contextes diversifiés de l'utilisateur avec une haute puissance d'expressivité sémantique ; (ii) effectuer un raisonnement holistique (toutes données incluses) et contextuel sur les risques en matières de vie privée ; (iii) parvenir à une gestion de vie privée centrée sur l'utilisateur ; (iv) prendre des décisions contextuelles optimales liées à la protection de la vie privée ; (v) gérer la dépendance des données inter-contextuelles ; et (vi) fournir une solution évolutive et efficace afin d'assister l'utilisateur dans diverses situations.

Pour ce faire, nous présentons d'abord un modèle de données basé sur une ontologie capable de représenter divers contextes utilisateur avec une couverture d'informations de haut niveau. Ensuite, nous introduisons une approche de raisonnement sémantique qui fournit un aperçu dynamique/contextuel des risques en matière de vie privée, adapté à l'expertise de l'utilisateur. Ensuite, pour permettre une gestion contextuelle optimale des compromis entre utilité des données et protection de la vie privée, nous proposons une approche multi-objectifs centrée sur l'utilisateur qui fournit dynamiquement les meilleures stratégies de protection de données à mettre en oeuvre en fonction des situations et préférences des utilisateurs.

Enfin, nous proposons une nouvelle solution de descente de gradient stochastique pour assurer une transition intélligente du niveau de protection des données. Cette solution offre ainsi une couche supplémentaire de protection contre les attaques par inférence de données.

Introduction

Dans ce chapitre, nous introduisons les facteurs technologiques qui ont contribué à la prolifération des environnements connectés pendant nos jours. Ensuite, nous nous concentrons sur la vie privée des utilisateurs dans le contexte de ces environnements (menaces et défis relatifs à la vie privée, lois et standards mondiales de vie privée). Par la suite, nous présentons le contexte et les objectifs de cette thèse.

Nous étudions un scénario qui illustre la motivation de ce travail et les défis émergents. Nous examinons les approches existantes dans la littérature sur la protection contextuelle de la vie privée dans les environnements intelligents. Ensuite, nous présentons notre framework proposé pour la gestion contextuelle de la vie privée dans les environnements connectés (CaPMan), dans lequel chaque module répond à un ensemble de besoins et de défis:

• Premier Module: Gestion de l'information. Ce module est responsable de la gestion des informations contextuelles (acquisition et modélisation des informations) et des préférences de l'utilisateur. Nous nous focalisons dans cette thèse sur la modélisation du contexte et nous proposons un modèle ontologique, notée uCSN, permettant de représenter d'une manière expressive différentes situations de l'utilisateur.

• Deuxième Module: Inférence de risques liés à la vie privée. Ce module comprend un raisonneur de risque, noté CaSPI, en charge de détecter d'une manière dynamique les risques impliqués pour l'utilisateur en fonction de l'évolution de sa situation.

• Troisième Module: Gestion de la vie privée. Ce module est chargé d'assister l'utilisateur dans la gestion de sa vie privée et la protection de ses données avant qu'elles ne soient communiquées aux consommateurs de données. Pour ce faire, ce module comprend un gestionnaire de risque, noté δ-Risk, responsable d'analyser les risques détectés et de fournir à l'utilisateur des stratégies de protection de vie privée optimisées à appliquer en fonction de sa situation et préférences. Pour la protection des données, nous nous concentrons dans cette thèse sur les transitions de protection et nous proposons une nouvelle approche de descente de gradient stochastique, notée P-SGD, qui permet de surmonter les vulnérabilités aux attaques par inférence de données.

Modélisation du contexte dans des environnements connectés

Dans ce chapitre, nous décrivons un modèle de données basé sur une ontologie.

Nous présentons une étude comparative des travaux existants sur la modélisation de l'utilisateur (profile, activité), de l'environnement et du contexte (utilisateur, environnement et d'autres dimensions). Ensuite, nous introduisons notre ontologie pour la modélisation du contexte utilisateur dans les réseaux de capteurs (uCSN), dans laquelle nous enrichissons la représentation du contexte pour prendre en compte divers types de : (i) informations utilisateur/environnement (informations scalaires, multimédias) ; (ii) sources de données (capteur, document) ; (iii) incertitudes (incertitudes liées à l'utilisateur, à l'environnement) ; et (iv) environnements (environnements connectés/non connectés, environnements avec des systèmes et appareils statiques/mobiles). Pour ce faire, nous définissons de nouveaux concepts et propriétés, et nous importons d'autres à partir des ontologies bien connues, à savoir DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], SOSA/SSN [2] et W3C Uncertainty Ontology [3], sans compromettre la possibilité de réutilisation du modèle de données dans différents domaines d'application. Enfin, nous évaluons la performance, la clarté, la cohérence et la précision de l'ontologie proposée.

Chapitre 3 Inférence de risques liés à la vie privée

Dans ce chapitre, nous décrivons le raisonneur de risque que l'on utilise pour déduire les risques en matière de vie privée impliqués dans le contexte de l'utilisateur.

Nous passons en revue les travaux existants sur l'inférence des risques avant de détailler l'approche proposée (CaSPI [4]) qui exerce un raisonnement sémantique et contextuel pour l'inférence dynamique des risques. Nous relevons les défis liés à (i) l'augmentation de l'expressivité dans les définitions des risques ; (ii) la mise en oeuvre d'un raisonnement holistique prenant en compte différents types de combinaison données/informations contextuelles ; (iii) faire face à la dynamique et à la dépendance contextuelle des risques liés à la vie privée ; (iv) gérer et s'adapter à l'expertise des utilisateurs ; et (v) assurer l'évolutivité et l'efficacité de la solution.

Nous validons notre proposition en développant un prototype et nous illustrons son fonctionnement en back-end et front-end. Enfin, nous évaluons ses performances en considérant différents scénarios.

Chapter 1

Introduction "He's not our hero. He's a silent guardian, a watchful protector.

A dark knight." -Jonathan Nolan, The Dark Knight

Connected Environments

Recent years have witnessed great strides in the fields of Ubiquitous Computing (e.g., Internet of Things), Big Data, and Machine Learning that have led to the rapid growth of smart connected environments. These environments are defined as infrastructures that host Cyber-Physical Systems (CPS), such as sensor networks, interconnected using various communication technologies (e.g., Bluetooth, 6LoWPAN).

Connected systems are capable of collecting valuable data that can be later mined and processed to provide advanced services for both environments and users. Current CPS-based applications are impacting numerous application domains including smart healthcare (e.g. patient and elderly monitoring), smart buildings/homes (e.g., increasing occupants' comfort, optimizing energy consumption), smart cities (e.g., traffic management, safety and disaster prevention, air quality monitoring), and so forth. The successful proliferation of connected environments has been driven by various technological factors. From the data sensing perspective, recent advances in Sensing Technologies have enabled the development of low-cost, low-power, multifunctional sensor nodes [START_REF] Akyildiz | Wireless sensor networks: A survey[END_REF], such as cameras, microphones, GPS, environmental sensors (e.g., sensors to measure temperature, humidity), and medical sensors (e.g., sensors to measure heart-rate, blood pressure). These sensors can be embedded on various devices (e.g., mobile phones, smartwatches) or/and deployed in different environments (e.g., cities, buildings). The advanced capabilities of the sensing objects have allowed the collection and transmission of numerous heterogeneous data about users and environments (i.e., data with different types and formats). From the data mining and processing perspective, recent advances in Information and Communication Technologies (ICT), Big Data, and Data Mining techniques have made it easier to deal with challenges related to managing big data volumes, heterogeneous right to be left alone" [START_REF] Warren | Right to privacy[END_REF]. Then, in the 1960s, it was the rise of electronic data processing that brought into being the notion of information privacy (or data privacy).

Westin [START_REF] Westin | Privacy and freedom[END_REF] defined privacy as "the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others", which mainly emphasized the control of the data subjects over their data.

Following that, Ziegeldorf et al. [START_REF] Ziegeldorf | Privacy in the internet of things: Threats and challenges[END_REF] argued in the 2010s that Westin's definition was too general for the IoT area, and consequently defined IoT privacy as the threefold guarantee including "(i) awareness of privacy risks imposed by smart things and services surrounding the data subject; (ii) individual control over the collection and processing of personal information by the surrounding smart things; and (iii) awareness and control of subsequent use and dissemination of personal information by those entities to any entity outside the subjects personal control sphere". After reviewing existing privacy definitions, the scope of this work is best summarized by the privacy perspective of Ziegeldorf [START_REF] Ziegeldorf | Privacy in the internet of things: Threats and challenges[END_REF], which addresses the self-determined management of personal information in the IoT era. This perspective is also compliant with the privacy needs outlined in current privacy laws and standards.

In the following sub-sections, we present the definition of personal information.

Then, we outline the most recent threats and challenges to user privacy in connected environments. After that, we provide an overview of the current data protection laws from around the world, followed by the recently released privacy and data protection standards.

Personal Information

The General Data Protection Regulation (GDPR) [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF] defined personal information (or personal data) as "any information relating to an identified or identifiable natural person (data subject)". The National Institute of Standards and Technology [START_REF] Mccallister | Guide to protecting the confidentiality of personally identifiable information (PII)[END_REF] defined personal information as "any information about an individual maintained by an agency, including [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF] any information that can be used to distinguish or trace an individual's identity [...]; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information". The California Consumer Privacy Act (CCPA) [13] defined personal information as "any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household". In light of this, we distinguish between identifiable and sensitive information by introducing two categories of personal information:

• Personally Identifiable Information (PII): Any information that can be used to distinguish or trace the data subject's identity. For example, the data subject's name, home address, email, phone number, biometrics, pictures, social security number, or domain-related ID like patient ID in e-health.

• Sensitive Personal Information (SPI): Any other sensitive information that alone does not identify the data subject but it is linked or linkable to him/her. SPI communicates information that is private or likely to harm the data subject if misused or sold to third parties. For example, age, gender, marital status, political/religion beliefs, locations, activities, habits, interests, or other domainspecific information like medical, financial, or social information.

Privacy Threats & Challenges

Advances in sensing technologies and data mining techniques pose several threats and challenges to the privacy of users in connected environments [START_REF] Ziegeldorf | Privacy in the internet of things: Threats and challenges[END_REF], [START_REF] Cha | Privacy enhancing technologies in the internet of things: Perspectives and challenges[END_REF], [START_REF] Ogonji | A survey on privacy and security of internet of things[END_REF].

Recent threats vary from identification, localization and tracking, and profiling to privacy-violating interaction and presentation, device life-cycle transitions, inventory attack, and linkage. We discuss in the following each of the seven threats, before concluding with the currently faced challenges.

(1) Identification: consists of linking the identifier (e.g., name, pseudonym) associated with collected sensor data to a specific user. This raises serious privacy concerns for the user since collected data is often privacy-sensitive (e.g., location of individuals, patients' vital signs), implying that when processed, it can reveal a plethora of SPI about the user. As well, the identification threat can also enable other threats like profiling and tracking of users.

(2) Localization and tracking: the user's location can be monitored and tracked in time and space through different means, e.g., GPS sensors deployed on user devices (e.g., mobile phone, smart watch), internet traffic, camera recordings. Besides the uneasy feeling of being watched, mining and processing the locations and trajectories of the user can lead to deduce sensitive information about her, such as her performed/daily activities, habits, and health conditions, therefore subjecting her to several privacy breaches.

(3) Profiling: refers to the threat of collecting and correlating profiles of data in order to analyze or predict aspects concerning the user, including user's economic situation, health, personal preferences, interests, reliability, behaviour, and movements. Profiling methods are mostly used in e-commerce for personalization (e.g., sending targeted advertisements or newsletters). Consequently, many privacy violations occur when user profiles are collected, processed, correlated, or even sold to third parties interested in exploiting it (e.g., marketing companies).

(4) Privacy-violating interaction and presentation: sensor nodes and multi-sensor devices may collect and transmit people's private information through public means in order to present the information (e.g. speakers, video screens) when people interact with the devices (e.g. moving, speaking, touching). This could therefore entail the leakage of private/sensitive information from what is presented to an unwanted audience.

(5) Device life-cycle transitions: during their life-cycle, devices (i.e., multi-sensor devices like mobile phones, tablets) can be used, then sold or destroyed. Even though it must destroy all data, some devices often store large amounts of historical data over their life-time that could be sensitive (e.g., personal photos, videos). This entails privacy issues for the user if data was not deleted prior to changing device ownership. [START_REF] Bou-Chaaya | P-SGD: A stochastic gradient descent solution for privacy-preserving during protection transitions[END_REF] Inventory attack: denotes the threat of targeting an object (i.e., sensor or device) by sending various query requests to it and analyzing the related responses. An adversary may use this type of attacks to compile an inventory list of other devices and/or appliances in the environment (e.g., medical devices or smart alarm systems at the user's home). This list can be privacy-sensitive for the user as it could be used for targeted break-ins at private homes/offices, or even may lead to reveal SPI about the user such as her health conditions (it is enough to infer the use of medical devices at home). [START_REF] Akyildiz | Wireless sensor networks: A survey[END_REF] Linkage: user data could be shared between service providers, or even sold to interested third parties, with or without her knowledge. This raises serious privacy concerns for the user as she may not be aware of how her data is being used, by whom, with what data/information it is linked, or what SPI may be disclosed when combining and processing data bits and pieces. Privacy remains therefore a major challenge to address in the field of connected environments. This was also supported by the European Union (EU) commission, which identified security and privacy as major IoT research challenges [START_REF] Sundmaeker | Vision and challenges for realising the internet of things[END_REF]. In particular, the currently faced challenges for IoT privacy are more linked to the goals of reducing the aforementioned threats. These include: how to enable users (data subjects) to understand their privacy situations? how to empower them to control their data sharing and protection appropriately in a way to meet their privacy requirements and business interests? and how to ensure data privacy protection throughout the entire data life-cycle phases, i.e. during data collection, transmission, aggregation, storage, mining, and processing phases?

Worldwide Privacy Legislation

Privacy is considered as a fundamental human right in the United Nations Universal Declaration of Human Rights and Article 8 of the European Convention on Human Rights of 1950 [START_REF] Pearson | Taking account of privacy when designing cloud computing services[END_REF]. This right became explicit by the emergence of numerous privacy laws and regulations around the world. Nowadays, there is no general information privacy legislation that covers all areas [START_REF] Levin | Privacy law in the united states, the eu and canada: The allure of the middle ground[END_REF]. Figure 1.2 1 shows the distribution of existing privacy laws among states, countries, and regions. We present in the following a brief overview of these laws.

Currently, more than 130 countries enacted national/regional privacy laws, which define different technical and organizational requirements for the storage and processing of personal data in information systems [START_REF] Greenleaf | Global data privacy laws 2019: 132 national laws & many bills[END_REF]. As a successor of the Directive 95/46/EC, the European Union adopted the European General Data Protection Regulation (GDPR) [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF], which came into force in 2018. Its key changes in terms of the principles, compared with the Directive 95/46/EC, include six aspects: (1) consent, the data subject's consent should be graspable, distinguishable and easy to be withdrawn; (2) breach notification, the GDPR makes the breach notification mandatory.

The notification should be sent within 72 hours after being aware of the breach; (3) right to access, the GDPR grants data subjects the right to be informed about data processing and to receive a copy of the handled personal data; (4) right to be forgotten, the data is required to be erased when the personal data are no longer necessary in relation to the purposes or the consent is withdrawn; (5) right to data portability, the data subject has the right to receive his uploaded data in a machine-readable format and transmit it to other data controllers; and (6) privacy by design, the GDPR integrates the privacy by design as a legal requirement, where the controller must implement appropriate technical and organizational measures in order to meet the GDPR requirements and protect the data subjects' rights (the Privacy by Design standard is further detailed in the following section). For the United States (US), some states have its own laws. California adopts the California Consumer Privacy Act (CCPA) and California Online Privacy Protection Act (CalOPPA) laws. The CCPA law came into force in 2020, and became the first GDPR-like law in the country. It boasts three guiding principles: transparency, accountability, and control. It grants data subject rights to access, portability and deletion. The CalOPPA law is the first to require websites to post privacy policies detailing data collection and use, however, it is only applicable to businesses and online operations with data subjects in California. Nevada adopts the Senate Bill 220 law, which became effective in 2019, and seems very similar to the CCPA but has some significant differences, such as only giving data subjects the right to opt out of having their data sold. There are several other US states in the process of passing comprehensive data protection laws (e.g., Consumer Data Protection Act for Virginia, which will be effective in 2023). Other countries have also adopted their own privacy laws, such as PIPEDA for Canada, LGPD for Brazil, PDP for Argentina, POPI for South Africa, DPA for Senegal, Personal Data Protection Bill 2019 for India, Cyber Security Law for China, Data Privacy Act of 2012 for Philippines, and Privacy Act 1988 for Australia.

International Privacy Standards

The laws principles are usually described with very general and broad terms [START_REF] D'acquisto | Privacy by design in big data: An overview of privacy enhancing technologies in the era of big data analytics[END_REF] that makes it hard for companies and organizations to properly integrate them in the system design due to the variety and diversity of existing information technologies. Consequently, several privacy standards were introduced to bridge the gap between legal frameworks and technologies by providing a set of guidelines that translate legal principles into more engineer-friendly principles in order to facilitate the design of privacy capabilities in systems and applications. Figure 1.3 illustrates an overview of the existing privacy standards with their mappings. We provide next a brief description of each standard and highlight the respective principles. Instead of reactively addressing privacy breaches after-the-fact, PbD approaches privacy proactively and tends to prevent privacy-invasive events before they happen by making privacy the default setting [START_REF] Cavoukian | Start with privacy by design in all big data applications[END_REF]. In 2010, PbD has been unanimously adopted as an international privacy standard in the 32nd International Conference of Data Protection and Privacy [START_REF] Cavoukian | Privacy by design [leading edge[END_REF]. Nowadays, PbD is incorporated as a legal requirement in the General Data Protection Regulation (GDPR) [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF], and globally recognized as an ISO/AWI standard (ISO/AWI 31700 -under development) [START_REF]ISO/AWI 31700 Consumer protection -Privacy by design for consumer goods and services[END_REF]. PbD identifies seven foundational principles that should be followed when developing privacy sensitive solutions:

(1) Proactive not reactive; Preventative not remedial. The solution should include proactive measures to anticipate and prevent privacy violations, i.e., to prevent privacy risks from occurring.

(2) Privacy as the Default Setting. The solution must deliver the maximum degree of privacy and data protection by default, without requiring user intervention.

(3) Privacy Embedded into Design. Privacy must be incorporated as an essential component of the solution's core functionality.

(4) Full Functionality: Positive-Sum, not Zero-Sum. The solution seeks to accommodate all interests and objectives in a positive-sum (i.e., win-win manner).

(5) End-to-End Security. The solution should ensure data protection during the entire life-cycle of data. [START_REF] Bou-Chaaya | P-SGD: A stochastic gradient descent solution for privacy-preserving during protection transitions[END_REF] Visibility and Transparency -Keep it Open. The solution must provide accountability, openness and compliance, which, in turn, improve user satisfaction and trust. [START_REF] Akyildiz | Wireless sensor networks: A survey[END_REF] Respect for User Privacy -Keep it User-Centric. The solution should empower data subjects (users) to play an active role in the control and management of their data. This can be achieved by ensuring that appropriate notice is given, and by supporting other user-friendly options, such as considering user preferences, delivering human-machine interfaces adaptable to users, and enabling users to make informed privacy decisions.

The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) drew up a new reference standard in 2019, ISO/ IEC 27701:2019 [START_REF]for privacy information management -Requirements and guidelines[END_REF] for privacy information management. The design goal is to provide guidance for establishing, maintaining, and continually improving a Privacy Information Management System (PIMS). This standard can be used by: (i) data controllers, entities (e.g., person, organization) that, alone or jointly with others, determines the purposes and means of the processing of personal data [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF]; and data processors, entities (e.g., person, organization) that processes personal data on behalf of the controller [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF]. It has been developed as an extension to ISO/IEC 27001 and ISO/IEC 27002, which respectively provide guidelines for Information Security Management System (ISMS) implementation, and information security controls.

The ISO/IEC 27701 also includes mapping to other existing privacy standards and legal frameworks, such as ISO/IEC 29100, ISO/IEC 27018, ISO/IEC 29151, Privacy by Design, and the GDPR regulation. The ISO/IEC 29100:2011 [START_REF]2011 Information technology -Security techniques -Privacy framework[END_REF] provides a privacy framework that considers the following privacy safeguarding requirements to protect personal information: (1) consent and choice, (2) purpose legitimacy and specification, (3) Collection limitation, (4) Data minimization, (5) use, retention and disclosure limitation, [START_REF] Bou-Chaaya | P-SGD: A stochastic gradient descent solution for privacy-preserving during protection transitions[END_REF] accuracy and quality, [START_REF] Akyildiz | Wireless sensor networks: A survey[END_REF] openness, transparency and notice, [START_REF] Warren | Right to privacy[END_REF] individual participation and access, [START_REF] Westin | Privacy and freedom[END_REF] accountability, [START_REF] Ziegeldorf | Privacy in the internet of things: Threats and challenges[END_REF] information security, and [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF] privacy compliance. The ISO/IEC 27018:2019 and ISO/IEC 29151:2017 standards are both based on ISO/IEC 27002, where the first provides guidance for the protection of personal information in public clouds acting as processors, and the second defines guidelines for personally identifiable information protection.

Therefore, the ISO/IEC 27701 is perceived as a global standard, as stressed by the National Commission on Informatics and Liberty 2 (CNIL-France), that provides several measures/requirements for the processing of personal data/information [START_REF]for privacy information management -Requirements and guidelines[END_REF]. These measures can be classified into controller-specific and processor-specific measures. Controller-specific measures include: (i) privacy notices, controllers should provide privacy policies to data subjects containing specific information regarding the collection, use, and processing of their data; (ii) processor agreement requirements, including data protection, breach notifications, and limiting data processing to the agreed purposes; (iii) data subjects' rights, including rights to access, correct, and erase their data, and to restrict the processing of their data among others, (iv) privacy by design and by default, controllers must adopt measures that operationalize the principles of privacy by design and by default (e.g., minimization, data de-identification and deletion, data retention). Processor-specific measures include: (1) processing limitations to the purpose specified in the contract; (2) data subjects' rights; (3) transfers and disclosures, processors must inform data subjects in advance of data transfers between jurisdictions or any intended changes thereof; and (4) subcontractors, requires processors to only engage subcontractors for processing data subjects' data pursuant to the terms of the contract.

Thesis Context

Sharing data in exchange for goods and services presents an opportunity for users to improve their quality of life, however, it also exposes them to many privacy risks.

In fact, processing and analyzing collected sensor data (e.g., location of individuals, patient's vital signs), which are spatio-temporal in nature [START_REF] George | Spatio-temporal sensor graphs (stsg): A data model for the discovery of spatio-temporal patterns[END_REF], can lead to disclosing a wide variety of privacy-sensitive information about users [START_REF] Lisovich | Inferring personal information from demand-response systems[END_REF], [START_REF] Barhamgi | User-centric privacy engineering for the internet of things[END_REF], such as health conditions, performed or daily activities, habits, preferences, and so on. This disclosure may be intentional if users are aware of it and have entered into agreements with relevant service providers. However, it can be harmful if the data/information 2 Source: https://www.cnil.fr/en/iso-27701-international-standard-addressing-persona l-data-protection of users is misused by providers, sold to interested third parties without user consent, or stolen by cybercriminals as providers are often victims of cyber-attacks that lead to data breaches.

Consequently, involving users in the control and protection of their privacy is currently receiving extensive attention from both legal and technical perspectives [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF], [13], [START_REF] Cavoukian | Start with privacy by design in all big data applications[END_REF], [START_REF]for privacy information management -Requirements and guidelines[END_REF], [START_REF]2011 Information technology -Security techniques -Privacy framework[END_REF]. Nonetheless, existing legal frameworks for data protection (e.g., GDPR [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF]) might not necessarily deter data consumers from abusing, intentionally or unintentionally, the data of users. The Facebook-Cambridge Analytica [START_REF]Data in the post-gdpr world[END_REF] and Exactis [START_REF]Marketing firm exactis leaks 340 million files containing private data[END_REF] scandals are only few examples of a long series of data breach scandals that happened despite the existence of appropriate data protection laws. In addition, privacy laws vary among countries, some providing more protection than others (e.g., GDPR [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF] for the European Union, CCPA [13] for the state of California). This increases the difficulty and complexity of managing and preserving the privacy of users, especially when users, service providers, and third parties are located in different countries governed by different data protection laws. Therefore, all these constraints emphasize the need for user-centric technical solutions that maintain the same level of data privacy protection in all countries.

Current approaches of user-centric privacy preserving [START_REF] Castelluccia | Enhancing transparency and consent in the iot[END_REF]- [START_REF] Chadwick | A privacy preserving authorisation system for the cloud[END_REF] mainly rely on preference specification and policy enforcement, where users specify their privacy preferences and accept policies that enforce these preferences. However, they all share two main limitations:

(1) lack of user awareness. The user may not be completely aware of the direct and indirect privacy risks involved with the exchange of her data with providers to correctly specify her preferences in the first place. She may simply not know what sensitive information might be revealed from her data when data pieces are analyzed in isolation or combined with each other or/and with other side information acquired from external data sources (e.g., social networks).

(2) lack of context-based privacy decision making. The data sharing or protection decisions are often made/accepted by the user in a static way. This means that they remain unchanged regardless of context changes. However, the sensitivity of data may vary from a context to another [START_REF] Barhamgi | User-centric privacy engineering for the internet of things[END_REF], [START_REF] Varadharajan | Data security and privacy in the internet of things (iot) environment[END_REF], i.e., new privacy risks may emerge as others may lose their significance. This makes static decisions overprotective in some contexts, causing unnecessary loss of data quality which may downgrade the accuracy of associated services; or under-protective, leading consequently to privacy violations. Therefore, the user must be able to make dynamic adjustments to her privacy decisions to cope with the dynamicity of her context.

Thesis Objectives

The objectives of this thesis are to design suitable solutions that overcome the aforementioned two limitations, and to provide a complete context-aware privacy framework that meets the guidelines of current privacy standards (i.e., Privacy by Design [START_REF] Cavoukian | Start with privacy by design in all big data applications[END_REF] and ISO/IEC 27701 [START_REF]for privacy information management -Requirements and guidelines[END_REF]). Specifically, the framework needs to cope with:

• Raising user awareness of the privacy risks associated with their data sharing and/or imposed by their surrounding environments, by providing them with a dynamic/contextual overview of risks tailored to their level of expertise.

• Assisting users in optimizing their data utility-privacy decisions according to their situations, needs and preferences, by providing them with the best data protection strategies that could be implemented in their situations.

• Ensuring appropriate protection of the data collected, according to user decisions, before being transmitted to data consumers.

Motivating Scenario

To illustrate the motivations behind the objectives of this thesis, we investigate a real-life scenario of a user, Alice, who shares data with service providers. This scenario highlights some of the privacy risks that can arise from sharing Alice's data, and underlines the need for dynamic/contextual adaptations of her data protection decisions. Figure 1.4 illustrates the proposed scenario. • Electricity provider: Alice shares the energy consumption readings of her home through deployed smart energy meters. In exchange, Alice receives personalized recommendations to reduce her energy consumption and bills.

• Healthcare provider: Alice shares her location data through a mobile application to benefit from an emergency care system that offers healthcare services, such as the smart ambulance service that she would use in case of respiratory distress.

The trust relationship between Alice and the providers is not static. It varies due to many factors such as the sensitivity of her situation, or the third parties with whom the provider communicates her data. Assume that both providers have signed contracts with marketing companies and government agencies interested in exploiting the data of their customers (e.g., Alice) for different purposes. For example, marketing companies could be interested in exploiting the energy consumption data to analyze the lifestyle of customers and send them targeted advertisements (e.g., advertisements about appliances that customers own or do not own). Government agencies could be interested in identifying customers involved in wrongdoing (e.g., fraud, crimes). Even though Alice is notified, through agreed policies, of consumers who have access to her data, she may not necessarily be aware of the privacy risks involved with this sharing. These risks can be of two types: mono-source and multi-source risks. Mono-source risks arise from sharing data with a single data consumer. For instance, analyzing the energy consumption data (see the signature in Figure 1.5) can entail various mono-source risks for Alice, such as the risks of disclosing her presence/absence hours at home, waking/sleeping cycles, some of her habits and activities (e.g., cooking, TV watching, sports activity using a treadmill) [START_REF] Pillitteri | Guidelines for smart grid cybersecurity[END_REF]. Moreover, existing works (e.g., [START_REF] Lisovich | Inferring personal information from demand-response systems[END_REF]) show that consumption signatures can be mined to identify the use of specific appliances (e.g., medical devices). This would reveal the health condition of Alice if the use of her NIV machine was identified. The analysis of location data can also entail significant mono-source risks for Alice such as the risks of disclosing her habits, behaviors and health conditions by analyzing her trajectory patterns (cf. Figure 1.5). For example, if Alice is located twice per week in a pulmonary rehabilitation center for COPD patients, then she is very likely to be a COPD patient. Multi-source risks are more complex risks that arise when customer data are communicated between consumers (cf. Figure 1.4). For example, assume that Alice has unlawfully certified that she is living alone to be eligible for a welfare program when submitting her application. A marketing company having access to both location and consumption data can infer this fraud (it is enough to identify the use of particular devices, such as microwave and TV, while Alice is outside her home).

All of this highlights the need to inform Alice, in an appropriate manner, of the risks that she accepts to take, with or without her consent, when sharing her data with consumers. This will then enable her to make informed and meaningful privacy decisions. To achieve this, the following needs should be considered: Need 1. Build a global view of the user's situation (e.g., Alice) by gathering context information about the user and her surrounding environment. Need 2. Infer the privacy risks involved in the current user context, and maintain continuous monitoring of the risk evolution to cope with context changes. Need 3. Provide a comprehensible overview of risks, which means an overview adapted to the level of expertise of the user. This enables all users to understand the implicit, direct and indirect implications of sharing their data with consumers.

After alerting Alice of the risks involved in her situation, she may want to adapt her data privacy measures to reduce the risks. Nonetheless, such an adaptation can be difficult for her as it also affects the data utility, and thus the quality of associated services, which might be important to her as well. For instance, assume that the health services are critical for Alice; stop sharing her location data can lead to eliminate the risks of disclosing her habits, behaviors and health conditions, but also to lose the health services received in exchange. This raises consequently the following need: Need 4. Assist the user in optimizing data utility-privacy decisions in a way to satisfy her privacy requirements and preferences while also maximizing the quality of the main services received in exchange for her data.

However, continuously balancing data privacy can lead sometimes to large gaps in precision between sequential data values, which mainly occurs when sharply decreasing the level of data protection. Such a happening improves the capabilities of an adversary to estimate, with high confidence, the real values of protected data, entailing temporal privacy leakages for the user (e.g., Alice). Accordingly, the following need emerges when considering data utility-privacy optimizations: Need 5. Measure data dependencies during the protection transition phases and study their impact on data protection in order to avoid large gaps in precision, and consequently ensure full protection of the user's privacy.

Scientific Challenges

In order to address the aforementioned needs, one needs to: (1) model an expressive representation of the user's situation; (2) reason on the situational information to infer the risks involved; (3) guide the user to optimize her decisions; and

(4) study inter-context dependencies and adapt the levels of data protection accordingly. However, when considering all of the above, several challenges emerge: Challenge 1. Coping with the information heterogeneity and semantics: Collected context information can be heterogeneous in types, formats, granularity, origins, and uncertainties. In addition, information pieces are often linked to each others through various (complex) relationships, and can have different characteristics and constraints. The framework must therefore be able to handle information heterogeneity and semantics in order to expressively represent various contexts. This challenge will be further detailed in Chapter 2.

Challenge 2. Performing a holistic (all-data-inclusive) privacy risk reasoning:

As discussed above, collected data pieces can be analyzed in isolation, or combined with each other (e.g., electricity consumption and location data) and/or with other side information acquired from external data sources (e.g., profiles on social networks, public databases). This improves the inference capability of data consumers, thereby increasing the sphere of possible privacy risks. Therefore, the proposed risk inference solution should take into account the different data/information shared by the user or available to data consumers from external data sources, and explores how they combine with each other.

Challenge 3. Coping with the dynamicity and context-dependency of privacy risks:

The sensitivity of data may depend on the context [START_REF] Barhamgi | User-centric privacy engineering for the internet of things[END_REF], [START_REF] Varadharajan | Data security and privacy in the internet of things (iot) environment[END_REF]. For example, the sensitivity of Alice's location when she is in the pulmonary rehabilitation center is higher than when she is at home, as in this case location data could be exploited to infer the disease of Alice. That is, as context changes, new privacy risks may emerge, while others may disappear or lose in significance. Therefore, the proposed inference solution should keep track of context changes, analyze their impacts on privacy risks, and maintain an updated risk overview. Challenge 4. Achieving user-centric privacy management: Individuals may have different levels of expertise to properly express their needs or preferences, and to interact with the system (e.g., understand risks, make privacy decisions). The proposed solution must therefore be user-friendly, allowing the guided assistance to be tailored to the user's expertise in order to maintain a good quality of humanmachine interactions.

Challenge 5. Making optimal context-based privacy decisions:

The user-privacy decisions depend on her situation (e.g., risks inferred) and preferences. Therefore, the proposed solution should always be able to provide the user with optimal and adaptive protection strategies to cope with the dynamicity of her context and preferences.

Challenge 6. Coping with the inter-context data dependency:

The protection assigned to data prior to its release may increase or decrease depending on the contextbased user decisions. However, significantly lowering the level of data protection makes subsequent data more precise. Due to data correlations, this may entail the revealing of the real value of previous data that needed more protection, resulting in temporal privacy leakage for the user. The proposed solution should therefore be able to trace data dependencies during contextual transitions, and to appropriately tune the decrease of the data protection level when needed in order to ensure full protection of the user's privacy.

Challenge 7. Delivering scalability and efficiency:

The solution must be scalable, i.e. handles reasoning over an increasing number of context information, including sensed information (e.g., Location), and risks. It should also be fast to support the user in different contexts, especially since user decisions must sometimes be made in real-time. Finally, it should maintain low computational and storage complexity, which makes it operational on various types of devices, including those with limited resources.

Several other challenges may also arise when considering context-aware privacypreserving and user-centric privacy, however, we focus in our research work on tackling the aforementioned needs and challenges.

Related Work

Several frameworks were proposed in the literature to address the challenges of context-aware privacy-preserving and secure context awareness in the fields of pervasive IoT environments (or connected environments). Neisse et al. [START_REF] Neisse | Dynamic context-aware scalable and trust-based iot security, privacy framework[END_REF] introduced a context-aware security and privacy framework for smart city applications. This approach defines the context by relying on four parameters: time, location, network, and speed. It provides a context-based security policy management to control access to the data of users based on a set of Event-Condition-Action (ECA) rules. It also provides a privacy-preserving mechanism based on pseudonymization and delayed message delivery. Hence, the access to data could be accepted, denied, modified (using pseudonymization), or delayed. Matos et al. [START_REF] De Matos | Providing contextaware security for iot environments through context sharing feature[END_REF] presented an overview of their context-aware security framework, that aims to provide authentication, authorization, access control, and privacy-preserving in IoT environments. However, the authors only provided a brief description of their framework modules without explaining how privacy is approached in their solution. Sylla et al. presented in [40] a global vision of their context-aware security and privacy as a service (CASPaaS) framework for IoT environments. They briefly discussed the role of each module.

