Pavol Sokol
email: pavol.sokol@upjs.sk

Veronika Kopčová
email: veronika.kopcova@student.upjs.sk

Lessons learned from honeypots -statistical analysis of logins and passwords

Keywords: honeypot, login, password, spatial data, Chi-square test, kappa statistic

Honeypots are unconventional tools to study methods, tools and goals of attackers. In addition to IP addresses, timestamps and count of attacks, these tools collect combinations of login and password. Therefore, analysis of data collected by honeypots can bring different view of logins and passwords. In paper, advanced statistical methods and correlations with spatial-oriented data were applied to find out more detailed information about the logins and passwords. Also we used the Chi-square test of independence to study difference between login and password. In addition, we study agreement of structure of password and login using kappa statistics.

Introduction

In current information society we deal with an increasing security threat. Therefore, an important part of information security is protection of information. Common security tools, methods and techniques used before are ineffective against new security threats. Therefore, it is necessary to choose other tools and techniques. It seems that the network forensics, especially honeypots and honeynets, are very useful tools. The use of the word "honeypot" is quite recent [START_REF] Pouget | Honeypot-based forensics[END_REF], however honeypots have been used for more than twenty years in computer systems. It can be defined as a computing resource, whose value is in being attacked [START_REF] Spitzner | The honeynet project: Trapping the hackers[END_REF]. Lance Spitzner defines honeypot as an information system resource whose value lies in unauthorized or illicit use of that resource [START_REF] Spitzner | Honeypots: Tracking Hackers[END_REF].

The most common classification of honeypot is classification based on the level of interaction. The definition of level of interaction is the range of possibilities the attacker is given after attacking the system. Honeypots can be divided into low-interaction and high-interaction. Example of this type of honeypots is Dionaea [START_REF]Dionaea project[END_REF]. On one hand, low-interaction honeypots emulate the characteristics of network services or a particular operating system. On the other hand, a complete operating system with all services is used to get more accurate information about attacks and attackers [START_REF] Joshi | Honeypots: a New Paradigm to Information Security[END_REF]. This type of honeypot is called high-interaction honeypot. Example of this type of honeypots is HonSSH [START_REF]HonSSH project[END_REF].

Concept of honeypot is extended by honeynet -a special kind of highlevel interaction honeypot. The honeynet can be also referred to as "a virtual environment, consisting of multiple honeypots, designed to deceive an intruder into thinking that he or she has located a network of computing devices of targeting value" [START_REF] Abbasi | Experiences with a Generation III virtual Honeynet[END_REF]. Four main parts of the honeynet architecture are known, namely data control, data capture, data collection and data analysis [START_REF] Spitzner | The honeynet project: Trapping the hackers[END_REF][START_REF] Abbasi | Experiences with a Generation III virtual Honeynet[END_REF].

The main reason to use these tools is collection and analysis of data captured using honeypots and honeynets. Learning new unconventional information about the attacks, attackers and tools is involved in the protection of the network services and computer networks of organizations. Each honeypot collects the IP addresses of attackers and special data according to type of honeypot. In paper we use the low-interaction honeypots Kippo [START_REF][END_REF], which collect timestamps, IP address of attacker, type of SSH clients and combination of logins and passwords. For purpose of this paper we focus on logins, passwords and their combinations.

This paper is a sequel to the analysis of data collected from honeypots and honeynets. In paper [START_REF] Abdou | What lies beneath? analyzing automated ssh bruteforce attacks[END_REF] authors focus on automated secure shell (SSH) bruteforce attacks and discuss the length of passwords, password composition compared to known dictionaries, dictionary sharing, username-password combination, username analysis and timing analysis.On the other hand, the main aim of this paper is to provide light on attackers' behaviour, and provide recommendations for SSH users and administrators. In this paper we focus on two main statistical analyses. Firstly, chi-square test of independence that analyzes group of differences. Secondly, Kappa statistics that measures agreement between observes.

To formalize the scope of our work, authors state two research questions:

-What attribution of logins, passwords and their attribution are significant for security of systems? -What is the relationship between the logins and passwords and origin of attacks?

This paper is organized into seven sections. Section II focuses on the review of published research related to lessons learned from analysis in the honeypots and honeynets. Section III outlines the dataset and methods used for experiment. Sections IV-VI focus on statistical and spatial analysis of logins, passwords and combination of them. The last section contains conclusions, discussion and our suggestions for the future research.

Related works

As it was mentioned before, the main task of honeypots and honeynet is in analysing the captured data and searching for new knowledge about the attacks and attackers. This section provides overview of papers that focus on lessons learned from honeypots and honeynets data.

Analysis of data collected by high-interaction honeypots are discussed in Nicomette et. al. [START_REF] Nicomette | Set-up and deployment of a high-interaction honeypot: experiment and lessons learned[END_REF] and Alata et. al. [START_REF] Alata | Lessons learned from the deployment of a high-interaction honeypot[END_REF]. [START_REF] Nicomette | Set-up and deployment of a high-interaction honeypot: experiment and lessons learned[END_REF] concentrate on the attacks executed by the SSH service and the activities executed after attackers gain access to the honeypot. Attackers and their activities after logging in are discussed in [START_REF] Alata | Lessons learned from the deployment of a high-interaction honeypot[END_REF]. Authors correlated their findings with the results from distributed low-interaction honeypots.

But then, low-interaction honeypots are discussed in Sochor and Zuzcak in papers [START_REF] Sochor | Study of internet threats and attack methods using honeypots and honeynets[END_REF][START_REF] Sochor | Attractiveness study of honeypots and honeynets in internet threat detection[END_REF]. In [START_REF] Sochor | Study of internet threats and attack methods using honeypots and honeynets[END_REF] data show currently spreading threats caught by honeypots. But then, the thorough interpretation of lessons learned from using the honeypots was outlined. Principal results are shown in [START_REF] Sochor | Attractiveness study of honeypots and honeynets in internet threat detection[END_REF], in addition they underline the fact that the differentiation between honeypots according to their IP address is quite rough (e.g. differentiation for academic and commercial network).

SGNET was used by [START_REF] Canto | Large scale malware collection: lessons learned[END_REF] as a distributed system of honeypots. They doubt the floatation of representative malware samples datasets. They claim that the false negative alerts differ from what they are allowed to be. Additionally, there is occurrence of false positive alerts on abrupt places. Clustering attack patterns with a suitable similarity measure are discussed in [START_REF] Thonnard | A framework for attack patterns' discovery in honeynet data[END_REF]. The results of this study allow identification of the activities of several worms and botnets in the collected traffic.

Time-oriented data were of interest in [START_REF] Sokol | Study of attack using honeypots and honeynets lessons learned from time-oriented visualization[END_REF]. Visualization of this data in honeypots and honeynets was outlined. In addition, the authors provide results based on heatmaps that is special visualisation. It was proved that the time is an important aspect of attacks. Attackers are mainly active at night (according to the honeynets time zone analysis).

Next example of using low-interaction honeypots (Dionaea) in order to studying is in [START_REF] Skrzewski | Network malware activity-a view from honeypot systems[END_REF]. It presents the results of nearly two years operation of honeypot systems, installed on unprotected research network. The paper focuses on the information about the life time of malware programs and the long-time malware activity.

Data collection and analysis methodology

The data were collected from the honeynet located in the campus network. The honeynet that runs on port 22 consists of SSH honeypots Kippo [START_REF][END_REF] in lowinteraction mode. The honeypots do not allow attackers to log into shell in this mode, they only capture data about network flows entering the honeynet. The honeypots have collected authentication attempts from 3rd August 2014 to 24th December 2015. During this period 1 391 746 records were collected. Each record contains username and password used in an attempt, as well as IP address and version of client of attacker, beginning and end of sessions. Dataset contain unique 5 488 logins, unique 205 477 passwords and unique 212 687 combinations of login and password.

For spatial analysis, each record was competed with spatial data using the IP-API.com service [START_REF]IP-API.com service[END_REF]. This service provides free use of its Geo IP API through multiple response formats. Each record was supplemented with time zone, country, region, city, Internet service provider (ISP), and global positioning systems (GPS) coordinates.

Data cleaning and analysing was performed using, the HoneyLog framework [START_REF] Sokol | Data collection and data analysis in honeypots and honeynets[END_REF]. This framework for analysing honeypots and honeynets data is based on a PHP framework of FuelPHP and JavaScript libraries. It has two main segments: a client part and a server part.

