Mohamed Sami Rakha
email: m.rakha@queensu.ca

Fahim T Imam
email: fahim.imam@queensu.ca

Thomas R Dean
email: tom.dean@queensu.ca

Generating a Real-Time Constraint Engine for Network Protocols

Keywords: Intrusion Detection, Domain-Specific Language, Network Security, Real-Time Systems, Source Code Generation

In this paper, we present a practical approach to generate the constraint engine for an effective constraint-based intrusion detection system (IDS). The IDS framework was designed for safety-sensitive networks that involve limited-access closed networks such as the networks for the command and control systems or the Air Traffic Control (ATC) systems. The constraint engine generated by the framework supports real-time performance while ensuring the intended, normal behaviour of its target networks. We present the IDS framework in terms of its internal DSL representation as well as its transformation mechanisms to generate the constraint engine code. Comparing the autogenerated version against a manually implemented, optimized version of the constraint engine indicates no significant difference in terms of their performance.

Introduction

As part of a cybersecurity project, we designed an effective framework to generate a robust constraint-based Intrusion Detection System (IDS) [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF] for limitedaccess closed networks. The IDS was designed to support real-time detection of intrusions for safety-sensitive networks while keeping the intended, normal behaviour of the networks intact for its authentic systems and agents. The IDS framework is envisaged to generate efficient executable code for all of its components, including the constraint engine, from a single specification document. The framework, therefore, supports practical usability for its constraint engine, allowing only limited human interventions for its code maintenance and change management. The key strength of the IDS framework is its realization of three levels of abstractions as follows:

1. The high-level description of the network protocols along with their constraints that can be written by the IDS users like Network Engineers; 2. The mid-level specification of the constraints represented in an internal DSL that can be transformed from the high-level description; 3. The low-level abstraction representing the executable constraint engine code that can be autogenerated from the internal DSL.

In this paper, we present the current state of our IDS framework in terms of its internal DSL representation that corresponds to the mid-level abstraction above. We also present the transformation mechanism of the internal DSL that we have implemented to generate the low-level, executable code for the constraint engine. The DSL allows expressing different protocol-specific constraints in terms of their internal data structures and other computational details. Essentially, the DSL was designed to ensure optimal memory management and real-time performance for the constraint engine code. Extending based on our previous work [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF], the DSL presented in this paper allows generalizing its mechanism to accommodate complex constraints that involve multiple valid sequences of packets with arbitrary order and length.

Prior to proposing the original DSL, we have also presented an optimization approach for the constraint engine which was manually implemented in C with promising results [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF]. The manual version of the constraint engine code was used as a guide for our automatic code generation framework presented in this paper. Evaluating the generated constraint engine on a set of test cases with different constraints validates the correctness of the autogenerated code. Comparing the performance of the autogenerated constraint engine against the manually implemented version shows that there is no significant performance penalty to our autogenerated code.

The focus of our constraint engine is to achieve real-time performance when inspecting the network packets against a set of constraints and successfully detect any intrusion. The subsequent response to a detected intrusion, however, is outside the scope of our current research. We are currently working on implementing the high-level language to specify different constraints which will be used to autogenerate the internal DSL code discussed in this paper. We will present the high-level language along with its transformation mechanism in our next article.

Background

The scope of our research is an anomaly-based IDS for limited-access, closed networks such as industrial control networks or command and control systems such as the Air Traffic Control (ATC) systems. A key feature of these systems is that they all involve a limited number of known protocols with restrictive operations. The network traffic of these systems therefore involve much less variability than that of a conventional network. The queries, responses, and commands involved in these networks tend to have regular patterns that can be predefined and specified as a set of logical constraints. These constraints can then be used to characterize the traffic in terms of their normal, predefined patterns. The IDS can detect potential intrusions based on traffic that deviates from the specified constraints.