The privacy module will be able to continuously analyze the user context and inform her accordingly about the privacy risks involved. However, they have not yet explored any of the framework modules. Other works were proposed for specific IoT domains. Gheisari et al. [START_REF] Gheisari | A contextaware privacy-preserving method for iot-based smart city using software defined networking[END_REF] proposed a context-aware privacy-preserving framework for smart cities using Software Defined Networking. The authors showed that the privacy is preserved by splitting sensitive data and sending split parts via a secure route. The decision made by the SDN controller is based on data sensitivity (that vary depending on the context) and routes credits. Alagar et al. [START_REF] Alagar | Context-based security and privacy for healthcare iot[END_REF] introduced a Context-Sensitive Role-based Access Control (CRBAC) architecture for IoT-based healthcare applications. The approach defines two types of access control: open access, for authenticated clients/medical devices; and closed Access, for non-member clients/devices. CRBAC is user-centric, where the user privacy requirements are included as context-sensitive rules to be enforced whenever patient health information are shared by things.

Comparative Study

In order to compare the referenced works, we define two levels of comparison criteria: the first level consists of the main foundational principles and privacy measures stated by the Privacy-by-Design and ISO/IEC 27701 standards; the secondlevel comprises specific criteria associated to the needs and challenges defined in Section 1.3.2. The goal here is to assess how well existing works comply with privacy standards and the aforementioned contextual privacy management challenges.

We therefore define the following criteria:

• Criterion 1. Proactive & Preventative: includes proactive measures to prevent privacy violations, i.e., to prevent privacy risks from materializing.

• Criterion 2. Privacy as the Default Setting: protects the user's privacy by default without requiring user intervention.

• Criterion 3. Full Functionality -Positive-Sum: seeks to achieve all objectives in a positive-sum (i.e., win-win manner). We focus here on:

-Data Utility-Privacy: optimizes the data utility-privacy trade-off to meet the privacy needs while maximizing the quality of services received in return.

-Scalability: handles increasing (and decreasing) workloads.

• Criterion 4. Data Privacy Protection: three sub-criteria are considered:

-End-to-End Protection: ensures data protection during the entire data life-cycle.

-Context-aware Protection: provides context-dependent data protection.

-Real-time Protection: offers real-time data protection.

• Criterion 5. Visibility, Transparency, and Openness: ensures that the data/service exchanges are established in accordance with the stated promises and objectives.

• Criterion 6. User-centric Privacy: ensures an appropriate involvement of the user in the protection of her privacy (i.e., empowers user-friendly options). We consider four sub-criteria to cover user-centric dimensions:

-User Awareness: raises user awareness about the privacy risks involved in the data sharing and the protection measures that could be taken accordingly through understandable privacy notices.

-User-centric Management: empowers the user to take control and manage her privacy protection.

-User-friendly Guidance: adapts the level of user assistance to her expertise.

-User Preferences: considers the preferences and interests of the user.

Criteria

Neisse et al. [START_REF] Neisse | Dynamic context-aware scalable and trust-based iot security, privacy framework[END_REF] Matos et al.

[

Sylla et al.

[

Gheisari et al.

[

Alagar et al.

[42]

CaPMan [5] Proactive Discussion. Table 1.1 shows that none of the aforementioned works fully complies with current privacy standards and needs. Most of these works, i.e. [START_REF] Neisse | Dynamic context-aware scalable and trust-based iot security, privacy framework[END_REF]- [START_REF] Sylla | Towards a context-aware security and privacy as a service in the internet of things[END_REF], [START_REF] Alagar | Context-based security and privacy for healthcare iot[END_REF], have only presented an overview of their proposed frameworks and briefly explained how they work. The frameworks in [START_REF] Neisse | Dynamic context-aware scalable and trust-based iot security, privacy framework[END_REF], [START_REF] Sylla | Towards a context-aware security and privacy as a service in the internet of things[END_REF], [START_REF] Alagar | Context-based security and privacy for healthcare iot[END_REF] have partially addressed the trade-off between data utility and privacy by integrating access control mechanisms. These mechanisms manage only the access rights of providers to user data, making the data either accessible in a fine-grained version or not accessible at all. This affects the availability of the services for the user when needed, especially if the full quality of service is not required (e.g., the user may wish to share her presence in the city rather than his exact location with the provider in order to get a list of restaurants present in this city rather than just those nearby). In addition, only works in [START_REF] Sylla | Towards a context-aware security and privacy as a service in the internet of things[END_REF] and [START_REF] Alagar | Context-based security and privacy for healthcare iot[END_REF] have been designed with the objective of involving the user in the management of her privacy and considering her preferences when establishing the context-dependent policies. However, they did not consider the fact that individuals may have different levels of expertise, which could impact the quality of individual-system interactions. Finally, some of these works (i.e., [START_REF] Gheisari | A contextaware privacy-preserving method for iot-based smart city using software defined networking[END_REF], [START_REF] Alagar | Context-based security and privacy for healthcare iot[END_REF]) lack re-usability as they were designed to cope with the challenges of domain-specific applications. Consequently, we detail in the following section our proposed generic and re-usable framework [5], which fully meets the aforementioned criteria.

Proposal: CaPMan Framework

We present here an overview of our proposal for Context-aware Privacy Management in connected environments, denoted CaPMan. The framework addresses the needs and challenges mentioned in Section 1.3.2. Figure 1.6 presents a detailed view of the framework modules and describes the different user-system interactions. The aim of CaPMan is to introduce a user-centric reasoning system capable of keeping the user up-to-date on her evolving privacy situation and assisting her in the management of her privacy protection. In the following, we start by describing the system operation, and then we detail the framework modules. The CaPMan system can be embedded on user devices (e.g., computer, mobile phone, tablet) and has two operational modes: passive and active. The passive mode enables the system to be a notifier and a recommender system, where its role consists of: (i) alerting the user about the direct and indirect privacy risks involved in the sharing of her data; and (ii) recommending data protection strategies to negotiate with relevant data consumers, that lead to meet the user needs and preferences, and to maximize the quality of services received in return. The active mode expands the operations of the passive mode and adds the ability to control and protect user data, based on her decisions, before it is communicated to related data consumers. We consider in our study that all data consumers are not trusted by the user (i.e., service providers and third parties). This is due to the fact that user's data could be misused by consumers, sold to interested third parties without the user consent, or stolen by cybercriminals as data consumers are often victims of cyber-attacks that lead to data breaches. In the active mode, the system is integrated as a middleware between data sources (e.g., sensors, devices) and data consumers. We detail in what follows the system operations and user-system interactions for both modes.

Passive mode. The user specifies her inputs: the list of sensed data that is currently shared with data consumers (e.g., location), and the list of preferences (e.g., privacy requirements, important services). The user preferences are detailed in Chapters 3 and 4. The system, on its side, collects further background data/information describing the user and her surrounding physical environment from other resources (e.g., Web resources). The system models the acquired data/information pieces and the relationships that exist between them to build the overview of the user's situation, and launches the risk reasoner to infer the privacy risks involved in the relevant context. Once the risk inference is completed, the risk manager identifies all possible optimal data protection strategies according to her situation and preferences. Finally, the system provides the user with a risk overview tailored to her expertise, and the list of strategies on which the user can rely when negotiating with data consumers.

The levels of user expertise are defined in Chapter 3.

Active mode. Takes into account all passive interactions and operations, and provides additional capabilities for the user to manage her privacy and protect her data. To achieve this, the system has the right to access and control the data values during the collection phase. It therefore operates in this mode as follows. If no risk is inferred, the system continues to generate data values for consumers as received (i.e., without applying additional protection). Otherwise, it alerts the user about the risks she accepts to take, and recommends a list of best protection strategies that could be adopted in this situation. The goal of the strategies here is to improve the user decision making regarding what appropriate amount of protection to associate to the data before communicating it to consumers. Therefore, the system waits for the user to select the strategy to implement and, meanwhile, stops communicating any data to consumers. Upon the user's choice of strategy, the system protects the pending data values and releases a protected version of them to consumers. The system continues to apply the same protection strategy to the received data values until a new context emerges, where the entire reasoning process is relaunched to consider the changes in the user's situation and their impact on the risk overview and strategies.

The CaPMan system has two types of execution for both passive and active modes depending on user needs: (i) continuous computing, and (ii) on-demand computing, which consists of on-time and scheduled computing. When considering continuous computing, the CaPMan system operates once per context to infer the privacy risks involved and identify the best data protection strategies to be implemented. At this point, when a context change occurs, the system computes the similarity between the current and historical contexts (stored in the user's private storage environment). If a full similarity is detected, the user is given the option of re-applying the actions of the previous similar context (i.e., re-applying the same protection strategy) or launching the global process. This contributes to reducing the computational cost of the system.

In the case of on-demand computing, the system operates only when requested by the user, thereby reducing the use of computational resources. At this stage, if the active mode is enabled, the system continues to protect user's data using the same strategy selected until the system is re-launched. The on-demand computing is not recommended if the user has frequent changes of situation in order to cope with the context-dependency of risks and strategies.

For the default storage management, the system stores locally the context characterizing the present situation of the user only, as well as the associated risks and strategies. This makes the system low-complex in storage, increasing its re-usability on a variety of devices, including those with limited storage resources (cf. Challenge 7). Historical contexts with their associated risks, strategies, and user decisions can be stored in an external storage environment that is private to the user (i.e., the communications between the system and storage environment are secured by the use of appropriate data security mechanisms). Historical information can be used by the system to continuously improve/adjust the default parameters based on user interactions. This will be further detailed in Chapter 4.

Framework Modules

As shown in Figure 1.6, CaPMan is a modular framework comprised of three modules: information management module, privacy risk inference module, and privacy management module. These modules are detailed in what follows.

Information Management

Inferring context-aware risks requires first to build up a global view of the user's situation (cf. Need 1). Achieving this requires collecting context information describing the user and her surrounding physical environment. This module is consequently responsible for managing context information (i.e., capturing and modeling formation acquired and the relationships that exit among them, which helps in better understanding the user situation. We explored in this thesis the context modeling component, where we proposed a generic and modular ontology for user-context modeling in connected environments, denoted uCSN. The proposal was motivated by the fact that semantic data models allow representation of heterogeneous information with a high expressive power, and maintain flexible data structures which make them able to cope with the dynamicity of the environment. Hence, uCSN introduces a rich vocabulary to represent general information about the user profile, her activity, and the surrounding environment (including smart environment aspects and the mobility of its components). uCSN can be easily aligned with other ontologies, through its pluggable layer, to cover domain-specific knowledge of the user (e.g., medical knowledge) or/and the environment (e.g., knowledge dedicated to smart homes, hospitals, or cities). We further discuss our proposal in Chapter 2. This module is responsible for detecting the risks involved in the user context.

Privacy Risk Inference

To achieve this, the module includes two components. First, the privacy rules component, which handles the definition/import of privacy rules that specify the risks to be detected by the system. The rules are defined according to the syntax proposed in Chapter 3, and they are used as a reference schema for the reasoning process.

This schema is regularly updated by the privacy community that regroups experts belonging to different application domains. This helps in improving the coverage of potential information combinations that entail domain-specific risks, which consequently improve the quality of the risk inference process. The rule updates are imported by the system when relaunching the risk reasoner. It is important to state that the accuracy of the risk inference process depends on the quality of the defined rules. We assume in this study that the privacy rules defined by experts are pre-validated (this validation will be further explored in future work This module is responsible for assisting the user in the management of her privacy by: (i) assessing and minimizing the risks inferred based on the privacy requirements and interests of the user; (ii) delivering optimized and meaningful strategies; and (iii) protecting sensor data streams according to the context-based protection strategy selected by the user. In order to do so, the module consists of three components. First, the risk manager component, in charge of managing user risks and identifying the best protection strategies to be suggested to the user. Computed strategies are optimal in that they seek to closely satisfy user requirements and preferences while maximizing data utility and minimizing the cost of protection. The risk manager continuously adjusts the strategies provided to cope with the dynamic nature of the user context and preferences. In fact, the user might change progressively her preferences due to the sensitivity of the risks entailed, or the sensitivity of the situation (e.g., private meeting, located in a hospital). The privacy risk management proposal is detailed in Chapter 4, and published [5] Second, the protection functions component, which includes the list of available protection functions (e.g., random-noise function, generalization function) that the risk manager and data protection components can rely on during their computing processes. Finally, the data protection component, responsible for: (1) selecting the most appropriate protection functions, in terms of compatibility and computational cost, to be executed on sensor data streams to achieve required protection levels (i.e., the protection levels stated in the strategy chosen by the user); and (2) executing selected functions on data pieces in order to communicate protected data to consumers. This component provides therefore context-aware data protection based on user decisions (i.e., when the system operates in active mode). However, ensuring full protection of data requires also to focus on inter-context transitions and their impact on privacy loss. In fact, the protection level assigned to a data stream may increase/decrease from a context to another, making therefore subsequent data values less/more precise at the context transition phase. This raises data leakage problems, especially when protection significantly decreases, which widens the precision gap between prior/subsequent correlated data and makes subsequent data more precise. The large gap in precision improves the capabilities of an adversary when using advanced mining techniques to estimate/infer, with a high confidence, the real values of prior data pieces where protection is critical. This makes consequently the data protection process vulnerable to data inference attacks. To overcome this vulnerability, we proposed a novel stochastic gradient descent approach for privacy-preserving during protection transitions, denoted P-SGD. The goal of this approach is to minimize protection deviation between sequential data values at the context transition until reaching the targeted protection level (i.e., the protection stated in the newly selected strategy). The gradient descent rate is calculated according to data dependency and protection function dependency (if changed in the new context). The P-SGD approach is detailed in Chapter 5, and published [START_REF] Bou-Chaaya | P-SGD: A stochastic gradient descent solution for privacy-preserving during protection transitions[END_REF] in the proceedings of the 33rd International Conference on Advanced Information Systems Engineering 5 (CAISE'21):

-Bou-

Report Organization

The remainder of the thesis is organized as follows:

Chapter 2 describes our ontology-based data model that enables the representation of various user situations with high semantic expressiveness power. We review related work on user, environment, and context modeling. Then, we introduce our ontology for user-Context modeling in Sensor Networks (uCSN), which improves the context representation to consider diverse types of: (i) user/environment information (i.e., scalar, multimedia information); (ii) data sources (e.g., sensor, document); (iii) uncertainties (e.g., uncertainties related to the user, the environment); and

(iv) environments (i.e., connected/unconnected environments, and environments with static/mobile systems and devices). We do so by defining new concepts and properties, and importing others from well-known ontologies, namely DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], SSN [2], HSSN [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], and W3C Uncertainty Ontology [3]. We keep uCSN generic and reusable in different application domains. Finally, we evaluate the accuracy, clarity, performance, and consistency of the proposal.

Chapter 3 presents the risk reasoner that one uses to infer the privacy risks involved in the user context. We review existing works on privacy risk inference before delving into the proposed context-aware semantic reasoning approach for dynamic risk inference (CaSPI [4]). We address the challenges of (i) increasing expressiveness in risk definitions; (ii) performing a holistic (all-data-inclusive) risk reasoning;

(iii) coping with the dynamicity and context-dependency of privacy risks; (iv) dealing with user expertise; and (v) delivering scalability and efficiency. We validate our proposal by developing a prototype, illustrate its functioning from the back-end and front-end, and evaluate its performance by considering different scenarios. 5 https://caise21.org/ Chapter 4 describes the risk manager that evaluates the values of the risks inferred, and then calculates the best data protection strategies that cope with the user's situation and preferences. We present our proposed approach for context-aware multiobjective privacy management (δ-Risk [5]). We detail the process followed from the incoming input (e.g., risks involved, user preferences) to the best strategies delivered at the output to the user. We validate our proposal by developing a prototype, illustrate its functioning from the back-end and front-end, evaluate its performance by considering different scenarios, and formally study its effectiveness in strategy identification.

Chapter 5 focuses on overcoming the system's vulnerability to data inference attacks during data protection transitions (e.g., when a context change occurs). We point out the cases that contribute to the temporal data privacy leakages during protection transitions. Then, we introduce our proposed privacy-preserving stochastic gradient descent solution (P-SGD [START_REF] Bou-Chaaya | P-SGD: A stochastic gradient descent solution for privacy-preserving during protection transitions[END_REF]). The proposed solution is connected to the data protection component of the framework, and triggered at the protection descent phases to provide an additional layer of protection against data inference attacks.

We detail the process followed by P-SGD and illustrate its functioning by executing the developed prototype. Finally, we present the experimentation setup and results.

Chapter 6 concludes the report with a recap of all the aforementioned chapters and discusses in details the next steps and potential future research directions.

Chapter 2

Context Modeling in Connected Environments

"For me context is the key -from that comes the understanding of everything."

-Kenneth Noland

Context-awareness has emerged as a key paradigm for ubiquitous computing and ambient intelligence applications (e.g., IoT-based applications). This paradigm leverages situational information about people and their environments to better improve the quality of machine-to-human communications (e.g., adapt behaviors to people's situation). However, doing so necessitates to represent user situations with a high expressiveness power. Ontology-based data models have been widely adopted as one of the most suitable modeling formats to deal with the heterogeneity of context information.

However, existing ontology-based context models do not fully address the challenges of: (i) covering the representation of domain independent information that describes the main context dimensions, i.e., user, environment, time, and location;

(ii) representing diverse data sources from which information can be collected

Introduction

Recent years have witnessed rapid progress in enabling technologies for mobile and ubiquitous computing, ambient intelligence, and machine learning. This allowed the emergence of numerous Context-aware Systems (CAS) in these areas that are capable of perceiving and interpreting changes in people's situation and adapting their operations accordingly. Hence, these systems have paved the way for proactive and intelligent reasoning that helped in minimizing user effort and improving human-computer interactions. Current context-aware applications are impacting various domains, such as healthcare and elderly-care (e.g., [START_REF] Forkan | Bdcam: Big data for contextaware monitoring-a personalized knowledge discovery framework for assisted healthcare[END_REF]- [START_REF] Pung | Context-aware middleware for pervasive elderly homecare[END_REF]), homes (e.g., [START_REF] Alirezaie | An ontology-based contextaware system for smart homes: E-care@ home[END_REF], [START_REF] Ni | A context-aware system infrastructure for monitoring activities of daily living in smart home[END_REF]), cities (e.g., [START_REF] Schürholz | Artificial intelligence-enabled context-aware air quality prediction for smart cities[END_REF], [START_REF] Khan | A framework for cloud-based contextaware information services for citizens in smart cities[END_REF]), military (e.g., [START_REF] Castiglione | Context aware ubiquitous biometrics in edge of military things[END_REF]), tourism (e.g., [START_REF] Meehan | Context-aware intelligent recommendation system for tourism[END_REF]), and for different purposes like providing CAS-users with context-driven recommendations, privacy preservation, and so on. Nonetheless, achieving this requires to gather, at any time and any place, as much context information as possible that describes the user (e.g., profile, activity) and her surrounding environment (e.g., environment description, components, characteristics).

The more the information gathered is expressive, the more the CAS is able to understand and interpret the user's situation, which helps in improving the quality of the services/functions delivered in return. However, the system may receive huge amounts of heterogeneous information in terms of data types and formats, originated from different sources (e.g., sensors, Web resources), and describing different context dimensions (i.e., time, location, user, and environment). In addition, it can be uncertain, incomplete, or ambiguous. Information pieces can have different levels of granularity and can be correlated through implicit and explicit relationships.

All this makes the modeling of context information a challenging task. Various context modeling techniques exist in the literature [START_REF] Perera | Context aware computing for the internet of things: A survey[END_REF], including key-value, object oriented, graphical, and ontology-based modeling. However, according to many surveys and studies [START_REF] Perera | Context aware computing for the internet of things: A survey[END_REF], [START_REF] Strang | A context modeling survey[END_REF], ontology-based data models have been adopted as one of the most appropriate modeling formats to deal with the heterogeneity of context information. Ontologies allow for information representation with a high semantic expressiveness power, enable comprehensive and complex reasoning over modeled information, and maintain a flexible and extensible data structure.

Several ontologies for context modeling were proposed in the literature [START_REF] Hervás | A context model based on ontological languages: A proposal for information visualization[END_REF]- [START_REF] Riboni | Owl 2 modeling and reasoning with complex human activities[END_REF], however, they are restrictive due to the following issues: (i) lack of domainindependent information coverage that describes the main context dimensions (i.e., user, environment, time, and location); (ii) lack of considered data and data types (e.g., scalar, multimedia); (iii) lack of considered data sources (e.g., sensors, devices, social network profiles, documents, public databases); (iv) no consideration of information quality aspects (e.g., uncertainty level, nature and type), which is important to limit the impact of context imperfection on the CAS behavior; and (v) lack of genericity/re-usability, most of these approaches (e.g., [START_REF] Kim | Ontology-based healthcare context information model to implement ubiquitous environment[END_REF], [START_REF] Chen | An ontology for context-aware pervasive computing environments[END_REF], [START_REF] Riboni | Owl 2 modeling and reasoning with complex human activities[END_REF]) are linked to Chapter 2. Context Modeling in Connected Environments a specific application domain, i.e. they include domain-specific knowledge, which may increase the semantic complexity or/and computation costs of the data model, and limit its re-usability in other domains.

To address the aforementioned limitations, we present here uCSN, a generic and modular ontology for user-Context modeling in Sensor Networks. uCSN allows the representation of a variety of user situations. It provides a high-level of information coverage of the four context dimensions: time, location, user, and environment. Moreover, it supports the representation of scalar/ multimedia information with their properties, diverse data sources, uncertainty aspects of collected information, and hybrid environments with their static/mobile aspects and components.

To achieve this, uCSN introduces new concepts and properties, and imports others from existing well-known ontologies such as: (i) Data Privacy Vocabulary (DPV) [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], to enrich the representation of the user-profile; (ii) Semantic Sensor Network (SSN) [2]/Hybrid SSN (HSSN) [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], to cover the modeling of hybrid connected environments; and (iii) W3C Uncertainty Ontology [3], to represent uncertaintyrelated aspects. uCSN does not contain domain-specific aspects but can be easily extended and aligned with other ontology models, through its pluggable layer, to cover domain-specific user/environment knowledge (e.g., user-medical data [START_REF] Kim | Ontology-based healthcare context information model to implement ubiquitous environment[END_REF],

building topology ontology [START_REF] Rasmussen | Bot: The Building Topology Ontology of the W3C linked building data group[END_REF]).

The rest of this chapter is organized as follows. Section 2.2 illustrates a scenario that motivates our proposal and identifies the challenges to tackle. Section 2.3 reviews existing ontologies for user, environment, and context modeling. Section 2.4 details the uCSN ontology. Section 2.5 outlines the experimental evaluation of uCSN accuracy, clarity, performance, and consistency. Finally, Section 2.6 presents a summary of the chapter.

Motivating Scenario

To motivate our proposal, we investigate the following scenario. Consider that Alice uses a context-aware application that provides her with personalized recommendations to protect her privacy. This application requires a high level of information coverage, i.e. it needs to gather all available information that characterize the context of Alice to deliver a good quality of privacy recommendations.

Figure 2.1 illustrates the present situation of Alice. To start with the surrounding environment, Alice is located at her home that hosts various sensors for monitoring purposes like video surveillance cameras and energy-consumption sensors. Alice is a COPD patient who follows her medical treatment from home using a NIV device.

In addition, other profile information are also collected by the application from external sources in order to better recommend Alice, such as her marital status and profile picture (from her Facebook profile), and her date of birth (from her Facebook profile and the public voting database available on the Internet). Moreover, Alice shares the energy-consumption readings of her home, which are sensed by the deployed energy sensors, with an electricity provider, to benefit from personalized recommendations to reduce her energy consumption and bills. She shares also her location data with a healthcare provider, through the GPS sensor embedded on her mobile device, to benefit from a smart ambulance service that she would use in case of respiratory distress. From their side, providers collaborate with third parties interested in exploiting the data of their customers (e.g., Alice) for a variety of purposes, including marketing companies and government agencies. To protect her privacy, the application needs to build the context view by gath-

ering and modeling all these information pieces, which are heterogeneous in types (i.e., scalar and multimedia information), formats (e.g., text, numeric, vector, XML, PNG, MOV), origins (e.g., sensor, social network profile, database, document) and semantics. It also needs to represent the quality of these information that may impact the system behavior. For example, the date of birth information captured from the Facebook profile is incomplete, which might impact the relating recommendations.

Moreover, the application may need to track the dynamicity of the environment (e.g., mobile sensor locations and coverage areas, capabilities of devices). It may also get access to sensor data (e.g., video data from surveillance cameras, location data from the GPS sensor) to better monitor the user activity at home. We considered in this example the case of a privacy-oriented application that requires high-level of information coverage of all context dimensions. Nonetheless, a wide range of context-aware applications exist in many domains [START_REF] Kulkarni | Context aware recommendation systems: A review of the state of the art techniques[END_REF], where the information coverage requirements vary from one to another depending on their operations. This means they can be interested in tracking user profile, activities, prefer- the representation of various data sources with their properties (e.g., origins, data-serialization formats) in order to ensure the traceability of the data/information sources.

• Challenge 4. Coping with multi-granular information: Context information may have different levels of granularity. For example, the CAS receives two information about the user's location, one indicating that the user is located in the airport (captured from a post on Facebook), and another more precise information indicating the exact location of the user collected from his wearable GPS sensor. Accordingly, the data model must handle the modeling of information with different granularity levels, which enriches the context representation.

• Challenge 5. Coping with information uncertainty and incompleteness: Contextual data/information is collected, sometimes in real-time, from various/diverse data sources (e.g., sensors, social media platforms). However, the uncertainty level of information may vary due to many factors (i.e., regular and irregular uncertainty [START_REF] Yang | Lifelogging data validation model for internet of things enabled personalized healthcare[END_REF]) such as node malfunctions/faults or misuse of social media platforms. Furthermore, context information is often incomplete and/or ambiguous [START_REF] Hervás | A context model based on ontological languages: A proposal for information visualization[END_REF], [START_REF] Wu | Multi-finger and whole hand gestural interaction techniques for multi-user tabletop displays[END_REF]. The data model must consequently be able to represent information uncertainties, which can help to minimize negative impacts on the quality/behavior of the CAS.

• Challenge 6. Coping with environment dynamicity: The surrounding environment of the user is dynamic (i.e., it evolves/changes progressively). This makes the information modeling process complex, as the data/information received is unpredictable, uncontrollable and unknown in advance.

• Challenge 7. Delivering re-usability, extensibility and efficiency: The data model must be generic and re-usable in different application domains, i.e., it must not contain domain-specific knowledge. It should also be extensible, so it can be easily adapted to domain-specific particularities. Finally, it must maintain low computational complexity in information retrieval, which makes it also usable by applications where responsiveness and light processing costs are critical.

Context Background & Related Work

Context Background

The term context has been defined by many researchers. Rodden et al. [START_REF] Rodden | Exploiting context in hci design for mobile systems[END_REF], Hull et al. [START_REF] Hull | Towards situated computing[END_REF], and Ward et al. [START_REF] Ward | A new location technique for the active office[END_REF] used synonyms to refer to context, such as environment and situation. Therefore, these definitions also cannot be used to identify new context. Abowd and Mynatt [START_REF] Abowd | Charting past, present, and future research in ubiquitous computing[END_REF] identified the five W's (Who, What, Where, When, Why) as the minimum information that is necessary to understand context. Schilit et al. [START_REF] Schilit | Context-aware computing applications[END_REF] and Pascoe [START_REF] Pascoe | Adding generic contextual capabilities to wearable computers[END_REF] have also defined the term context.

Dey claimed that these definitions were too specific and cannot be used to identify context in a broader sense, and provided the following definition for context:

"Context is any information that can be used to characterise the situation of an entity. An entity is a person, place, or object that is considered relevant to the interaction between a user and an application, including the user and applications themselves."

We accept the definition provided by Dey et al. [START_REF] Dey | A conceptual framework and a toolkit for supporting the rapid prototyping of context-aware applications[END_REF] in our research work, because this definition can be used to easily identify whether a provided data element is context or not. Nonetheless, the entity of interest in our work is the user. Therefore, we stress the definition provided by Dey et al. [START_REF] Dey | A conceptual framework and a toolkit for supporting the rapid prototyping of context-aware applications[END_REF] and we consider in our study that the term "context" represents the "group of information" instead of "a single information", and the user-context can therefore be defined as follows:

"A user context is defined as the finite group of information that characterizes the situation of the user in a specific time and space."

The user context is spatio-temporal, and the user situation can therefore be regarded as "the sequence of user contexts in time and space". We provide in Chapter 3 a formal definition of user context that will be used after (cf. Definition 4). In what follows, we discuss the dimensions used by various researchers to represent a context, and then we highlight the fundamental dimensions considered in our work.

So far, there is no standard to specify what type of information needs to be considered in context modeling [START_REF] Perera | Context aware computing for the internet of things: A survey[END_REF]. Consequently, the main context dimensions remain neither well defined nor delimited, resulting in a variety of dimensions depending on the perspectives in the field. Authors in [START_REF] Dey | Designing mediation for context-aware applications[END_REF] considered four dimensions of context information: location, time, identity, and activity. In [START_REF] Ryan | Enhanced reality fieldwork: The context-aware archaeological assistant[END_REF], authors considered the following context dimensions: location, time, identity, and environment. [START_REF] Thevenin | Plasticity of user interfaces: Framework and research agenda[END_REF] considered user, platform, and environment. [START_REF] Wang | Ontology based context modeling and reasoning using owl[END_REF] considered location, person, activity and computational entity. [START_REF] Hervás | A context model based on ontological languages: A proposal for information visualization[END_REF] focused on location, time, user, environment, service and device. [START_REF] Chen | The soupa ontology for pervasive computing[END_REF] considered person, agent, belief-desire-intention, action, policy, time, space and event. In [START_REF] Kim | Ontology-based healthcare context information model to implement ubiquitous environment[END_REF], authors were focusing on the medical domain, so they specified eight dimensions for context information, namely location, time, individual, activity, medical, auxiliary, environment, and device.

Our objective here is to provide a generic data model that covers only domainindependent knowledge, i.e. we focus only on domain-independent dimensions.

The dimensions outlined in the previous studies characterize four general elements: time, location, user, and environment. From the user perspective, identity, activity, action, belief-desire-intention are properties of the user dimension. Platform, device, service and computational entity can be regarded as properties of the environment dimension. Event is expressed by both time and location dimensions. Therefore, we consider in this study time, location, user, and environment as the four fundamental context dimensions to characterize the user's situation (cf. Figure 2.2).

Related Work

In this section, we study and review existing ontology-based models that represent the user (i.e., user-only models), environment (i.e., environment-only models), and the combination of user and environment with other dimensions (i.e., context models). We compare these works based on the following criteria that are linked to the challenges mentioned in Section 2.2:

• Criterion 1. Re-usability: The approach is not related to a specific domain and is compatible with different application purposes. In fact, integrating domain specific knowledge can increase the semantic complexity and/or computation costs of the data model. Hence, this criterion indicates if the approach is re-usable in various application domains via {YES, NO}.

• Criterion 2. Extensibility: This criterion states {YES, NO} if the approach is extensible, i.e., adaptable to domain-specific applications.

• Criterion 3. Information Coverage: This criterion denotes by {YES, NO, PARTI AL} the ability of the approach to cover the representation of domain-independent information related to the different context dimensions:

(1) Time (i.e., time instants and intervals).

(2) Location (i.e., location semantics through coordinates, textual descriptions, or/and spatial zones).

(3) User:

-Profile, i.e., information describing the user's profile (e.g., identity, preferences, public life, knowledge belief).

-Activity, i.e., information describing the user's activity (e.g., locations visited, activities performed, data sensed and shared with data consumers in exchange for services).

(4) Environment:

-Unconnected environment aspects (e.g., structure, descriptions, devices).

-Connected environment aspects (e.g., sensors, smart appliances, actuators with their capabilities and properties). In addition, we consider the following two sub-criterion to underline also the ability of the approach to handle sensor diversity/mobility in the environment:

* Sensor Diversity: The environment can host simple sensors or/and more advanced multi-sensor devices that are capable of sensing, processing, communicating, and storing data. In addition, sensors are capable of sensing scalar or/and multimedia data. Hence, this criterion states the ability of the approach to handle sensor diversity in terms of simple sensors/multi-sensor devices and scalar/multimedia sensors.

* Sensor Mobility: The environment can be (i) static, i.e., hosts static sensor nodes or/and multi-sensor devices that do not change locations/ coverage areas with time, or (ii) mobile, i.e., hosts at least one mobile sensor/device. Integrating mobile sensing devices in the representation of sensor networks is important to consider mobile data sources from which context information might be collected (e.g., smart phones, drones). However, considering mobility adds challenges related to properly locating and tracking mobile sensors, and updating their coverage areas when they move. Consequently, this criterion states the ability of the approach to represent sensor mobility.

-Service (i.e., services provided to the user with its characteristics).

• Criterion 4. Information diversity: This criterion indicates {YES, NO, PARTI AL} if the approach is capable of modeling data/information with different data types.

• Criterion 5. Source diversity: This criterion indicates {YES, NO, PARTI AL} if the approach handles the representation of heterogeneous data sources in terms of origins and types.

• Criterion 6. Information Uncertainty: This criterion states {YES, NO, PARTI AL} if the approach is capable of representing the uncertainty aspects of collected context information.

We do not consider criteria related to information multi-granularity (cf. Challenge 4) and environment dynamicity (cf. Challenge 6) since they are both satisfied when using ontology-based models to which our study is limited.

User Modeling

We present here existing ontologies for user modeling, i.e., ontologies that represent user profile and/or activity information. We start by detailing each work separately (the name of the model is highlighted in bold font). Finally, we evaluate them based on the aforementioned criteria (for criterion 3, we only consider the user information coverage).

A user profile is defined as "the explicit digital representation of a person's identity. It regroups all personal information describing the characteristics of a person" [START_REF] Piao | Inferring user interests in microblogging social networks: A survey[END_REF]. Existing ontologies for user modeling describe the user profile in different manners depending on the usage purpose:

DPV. The Data Privacy Vocabulary (DPV) model [1] is a W3C (World Wide Web Consortium) initiative released in January 2021 (version 2). It introduces classes and

properties to describe instances of legally compliant personal data handling according to the EU General Data Protection Regulation (GDPR [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF]). This model covers all domain independent profile information and regroups them into different categories such as identifying, demographic, ethnicity, physical characteristics, public life, and preference. [START_REF] Brickley | FOAF Vocabulary Specification[END_REF] is one of the most widely used ontologies to model people in the social network field. It specifies a vocabulary that can be used to define, exchange and search for social information that describes people with their social profile characteristics (e.g., first/last name, age, birthday, skypeID, yahooChatID) and their social connections with others.

FOAF. The FOAF ontology

UPO.

In [START_REF] Skillen | Ontological user profile modeling for context-aware application personalization[END_REF], authors proposed an ontological User Profile Modeling for contextaware application personalization within mobile environments (UPO). They introduced concepts and properties to represent the user profile/activity aspects including contact, health, education, capabilities, interests, preferences, and activities.