For purpose of paper, important part of dataset consists of combination of logins and passwords. Since the logins and passwords are the qualitative data it needed to be converted into quantitative data. For each login and password, we assigned following attributes:

-contains only lowercases login or password contains only lowercase characters (ASCII codes between 97 and 122); -contains only uppercases -login or password contains only capital characters (ASCII codes between 65 and 90); -contains only numbers -login or password contains only numbers (ASCII codes between 65 and 90); -contains number -login or password contains at least one number; -contains year -login or password contains year (2014 or 2015) and -contains special character -login or password contains at least one special character (ASCII codes 32-47,58-64,91-96 and 123-127);

In paper we use two statistical methods: chi-square test of independence and kappa statistics. The Chi-square test of independence, also known as the Pearson Chi-square test [START_REF] Mchugh | The chi-square test of independence[END_REF], is one of the most useful tools for testing hypotheses when the variables are nominal. It is a non-parametric tool designed to analyse group differences. Each non-parametric test has its own specific assumptions as well. The assumptions of the Chi-square include:

1. The data in the cells should be frequencies, or counts of cases. 2. The categories of the variables are mutually exclusive. 3. Each subject may contribute data to one and only one cell in the Chi-square. 4. The study groups must be independent. 5. While Chi-square has no rule about limiting the number of cells (by limiting the number of categories for each variable), a very large number of cells (over 20) can make it difficult to meet assumption #6 below, and to interpret the meaning of the results. 6. The value of the cell expected should be 5 or more in at least 80% of the cells, and no cell should have an expected of less than one (3). This assumption is most likely to be met if the sample size equals at least the number of cells multiplied by 5.

On the other hand, Kappa [START_REF] Viera | Understanding interobserver agreement: the kappa statistic[END_REF] is intended to give the reader a quantitative measure of the magnitude of agreement between observers. Interobserver variation can be measured in any situation in which two or more independent observers are evaluating the same thing.

Logins

The first observed aspect of analysis is login. Top 10 logins are shown in Fig. 1(left). This diagram shows that the most tested login is root. According to other logins, attackers test default logins for different systems (admin, user, PI, Oracle, etc.). Also attacker is often trying the same login and password combination. In this paper we focus on analysis of login with the largest number of unique passwords. Top 10 logins with unique passwords are shown in Fig. 1 (right). From this perspective, the most tested login is root. Attacker also tests following logins with large number of unique passwords: user, test, nagios, mysql.

Attributes of logins

According to Linux documentation for tool useradd [START_REF]Linux documentation for useradd[END_REF], Unix/Linux's username (login) equals regular expression [a-z ][a-z0-9 -]*[$]?$. This expression means that the first character of login is lowercase and other characters are lowercases or numbers. Also capital letters are not allowed. Moreover, logins must neither start with a dash nor contain a colon or a whitespace, end of line and tabulation etc. Documentation notes that using a slash may break the default algorithm for the definition of the user's home directory.

As we can see in Fig. 2, the largest group of logins is logins containing only lowercases (88,47 %). A slight amount of logins contains a number (7,89 %) or special character (4,46 %). According to our opinion, logins, which contain capital letters or special character are tested by special group of attackers -script kidies or attacks were directed to other systems like UNIX/LINUX.

Another studied aspect is the length of logins (Fig. 3). According to above mentioned Linux documentation [START_REF]Linux documentation for useradd[END_REF], logins may only be up to 32 characters long. The length of tested logins is in range from 1 to 50 characters. The logins with length between 33 and 50 are a sign of incorrect use of automated

Frequency of ASCII characters in logins

For purpose of the frequency of ASCII characters in logins we created frequency table (Fig. 4). This table takes into account the frequency of at least one occurrence of a given character within a login. ASCII character with the highest occurrence is lowercase a. Lowercase e, which is the most frequent character in many alphabets (e.g. English, French and German alphabet), is in the 2nd place. On the other hand, lowercase q and x have the lowest occurrence. The most used number is 1 and 2. On the other hand, 6 and 8 are used at least. In the most cases the login contain special character /. In contrast to this, pass-words do not contain this character. According to our opinion, it is again sign of incorrect use of automated programs.

Logins and origin of attacks

Tab. 1 shows top 20 countries, which are origin of attacks. For each country, table shows the count of attacks, top login and its count and percentage and the top three logins, which are tested by attackers from country. The login root is the most tested login from each top 20 country. The interesting fact is that percentage of tested login root to all tested passwords from country is different. On one hand, there is high percentage in countries such as China, Hong Kong, France, Hungary etc. On the other hand, there is low percentage in countries such as Argentina or Singapore. The most tested group of logins are root/admin/ubnt, root/admin/test and root/admin/user. Based on this it can be concluded that groups of tested logins, considering origin of attacks, can be interesting indicator for finding group of attackers.

Passwords

The second observed aspect is password. Compared to logins the types of passwords are pronounced. The most commonly used password is admin. Top 10 the most used passwords (123456, password, root, 1234, etc.) is shown in Fig. 5 (left). Like in login, we focus on the passwords that are used with the most unique logins. In this regard, the most used login is password (none). Other most used passwords with the most unique logins are shown in Fig. 5 (right).

Attributes of passwords

In this section we focus on attributes of passwords. These attributes are shown in Fig. 6. Compared to the login, Linux documentation does not restrict password from the perspective of characters (no security). It is due to the fact that system stores hash of password (no clear password). According to Fig. 6 the most frequently used passwords contain numbers (50,36 %). A slightly smaller number of the passwords containing only lowercase (45,24 %). In contrast, entries containing only a number occur almost three times less often. An interesting fact is that among the top 10 passwords were four passwords containing only numbers (123,1234,12345,123456) (9,9 %) and the only one password containing only lowercase characters (test) (0,83 %). Another attribute of password is its length. The length of the password is in the range between 0 and 98. The most passwords contain 8 characters. The largest number of length of passwords is in the range between 3 and 20 characters. It is worth mentioning that passwords with 32 characters are hashes (e.g. 706e642a056c7e894ed5a01e55700004). Number of characters of passwords is shown in Fig. 7 (left). Passwords with 33 characters and more are a sign of incorrect using of tool (e.g. #files th a:hover { background:transparent; border...) or manual attack by script-kidies (e.g. rooooooooooooooooooooooooooooooooooooooooooooooooooooooooooot)

We also focus on the largest group of passwords that contain only numbers. In this group the largest subgroup of passwords contains 8 respectively 6 digits. Number of length of passwords, which contain only numbers, are shown in Fig. 7 (right).

Frequency of ASCII characters in passwords

Like for a login, the frequency tables of ASCII characters in passwords were created (Fig. 8). This table takes into account the frequency of at least one occurrence of a given character within a password. ASCII character with the highest occurrence is lowercase a. Lowercase e, which is the most frequent character in many alphabets (e.g. English, French and German alphabet), is in the 2nd place. On the other hand, capital V and capital K have the lowest occurrence. Similar to login, the most used number is 1 and 2. On the other hand, 6 and 7 are used the least. In the most cases the passwords contain special characters @ and !. Interesting fact is occurrence of characters Horizontal Tab (ASCII code 9) and Device control 1-4 (ASCII codes 17-20) in passwords (e.g. %username DC1 3!@, %username DC2 34567890-=). These codes are used for software flow control (e.g. DC 1 for quit application). These codes are not visible in logs. Passwords with these codes begin with special characters !, % or @ and they are linked to login root. According to our opinion, passwords with these codes are used in incorrect using of a tool by script-kidies.

Passwords and origin of attacks

Tab. 2 shows top 20 countries, where attacks originated. For each country, table shows the count of attacks, the most used passwords with their count and percentage and the top three logins, which were tested by attackers from country. In table (none) means that password without chars was inputted. The password 123456 is the most tested from 7 top countries. An interesting finding is password weubao in Hong Kong. In case of logins, there is similar the most tested groups of logins considering the origin of attacks. In case of passwords, there are no similar groups with top 3 passwords. Based on this it can be concluded that there is relationship between passwords and origin of attacks.

Combination of logins and passwords

In previous sections we focus on logins and passwords. Since attacker test combinations of login and password, we focus on this aspect. The most tested combination of login and password, which are used by attackers, are following: root/admin, root/root, root/Password, root/123456, root/toor, root/1234, root/1 etc. In the following sections we focus on relationship between logins and passwords.