The IDS Framework. Figure 1 presents the high-level architecture of our IDS framework. The two main components of the framework are the packet parser and the constraint engine. Both of these components are automatically generated from the protocol specification document at the top. The specification document is meant to be written by the Network Engineers in a language called SCL [START_REF] Marquis | Scl: a language for security testing of network applications[END_REF] using their familiar ASN.1-based notations. SCL allows modular description of multiple protocols in terms of the syntax and semantics of their network traffic packets. The generated parser [START_REF] Elshakankiry | Context sensitive and secure parser generation for deep packet inspection of binary protocols[END_REF] reads the network packets and converts them into an internal structure for the constraint engine to use. In the process, the parser also validates the internal structure of the packets [START_REF] Elshakankiry | Context sensitive and secure parser generation for deep packet inspection of binary protocols[END_REF].

The main task of the constraint engine is to validate different constraints among the network packets. The engine is responsible for storing constraintspecific information from the incoming packets that can be used to check the validity of the later packets. The engine also supports the mechanism of automatically deleting the stored information when no longer needed. The interface between the parser and the constraint engine consists of dedicated callback entries for each of the protocol-specific packet type recognized by the parser.

As presented in Figure 1 our IDS framework only requires minimal human intervention for its change management and code maintenance. Any changes to the network such as the addition of new systems or protocols simply require updating the protocol specification at the top. The underlying framework of the IDS will then take care of generating the new executable code for the parser and the constraint engine based on the updated specification.

The Evaluation Framework. While our IDS framework was designed to support any kind of network protocol, in order to demonstrate our approach we consider the Real Time Publish and Subscribe (RTPS) protocol [START_REF] Pardo-Castellote | Real-time publish-subscribe system[END_REF] along with the Internet Group Message Protocol (IGMP) [START_REF] Cain | Internet group management protocol[END_REF] as part of our evaluation framework. The RTPS protocol is a real-time implementation of the Data Distribution Service (DDS) framework [START_REF] Pardo-Castellote | OMG data-distribution service: Architectural overview[END_REF], where some systems publish data (e.g. radar tracks) while the other systems subscribe to the data (e.g., air traffic control terminal, flight service station). RTPS protocol has been used in many critical domains and real-time applications such as NASA's Launch Control Networks and the Canadian Automated Air Traffic Management System [START_REF]The Canadian Automated Air Traffic System[END_REF]. One of the key concepts in DDS is that of a topic which refers to a particular message type and a quality of service. An example might be a radar track, or flight plan information. RTPS is a UDP protocol which uses both multicast and unicast messages. Multicast messages allow a publisher to send a single message that can be received by all subscribers. However, to track which systems are listening to multicast packets means we must also analyze the IGMP protocol, which is used to manage multicast UDP messages. Our IDS framework is being extended to support other UDP protocols such as the NTP [START_REF] Mills | Network time protocol version 4: Protocol and algorithms specification[END_REF], TFTP [START_REF] Sollins | The TFTP protocol (revision 2)[END_REF], and NFS [START_REF] Callaghan | NFS version 3 protocol specification[END_REF].

The Threat Model. Our threat model is that the attacker has compromised one or more nodes of the network through an alternate channel such as USB and is looking to infect another node or to compromise the network function at some point in the future. In our case, the IDS must treat each of the incoming network packets as a suspicious entity. The contents of an incoming packet as well as its arriving sequence must be evaluated against a set of protocol-specific constraints in order to validate the packet's right to exist in the network traffic as a safe entity. The constraint engine for the anomaly-based IDS, therefore, requires a set of constraints for each of the protocol-specific packet types that collectively specify the normal behaviour of its target network.

There are three types of constraints that we are interested in. The first type involves the constraints specified by the protocol parser to validate the wellformedness of the network packets. The second type involves describing the constraints between the incoming packets and the network environment. For example, radar data and ADS-B [START_REF] Baud | Radar/ads-b data fusion architecture for experimentation purpose[END_REF] data may only originate from a specific set of systems. Finally, the third type of constraints involves describing the constraints among multiple packets along with their valid sequences. Three examples of constraints for the RTPS protocol are: RTPS packets have the correct format and structure, application data packets originate from the correct source addresses, and that an intruder has not introduced a new topic in order to suborn the DDS framework to provide communication between malware components.