UPOS.

In [START_REF] Sutterer | Upos: User profile ontology with situation-dependent preferences support[END_REF], authors introduced the notion of personalized user profiles and proposed the User Profile Ontology with Situation-Dependent Preferences Support (UPOS). The aim of this ontology was to support the situation-dependent personalization of services within changing environments by splitting the user profile into several profile subsets where each is defined in response to a specific service.

Extended-UPOS.

In [START_REF] Stan | A user profile ontology for situation-aware social networking[END_REF], authors proposed an extension of UPOS ontology for situation-aware social networking. They kept the dynamic aspects of user profiles, and considered the conjunction of context dimensions in order to better identify in real-time the situation of users.

CC/PP. The Composite Capabilities/Preference Profile (CC/PP) model [START_REF] Klyne | Composite capability/preference profiles (CC/PP): Structure and vocabularies[END_REF] is a W3C initiative that suggests an infrastructure to describe device capabilities and user preferences. CC/PP is developed specifically to facilitate the decision making process of a server on how to customize and transfer web content to the user's device in a suitable format. It can guide to the adaptation of the content delivered to the device according to software terminals, hardware terminals, and applications such as a browser, data types, and protocols.

UP-PwD.

In [START_REF] Skillen | A user profile ontology based approach for assisting people with dementia in mobile environments[END_REF], authors proposed a user profile ontology-based approach that provides context-aware personalized services for assisting People with Dementia in mobile environments (UP-PwD). They introduce new classes and properties to represent generic user aspects (e.g., personal information, capabilities, preferences, activities, and locations) as well as other domain-specific aspects such as educational, health, and social information.

Comparative Study

Table 2.1 shows that none of the aforementioned works fully considers the entire list of criteria. We discuss in what follows the results of this comparison according to each criterion.

Re-usability. The UPOS [START_REF] Sutterer | Upos: User profile ontology with situation-dependent preferences support[END_REF] and CC/PP models [START_REF] Klyne | Composite capability/preference profiles (CC/PP): Structure and vocabularies[END_REF] are said to be generic since they do not contain domain-specific knowledge. The rest of data models contain knowledge associated to specific domains (e.g., medical, social, educational), however they can be divided into two categories: (i) domain-independent models; and

(ii) domain-driven models. The DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], UPO [START_REF] Skillen | Ontological user profile modeling for context-aware application personalization[END_REF] and UP-PwD [START_REF] Skillen | A user profile ontology based approach for assisting people with dementia in mobile environments[END_REF] ontologies belong to (i), i.e., they integrate domain-specific knowledge through modules/profiles (e.g., health profile, social profile) which makes it easier to exclude the related concepts/properties from the ontology and re-use it in other fields. The FOAF [START_REF] Brickley | FOAF Vocabulary Specification[END_REF] and Extended-UPOS [START_REF] Stan | A user profile ontology for situation-aware social networking[END_REF] are oriented towards the field of social networks.

Extensibility. Most of the data models (i.e., [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], [START_REF] Skillen | Ontological user profile modeling for context-aware application personalization[END_REF], [START_REF] Sutterer | Upos: User profile ontology with situation-dependent preferences support[END_REF], [START_REF] Klyne | Composite capability/preference profiles (CC/PP): Structure and vocabularies[END_REF], [START_REF] Skillen | A user profile ontology based approach for assisting people with dementia in mobile environments[END_REF]) are extensible and can be adapted to the particularities of the application domain. The FOAF [START_REF] Brickley | FOAF Vocabulary Specification[END_REF] and Extended-UPOS [START_REF] Stan | A user profile ontology for situation-aware social networking[END_REF] models can be extended, however, they are limited to their field of interest.

User Information Coverage. All data models (except DPV) partially represent the user profile information and activity information (i.e., performed activities or/and visited locations). The DPV model [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF] represents all domain-independent profile information and categorizes them through different classes (i.e., identifying, preferences, demographic, ethnicity, physical characteristic, public life, knowledge belief, and authenticating). However, the coverage of information on user activity remains limited. At present, it only considers user behavioral information.

Information Diversity. DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF] and FOAF [START_REF] Brickley | FOAF Vocabulary Specification[END_REF] consider the representation of images along with scalar information, but lack the representation of other multimedia data such as sounds and videos.

Source Diversity. DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF] is the only model to support representation of data sources through the dpv:DataSource concept.

Information Uncertainty. None of the reviewed models supports the representation of the information uncertainty aspects.

Environment Modeling

We discuss in this section existing ontologies for environment modeling. Environment ontologies vary between those integrating a generic vocabulary to represent different environments and those integrating a domain-specific vocabulary to represent a specific environment in particular (e.g., building, home). In this study, we only focus on reviewing domain-independent ontologies that cover the representation of many environments. In what follows, we shall follow the same procedure as in the previous subsection 2.3.3. For the information coverage criterion, we only consider here the environment aspects. In addition, criterion 5 (i.e., source diversity)

is not considered as the focus here is on how to represent environment descriptions, components (e.g., sensors), and services. Consequently, the only data sources to be considered in such data models are the internal ones, if they exist (i.e., the sensors deployed in the environment).

The surrounding physical environment of the user (e.g., home, mall, street, city) can be a connected environment (i.e., hosts smart cyber-physical systems) or not.

Environments might have specific aspects that do not necessarily exist for others.

Therefore, we focus here on covering common generic aspects/components across all connected/unconnected environments (e.g., zones, descriptions, components like sensors, devices and appliances). Several ontology-based models exist in the fields of semantic sensor network modeling, IoT/connected environment modeling: Other approaches have also extended the SSN ontology. However, they were all contributed before the newly released version of SSN (i.e., SOSA/SSN). Consequently, they tried to deal with the limitations of the old SSN such as the lack of description of essential IoT elements (e.g., objects, actuators, services, etc), services, and so forth. These ontologies are respectively presented in the following.

SOSA/SSN. In [2],

IoT-O.

In [START_REF] Seydoux | Iot-o, a core-domain iot ontology to represent connected devices networks[END_REF], authors have introduced IoT-O, a core-domain IoT ontology to represent connected devices networks and their relation with their environment. IoT-O expands from old SSN with descriptions of sensors, services, units, nodes, things and actuators. It covers the following modules through alignments with existing ontologies: sensing (aligned with the old SSN ontology [START_REF] Compton | The ssn ontology of the w3c semantic sensor network incubator group[END_REF]), acting (aligned with SAN ontology [START_REF] Spalazzi | An internet of things ontology for earthquake emergency evaluation and response[END_REF]), life-cycle (aligned with Life-cycle ontology [START_REF] Styles | Lifecycle Schema[END_REF]), service (aligned with hRest [START_REF] Kopeck | Hrests: An html microformat for describing restful web services[END_REF], MSM [START_REF] Pedrinaci | Toward the next wave of services: Linked services for the web of data[END_REF], wsmo-lite [START_REF] Vitvar | Wsmo-lite annotations for web services[END_REF]) and energy (aligned with PowerOnt [START_REF] Bonino | Poweront: An ontology-based approach for power consumption estimation in smart homes[END_REF]).

IoT-Lite. In [START_REF] Bermudez-Edo | Iot-lite: A lightweight semantic model for the internet of things and its use with dynamic semantics[END_REF], authors have proposed IoT-Lite Ontology, an instantiation of the old SSN ontology. It is a lightweight ontology that represents IoT resources, entities and services. It allows the discovery and interoperability of IoT resources in heterogeneous platforms using a common vocabulary.

IoT Ontology. IoT Ontology [START_REF] Kotis | An iot-ontology for the representation of interconnected, clustered and aligned smart entities[END_REF] is also an expansion of the old SSN. It integrates new concepts such as physical-entity and smart-entity to support semantic expressions for interconnected, aligned and clustered entities. As shown in to Table 2.2, the HSSN ontology [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF] covers most of the criteria. It lacks only the representation of information uncertainty aspects. We discuss hereafter the comparison of the listed environment models.

Comparative Study

All the aforementioned works (i.e., [2], [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], [START_REF] Seydoux | Iot-o, a core-domain iot ontology to represent connected devices networks[END_REF], [START_REF] Bermudez-Edo | Iot-lite: A lightweight semantic model for the internet of things and its use with dynamic semantics[END_REF], [START_REF] Kotis | An iot-ontology for the representation of interconnected, clustered and aligned smart entities[END_REF]) are generic and extensible. They handle representation of domain-independent aspects of both connected and unconnected environments (e.g., structure, descriptions, sensors, devices, services). Moreover, they all consider representation of simple sensor nodes and multisensor devices. However, these models (except HSSN [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF]) do not consider the diversity of sensors and information in terms of scalar and multimedia properties, and do not integrate sensor mobility into their representation of sensor networks. Only HSSN [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], IoT-O [START_REF] Seydoux | Iot-o, a core-domain iot ontology to represent connected devices networks[END_REF], and IoT-Lite [START_REF] Bermudez-Edo | Iot-lite: A lightweight semantic model for the internet of things and its use with dynamic semantics[END_REF] ontologies represent the services provided to the user with their features (e.g., input/output variables, capabilities). Finally, none of the models tackles the modeling of information uncertainty.

Context Modeling

A broad variety of ontologies exist for context modeling in the fields of connected/smart environments and sensor networks, including ontologies for human behavior/activity recognition. In the following, we start by detailing these works and then we review them according to the aforementioned comparison criteria.

PiVOn. In [START_REF] Hervás | A context model based on ontological languages: A proposal for information visualization[END_REF], authors propose the Pervasive Information Visualization Ontology (PiVOn) for context modeling in intelligent environments. They considered the following context dimensions: user, environment, device, and service. Thus, PiVOn is composed of four independent ontologies that represent respectively information related to the considered four dimensions. It integrates the following aspects as properties (or meta-context) of the main dimensions: time, location (e.g., environments where the user is located, GPS coordinates), identity (aligned with FOAF ontology [START_REF] Brickley | FOAF Vocabulary Specification[END_REF] to describe the user profile), and activity. The user context is analyzed from the perspective of the 5 Ws Theory, a journalism principle regarded as basic in information gathering (What, Who, Where, When, Why).

CONCON.

In [START_REF] Wang | Ontology based context modeling and reasoning using owl[END_REF], the CONtext ONtology (CONCON) is introduced for modeling context in pervasive computing environments. CONON provides an upper context ontology that captures generic concepts and properties about basic context, and also provides extensibility for adding domain-specific ontologies. Authors consider person, activity (deduced/scheduled activities), surrounding location (i.e., indoor/outdoor space) and computational entity (e.g., device, service) are the fundamental dimensions to define the context.

SOUPA.

Authors in [START_REF] Chen | The soupa ontology for pervasive computing[END_REF] propose SOUPA, a Standard Ontology for Ubiquitous and Pervasive Applications. SOUPA consists of two modules. First, the SOUPA-Core that consists of nine ontologies, where together define a generic vocabulary for describing person contact information, beliefs, desires, and intentions of an agent, actions, policies (e.g., rights, obligations), time (i.e., time instants and intervals), space (e.g., geographical regions, geo-spatial coordinates), and events (with their time/space features). The second module is the SOUPA-Extensions, that allows the alignment with other domain-specific ontologies, which justifies its extensibility.

COBRA-ONT.

The Context Broker Architecture Ontology (CoBrA-Ont) is an extension of the SOUPA ontology [START_REF] Chen | An ontology for context-aware pervasive computing environments[END_REF]. It focuses on the domain of smart meeting rooms and enriches accordingly the representation of people, places, activities and devices. The main objective of this ontology is to enable knowledge sharing and ontology reasoning within the CoBra (for Context Broker Architecture) infrastructure.

CoDAMoS.

In [START_REF] Preuveneers | Towards an extensible context ontology for ambient intelligence[END_REF], authors propose CoDAMoS, an ontology for context modeling in mobile environments. This ontology has been designed with the aim of solving the challenges of: application adaptation, automatic code generation, code mobility, and generation of device-specific user interfaces. CoDAMoS defines six context dimensions: time, location, user, environment, platform, and service. It provides representation of user preferences/activities/tasks, environmental conditions, device resources (e.g., memory, network, power, and storage) and software (middleware, OS, virtual machine), and the characteristics of the services delivered to the user (e.g., service profile, model, and grounding).

mIO!. In [START_REF] Poveda-Villalón | A context ontology for mobile environments[END_REF], authors propose the mIO! ontology to represent the user context in mobile environments. This accordingly allows to configure, discover, execute, and enhance different services in which the user may be interested. mIO! is a modular ontology, it reuses existing ontologies to enrich some of its eleven core aspects: user (aligned with FOAF [START_REF] Brickley | FOAF Vocabulary Specification[END_REF]), role (i.e., user profiles and preferences; aligned with Reco1 ), environment (aligned with CoDAMoS [START_REF] Preuveneers | Towards an extensible context ontology for ambient intelligence[END_REF]), location (aligned with SOUPA [START_REF] Chen | The soupa ontology for pervasive computing[END_REF]), time (aligned with W3C Time [START_REF] Hobbs | W3C Time Ontology in OWL[END_REF]), service, provider, source, device (e.g., sensors), interface and network.

PalSPOT. In [START_REF] Riboni | Owl 2 modeling and reasoning with complex human activities[END_REF], authors introduce an ontology for human activity recognition, denoted PalSPOT. This ontology represent knowledge about user and social activities. It provides also an extensive taxonomy to represent several types of user activities such as personal, physical, professional, and traveling activities. Considering the surrounding environment, PalSPOT is capable of representing their descriptions, as well as the deployed simple sensor nodes. Finally, symbolic locations (e.g., indoor, outdoor) and time granularity are provided.

Comparative Study

According to the comparative study presented in Table 2.3, none of the above works fully considers the entire list of criteria. We discuss in the following the results of this comparison according to each criterion.

Re-usability/Extensibility. The COBRA-ONT [START_REF] Chen | An ontology for context-aware pervasive computing environments[END_REF] and PalSPOT [START_REF] Riboni | Owl 2 modeling and reasoning with complex human activities[END_REF] ontologies integrate domain-specific knowledge related respectively to the smart meeting rooms and social domains. The rest of works (i.e., [START_REF] Hervás | A context model based on ontological languages: A proposal for information visualization[END_REF]- [START_REF] Chen | The soupa ontology for pervasive computing[END_REF], [START_REF] Preuveneers | Towards an extensible context ontology for ambient intelligence[END_REF], [START_REF] Poveda-Villalón | A context ontology for mobile environments[END_REF]) provide a generic vocabulary to represent the user context. Nonetheless, all aforementioned works are extensible and can be adapted to specific domains.

Information Coverage. All context works satisfy the coverage of information that represent time and location dimensions, as well as the aspects of unconnected environments (e.g., descriptions, environmental conditions). Concerning connected environments properties, the PiVOn ontology [START_REF] Hervás | A context model based on ontological languages: A proposal for information visualization[END_REF] handles representation of sensors, actuators, dependent/autonomous devices, and multi-sensor devices with their capabilities. The mIO! ontology [START_REF] Poveda-Villalón | A context ontology for mobile environments[END_REF] introduces a specific taxonomy limited to the representation of devices, including simple sensor nodes and multi-sensor devices.

The PalSPOT ontology [START_REF] Riboni | Owl 2 modeling and reasoning with complex human activities[END_REF] is limited to the representation of simple sensor nodes.

As regards sensor mobility, PiVOn [START_REF] Hervás | A context model based on ontological languages: A proposal for information visualization[END_REF] is capable of describing only current locations of sensors/devices. However, it does not associate temporal entities to these locations, which denies the ability to track mobile sensors. For the service description, only PiVOn [START_REF] Hervás | A context model based on ontological languages: A proposal for information visualization[END_REF], CoDAMoS [START_REF] Preuveneers | Towards an extensible context ontology for ambient intelligence[END_REF], and mIO! [START_REF] Poveda-Villalón | A context ontology for mobile environments[END_REF] provide classes and properties to describe services with their characteristics (e.g., service profile, model). When considering the coverage of user information, all works reviewed are partially representative. None of them fully covers the representation of domain-independent information that characterize the user's profile and activity.

Information Coverage/Uncertainty & Source Diversity. The compared context models consider only scalar context information. They lack multimedia data/information in their context representation. They also lack representation of uncertainty features of collected context information. As for source diversity, only mIO! [START_REF] Poveda-Villalón | A context ontology for mobile environments[END_REF] considers multi-source modeling through its provided source ontology.

General Discussion

To summarize the previously-detailed studies, none of the existing context models fully answers the list of criteria. They mainly share limitations related to: (i) covering the aspects and properties of connected environments, and the information that characterize the profile and activities of the user; (ii) handling the representation of diverse information (in terms of types/formats) and diverse data sources (in terms of origins/types); and (iii) representing the uncertainty features of collected context information.

When considering the user-only models, we notice that the DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF] model presents a rich vocabulary to represent all domain-independent profile information according to the EU GDPR [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF]. The generic profile classes can be easily extracted from this model since they are grouped into categories (e.g., demographic, public life, preference), so they can be easily distinguished from domain-specific categories (e.g., medical, financial). As well, when considering environment-only models, we notice that the HSSN ontology [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], which extends the well-known and widely used SOSA/SSN standard ontology [2], is generic and extensible. It

uCSN Ontology

In this section, we detail our proposed ontology for user-Context Modeling in Sensor Networks, denoted uCSN. This ontology addresses the challenges mentioned in Section 2.2. It introduces new concepts and properties, and imports others from DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], HSSN [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], SOSA/SSN [2], and W3C Uncertainty Ontology [3], in order to provide a comprehensive view of the user's situation. The following prefixes dpv:, sosa:, ssn:, hssn:, mssn:, uo:, and time: refer to DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], SOSA [2], SSN [2], HSSN [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], MSSN [START_REF] Angsuchotmetee | Mssn-onto: An ontologybased approach for flexible event processing in multimedia sensor networks[END_REF], Uncertainty [3] and Time [START_REF] Hobbs | W3C Time Ontology in OWL[END_REF] ontologies respectively. We start first by presenting an overview of our ontology.

Overview of uCSN

The uCSN ontology is comprised of two main layers as illustrated in Figure 2.3.

The core layer (i.e., yellow layer), is composed of the generic core concepts to represent the context dimensions: user (i.e., profile and activity), environment (e.g., descriptions, devices, sensors, services), time, and location (e.g., events). The second layer (i.e., orange layer) is a pluggable layer that allows the alignment with external ontology-based models to represent domain-specific knowledge related to the user (e.g., medical, social) or a particular environment (e.g., home, building, city).

Consequently, the core layer ensures the genericity of the uCSN ontology and the pluggable layer justifies its extensibility. Full documentation of the uCSN ontology is available at this link2 . Also, the ontology files are accessible online3 for download. The core layer includes concepts to describe general aspects such as entities, data sources, events, uncertainty features, and so forth (cf. Figure 2.3). It also includes other concepts regrouped into two modules: (i) user module, contains the concepts that characterize the user (i.e., profile and activity); and (ii) environment module, comprises the concepts that describe the environment of the user. In the following, we begin first by defining the entities, and then we explore the user and environment modules with their related general concepts (e.g., data sources, events).

User Module

The user module contains the user's personal information, expressed by the con- In addition to profile information, it is also important to monitor the activity of the user. This helps to better understand the current situation of the user and, consequently, to improve the quality of the reasoning process. However, achieving this

Profile Information

Eight main categories of generic profile information are imported from the DPV model [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], described by the following concepts: identifying, demographic, ethnicity, physical characteristic, knowledge belief, public life, authenticating and preference. Figures 2.9 A ucsn:Activity depends on the domain of interest. For example, the activity can be showering or eating in the smart home domain, as it can be moving hand or using medical equipment in the medical domain. Hence, we do not aim to detail the activity description to keep it re-usable and allow alignments with other activity ontologies depending on the application. However, an activity in general can take place once, as it can be a daily or regular activity. Consequently, the same ucsn:Activity can be performed at different times and locations, i.e.,

an activity can have one or more associated events. An event is a happening that takes place at a particular time (instant or interval) and location [START_REF] Aggarwal | Managing and mining sensor data[END_REF]. It is represented by the ucsn:Event concept (see in Figure 2.13). The ucsn:hasEventTime and ucsn:hasEventLocation properties are added to map events to their corresponding time instants/intervals and locations. The activity is therefore mapped to its related events through the property ucsn:isPerformedAt as illustrated in Figure 2.12.

Environment Module

The environment module includes aspects that allow the description of the user's surrounding environment. We aligned this module with the SOSA/SSN [2] and HSSN [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF] ontologies that provide a rich vocabulary to represent the environment's structure (e.g., location map), systems deployed (e.g., sensors, actuators), devices, and services. We detail in the following each of these aspects. (i) hssn:Infrastructure, a physical environment having locations where sensors could be deployed, which is equivalent to ucsn:Environment; and (ii) hssn:Device, an electronic equipment where sensors could be embedded (e.g., smart phone, drone).

This distinction is illustrated in Figure 2.17. A ucsn:Environment can host many sosa:Platform, i.e. can host other environments (e.g., cities host buildings, houses host rooms), or devices (e.g., the user's home hosts mobile phones). Regarding the structure of the environment, Figure 2.17 shows that each ucsn:Environment is described by a mssn:LocationMap that is composed of a set of mssn:Location. Software is also considered in the device modeling.

User/Environment Mediation

We detail here the properties that ensure the interconnection of the user and environment modules. The ucsn:User can be located in an ucsn:Environment, but also can control the environment, i.e., controls the information sensed from this environment (e.g., in case of her home or office). For example, the user controls the data collected by sensors deployed in her home, such as energy-consumption, temperature, or humidity data. These two relations are respectively represented by the ucsn:isLocatedInEnv and ucsn:controlsEnv properties. In order to track the presence of the user in the environments, the ucsn:hasUserPresenceTime property is added to map the ucsn:Environment to the related time:TemporalEntity. In addition, a hssn:Device can be attached to the ucsn:User (e.g., mobile phone, tablet). This is represented by the ucsn:isAttachedToUser property.

Information Uncertainty

The collected context information may be uncertain, incomplete, and/or ambiguous [START_REF] Yang | Lifelogging data validation model for internet of things enabled personalized healthcare[END_REF], [START_REF] Wu | Multi-finger and whole hand gestural interaction techniques for multi-user tabletop displays[END_REF]. This affects the quality of corresponding contexts, which can consequently impact the functionality of the CAS and/or the quality of its outputs (e.g., context-aware services). Therefore, we aim to integrate concepts that describe uncertainty aspects of modeled information. For this purpose, three concepts are imported from the W3C Uncertainty ontology uo:Ambiguity, means that the information is not clearly specified; (2) uo:Empirical, means that the information about an entity is either satisfied or not for all entities, but it is not known for which entities it is satisfied; (3) uo:Incompleteness, means that the information about the entity is incomplete; (4) Inconsistency, means that there is no entity that would satisfy the statement; and (5) Vagueness, means that there is no precise correspondence between the information and the related entities.

uCSN Experimental Evaluation

In this section, we detail the experimental protocol followed to evaluate both the syntactic and semantic aspects of the uCSN ontology (i.e., the concepts and the semantic inter-concept relations). The objectives of this protocol are:

Accuracy Evaluation

In order to study the accuracy of uCSN, we elaborate a query-based evaluation that highlights the ontology impact towards overcoming the challenges of (i) information coverage, (ii) information diversity, (iii) source diversity, and (iv) information uncertainty. The accuracy evaluation of sensor mobility and diversity is detailed in the HSSN experiments [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF]. We start first by detailing the query setup process, then we discuss the obtained results and we compare them according to the expected ones.

Query Setup

The aforementioned challenges can be addressed by answering SPARQL queries related to user, environment, and uncertainty information in uCSN. We define in the following the list of queries to execute with respect to each challenge.

Information Coverage. The information coverage queries are divided into useroriented, environment-oriented and context-oriented queries.

User Information. In order to expressively extract the information characterizing the user from the ontology, we define the following five queries:

• Query 1: Extracts the list of sensed information with their describing entities and sensing statuses (i.e., data consumers with whom information is shared, sensors used to sense related data values, sensing events, and communication protocols used to communicate data to consumers).

• Query 2: Extracts the data values of each sensed information, collected during a specific time interval [t1; t2], with their respective times/locations of capture.

• Query 3: Generates the list of information describing the contextual activity of the user, i.e. user locations, activities performed, behavioral and sensed information with their respective times and locations.

• Query 4: Generates a detailed view of the user profile at a given time instant t.

It extracts all profile information characterizing the user at t.

• Query 5: Generates the list of information that express user location semantics, i.e. user locations acquired from external sources (e.g., Facebook), location data values sensed by GPS sensors, and environments where the user is located. Information Diversity. In order to consider information diversity, on should be able to distinguish scalar and multimedia information. Therefore, Query 9 selects only the multimedia identifiable information of the user, and Query 10 extracts the list of scalar and multimedia sensed information and highlights the type of each one. Information Uncertainty. The application may need to extract uncertainty knowledge of modeled information in order to adjust its behavior/outputs accordingly.

To do so, we consider three categories to distinguish the uncertainties related to the user, the environment, and the time/location properties. The uncertainty information for the three categories is respectively extracted using Queries 12, 13, and 14.

Query Run & Discussion

We created a population of individuals and ran the aforementioned queries. Then, we compared the obtained and expected results. We created an environment described by a location map containing 20 locations. This environment hosts 20 actuators, 100 sensors (50 static, 50 mobile, 50 scalar, and 50 multimedia sensors), and 20 devices. Each sensor is located in one location, covers one coverage area, and observes one information (i.e., 50 scalar and 50 multimedia sensed information). Each of the sensed information describes one entity and has one sharing status (for each sensed information: 5 data consumers, 1 sensor, 1 communication protocol, and 1 sensing event associated with 1 temporal entity and 1 location). In addition, each of the sensed information has 50 data values where each has 1 time and location of capture. We created also 10 user locations collected from an external source, 5 activities performed, 2 behavioral information. The user profile is composed of 140 information (20 individuals per sub-concept). Each of the profile and activity information has one data source (140 in total divided into 40 sensors, 40 devices, and 60 external sources). We considered 5 devices attached to the user and 25 services provided to her. We associate an uncertainty value, nature, and type with half of the personal information, data value, time and location individuals. Finally, we consider that 20 of the coverage areas are uncertain (i.e., each of them has an associated uncertainty individual with its corresponding nature and type).

We ran queries 1-14 on the population of individuals, and for each case, the returned results matched exactly the expected ones. Therefore, the query results confirmed that our ontology is able to accurately answer the challenges mentioned in Section 2.2. In addition, the results show that uCSN provides a high-level of generic information coverage to represent the user and the environment. This makes it usable by various context-aware systems in multiple domains, including those requiring high quality of information coverage (e.g., privacy-preserving systems).

Clarity Evaluation

We created an evaluation form 4 to assess the ambiguity of the labels used to describe the uCSN concepts and inter-concept relations (i.e., the object properties). We focus only on evaluating the ambiguity of the newly defined concepts/properties. We sent the form to 50 ontology and sensor network experts, divided into 3 categories as shown in Figure 2.26: 25 computer scientists (i.e., assistant professors, associate professors, full professors, and PhD students), 18 research engineers experts in the fields of semantic web and context-aware computing, and 7 experts in network engineering. From a demographic standpoint (cf. Figures 2. [START_REF] George | Spatio-temporal sensor graphs (stsg): A data model for the discovery of spatio-temporal patterns[END_REF]

Clarity Results & Discussion

In the form, participants were first asked to guess the correct labels to assign to related concepts according to the described meanings of the concepts. For each concept, a list of 3 to 4 possible choices is provided, where choices are synonyms from several domains. For example, for the user concept, the participant had to choose between the following four labels: person, user, human, and client. Figure 2.28 confirms that the terms used are clear for the multi-domain experts with an average of 90% for guessing correct concept labels. The term "Service Provider" was the most ambiguous, with a 78% correct match percentage, especially for computer scientists where 7 of them (i.e., 28%) chose the term "Supplier".

Next, participants were asked to guess the correct labels of inter-concept relations based on their described meanings. Figure 2.29 shows that labels were correctly matched to their corresponding relations with an average of 88%. Therefore, the terms used to describe the semantic relations are clear for the three categories

Performance Evaluation

In order to evaluate the performance of uCSN, we considered several scenarios to study the impact of user, environment and context complexity on performance. Performance tests consist of executing queries related to each scenario (i.e., from the list of previously defined queries) on different population sizes. The performance results take into account the query run-time by running 10 times and calculating the average execution time. The tests were conducted on a machine equipped with an Intel i7 -2.8 GHz processor, and 16 GB of RAM.

User Impact

We studied here the impact of user information on performance. We considered therefore two scenarios, one focusing on user's personal information from a general point of view, and the other targeting the complexity of sensed information in terms of number and associated characteristics.

In the first scenario, we varied the percentage of personal information (divided in half between profile and activity) from 0, 30, 50, 70, to 100% in the population of individuals, while considering the following three population sizes: 100, 1000, and 10 000 context information. Then, we retrieved the list of personal information by combining queries 3 and 4 and measuring the corresponding run-time. In figure 2.30, we noticed that increasing the percentage of personal information in the population of individuals increases the time needed to retrieve it. For example, in the cases of 100 and 1000 context information, the execution time has respectively increased from 10ms (0%) to 30ms (100%), and from 15ms (0%) to 141ms (100%). The progression from 0% to 100% personal information had a quasi-linear impact on query run-time for all three cases (100, 1000, and 10 000 context information). When considering the worst-case scenario of 10 000 personal information describing the user in a single context, the process was able to retrieve it in less than 650ms. In the second scenario, we studied the impact of complex sensed information on performance. We considered a two-dimensional complexity, one increasing the number of sensed information from 1, 10, 50, to 100, and the other increasing the number of associated elements per sensed information from 0, 10, 100, to 500. For the associated elements, we considered random partitions between data values, sensing statuses, data consumers, sensors, and sensing events. We combined and executed queries 1 and 2 for this scenario. Figure 2.31 shows that the process maintained good performance for all complexity cases and the evolution of the query run-time is quasi-linear. When considering the case of 10 sensed information with 100 elements per information (most close to real scenarios), the time required to retrieve it was less than 100ms. The worst case was when having 100 sensed information with 500 elements per information (i.e., 50 000 individuals to retrieve), the process was able to retrieve all these information pieces with an average of 1s.

Environment Impact

Here, we checked the impact of having surrounding environments, with various levels of complexity, on performance. To do so, we considered a two-dimensional environment complexity, where the first indicates the number of sub-environments hosted by the environment (e.g., the user's home hosts 5 rooms), and the second states the number of associated individuals per environment/sub-environment. The individuals describe location maps with their associated locations, sensors, actuators, and devices deployed in the environment. We ran query 6 for this scenario and we measured the query run-time for each case. Figure 2.32 shows that increasing the complexity of the environment had a quasi-linear impact on the time required to retrieve the corresponding descriptions and components. Nonetheless, the information retrieval process maintained good performance for all cases, which highlights the ability of the ontology to handle complex environments. If we consider the case of 1 environment with 100 individuals that characterize it (quasi-real scenario), the time required to retrieve the environment characteristics was less than 40ms. The worst case was that for 100 environments (i.e., 1 environment that contains 99 subenvironments) with 500 describing individuals per environment, the process was able to build a view of all environments in an average of 1s.

Context Impact

Previous tests were conducted by considering controlled scenarios of information partitioning. We aim in this test to create random scenarios and study the impact of various contexts on performance. To do so, we varied the size of the context from 1, 5, 10, 50, 100, 500, 1000, 5000, to 10 000 describing information. Then, we considered for each context size three scenarios of random information partitioning between the user and the environment. We ran query 8 for this test. According to Figure 2.33, the information partitioning per context had no impact on the query run-time. This is due to the fact that all context information are individuals regardless of their semantics, and each modeled individual has at least one associated relation, so the overall number of modeled individuals and relations is closely similar for all three scenarios. Finally, the context size had a quasi-linear impact on the query run-time (cf. Figure 2.33). Nonetheless, the information retrieval process maintained good performance, even for large contexts of 10 000 information, where it was able to retrieve context information within an average time of 523ms. Discussion. The performance evaluation showed that adopted uCSN concepts and properties do not heavily impact the query run time, which remains quasi-linear.

Moreover, the uCSN ontology can handle various types of contexts, including complex ones from the user or/and the environment perspectives, while maintaining low computational complexity (i.e., in time). This highlights the feasibility of using uCSN for numerous context-aware applications, including those subject to real-time constraints.

Consistency Evaluation

Consistency is defined as a criterion that verifies if the ontology includes or allows any contradictions [START_REF] Staab | Handbook on ontologies[END_REF]. The formal and informal descriptions in the ontology must therefore be consistent. In order to evaluate consistency, we adopted the following SPARQL queries that search for anti-patterns in the ontology, a strong indicator of inconsistencies. Query 15 detects concepts with no parent, and Query 16 detects abnormally disjointed concepts in the ontology. Finally, to conclude the inconsistency evaluation, we ran Protege's HermiT 1.3.8.413 reasoner, and found no inconsistencies between the asserted class hierarchy and inferred one. results indicate that there are no concepts that have abnormal disjoint relations with their relatives. This underlines the soundness of our newly added and imported concepts, and therefore the soundness of the graph structure. This proves critical when considering future alignments between uCSN and other ontologies (e.g., domainspecific user/environment ontologies).

Chapter 3

Privacy Risk Inference

"Nothing in life is to be feared, it is only to be understood. Now is the time to understand more, so that we may fear less."

-Marie Curie

With the rapid expansion of smart cyber-physical systems and environments, users are becoming increasingly concerned about their privacy, and asking for more involvement in the control and protection of their data. However, users may not be completely aware of the direct and indirect privacy risks involved with exchanging data with data consumers to properly manage their privacy decisions.

Existing approaches of user privacy risk awareness suffer from several drawbacks, including: (i) no consideration of user contextual knowledge and its impact on data sensitivity, and thus on user privacy; (ii) lack of expressiveness in risk definitions to consider various simple/complex data combinations; (iii) lack of representation and serialization of data that are heterogeneous in terms of types, formats, sources, and semantics, to allow for holistic (all-data-inclusive) risk reasoning; (iv) lack of value-based reasoning; (v) lack of high-level risk detection that encompasses risks of various types and inferences; (vi) lack of an adaptable/user-friendly risk overview; (vii) lack of efficiency, performance-wise, to support the user in various contexts; and (viii) lack of re-usability in different application domains.

To address the aforementioned limitations, we propose in this chapter CaSPI, a context-aware semantic reasoning approach for dynamic privacy risk inference. This approach relies on the use of ontologies and inference rules for contextual knowledge representation and privacy risk definitions with high semantic expressiveness power. The risk inferences are thus achieved by performing rule-based reasoning over modeled context knowledge, which includes sensed data, as well as other background data about the user and her environment, with their relationships. CaSPI is generic and re-usable in different domains. Performance results showed that it provides scalability and computational and storage efficiency, making it able to assist the user in different contexts, including ephemeral ones.

Introduction

Advances in mobile and ubiquitous computing, such as the Internet of Things (IoT), have reshaped the lives of people over the last few years. Current applications of smart IoT-enabled cyber-physical systems touch almost all aspects of our daily life, including healthcare (e.g., patient and elderly monitoring), entertainment and leisure (e.g., smart entertainment spaces), transportation (e.g., vehicle networks, smart highways), environmental (e.g., energy management, pollution level monitoring), and work (smart manufacturing and work environments).