Association between passwords and logins and their attributions

For purpose of association between passwords and logins and their attributions the Chi-square test of independence [START_REF] Mchugh | The chi-square test of independence[END_REF] is used. In our case study, there are two groups: passwords and logins. The independent variable is login/password and dependent variable is its attribution: special char, only number, number, only uppercase. Our goal is to find out, whether login and password differ. Tab. 3 shows our data where marginals were calculated.

The formula for calculating Chi-Square values is:

χ 2 = (O -E) 2 /E
, where O is observed and E is expected value. Chi-Square expecteds are calculated as follows: E = M r * M c/n. Table 4 provides the results of this calculation for each cell. Expected value (chi square value). Now we sum cell chi square values to obtain chi square statistic for the table. In this case it is 3571. The chi square table requires knowledge of degrees of freedom to determine the significance level of the statistics. It holds: df = (numberof rows -1) * (numberof columns -1) = 1 * 3 = 3. The critical value for chi square distribution with df = 3 is 7,815. So our calculated value is bigger than critical value: 3571 > 7, 815 and we can conclude that null hypothesis is rejected, which means that there is a relationship between login and password. However, this result does not specify what impact on this relationship. It can be seen in Tab. 4. The largest values of cell chi square values can be seen in a special char for login. It means that number of logins that contain special char is significantly greater than expected value. On the other hand, cell chi square values less than 1 means that number of observed cases is equal to number of expected cases. So there is no effect on password for number and only uppercase.

Based on the above mentioned, it can be concluded that there is a relationship between the login and password. Especially if the password contains a special character or number. Logins typically contain only lowercases. Therefore, if it contains special characters, numbers, at least one number or all capital characters, there is a relationship between the login and password. In the greatest extent it occurs in case of login with special character (e.g. password garland!@# for login root). Another example is the login root!"?$%& with password (none). In these cases, it can be concluded that it is not a dictionary attack, respectively brute force attack, but a manual attack or automated attack by script-kidies. For study agreement of structure of password and login, we use kappa statistics. The data were collected in Table 6.

We can simply calculate the percentage of agreement as a sum of diagonals divided by number of observations, we have 90,3% agreement. But that measure does not take into account the random chance of agreement. We calculate expected agreement that is P e = 0, 416. Formula for kappa: K = (P o-P e)/(1-P e) = 0, 834. Using table in [START_REF] Viera | Understanding interobserver agreement: the kappa statistic[END_REF] we can conclude that agreement of login and password is substantial.

Conclusions, recommendations and future works

Attacks collected by honeypots are interesting source for further analysis. In paper we focus on logins, passwords and their combination. We outline statistical analysis of collected data. General rules for passwords creating state that password should contain lowercase, capital letter, number and special character. Length of password should be 8 or more. According to above mentioned, we propose to use capital V, capital K and number 6 and 7 in passwords. We recommend avoiding the following lowercases: a,e,i,n,r,o,s and following numbers: 1,2,3 and 9. To strengthen password it is recommended to use password with length 10 or more and special characters: [,],{ and }.

Since the combination of login and password is used in attack, it is needed to deal with the strength of login. General safety rules state that default passwords and root should not be used. We agree with these rules, but above mentioned we propose the following rules for login creating. The first character of password must be lowercase. Lowercase q or x look like the best choice. The login must have length between 1 and 32 characters. We recommend use the login with length between 12 and 32 characters. We recommend avoiding the following lowercases: a,e,i,r,n,o,s,t,l,c and following numbers: 1,2,3 and 0. In general, using the numbers increase the security of the password, especially numbers: 6,7 and 8.

As we showed before, Chi-square test of independence and Kappa statistics show that there is relationship between logins and passwords. On the basis of these tests, attacks can be divided into manual attacks and automated attacks.

In the future, the research in field of analysis of collected data will continue. We will primarily focus on types of clients and time-oriented analysis from the perspective of logins and passwords.

Fig. 1 .

 1 Fig. 1. Top 10 logins and top 10 logins with unique passwords

Fig. 2 .

 2 Fig. 2. Attributes of logins

Fig. 3 .

 3 Fig. 3. Length of logins

Fig. 4 .

 4 Fig. 4. Frequency table of ASCII characters in logins

Fig. 5 .Fig. 6 .Fig. 7 .

 567 Fig. 5. Top 10 passwords and top 10 passwords with unique logins

Fig. 8 .

 8 Fig. 8. Frequency table of ASCII characters in passwords

Table 1 .

 1 Logins and top 20 countries

	Country	Count of attack	Top login	Count (percent) of top login	The 2nd and 3rd login
	China	895 945	root	873 321 ( 97,47 %)	admin/ubnt
	Hong Kong	219 621	root	219 025 (99,73 %)	admin/ubnt
	France	123 430	root	122 889 ( 99,56 %) admin/developer
	United States	92 721	root	81 381 (87,77 %)	admin/ubnt
	Hungary	6 952	root	6 820 (98,10 %)	deployer/ubuntu
	Rep. of Korea	5 459	root	4 074 (74,63 %)	admin/test
	Germany	2 872	root	804 (27,99 %)	admin/test
	Russia	2 851	root	1 848 (64,82%)	admin/user
	Brazil	2 609	root	868 (33,27%)	admin/ubnt
	Argentina	2 131	root	87 (4,08%)	mysql/jboss
	Singapore	2 113	root	188 (8,90%)	admin/test
	Vietnam	2 021	root	1 095 (54,18%)	admin/test
	UK	1 536	root	472 (30,73%)	admin/ubnt
	Poland	1 358	root	641 (47,20%)	admin/user
	Netherlands	1 343	root	437 (32,54%)	admin/user
	Canada	1 276	root	597 (46,79%)	admin/test
	Spain	1 142	root	467 (40,89%)	admin/ubnt
	Japan	1 127	root	697 (61,85%)	admin/ubnt
	Ukraine	1 124	root	642 (57,12%)	admin/user
	Turkey	939	root	712 (75,83%)	admin/ubnt

Table 2 .

 2 Passwords and top 20 countries

	Country	Count of attack	Top password	Count (percent) of top password	The 2nd and 3rd password
	China	895 945	admin	6 384 (0,71%)	password/123456
	Hong Kong	219 621	wubao	188 (0,09%)	jiamima/(none)
	France	123 430	(none)	112 (0,09%)	fff1fff/password
	United States	92 721	default	895 (0,97%)	(none)/admin
	Hungary	6 952	123456	14 (0,20%)	(none)/raspberry
	Rep. of Korea	5 459	123456	90 (1,65%)	admin/default
	Germany	2 872	ADMIN	164 (5,71%)	123456/password
	Russia	2 851	password	58 (2,03%)	admin/123456
	Brazil	2 609	123456	48 (1,84%)	default/admin
	Argentina	2 131	123456	44 (2,06%)	password/server
	Singapore	2 113	123456	23 (1,09%)	1234/test
	Vietnam	2 021	(none)	181 (8,96%)	password/admin
	UK	1 536	123456	114 (7,42%)	password/admin
	Poland	1 358	123456	28 (2,06%)	password/12345
	Netherlands	1 343	(none)	144 (10,72%)	admin/1234
	Canada	1 276	password	43 (3,37%)	123456/ C@r*i%n$t#o!(s
	Spain	1 142	admin	8 (0,70%)	ubnt/12345
	Japan	1 127	default	36 (3,19%)	admin/ubnt
	Ukraine	1 124	(none)	80 (7,12%)	admin/root
	Turkey	939	admin	23 (2,45%)	123456/123456789

Table 3 .

 3 Calculation of marginals

		special char	only number	number	only uppercase	Marginals Mr
	Password	41 623 177 543 442 514	3 862	665 542
	Login	989	226	1933	50	3 198
	Marginals Mc 42 612 177 769 444 447	3 912	668 740

Table 4 .

 4 Cell expected values and (cell Chi-square values)

		special char	only number	number	only uppercase
	Password 42408,22 (14,54) 176918,89 (2,20) 442321,60 (0,08) 3893,29 (0,25)
	Login	203,78 (3025,76) 850,11 (458,20) 2125,40 (17,42) 18,71 (52,34)

Table 5 .

 5 Examples of logins and passwords in Chi-square test of independence

		special char	only number	number	only uppercase
	Password garland!@# 30011970 itac2014 GENGISHAN
	Login	root! ?$%& 12345678 Aa12345root	NASA

Table 6 .