Generating Constraint Engine Code

Each of the packet types within a network stream must have a set of associated constraints. A packet type refers to the protocol-specific type of the packet such as the RTPS DATA message packet. In our approach, the constraints are considered to be independent from each other. Each of the multipacket constraints must specify a set of Packet Types, P = {P o , P 1 , .., P n , P t , P f } that must exist in a particular order; where, P o is the type of the Initial Packet of the sequence, P 1 , .., P n are the types of the Intermediate Packets leading up to the Target Packet type, P t , and the Final Packet type P f after the P t marks the closure of the packet sequence relevant to the constraint.

Each instance of the network constraints corresponds to a tree data structure, which is referred to as the constraint tree in this paper. Such a tree gradually collects data for its nodes from the stream of network packets. A constraint tree can be expressed using the prefix notation: AND(OP(a, b),OP(c, d)); where, AND refers to the logical conjunction, OP is a logical operator such as equality (EQ) or non-equality (NEQ), and a, b, c, and d represent the leaf node data from different packets that must be evaluated. Hasan et al. [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF] proposes a life-cycle model for the constraint trees with four consecutive phases: Instantiate (I), Bind (B), Evaluate (E) and Destroy (D). It is the life-cycle model of the constraint trees that dictates the overall memory management and the optimization of the constrain engine in order to achieve the real-time performance of our IDS.

The Constraint Tree Life-Cycle Model

Based on its corresponding constraint specification, each phase of the constraint tree is triggered by the arrival of a particular packet type within a stream of network packets. Figure 2 illustrates a generic scenario of a constraint that involves different packet types with a particular arriving sequence. In between the initial packet, P o and the final packet, P f , there could be many intermediate packets of different types; however, within those packets, the constraint is specific about the existence of three particular types of packets, P x , P y , and the target packet P t , that must arrive in the specified order. The constraint tree phases along with their internal memory management processes are described below.

Instantiate is the first phase of a constraint tree instance which is triggered by the arrival of the initial packet type, P o from a predefined sequence. In this phase, a memory space is allocated for the constraint tree and a reference to the tree is cached in a hash table that can be used by the later phases. The common values between the initial packet and the consecutive packet(s) are used as the keys for the hash table. Any data needed from the initial packet to evaluate the constraint are stored in the tree instance.

Bind is the second phase of a multi-packet constraint that has more than two packets. This phase involves the following tasks: validate the sequence of the arriving packets and fill out the empty leaves in the constraint tree. While our original approach [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF] only allowed a single bind phase, the approach currently allows multiple bind phases to be defined for a constraint. Figure 2 illustrates that scenario by multiple intermediate packet types between the initial and the target packet types. In the first bind phase, the constraint engine retrieves the tree from the instantiate hash table. In the case of more than one bind phases, the constraint tree will be passed from one bind phase to the next through one or more hash tables. Evaluate is the phase in which the validity of the target packet P t is evaluated. The triggering packet type P t of this phase should provide the data for any remaining leaf nodes of the constraint tree. A security violation occurs if the evaluate phase fails to retrieve the tree from the hash table of the previous phase or the tree evaluates to a false value. The evaluate phase for the same tree instance can be executed every time a triggering packet arrives.

Destroy is the final phase of the life cycle which is triggered by the arrival of the final packet, P f in the predefined packet sequence. As a result of this phase, the constraint tree is deleted from all the hash tables to free up memory.