While such systems promise to ease our lives, they raise major privacy concerns for their users, as the data they collect is often privacy-sensitive, such as location of individuals, patients' vital signs, accelerometer data, and energy consumption data of environments (e.g., building, home). In fact, the processing and analysis of collected sensor data can lead to reveal a wealth of sensitive information about the user, such as her routines and habits, health conditions, political/religious affiliations, preferences, activities performed (general activities like running and driving, or domain-related activities like hand moving in the medical domain), and so forth [START_REF] Zhang | Security and privacy in smart city applications: Challenges and solutions[END_REF], [START_REF] Shilton | Four billion little brothers? privacy, mobile phones, and ubiquitous data collection[END_REF], [START_REF] Lisovich | Inferring personal information from demand-response systems[END_REF], [START_REF] Kwapisz | Activity recognition using cell phone accelerometers[END_REF]. This can cause serious harms for the user (e.g., mental, physical, dignity/reputation, financial, and societal harms) if the sensed data or disclosed information were misused by the providers of these systems, or even sold to interested third parties (with/without user consent) and exploited for various purposes.

Many studies (e.g., [START_REF] Kolter | User-centric Privacy: A Usable and Provider-independent Privacy Infrastructure[END_REF], [START_REF] Knijnenburg | Simplifying privacy decisions: Towards interactive and adaptive solutions[END_REF]) showed that users are becoming more and more conscious of their privacy and willing to play an active role in controlling their data.

This fact was also backed by the newly released privacy regulations (e.g., GDPR [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF], CCPA [13]) and standards (e.g., PbD [START_REF] Cavoukian | Start with privacy by design in all big data applications[END_REF], ISO/IEC 27701 [START_REF]for privacy information management -Requirements and guidelines[END_REF]), which call for more involvement of users in the control and protection of their data by enabling them to control what is collected, when, by whom, and for what purposes. Some works (e.g., [START_REF] Castelluccia | Enhancing transparency and consent in the iot[END_REF]- [START_REF] Chadwick | A privacy preserving authorisation system for the cloud[END_REF]) tried to deal with this requirement by enabling users to specify their privacy preferences and accept privacy policies that enforce these preferences.

However, the user may not be aware of the privacy risks associated with her data sharing to correctly specify her preferences in the first place. She may simply not know what can be inferred from her data when data bits and pieces are analyzed in isolation, or combined with each other and/or with other contextual data about the user or her surrounding environment, that could be acquired from external sources (e.g., social network profiles, public websites and databases).

To overcome this issue, several approaches [START_REF] Christin | Raising user awareness about privacy threats in participatory sensing applications through graphical warnings[END_REF]- [START_REF] Petkos | Pscore: A framework for enhancing privacy awareness in online social networks[END_REF] have been proposed to raise user privacy risk awareness in the fields of connected and web environments.

However, these approaches share the following limitations: (i) no consideration of user contextual knowledge and its impact on data sensitivity, and thus on the plausible inferences of sensitive information; (ii) lack of expressiveness in risk definitions to consider different combinations of sensed data together and/or with other contextual data, and their implications for the disclosure of sensitive information; (iii) lack of representation and serialization of heterogeneous data in terms of types, formats, sources, and semantics, to allow for holistic (all-data-inclusive) risk reasoning;

(iv) lack of value-based reasoning, the approaches are limited to general reasoning over attributes' names (e.g., location, blood pressure) and do not support reasoning over attributes' data values, constraints, and properties; (v) lack of high-level risk detection that encompasses risks of various types (i.e., direct and indirect risks) and sensitive information inferences (e.g., information describing the user profile and activity); (vi) lack of adapted risk overview to user expertise and interests; (vii) lack of efficiency, performance-wise, to support the user in various contexts; and (viii) lack of genericity and re-usability in different application domains.

Accordingly, we propose in this chapter a context-aware semantic reasoning approach for dynamic privacy risk inference, entitled CaSPI. This approach is capable of providing the user with a complete overview of the direct and indirect privacy risks that she accepts to take. Direct risks are those associated with the sharing of sensed data and that the user can control. Indirect risks are those imposed by the surrounding connected environment and on which the user has no control, such as being under a CCTV surveillance in a monitored area (e.g., airport, mall). To achieve this, CaSPI relies on the use of ontologies and inference rules to respectively represent the user contexts and define the risks to be detected with high semantic expressiveness power. For data representation, an ontology-based data model enables the representation of heterogeneous data (e.g., scalar and multimedia data) that could be acquired from different types of data sources (e.g., sensors, devices, social network profiles, public databases, documents). It also allows to represent the semantics of the relationships between data. For the risk definition, CaSPI features a generic semantic rule syntax for explicitly defining various types of risks, and considering diverse data combinations using basic and advanced operators (e.g., logical, spatio-temporal, semantic operators). For the risk inferences, CaSPI incorporates a semantic reasoner that performs rule-based reasoning over modeled context information in order to infer the privacy risks involved in the current situation of the user. In addition, it monitors the evolution of risks to cope with the dynamicity of the user context. CaSPI is generic and re-usable in numerous application domains.

To validate our proposal, we developed a prototype based on Semantic Web tools (e.g., OWL API, SWRL API, Pellet reasoner), and illustrated its functioning from both back-end and front-end perspectives. We also evaluated its performance in different scenarios. Our results showed that CaSPI delivers scalability and efficiency in time and space, which makes it able to assist the user in various contexts, including ephemeral ones (i.e., contexts with short time periods).

The remainder of this chapter is organized as follows. Section 3.2 presents a scenario that motivates our proposal and identifies the challenges to address. Section 3.3 evaluates existing approaches. Section 3.4 details the different modules of CaSPI and provides formal definitions of the key terms. Section 3.5 presents the implementation and experimental protocol. Finally, Section 3.6 summarizes the chapter.

Motivating Scenario

In order to motivate our proposal, consider the scenario presented in Chapter 1 that illustrates the situation of Alice who shares her energy-consumption and location data respectively with the electricity and healthcare providers. Alice is a COPD patient and follows her medical treatment from home using a NIV device (medical device). Even though Alice is notified, through agreed policies, of data consumers who have access to her data (i.e., service providers and third parties), she may not necessarily be aware of the privacy risks associated with this sharing. For instance, analyzing the energy consumption signatures of her home (cf. Figure 3.2 can lead to disclose numerous sensitive information about Alice related to her lifestyle and habits [START_REF] Pillitteri | Guidelines for smart grid cybersecurity[END_REF], including her presence/absence hours at home, waking/sleeping cycles, and activities performed at home with their time duration (e.g., cooking, watching TV, workouts using the treadmill). In addition, existing works (e.g., [START_REF] Lisovich | Inferring personal information from demand-response systems[END_REF]) showed that consumption signatures can be analyzed to identify the use of specific appliances and devices. This would reveal the disease of Alice if the use of her NIV machine was identified. The analysis of location data patterns (cf. Figure 3.2) can also entail significant risks for Alice such as the risks of disclosing her habits and routines, behaviors, health conditions based on frequent visits to hospitals, political/religious affiliations, and her identity based on her locations in personal environments (e.g., home, office) [START_REF] Shilton | Four billion little brothers? privacy, mobile phones, and ubiquitous data collection[END_REF], [START_REF] Krumm | Inference attacks on location tracks[END_REF]. insights and make it more valuable. However, this can expose users to other more complex privacy risks. For example, assume that Alice has unlawfully certified that she is living alone to be eligible for a welfare program when submitting her application. The parties that have access to both location and consumption data (e.g., marketing company) can infer this fraud (it is enough to identify the use of particular smart appliances, such as microwave, television, or coffee maker, while Alice is outside her home). Also, if Alice stated in her application that she is a teenager, collecting her date of birth from her Facebook profile or from the public voting records leads to infer the fraud. All the previous risks were direct risks that can be controlled by Alice as they are associated with her sensed data. However, Alice can be also exposed to other risks that are out of her control zone (i.e., indirect risks). For example, as shown in Figure 3.3, being under CCTV surveillance in a monitored area (e.g., malls, streets, airports) can lead to reveal Alice's presence in the area, her interests, activities, meetings, social relationships, and so on.

All of this highlights the need to inform Alice of the direct and indirect risks that she accepts to take, with or without her consent, in order to enable her to make informed privacy decisions. However, when considering various types of risks, data heterogeneity (e.g., scalar, multimedia) and semantics, user expertise, and the time constraints of user decisions, several challenges emerge. The challenges related to data heterogeneity and semantics were detailed and addressed in the previous chapter (cf. Sections 2.2 and 2.4). We focus here on the challenges related to risk definition, risk detection and monitoring, user expertise, and solution efficiency: Challenge 1. Increasing expressiveness in risk definitions: Contextual data (i.e., sensed and background data) can be processed and/or combined in many simple and complex forms, yielding a variety of sensitive information inferences for the user. The approach should therefore feature a generic syntax that allows the definition of privacy risks with high expressiveness power. This syntax must consider various types of data combinations, including combinations using: (i) basic operators, such as logical and comparison operators; and (ii) advanced operators like spatio-temporal operators that examine the spatio-temporal correlations among data elements, and semantic operators that accurately reflect the semantics of the relationships between them. In addition, it must consider different types of sensitive information that could be revealed about the user, such as information describing the user profile (e.g., age, marital-status, disease) and activity (e.g., habit, behavior).

Challenge 2. Performing a holistic (all-data-inclusive) risk reasoning: As discussed above, sensed data can be analyzed in isolation, or combined with each other (e.g., energy-consumption and location data) and/or with other background data acquired from external sources (e.g., social network profiles, public databases, documents). This improves the inference capability of data consumers, thereby enlarging the sphere of privacy risks. Consequently, the proposed solution must be capable of representing and serializing data that is heterogeneous in terms of type (e.g., scalar and multimedia data), metadata, and format. This paves the way for holistic reasoning over contextual data, including attribute-based and value-based reasoning.

Challenge 3. Coping with the dynamicity and context-dependency of privacy risks:

The sensitivity of data may depend on the user context [START_REF] Barhamgi | User-centric privacy engineering for the internet of things[END_REF], [START_REF] Varadharajan | Data security and privacy in the internet of things (iot) environment[END_REF]. For example, the sensitivity of Alice's location when she is in a hospital is higher than at home, as in this case location data could be used to infer the disease of Alice. Consequently, as context changes, new privacy risks may emerge, while others may disappear or lose in significance. Therefore, the proposed solution should keep track of context changes, analyze their impacts on privacy risks, and maintain an updated risk overview.

Challenge 4. Dealing with user expertise: People may have different levels of expertise when it comes to specifying their preferences and understanding their privacy risks. The proposed solution should be able to tailor the preference specifications and risk overview to the user's expertise. This ensures good quality of humanmachine interactions and allows all users to understand the privacy implications. Other challenges may also arise when considering privacy risk inferences, however, we focus in our research work on tackling the aforementioned ones.

Related-work

Several works were proposed in the fields of Connected environments and Web environments to tackle the challenges of user privacy risk awareness.

-Christin et al. [START_REF] Christin | Raising user awareness about privacy threats in participatory sensing applications through graphical warnings[END_REF] proposed a graphical-based warning approach to inform users about the risks of disclosing sensitive information about them in participatory sensing applications. They considered four types of attributes that can be shared by users: location, pictures, audio samples, and acceleration. They defined three levels of granularity (i.e., fine, medium, coarse) for each of these attributes, and associated a list of possible risks to each level. The approach does not include a risk detection mechanism; instead, it discusses some of the risks that might be associated with data sharing. The risks are represented through picture-based warnings, making them easily comprehensible by users. The approach does not cover the risks that may be generated when attributes are combined together and/or with other contextual information. The authors have tested their alerting approach by conducting a user study involving 30 participants.

-Wagner et al. [START_REF] Wagner | User interface design for privacy awareness in ehealth technologies[END_REF] provided a user-centric approach to create privacy-aware user interfaces for mobile eHealth applications. They focused on three classes of applications: fitness trackers, personal well-being applications, and medical applications. The approach features an Inform-Alert-Mitigate (I-AM) cycle that (i) informs users of potential privacy issues for each of these applications regarding privacy policies and permissions; (ii) considers the user's contextual information and alerts her about privacy risks that she exposes herself to; and (iii) provides the user with concrete actions that can mitigate the current risk-exposure. It considers the following attributes that could be collected by apps: identifiable (e.g., name, email), demographic (e.g., date of birth, gender), activity (e.g., location, time), nutrition, and medical attributes (e.g., heart rate). However, the authors only provided an overview of the I-AM cycle phases without going into detail about the process used to determine the risks involved for the user.

-Alrayes et al. [START_REF] Abdelmoty | Towards understanding location privacy awareness on geo-social networks[END_REF] examined the user awareness regarding the privacy risks associated with location data sharing in Geo-Social Networks (GeoSNs). They carried out user studies, in form of online surveys, to gauge users' perceptions to privacy threats as a consequence of recording their location information of GeoSNs. They addressed the following aspects in these studies: (i) the extent of users' awareness of the terms of use they agree to when using these applications; (2) their understanding and attitude to potential privacy implications; and (3) how they may wish to control access to their personal information on these applications.

For the privacy implications, the questions focused on evaluating users' awareness of plausible inferences about their private places, activities at different times, their connections to other users, and possible knowledge of this information by the applications. The approach does not feature a risk inference process, it only provides some recommendations for the design of privacy-sensitive GeoSNs.

-Alemany et al. [START_REF] Alemany | Enhancing the privacy risk awareness of teenagers in online social networks through soft-paternalism mechanisms[END_REF] proposed two soft-paternalism mechanisms in the form of nudges that provide information to the user about the privacy risk of publishing information on Social Networks. Privacy awareness refers to the users' knowledge about the potential audience that might see their publication disclosure. The first mechanism shows the profile images of users that are part of the potential audience that may have access to the message with a risk-level alert (e.g., low, high).

The second mechanism shows the number of users that are part of the audience that may have access to the message. The two mechanisms were tested with 42 teenagers in an online social network called PESEDIA. The results obtained suggest that the use of soft-paternalism mechanisms could be a suitable option to improve the decision-making process and prevent teenagers from privacy risk publications that could have negative consequences.

-Petkos et al. [START_REF] Petkos | Pscore: A framework for enhancing privacy awareness in online social networks[END_REF] proposed a scoring framework for raising user awareness in Online Social Networks (OSN) regarding the sensitive information that could be disclosed by OSN operators and other third parties that can access their data.

They identified eight categories of sensitive information, including demographics, psychological traits, sexual profiles, political attitudes, religious beliefs, health factors, location, and consumer profile. The data to be shared in OSN includes posted content (text, images), explicitly declared profile data, user network data, sets of likes, and so forth. The approach introduces a privacy scoring mechanism that enriches the sensitive information with several scores, each reflecting a different aspect of information disclosure. The overall privacy score is obtained by multiplying the scores of the following aspects: (i) level of confidence to infer the information; (ii) sensitivity of the disclosed information for the user; and (iii) visibility of the information to other people. Other aspects were also considered to enrich the scoring model, including (1) the information source (i.e., declared by the user or inferred); (2) the associated data in case of inferred information; and

(3) the level of control of the user on the information disclosure. The authors did not conduct experiments to showcase the applicability and effectiveness of their scoring approach. Their ongoing work focuses on developing a risk inference mechanism to complete the computational aspects of their framework.

Comparative Study

In order to compare existing works, we define the following criteria based on the challenges and needs discussed in Section 3.2. The criteria focus mainly on application domains, risk definition, data representation, risk inference, user expertise, and operational features of the approach. These are:

• Criterion 1. Application Domain: states the domain of application of the proposed approach (e.g., connected environments, social networks).

For the risk definition, we specify criteria related to the scope of attributes considered and the expressiveness of risks:

• Criterion 2. Attribute Scope. Checks information coverage when defining risks:

(2.1) Attribute Diversity: denotes {YES, NO} if the approach considers privacy risks related to numerous/diverse attributes of the user.

(2.2) Context Coverage: indicates {YES, NO} if the approach considers the user's contextual information when defining risks.

• Criterion 3. Expressiveness. Checks the ability of the approach to provide expressive risk definitions, i.e. to consider different/complex data combinations of various attributes together and/or with other contextual data when defining risks. This helps to broaden the coverage and improve the expressiveness of the risks associated with data sharing. We look at data combinations using basic and advanced operators:

(3.1) Basic Operators: states {YES, NO} if the approach considers basic operators (e.g., Logical operators) to combine data.

(3.2) Advanced Operators: states {YES, NO} if the approach supports advanced operators (e.g., semantic, spatial, temporal operators) to combine data.

For the data representation, we specify criteria related to data heterogeneity and data serialisation:

• Criterion 4. Data Heterogeneity: indicates {YES, NO} if the approach supports representation of heterogeneous data in terms of data types and metadata (i.e., scalar and multimedia data).

• Criterion 5. Data Serialisation: indicates {YES, NO} if the approach supports: (i) data extraction from diverse data sources (e.g., sensors, social network profiles, documents), having different serialization formats (e.g., json, rdf, pdf, docx, jpeg, mov); and (ii) data representation in a unified serialization format, allowing consequently the reasoning on heterogeneous data.

For the risk inference, we specify criteria related to the nature and level of control of the risks inferred, and the handling of attribute/value-based risk reasoning:

• Criterion 6. Risk Nature. Checks the nature of the risks inferred: (6.1) Identity Disclosure: denotes {YES, NO} if the approach identifies risks re- lated to the disclosure of the user's identity (i.e., risks of re-identification).

(6.2) Sensitive Information Disclosure: states {YES, NO, PARTI AL} if the approach identifies risks related to (i) the disclosure of the user-shared sensitive data by unwanted parties, and (ii) the disclosure of other SPI (cf. Section 1.2.1) about the user when processing her shared data.

• Criterion 7. Risk Control. Checks the ability of the approach to infer direct and indirect risks for the user:

(7.1) Direct Risks: denotes {YES, NO} if the approach identifies direct risks that can be controlled by the user, such as those associated with her data sharing.

(7.2) Indirect Risks: denotes {YES, NO} if the approach identifies indirect risks, i.e. risks related to the user but over which the user has no control (e.g., the risks imposed by the surrounding connected environment).

• Criterion 8. Reasoning. Checks the ability of the approach to handle attributebased or/and value-based risk reasoning:

(8.1) Attribute-based: indicates {YES, NO} if the approach performs risk reason- ing on attribute names and/or properties.

(8.2) Value-based: indicates {YES, NO} if the approach performs risk reasoning on data values of attributes (e.g., examines conditions applied to data values and/or properties).

In addition to the aforementioned criteria, we define other criteria related to the risk indicators delivered to the user and the operational features of the approach:

• Criterion 9. User Expertise: denotes {YES, NO} if the risk overview provided by the approach is tailored to the user's level of expertise.

• Criterion 10. Operational Features:

(10.1) Automation Degree: denotes {AUTO, SEMI, MANU AL} if the approach is respectively automatic, semi-automatic, or manual.

(10.2) Performance. We consider two sub-criteria:

(i) Scalability: denotes {YES, NO} if the approach is capable of performing over an increasing number of information and risks;

(ii) Efficiency: states {YES, NO} if the approach provides appropriate per- formance in terms of time behavior, resource utilization, and capacity in various scenarios.

Criteria

Christin et al.

[107]

Wagner et al.

[108]

Alrayes et al.

[109]

Alemany et al.

[ Discussion. All of the proposed approaches contribute to raising user awareness of the privacy risks associated with sharing their attributes. However, they all suffer from the same limitations. They lack re-usability as they focus on inferring risks related to specific user information in particular domains. The majority of them (i.e., [START_REF] Christin | Raising user awareness about privacy threats in participatory sensing applications through graphical warnings[END_REF], [START_REF] Abdelmoty | Towards understanding location privacy awareness on geo-social networks[END_REF]- [START_REF] Petkos | Pscore: A framework for enhancing privacy awareness in online social networks[END_REF]) do not consider the impact of user contexts on plausible inferences of sensitive information, despite the fact that data sensitivity varies across contexts, and thus the sphere of risks (cf. Challenge 4). They mainly focus on identifying the risks associated with processing each attribute separately, without considering the risks involved in combining and processing attributes' data together and/or with other contextual data. Only [START_REF] Christin | Raising user awareness about privacy threats in participatory sensing applications through graphical warnings[END_REF] addresses data heterogeneity from the perspective of considering risks associated with location data, pictures, audio samples, and acceleration data, without tackling the challenges of data representation. When it comes to risk nature, existing works mainly identify risks related to disclosing user-shared attributes by unwanted audience [START_REF] Wagner | User interface design for privacy awareness in ehealth technologies[END_REF], [START_REF] Alemany | Enhancing the privacy risk awareness of teenagers in online social networks through soft-paternalism mechanisms[END_REF], and revealing some of the user-related SPI when executing inference mechanisms on shared data [START_REF] Christin | Raising user awareness about privacy threats in participatory sensing applications through graphical warnings[END_REF], [START_REF] Abdelmoty | Towards understanding location privacy awareness on geo-social networks[END_REF], [START_REF] Petkos | Pscore: A framework for enhancing privacy awareness in online social networks[END_REF]. They consequently cannot be used to identify the risks of user reidentification through protected data patterns (e.g., anonymized/pseudonymized data) when data is processed and sometimes combined with other side information.

Moreover, none of them is capable of identifying the indirect privacy risks for the user, or performing a value-based risk reasoning. When considering the risk indicators delivered to the user, [START_REF] Christin | Raising user awareness about privacy threats in participatory sensing applications through graphical warnings[END_REF] and [START_REF] Alemany | Enhancing the privacy risk awareness of teenagers in online social networks through soft-paternalism mechanisms[END_REF] are capable of delivering simple/userfriendly indicators that could be comprehensible by all users. However, none of the works is capable of tailoring the risk overview based on the user's expertise.

Indeed, expert/advanced users may require a more detailed view of their privacy implications than non-savvy/beginner users, who prefer a summary of the main risks. Finally, none of these works includes experiments that evaluate the scalability and efficiency of the proposed solution in various scenarios. Table 3.1 details the comparison between the aforementioned works according to the defined criteria.

CaSPI Proposal

In this section, we detail our proposed risk inference approach, entitled CaSPI, which stands for Context-aware Semantic reasoning approach for dynamic Privacy risk Inference. CaSPI addresses all the needs and challenges specified in Section 3.2.

We start by describing the approach's functioning. We present after formal definitions of the key terms used in this study, and discuss the user profiles with their characteristics. Then, we detail the proposed rule syntax to define risks and the reasoning algorithm of our approach. which can be personalized by the user depending on her profile; and (3) the list of inference rules expressing the privacy risks to be detected. It launches consequently the rule-based reasoner over modeled data/information in order to infer the direct/indirect risks involved in the current context. The risks inferred are delivered as output (4) through an adaptive user interface according to the specified user profile and preferences. This allows all users, with different levels of expertise, to understand the privacy implications of sharing their data with data consumers (i.e., service providers and third parties) and their presence in the environment (cf. Challenge 5).

When a context change occurs (cf. Definition 4), the system computes the similarity between the current and historical contexts. If a full similarity is detected (cf.

Definition 4.1), the user is given the option of re-applying the actions of the previous similar context, or launching the risk reasoner. This contributes to reducing the computational cost of the global CaPMan system.

Context Representation

The quality of the risk inferences depends on the quality of the context coverage (i.e., coverage of data/information that characterizes the user's situation). The approach must consequently enable the collection and representation of various attributes' data describing the user and her surrounding environment, as well as the semantics of the relationships between them, in order to provide a high and expressive context coverage. The data collected is heterogeneous in terms of types and metadata (e.g., scalar and multimedia data), and can be of two categories: [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF] Let u denotes the user of interest.

Definition 1 (Data Node). Let DN be the set of data nodes {dn 1 ; ... ; dn n } that could be: (i) sources from which data is collected (e.g., sensors, devices, social networks); (ii) smart systems deployed in the user's environment (e.g., actuators, appliances); or (iii) data consumers with whom the data is shared (e.g., service providers, third parties). dn ∈ DN is formalized as follows:

dn : desc ; id , where:

• desc is the textual description of dn (e.g., GPS-sensor, Healthcare-provider).

• id is the identity of dn, expressed as a uniform resource identifier (URI).

Example 1. The sources of the data collected, describing Alice and her home, are the GPS sensor, energy-consump sensor, Facebook profile, and the public database of voting records:

sensor- . Let E u be the set of physical environments {env 1 ; ... ; env n } where the user u is/was located. env ∈ E u can be of two types: connected (i.e., hosts smart systems) or unconnected environment.

∀ env ∈ E u , env : desc ; sz ; Sys , where:

• desc denotes the textual description of env (e.g., home, office, mall, street)

• sz expresses the spatial zone of env (cf. Definition 3)

• Sys DN represents the set of systems (data nodes) deployed in env (e.g., sensors, actuators). For unconnected environments, Sys = ∅. Definition 3 (Spatial Zone). A spatial zone, sz, is defined as a geographical surface bounded by a set of distinct locations, where each is expressed by coordinates in space, such that: sz : loc 1 ; loc 2 ; ... ; loc n , where:

• loc is a location, defined as 3-tuple loc : long ; lat ; alt , where long, lat, and alt denote respectively the longitude, latitude, and altitude of loc.

Example 3. The home of Alice can be represented as follows:

environment-1: Home ; zone-1 ; Sys-1 zone-1: loc-1 ; loc-2 ; loc-3 ; loc-4 loc-1: -1.53245 ; 34.0132 ; 200.03 loc-2: -1.53310 ; 34.0140 ; 205.14 loc-3: -1.51025 ; 34.0581 ; 216.57 loc-4: -1.51090 ; 34.0571 ; 218.13 -Sys-1={sensor-2 ; device-1} device-1: NIV medical device ; http://64.17.15.2:5051/ Definition 4 (User Context). A user context, c ∈ C, is a spatio-temporal semantic context, defined as the finite group of information characterizing the user's situation within the respective space-time. Specifically, c ∈ C consists of: (i) the set of attributes' data and properties collected/known about the user, u, and her surrounding environment, env ∈ E u , within the relevant space-time; and (ii) the set of semantic relations expressing how these attributes are linked within the relevant space-time. c ∈ C is formalized as follows:

c : t ; s ; A ; Rel A
, where:

• t denotes the time period of c, defined as 2-tuple t : t start ; t end , where t start and t end are two time instants.

• s expresses the spatial zone of c (cf. Definition 3).

• A = {a 1 ; a 2 ; . . . ; a n } is the set of attributes characterizing c (cf. Definition 5), where each includes data that is either collected within {t; s} or previously collected but still valid within {t; s}.

• Rel A = {rel 1 ; rel 2 ; . . . ; rel m } represents the set of semantic relations between attributes {a 1 , ..., a n } ∈ A, such that:

∀ rel ∈ Rel A , rel ≡ rel(a i ; a j ) | {a i ; a j } A and i, j ∈ [1, n]
rel(a i ; a j ) is a unidirectional relation, with a primitive type of String, that specifies how attribute a i is linked to attribute a j .

A context change means a change in the user's situation. It occurs if at least one of the context parameters varies.

Definition 4.1 (Context Similarity

). Let c i , c j be two user contexts, such that {c i ; c j } C. The similarity between c i and c j is determined by computing the similarity between their groups information (i.e., c.A c.Rel A ):

sim c (c i , c j ) = sim c ( c i .A c i .Rel A ; c j .A c j .Rel A ) → [0; 1]
Where:

• sim is a unit similarity function that compares the exact match between attribute descriptions and described entities, as well as the exact match between the sets of semantic relations. sim returns a value ranging from 0 to 1, where 0 means that the two contexts are not similar and 1 means a full similarity.

sim(c i , c j ) = 1 only if:

   ∀a x ∈ c i .
A, ∃! a y ∈ c j .A : a x .desc = a y .desc and a x .ent = a y .ent c i .Rel A = c j .Rel A Definition 5 (Attribute). Let A be the set of attributes {a 1 ; a 2 ; ... ; a n } describ- ing the user u and her physical environments ∑ env ∈ E u . An attribute a ∈ A is formalized as follows:

a : desc ; ent ; Log ; access , where:

• desc denotes the textual description of a (e.g., location data, energy-consump data, user activities, profile images, home appliances).

• ent ∈ {u} ∪ E u denotes the entity related to a, which can be the user u or an environment env ∈ E u .

• Log = { d ; M } is the set of spatio-temporal data values of a. Log can be viewed as the log file of a, where:

d denotes the data value, which can be scalar (e.g., location, temperature, age, marital-status) or multimedia (e.g., image, audio, video).

-M = {meta 1 ; ... ; meta n } is the set of metadata characterizing d. For instance, M can include the following metadata:

* t capture , denotes the time of capture of d.

* l capture , denotes the location of capture of d.

* source ∈ DN, denotes the data source from which d is captured. source can derive from connected environments (e.g., sensor, device) or web environments (e.g., social media platform, public database).

* D consumer DN, represents the set of data consumers with whom d is shared (e.g., service providers, third parties), such that: D consumer = { dc 1 ; dc 2 ; ... ; dc n } ∪ {⊥} , where:

• dc i ∈ D consumer is a data node expressing a data consumer.

• D consumer = ∅ indicates that data consumers are unknown.

• D consumer = {⊥} denotes that a is a public attribute.

• access ∈ {r ; r/w} denotes the access rights of the CaPMan system to the data of a, which can be read or read/write. It expresses the level of control of the system over the data of a.

Definition 5.1 (Sensed Attribute). Let SA A be the set of sensed attributes, i.e. attributes characterizing sensed data by deployed/wearable sensors, and on which the CaPMan system has access to control and manage, such that: ∀a ∈ SA : a.access = r/w. In what follows, we represent previous definitions with their constraints using the formal Description Logic (DL) language [START_REF] Staab | Handbook on ontologies[END_REF] in order to clarify their integration in the data model in terms of uCSN classes and properties. DL is a popular knowledge representation language that provides logical formalism for ontologies and the Semantic Web. We do not represent here the user context (cf. Definition 4)

in DL since it consists of all the modeled individuals (i.e., attributes' data) and their relationships in the respective ontology file. The contextual attributes vary from sensed to background-oriented attributes (cf.

Definitions 5.1 and 5.2), such that A = SA ∪ BA. We represent next both categories of attributes with their properties using DL. The uCSN ontology considers also the representation of background data describing the characteristics of (i) devices deployed in the environment (e.g., fire/CO detection device deployed at home) or held by the user (e.g., mobile phone); and (ii) services provided to the user in exchange for her sensed data, such as the personalized energy-saving recommendations provided to Alice by the electricity provider (cf. Section 3.2).

Privacy Risk Definition

Following the modeling of the user's contextual data, the reasoner requires a reference schema that contains the list of inference rules on which it will rely to detect the privacy risks involved for the user. Nonetheless, the rule definition process is challenging due to the variety of risk types (e.g., direct/indirect risks), as well as the diversity of attribute/data combinations that may entail the disclosure of one or more sensitive information (cf. Challenge 1). To address this challenge, we propose next a generic and re-usable privacy rule syntax that allows the definition of various types of risks with high expressiveness power. This is achieved by considering different types of attributes/data combinations, including combinations through:

(i) logical operators to connect attributes, data, and constraints; (ii) comparison operators to assign conditions to data values; (iii) spatio-temporal operators to examine the spatio-temporal correlations among data values; and (iv) semantic operators that accurately reflects the semantics of attributes/data relations. One can therefore use the proposed syntax to define basic combinations of attributes and data, as well as more advanced combinations that consider the semantics of the relationships between them, which improves the quality of the risk definitions. In the following, we formally define a sensitive information, and a privacy rule.

Definition 6 (Sensitive Information). Let SI be the set of sensitive information {si 1 ; ... ; si n }, which expresses sensitive personal information about a user that could be disclosed when combining and/or processing her contextual data. Such a disclosure can cause serious harms for the user if misused (e.g., mental, physical, dignity/reputation, financial, or societal harms [START_REF] De | Priam: A privacy risk analysis methodology[END_REF]). si ∈ SI can be of two types: profile information (e.g., age, disease), or activity information (e.g., behavior, physical activity). The set SI can thus be formalized as follows: SI = Pro f ile Activity , where:

• Pro f ile represents the set of sensitive information characterizing the user profile, which may vary from generic to domain-specific information, such that: • Rule 6: A user is located in a public environment (e.g., mall, street) that hosts CCTV cameras. This raises the risks of inferring user presence/absence in the environment, her interests, and her activities in this environment. Enhancing the quality of the risk inference process necessitates not only expanding the coverage of direct and indirect risks, but also providing high-quality rule definitions. Indeed, the more we explore application domains, the more we discover combinations of attribute/data elements that lead to disclose sensitive information about a user. In addition, the privacy rules defined must be regularly updated in order to cope with evolution of data sensing and mining technologies. To overcome these problems, the CaPMan system collaborates with a group of privacy experts belonging to various application domains. This collaboration is done using an outsourcing solution that enables the privacy community to define various privacy rules using the proposed syntax, and update existing ones. It also checks the rules validity, and manages the rules conflicts and dependencies. The implementation of this solution and the tackling of associated challenges will be explored further in future work. At this stage, we consider that the expert-defined rules are pre-validated.

Pro f ile = Generic Medical Financial
The rule updates are thus imported regularly by the privacy rules component of the CaPMan framework and converted to the chosen semantic rule language (e.g., W3C

Semantic Web Rule Language [START_REF] Horrocks | Swrl: A semantic web rule language combining owl and ruleml[END_REF]) before being provided as input to the risk reasoner as shown in Figure 3.5. Attribute Ontology [START_REF] Klotz | Vsso: The vehicle signal and attribute ontology[END_REF], ontology for smart homes [START_REF] Alirezaie | An ontology-based contextaware system for smart homes: E-care@ home[END_REF], building topology ontology [START_REF] Rasmussen | Bot: The Building Topology Ontology of the W3C linked building data group[END_REF]). Thus, in addition to the generic rules, the system imports the rules related to the considered domains, and the associated ontologies are plugged into the generic uCSN ontology to ensure interoperability between inference rules and knowledge representation.

User Profiles

Users might have different levels of expertise when it comes to specifying their preferences (e.g., which sensitive information is significant for them), and understanding their privacy risks (cf. Challenge 4). The guided assistance must therefore be tailored to the user's expertise, which helps in improving the quality of user-system interactions. Consequently, we define in the following three user profiles:

• Beginner: The user is not familiar with her privacy, which means she does not know how to interpret what is sensitive for her and what is not; nonetheless, she asks for comprehensible descriptions of the risks she accepts to take.

• Intermediate: The user understands how to specify her preferences for sensitive information. However, she only requires a detailed overview of the significant risks to her (i.e., the risks associated with significant information inferences).

• Advanced: The user is expert in interpreting and analyzing her privacy situation. She can ask for full details about the significant and non-significant risks involved in her situation. that summarizes the current privacy situation, as well as a detailed risk overview using textual warnings, which includes the risks with their associated sensed data, sensitive information, and values. For an advanced, the system provides all intermediate options plus an optional detailed overview of non-significant risks.