 6 Kappa statistics

	Login/Password	special char	only number	number	only uppercase	Total
	special char	547	38	22	0	607
	only number	0	218	0	0	218
	number	11	98	1088	0	1197
	only uppercase	1	4	27	13	45
	total	559	358	1137	13	2067

Table 7 .

 7 Examples of logins and passwords in Kappa statistics

	Login/Password	special char	only number	number	only uppercase
	special char	root/, . kl;iop890	root/ - * 123456	root-*123456	-
	only number	-	123456 123456	-	-
	number	rootzo9 * ?qp	tom6bj 278497	r00t loler11q	-
	only uppercase	NASA N.A.S.A	SZIM 888888 USERID passw0rd CSICI CCC
	6.2 Agreement of structure of password and login

Acknowledgments

We would like to thank colleagues from the Czech chapter of The Honeynet Project for their comments and valuable input. This paper is funded by the Slovak Grant Agency for Science (VEGA) grants under contract No. 1/0142/15 and No. 1/0344/14, VVGS projects under contract No. VVGS-PF-2016-72610 and No. VVGS-PF-2016-72616 and Slovak APVV project under contract No. APVV-14-0598.


Antonín Pavlíček
email: antonin.pavlicek@vse.cz

Petr Doucek
email: doucek@vse.cz

Social media and social CRM

Keywords: Customer Relationship Management, Customer Care, Social Media, Social Networking Sites, Social CRM, Enterprise Information System, Facebook, Good Practice, Telecommunications, Mobile Operators, Response Time, Czech Republic, France, USA

The main aim of the paper is to analyse social CRM, specifically Facebook communication of mobile operators in the United States, the Czech Republic, and France to examine the state of social customer care on social networking sites and consider possibilities, need for automatization and improvement of EIS. The analysis is based on messages and answers posted on Facebook pages and measuring the response time on over 1.3 million unique questions. It identifies trends, looks for certain repeating patterns or correlations and as a result offers a comprehensive report on the current use of social media as a channel for customer care amongst mobile operators. The theoretical background will also propose an advice on how to maintain a healthy relationship with customers on social networks and add a real value both for customers and company.

Introduction

There is no doubt that social networking sites (SNS) have recently become new communication standard in e-society [START_REF] Doucek | E-Society -Perspectives and Risks for European Integration[END_REF]. Thanks to its versatility SNS can be used to find the job [START_REF] Boehmova | How Employers Use Linkedin for Hiring Employees in Comparison with Job Boards[END_REF], romantic partner, latest gossip [START_REF] Dunaev | Seeking Safe Sex Information: Social Media Use, Gossip, and Sexual Health Behavior Among Minority Youth[END_REF], play interactive games [START_REF] Sudzina | Escapist Motives for Playing Facebook Games: Fine-Tuning Constructs[END_REF] or just have private [START_REF] Sigmund | Privacy in the Information Society: How to Deal with Its Ambiguity?[END_REF] conversation with friends and acquaintances [START_REF] Pavlicek | Social Media -the Good, the Bad, the Ugly[END_REF]. Facebook is the main on-line community communication channel [START_REF] Vondra | Explanation of Multimedia Communication Using Catwoe Analysis[END_REF] not only for teenagers or young college students but also for the vast majority of working population in developed countries. Its growing popularity resulted in more than 1.65 billion Facebook users [START_REF]Facebook Statistics[END_REF]. Companies follow this trend by investing into proper maintenance of their profiles on social networks but quality social media content is just one part of success. The other partmaybe even more importantmakes the core of this paper: interaction with customers.

Contacting a company over SNS is just one or two clicks away. It is fast, free and public so anybody can see the response verified by thousands of visitors, who can assess the answer and judge the company. That is the main reason why customer care on social networks is becoming crucial.

CRM and Social Media

A systematic review of the state of the customer relationship management (CRM) [START_REF] Soltani | Customer relationship management mechanisms: A systematic review of the state of the art literature and recommendations for future research[END_REF] defines the customer relationship management as "The overall process of building and maintaining profitable customer relationships by delivering superior customer value and satisfaction with the goal of improving the business relationships with customers. Also, it is the strongest and the most efficient approach to maintaining and creating the relationships with customers." A company should care about its customer by answering their request and solving their problems. CRM can also involve in business intelligence factors by observing the expectations of the customers. Both abovementioned goals can be supported by social media.

The modern approach to CRM began in the 1990s with Sales Force Automation (SFA) that enabled companies to hone their sales processes and boost productivity. CRM continues to evolve and by the end of the century the world's first mobile CRM solution is introduced, followed by the first ever Software-as-a-Service (SaaS) CRM product.

Since the spreading of the internet in the beginning of the 21st century, customers have become more informed about the prices, the products, the services, the competitors and as a consequence are more demanding. Another point was described by Gilles Babinet [START_REF] Babinet | Big Data, penser l'homme et le monde autrement[END_REF], who explained that nowadays the worth of a product comes more from the additional services it can provide, rather than the real technical capacities. He called that the "revolution in the worth process for the companies". Companies begin to see CRM as a way to manage all business relationships via a single platform. However, companies had difficulties at the time calculate return of investments [START_REF] Erdos | The Benefit of It-Investments: Technological and Cost-Return-Benefit Approach[END_REF] and to adapt to this new demands and often did not get the stake of a performant CRM software or on the opposite wanted to develop a lot of functionalities but without strategy and as a result they got too many data that they did not know how to use.

During the recent years, successful companies have built a real CRM strategy: especially companies that grew up very fast, such as Uber, Airbnb, Booking, Apple … usually offer an amazing customer care. Indeed, companies that began succeeding were working both front and back systems and their goals were to link these systems together, as a system that can be used by customers and business partners. The CRM scene is expected to be worth £36.4 billion by 2017 according to Gartner [START_REF] Columbus | Gartner Predicts CRM Will Be A $36B Market By[END_REF].

We can identify two main ways to deal with customer care: customer interactions / contact software (CIS) and Customer Relationship Management (CRM) software. CIS is more flow oriented whereas the CRM system really focusses on the customer.

A customer interactions software enables to optimize the dispatch of the demand stream (input) accordingly to the available resources to deal with these requests. It is typically what is going on in call centres but some developers are trying to apply the same procedures in chat, emails or social network. The main goal is to split the depends in order to organize the waiting line in an optimal way, with more or less so-phisticated allocation rules. The operating is very simple: when a customer contacts company, no matter how he does it, a ticket is created. Then the ticket is handled automatically and randomly by any employee.

A customer relationship management software tries to put the customer in the centre of the processit creates a database where all the information are gathered: emails, phone calls, mails, fax... It fits especially to the companies, which wish to know their clients in order to offer customized service and speech. Some CRM software also enable to allocate the request to the right customer adviser, according to its language and competencies.

In this respect we can point to two main advantages of a CRM software compared to a customer contacts software. First and foremost, CRM enables to follow the evolution of the client. That means a lot for the client as they really appreciate to be recognized and not only considered as numbers: the way of answering cannot be the same for a client that contact the company for the first or the fifth time on the same topic. Social media can enhance such individual approach. Secondly, the CRM software enables to enhance the knowledge about clients: customers want adapted answers for their request but also for the products and services that are offered. Gathered in the CRM software, the marketing department can also use them to analyse the desires of its customers. Feedback and verbatim are very precious sources for the marketing to identify new segments, social media are ideal partner for this.

Our paper focuses on the new possibilities of social communication, which emerged with the rise of Facebook, Twitter and other SNS, while trying to answer, whether and how Enterprise Information System (EIS) can be involved.

2.1

Customer care on social networks: Social CRM Social Customer Relationship Management (SCRM) does not replace CRM but it extends its application field by integrating the data from social networks and other digital exchange places. In March 2008 Comcast was one of the first companies to interact directly with the customers via Twitter. Social media marketing was beginning to grab the attention of organization as the use of Facebook began to spread rapidly through the world. Moreover, companies began to see the power of social media marketing to attract customers. In return, customers began to see how they could use the web to be able to express their thoughts about companies online: organizations became, therefore, aware that customers do not bring them feedback directly but instead post their opinion publicly online. In this respect, CRM vendors started to develop systems that would address the issue created by social networks.