The DSL Representation of Network Constraints

It should be noted that for the single-packet constraints, the life-cycle model only involves the evaluate phase for the P t contents against a known set of environmental values. For two-packet constraints, the model simply involves the instantiate phase for the P o and the evaluate phase for the P t . The life-cycle model presented above is particularly useful for those constraints that involve more than two packets in a sequence with multiple alternative valid orders. In this section, we describe the internal DSL representation using two such constraints namely the C5 and C11. Figure 3 illustrates the possible sequences of packets involved in these two constraints in terms of their constraint tree phases.

Constraint C5. All subscribers and publishers must be valid members of an IGMP multicast group. These participants must send their membership reports to specific group addresses before showing their interests in a topic.

Constraint C11. The data of a certain topic is considered valid if it is produced from a valid publisher and consumed by a valid subscriber.

As reflected in Figure 3, the target packet type to evaluate constraint C5 is RTPS.DATA(W) (the publisher) or RTPS.DATA(R) (the subscriber) submessage of an RTPS packet. The previous packet types, in order, are an RTPS packet containing a participant submessage, RTPS.DATA(P), and an IGMP membership report packet. The IDS parser that we implemented can parse callbacks not only for the entire packets but also for the meaningful parts of the packets such as the RTPS submessages. Therefore, the constraint engine can use the RTPS submessage as a trigger for its phase logic. Listing 1.1 shows the DSL representation for the constraint C5. The first line of the code specifies the constraint ID (line 1). The constraint ID is a unique identifier value that is used as a suffix in the generated code for each constraint. Next, in line 3-4, we have the constraint tree expression in prefix notation. The keywords INSTANTIATE, BIND, EVALUATE, and DESTROY correspond to the life-cycle phases of the constraint tree, each followed by a triggering packet type as specified in Figure 3. For instance, the instantiate phase is triggered when reporting the multi-cast group address of a network; i.e., arrival of the IGMP Membership Report packet. The V2REPORT in line 6 refers to the Membership Report packet from the IGMP version 2 specification. The packet type DATAPSUB in line 14 refers to an RTPS participant submessage, RTPS.DATA(P) which triggers the bind phase. The packet types DATARSUB and DATAWSUB in lines 23 correspond to the RTPS subscriber and publisher submessages. In line 29, the V2Leave packet type corresponds to the leave submessage from the IGMP version 2 specification.

Tree Instance Hashing. The DSL proposed by Hasan et al. [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF] had two implicit hash tables to hold the constraint tree between the instantiate and bind phase, and between the bind and evaluate phase. In our DSL, each of the instantiate and bind phase can have an unlimited number of defined hash tables. In listing 1.1, line 10 shows an example of assigning key fields from the packet while line 11 defines the hash table name hashIC5. During the bind phase, the constraint engine should be able to find the constraint tree in the instantiate hash table. The constraint engine uses key fields from the triggering packet to lookup the constraint tree instance created in the instantiate phase. In listing 1.1, the hash table name for the instantiate is defined in line 16 while the necessary key fields are defined in line 17.

The bind phase updates the constraint tree by filling the empty leaves with the appropriate packet fields as in lines 18-19 of listing 1.1. The bind phase stores the updated constraint tree in the bind hash table. In listing 1.1, the hash table name and key fields for bind phase are defined in lines 20-21. The hash table name and key fields used by the evaluate phase are defined in lines 24 and 26. Finally, the destroy phase deallocates the constraint tree from the defined hash tables. Based on the constraint specification, the autogenerated constraint engine may have an unlimited number of hard-coded definitions of hash tables for the instantiate and bind phases.