CaSPI Reasoner

CaSPI employs a semantic reasoner that performs rule-based reasoning over modeled context information, based on the privacy rules imported, in order to infer the risks involved in the relevant user context. The reasoner is launched by default when a context change occurs, allowing continuous monitoring of the risk evolution to cope with the dynamicity of the user context (cf. Challenge 3). In the following, we formally describe the risk inference process and define a privacy risk. Then, we detail our proposed algorithm.

The risk inference process consists of executing the riskReasoner() function that • id ∈ N denotes the risk identifier.

• value ∈ [0; 1] denotes the risk value. The quantification of r.value is detailed in Chapter 4.

• SI = SI pr is the set of sensitive information associated with r.

• SA = {a 1 , ..., a n } (E pr c.SA) denotes the set of sensed attributes associated with r (i.e., stated in the set of elements of pr, E pr ).

The number of risks to detect when executing the riskReasoner() function depends on the number of privacy rules imported in this iteration, such that: |PR| = |R c | only if all pr ∈ PR are satisfied. The privacy risks detected are stored with their properties in the ontology file of the relevant context. They are modeled according to the following classes and properties represented in DL: ).

An additional description can be provided to each ucsn:SensitiveInformation, using the ucsn:hasDescription property, which helps in better expressing its meaning in the relevant context. On the other hand, a ucsn:PrivacyRisk may have one or more associated ucsn:SensedInformation (e.g., location, energy-consumption).

Reasoning Algorithm

Algorithm 1 presents the algorithm of the riskReasoner() function, which takes as input: (i) the ontology file comprising context information, contextFile; (ii) the array of privacy rules, PR; (iii) the user profile, pro f ile; and (iv) the list of sensitive information with their preference flags for the user, uSI. uSI is a two-dimensional array, where the first column contains the list of sensitive information (i.e., SI), and the second column contains the associated flags expressing user preferences, with a value of 1 if the information is significant for the user, and 0 otherwise. It is important to receive both significant and non-significant information as input, so that the system can provide advanced users with an additional insight into non-significant but taken risks (See Figure 3.6). For beginner/intermediate users, the preference flags allow filtering the privacy rules so that only those that lead to the disclosure of user-significant information are considered.

The algorithm outputs the array of privacy risks involved in the relevant user context, R c . This is done following five major steps:

• Step 1 (lines 3-4): It filters the array of rules (PR) before launching the reasoning process, to consider only:

(a) rules that are significant for the user (i.e., those involving at least one sensitive information of SI that is user-significant).

(b) rules including only the sensed attributes in the relevant context (i.e., ∀e ∈ E pr SA : e ∈ c.SA).

(c) rules comprised of only background-oriented attributes and data (i.e., expressing indirect risks).

To do so, it starts by extracting the list of sensed attributes from contextFile and stores it in the sensedAttribute array (line 3). This is done by calling the function getSensedAttributes(). Then, it calls the f ilterPrivacyRules() function that returns the filtered array of rules (line 4).

• Step 2 (lines 5-6): It calls the createRuleEngine() function that creates a rule engine instance based on the privacy rules considered, and maps it to the ontology file (line 5). Then, it calls the createReasoner() function that creates an ontology reasoner instance and maps it to the ontology file (line 6).

•

Implementation & Evaluation

In this section, we present the implementation phases of the CaSPI proposal from the back-end and front-end perspectives. Then, we evaluate the performance of the risk reasoner in multiple cases and we formally study its storage complexity.

CaSPI Implementation

In order to validate our proposal, we developed a Java-based prototype of the system using Semantic Web tools, such as OWL API, SWRL API, and Pellet reasoner, and we embedded it on the user's mobile device. As illustrated in Figure 3.7, the prototype collects and models the contextual data of the user (i.e., sensed and background data), as well as user inputs, which vary according to the selected profile In what follows, we illustrate how the prototype works in the back-end. Then, we present the front-end mockups of the associated mobile application. It is important to note that this application is currently under development. We only represent here the mockups of the respective user interfaces.

Back-end: Java-based Prototype

The goal here is to showcase how the system works and to highlight its ability to track the evolution of risks in response to changes in the user context (cf. Challenge 3). To do so, we consider the context describing Alice's situation in Section 3.2 as the first context, followed by two context changes.

• Context-1: Alice is located at home, shares her location data, sensed by GPS sensor of her mobile phone, with a healthcare provider, and shares the energyconsumption data of her home, sensed by a deployed energy sensor, with an electricity provider. Alice has a NIV device deployed at home. Other background data are also known about Alice, such as her date of birth, and marital-status. • Context-2: Alice continues to share the same data with consumers, but she is now located in a shopping mall that hosts surveillance cameras.

• Context-3: Alice leaves the mall two hours later. using the Semantic Web Rule Language (SWRL) [START_REF] Horrocks | Swrl: A semantic web rule language combining owl and ruleml[END_REF]. SWRL is a W3C recommended standard language that combines OWL expressivity with the Rule Markup Language (RuleML) to define rules. It can be roughly considered as the union of Horn-Logic and OWL based on the description logic SHOIN . SWRL allows for interoperability, re-usability, extensibility (through built-ins), and computational scalability [START_REF] Horrocks | Swrl: A semantic web rule language combining owl and ruleml[END_REF]. As explained by Fiorentini [START_REF] Fiorentini | An analysis of description logic augmented with domain rules for the development of product models[END_REF], SWRL provides association rules, that allows to associate new individuals to classes and create properties between individuals. The SWRL-based rule syntax follows the same structure of the one provided in Definition 7. We represent in the following PR 1 and PR 4 using SWRL. The remaining seven rules are included in the prototype source code.

PR 1 in SWRL syntax

A user is sharing her location data with a data consumer without any protection. This raises the risk of inferring her habits, behaviors and preferences.

ucsn:User(?u) ∧ ucsn:hasPersonalInformation(?u, ucsn:LOCATION) ∧ ucsn:hasDescription(ucsn:BEHAVIOR, "Behaviors of the user")

∧ ucsn:hasValue(?r, 1) ∧ ucsn:hasInference(?r, ucsn:HABIT)

∧ ucsn:hasInference(?r, ucsn:PREFERENCE) ∧ ucsn:hasInference(?r, ucsn:BEHAVIOR)

∧ ucsn:hasSensedInfo(?r, ucsn:LOCATION)

PR 4 in SWRL syntax

A user is sharing the energy consumption data of her home with data consumers without protection. This raises the risks of inferring her presence/absence, sleeping cycles, and home activities.

ucsn:User(?u) ∧ ucsn:Environment(?env) ∧ ucsn:hasDescription(?env, "Home") ∧ ucsn:hasDescription(ucsn:PRESENCE-ABSENCE, "User's presence/absence at Home")

∧ ucsn:hasDescription(ucsn:SLEEPING-CYCLE, "Sleeping cycles of the user")

∧ ucsn:hasDescription(ucsn:PERFORMED-ACTIVITY, "Home activities of the user")

∧ ucsn:hasValue(?r, 1) ∧ ucsn:hasInference(?r, ucsn:PRESENCE-ABSENCE)

∧ ucsn:hasInference(?r, ucsn:SLEEPING-CYCLE)

∧ ucsn:hasInference(?r, ucsn:PERFORMED-ACTIVITY)

∧ ucsn:hasSensedInfo(?r, ucsn:ENERGY-CONSUMP)

The system monitors the user's situation continuously and launches the risk reasoner by default when a change takes place. When launched in context-1, only rules PR 1 , PR 4 , and PR 5 are satisfied, generating consequently three privacy risks. The corresponding risk overview, R c , is illustrated in Figure 3.9. The sensitive information column includes the descriptions of the associated disclosed sensitive information, which are defined in the rules using the ucsn:hasDescription property. When the system receives information about the changed environment (i.e., context-2), it relaunches the reasoner and updates the risk overview based on the new inferences. Once Alice leaves the mall (i.e., context-3), the system detects the changes and the inference engine is relaunched. Figure 3.11 shows that the fourth risk detected in context-2 became negligible and was thus eliminated. Only the first three risks remains valid. The average time of the reasoning process is 1 ms in all three contexts.

Front-end: User Interfaces

The mockups of the mobile application user interfaces were designed using Inkscape graphics editor 1.0 4 . The user starts first by logging in to the application through the login page illustrated in Figure 3.12. The user can create her account automatically by syncing it to her Facebook or Google account, or she can register manually through the application. For each of these scenarios, the user must specify her privacy-aware level of expertise (i.e., Beginner, Intermediate, Expert) that will be assigned to her account (cf. Figure 3.12). Once logged in, the user is asked to select her currently sensed data, which may vary from generic user/environment data to domain-specific data (e.g., healthcare data). The user specifies the environment description (e.g., home, office) and selects the related sensed data. She can define several environments with the "add" button.

The user has the possibility to define new inputs of data and/or domains, which will be automatically taken into account for future specifications. Figure 3.13 illustrates the respective user interface. In the example of Alice, the data selected in her current context are her "Location" and the "Energy consumption" of her home. After specifying her sensed data, only an Intermediate or Advanced user has the option to personalize her sensitive information as shown in Figure 3.14. The personalization can be done by selecting predefined groups of information (e.g., ethnic information, public life information), which could be available in the default settings of the application or customized by the user. As well, the user can manually choose the instances of information that are sensitive to her regardless of their groups. The information instances vary from profile to activity information (cf. Definition 6).

On one hand, profile information can be generic (e.g., re-identification, age, gender, marital-status), or domain-specific, such as medical (e.g., disease, blood type, mental health), financial (e.g., bank account information), social (e.g., family, friends, associations), professional (e.g., salary, job), and so on. The user has also the possibility to define new inputs for each of these categories, as well as new domain categories. On the other hand, activity information are related to user habits, behaviors, performed activities, presence/absence, and so on. The user has also the possibility to define new inputs. For Alice, only the "Date of birth", "Age", "Marital Status", "Political

Affiliation", and "Preference" are significant from the generic category, as well as the full list of the medical profile and activity information.

Performance Evaluation

The objective here is to evaluate the ability of the approach, performance-wise, to operate in various scenarios, including worst case ones, and to meet the needs of scalability and efficiency (in time and space) outlined in Challenge 5. To achieve this, we start by considering three cases that measure the impact of the following metrics on performance: (1) the number of privacy rules imported by the system for a single reasoning iteration; (2) the number of risks to be detected in a single iteration; and

(3) the size diversity of the user context. Then, we formally study the storage complexity of the proposal. The performance is evaluated based on two criteria: the total execution time and memory usage of one iteration. The tests are conducted on a machine equipped with an Intel i7 2.80 GHz processor and 16 GB of RAM. The chosen execution value for each scenario is an average of 10 sequenced values. We select the peak value of the in-use memory for each scenario when measuring memory usage.

Case 1:

We study here the impact of privacy rules on performance by progressively increasing the number of rules imported by the system. We limit the context size to 100 individuals modeled with their relationships, and we consider a mixed list of satisfying/non-satisfying rules in the current context, such that only satisfying rules generate risks to the user. We execute the CaSPI reasoner 6 times, taking into account the following number of rules for each iteration: 1 (satisfying); 10 (5 are satisfying); 50 [START_REF]2011 Information technology -Security techniques -Privacy framework[END_REF]; 100 [START_REF] Khan | A framework for cloud-based contextaware information services for citizens in smart cities[END_REF]; 500 (100); and 1,000 (100). Figure 3.17 shows that the number of privacy rules has a quasi-linear impact on the total execution time, with an average of 2 s for 10 rules, 3.5 s for 50 rules, 5 s for 100 rules, and up to 27 s for 1000 rules. The evolution is similar for the RAM consumption (see in Figure 3.17 Case 3: We evaluate here the influence of the context size on performance, in terms of number of ontology individuals with their relationships. To do so, we limit the pool of rules imported to 100, including 50 satisfying rules (i.e., 50 risks to be detected for the user). We execute the CaSPI reasoner 8 times, taking into account the following number of individuals for each iteration: 1; 10; 50; 100; 500; 1,000; 5,000; and 10,000. Figure 3.19 shows that the context size has a quasi-constant impact on the total execution time up to 1,000 individuals with an average of 5 s, and then the evolution becomes quasi-linear with an average of 8 s for 5,000 individuals and 12 s for 10,000. The evolution of the RAM usage is quasi-linear (see in Figure PROOF. Let i denotes the maximum number of individuals and relationships that express the user context, and p the maximum number of privacy rules imported by the system. The amount of storage space required by the system is increased with the increase of input value, n = i + p, resulting in a linear storage complexity of O(n). Therefore, even in the worst case scenario of a large context size (e.g., 10,000 individuals) and a large number of rules (i.e., 1,000 rules), the system maintains a low storage complexity.

Discussion.

The experiments and studies conducted show that CaSPI is scalable, and maintains computational and storage efficiency (cf. Challenge 5). The solution is capable of operating and assisting the user in different scenarios, including worst case ones. This increases its re-usability for a variety of applications, including those requiring real-time assistance, and allows it to operate on a variety of devices, including those with limited resources.

Summary

In this chapter, we present a Context-aware Semantic reasoning approach for Privacy risk Inference (CaSPI). The approach is equipped with a semantic rule-based reasoner that is used to infer the risks involved in user contexts. To achieve this, CaSPI relies on the use of ontologies (e.g., uCSN ontology) and inference rules that respectively represent contextual knowledge and define the risks to be detected by the reasoner with high semantic expressiveness power. In order to define the rules, we introduce a generic rule syntax that enables the combination of sensed/background data using basic and advanced operators (i.e., logical, comparison, spatio-temporal, and semantic operators), and considers various types of sensitive inferences (e.g., re-identification, sensitive profile or activity information). CaSPI is generic and reusable in several domains. It is capable of providing the user with a complete and dynamic overview of risks to cope with the dynamicity of her context. The risk overview is tailored to the user's expertise, allowing all users to understand their privacy situations. We developed a prototype to validate our proposal and we illustrated its functioning from both back-end and front-end perspectives. We also evaluated its performance by considering multiple cases. The results show that our approach is scalable and achieves efficiency in terms of computation and storage, even in worst-case scenarios. This increases its re-usability to support the user in different contexts.

Chapter 4

Privacy Risk Management

"What gets measured, gets managed."

-Peter Drucker

In today's highly connected environments (e.g., IoT environments), multiple systems collect, exchange, store, and process large amount of fine-granular data in every aspect of life. Such detailed data improve the delivery of advanced services across a wide range of application domains (e.g., smart homes, cities, e-health).

However, the produced data is often privacy-sensitive for their users (e.g., location, blood pressure), and its analysis allows data consumers to deduce sensitive information about users, such as their behaviors, activities, preferences, and so on.

Therefore, users must be able to make appropriate data utility-privacy decisions based on their situations and interests, in order to meet their privacy needs while also maximizing the quality of services received in exchange for their data. However, involving users in the management of such trade-offs is challenging due to the: (i) variety of expertise levels of users to express their needs and preferences;

(ii) dynamicity of user contexts and the privacy risks involved; and (iii) complexity of reducing privacy risks to meet user needs without compromising main services.

This raises consequently the need for a solution that can assist users in optimizing their data privacy decisions. Nonetheless, such a solution must be adaptive, scalable and fast in order to support the user in various contexts.

To address these challenges, we propose in this chapter δ-Risk, a user-centric multi-objective approach for context-aware privacy management in connected environments. Our approach features a new privacy risk quantification model to dynamically calculate and select the best data protection strategies for the user based on her situation and preferences. Computed strategies are optimal in that they seek to closely satisfy user preferences, while also maximizing data utility and minimizing the cost of protection. We implemented our proposed approach, evaluated its performance in various scenarios, and formally studied its effectiveness. The results show that δ-Risk delivers scalability and efficiency (performance-wise). It also provides the user with at least one best strategy per context.

Introduction

Advances in the fields of ubiquitous computing (e.g., Internet of Things), sensing technologies, and Big Data have allowed the fast evolution of smart connected environments. These environments are equipped with Cyber-Physical Systems (CPS), such as sensor networks, capable of collecting and exchanging data that could be later mined and processed in order to provide advanced services. Current CPSbased applications are impacting numerous application domains including medical (e.g., patient and elderly monitoring), building/housing (e.g., increasing occupants' comfort, optimizing energy consumption), environmental (e.g., monitoring air and water pollution levels), and so on.

Providing smart services requires collecting massive amounts of sensor data, which are spatio-temporal in nature [START_REF] George | Spatio-temporal sensor graphs (stsg): A data model for the discovery of spatio-temporal patterns[END_REF], such as individual's location, patient's vital signs, and energy-consumption of user's home. However, collected data are often privacy-sensitive as their analysis exposes associated users to various privacy risks, such as the risks of disclosing their routines and habits, health conditions, behaviors, activities, preferences, and so forth [START_REF] Zhang | Security and privacy in smart city applications: Challenges and solutions[END_REF], [START_REF] Shilton | Four billion little brothers? privacy, mobile phones, and ubiquitous data collection[END_REF], [START_REF] Lisovich | Inferring personal information from demand-response systems[END_REF], [START_REF] Kwapisz | Activity recognition using cell phone accelerometers[END_REF]. This can be harmful for users if their data/information is misused by providers, sold to interested third parties, or stolen by cybercriminals as providers are often victims of cyber-attacks that lead to data/information breaches. Therefore, involving users in the control and management of their data privacy is currently receiving tremendous attention from both legal and technical perspectives (e.g., [START_REF] Vollmer | Table of contents EU General Data Protection Regulation (EU-GDPR)[END_REF], [13], [START_REF] Cavoukian | Start with privacy by design in all big data applications[END_REF], [START_REF]for privacy information management -Requirements and guidelines[END_REF]).

Nonetheless, achieving effective user involvement requires improving their privacy decision-making. To do so, we first focused on raising user awareness of the privacy risks they face by proposing CaSPI in the previous chapter, which provides a dynamic context-based risk overview tailored to the user's expertise. This allows all users to understand their implicit, direct and indirect privacy risks, and paves the way to make informed data privacy decisions. However, the interests and privacy needs vary from one user to another, and thus their privacy decisions. For instance, a user may agree to take the risks and share fine-granular data in order to benefit from all the services received in exchange for her data; nonetheless, another user may need to reduce the risks but without compromising the main services for her.

Users might not always know the appropriate data protection measures to apply in their situations. Indeed, over-protective measures limit the utility of shared data to eliminate the risks, but could also downgrade the accuracy of services. Underprotective measures may improve the accuracy of services, but might also lead to privacy breaches. Therefore, optimizing data utility-privacy trade-offs according to user needs, interests and contexts remains a key challenge to tackle. What makes it more challenging is that user-decisions must sometimes be fast (i.e., in real-time), and users may have different levels of expertise to express their needs and preferences. Therefore, the proposed solution needs to: (i) tailor the guided assistance to the user's expertise; (ii) adapt the optimal data utility-privacy decisions to cope with the dynamic nature of user contexts and preferences; and (iii) provide scalability and computational/storage efficiency, which allows it to assist the user in different contexts, and operate on a variety of devices, including those with limited resources.

To address the aforementioned needs and challenges, we propose in this chapter δ-Risk, a user-centric multi-objective approach for context-aware privacy management in connected environments. Our approach is capable of assisting the user in optimizing her data utility-privacy decisions, by providing dynamic and optimal data protection strategies according to her context and preferences. Each of these strategies intends to minimize the user's risks in a way to meet her interests and privacy needs, while also maximizing data utility and minimizing the cost of data protection. To achieve this, the approach involves a new privacy risk quantification model, that is used to calculate and select the best protection strategies. These strategies are the best combinations of data protection levels in the relevant situation. Each level expresses the amount of protection to add to the data of a specific sensed attribute before being released to data consumers. The assistance provided by our approach is adapted to the selected user profile, which may vary from beginner, intermediate, to advanced. To validate our proposal, we developed a Java-based prototype and illustrated its functioning from both back-end and front-end perspectives. We also evaluated its performance in different scenarios, and formally studied its effectiveness in strategy identification. The results show that δ-Risk delivers scalability and efficiency. In addition, it is always capable of: (i) identifying all possible strategies that satisfy the relevant data utility-privacy trade-off; (ii) delivering the best strategies; and (iii) providing at least one best strategy per context.

The rest of the chapter is organized as follows. Section 4.2 illustrates a scenario that motivates our proposal and identifies the challenges to tackle. Section 4.4 details our δ-Risk proposal and provides formal definitions of the key terms. Section 4.5 outlines the implementation phases and experimental protocol. Finally, Section 4.6 summarizes the chapter.

Motivating Scenario

We consider again the scenario describing Alice's situation, represent the associated overview of privacy risks, and consider a variety of interests/requirements for Alice, in order to highlight the need for dynamic adaptation of data utility-privacy decisions based on changes in the user context and preferences.

First, we remind the reader that Alice is a COPD patient and shares fine-granular energy consumption and location data with an electricity and a healthcare provider respectively, as illustrated in Figure 4.1. She receives several services in exchange for her data, which are respectively the list of personalized recommendations to reduce her energy consumption and bills, and other healthcare services (e.g., smart ambulance service). Once Alice is alerted, she may want to adapt her data privacy measures to reduce the risks. Nonetheless, such an adaptation can be difficult for her as it also affects the data utility, and thus the quality of associated services, which might be important to her as well. For instance, stop sharing her location data can lead to eliminate risk-1, but also to lose the health services received in exchange. Therefore, assisting the user in optimizing data utility-privacy decisions according to her situation and preferences becomes essential. However, when considering such assistance, the following needs emerge:

Need 1.
Coping with data diversity. The user can share a variety of sensed data with data consumers, which could be diverse in terms of attributes (e.g., location, temperature, camera recordings) and types (e.g., scalar and multimedia data). The risk manager should be capable of determining the appropriate levels of protection to assign to the data of diverse attributes when optimizing data privacy strategies.

Need 2. Quantifying privacy risks and the global risk level. The risk manager should be able to measure the impact of data protection on the risk values, and quantify the resulting global risk level for the user. This helps in optimizing the amount of protection to add in order to meet user preferences while also maximizing the quality of associated services.

Need 3.

Coping with the diversity of user preferences. The user preferences can be related to three different aspects: data privacy protection, risk level, and service importance. For example, Figure 4.3 describes three cases of preference specification by Alice. In case-1, Alice wants to have a full privacy protection. In case-2, Alice wants also to preserve the full quality of her health services. In case-3, Alice requires also to reduce the global risk level to 50%. Therefore, the risk manager should be capable of adapting the strategies to satisfy all user preferences of different aspects. has its computational cost that impacts the overall computational cost of the data protection process. Therefore, the risk manager should be able to consider the costs of associated protection functions when optimizing the data protection strategies in order to minimize the global cost of protection.

Need 5. Responding to user-time constraints. User decisions must sometime be fast (i.e., in real-time). The risk manager should consequently be fast when identifying the optimal data protection strategies.

However, when considering the aforementioned needs, the following challenges emerge:

Challenge 1. Coping with user expertise: People may have different levels of expertise to properly express their preferences and interact with the system. The proposed solution must therefore be user-friendly, allowing the guided assistance to be tailored to the user's expertise in order to maintain good quality of human-machine interactions.

Challenge 2. Dealing with the dynamicity and context-dependency of data protection strategies:

As user context changes, new privacy risks may emerge, while others may become negligible. As well, the user's preferences can change depending on her situation. Therefore, the proposed solution should always be capable of providing adaptive optimal data protection strategies to cope with the dynamicity of the user's context and preferences.

Challenge 3. Delivering scalability and efficiency:

The solution must be scalable, i.e., handles reasoning over an increasing number of sensed attributes and privacy risks. It should also maintain computational and storage efficiency in order to support the user in various contexts, and be operational on different types of devices, including resource-constrained ones.

Data Privacy Background

Data privacy has received extensive attention over the last decade. Existing functions for data protection vary from data perturbation to data restriction. Figure 4.4 illustrates a proposed classification of data protection functions, based on their perspective of protection. This classification consists of two major categories: data perturbation and data restriction functions. Data perturbation functions focus on modifying original data by either hiding sensitive parts of it leading to user reidentification, or distorting its value by injecting noise [START_REF] Fung | Privacy-preserving data publishing: A survey of recent developments[END_REF]. Accordingly, this category regroups anonymization and noise-addition techniques. Anonymization functions (e.g., k-Anonymity [START_REF] Sweeney | K-anonymity: A model for protecting privacy[END_REF]), l-Diversity [START_REF] Machanavajjhala | Ldiversity: Privacy beyond k-anonymity[END_REF], t-Closeness [START_REF] Li | T-closeness: Privacy beyond kanonymity and l-diversity[END_REF], CASTLE [START_REF] Cao | Castle: Continuously anonymizing data streams[END_REF])

focus on dissociating the link between data and related data owner, and preserving the full utility of the data value. To do so, anonymization operations mask the owner's identity from the data by removing explicit identifiers, and decreasing the granularity of quasi-identifiers using operations such as generalization and suppression [START_REF] Fung | Privacy-preserving data publishing: A survey of recent developments[END_REF], [START_REF] Aggarwal | A general survey of privacy-preserving data mining models and algorithms[END_REF]. Noise-addition functions focus on distorting the value of the original data by injecting additive noise. This impacts the utility of the data value, but preserves the link between data and related owner (this link is critical if the owner receives services in exchange for data). Random-noise [START_REF] Islam | Privacy preserving data mining: A noise addition framework using a novel clustering technique[END_REF], generalization [START_REF] Komishani | Pptd: Preserving personalized privacy in trajectory data publishing by sensitive attribute generalization and trajectory local suppression[END_REF],

data swapping [START_REF] Sharma | A review study on the privacy preserving data mining techniques and approaches[END_REF], and differential privacy [START_REF] Dwork | Differential privacy: A survey of results[END_REF] are examples of noise-addition functions. and/or manipulate data. Encryption functions (e.g., [START_REF] Fang | A survey of big data security and privacy preserving[END_REF], [START_REF] Barhamgi | Protecting privacy in the cloud: Current practices, future directions[END_REF]) vary from (i) secure multiparty computation (SMC) functions, focus on aggregating inputs of distributed entities to produce outputs while preserving the privacy of inputs; (ii) asymmetric/symmetric encryption functions, use encryption keys to protect released data; to (iii) public key infrastructure (PKI) functions, focus on delivering certificates to communicating entities in order to secure the identification process.

δ-Risk Proposal

In order to address the needs and challenges stated in Section 4.2, we propose in the following δ-Risk, a new user-centric multi-objective approach for context-aware privacy risk management in connected environments. δ is a privacy parameter that expresses the risk threshold, i.e., the maximum level of risk that the user accepts to take in her relevant situation. The objective of this approach is to assist the user in optimizing her data utility-privacy decisions, in a way to meet her preferences while also maximizing data utility and minimizing the cost of protection. Accordingly, δ-Risk provides a list of best protection strategies from which the user selects one to implement in her relevant situation. In addition to her privacy preferences, the approach considers also the interests of the user (e.g., which services are important to her), thereby making the strategies provided not only optimal but also meaningful. Consequently, δ-Risk outputs (5) the list of best data protection strategies that might be adopted in the relevant situation. The user (6) selects one of these strategies to be implemented, which remains valid as long as no changes occur in the entries. Finally, (7) δ-Risk transmits the chosen strategy to the data protection module of CaPMan, which is responsible for protecting sensed data values prior to its release to data consumers. The δ-Risk principle is defined as follows: the global risk level to maintain in the user context should not bypass the threshold δ. The δ value can be fixed directly by the user (if she wants to limit the maximum level of risk), or automatically computed when executing the risk manager in a way to maximize the user's privacy protection (i.e., δ is fixed at the lowest-possible value that satisfies user preferences in the current situation). In what follows, we formally define an impact matrix and a protection function.

Definition 9 (Impact Matrix). Let W c be the impact matrix, expressing the impact status of sensed attributes {a 1 , a 2 , ..., a m } of c.SA on risks {r 1 , r 2 , ..., r n } of R c . r. W c is automatically identified by the risk reasoner module of CaPMan after performing the risk reasoning process, such that:

W c =       ω 11 ω 12 . . . ω 1m ω 21 ω 22 . . . ω 2m . . . . . . . . . . . . ω n1 ω n2 ... ω nm      
, where

ω ij =    0 if a j / ∈ r i .SA 1 if a j ∈ r i .SA
We remind the reader that according to Definition 8, r : id ; value ; SI ; SA .

The impact status ω ij of an attribute a j on a risk r i is therefore equal to 1 only if a j is included in the set of attributes associated with r i .

Example 8. Alice is taking 3 risks in her situation, where the first is associated with her location data and the two others with the energy-consumption data of her home. The risk vector, set of sensed attributes, and impact matrix are consequently represented as follows:

R c . r = r 1 r 2 r 3 ; c.SA = {a 1 ; a 2 } ; W c =    1 0 0 1 0 1   
where a 1 (i.e., Location) impacts only r 1 , and a 2 (i.e., energy-consump) impacts r 2 and r 3 .

Definition 10 (Protection Function). A protection function, f ∈ PF, is a protection method that can be executed on data values of an attribute a ∈ c.SA prior to their release to data consumers. f is a local function stored in the CaPMan system, such that:

f : name ; categ ; Feature ; Param , where:

• name denotes the textual name of f (e.g., generalization, random-noise)

• categ represents the category to which f belongs, such that: categ ∈ {noise-addition ; anonymization ; access-control ; encryption}

• Feature is the set of features characterizing f , including at least:

cost, the computational cost of f in terms of processing time and memory overhead

• Param represents the set of input parameters of f , including at least:

-SA SA is the set of attributes to which f is associated -P is the set of protection levels to achieve for the data of attributes in SA

User Preferences

As previously stated, user preferences can range from privacy to service preferences.

From privacy standpoint, preferences can be related to: (i) the level of risk that the user accepts to maintain; or (ii) the level of data protection for specific attributes (e.g., 80% protection on location data). From service standpoint, the user can specify her preferences regarding the services important to her, allowing the risk manager to maximize the quality of the main services when optimizing the strategies. The preferences can be represented as follows:

• Privacy Preferences:

1. The risk threshold δ, with a value between 0 and 1, where 0 indicates that the user u requires maximum protection and does not accept to take any risk, and 1 means that u accepts to take all risks and share fine-granular data to preserve the full quality of services.

If the user does not specify a value for δ, this means that she wants to maximize her privacy protection while also considering the other preferences. δ should be accordingly fixed at the lowest possible value.

2. The data protection levels enforced for specific sensed attributes. Users can manually enforce specific protection levels to achieve for the data of related attributes prior to its release. Let eP denotes the set of enforced data protection levels. eP can also include protection levels extracted from pre-signed agreements with data consumers. It can be represented as follows: eP = {ep 1 ; ep 2 ; . . . ; ep m } , where:

∀i ∈ [1; m], ep i ∈ [0; 1] and ∃! a i ∈ c.SA : ep i ∼ a i
• Service Preferences:

3. The services important to the user, expressed by a value of 1 (or 0 if not).

Each of the services is associated with one or more sensed attributes. Let S denotes the set of services offered to the user in exchange of her data:

∀s ∈ S, s : SA ; li , where:

-SA c.SA represents the set of sensed attributes associated with s li denotes the level of importance of s to u. li has a primitive Boolean data type with a value of 1 if s is important and 0 if not

User Profiles

Even though the approach is capable of considering a variety of user preferences, people may have different levels of expertise to interact with the system, such as to correctly express their preferences and/or select one of the best strategies to implement (cf. Challenge 1). In order to overcome this issue, we extend the user profiles defined in Chapter 3 (cf. Section 3.4.3) in order to tailor the assistance provided to the user's expertise. We remind the reader of the three profiles defined:

• Beginner: The user is not familiar with her privacy, she does not know how to specify her preferences, interpret her risks and the protection strategies provided.

• Intermediate: The user understands how to specify her preferences related to sensitive inferences and services personalization, as well as limiting the maximum level of risk when needed. However, she only requires a detailed overview of the significant risks to her, and a short list of best protection strategy options.

• Advanced: The user is expert in specifying her preferences, interpreting and analyzing her privacy situation. She can ask for full details about the significant and non-significant risks involved in her situation, as well as more options of best protection strategies to choose from. to limit the level of user-interaction with the system, as well as the bunch of information provided, according to her profile. The level of user-interaction is expressed by a min-max number in Figure 4.6. We only discuss in what follows the additional characteristics for each profile. For all profiles, δ is by default free (i.e., not specified), which means that the user wants to maximize privacy protection. However, a beginner has the option to manually specify a value of 0 or 1 for δ only during a fixed time period, otherwise the system proceeds with the default δ (i.e., maximize protection).

The enforced data protection levels are only extracted from pre-signed agreements with data consumers (if exist). Finally, the system selects automatically one of the best protection strategies without requiring user intervention. An intermediate can manually specify a value for δ ranging from 0 to 1, and has the option to personalize important services to her. The enforced data protection levels are only extracted from pre-signed agreements with data consumers (if exist). Finally, an intermediate has to select one of the K-best strategies provided by the system during a fixed time period, otherwise the system selects one of these strategies and implements it. For an advanced, the system provides all intermediate options plus the possibility to enforce specific data protection levels for her sensed attributes.

δ-Risk Operations

After collecting user preferences, computing adaptive optimal data protection strategies to cope with the dynamicity of the user's context and preferences becomes a challenging endeavor (cf. Challenge 2). To address this challenge, the δ-Risk process consists of two operations: protection strategy identification and best strategy selection. Before detailing these operations, we start by formally defining a protection strategy, data protection level, and a best protection strategy. • wA = wa 1 ... wa m denotes the vector of weights assigned to attributes {a 1 ; . . . ; a m } of c.SA. Each wa i of wA expresses the weight of attribute a i ∈ c.SA, which is calculated based on the service preferences of the user. wa i is equal to the number of important services from the set S = {s 1 ; . . . ; s n } to which a i is associated:

Definition 11 (Protection Strategy

∀ i ∈ [1; m], wa i = n ∑ k=1 α k | α k =    0 if a i / ∈ s k .SA s k .li if a i ∈ s k .SA
• cPF represents the set of costs of the protection functions selected by the system to be executed on attributes of c.SA.

• Rank() expresses the ranking function. It takes as input a protection strategy p ∈ P c , the vector of weights, wA, and the set of costs of selected protection functions, cPF. It outputs the ranking score of p that is calculated according to the distance between p and wA, and the costs of the combined protection functions. • If no strategies result from this operation, this means that the combination of the privacy preferences (i.e., δ and eP) is inconsistent (cf. Definition 14). In this case, the system asks u to change one of these preferences and assigns a timeout period for this query: (1) if u fails to respond before the timeout expires, the system releases the value of δ, which leads to maximize the user-privacy protection; (2) otherwise, the first operation is re-launched while considering user changes.

• If this operation generates several protection strategies, the second operation proceeds with ranking the resulting strategies using the Rank() function, and selecting the K-best strategies to be proposed to u. Assume also that attributes a 1 and a 2 have the same weight, and the cost of the protection functions associated with a 1 and a 2 are respectively 2 and 1. When executing the Rank() function (detailed in Section 4.4.3.3), the score of p 2 will be higher than p 1 . p 2 will be therefore selected as the best strategy, which suggests applying 60% protection on data of a 1 and 30% on data of a 2 .

Determining appropriate combinations of data protection levels requires first to quantify privacy risks in order to study the impact of these levels on risk values; then, to quantify the global risk level (i.e., R c .v) in order to ensure that the resulting combinations satisfy the δ-Risk principle. Therefore, we begin by formally quantifying a privacy risk and the global risk level. Then, we detail the two δ-Risk operations.