After 2010, CRM begins to integrate all departments: the companies has understood that the concept of CRM is strategic and companies of all size implement CRM software. As a consequence, social CRM needs to be much more integrated into customer management systems and approach. Social CRM was estimated to comprise 8% of all global CRM spending during 2012, which has doubled since 2010, according to Gartner. [START_REF] Columbus | Gartner Predicts CRM Will Be A $36B Market By[END_REF]

Research Questions

In our research we have, by observing actual events on SNS, tested limits of meaningful SCRM usage and whether/how Enterprise Information System (EIS) can be useful support tool. The paper seeks to find answers to the following research questions:

1. Is really Social CRM in practice used so extensively as claimed by theoretical studies? 2. What mood / sentiment on SNS prevails? Is the medium predominantly negative? How SCRM deals with it? 3. Doesn't Social CRM a create problems due to expected short response times? Should be the SCRM process automated or computer aided?

Research Methodology

We have decided to analyze mobile network operators (MNO) since this industry is closely connected with modern technologies, companies are quite big and rich, their product is commoditized so the marketing and CRM are of vital importance. Also, from the data perspective -MNOs usually dispose of large fan communities on Facebook and their customers often face plenty ofoften repetitive-problems that need to be solved. We analyzed official Facebook pages of three leading ,1 MNOs from the Czech Republic, France, and the United States (see Table 1) and collected public users' questions and all the answers with all possible metadata, primarily time of the answer and response, that might show us the current state of social customer care, its development over time, differences between countries and individual operators and finally usage of Facebook as a place to solve customers' problems. Altogether, we have managed to legally download over 1.3 million unique questions with all of the consecutive reactions. Through six year period (2010 to 2015) we have measured the time that it took customer care staff to answer the question and even to answer the following questions and also absolute and relative totals of questions asked and answered as well as the difference between these two. As a factor representing the quality of the answer, we counted questions that were successfully solved by one reply and related this number to all answered questions. These data were related to the time of the day and months and years and tested for repeating patterns or interesting formations. Each factor is also compared by individual operators amongst each other and aggregated by countries.

For qualitative analysis, we have analyzed 100 most popular posts (Likes & Shares) for each company (N=900).

Data Gathering

Facebook provides two different ways to gather data from their social network, either query language FQL or newer API called Graph API. Both of these meet our needs.

There are many online tools for Facebook data analysis, in our case, however, there was no suitable solution on the market, as our requirements were a bit specific. So we have used Power Query -an extension for Microsoft Excel which has built-in support for gathering data from Facebook.

Limitations

Some operators do not have their Facebook page available for posting messages and rather use their own custom web application for customer care which makes impossible for us to analyse any desired information. Also, the amount of fetched data might be limited by Facebook cut-off policy when carrying out too many requests consecutively. Due to this problem, there were a few minor gaps in downloaded dataestimated at 5% -10 % from the complete set.

Average response time could have been influenced by long-time unanswered posts later commented by other user and just then answered by MNO. Response time, in this case, would be extremely highso we have removed those cases from calculations.

Minimal response values of the second and third answer were sometimes as low as one second -when clients' response is commented by someone else at the same time as by the operator itselfsuch records were also removed so they don't skew the results.

We were also a disappointed by Twitter's policy as it was originally planned to carry out the same research there. Unfortunately, their API does not provide full conversations with all the replies, which makes such kind of data mining impossible.

Results and discussion

SCRM level was measured by the extent and delay of response to customers' stimuli. Table 2 shows the results for all MNOs, with the overall response rate is just about 23 percent (320.682 out of 1.367.586). On average, MNOs answered only every fourth question raised on SNS. The highest answer rate had Orange in France with 49 % of answered questions. The worst response rate was observed with Sprint in the USA with 90% of unanswered questions.

Incoming SCRM communication

Total message chart (Fig. 1) shows total incoming communication activity from users (messages placed monthly on MNO's Facebook page) through six year period. 20.000 messages were surpassed in April, June and October 2013 by Sprintwith approximately two-thirds of cases were complaints and negative reactions. In comparison with T-mobile and AT&T, Sprint had the worst positive / negative ratio. In France, the highest peak reached 13.297 messages in February 2012. Czech market peaked in May 2013 with 4.153 questions/comments. Czech market is quite specific. There was the very slow beginning of customer care implementation on Facebook for all MNOs: Vodafone was the first one to use, promote and track Facebook in early 2011. Until today we can trace their difficult beginnings on Facebookreflecting the fact, that innovations of IT in telecommunication causes a lot of unexpected situationsbut surprisingly Vodafone CZ kept improving the quality of services, and reduced the problems.

In January 2012 O2 CZ offered Facebook users chance to win mobile phones for free. That spurred the growth of active O2 customers and from that moment O2 CZ started to compete of Facebook with other providers. T-Mobile CZ and Vodafone CZ's total messages softly decline, but O2 took lead in January 2014 again, this time by harnessing the power of "influencers" who started big wave of interactions on O2 Facebook page with a lot of likes, shares, haters, and lovers and boosted total messages by onefifth every month. By the end of 2015, no MNO received more than 3.000 messages per month. Such reduction of the questions and answers can be explained by more "formal" behaviour and removing of the problems from Facebook pages, but still, there is enough data comparing the questions and helpfulness of answers that put T-Mobile as a dominant SCRM player. Sprint USA as the only provider in USA market couldn't handle the situation and restricted the rights of Facebook users to contribute on its pagepractically acknowledging SCRM defeat.

5.2

The frequency of SNS posts during day On the other hand, it is not surprising that 4 a.m. is the time with an overly lowest number of questions common for all the markets. Question are not limited to business hours, we can witness customers asking the questions almost around the clock.

Response time

Figure 3 shows average delay of the first reaction on message during the day. The xaxis reflects time when was message posted, y-axis describes the average response delay. Response time is crucial SCSR parameter, it expresses speed of reaction, responsibility, and reliability in any case or situation. The worst overall reaction time during the day has SFR in France with an average of 24 hours (with best average reaction takes more than 9 hours). There is a visible difference between French approach to SCRM and other markets. Whereas an average response time in the Czech Republic and the USA varies between half an hour and three hours, MNOs in France are literally off the scope, beginning with SFR at about 6 hours and ending with Bouygues Telecom and Orange at over 12 hours. The highest peak was hit during the beginning of 2015 on SFR page with the average of over 84 hours (more than 3 and half days).

Generally, bad performance of French mobile operators seems to be caused by cultural differences, as all examined operators tend to perform similarly and obviously with no effect on a number of customers.

Czech and USA MNOs react within the same day. The slowest average reaction has been 9 hours and fastest comments appear in less than 60 minutes. The worst results are achieved at the midnight while constantly fastest reaction is during entire "office hours" from 5 a.m. until 9 p.m. The fastest average time of answers during the day performs around 3 p.m. and reaches 64 minutes. The slowest answers come from SFR in France: messages placed at midnight wait 41 hours and 45 minutes to be answered.

Secondly, we can see a stable trend of declining response time through all the operators in our study. Over the time, there are often clearly visible points, when certain operators started to pay more attention to Facebook customer care. This trend can be seen for example in the first half of 2013 on the page of Sprint, AT&T did the same in the beginning of 2014. The same happened on the Czech market, surprisingly earlier than in the USA, Vodafone started that in early 2012, T-mobile CZ during 2012 and early 2013 whereas O2 CZ kept decent response time since the beginning of our data in 2011, but the overall winner would be the T-mobile USA with constantly prompt answers since 2012.

Generally positive fact is, that operators tend to adapt to their customers' behaviour as they keep answering asked questions till late evening or even during the night and do not follow the typical 9 to 5 business day schedule.

Sentiment analysis

As asked in the second Research question: "What mood / sentiment on SNS prevails? Is the medium predominantly negative?" For each MNO, we have analysed top 100 posts (900 in total) with the most shares and likes with results shown in the Fig. 4. Our findings confirm that Facebook is predominantly negative medium.

In the Czech Republicmajority (56%) of the most popular post just identify problem areas and highlight particular "bad experience" and confirm negative reactions and statement offending the operator. The most frequent argument is the high price of contract packages comparing to Germany and Austria and the gap between the quality of service and its price. Second in frequency of likes are complaints focused on signal coverage. Billing errors proved to be a popular topic tooone customer even paid advertisement to promote his negative post.

In the USA discussion seems to be more extreme: users tend to like or dislike MNO, neutral posts are rare. Out of most shared&liked posts only about 12 % are neutral, 57 % negative and 39 % positive. Contrary to that, French users are neutral in almost half of cases (47 %), 45 % are negative and just 8 % are positive. Our finding is consistent with the Galtung and Ruge's theory of News Values, where they identify negativity as one of the most attractive factors of media communication. [START_REF] Galtung | The Structure of Foreign News[END_REF]

Enterprise Information System (EIS) and social media

Developers have been quick to take the initiative, adding various social media packages to ERP systems. Let's have a look how the integration of social media with ERP or EIS should be constructed. If we integrate as additional input to the system social media stream (Facebook, Twitter, LinkedIn and others), we should than also consider, how to automatically analyse it.