Hash Table Naming. In our current DSL, each hash table should have a unique name throughout the constraint engine code. In listing 1.1, the variable HashInstantiate holds the hash table name for the instantiate phase of constraint C5. While the variable HashBind holds the hash table name for the bind phase. The constraint phases should access any of the hash tables by their unique names. For example, the bind phase should be able to find the constraint tree allocated previously at the instantiate phase. Therefore, the HashInstantiate is specified twice in the DSL of listing 1.1 -first in the instantiate clause and the next in the bind clause. The DSL grammar allows the naming of multiple hash tables when the phase clause holds multiple cases. Listing 1.2 shows an example of multiple hash tables within the same phase clause for constraint C11. In C11 example, the instantiate phase has two hash tables: hashIC11 DATARSUB and hashIC11 DATAWSUB. Each one of these hash tables is accessed at different cases based on the logical sequence. Management. Figure 4 summarizes the hashing mechanism among the four phases of a constraint tree. During the instantiate phase, the constraint engine instantiates a tree for the constraint C x and inserts its reference to a hash table. The location of the tree reference in the hash table is determined by the hash key value. The packet fields used to calculate the key value should be specified in the DSL. For example, listing 1.1 for C5 defines srcIP and groupaddr as the key fields for its hash table hashIC5. Based on these two fields, a reference to constraint tree is located in the hash table hashIC5. In some cases, the calculated key value may point to an already existing hashing slot causing a collision [START_REF] Wolper | Reliable hashing without collision detection[END_REF]. In such a case of collision, the old tree is deleted and the hash slot is updated with a new tree instance. At the bind phase, the instantiate tree reference is copied from the instantiate hash table into the bind hash table. In C5 example, the bind hash table is hashBC5. At the end of the bind phase, the copied tree reference is deleted from the instantiate hash table to free up space. However, the DSL allows disabling this deletion by adding the keyword SPLIT in the bind clause. In case of collision, the tree update can be ignored by adding the keyword REPEAT. For example, listing 1.1 for C5 has the keyword REPEAT at line 15. During the evaluate phase, the constraint tree is retrieved from the hash table specified by the name in variable HashBind, if available. Otherwise, the constraint engine should report a security violation. The evaluate phase does not change the content of the hash tables. In our approach, the generated hashing uses the linear probing algorithm with a relatively prime step size [START_REF] Flajolet | On the analysis of linear probing hashing[END_REF]. However, other hashing algorithms that support deletion can be used.

Hash Table

Constraint Generalization. The automatic generation approach takes into consideration the generality of constraint specifications. One of the challenging generalizations is the cross scenarios handling. The cross scenarios happen when the constraint specification permits the same triggering packets for more than one phase. For instance, the constraint C11 in listing 1.2. The target of the constraint determines if a data message of a given RTPS topic is produced by a valid publisher and consumed by a valid subscriber. Both the instantiate and bind phases can be triggered by a DATA(W) or a DATA(R) as depicted in Figure 3. For such a case, the generated constraint engine must conform to the accurate scenario by checking if the other packet has already arrived. We use the SEARCH function (in Line 8 and Line 24) to check if the other packet has arrived by the availability of constraint tree in hash table.

In listing 1.2, we added the if condition at the start of each phase case to handle the cross scenario generalization. Another example of generalization is the multiple triggering packets for the same phase. We can observe that C11 specification handles such a case by applying a switch block. Each packet type in such case will represent a triggering packet type. The same approach can be applied to extend the C5 specifications. In C5 instantiate and destroy phases, we add switch statements to handle older versions of IGMP Report packets. Listing 1.3 shows the two phases after generalization.

.c File

TXL Transformations Generated Files

Fig. 5: Automatic Generation of the Constraint Engine Code.