Privacy Risk & Global Risk Level Quantification

Privacy risks (i.e., direct risks) have one or more associated sensed attributes. This means that increasing the protection of attributes' data will lead to minimize the risk values. Consequently, the risk vector r depends on the protection levels assigned to sensed attributes, p, and the impact matrix of attributes on risks, W c . This can be represented as follows:

r = F (W c ; p) (4.1)
Where:

• F is the risk quantification function, which takes an impact matrix and a protection vector as parameters, and returns the risk vector with the calculated risk values.

      r 1 .value r 2 .value . . . r n .value       = F            
p m            
Before exploring the risk quantification function (F ), we define the assumptions to consider:

1. A (direct) privacy risk has at least one impacting shared attribute a j ∈ c.SA. This means that:

∀ w i ∈ W c , m ∑ j=1 ω ij = 0 2.
If no protection assigned to attributes impacting r i , the risk value, r i .value, is equal to 1 (i.e., highest level).

3. If the full protection is assigned to attributes impacting r i , r i is negligible (i.e., r i .value = 0).

4.

The higher the protection level p j impacting r i , the lower the value of r i .

Attributes may have different values of impact on a single risk, ranging from 0 to 1. For example, two attributes may impact a same privacy risk, however, the impact value could be 40% for the first and 60% for the second attribute. The challenge of determining the impact value of a specific attribute on a risk is addressed in future work. In order to simplify the process, we consider in this study that attributes have the same value of impact on a privacy risk (e.g., if two attributes are impacting the risk, their impact values are equal to 0.5). Accordingly, we proceed with identifying the impact values of attributes on risks according to the impact matrix W c . Let W c denotes the matrix of impact values. W c is computed as follows:

W c =      
      | ∀i ∈ [1, n], ∀j ∈ [1; m], ω ij = ω ij m ∑ k=1 ω ik (4.2)
Privacy risks are therefore quantified as follows:

r = F (W c ; p) r = 1 -( W c × p) (4.3)       r 1 .value r 2 .value . . . r n .value       = 1 -            
   = 1 -       1 0 0 1 0 1    × 0.6 0.3    =    0.6 0.3 0.3   
After quantifying the privacy risks, we now focus on how to measure the global risk level in the user context, R c .v. This level is used to interact with the value of δ in order to determine whether or not it satisfies the δ-Risk principle. Accordingly, R c .v is equal to the maximum value of risk in R c . r. This can be formalized as follows:

R c .v = max       r 1 .value r 2 .value . . . r n .value       | R c .v ∈ [0, 1] (4.4)

Protection Strategy Identification

We detail in this section the first δ-Risk operation, which consists of identifying the appropriate protection strategies (cf. Definition 11) that could be implemented in the relevant user's situation. To achieve this, we start from the δ-Risk principle, which states that the global risk level to maintain (i.e., R c .v) should not bypass the threshold δ. Accordingly: R c .v δ To solve the resulted system, we use the Gauss-Jordan Elimination (GJE) method, an implicit pivoting strategy that performs row operations to convert a matrix into a reduced row echelon form [START_REF] Householder | The theory of matrices in numerical analysis[END_REF]. This method has been widely used in various domains to solve systems of linear equations, such as for traffic control management [START_REF] Nagarajan | Traffic control management using gauss jordan method under neutrosophic environment[END_REF], image change and climate prediction [START_REF] Shang | A new parallel paradigm for blockbased gauss-jordan algorithm[END_REF], [START_REF] Aouad | Parallel basic matrix algebra on the grid'5000 large scale distributed platform[END_REF], cluster and grid computing [START_REF] Shang | Large scale computing on component based framework easily adaptive to cluster and grid environments[END_REF], [START_REF] Aouad | Grid and cluster matrix computation with persistent storage and out-of-core programming[END_REF], and location privacy [START_REF] Xue | Location diversity: Enhanced privacy protection in location based services[END_REF]. Solving the linear system using the GJE method can result in three possible cases: (1) system is inconsistent, resulted when the δ/eP combination is inconsistent, which does not generate any solution;

ω n1 ω n2 . . . ω nm       ×       p 1 p 2 . . . p m       ) = δ ⇒           
(2) system independent, resulted when attributes are independent, which generates exactly one solution; and (3) system dependent, resulted when attributes are dependent, which generates an infinite number of solutions.

The inconsistency problem presented in case ( 1) is typically resulted when the system contains at least one equation that includes only enforced protection levels (i.e., {p 1 ; . . . ; p m } eP). This leads to limiting the options for δ to one possible value, and will therefore entail an inconsistency if the specified δ value by the user/system does not match the acceptable one. Definition 14 discusses this constraint. Definition 14 (δ/eP Inconsistency). Let {p 1 ; p 2 } be the protection levels to be assigned to attributes {a 1 ; a 2 } c.SA. Assume that risk r i of r is impacted only by {a 1 , a 2 }. The linear system will therefore include the following equation: ω 11 .p 1 + ω 12 .p 2 = 1δ. Accordingly, the δ/eP combination is said to be inconsistent only if: This is done following one major step that varies according to the δ value. Indeed, the process starts by checking the value of δ, which can be specified by the user (i.e., δ ∈ [0; 1]) or left empty (i.e., the user asks for maximizing privacy protection).

• Step 1 (lines 3-5): If δ is equal to 0 (line 3), this means that the user does not accept to take any risk and the data protection levels must consequently be at their highest levels. The process calls the createFullProtStrategy function that returns the full protection strategy, p = 1 1 . . . 1 (line 5).

• Step 2 (lines 6-8): If δ is equal to 1 (line 6), this means that the user agrees to take all risks and share fine-grained data in order to maintain the full quality of services received in return. The data protection levels should thus be left at their default values. The process calls consequently the createDe f aultStrategy function that assigns the enforced value to p j of p if p j ∈ eP, or a value of 0 if not (line 8).

• Step 3 (lines 11-17): If δ was not specified by the user (i.e., equals to NULL), this means that the user wants to maximize her privacy protection while considering other preferences. The process calls the getLowestPossibleDelta() function (cf.

Algorithm 2) accordingly, which returns the lowest-possible δ value that can be considered in the relevant situation. This function can return a value greater than 1 (line 14) if the linear system has generated inconsistencies for all possible δ values, which will outputs an empty array of strategies (line 17). Otherwise, the minimized value of δ ∈ [0; 1] is adopted and the process proceeds accordingly.

• * If dependency equals True, this means that attributes are dependent, and the system has an infinite number of possible solutions. The process calls accordingly the createDependentStrategies function (line 20), which starts by identifying existing dependencies among the unknown p j items. Then, it performs two operations on each dependent p j item. The first operation prioritizes the attribute of the selected p j , by assigning a 0 value to p j , which means that no protection is applied on a j . The second operation assigns a value of 1 to p j (i.e., stop sharing a j ), which gives priority to the associated dependent attributes. Next, both operations calculate the remaining p items that are dependent from p j . This function consequently identifies several appropriate strategies, where each emphasizes at least one dependent attribute.

-If inconsistency equals True (i.e., δ/eP combination is inconsistent), the process generates an empty array of strategies.

-Step 1.3 (lines 11-14): The process then filters the resulting array of strategies so that only the strategies with the highest score are considered. This will ultimately lead to strategies that include the lowest-possible protection levels assigned to attributes based on their importance to the user. These strategies are said to have the shortest distance to wA[].

• Step 2 (lines 15-18): It calculates the cost of protection of the resulting strategies.

The cost of a strategy is equal to the sum of costs of the protection functions associated to the attributes protected by this strategy (i.e., attributes having protection levels higher than 0 in the relevant strategy).

•

Implementation & Evaluation

In this section, we present the implementation phases of the δ-Risk proposal from the back-end and front-end perspectives. Then, we evaluate the performance of the risk reasoner in multiple cases, and we formally study its storage complexity and effectiveness in strategy identification.

δ-Risk Implementation

In order to validate our δ-Risk solution, we developed a Java-based prototype and embedded it on the user's mobile device. As illustrated in In what follows, we illustrate the prototype operation in the back-end. Then, we present the front-end mockups of the associated mobile application. It is important to note that this application is currently under development. We only represent here the mockups of the respective user interfaces.

Back-end: Java-based Prototype

We consider the privacy situation of Alice described in Section 4.2 to showcase how the system works. Figure 4.9 presents the overview of risks that has been resulted from the execution of the CaSPI reasoner (cf. Chapter 3). Assume that after alerting Alice about these risks, she adjusted her privacy preferences and accepted to take a maximum risk level of 60% in her current situation, as shown in profiles, if no value is specified for δ, the user asks therefore to maximize her privacy protection while also considering the other preferences. The user can access at anytime the summary of her global privacy situation interface illustrated in Figure 4.14, which includes the risk summary (i.e., risk number and global risk level) and the protection strategy selected. She can also change the strategy selected by clicking on the "select your protection strategy" button.

Performance Evaluation

The objective here is to evaluate the ability of the approach, performance-wise, to operate in various scenarios, including worst case ones, and to meet the needs of scalability and efficiency (in time and space) outlined in Challenge 3. To achieve this, we start by considering four cases that measure the impact of the following metrics on performance: (i) the number of privacy risks involved in a single user situation, |R c . r|; (ii) the number of sensed attributes in a single user situation, |c.SA|;

(iii) the level of dependency of sensed attributes in the impact matrix W c ; and (iv) the complexity of the strategy ranking process. Then, we formally study the storage complexity of the proposal. The performance is evaluated based on two criteria: the total execution time and memory usage of one iteration. The tests are conducted on a machine equipped with an Intel i7 2.80 GHz processor and 16 GB of RAM.

The chosen execution value for each scenario is an average of 10 sequenced values.

We select the peak value of the in-use memory for each scenario when measuring memory usage.

Case 1:

We study here the impact of privacy risks on performance by progressively increasing the number of risks inferred for the user in her situation. We limit the number of sensed attributes to 4, the level of dependency of attributes in W c to 4 (i.e., all attributes are dependent), the δ value to 0.6, the vector of weights wA = 1 2 1 2 , and the number of protection functions to 4 with the following costs cPF = {1, 3, 1, 1}. We execute the δ-Risk process 7 times, taking into account the following number of risks for each iteration: 1; 10; 50; 100; 500; 1000; and 2000. This consequently highlights the importance of using the GJE method to solve the linear system. It is important to note that in practice, the number of risks inferred in a given situation will not practically exceed Case 2: We investigate here the impact of user-sensed attributes in a single situation on performance. We limit the number of risks to 100, the maximum level of dependency of attributes in W c to 4 (i.e., each four attributes are dependent from each others), the δ value to 0.6, the vector of weights the vector of weights wA = 1 2 1 2 0 . . . 0 , and the number of protection functions to 4 with the following costs cPF = {1, 3, 1, 1}. We execute the δ-Risk process twelve times, taking into account the following number of sensed attributes for each iteration: We evaluate here the influence of the attribute dependency level on performance. To do so, we limit the number of sensed attributes to 50, the vector of weights wA = 1 2 1 2 0 . . . 0 , the δ value to 0.6, and the number of protection functions to 4 with the following costs cPF = {1, 3, 1, 1}. We execute the δ-Risk process six times, taking into account the following maximum levels of attribute dependency for each iteration: 1 (i.e., attributes are independent); 2; 4; 6;

8; and 10. According to figure 4.17, the number of sensed attributes has a quasiconstant impact on the total execution time, with an average of 1 s up to a maximum dependency level of 6. Then, the impact tends to be exponential with an average of 9s for a dependency level of 8, and 1227s for 10. The evolution is similar for the RAM consumption (see in Figure 4.17), with an average of less than 1000 MB up to a maximum dependency of 6, and then tends to be exponential, reaching an average of 9500 MB up to a dependency level of 10. However, it is important to note that it is almost impossible to combine more than six sensed attributes in order to reveal certain sensitive information about the user that could not be revealed otherwise. situation; and (iv) the number of appropriate strategies identified in the current situation. This results consequently in a linear storage complexity of O(n). Therefore, even in the worst case scenario of a large context size (e.g., 10,000 individuals/relationships) and a high number of risks (e., 1,000 risks), the system maintains a low storage complexity.

Discussion.

The experiments and studies conducted show that δ-Risk is scalable, and maintains computational and storage efficiency (cf. Challenge 3). In fact, in the worst case scenario of 1000 privacy risks, 50 sensed attributes with a maximum dependency level of 6, and 5 different protection functions assigned to these attributes, the solution is able to respond and provide strategies within an average time of 3 s and an average RAM space of 1200 MB. Nonetheless, if we consider a more quasireal scenario of 20 risks, 5 sensed attributes with a dependency level of 3, and 5 protection functions, the solution responds within an average time of 550 ms and an average RAM space of 180 MB. Therefore, our proposal is capable of operating and assisting the user in different situations. This increases its re-usability for a variety of applications, including those requiring real-time assistance, and enables it to operate on a variety of devices, including those with limited resources.

Effectiveness in Strategy Identification

In this section, we formally study the effectiveness of the δ-Risk proposal in identifying always the best data protection strategies for the user according to her situation and preferences.

THEOREM 3. The δ-Risk process is always capable of identifying all possible appropriate strategies in the current situation, { p 1 ; p 2 ; . . . ; p n } P c (i.e., strategies that meet R c .v = δ).

PROOF. The proof consists of two cases, namely a simple and a generic case. SIMPLE CASE. Consider that the user has only one sensed attribute, such that c.SA = {a 1 }. According to Assumption 1 stated in Section 4.4.3.1, all (direct) risks in- evitably impact the attribute a 1 , which means that W c is composed of a single vector with values of 1. Consequently, the resulting linear system consists of a single equation p 1 = 1δ (cf. Equation 2.6), generating one protection strategy p = p 1 = (1δ) , which will therefore constitute the best strategy to be deliv- ered, bp = p = (1δ) . GENERIC CASE. Consider that the user has m sensed attributes in her context c, c.SA = {a 1 ; . . . ; a m }, and the number of risks inferred is n, R c . r = r 1 . . . r n . W c will therefore be a n × m matrix of {0,1} values expressing the impact of attributes of c.SA on risks of R c . r. According to Equation 2.6, this results in a linear system of n equations with m unknowns (i.e., p 1 ; p 2 ; . . . ; p m ). The process will consequently proceed to identify the appropriate strategies based on the value of δ:

• If δ = 0, this means that the user does not accept to take any risk and the data protection levels must be at their highest levels. All risks must consequently be eliminated, such that R c . r = r 1 . . . r n = 0 . . . 0 , which leads, according to Equation 2.3, to the full protection strategy bp = p = 1 . . . 1 .

• If δ = 1, this means that the user agrees to take all risks and share fine-grained data in order to maintain the full quality of services received in return. Consequently, no additional protection is needed, and the data protection levels should be left at their default values. The output will therefore consist of the following strategy: bp = p = p 1 ... p m , where:

∀j ∈ [1; m], p j =    0 if p j / ∈ eP val ∈ ]0; 1] if p j ∈ eP, such that p j = val
• If δ is not specified by the user (i.e., equals to NULL), this means that the user wants to maximize her privacy protection while also considering other privacy preferences (i.e., the enforced data protection levels). Accordingly, the process identifies the lowest-possible value for δ that meet current needs.

-If the process fails, which occurs when the linear system generates inconsistencies for all considered δ values due to the δ/eP combination (cf. Definition 14), the process outputs in this case an empty array of strategies (i.e., P c = ∅). Following that, the user is asked to adjust her privacy preferences, and a timeout period is assigned to this task. If the user fails to respond before the timeout expires, the system sets the value of δ to 0, and the full protection strategy is implemented.

-Otherwise, the identified value for δ is adopted in the current situation, and the process proceeds accordingly.

• If δ ∈ ]0; 1[, this means that the user agrees to take risks to preserve as much as possible from the quality of services received in exchange for her data, however, the risk values should not bypass the specified threshold (i.e., δ). Accordingly, the process identifies all possible appropriate strategies that optimize the data utility-privacy trade-off (i.e., strategies that meet R c .v = δ) using the Gauss Jordan Elimination method to solve the linear system, such that: The process results in three possible cases:

     
1. System is inconsistent, which occurs when the δ/eP combination is inconsistent (cf. Definition 14). At this stage, the user is asked to either release the value of δ (if specified) or one of the impacting p ∈ eP. The δ-Risk process is re-launched accordingly with the updated δ/eP, or with δ = 0 in the case when the assigned timeout period for this task expires without user response.

2. Attributes are independent, and the system has a unique solution:

M =       1 0 . . . 0 v 1 0 1 . . . 0 v 2 . . . . . . . . . . . . . . . 0 0 . . . 1 v m      
This yields a single appropriate strategy, which will thus constitute the best strategy to deliver: bp = p = v 1 v 2 . . . v m .

3. Attributes are dependent, and the system has an infinite number of solutions:

M =      
∃ α i ∈ M and ∃ j, k ∈ [1; m] : α ij × α ik = 0
At this point, the process iteratively assigns the lowest protection level (i.e., 0) to each dependent attributes (e.g., a j , a k ) and calculates the remaining protection levels according to the matrix of dependencies M. After, it repeats the same iterations but with a value of 1, which stands for the highest protection level. When completed, the process identifies several appropriate strategies, { p 1 ; p 2 ; . . . ; p n } P c , where each emphasizes at least one dependent attribute.

Therefore, for all δ values, the process is always capable of calculating all possible appropriate strategies that lead to optimizing the data utility-privacy trade-off in the current user situation. THEOREM 4. The δ-Risk process is capable of always selecting the best data protection strategies to be delivered to the user. PROOF. After identifying all possible appropriate strategies, the process executes the ranking function, Rank(), in order to select only the best ones, which stands for the strategies that best meet user preferences and minimize the cost of protection.

The Rank() function ranks the strategies according to the service preferences of the user (i.e., wA) and the costs of the selected protection functions (i.e., cPF). It assigns the highest ranking score to the strategy with the shortest distance to wA and the lowest cost of protection. Therefore, for each δ value:

• If |P c | = 1, the identified strategy is automatically chosen as the best one.

• If |P c | > 1, the process ranks the strategies and selects the K-best ones to be delivered to the user.

THEOREM 5. δ-Risk provides the user with at least one best data protection strategy per context.

PROOF. As proved in the preceding theorems, the process is capable of providing at least one best strategy in all existing cases.

Summary

We present in this chapter our proposed user-centric multi-objective approach for context-aware privacy management in connected environments (δ-Risk). This approach features a new privacy risk quantification model to dynamically calculate and select the best data protection strategies for the user based on her preferences and contexts (e.g., involved risks). Computed strategies are optimal in that they seek to closely satisfy user requirements and preferences while maximizing data utility and minimizing the cost of protection. We developed a prototype to validate our proposal and illustrated its functioning from both back-end and front-end perspectives. We also evaluated its performance by considering multiple cases, and formally studied its effectiveness in strategy identification. The results show that δ-Risk delivers scalability and efficiency, making it capable of supporting the user in a variety of contexts, including ephemeral ones, and providing her with at least one best strategy per context.

Chapter 5

Privacy-preserving during Protection Transitions

"Inference is always an invasion of the unknown, a leap from the

known." -John Dewey

Advances in privacy-enhancing technologies, such as context-aware and personalized privacy models, have paved the way for successful management of data utility-privacy trade-offs. However, significantly lowering the level of data protection when balancing utility-privacy to meet the individual's needs makes subsequent protected data more precise. This increases the adversary's capability to reveal the real values of the previous correlated data that needed more protection, making existing privacy models vulnerable to inference attacks.

To overcome this problem, we propose in this paper a new stochastic gradient descent solution for privacy-preserving during protection transitions, denoted P-SGD.

The goal of this solution is to minimize the precision gap between sequential data values when decreasing data protection by the privacy model. P-SGD intervenes at the protection descent phase and performs an iterative process that measures data dependencies, and gradually reduces protection accordingly until the desired protection level is reached. It considers also possible changes in protection functions and studies their impact on the protection descent rate. We validated our proposal and evaluated its performance. The results show that P-SGD is fast, scalable, and maintains low computational and storage complexity.

Introduction

The rapid expansion of cyber-physical systems and the technological advances in sensing technologies and data mining techniques have contributed to the tremendous development of smart people-driven applications. These applications tend to reshape the lives of people in many domains by providing them with advanced services (e.g., increasing comfort, monitoring patients and elderlies). Delivering such services requires collecting and processing massive amounts of data (e.g., location data, health data) to discover underlying patterns and trends. However, privacy concerns hinder the wider use of this data especially as data mining and processing may give rise to serious privacy risks for application users, such as disclosing their health conditions, habits, activities, and so forth [START_REF] Zhang | Security and privacy in smart city applications: Challenges and solutions[END_REF], [START_REF] Lisovich | Inferring personal information from demand-response systems[END_REF], [START_REF] Kwapisz | Activity recognition using cell phone accelerometers[END_REF].

Consequently, balancing trade-offs between data utility and privacy protection has been subject to intense study in recent years [START_REF] Chamikara | An efficient and scalable privacy preserving algorithm for big data and data streams[END_REF]- [START_REF] Pingley | Cap: A context-aware privacy protection system for location-based services[END_REF]. Current context-aware privacy solutions [START_REF] Pingley | Cap: A context-aware privacy protection system for location-based services[END_REF]- [START_REF] De Matos | Providing context-aware security for iot environments through context sharing feature[END_REF], including our CaPMan proposal, as well as personalized privacy solutions [START_REF] Gao | Balancing trajectory privacy and data utility using a personalized anonymization model[END_REF], [START_REF] Qiu | Mobile semantic-aware trajectory for personalized location privacy preservation[END_REF], [START_REF] Xiong | A personalized privacy protection framework for mobile crowdsensing in iiot[END_REF] aim to maximize the usefulness of data by optimizing the level of protection according to data sensitivity in the current context and/or user preferences. However, these solutions do not consider the effect of temporal correlations between sequential data values on privacy loss. They assign the appropriate level of protection to the data according to the user's context (e.g., privacy risks involved) and/or preferences.

Nonetheless, continuously balancing data protection levels without considering previous protection patterns may entail temporal privacy leakage. In particular, this leakage occurs when the protection level significantly decreases, which widens the precision gap between prior/subsequent correlated data and makes subsequent data more precise. The large gap in precision improves the capabilities of an adversary, when using advanced mining techniques, to reveal the real values of prior data pieces that required more protection. This makes existing privacy-preserving solutions vulnerable to data inference attacks. A data inference attack is a data mining attack in which adversaries are capable of estimating/inferring real values of protected data with high confidence. One of the possible solutions to overcome this vulnerability is to integrate a gradient descent mechanism at the protection descent phase. This helps to reduce the precision gap between sequential protected data when downshifting the protection level. Gradient descent is a general paradigm that underlies algorithms for solving optimization problems [START_REF] Han | Privacy-preserving gradient-descent methods[END_REF]. It has been widely applied to many fields such as location-based applications for predicting moving destination [START_REF] Wang | Moving destination prediction using sparse dataset: A mobility gradient descent approach[END_REF], differential privacy [START_REF] Shin | Privacy enhanced matrix factorization for recommendation with local differential privacy[END_REF], and personalized privacy [START_REF] Meng | Towards privacy preserving social recommendation under personalized privacy settings[END_REF]. Nonetheless, to the best of our knowledge, there has not been any work on securing data protection transitions using gradient descent.

The implementation of a gradual descent process for data protection levels is challenging, as the corresponding deviation rate depends on several dynamic factors. First, the temporal correlations between sequential data values, which may vary from sequence to sequence as the data can be generated in regular or irregular time series. Second, the dynamicity of the protection function chosen by the system to be executed on data values. In fact, the system can change the data protection function at the protection transition phases with a view to improving protection, reducing the cost of protection (i.e., computational costs), or due to errors in function operations. However, the protection functions can share similarities in their operations (e.g., generalization and random-noise functions add noise to the real value of data), making it important to consider their dependence and its impact on the protection deviation rate. What makes it more challenging is the need for a fast and low complex solution, which makes it re-usable by various privacy models, including those offering real-time protection, and operational even for resource-constrained devices. Finally, the solution should follow a non-deterministic descent to avoid revealing the deviation rate by adversaries in case of repeated descent patterns.

To address these challenges, this chapter introduces P-SGD, a stochastic gradient descent solution for privacy-preserving during protection transitions. P-SGD empowers existing privacy models against data inference attacks, by minimizing the precision gaps of sequential protected data values during the protection descent phase. It follows an iterative process to identify the appropriate protection level to be assigned to each transitional data until the targeted level is reached. Computed protection levels consider the temporal dependencies between data values and the dependencies between protection functions (in case of change). Our solution is generic (i.e., it handles attributes with different data types and formats), and supports simultaneous reasoning over multiple attributes. We validated our proposal and evaluated its performance. Results show that P-SGD is fast, scalable, and maintains low computational and storage complexity.

The rest of the chapter is organized as follows. Section 5.2 presents the motivating scenario. Section 5.3 details our P-SGD proposal and provides formal definitions of the key terms used. Section 5.4 outlines the experiments and results. Section 5.5

presents an overview existing privacy models to which our proposal can be connected (i.e., context-aware and personalized privacy models). Finally, Section 5.6 summarizes the chapter.

Motivating Scenario

To motivate our proposal, we consider here a second scenario for Alice. We remind the reader that Alice is a COPD patient, and shares her location data with a healthcare provider to benefit from an emergency care system that offers healthcare services (e.g., smart ambulance service that she would use in case of respiratory distress). Alice also shares her location data with several other service providers in exchange for their services through applications and social media platforms (e.g., Facebook, Google Maps).

The trust relationship between Alice and the providers may vary greatly due to many factors, such as the privacy risks associated with the sharing of data, the sensitivity of her context (e.g., private meeting), or the third parties with whom her data is communicated. Alice may therefore want to protect her privacy in some situations but without completely losing associated services. To do so, she uses a contextaware privacy-preserving system (e.g., CaPMan) that optimizes the data protection according to her contexts and preferences.

Consider that Alice has a medical appointment at the Belharra-Ramsay center for her COPD treatment. She takes the road from her home to the treatment center.

However, locating Alice in the pulmonary rehabilitation center can entail the disclosure of her health condition, which involves privacy concerns for her. Accordingly, assume that the privacy system increases data protection to 80% when Alice arrives at the center, and then shifts the level of protection to 20% when she leaves. The system protects sensed data using a generalization-based protection function. In the following, three cases are considered to highlight the impact of the second protection transition phase (from 80% to 20%) on privacy loss. As previously mentioned in Section 5.1, the system can change the protection function to be executed on data at the protection transition phase. In case-2, illustrated in Figure 5.2, the system changes the function when the protection level shifts to 20%, and adopts a randomization-based function that adds random noise to the real location positions. However, the generalization and randomization functions share similarities. They both add noise to the data, which makes them dependent, and the privacy issues related to lowering the protection level persist. This highlights the need to examine dependencies between protection functions and their impact on the protection deviation rate.

In the previous two cases we considered regular time series data. However, data can be also collected in irregular time series, i.e., the data collected follow a temporal sequence, but the measurements may not occur at regular time intervals. For instance, case-3 assumes that after leaving the medical center, the system has stopped sharing (protected) location data only for a specific time interval due to loss of connectivity with the GPS sensor (cf. Figure 5.3). When data sharing started again, the temporal distance between the last data shared and the current one has already exceeded the temporal granularity of the attribute (i.e., location). The two data pieces are thus independent and the adversary will not be able to link previous and subsequent location patterns. It is thereby important to measure the temporal correlations between sequential data and study its impact on data protection. The solution must be scalable, i.e., handles simultaneous reasoning over an increasing number of attributes. Moreover, it should maintain computational and storage efficiency, which increases its reusability to also include privacy models subject to real-time constraints, and makes it operational on a variety of devices, including those with limited resources.

P-SGD Proposal

Current context-aware and personalized privacy-preserving models (e.g., CaPMan) enable the variation of data protection levels based on user preferences and/or situations (e.g., privacy risks involved) in order to optimize the balancing of data utilityprivacy. However, these models perform direct shifting of the data protection level, which may lead in certain cases to temporal privacy leakage due to data correlations. In particular, the data privacy leakage occurs when significantly decreasing the level of protection, creating a significant gap in the level of precision between previous and subsequent data. This increases the ability of an adversary to reveal the real values of previous correlated data that needed more protection, entailing privacy concerns for the user.

In order to overcome this vulnerability, we propose P-SGD, a Privacy-based Stochastic Gradient Descent solution for privacy-preserving during protection transitions. Our solution addresses the challenges and needs mentioned in Section 5.2.

It operates during protection descent phases to minimize precision gaps between

sequential protected data values. To do so, P-SGD features an iterative protection descent process that identifies the appropriate data protection level (cf. Definition 12) to be achieved for each data piece prior to its release to data consumers. The process stops when reaching the targeted protection level, i.e., the one specified by the privacy model.

P-SGD supports attribute diversity, i.e., it is capable of operating for data of various sensed attributes (e.g., location, energy-consumption, camera recordings) with different data types (e.g., scalar and multimedia data). It also supports protection function diversity. In fact, existing protection functions vary from data anonymization, data perturbation using noise addition, privacy-aware access control to encryption (cf. Section 4.3). Each of these functions achieves differently the desired data protection level. This makes therefore our approach generic and compatible with numerous existing privacy models in various application domains. P-SGD can be plugged into the privacy model, as shown in Fig. 5.5, to provide an additional layer of protection against data inference attacks. Before delving into the process, we would like to remind the reader of some formal definitions that were provided in previous chapters and will be used next.

Specifically, the definitions of an attribute, sensed attribute, protection function, and a data protection level. However, we extend the attribute definition to take into account the standard time periods during which the data of attributes are dependent.

*Definition 5 (Attribute). Let A be the set of attributes {a 1 ; a 2 ; ... ; a n } describ- ing the user u and her physical environments ∑ env ∈ E u . An attribute a ∈ A is formalized as follows:

a : desc ; ent ; Log ; access ; τ , where:

• desc denotes the textual description of a (e.g., location data, energy-consump data, user activities, profile images, home appliances).

• ent ∈ {u} ∪ E u denotes the entity related to a, which can be the user u or an environment env ∈ E u .

• Log = { d ; M } is the set of spatio-temporal data values of a. Log can be viewed as the log file of a, where:

d denotes the data value, which can be scalar (e.g., location, temperature, age, marital-status) or multimedia (e.g., image, audio, video).

-M = {meta 1 ; . * D consumer DN, represents the set of data consumers with whom d is shared (e.g., service providers, third parties), such that: D consumer = { dc 1 ; dc 2 ; ... ; dc n } ∪ {⊥} , where:

• dc i ∈ D consumer is a data node expressing a data consumer.

• D consumer = ∅ indicates that data consumers are unknown.

• D consumer = {⊥} denotes that a is a public attribute.

• access ∈ {r ; r/w} denotes the access rights of the CaPMan system to the data of a, which can be read or read/write. It expresses the level of control of the system over the data of a.

• τ denotes the standard time period during which two data values of a are said to be time-dependent.

*Definition 5.1 (Sensed Attribute). Let SA A be the set of sensed attributes, i.e., attributes characterizing sensed data by deployed/wearable sensors, and on which the CaPMan system has access to control and manage, such that: ∀a ∈ SA : a.access = r/w. *Definition 10 (Protection Function). A protection function, f ∈ PF, is a protection method that can be executed on data values of an attribute a ∈ c.SA prior to their release to data consumers. f is a local function stored in the CaPMan system, such that: f : name ; categ ; Feature ; Param , where:

• name denotes the textual name of f (e.g., generalization, random-noise)

• categ represents the category to which f belongs, such that: categ ∈ {noise-addition ; anonymization ; access-control ; encryption} • Feature is the set of features characterizing f , including at least:

cost, the computational cost of f in terms of processing time and memory overhead

• Param represents the set of input parameters of f , including at least:

-SA SA is the set of attributes to which f is associated -P is the set of protection levels to achieve for the data of attributes in SA *Definition 12 (Data Protection Level). A data protection level, p, expresses the amount of protection to be achieved for the data values of an attribute a ∈ c.SA. p is probabilistic with a value between 0 and 1, where 0 means that data is shared in fine-granular version (i.e., without any protection), and 1 means that data is not shared (i.e., highest level of protection). A value between 0 and 1 indicates the level of protection that should be reached when executing a protection function f ∈ PF on the data of a. Knowing that the way to achieve p depends on the selected protection function.

A stochastic gradient descent (SGD) method is generally defined as an iterative method for optimizing an objective function with suitable smoothness properties [START_REF] Bottou | The tradeoffs of large scale learning[END_REF]. It has been widely adopted mainly for high-dimensional optimization problems as it reduces the computational burden, achieving faster iterations in trade for a lower convergence rate. This agrees with our needs listed in Challenge 4. We detail in what follows our proposed P-SGD method. ; p old i ]

The iterative process followed by P-SGD is thus defined by the following formula:

p current = p oldη , where:

(5.1)

• η represents the deviation rate of the protection level (the quantification of η is detailed in the following subsection)

• ∈ [0; 1] expresses the random noise added to η

We consider in this study that attributes are independent. The P-SGD process is therefore performed on the data values of each attribute separately. In order to track and measure the correlations in sequential data and the dependencies between their associated protection functions (cf. Challenges 1 and 2), we define a transition matrix, Trans, that contains only the properties of the last data value (i.e., d old i ) of each sensed attribute a i ∈ SA. We store only the properties of the last data values since the process operates iteratively. This reduces storage overhead and allows for scalability in attribute number (cf. Challenge 4). Trans denotes therefore the cache, and can be represented as follows: , of an attribute a i ∈ A. depend t has a value between 0 and 1, where 0 means that the data are time-independent, and 1 means that the data are fully dependent (time-wise), which typically occurs only when t old i and t current i are similar. The higher the temporal distance between the two data values is, the lower their time dependency is. The two data values are said to be time-dependent only if their temporal distance is less than the standard time period of their attribute a i (i.e., a i .τ). depend t is therefore computed as follows: • sim is a unit similarity function that checks the exact matching between the classes and the lists of features of the two protection functions, and returns a value between 0 and 1, such that:

Trans =      
depend t (
sim( f old i , f current i ) = 1 only if:

f old i .class = f current i
.class and f old i .Feature = f current i .Feature

The P-SGD process will therefore be executed only if the sequential data values are dependent and their associated protection functions are also dependent (i.e., only if depend = 0 and sim = 0). In order to quantify η, we consider the following principles:

1. The more the temporal distance between previous/current data values increases, the more the time dependency among these data values decreases, and the protection gap between them can be enlarged. Where:

• c i ∈ C is a system parameter that expresses the maximum deviation value of data protection level for attribute a i ∈ A. c i controls therefore the convergence speed of the protection level towards p target i

• sim( f old i , f current i ) is the similarity function that returns a score ∈ ]0; 1]

• depend t (d old i , d current i

) ∈ ]0; 1] is the temporal dependency score

P-SGD Algorithm

We present here the reasoning algorithm of our P-SGD solution. Algorithm 5 presents the algorithm of our P-SGD solution that takes as input the concerned attribute, a, the maximum deviation value of protection, c, the properties of the current data value (i.e., t current and f current ), and the targeted protection level p target . It outputs the calculated protection level to be assigned to the current data value, p current . This is done following four major steps:

• We only detail in this chapter the pseudo-code of the main P-SGD process. Nonetheless, the pseudo-codes of the aforementioned functions are detailed in the prototype source code provided in Section 5.4.