The Data analysis phases should include Preprocessing, Representing Social Media Data in convenient form, Definition of some similarity metrics and result in the Clustering process. Text analysis platforms should be used, together with some relevant Ontologies.

As a result, we can benefit from various trend detections and visualisations, in the form of Patterns, Cluster results, Data Cubes or Graphs.

The matter is even more complicated by the fact, that most of above mentioned tools are language-related, so such automated system extremely difficult localize for small markets (simple translation does not work).

Conclusions

We have proved, that Social CRM was in practice used quite extensively in 2012-2013 with declining number of user inputs lately. As we expected, mobile operators did their best to catch the trend of social networks and over time they clearly invested in improving the quality of customer care on Facebook (shortening the response time). There is still a possible opportunity to gain customers by good social CRM as none of the observed companies does perform ideally.

Our analysis also strongly suggested, that most of the social interactions are still being achieved "manually"by customer care staff writing the posts. The timeline of interactions shows no signs of automated response system being used. Up-to-date Social CRM requires ever shorter response times, and probably the only way how to achieve it is the implementation of automated or computer aided SCRM processes. However, we admit, that such system would be a great challenge [START_REF] Doucek | E-Society -Perspectives and Risks for European Integration[END_REF] to program into existing Enterprise Information Systems.

Lastly, we have proved, that Facebook is predominantly negative medium, where is quite difficult to perform a positive and successful SCRM.

Further research could be conducted to determine the effectiveness of SCRM in addressing diverse groups of Facebook users. Also, qualitative content analysis of the data we acquired would be interesting, albeit extremely time-consuming. In further paper, we should conduct on both quantitative and qualitative analysis of the data we have accumulated.

Fig. 1 .

 1 Fig. 1. Total Message Count in Time (authors)

Figure 2

 2 Figure 2 represents total aggregated number of questions asked and answered during each hour of a day. The highest amount of questions was asked expectedly on the USA market, as it is by far the largest one, between 11 a.m. and 9 p.m., peaking at 7 p.m. (58.781). Questions in France peaked at 21.103 during 11 a.m. and in the Czech Republic during the 1 p.m. (12.686).

Fig. 2 .

 2 Fig. 2. Questions During a Day

Fig. 3 .

 3 Fig. 3. Average Response Delay of the First Answer (authors)

Fig. 4 .

 4 Fig. 4. Positive / Negative Sentiment of Commentsin % (authors)

Table 1 .

 1 Number of Fans and Followers on Facebook and Twitter as of November 2015 -in thousands (K) and millions (M) (authors)

	Czech Republic		France			USA
	O2	Vodafone	T-Mobile	SFR	Orange	Bouygues	AT&T	T-Mobile USA	Sprint
	FCB 185 K 183 K 197 K 927 K 9.4 M 826 K 5.8 M 5 M	2.1 M
	TW 8.5 K	39 K	5.5 K	52.2 K 123 K 82 K	711 K 575 K 345 K

Table 2 .

 2 Overall Statistics (authors)

		Number of Mes-sages	Questions Without Answer	Questions Without Answer	Average Time	Minimum Time	Maximum Time
	O2 CZ	79.063	53.295	67%	4:22:44	0:00:46	49:31:02
	Vodafone CZ	62.460	41.567	67%	5:49:56	0:00:38	128:29:18
	T-Mobile CZ	35.599	22.525	63%	3:58:48	0:00:21	66:36:40
	Orange FR	9.636	4.950	51%	15:51:48	0:00:49	73:37:52
	SFR FR	25.996	15.583	60%	31:04:42	0:01:19	287:59:26
	Bouygues Telecom FR	231.498	190.307	82%	14:58:57	0:00:22	289:16:50
	ATT USA	194.533	110.956	57%	4:05:54	0:00:18	99:22:40
	T-Mobile USA	318.315	236.641	74%	1:45:55	0:00:15	97:54:21
	Sprint USA	410.486	371.080	90%	8:07:19	0:00:47	99:53:45
	SUM	1.367.586 1.046.904	76,55%
	Average				10:00:40	0:00:37 132:31:19

Table 3 .

 3 TOP 100 Posts Evaluated on Positive/Negative Scalein % (authors)

	Country	Extremely Positive	Positive	Neutral	Negative	Extremely Negative
	Czech Republic	9	60	63	132	36
	USA	93	24	12	54	117
	France	15	9	141	87	48

With one exception in the USA, where the largest one -Verizondoes not have its Facebok page opened for public posts.

Acknowledgments. The paper was processed with the contribution of long-term support of scientific work on Faculty of Informatics and Statistics, University of Economics, Prague and help of the students in the course 4SA526 New Media.


Jan Kučera
email: jan.kucera@vse.cz

Dušan Chlapek
email: chlapek@vse.cz

Using SPEM to Analyze Open Data Publication Methods

Keywords: Analysis, method, Open Data, Open Government Data, Software & Systems Process Engineering Meta-Model, SPEM

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Open Data is data "that can be freely used, re-used and redistributed by anyonesubject only, at most, to the requirement to attribute and sharealike" [22]. Further details on what "open" means are provided by the Open Definition [21]. Legal and technical openness are the key aspects of ensuring reusability of data [19]. Legal openness is achieved by open licensing of data, i.e. by making data available under a license that permits its free re-use and redistribution. In order to minimize the technical obstacles Open Data should be made available for free download as a complete dataset in a machine-readable format. Re-use of data held by public sector bodies could be a source of social and economic value [START_REF]Creating Value through Open Data: Study on the Impact of Re-use of Public Data Resources[END_REF]. Despite the fact that a number of countries have already launched their Open Government Data initiatives, many important datasets remain closed [START_REF]World Wide Web Foundation: Open Data Barometer: ODB Global Report Third Edition[END_REF]. Publishing Open Government Data could be a challenging task and publishers often face various organizational, legal, technical and other barriers [START_REF] Janssen | Benefits, Adoption Barriers and Myths of Open Data and Open Government[END_REF], [START_REF] Ubaldi | Open Government Data: Towards Empirical Analysis of Open Government Data Initiatives[END_REF].

In order to help the Open Data publishers to overcome the barriers and to promote the recommended practices for its publication various Open Data publication methods have been developed [START_REF]Project Open Data[END_REF], [START_REF]Share-PSI 2.0: Guides to Implementation of the (Revised) PSI Directive[END_REF][START_REF]Socrata: Open Data Field Guide[END_REF]. On one hand knowledge about how to open up data is being gathered, on the other hand this knowledge is documented in different methods and their heterogeneity might make integrating their content difficult. Zuiderwijk et al. [START_REF] Zuiderwijk | Design Principles for Improving the Process of Publishing Open data[END_REF] also point out that the Open Data publication process should be standardized across an organization. Such a standardization requires sharing the information about the Open Data publication process across the organization.

In the software engineering domain practitioners are also struggling with difficulties in combining and integrating content about the development processes due to the heterogeneity of the sources of this content and with providing the development teams with an access to a shared body of information about the development process [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. This situation led to development of the Software and Systems Process Engineering Meta-Model (SPEM)a conceptual framework and meta-model providing concepts that allows "modeling, documenting, presenting, managing, interchanging, and enacting development methods and processes" [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF].

The goal of this paper is to discuss the possible benefits of constructing Open Data publication methods from a meta-model and the possible benefits of use of SPEM 2.0 and to analyze similarities and differences in the structure of three Open Data publication methods using the SPEM 2.0 meta-model elements. Based on this analysis we assess how the analyzed methods are constructed.

This paper is structured as follows. In the following chapter Open Data publication method is defined and examples of the existing methods are provided. Then the potential benefits of constructing an Open Data publication method from a meta-model in general and the benefits of using SPEM 2.0 in particular are discussed. Related work is described in the next section. In the following section a short overview of the SPEM 2.0 meta-model elements is provided. Then the results of the structural analysis of the three selected Open Data publication methods are presented. Conclusions are summarized at the end of this paper.