Implementation

An overview of our implemented autogeneration framework for the constraint engine code is presented in Figure 5. Based on the constraints specified in the DSL input, the framework requires three kinds of transformations to generate the necessary C files for the constraint engine. These include the transformations for the hashing, the constraint tree phases, and the parser callbacks, as depicted in the figure. We used the T XL [START_REF] Cordy | The TXL Source Transformation Language[END_REF] as the transformation language between the DSL and the constraint engine code. After the transformations, all the generated C files of the IDS are compiled to build a binary executable file. The binary file includes the parser and the autogenerated constraint engine. Four snippets of the generated code for constraint C5 are presented in this section. First is the example of hash.h file in listing 1.4 that includes the function prototypes of the generated hashing operations for the C5 constraint tree. Next, in listing 1.5, we have the generated code for constraint.h which includes the function prototypes of the constraint tree phases. Notice how the function parameters correspond to the C5 DSL in listing 1.1. For example, the function instantiateC5 V2Report(..) in Line 1 requires a pair of key fields, followed by a pair of leaf node values based on lines 8-10 of the instantiate clause in C5 DSL 1.1. Listing 1.6 presents the generated implementation of the C5 bind function for the constraint.c file. The bind implementation calls different hash functions to retrieve and update each tree instance. 1 int i n s t a n t i a t e C 5 _ V 2 R e p o r t ( uint32_t key1 , uint32_t key2 , uint32_t

SrcIPAddressNewJoin , uint32_t GroupDestIPToBeJoined , unsigned long pktCount ) ; 2 int i n s t a n t i a t e C 5 _ V 3 R e p o r t ( uint32_t key1 , uint32_t key2 , uint32_t

SrcIPAddressNewJoin , uint32_t GroupDestIPToBeJoined , unsigned long pktCount ) ; 3 int bind1C5 ( uint32_t instatiate_key1 , uint32_t instatiate_key2 , uint32_t key1 , uint32_t SrcIPParticipant , uint32_t DestIPParticipant , unsigned long pktCount ) ; 4 int evaluateC5 ( uint32_t key1 , unsigned long pktCount ) ;

Results and Evaluation

The generated IDS has been tested against four different constraints with the test cases listed in Table 1. Each of the cases in the table was intentionally induced in separate packet capture (pcap) files. As shown in Table 1, each of the four constraints has a normal scenario where the IDS should pass with no violations, along with a set of abnormal cases with anomalous packets. The violation checks reported by the generated constraint engine are consistent with the test case expectations, proving the correctness of the constraint engine code. Figure 6 shows the performance results on the run-time averages of the two IDS versions on three pcap files. For our evaluation, we used the same set of pcap files used by Hasan et al. [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF] against the same three constraints: C5, C11 and C8. We run each IDS 10 times for each pcap file. Each of the IDS was ran on an Ubantu Linux 64-bit VM with Intel core i7 processor using 2 GB of RAM. As we can observe in Figure 6, the autogenerated IDS is slower with a maximum drop of less than 6%. The results indicate that there is a slight drop in the performance for the autogenerated IDS in contrast to the manually implemented version. However, the performance difference is insignificant. These results highlight that the automatic generation of the constraint engine presented in this paper does not lead to a significant performance penalty.

Related Work and Discussion

While there exist various approaches to develop an IDS [START_REF] Liao | Intrusion detection system: A comprehensive review[END_REF], the premise of our approach is an anomaly-based IDS [START_REF] Garcia-Teodoro | Anomalybased network intrusion detection: Techniques, systems and challenges[END_REF] for limited-access closed-networks which involve a limited number of protocols. Various anomaly-based approaches have been studied that apply Machine Learning (ML) techniques [START_REF] Tsai | Intrusion detection by machine learning: A review[END_REF] to identify suspicious patterns in the network traffic. However, the ML-based approaches are typically useful for conventional public networks that involve a broad variety of protocols with variable traffic patterns that are hard to prognosticate. Since the target networks of our IDS solely involve a limited number of protocols with restrictive operational patterns, we did not consider any ML-based technique for our approach. Our approach is based on the idea of inspecting each of the network packets against a finite set of protocol-specific constraints that are already known. We considered achieving real-time performance and automatic generation of our constraint-based IDS [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF] to be the key challenges for our approach.