P-SGD Integration in CaPMan

As previously discussed, the P-SGD proposal is generic and can be connected to various privacy models, including our proposed CaPMan model. We detail in this section the integration of P-SGD in CaPMan. As shown in Figure 5.7, P-SGD is connected to the data protection module of CaPMan that is responsible for applying protection on data before being delivered to data consumers. The protection is added based on the protection strategy selected in the relevant user's situation. The data protection module receives as input: (1) the data values of sensed attributes;

(2) the strategy selected; and (3) the protection functions to be executed on relevant data of attributes. It calls the P-SGD process when the protection level to be assigned to the data of an attribute is decreased, which typically occurs when changing the protection strategy. Accordingly, the P-SGD process is iteratively executed for each data value upon its arrival in order to determine the appropriate protection level to achieve for this data prior to its release. Once identified, the data protection module applies the corresponding protection function to this data in order to achieve the identified protection level, and then outputs (4) the protected version of this data to related data consumers.

Experimental Validation & Evaluation

In order to implement and validate our approach, we developed a Java-based prototype (the source code is available online through this link 1 ). We illustrate in the following the prototype operation by considering the scenario of Alice described in Section 5.2. We focus on the second protection transition (i.e., from 80% to 20%), and assume that the protection function remains unchanged. We repeated the descent process three times to emphasize the non-deterministic nature of the solution in the case of repeated transition patterns (cf. Challenge 3). We consider here regular time series data with a data generation time of 1s, and we fix c at 0.5 (i.e., the maximum protection deviation is 50%). protection convergence (7 for transitions 1-2 and 8 for transition 3). This is due to the noise value associated with the deviation rate (i.e., ), which varies randomly with each iteration.

Performance Evaluation

The objective here is to evaluate the approach's effectiveness, in terms of performance, to operate in different scenarios. The approach is said to be effective if it meets the needs outlined in Challenge 4: (1) fast; (2) scalable (i.e., supports multiattribute handling); and (3) low-complex in time and space (i.e., in terms of memory overhead and storage). To do so, we start by considering two cases to study the impact of the following two metrics on performance: (i) the complexity of the Discussion. The experiments conducted show that P-SGD is scalable and efficient in time and space (cf. Challenge 4). The solution is able to maintain effective performance in different scenarios, including worst-case ones. This increases its reusability to also include privacy models that require real-time reasoning, and allows it to operate on a variety of devices, including resource-constrained ones.

Privacy Models Background

Several approaches have been proposed in the literature to address the challenges of security and privacy in the fields of pervasive Internet of Things (IoT) environments (connected environments). However, to the best of our knowledge, this is the first work to tackle the problem of preserving user privacy against data inference attacks during protection transitions. Therefore, we discuss in this section existing privacypreserving models to which our P-SGD solution could be connected.

Balancing data utility-privacy has received extensive attention in the last decade.

Existing approaches vary from context-aware to personalized privacy-preserving. In

Report Recap

The study presented in this thesis focuses mainly on privacy risk inference and management in connected environments.

In Chapter 1 we give the reader an insight on connected environments, and why privacy in the context of these environments is considered a topic of interest nowadays. Specifically, we discuss current privacy threats and challenges encountered in these environments, as well as existing international privacy regulations and standards. Then, we focus on our thesis's objectives of raising user awareness of the privacy risks involved in their situations, assisting users in the optimization of their data utility-privacy decisions based on their preferences and situations, and ensuring appropriate protection of the data collected before being transmitted to data consumers. We present a real-life scenario of a user situation and illustrate some of the privacy risks involved in this latter in order to showcase the motivation behind this work and the challenges that lie ahead. Following that, we review existing works of context-aware privacy management in connected environments according to the identified needs and challenges. Then, we present our proposed framework for Context-aware Privacy Management in connected environments (CaPMan) and detail its corresponding modules that answer the objectives and address the set of needs and challenges. Finally, we list the publications related to this report before introducing the following chapters.

In Chapter 2 we present an ontology-based data model for user-Context modeling in Sensor Networks (uCSN) where we improve the context representation to consider diverse types of: (i) user/environment information (i.e., scalar and multimedia information); (ii) data sources (e.g., sensor, device, social network profile, document); (iii) uncertainties (e.g., uncertainties related to the user and the environment); and (iv) environments (i.e., connected/unconnected environments, and environments with static/mobile systems and devices). We do so by defining new concepts and properties, and importing others from well-known ontologies, namely DPV, SSN, HSSN, and W3C Uncertainty ontologies. The uCSN ontology is generic and re-usable in different application domains. Finally, we evaluate the accuracy of our additions, their clarity, consistency, and the overall impact on performance.

In Chapter 3 we present a Context-aware Semantic reasoning approach for Privacy risk Inference (CaSPI). This approach is equipped with a semantic rule-based reasoner that is used to infer the risks involved in user situations. To achieve this, CaSPI relies on the use of ontologies (e.g., uCSN ontology) and inference rules that respectively represent contextual knowledge and define the risks to be detected by the reasoner with high semantic expressiveness power. CaSPI is generic and re-usable in several domains. It is capable of providing the user with a dynamic overview of risks that copes with the evolution of her situation and is tailored to her expertise. This allows all users to understand their privacy situations, paving the way for them to make informed data privacy decisions. We developed a prototype to validate our proposal, illustrated its operation from both the back-end and front-end, and evaluated its performance in several scenarios.

In Chapter 4 we introduce a user-centric multi-objective approach for contextaware privacy management in connected environments (δ-Risk). This approach features a new privacy risk quantification model to dynamically calculate and select the best data protection strategies for the user based on her situation and preferences.

Computed strategies are optimal in that they seek to closely satisfy user requirements and preferences, while also maximizing data utility and minimizing the cost of protection. We developed a prototype to validate our proposal and illustrated its functioning from both back-end and front-end perspectives. We also evaluated its performance by considering multiple cases, and formally studied its effectiveness in best strategy identification.

In Chapter 5 we propose a new stochastic gradient descent solution for privacypreserving during protection transitions (P-SGD). The proposed approach can be connected to numerous existing privacy models, providing an additional layer of protection against data inference attacks during protection transitions. P-SGD features an iterative non-deterministic process that gradually decreases the data protection level during the protection descent phases. It is capable of measuring data dependencies as well as similarity in protection functions, and adapt the descent rate accordingly. This allows preserving an appropriate precision gap between sequential protected data values, avoiding consequently potential data leakages. We developed a prototype to validate our proposal, and we evaluated its performance in multiple scenarios.

Future Research Directions

Various improvements still need to be considered for this work. We detail future research directions for each contribution separately.

Context Modeling in Connected Environments

Completeness Evaluation. We would like to continue the ongoing evaluation of the completeness of the uCSN ontology through comparisons with situation, user, environment, and mobility taxonomies. This evaluation will potentially help us discover missing concepts or properties that could complement uCSN.

Privacy Risk Inference

Privacy Rules Validity, Dependencies and Conflicts. We aim to address the challenges of verifying the validity of defined privacy rules, as well as the existing dependencies and conflicts between them. For the validity, we would like to consider two validation aspects: (i) testing aspect, which involves evaluating the accuracy of the defined rule in several different scenarios prior to its consideration by the CaSPI reasoner; (ii) human aspect, which involves checking and validating it by a group of privacy experts following the development of the outsourcing solution. In order to manage rule dependencies and conflicts, we would like to proceed with comparing existing rules by measuring the similarities between their related sequences of data elements, as well as the similarities of their associated sets of sensitive information.

Outsourcing Solution for Rule Definitions. We aim to develop and implement the outsourcing solution for the privacy rule definitions with a group of privacy experts in order to provide a high-level risk coverage in various application domains.

Privacy Rules Implementation. Current semantic rule languages (e.g., SWRL [START_REF] Horrocks | Swrl: A semantic web rule language combining owl and ruleml[END_REF]) presents some limitations when considering spatial, temporal, and logical operators (e.g., logical disjunction, negation) to define rules. We aim consequently to address these limitations by proposing a new built-in for the extensible SWRL language that enables the use of spatio-temporal and expanded logical operators.

CaSPI Evaluation.

Once the development of the mobile application is complete, we would like to extend the evaluation of the CaSPI proposal to also evaluate the time required by users of different profiles to interact with the application (e.g., inputs specification).

Inter-Context Risk Coverage. At this point, the CaSPI proposal reasons over each context separately (i.e., intra-context information reasoning), without considering inter-context patterns and their impact on the privacy situation of the user. For instance, a user located every Tuesday in a sports gym can lead to disclose her regular activity, and also to predict her future time of presence at home on Tuesdays. Such risks are not currently covered by our proposal. To overcome this limitation, we aim to improve the risk coverage, by allowing for the definition of inter-context privacy rules, and the reasoning over historical contexts to identify the plausible information patterns based on their time and spatial dependencies.

Privacy Risk Management

Privacy Risk Quantification. We would like to improve our risk quantification model to also consider the uncertainty aspects of information elements and their impact on associated risk values.

δ-Risk Evaluation. Once the development of the mobile application is complete, we would like to extend the evaluation of the δ-Risk proposal to also evaluate the time costs of user interactions with the application, such as to specify their inputs (e.g., preferences, sensed data), making their privacy decisions by choosing the protection strategy to implement, and so on.

Privacy-preserving during Protection Transitions

Data Dependency. Sensor data are spatio-temporal in nature [START_REF] George | Spatio-temporal sensor graphs (stsg): A data model for the discovery of spatio-temporal patterns[END_REF], which means that in addition to their temporal correlations, they also hold spatial correlations that must be considered when measuring data dependency. In addition, the spatial and temporal distances between generated data can vary according to the user's context.

For example, distances between location data vary whether the user is driving a vehicle, running, or walking. Therefore, we aim to improve the data dependency measurement by introducing a three-dimensional dependency graph of temporal, spatial, and contextual dimensions.

Time Dependency of Data. We considered in this study that the standard time period during which two data values of an attribute are said to be dependent (i.e., a.τ) is provided as input to the system. As future work, we aim to automate the computing of a.τ, which could be calculated based on several metrics, such as the historical data distribution in time (e.g., regular/irregular time series) and the velocity of data value changes and relative gaps.

Protection Function Similarity. The current similarity measurement of protection functions takes into consideration the exact match between functions' classes and feature lists. We thus aim to improve the similarity measurement to further consider the semantic similarity of their features.

CaPMan Framework

CaPMan Implementation. We are developing the CaPMan mobile application that assists the user in managing her privacy based on her situation. This application consists of the context acquisition, context modeling, risk reasoner, risk manager, and the data protection engines. The implementation has the highest priority from all future work, since it allows for the testing of our CaPMan framework's accuracy in real-world scenarios, as well as the end to end evaluation of the entire framework operations.

Crowdsourcing Solution for Environment Modeling. We aim to integrate in the mobile application a crowdsourcing solution that allows all CaPMan users for manipulating the maps of their environments, such as adding new components (e.g., sensors, devices, actuators) and reporting updates in their environments (e.g., location change of a camera in the mall). This will improve the quality of information coverage, and enable users to practically exchange information about their environments and contribute to the reinforcement of their privacy protection.

Data Protection. We would like to explore the data protection module of CaPMan, and specifically address the challenges of: (i) protection functions selection, which can depend on several metrics, such as the computational cost, vulnerabilities to data inference, and compatibility with attribute type and data format; and (ii) System vulnerability assessment in the face of security threats.

CaPMan Extension. The proposed CaPMan framework is user-centric. As future work, we aim to expand the indexing of the framework to make it entity-centric, where an entity could be a user or an environment (e.g., company, mall).

Finalement

  , nous répertorions les publications liées à ce rapport avant d'introduire les chapitres suivants. xi Chapitre 2

Figure 1 .

 1 1 illustrates examples of connected environments.

FIGURE 1 . 2 :

 12 FIGURE 1.2: Privacy Laws Around the World

FIGURE 1 . 3 :

 13 FIGURE 1.3: Privacy Standards

FIGURE 1 . 4 :

 14 FIGURE 1.4: Motivating Scenario

FIGURE 1 . 5 :

 15 FIGURE 1.5: Energy consumption signature / Location data pattern

FIGURE 1 . 6 :

 16 FIGURE 1.6: Overview of CaPMan Framework

FIGURE 1 . 7 :

 17 FIGURE 1.7: Information Management Module

FIGURE 1 . 8 :

 18 FIGURE 1.8: Privacy Risk Inference Module

FIGURE 2 . 1 :

 21 FIGURE 2.1: Running Example

FIGURE 2 . 2 :

 22 FIGURE 2.2: Fundamental Dimensions of user-Context Information

  authors have proposed SOSA/SSN, a joint W3C and OGC (Open Geospatial Consortium) standard, that constitutes the new version of the most foundational ontology for sensors, the Semantic Sensor Network (SSN) Ontology. The main innovation of this SSN new generation has been the introduction of the Sensor, Observation, Sample, and Actuator (SOSA) ontology, which provides a lightweight core for SSN. Together, SOSA/SSN ontologies describe systems of sensors and actuators, observations, platforms, involved procedures, studied features of interest, observed properties, and so forth. SOSA/SSN is a generic and modular ontology that respects the Ontology Design Pattern (ODP), which makes it easier to reuse/extend.HSSN.In[START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], authors have introduced HSSN, an ontology for Hybrid Semantic Sensor Networks. HSSN extends the widely used Semantic Sensor Network ontology (SOSA/SSN) to overcome existing limitations related to sensor diversity, platform diversity and data diversity. HSSN defines new concepts and properties to represent hybrid sensor networks, i.e., networks containing mobile/static sensors, scalar/multimedia properties, and infrastructures/devices as platforms where sensors are deployed.

  introduces classes and properties to represent: (i) structure/component aspects of an environment; (ii) scalar/multimedia sensors and multi-sensor devices; and (iii) services. Moreover, it integrates mobility-related classes to represent mobile sensors and keep track of their locations and coverage areas. Accordingly, we decide to import classes/properties from both DPV and HSSN ontologies to cover the representation of the user's profile and environment.

FIGURE 2 . 3 :

 23 FIGURE 2.3: Overview of the uCSN Ontology

FIGURE 2 . 4 :

 24 FIGURE 2.4: Entity Representation

  cept ucsn:PersonalInformation (see in Figure2.5). A ucsn:PersonalInformation is spatio-temporal and can be of two types: (i) information that characterizes the user profile, represented by ucsn:ProfileInformation, which barely changes over time/space; or (ii) information characterizing the user's activity, represented by ucsn:ActivityInformation, which varies over time/space depending on the evolution of the user's situation. The user has many ucsn:PersonalInformation as shown in Figure2.6, each of which is captured from a ucsn:DataSource (e.g., sensor, social network profile) and shared with many ucsn:DataConsumer (e.g., Facebook).

FIGURE 2 . 5 :FIGURE 2 . 6 :

 2526 FIGURE 2.5: Personal Information

Figure 2 .

 2 [START_REF] Akyildiz | Wireless sensor networks: A survey[END_REF] shows that uCSN is capable of representing different types of data sources, i.e. sensors, devices and other external sources (e.g., social media platforms, databases, documents), through the sosa:Sensor, hssn:Device, and ucsn:ExternalSource concepts (cf. Challenge 3). The data source's origin, URI identifier, and data-serialization format can be also represented through the following properties: ucsn:origin, ucsn:uri-identifier, and ucsn:serialization-format.

FIGURE 2 . 7 :

 27 FIGURE 2.7: Source Diversity

  requires to gather tracking information describing activities performed, locations/places visited, and user behavior, and to keep track of the information sensed by deployed/wearable sensors. Accordingly, the ucsn:Activity, ucsn:UserLocation, dpv:Behavioral, and ucsn:SensedInformation concepts are added as sub-concepts of ucsn:ActivityInformation (cf. Figure2.8). Further details on how to consider the dynamicity of the user's activity are provided in sub-section 2.4.2.2.

FIGURE 2 . 8 :

 28 FIGURE 2.8: Profile/Activity Information

  Figure 2.9).

FIGURE 2 . 9 :

 29 FIGURE 2.9: Profile Information (part-1)

FIGURE 2 . 10 :

 210 FIGURE 2.10: Profile Information (part-2)

FIGURE 2 .

 2 FIGURE 2.12: Location/Activity Information Properties

FIGURE 2 .

 2 FIGURE 2.14: Sensed/Behavioral Information

FIGURE 2 . 15 :

 215 FIGURE 2.15: Characteristics of Sensed Information

FIGURE 2 .

 2 FIGURE 2.17: Environment Representation

Figure 2 .

 2 Figure 2.18 details the general representation of devices. A hssn:Device has hssn:Hardware features related to storage, processing, communication, and power supply, in addition to the ability of embedding sensors via its expansion card. These features are respectively represented by the hssn:Memory, hssn:NetworkInterface, hssn:Processor, hssn:PowerSupply, and hssn:ExpansionCard concepts. The hssn:

FIGURE 2 .

 2 FIGURE 2.18: Device Representation

FIGURE 2 .

 2 FIGURE 2.20: Sensor Properties

FIGURE 2 .

 2 FIGURE 2.22: Service Representation

  Figure 2.23 illustrates the aforementioned properties.

FIGURE 2 .

 2 FIGURE 2.23: User/Environment Mediation

  [3]: (i) uo:Uncertainty, indicates the statement about the uncertainty associated with the information collected; (ii) uo:UncertaintyNature, expresses whether the uncertainty is an inherent property of the world or a lack of information; and (iii) uo:UncertaintyType, indicates the type of uncertainty (e.g., incompleteness, ambiguity). The properties uo:nature and uo:uncertaintyType map the uo:Uncertainty to its related nature and type. Each uo:Uncertainty has an associated value represented by the uo:uncertaintyValue property. As shown in Figure2.24, the uo:UncertaintyNature comprises two subconcepts, uo:Aleatory and uo:Epistemic, that respectively indicates whether the uncertainty arises from the entities described by the information or from the related data source. In addition, the uo:UncertaintyType contains five sub-concepts:[START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF]

FIGURE 2 .

 2 FIGURE 2.24: Uncertainty Representation

FIGURE 2 . 25 :

 225 FIGURE 2.25: Uncertainty related to User/Environment Information

  and 2.27), the survey respondents are divided into 31 males and 19 females, and belong to different countries: France (26 respondents), Lebanon (12), United Arab Emirates (6), United States of America (2), Tunisia (2), Germany (1) and United Kingdom (1).

FIGURE 2 .

 2 FIGURE 2.26: Respondents Genders/Fields of Expertise

FIGURE 2 .

 2 FIGURE 2.28: Concept Evaluation

FIGURE 2 .

 2 FIGURE 2.29: Property Evaluation

FIGURE 2 . 30 :

 230 FIGURE 2.30: User Complexity Impact

FIGURE 2 . 31 :

 231 FIGURE 2.31: Impact of Sensed Information Complexity

FIGURE 2 . 32 :

 232 FIGURE 2.32: Environment Complexity Impact

FIGURE 2 .

 2 FIGURE 2.33: Context Complexity Impact

Query 15 :

 15 Searching for concepts with no parent SELECT distinct ? a WHERE { ? a SubClassOf owl : Nothing . } Query 16: Searching for abnormally disjointed concepts SELECT distinct ? A ? B1 ? B2 ? C WHERE { ? B1 subClassOf ? A . ? B2 subClassOf ? A . ? C subClassOf ? B1 . ? C disjointWith ? B2 . } Discussion. The query results show no inconsistencies in the uCSN ontology structure. The only concept subsuming nothing is owl:Nothing (Query 15). Query 16

Figure 3 .

 3 1 details the data/service exchange processes and the additional background data known about Alice in her current situation. Background data includes her marital status, profile picture, and date of birth collected from her Facebook profile. The date of birth is also captured in a different format from the public voting records.

FIGURE 3 . 1 :

 31 FIGURE 3.1: Running Example

FIGURE 3 . 2 :

 32 FIGURE 3.2: Energy consumption signature / Location data pattern

Figure 1 .

 1 Figure 1.4), and collect other background data about them from external data sources, like social network profiles or public databases, to enrich customer profiles with new

FIGURE 3 . 3 :

 33 FIGURE 3.3: CCTV surveillance in a smart mall

Challenge 5 .

 5 Delivering scalability and efficiency: The solution must be scalable, i.e. handles reasoning over an increasing number of contextual data and privacy risks. It should also react fast to support the user in different contexts, especially as user decisions must sometimes be made in real-time. Finally, it should maintain low computational and storage complexity, which makes it operational on various types of devices, including those with limited resources.

FIGURE 3 . 4 :

 34 FIGURE 3.4: Overview of the CaSPI proposal

PR 4 :PR 5 :

 45 (SensedInformation = Energy-consump) AND (Energy-consump) describesEntity (Environment) AND (Environment) hasDescription (= "Home") AND (Energy-consump) hasSensingStatus (SensingStatus = Status-1) AND (Status-1) isSharedWith (DataConsumer) AND (Status-1) isProtected (= false) -→ {presence-absence, sleeping-cycles, activities} • Rule 5: A user has a chronic disease and follows her medical treatment using a medical device deployed at home. She is sharing the energy consumption data of her home without protection. This raises the risk of inferring her disease. (User) controlsEnv (Environment) AND (Environment) hasDescription (= "Home") AND (Environment hosts (Device = MedicalDevice)) AND (SensedInformation = Energy-consump) AND (Energy-consump) describesEntity (Environment) AND (Energy-consump) hasSensingStatus (SensingStatus = Status-1) AND (Status-1) isSharedWith (DataConsumer) AND (Status-1) isProtected (= false) -→ {disease} Example 7. We provide here examples of rules that express indirect risks (i.e., risks uncontrolled by the user):

PR 6 :PR 7 :PR 8 :PR 9 :

 6789 (User) isLocatedIn (Environment) AND (User) NOT (controlsEnv Environment) AND (Environment) hosts (System = CCTV) -→ {presence-absence ; interests ; activities} • Rule 7: The home/office street of the user hosts a CCTV camera, and this camera has a coverage area that contains the spatial zone of the home/office. This raises the risks of inferring the presence/absence of the user at home/office, and her activities in the area covered by the camera. (User) controlsEnv (Environment-1) AND (Environment-1) hasDescription (= "Home" OR "Office") AND (Environment-1) hasSpatialZone (SpatialZone) AND (Environment-2) NOT (hasDescription (= "Home")) AND (Environment-2) hosts (System = CCTV) AND (Surveillance-camera) hasCoverageArea (CoverageArea) AND (CoverageArea) covers (SpatialZone) -→ {presence-absence ; activities} • Rule 8: The user is located in a public environment that hosts Automatic Number Plate Recognition (ANPR) sensors. This raises the risk of inferring the presence/absence of the user in the environment. (Environment) hosts (System = ANPR) AND (User) NOT (controlsEnv Environment) AND (User) isLocatedIn (Environment) -→ {presence-absence} • Rule 9: The user is located in a medical center or hospital that hosts CCTV cameras. This raises the risks of inferring the presence/absence of the user in the medical environment, her medical information (e.g., disease, surgery, allergy). (User) isLocatedIn (Environment) AND (Environment) hasDescription (= "Medical-Center" OR "Hospital") AND (Environment) hosts (System = CCTV) -→ {presence-absence ; medical-information}

FIGURE 3 . 5 :

 35 FIGURE 3.5: Privacy Rules Import

FIGURE 3 . 6 :

 36 FIGURE 3.6: User Profiles

  takes as input: (i) user-context information, (c.A c.Rel A ); (ii) user profile, pro f ile; (iii) user preferences related to sensitive information, uSI SI; and (iv) privacy rules, PR. It returns an overview of the risks taken by the user u in c, denoted by R c . This can be represented as follows: riskReasoner((c.A c.Rel A ) ; pro f ile ; uSI ; PR) → R c Where: R c = r 1 r 2 . . . r n | n ∈ N Definition 8 (Privacy Risk). A privacy risk, r ∈ R c , is defined as the risk of disclosing one or more sensitive information about the user. Each r ∈ R c is associated with one distinct privacy rule, pr ∈ PR, that is satisfied in the context c ∈ C. It expresses the probability of achieving the logical consequence of the related pr in c (i.e., pr.SI ). r has a probabilistic value ranging from 0 to 1, where 0 indicates that r is negligible, and 1 indicates that the information disclosure is materialized at 100% (i.e., the disclosure of pr.SI ). r can be represented as follows: r : id ; value ; SI ; SA | ∃! pr ∈ PR : r ∼ pr where:

Algorithm 1 : 5 ruleEngine 6 reasoner 7 ruleEngine 8 reasoner 9 contextFile

 156789 Step 3 (line 7): It launches the rule-based inference engine to detect the risks involved, by calling the function in f er(). • Step 4 (lines 8-9): It flushes the changes stored in the buffer (i.e., risks inferences) by calling the function f lush(), causing the reasoner to append the changes in the ontology instance. Then, the ontology file is updated to save the new inferences by calling the function saveU pdates() (line 9). • Step 5 (line 10): It extracts the privacy risks with their properties (i.e., r.id, r.value, r.SI , and r.SA ) from the ontology file using the getPrivacyRisks() function, and stores them in the four-dimensional array R c , where each row denotes one risk. CaSPI Reasoner Input: contextFile, PR[], uSI[][], pro f ile; // the ontology file containing individuals and relationships expressing the current context, the array of privacy rules, the array of sensitive information with their preference flag, and the user profile; Output: R c [][][][]; // the overview of risks, where each row presents the properties of a risk: risk id, risk value, associated sensitive information and sensed data (for direct risks); 1 Variables: sensedAttributes[], ruleEngine, reasoner; // set of sensed attributes, the rule engine variable, and the ontology reasoner variable; ← getSensedAttributes(contextFile); // returns the set of the currently sensed attributes ; 4 PR[] ← f ilterPrivacyRules(PR[], sensedAttributes[], uSI[][], pro f ile); // returns the set of filtered rules ; ← createRuleEngine(PR[], contextFile); // create the rule engine instance, associate the considered privacy rules, and map it to the ontology file; ← createReasoner(contextFile); // create the ontology reasoner instance and map it to the ontology file; ← in f er(); // run the inference function to infer the involved privacy risks; ← f lush(); // flush the reasoner to consider the risk inferences; ← saveU pdates(); // save the updates in the ontology file; 10 R c [][][][] ← getPrivacyRisks(contextFile); // get the list of privacy risks inferred with their properties: id, value, associated sensitive information and sensed attributes (if exist);

(

  cf. Section 3.4.3). It performs then rule-based reasoning over modeled data, based on imported and filtered rules, and outputs an overview of the risks involved in the relevant context with their characteristics. The produced overview is consequently tailored to the user's profile before being released in order to allow all users to understand their privacy implications. The source code of the CaSPI prototype is available online for download via this link 2 .

FIGURE 3 . 7 :

 37 FIGURE 3.7: Implementation of the CaSPI proposal

Figure 3 .

 3 Figure 3.8 shows how current context information are modeled as uCSN individuals, along with their relationships. We used Protege 5.5.0 3 to illustrate them.

FIGURE 3 . 8 :

 38 FIGURE 3.8: Context-1 of Alice

∧

  ucsn:SensedInformation(ucsn:LOCATION) ∧ ucsn:isProtected(ucsn:LOCATION, false) ∧ ucsn:hasSensingStatus(ucsn:LOCATION, ?status) ∧ ucsn:DataConsumer(?d) ∧ ucsn:isSharedWith(?status, ?d) ∧ swrlx:createOWLThing(?r, ucsn:HABIT, ucsn:PREFERENCE, ucsn:BEHAVIOR) -→ ucsn:PrivacyRisk(?r) ∧ ucsn:ActivityInformation(ucsn:HABIT) ∧ ucsn:Generic(ucsn:PREFERENCE) ∧ ucsn:ActivityInformation(ucsn:BEHAVIOR) ∧ ucsn:hasDescription(ucsn:HABIT, "Habits of the user")∧ ucsn:hasDescription(ucsn:PREFERENCE, "Preferences of the user")

∧

  ucsn:controlsEnv(?u, ?env) ∧ ucsn:SensedInformation(ucsn:ENERGY-CONSUMP) ∧ ucsn:describesEntity(ucsn:ENERGY-CONSUMP, ?env) ∧ ucsn:hasSensingStatus(ucsn:ENERGY-CONSUMP, ?status) ∧ ucsn:DataConsumer(?d) ∧ ucsn:isSharedWith(?status, ?d) ∧ ucsn:isProtected(ucsn:ENERGY-CONSUMP, false) ∧ swrlx:createOWLThing(?r, ucsn:PRESENCE-ABSENCE) ∧ swrlx:createOWLThing(ucsn:SLEEPING-CYCLE, ucsn:PERFORMED-ACTIVITY) -→ ucsn:PrivacyRisk(?r) ∧ ucsn:ActivityInformation(ucsn:PRESENCE-ABSENCE) ∧ ucsn:ActivityInformation(ucsn:SLEEPING-CYCLE) ∧ ucsn:ActivityInformation(ucsn:PERFORMED-ACTIVITY)

Figure 3 .

 3 Figure 3.10 shows that previous risks are still valid in the new context because the changes had no effect on them, and a new risk is inferred related to the rule PR 6 .

FIGURE 3 . 9 : 1 FIGURE 3 . 10 : 2 FIGURE 3 . 11 :

 3913102311 FIGURE 3.9: Privacy Risk Overview in Context-1

FIGURE 3 . 12 :

 312 FIGURE 3.12: Login and Profile Specification Interfaces

FIGURE 3 .

 3 FIGURE 3.13: Sensed Data Selection Interface

FIGURE 3 . 15 :

 315 FIGURE 3.15: Privacy Risks Interface: Picture-based Warnings for a Beginner (left) and Intermediate/Advanced (right) user

Figure 3 .

 3 Figure 3.15 illustrates the picture-based warnings that have been sent to Alice in context-1, such that the figure on the left represents the Beginner view, and the one on the right represents the Intermediate/Advanced view depending on her profile.

FIGURE 3 . 16 :

 316 FIGURE 3.16: Privacy Risks Interface: Textual Warnings for an Intermediate (left) and Advanced (right) user

  ), with an average of 150 MB for 10 rules, 170 MB for 50 rules, 210 MB for 100 rules, and up to 278 MB for 1000 rules. This consequently highlights the importance of filtering the list of rules before launching the risk reasoning process.

FIGURE 3 . 17 :Case 2 :

 3172 FIGURE 3.17: Privacy Rules Impact

FIGURE 3 . 18 :

 318 FIGURE 3.18: Privacy Risks Impact

  3.19) with an average of 200 MB for 100 individuals and up to 830 MB for 10,000. This consequently underlines the ability of the CaSPI solution to assist the user in a variety of contexts, including ephemeral ones (i.e., contexts with short time periods).

FIGURE 3 . 19 : 1 .

 3191 FIGURE 3.19: Context Diversity Impact

FIGURE 4 . 1 :

 41 FIGURE 4.1: Alice's Situation

FIGURE 4 . 2 :

 42 FIGURE 4.2: Alice's Privacy Situation

FIGURE 4 . 3 : 4 .

 434 FIGURE 4.3: Privacy Needs and Interests of Alice

FIGURE 4 . 4 :

 44 FIGURE 4.4: Classification of Data Protection Functions

Figure 4 .( 1 )( 2 )( 3 )( 4 )

 41234 Figure 4.5 illustrates an overview of our proposal, including related inputs and outputs. δ-Risk receives as input:

FIGURE 4 . 5 :

 45 FIGURE 4.5: Overview of the δ-Risk proposal

Figure 4 .

 4 Figure 4.6 details the extended characteristics of the user profiles, which are related to preference specification and protection strategy selection. The goal here is

FIGURE 4 . 6 :

 46 FIGURE 4.6: Extended Characteristics of User Profiles

Figure 4 .

 4 Figure 4.7 details the δ-Risk process. The first operation consists of identifying all possible protection strategies (i.e., P c ):

FIGURE 4 . 7 :

 47 FIGURE 4.7: δ-Risk Operations

  the utility of attributes' data requires assigning the lowestpossible protection levels to these data. These levels are obtained when minimizing risks to the highest acceptable values. Therefore, optimizing the data utility-privacy trade-off necessitates considering only the combinations of data protection levels that satisfy R c . r.value = δ. This results in the following linear system of n equations with m unknowns:

{p 1 ; p 2 } eP and δ = 1 -( ω 11 .p 1 + ω 12 .p 2 )

 121111122 Reasoning Algorithm. Algorithm 2 presents the protection strategy identification algorithm that takes as input the impact matrix, Wc[][], the δ value (specified by the user or left empty), and the array of enforced protection levels, eP[]. It outputs the array of identified protection strategies, Pc[][].

-

  Step 4 (lines 18-34): If δ ∈]0; 1[ (line[START_REF] Levin | Privacy law in the united states, the eu and canada: The allure of the middle ground[END_REF], which can be specified by the user or identified by the system when calling the getLowestPossibleDelta() function, the process builds the linear system by calling the buildSystem() function and stores the resulted system in the two-dimensional array System[][] (line 20). Then, it solves the system using the GJE method by calling the solveSystemGJE() function (line 21). This function returns a reduced row echelon form stored in M[][]. Following that, the process checks for inconsistency by calling the checkInconsistency() function, which returns a Boolean value stored in inconsistency (line 22). In fact, the system can generate inconsistencies here only when the user specifies δ. If inconsistency equals False, this means that the system is consistent. The process checks attribute dependency in M[][] by calling the checkDependency() function, which returns a Boolean value stored in the variable dependency (line 24). * If dependency equals False (line 25), this means that attributes are independent, and the system results in one exact solution for each unknown p j value, leading to create one protection strategy. This procedure is done by calling the createIndependentStrategy() function (line 27).

Figure 4 .

 4 8, the prototype performs continuous reasoning over the user's situation and generates dynamic protection strategies based on user preferences and contexts. The source code of the δ-Risk prototype is accessible online for download via this link 1 .

FIGURE 4 . 8 :

 48 FIGURE 4.8: Implementation of the δ-Risk proposal

Figure 4 .

 4 [START_REF] Ziegeldorf | Privacy in the internet of things: Threats and challenges[END_REF]. We also illustrate in this figure the impact matrix, W c , of location and energy-consump attributes on the risks, which is automatically calculated by the risk reasoner. The δ-Risk process is consequently executed, and generates one best strategy that suggests achieving 40% protection for energy-consumption data and 40% protection for location data (cf. Fig.4.10).

FIGURE 4 . 9 :

 49 FIGURE 4.9: Alice's Privacy Situation

FIGURE 4 . 10 :

 410 FIGURE 4.10: Alice Preferences, Impact Matrix, and Resulted Strategy

Figure 4 .

 4 Figure 4.11 shows the preference specification interface, which varies according to the user's profile. A beginner user has only the option to set the value of the risk threshold (δ) to 0 (i.e., maximum protection) or 1 (i.e., maximum quality of services) as previously described in Section 4.4.2. An intermediate user can personalize her sensitive information (see in Figure 3.14), services, and enforce a value for δ ranging from 0 to 1. An expert user has all intermediate properties plus the possibility to

FIGURE 4 . 11 :

 411 FIGURE 4.11: Preference Specification Interface

FIGURE 4 . 12 :

 412 FIGURE 4.12: Service Preference Specification Interface

Figure 4 .