2

Open Data Publication Methods Brinkkemper [3] provides definitions of the terms method, technique, tool and methodology in the information systems development domain. He defines a method as "an approach to perform a systems development project, based on a specific way of thinking, consisting of directions and rules, structured in a systematic way in development activities with corresponding development products", whereas he views a methodology of information systems development as "scientific theory building about methodical information systems development" [START_REF] Brinkkemper | Method engineering: engineering of information systems development methods and tools[END_REF]. He also points out that the term methodology is sometimes used incorrectly standing for method.

We share the view of Brinkkemper that the term methodology should be used to refer to the theory of methodical aspects of some particular field. Therefore we use the term Open Data publication (ODP) method in this paper which we broadly define as an approach to the publication of Open Data consisting of recommendations about what should be done or achieved when publishing Open Data or how it should be implemented.

Number of ODP methods have already been developed. For example Project Open Data [START_REF]Project Open Data[END_REF] provides guidance, tools and case studies in order to help agencies in the USA to implement the Open Data policy. Socrata, a provider of solutions for publication of Open Data, also provides its own ODP method called "Open Data Field Guide" [START_REF]Socrata: Open Data Field Guide[END_REF].

As of September 2016 a list of forty guides for implementation of the revised PSI (Public Sector Information) Directive (Directive 2003/98/EC [7] amended by the Directive 2013/37/EU [6]) and for publication of Open Data has been collected during the Share-PSI 2.0 project [START_REF]Share-PSI 2.0: Guides to Implementation of the (Revised) PSI Directive[END_REF]. This list contains both international as well as national ODP methods of the European states. The national ODP methods are usually written in the local language of the particular country and the list [START_REF]Share-PSI 2.0: Guides to Implementation of the (Revised) PSI Directive[END_REF] also shows that they differ in what practices for publication of Open Data and PSI are recommended by these methods. These methods do not differ only in language and content but also in format and structure. For example the Open Data Handbook of Flanders [START_REF]Government of Flanders in Belgium: Open Data Handbook (Open Data Handleiding)[END_REF] represents a document in PDF structured into chapters. On the other hand DCAT application profile implementation guidelines [START_REF]European Union: DCAT application profile implementation guidelines[END_REF] are represented in a form of web pages with a common structure.

Benefits of Constructing Open Data Publication Methods from a Meta-Model

Brinkkemper [START_REF] Brinkkemper | Method engineering: engineering of information systems development methods and tools[END_REF] introduced the term method engineering and he points out that metamodelling techniques are needed for design and evaluation of methods. Gonzalez-Perez et al. [START_REF] Gonzalez-Perez | A Metamodel for Assessable Software Development Methodologies[END_REF] argue that software development methods constructed from a metamodel "usually offer a higher degree of formalisation and better support for consistent extension and customisation, since the concepts that make their foundations are explicitly defined".

Making data available for re-use requires adequate workflows [START_REF] Ubaldi | Open Government Data: Towards Empirical Analysis of Open Government Data Initiatives[END_REF]. These workflows could be set up by implementing the suitable ODP method. However, as we indicated with the examples of the existing ODP methods, these methods might differ in scope, focus or structure which might complicate selection of a method that would suit the needs of a particular Open Data publisher or finding compatible ODP methods in situations where more than one method need to be applied.

Explicit definition of the concepts that the ODP methods are built from could make identification of the same or similar concepts across different ODP methods easier. This in turn could help the Open Data publishers in assessing, selecting and customizing the relevant ODP methods. Development and implementation of the ODP methods should therefore benefit from use of meta-models.

Software and Systems Process Engineering Meta-Model [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF] is an Object Management Group (OMG) specification. It tries to address some of the problems that organizations face when developing systems such as lack of an easy access to a shared body of information about the development process, difficulties in combining content from different sources describing methods and practices due to their different presentation and style and difficulties in defining systematic development approach that fits the specific needs of an organization. The primary focus of SPEM are software development processes but it allows representing processes in other domains as well which is demonstrated in the specification with a case study describing a process for investments clubs [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF].

Representing the Open Data publication methods as the SPEM method content and processes could bring the Open Data practitioners the similar benefits as it brings to the software development organizations. Possible benefits to the ODP methods resulting from the key SPEM 2.0 capabilities are summarized in table 1.

Table 1. Possible benefits of use of SPEM 2.0 to the ODP methods, source (based on [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF])

Key SPEM 2.0 capability Possible benefits to the ODP methods

Separation of method content from the application of method content in a specific development process

Method content related to publication of Open Data could be represented in a standardized way independent on a particular process. This would allow its use in different Open Data publication processes which in turn might help sharing of good practice.

Consistent maintenance of different development processes

Open Data publication processes could be systematically developed and maintained.

Ability to represent processes based on different lifecycle models and approaches

Standardized ODP method content and processes could be configured for use in specific projects or environments, e.g. ODP processes could be configured to be in line with the approaches of different types of Open Data publishers. Plug-in mechanism that enables processes to be extended or customized without modifying the original content Generally applicable recommendations for publication of Open Data could be extended or customized with specific guidelines, e.g. guidelines for publication of a specific category of data.

New processes could be assembled from reusable process patterns

Process patters for implementing the recommendations provided by an ODP method could be developed. Open Data practitioners following the given ODP method could re-use the patters in their processes.

Process components might be linked with inputs and outputs but the development team could be allowed to choose the appropriate activities and techniques

If appropriate ODP methods could focus on the required or recommended outputs rather than activities of the Open Data publication process. Open Data practitioners might be allowed to select the most appropriate activities or technique for achieving the outputs depending on the situation.

Related Work

Several authors discussed or used SPEM in various contexts. Bendraou et al. [START_REF] Bendraou | A Comparison of Six UML-Based Languages for Software Process Modeling[END_REF] compared six UML-based languages for software process modeling including SPEM 1.1 and SPEM 2.0. Henderson-Sellers [START_REF] Henderson-Sellers | Standards harmonization: theory and practice[END_REF] analyzed differences in granularity and ontologies of several standards including SPEM.

Martınez-Ruiz at al. [START_REF] Martınez-Ruiz | Modelling software process variability: an empirical study[END_REF] propose an extension to SPEM that would allow better modelling of the software process variability. Rodríguez-Elias et al. [START_REF] Rodríguez-Elias | Modeling and analysis of knowledge flows in software processes through the extension of the software process engineering metamodel[END_REF] adapted SPEM for modelling and analysis of knowledge flows in software processes.

Moraitis and Spanoudakis [START_REF] Moraitis | The Gaia2JADE process for multi-agent systems development[END_REF] present the Gaia2JADE process for multi-agent systems development that is described using SPEM specification. Another examples of the SPEM use could be found in the work of Brusa et al. [START_REF] Brusa | Towards ontological engineering: a process for building a domain ontology from scratch in public administration[END_REF] where a process for building a public domain ontology is based on SPEM and also in the work of Loucopoulos and Kadir [START_REF] Loucopoulos | BROOD: Business Rules-driven Object Oriented Design[END_REF] where BROOD (Business Rules-driven Object Oriented Design) process is represented using SPEM. Saldaña-Ramos et al. [START_REF] Saldaña-Ramos | Design of a competence model for testing teams[END_REF] proposed a competence model for testing teams and represented it using SPEM.

SPEM 2.0 Meta-Model Elements

Key feature of SPEM is a separation of the method content definitions from its application in the development process [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. Method content represents libraries of reusable content such as definition of tasks, roles, tools or work products that is independent on its application in the specific step of a development lifecycle. In SPEM process represents a specific way of performing some project, e.g. software development project using a specific technology. Separation of the reusable method content from the development processes allows defining various processes with their own lifecycles and work breakdowns that build upon the same base components providing recommendations about how to achieve the common development goals. SPEM also reflects the fact that projects are unique and allows configuration of the method content and processes to fit the needs of a specific project.

SPEM provides meta-model classes as well as the UML stereotypes (SPEM 2.0 UML 2 Profile) for representing elements of both method content and processes [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. According to [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF] the key method content elements are Task Definitions, Work Product Definitions, Role Definitions and Guidance.

Task Definition represents an assignable unit of work and it is assigned to specific Role Definitions [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. A Task Definition could be broken down into Steps. Work Product Definition represents work products that are consumed, produced or modified by Task Definitions. Role Definition is "a set of related skills, competencies, and responsibilities of an individual or a set of individuals" [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. Categories can be used to categorize the content into logical groups such as requirements management.