 4 Figure 4.13 illustrates the strategy selection interface. As previously discussed, a timeout period is assigned to this query, such that if the user fails to respond within this period of time, the system selects randomly one of the strategies. The default maximum number of strategies provided is fixed at 3 for an intermediate and 5 for an advanced as stated in Section 4.4.3.3. Nonetheless, the user can manually change this variable by sliding the relative cursor.

FIGURE 4 .

 4 FIGURE 4.13: Protection Strategy Selection Interface

Figure 4 .

 4 Figure 4.15 shows that the number of privacy risks has a quasi-linear impact on the total execution time, with an average of 1 s up to 100 risks, 1.5 s for 500 risks, 2.2 s for 1000 risks, and 3.4 s for 2000 risks. The evolution is similar for the RAM consumption (see in Figure 4.15), with an average of less than 220 MB up to 100 risks, 250 MB for 1000 risks, and 290 MB for 2000 risks. This consequently highlights the importance

FIGURE 4 . 15 :

 415 FIGURE 4.15: Case 1: Privacy Risks Impact

  1; 5; 10; 20; 30; 40; 50; 60; 70; 80; 90; and 100.

Figure 4 .

 4 [START_REF] Sundmaeker | Vision and challenges for realising the internet of things[END_REF] shows that the number of sensed attributes has a quasi-linear impact on the total execution time, with an average of 1 s up to 10 attributes, 2 s up to 50 attributes, and 4 s up to 100 attributes. The evolution is similar for the RAM consumption (see in Figure 4.16), with an average of less than 200 MB up to 10 attributes, 1000 MB up to 40 attributes, and 2000 MB up to 100 attributes. It is important to note that in practice, the number of user-sensed attributes in her situation will not practically exceed 50.

FIGURE 4 . 16 :

 416 FIGURE 4.16: Case 2: Attributes Impact

FIGURE 4 . 17 : 4 :

 4174 FIGURE 4.17: Case 3: Attribute Dependencies Impact

FIGURE 4 . 18 : 2 .

 4182 FIGURE 4.18: Case 4: Strategy Ranking Complexity Impact

FIGURE 5 . 1 :

 51 FIGURE 5.1: Case-1

FIGURE 5 . 2 :

 52 FIGURE 5.2: Case-2

FIGURE 5 . 3 :Challenge 1 .Challenge 2 .Challenge 3 .

 53123 FIGURE 5.3: Case-3

FIGURE 5 . 4 : 4 .

 544 FIGURE 5.4: Repeated Protection Transition Patterns

FIGURE 5 . 5 :

 55 FIGURE 5.5: Integration of P-SGD

FIGURE 5 . 6 :

 56 FIGURE 5.6: P-SGD process

is the protection function associated to d old i of attribute a i 5 . 3 . 1 Definition 15 (

 53115 Deviation Rate QuantificationThe deviation rate, η, depends on: (1) the temporal dependency of previous and current data values of a i , d old i and d current i ; and (2) the level of dependency of their related protection functions, Time Dependency of Data). Let depend t denotes the temporal dependency score of two data values,

2 .

 2 The more previous/current protection functions are similar, the more the protection gap should be reduced.Accordingly, η is quantified as follows:η = c i × sim( f old i , f current i ) × depend t (d old i ,

--

  Step 1 (line 3): It computes the dependency score of previous/current data values, d old and d current , and stores the result in the depend t variable. • Step 2 (line 4): It calculates the similarity score of previous/current protection functions, f old and f current , and stores the result in the simScore variable. • Step 3: It checks the need or not for executing the gradient descent process: Step 3.1 (lines 5-11): If data values are time-dependent and the related protection functions share similarities (line 5), the process is executed: * It starts by calculating the amount of the random noise, , to be appended to η (line 7). * It calculates the value of the deviation rate η (line 8) and the value of p current accordingly (line 9).* It checks the validity of the calculated value for p current . If this value is less than or equal to p target (lines 10), this means that the process has achieved the protection level specified by the privacy model. Consequently, the value of p current equals the one of p target and the downshifting process ends (line 11). Otherwise, the calculated value for p current is valid. Step 3.2 (lines 10-11): If data and/or associated functions are independent, the gradient process is not executed and the protection level is downshifted directly to p target , i.e., the value of p current equals the one of p target .• Step 4 (line 14): the data properties of the relevant attribute are updated in the transition matrix, Trans[][], and the process is ended.

FIGURE 5 . 7 :

 57 FIGURE 5.7: P-SGD Integration in CaPMan

FIGURE 5 . 8 :

 58 FIGURE 5.8: Securing protection transitions using the P-SGD process

Case 1 :

 1 protection functions dependency; and (ii) the number of attributes handled simultaneously. Then, we formally study the storage complexity of the proposal. The performance is evaluated based on two criteria: the total execution time of one iteration and the memory overhead. The tests were conducted on a machine equipped with an Intel i7 2.80 GHz processor and 16 GB of RAM. The chosen execution value for each scenario is an average of 10 sequenced values. We consider two dimensions to study the complexity of the functions dependency: the first increases the number of features and the second increases the diversity in features between the two functions. We execute the P-SGD process 13 times, taking into account the following number of features for each iteration: 1, 5, 10, 15, 20, 30, 40, 50, 60, 70, 80, 90 and 100. For each of these scenarios, we consider three sub-scenarios where we vary respectively the percentage of diverse features from 0%, 50% to 100%. As shown in Figure5.9, the number and diversity of the features have no impact on the function dependency procedure, and thus on performance. This is due to the fact that the procedure verifies only the exact matching of the features' names and values. The process is executed in all scenarios with an average time of 35ms and 10MB of RAM usage.

FIGURE 5 . 9 :Case 2 :

 592 FIGURE 5.9: Protection Function Similarity Impact

FIGURE 5 . 10 :

 510 FIGURE 5.10: Multi-attribute Impact

  our research work, we proposed CaPMan[5], a user-centric context-aware model for privacy management in connected environments that meets current privacy standards (i.e., Privacy by Design and ISO/IEC 27701 standards). Matos et al.[START_REF] De Matos | Providing context-aware security for iot environments through context sharing feature[END_REF] not the product of my circumstances. I am the product of my decisions." -Stephen Covey

TABLE 1 .

 1

1: Review of Context-aware Privacy Frameworks

5.1.3 Privacy Management

	). The second
	component is the risk reasoner, which consists of a semantic rule-based reasoning en-
	gine that examines modeled context information and dynamically infers the risks
	involved. This engine is capable of monitoring the evolution of risk values based on
	context changes. Chapter 3 details the entire risk inference process. The proposed
	approach is published [4] in the Future Generation Computer Systems 3 journal:
	FIGURE 1.9: Privacy Management Module

-Bou Chaaya, Karam, et al. "Context-aware System for Dynamic Privacy Risk Inference." Future Generation Computer Systems, Elsevier, 2019, 101, pp.1096-1111.

1.

Challenge 1. Providing high-level information coverage: Context information

	resources (e.g., Web resources). Consequently, when modeling context information,
	several challenges emerge:
	• can characterize different dimensions, i.e., time, location, user, and environment.
	These information pieces can also have different/complex types of relations among
	each others, characteristics, and constraints. The data model should therefore
	provide high-level and expressive information coverage of all context dimen-
	sions. This makes it capable of meeting the needs of different applications.
	• Challenge 2. Coping with information diversity: Contextual data/information
	can be heterogeneous in terms of data types and properties (e.g., scalar and mul-
	timedia data). The data model must allow the representation of scalar and mul-
	timedia data/information with their properties. This enriches the representation
	of user contexts, thereby improving the quality of CAS operations.
	• Challenge 3
	ences, locations, or/and environment changes. This tracking is achieved by collect-
	ing data from deployed/wearable sensors or/and information from other external

. Coping with source diversity: The

	data/information can be col-
	lected/extracted from a wide variety of data sources, which can be derived from
	connected environments (e.g., scalar/multimedia sensors, documents) and/or
	other external resources, such as Web resources (e.g., social network profiles,
	public databases, emails, documents). Therefore, the data model must support

TABLE 2 .

 2

	Criteria		DPV [1]	FOAF [81]	UPO [82]	UPOS [83]	Extended-UPOS [84]	CC/PP [85]	UP-PwD [86]
	Re-usability		YES	NO	YES	YES	NO	YES	YES
	Extensibility		YES	YES	YES	YES	YES	YES	YES
	User Information	Profile	YES	PARTIAL PARTIAL PARTIAL	PARTIAL	PARTIAL PARTIAL
	Coverage	Activity PARTIAL PARTIAL PARTIAL PARTIAL	PARTIAL	PARTIAL PARTIAL
	Information Diversity	PARTIAL PARTIAL	NO	NO	NO	NO	NO
	Source Diversity	YES	NO	NO	NO	NO	NO	NO
	Information Uncertainty	NO	NO	NO	NO	NO	NO	NO

1: Comparative Study of Existing User Models

TABLE 2 .

 2

	Criteria			SOSA/SSN [2]	HSSN [43]	IoT-O [87]	IoT-Lite [95]	IoT-Ontology [96]
	Re-usable			YES	YES	YES	YES	YES
	Extensible			YES	YES	YES	YES	YES
		Unconnected Env. Aspects	YES	YES	YES	YES	YES
	Environment Information Coverage	Connected Environment	Aspects Sensor Diversity	YES PARTIAL	YES YES	YES PARTIAL PARTIAL YES	YES PARTIAL
			Sensor Mobility	NO	YES	NO	NO	NO
		Service		NO	YES	YES	YES	NO
	Information Diversity		NO	YES	NO	NO	NO
	Information Uncertainty		NO	NO	NO	NO	NO

2: Comparative Study of Existing Environment Models

TABLE 2 .

 2

	Criteria				PiVOn [55]	CONCON [56]	SOUPA [57]	COBRA-ONT [59]	CoDAMoS [60]	mIO! [61]	PalSPOT [62]
	Re-usable				YES	YES	YES	NO	YES	YES	NO
	Extensible				YES	YES	YES	YES	YES	YES	YES
		Time			YES	YES	YES	YES	YES	YES	YES
		Location			YES	YES	YES	YES	YES	YES	YES
			Unconnected Env. Aspects	YES	YES	YES	YES	YES	YES	YES
				Aspects	YES	NO	NO	NO	NO	PARTIAL PARTIAL
	Information Coverage	Environment	Connected Environment	Sensor Diversity PARTIAL	NO	NO	NO	NO	PARTIAL	NO
				Sensor Mobility PARTIAL	NO	NO	NO	NO	NO	NO
			Service		YES	NO	NO	NO	YES	YES	NO
		User	Profile		PARTIAL PARTIAL PARTIAL	PARTIAL	PARTIAL	PARTIAL PARTIAL
			Activity		PARTIAL PARTIAL PARTIAL	PARTIAL	PARTIAL	PARTIAL PARTIAL
	Information Diversity			NO	NO	NO	NO	NO	NO	NO
	Source Diversity			NO	NO	NO	NO	NO	YES	NO
	Information Uncertainty			NO	NO	NO	NO	NO	NO	NO

3: Comparative Study of Existing Context Models

  Clarity Evaluation. Checks if the labels used to describe the newly added concepts and properties are clear and unambiguous to domain stakeholders. The aim is to evaluate the clarity and compatibility of our extensions with respect to the context-awareness domain.3. Performance Evaluation. Measures the impact of the uCSN ontology on performance (i.e., query run time). The aim is to evaluate the feasibility, in terms of performance, of integrating uCSN in context-aware applications.4. Consistency Evaluation. Checks if the added concepts and properties generate inconsistencies (e.g., anti-patterns) within the structure of the ontology. The aim is to evaluate the soundness of the ontology graph.

1. Accuracy Evaluation: Checks if the uCSN concepts and properties are capable of answering the challenges mentioned in Section 2.2.

2.

Generate the list of data values captured during [t1; t2]

	Query 7:
	Query 1: Knowing sensed information with their characteristics
	SELECT distinct ? user ? sensedInfo ? entity ? status ? consumer
	? sensor ? protocol ? event ? time ? location
	WHERE {
	? user : h as Per so nal In for mat io n ? sensedInfo .
	? sensedInfo rdf : type ucsn : SensedInformation ;
	: describesEntity ? entity ;
	: hasSensingStatus ? status .
	? status : isSharedWith ? consumer ;
	: h a s Co m m un i c at i o nP r o to c o l ? protocol ;
	: isSensedBy ? sensor ;
	: hasSensingEvent ? event .
	? event : hasEventLocation ? location ;
	: hasEventTime ? time .
	}
	Query 2: SELECT distinct ? user ? sensedInfo ? datavalue ? time ? location
	WHERE {
	? user : h as Per so nal In for mat io n ? sensedInfo .
	? sensedInfo rdf : type ucsn : SensedInformation ;
	: hasDataValue ? datavalue .
	? datavalue : hasCaptureTime ? time ;
	: hasCaptureLocation ? location .
	FILTER (? time >= t1 && ? time <= t2 )
	}

Generate a detailed view of the user services

  Context Information. In order to generate a complete and expressive view of the user's context, we define Query 8 which extracts all of modeled context information with their relationships.

	SELECT distinct ? user ? service ? provider ? device ? variable
	? interface ? metadata ? capability ? event
	WHERE {
	? provider : providesService ? service .
	? service : isProvidedTo ? user ;
	: isProvidedThrough ? device ;
	: hasVariables ? variable ;
	: hasInterfaces ? interface ;
	: hasMetadata ? metadata ;
	: hasCapability ? capability ;
	: isProvidedAt ? event .
	}
	Query 8:

Generate the complete view of the user's situation

	SELECT distinct ? domainType ? domainValue ? relation ? rangeType
	? rangeValue
	WHERE {
	? relation rdf : type owl : ObjectProperty .
	? domainValue ? relation ? rangeValue .
	? domainValue rdf : type ? domainType .
	? rangeValue rdf : type ? rangeType .
	}

Query 9: Knowing the user's multimedia identifiable information

	SELECT distinct ? user ? mediaType ? mediaValue
	WHERE {
	? user : h as Per so nal In for mat io n ? mediaValue .
	? mediaValue rdf : type ucsn : MultimediaInfo ;
	rdf : type ? mediaType .
	}

Query 10: Knowing the user's scalar and multimedia sensed information

	SELECT distinct ? user ? sensedType ? sensedValue
	WHERE {
	{ ? user : h asP er son al Inf orm at ion ? sensedValue .
	? sensedValue rdf : type hssn : ScalarProperty ;
	rdf : type ? sensedType . }
	UNION
	{ ? user : h asP er son al Inf orm at ion ? sensedValue .
	? sensedValue rdf : type hssn : MultimediaProperty ;
	rdf : type ? sensedType . } }
	Source Diversity. To highlight the representation of diverse data sources (i.e., sen-
	sors, devices, and external sources) with their properties (e.g., origin, data serialisa-
	tion format), we define Query 11.

Query 11: Generate the list of data sources with their properties SELECT distinct ? source ? origin ? serialisation WHERE { ? source rdf : type ucsn : DataSource ; : origin ? origin ; : serialisation -format ? serialisation . }

Query 12: Uncertainties related to the user

	SELECT distinct ? infoType ? infoValue ? uncertainty ? uValue
	? uNature ? uType
	WHERE {
	{ ? user : h asP er son al Inf orm at ion ? infoValue .
	? infoValue rdf : type ? infoType . }
	UNION
	{ ? user : hasPersonalInfo ? sensedInfo .
	? sensedInfo rdf : type ? infoType ;
	: hasDataValue ? infoValue . }
	? infoValue : hasUncertainty ? uncertainty .
	? uncertainty : uncertaintyValue ? uValue ;
	: nature ? natureInstance ;
	: uncertaintyType ? typeInstance ;
	? natureInstance rdf : type ? uNature .
	? typeInstance rdf : type ? uType . }

TABLE 3 .

 3

1: Review of Privacy Risk Inference Approaches

Definitions 2 and 3: Physical Environment and Spatial Zone

					Definition 1: Data Node
	(DataSource	DataConsumer) (DATA-NODE)
	DataSource ≡ Sensor	Device	ExternalSource
	Sensor ≡ StaticSensor	MobileSensor
	DataSource		(description.VALUE)	(origin.VALUE)	(uri-identifier.VALUE)
	DataSource		serialization-format.VALUE
	DataConsumer ≡ ServiceProvider	ThirdParty
	DataConsumer		collaboratesWith.ThirdParty
	DataConsumer		(description.VALUE)	(uri-identifier.VALUE)
	(Environment	(Platform	¬Device)) (PHYSICAL-ENVIRONMENT)
	Platform ≡ Environment	Device
	Environment	(description.VALUE)	(isDescribedBy.SpatialZone)
	SpatialZone	isComposedOf.Location
	Environment	hosts.(Platform	System)
	Device	(hosts.System)	(hasSoftware.Software)	(hasHardware.Hardware)
	System ≡ Sensor	Actuator	Sampler
	System	(hasSubSystem.System)	(uri-identifier.VALUE)

Definition 5.2: Background-oriented Attribute (Environment-related attribute)

					Definition 5.1: Sensed Attribute
	(SensedInformation) (SENSED-ATTRIBUTE)
	SensedInformation ≡ ScalarProperty	MultimediaProperty
	MultimediaProperty ≡ Image	Audio	Video
	SensedInformation	(describesEntity.(User	Environment))	(access.VALUE)
	SensedInformation	hasSensingStatus.SensingStatus
	SensingStatus	(isSharedWith.DataConsumer)	(isSensedBy.Sensor)
	SensingStatus	hasCommunicationProtocol.CommunicationProtocol
	SensingStatus	(hasSensingEvent.Event)	(hasDataValue.DataValue)
	Event	(hasEventTime.TemporalEntity)	(hasEventLocation.Location)
	DataValue		(hasCaptureTime.TemporalEntity)	(hasCaptureLocation.Location)
	DataValue ≡ ScalarValue	MultimediaValue
		Definition 5.2: Background-oriented Attribute (User-related attribute)
	(PersonalInformation	¬(SensedInformation	access.R/W)) (USER-BG-ATTRIBUTE)
	PersonalInformation ≡ ProfileInformation	ActivityInformation
	(Identifying	PhysicalCharacteristic	PublicLife	Demographic	Ethnicity
	KnowledgeBelief	Preference	Authenticating)	ProfileInformation
	ProfileInformation		(hasCaptureTime.TemporalEntity) (hasCaptureLocation.Location)
	(Activity	UserLocation	Behavioral	SensedInformation)	ActivityInformation
	Activity	isPerformedAt.Event
	Event	(hasEventTime.TemporalEntity)	(hasEventLocation.Location)
	UserLocation	hasLocationTime.TemporalEntity
	Behavioral	(hasCaptureTime.TemporalEntity)	(hasCaptureLocation.Location)
	(Environment	SpatialZone	Device	System	CoverageArea
	Property) (ENV-BG-ATTRIBUTE)
	Environment		(description.VALUE)	(isDescribedBy.SpatialZone)
	Environment		hosts.(Platform	System)
	Platform ≡ Environment	Device
	Device	hosts.System
	System ≡ Sensor	Actuator	Sampler
	Sensor	(currentlyCovers.CoverageArea)
	System	(hasOperatingRange.OperatingRange)	(hasSurvivalRange.SurvivalRange)
	System	(hasSystemCapability.SystemCapability)	(hasSubSystem.System)
	OperatingRange	SurvivalRange	SystemCapability	Property

PersonalInformation

(isCapturedFrom.DataSource) (isSharedWith.DataConsumer)

e 1 θ e 2 θ ... θ e n

  Other represents the set of other profile information that could be specified by the user or by the privacy community when defining risks.

	AND (Environment) isDedicatedFor (Disease)
	-→ {disease}
	• Rule 4: A user is sharing the energy consumption data of her home with data
	consumers without protection. This raises the risks of inferring her presence/ab-
	• Activity represents the set of sensitive information characterizing the user ac-sence, sleeping cycles, and home activities.
	tivity, such that:
	Activity = {behavior ; habit ; performed-activity ; presence-absence ;
	sleeping-cycle ; fraud}	Other
	* comparisonValue is a comparison value with a primitive data type of
	Boolean, Decimal, or String, that is used when a condition is assigned to
	one or more data values.
	-θ is an operator that combines two or more attribute/data elements. It be-
	longs to one of the following categories:

Pro f essional

Social Other

-Generic represents the set of generic profile information Generic = {re-identification ; age ; date-of-birth; marital-status ; gender ; height ; weight ; political-affiliation ; sexual-orientation ; physical-trait ; ethnic-origin ; race ; religion ; language ; dialect ; accent ; preference ; interest} * re-identification is the happening that occurs when the anonymized sensed data (e.g., location data) is matched with its true owner (i.e., user).

-Medical represents the set of medical profile information Medical = {disease ; allergy ; surgery ; immunization ; blood-type ; drug-test ; mental-health ; genetic} -Financial represents the set of financial profile information Financial = {credit-information ; bank-account-information ; transactional-information ; card number ; card type} -Pro f essional represents the set of professional profile information Pro f essional = {salary ; job ; certification ; academic-degree} -Social represents the set of social profile information Social = {family ; friend ; association ; membership ; meeting} --Other represents the set of other activity information that could be specified by the user or by the privacy community when defining risks.

Definition 7 (Privacy Rule). Let PR be the set of privacy rules, {pr 1 ; ... ; pr n }, that define the risks to be detected by the reasoner. A privacy rule, pr ∈ PR, is an inference rule, specified by means of an ontology language (e.g., OWL

[START_REF] Staab | Handbook on ontologies[END_REF]

) in the form of an if-then (antecedent-consequent) sentence. It explicitly specifies a sequence of attribute/data elements that, when combined using the stated operators, results in the disclosure of one or more sensitive information. pr ∈ PR is defined according to the following syntax:

pr : ϕ(E) → SI , where:

• ϕ(E) = represents the sequence of attribute/data elements {e 1 ; e 2 ; ... ; e n } ∈ E, combined through operators θ, such that:

-∀e ∈ E, e ∈ {class ; individual ; comparisonValue}, where: * class is an ontology class denoting a user, environment, attribute (i.e., sensed or background-oriented attribute), data node, or a metadata related to the previous classes (e.g., time, location). * individual is an ontology individual expressing a data value of a class. θ ∈ {Logical Comparison Spatial Temporal Semantic} , where: * Logical = {AND ; OR ; NOT} is the set of logical operators. AND (User) isLocatedIn (Environment) AND (Environment) hasDescription (= "Medical-Center" OR "Hospital")

  The uCSN ontology is extended in the current application to account for privacy risk modeling. Privacy risks are therefore represented as individuals of the ucsn:PrivacyRisk concept. The risk identifiers and values are respectively represented by the ucsn:risk-identifier and ucsn:hasValue properties. On one hand, each ucsn:PrivacyRisk has one or more associated ucsn:SensitiveInformation that may vary from ucsn:ProfileInformation to ucsn:ActivityInformation (cf.

	Definition 6). ucsn:ProfileInformation can be ucsn:Generic (e.g., age, marital-
	status) or domain-specific, such as ucsn:Medical (e.g., disease), ucsn:Financial
	(e.g., card number), ucsn:Professional (e.g., salary), and ucsn:Social (e.g., friends
			Privacy Risk and Sensitive Information
	(PrivacyRisk) (RISK)
	PrivacyRisk	(risk-identifier.VALUE)	(hasValue.VALUE)
	PrivacyRisk	(hasInference.SensitiveInformation)	(hasSensedInfo.SensedInformation)
	SensitiveInformation ≡ PersonalInformation	¬Identifying
	SensitiveInformation ≡ (ProfileInformation	¬Identifying)	ActivityInformation
	(Generic	Medical	Financial	Professional	Social)	ProfileInformation
	SensitiveInformation	hasDescription.VALUE

1 , p 2 , ..., p m to be achieved for data of attributes {a 1 ; a 2 ; . . . ; a m } of c.SA. Appropriate

  ). A protection strategy, p ∈ P c , is a protection vector composed of an appropriate combination of data protection levels p means a combination that meets the privacy preferences of the user u (i.e., δ and eP) while maximizing data utility. p ∈ P c can be represented as follows: .e., highest level of protection). A value between 0 and 1 indicates the level of protection that should be reached when executing a protection function f ∈ PF on the data of a. Knowing that the way to achieve p depends on the selected protection function.Definition 13 (Best Protection Strategy). A best protection strategy, bp ∈ BP c , is an appropriate strategy p ∈ P c , that also satisfies the service preferences of u (expressed by wA), and has the lowest cost of protection (i.e., based on the corresponding combination of protection functions). These constraints are expressed by the ranking score

	p = p 1 p 2 ... p m , where: ∀i ∈ [1; m], p i ∈ [0; 1] and ∃! a i ∈ c.SA : p i ∼ a i Definition 12 (Data Protection Level). A data protection level, p, expresses the amount of protection to be achieved for the data values of an attribute a ∈ c.SA. p is probabilistic with a value between 0 and 1, where 0 means that data is shared in fine-granular version (i.e., without any protection), and 1 means that data is not shared (iassigned to p, which is computed as follows: score( p) = Rank( p, wA, cPF) → N , where:

∀ p i ∈ P c : p i |= bp only if ∀ p j ∈ P c , score( p j ) ≤ score( p i )

  Algorithm 4 details the Rank() function.Therefore, p is said to be one of the best protection strategies, bp ∈ BP c , only if it has the highest ranking score:

ω 11 ω 12 . . . ω 1m ω 21 ω 22 . . . ω 2m

								p 1
	. . .	. . .	. . .	. . .	    	;	    	p 2 . . .
	ω n1 ω n2 . . . ω nm

ω 11 ω 12 . . . ω 1m ω 21 ω 22 . . . ω 2m

	. . .	. . .	. . .	. . .
	ω n1 ω n2 . . . ω nm

ω 11 ω 12 . . . ω 1m ω 21 ω 22 . . . ω 2m

  Example 10. According to Examples 8 and 9, the best strategy delivered to Alice in her situation is bp = 0.6 0.3 . Once implemented, the risk values will be minimized to:

									p 1		
		. . .	. . .	. . .	. . .	    	×	    	p 2 . . .	    	    
		ω n1 ω n2 . . . ω nm				p m
		r 1 .value
	 	r 2 .value
		r 3 .value

  Step 3 (lines[START_REF] Greenleaf | Global data privacy laws 2019: 132 national laws & many bills[END_REF][START_REF] D'acquisto | Privacy by design in big data: An overview of privacy enhancing technologies in the era of big data analytics[END_REF][START_REF] Cavoukian | Start with privacy by design in all big data applications[END_REF]: It adds the calculated costs to the scores of strategies. Then, only strategies with the highest ranking score are selected and added to the array BPc[][], which will consequently include the best strategies that could be implemented in the current situation (lines 20-21).

	Algorithm 4: Best Strategy Selection -Rank() function
		Input: Pc[][], wA[], cPF[]; // the array of protection strategies, vector of weights, and the
		array of costs of protection functions;
		Output: BPc[][]; // the array of best protection strategies;
	1 Variables: sortedWA[], A[], minP, Score[][], maxScore, CostPc[][];
	2 begin
	3	sortedWA ← sortAndFilter(wA[]); // sorts wA[] in a descending sequence and
		removes redundant values;
	4	foreach weight ∈ sortedWA do
	5	A ← attributesSimilarWeight(wA[], weight);
	6	// the array A will include attributes having the same weight weight;
	7	foreach a ∈ A do
	8	minP ← getMinP(Pc[][], a); // minimal protection level to be assigned to a;
	9	Score ← addScore(Pc[][], minP, a, wA[]); // updates the score of strategies
		having minP;
	10	maxScore ← getMaxScore(Score[][]); // returns the maximal score;
	11	for k ← 0 to |Score| do
	12	if (Score[k][1] ! = maxScore) then
	13	Pc ← deleteStrategy(k); // keeps only strategies with the highest score;
	14	for i ← 0 to |Pc| do
	15	for j ← 0 to |Pc[0]| do
	16	if (Pc[i][j] ! = 0) then
	17	CostPc[i][1] = CostPc[i][1] + cPF[j]; // calculate the cost of protection
		for each strategy;
	18	Score ← addCostToScore(Score[][], CostPc[][]); // adds the cost to the strategy score;

19 maxScore ← getMaxScore(Score[][]); 20 BPc ← selectBestStrategies(Pc[][], Score[][], maxScore); // BPc includes only the best strategies, i.e., the strategies with the highest score;

ω 11 ω 12 . . . ω 1m 1 -δ ω 21 ω 21 . . . ω 2m 1 -δ

									α
	. . .	. . .	. . .	. . .	. . .	    	→ M =	    
	ω n1 ω n1 . . . ω nm 1 -δ

11 α 12 . . . α 1m v 1 α 21 α 22 . . . α 2m v 2

						
	. . .	. . .	. . .	. . .	. . .	    
	α n1 α n2 . . . α nm v m

α 11 α 12 . . . α 1m v 1 α 21 α 22 . . . α 2m v 2

	. . .	. . .	. . .	. . .	. . .

α n1 α n2 . . . α nm v m

	
	    	, where:

  DN, denotes the data source from which d is captured. source can derive from connected environments (e.g., sensor, device) or web environments (e.g., social media platform, public database).

.. ; meta n } is the set of metadata characterizing d. For instance, M can include the following metadata: * t capture , denotes the time of capture of d. * l capture , denotes the location of capture of d. * source ∈

  Algorithm 5: P-SGD Process Input: a, c, t current , f current , p target ; // attribute, default deviation value, time of capture and protection function of d current , and the targeted protection level; Output: p current ; // the protection level to be assigned to d current ; Trans[][], depend t , simScore, , η; // transition matrix, dependency score of data, similarity score of prot-functions, random noise and deviation rate; ; // Trans[][0] is the t old column of d old values; 4 simScore ← sim(Trans[a][2], f current ); // Trans[][2] is the f old column associated to d old × simScore × depend t ; // calculate the value of η; 9 p current = p oldη ; // calculate the value of p current ; 10 if (p current <= p target ) then 11 p current = p target ; // check the validity of the calculated p current value ;

	2 begin
	3	depend t = 1 -t current -Trans[a][0] a.τ
		values;
	5	if (depend t ! = 0 && simScore ! = 0) then
	6	// dependent data values and dependent protection functions;
	7	← randomNumber(0, 1); // returns a random value between 0 and 1;

1 Variables: 8 η = c 12 else 13 p current = p target ; // data values or/and protection functions are independent; 14 Trans ← updateTransMatrix(a, t current , p current , f current ); 15 return p current

Source: https://termly.io/resources/infographics/privacy-laws-around-the-world/

https://www.sciencedirect.com/journal/future-generation-computer-systems

https://dl.acm.org/journal/toit

https://triplydb.com/ctic/reco

https://spider.sigappfr.org/uCSNdoc/index-en.html

https://spider.sigappfr.org/research-projects/ucsn/ (Ontology Files)

http://bit.ly/uCSN-clarity-evaluation

https://spider.sigappfr.org/uCSNdoc/index-en.html

return R c [][][][]The pseudo-codes of the functions called in the reasoning algorithm are detailed in the prototype source code provided in Section 3.5.

https://spider.sigappfr.org/research-projects/privacy-oracle/

https://protege.stanford.edu/

https://inkscape.org/

return BPc[][]

https://spider.sigappfr.org/research-projects/delta-risk/

https://inkscape.org/

https://spider.sigappfr.org/research-projects/psgd/ (P-SGD Prototype)

Acknowledgements

"No one who achieves success does so without acknowledging the help of others. The wise

(User) hasPersonalInformation (SensedInformation = Location) AND (Location

Environment Information. The context-aware application may need to extract an expressive description of the user's surrounding environment, and/or the services provided to her. The following queries answer these needs:

• Query 6: Generates a detailed view of the user surrounding environment, i.e. spatial description, systems (e.g., sensors, actuators) and devices deployed in the environment, as well as the devices attached to the user.

Summary

Many works adopted ontologies for better semantic representation of user contexts. However these works do not fully address the challenges of information coverage, information diversity, source diversity, and information uncertainty. Moreover, some context models contain domain specific knowledge and are not re-usable for different application purposes. Consequently, we propose in this chapter uCSN, a generic, modular, and extensible ontology for user-Context modeling in Sensor Networks. uCSN provides a high-level coverage of context information by introducing new concepts and properties and importing others from the DPV [START_REF] Polleres | Data Privacy Vocabulary (dpv)[END_REF], SOSA/SSN [2], HSSN [START_REF] Mansour | Hssn: An ontology for hybrid semantic sensor networks[END_REF], and W3C Uncertainty [3] ontologies. We implemented uCSN and evaluated its accuracy, clarity, performance, and consistency. We only detail in this chapter the pseudo-code of the main process, including the minimization of δ. However, the pseudo-codes of the remaining functions called in Algorithm 2 are detailed in the prototype source code provided in Section 4.5.

Best Strategy Selection

The second operation of δ-Risk is performed when the number of strategies resulted from the first operation is greater than 1 (i.e., |P c | > 1). At this point, ranking the strategies and selecting the K-best ones to be proposed to the user becomes a need. K expresses the number of best protection strategies, i.e., those with the highest ranking score (cf. Definition 13). However, fixing the maximum value of Kis challenging as many factors may contribute to the perceived choice overload, such as the number of options, time constraints, and user expertise [START_REF] Chernev | Choice overload: A conceptual review and meta-analysis[END_REF]. Accordingly, we assign the following default values to max(K) based on user profiles: 1 for beginner, 3 for intermediate, and 5 for advanced. Nevertheless, the value of max(K) can be changed manually by the user, and also updated by the system administrator based on user interactions.

The best protection strategies should best meet the privacy and service preferences of the user (cf. Section 4.4.1, while also minimizing the cost of data protection.

To achieve this, the current operation ranks the resulting strategies (i. proposed a context-aware security approach, that provides authentication, authorization, access control, and privacy-preserving to fog and edge computing environments. Gheisari et al. [START_REF] Gheisari | A context-aware privacy-preserving method for iot-based smart city using software defined networking[END_REF] introduced a context-aware privacy-preserving approach for IoT-based smart city using Software Defined Networking. Sylla et al. [START_REF] Sylla | Towards a context-aware security and privacy as a service in the internet of things[END_REF] presented a context-aware security and privacy as a service (CASPaaS) architecture to inform the user about the contextual risks involved. Gao et al. [START_REF] Gao | Balancing trajectory privacy and data utility using a personalized anonymization model[END_REF] proposed a personalized anonymization model for balancing trajectory privacy and data utility.

Qiu et el. [START_REF] Qiu | Mobile semantic-aware trajectory for personalized location privacy preservation[END_REF] provided a semantic-aware personalized privacy model that studies user requirements and location's privacy sensitivity to adapt the trajectory construction accordingly. Xiong et al. [START_REF] Xiong | A personalized privacy protection framework for mobile crowdsensing in iiot[END_REF] proposed a personalized privacy protection model based on game theory and data encryption.

Summary

We introduce in this chapter a new privacy-preserving stochastic gradient descent solution (P-SGD) that can be integrated into numerous existing privacy models in order to provide an additional layer of protection against data inference attacks during protection transitions. P-SGD features an iterative non-deterministic process that gradually decreases the data protection level during the protection descent phases.

This allows preserving an appropriate precision gap between sequential protected data values to avoid potential data leakages.