The key process elements are Activities and "use" elements for representing use of the method content elements in the context of a specific process. Activity represents a unit of work within a Process [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. Activities can be nested to form breakdown structures. Although the Process has a distinct symbol in SPEM 2.0, it is represented by the Activity class in the SPEM 2.0 UML profile [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. Therefore only the Activity is taken into account in the analysis described in the following section.

Task Use, Role Use and the Work Product Use are specializations of the abstract Method Content Use element that represents a use of a particular method content element in the context of some Activity. Method Content Use element ensures the separa-tion of the method content from a process and it allows overriding the method content elements with the specifics of the given process.

Role Use and the Task Use instances are linked to the corresponding Activity instances with instances of the Process Performer which can also be used to distinguish how a particular role is involved in the process, e.g. it can be used to present the RACI (responsible, accountable, consulted, informed) relationships [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. Similarly a Process Parameter links an Activity or a Task Use with a Work Product Use to indicate whether the Work Product Use is an input or an output of the Activity/Task Use or both. However in the SPEM 2.0 UML profile the Process Parameter instances are not represented as classes but as associations with the ParameterIn (input), Param-eterOut (output) or ParameterInOut (input and output) stereotypes.

Additional information about both the method content and the process elements could be provided by Guidance. In order to distinguish various types of guidelines Guidance can be classified with Kinds. SPEM 2.0 specification [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF] also contains a Base Plug-in which provides instances of Kinds for Guidance as well as for Activity, Category, Work Product Definition and Work Product Relationship.

6

Analyzing Open Data Publication Methods Using SPEM

In this section we use the SPEM 2.0 meta-model to analyze structure of three Open Data publication methods. First the analyzed ODP methods are briefly introduced, then the analysis approach is explained. Results of the analysis are discussed at the end of this section.

Analyzed Open Data Publication Methods

We selected three ODP methods in whose development we were involved because we are familiar with their structure and semantics. The following methods were analyzed: Best Practices for Sharing Public Sector Information [START_REF]Share-PSI 2.0: Best Practices for Sharing Public Sector Information[END_REF] represent a lightweight approach focusing on providing a guidance rather than a process. On the contrary Methodology for publishing datasets as open data [START_REF] Nečaský | Deliverable D5.1: Methodology for publishing datasets as open data[END_REF] represents a process-oriented approach to publication of Open Data. Both the Share-PSI 2.0 Best Practices and the COMSODE method target an international audience and thus they provide no recommendations specific to a particular region. Czech OGD standards [START_REF]Ministry of the Interior of the Czech Republic: Standards for publication and cataloguing of Open Data of the public sector in the Czech Republic (Standardy publikace a katalogizace otevřených dat VS ČR)[END_REF] represent a national ODP method that should be followed by the public sector organizations in the Czech Republic.

Analysis Approach

Neither of the analyzed ODP methods is based on the SPEM meta-model. For each of these methods SPEM 2.0 elements were identified that were considered appropriate to represent the content of the given ODP method based on their semantics. Elements for which stereotypes are defined and summarized in the Annex A of the SPEM 2.0 specification [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF] were considered in the analysis. If the content of the analyzed ODP methods was described or represented in a way that is independent on the process, appropriate SPEM method content elements were chosen. If it was not possible to separate the content from the process, e.g. in cases where the description referenced a particular part of the process, the SPEM process elements were selected.

The Czech OGD standards are represented as a set of web pages. Sometimes one page contained both the process-independent and the process-dependent content. In such cases more than one SPEM meta-model element was considered to represent the content.

Because all of the analyzed ODP methods contain guidance, we further analyzed what kind of guidance is provided by mapping the provided guidance to the guidance kinds specified in the SPEM 2.0 Base Plug-in. SPEM 2.0 [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF] also provides means for managing the whole libraries of the method content and process, i.e. Method Plugins. However this part of the SPEM 2.0 specification was not considered in the analysis because it focuses on the extensibility and variability mechanism rather than on the structure of the content.

Analysis Results

Table 2 provides an overview of the SPEM 2.0 meta-model elements considered as suitable to represent the content of the analyzed ODP methods. SPEM 2.0 defines a broader set of elements than presented in table 2, however elements not present in the analyzed ODP methods are excluded from the overview. The Share-PSI 2.0 Best Practices provide only the method content in a form of guidance. Therefore they could be easily referenced from other Open Data publication methods (for example Share-PSI 2.0 Best Practices are directly referenced from the Solutions Bank of the Open Data Handbook [20]). Share-PSI 2.0 Best Practices are categorized according to a set of PSI elements [START_REF]Share-PSI 2.0: Best Practices for Sharing Public Sector Information[END_REF], i.e. topics addressed by the PSI Directive. However semantics of this categorization corresponds to none of the SPEM 2.0 Base Plug-in category kinds (discipline, domain, role set and tool category).

Compared to the Share-PSI 2.0 Best Practices the COMSODE method as well as the Czech OGD standards are constructed from a broader set of concepts and they not only specify what should be done in order to publish Open Data but also who should be involved and what the expected outcomes are in terms of the work products. They both define a process for publication of Open Data that is broken down into phases and activities. COMSODE method also specifies the recommended steps for achieving the specified tasks.

Acknowledgements. Paper was processed with contribution of long term institutional support of research activities by Faculty of Informatics and Statistics, University of Economics, Prague.

COMSODE method, especially in the annex 2 [START_REF] Nečaský | Deliverable D5.1: Methodology for publishing datasets as open data[END_REF], clearly separates elements such as activities, phases or performers (roles) and links them with relationships (for example activities and performers are linked with the responsibility relationships using the RACI chart). Czech OGD standards are also highly structured, however description of phases or individual activities sometimes presumes a certain sequence of work. The Czech OGD standards are intended to provide the recommended process that should be followed within the Czech public administration. The process orientation of the Czech OGD standards is therefore in line with this purpose. However extracting knowledge applicable in other contexts would require separation of the method content from the process itself.

Table 3 summarizes kinds of guidance provided by the analyzed methods. The following kinds of guidance were not identified in the analyzed methods: Checklist, Estimate (metric kind), Estimation Considerations (metric kind), Estimating Metric (metric kind), Example, Report, Reusable Asset, Supporting Material and Roadmap.

As the name suggests practices are the main kind of guidance provided by the Share-PSI 2.0 Best Practices. However external sources are referenced as well which were classified as the SPEM whitepapers. The COMSODE method explains the concept of Open Data, provides a glossary of terms as well as a wide range of practices for conducting the tasks and activities.

A Guideline provides "additional detail on how to perform a particular task or grouping of tasks" [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF]. This additional detail on how the Open Data should be published is provided by a reference internal directive that is a part of the Czech OGD standards. Czech OGD standards also include reference Open Data publication plans that can be used as templates. Guidance on how to register datasets in the Czech National Open Data Catalogue is provided as well which represents the tool mentor element.

Conclusions

Openly licensed machine-readable data could be a source of social and economic value [START_REF]Creating Value through Open Data: Study on the Impact of Re-use of Public Data Resources[END_REF], [START_REF] Ubaldi | Open Government Data: Towards Empirical Analysis of Open Government Data Initiatives[END_REF]. Open Data movement is strong in the public sector domain and the release of data held by public sector bodies for re-use is sometimes even encouraged by the legislative means such as the European PSI directive [6].

Methods that provide the publishers with recommendations how to overcome the problems commonly faced when publishing Open Data are emerging. Use of metamodels could help the Open Data practitioners when assessing, selecting and customizing the Open Data publication methods because the concepts that form the building blocks of these methods are more likely to be explicitly defined.

Software and Systems Process Engineering Meta-Model [START_REF]Object Management Group: Software and Systems Process Engineering Meta-Model Specification[END_REF] is a common metamodel for representing the development methods and processes which is intended to make their development, maintenance and interchange easier. In this paper we analyzed structure of three ODP methods by identification of the SPEM 2.0 meta-model concepts that were considered suitable for representing the content of the analyzed methods.

This paper presents results of an ongoing research. In the future research we will further assess suitability of SPEM 2.0 as the meta-model for engineering of the ODP methods. Zuiderwijk et al. [START_REF] Zuiderwijk | Design Principles for Improving the Process of Publishing Open data[END_REF] point out that multiple versions of the processes for publication of Open Data might be required for different types of data. Therefore we will also focus on the extension and variability mechanism offered by SPEM and its potential application for building bodies of information about publication of Open Data that could be shared and customized to fit the needs of the specific organizations and the types of data they manage and publish.