Satisfying network constraints can be considered similar to finding frequent patterns in the data stream. Various tree-based approaches have been considered in literature for different applications [START_REF] Kurien | Survey on Constrained based Data Stream Mining[END_REF][START_REF] Potharst | Classification Trees for Problems with Monotonicity Constraints[END_REF][START_REF] Silva | Pushing constraints into data streams[END_REF]. A key limitation of these approaches is that they require maintaining large constraint trees to express their desired patterns. Against streaming data in large scale, even with efficient pruning algorithms, traversing and updating such constraint trees would require continuous memory operation which is bound to cause major bottlenecks in performance. In our approach, using the constraint tree life-cycle model we instantiate a simple tree for each of the individual constraints with optimized memory management. Using the hashing mechanism presented in this paper, our approach allows accessing the required tree nodes in the memory or removing a tree from memory, both in constant time.

Open source tools such as SNORT [START_REF] Park | Performance comparison and detection analysis in SNORT and Suricata environment[END_REF] support rule-based intrusion detection techniques. The SNORT rules [START_REF] Khamphakdee | Improving intrusion detection system based on SNORT rules for network probe attack detection[END_REF] can be used to express similar concerns comparable to the single-packet environmental constraints in our approach. However, when it comes to multi-packet constraints involving a set of valid sequence of packets, expressing them using SNORT-based rules are not feasible. Writing such rules would require specifying the exact time frames for the expected arrival of related packets. In contrast, our approach allows defining the partial-order patterns on the required set of packets without the need to specify any time window. In a related effort of using a DSL to express network constraints, Salgueiro et al. [START_REF] Salgueiro | On using constraints for network intrusion detection[END_REF] present a DSL to describe common attacks on TCP/IP protocols that can generate solution code. However, the DSL was not designed to handle the kind of multi-packet constraints that we needed for the DDS networks.

Generating automated code has been used in various Model-Driven Engineering projects. These projects usually involve generating operational code from a model specifying the system to be created. Our code generation approach is distinct that we are generating the code to validate the network data against the models. The generated constraint engine code by our IDS framework checks the validity of the traffic data against a set of protocol-specific behavioural models of the target networks.

Conclusion and Future Work

In this paper, we have presented an effective approach to autogenerate a constraint engine through a practical IDS framework. The approach implements and extends our earlier DSL proposed by Hasan et al. [START_REF] Hasan | A Constraint-based Intrusion Detection System[END_REF] and generalizes its representation to accommodate any kind of complex multi-packet constraints that involve alternative sequences of packets with arbitrary length and order. We have successfully implemented a mechanism to transform the internal DSL into executable constraint engine code using TXL.

Comparing the performance of the autogenerated constraint engine against the manually implemented version displays no significant performance overhead. The correctness of the generated constraint engine was evaluated based on four different test cases. For our next evaluation, we plan to involve a third-party Red team to incorporate a comprehensive collection of malicious activities on our simulation environment for an ATC network.

We are currently working on generating the internal DSL from an SCL-based high-level constraint specification language suitable for the Network Engineers to use. The SCL language, already being used to generate the parser for our IDS framework, is modular, which allows easy specification of multiple protocols for a given network. Finally, since the IDS framework only allows autogenerating its constraint engine from a high-level specification, the approach requires minimum human interventions. The intricate implementation details of the constraint engine are not needed to be coded or managed by humans which eliminates the possibility of having human-induced errors and heavy maintenance overhead when adapting a new set of protocols and systems for the IDS.

Fig. 1 :

 1 Fig. 1: The IDS Framework.

Fig. 2 :

 2 Fig. 2: Sequence of Packets with Constraint Tree Phases.

Fig. 3 :

 3 Fig. 3: The Constraint Tree Phases in 2 Different Constraints.

Fig. 4 :

 4 Fig. 4: The Constraint Tree Phases and Hashing.

  AND ( EQ ( SrcIPPublisher , D e s I P f r o m S u b s c r i b e r ) , EQ ( P u b l i s h e r S r t P o r t ) ,[START_REF] Cain | Internet group management protocol[END_REF] EQ ( e n t i t y I D P u b l i s h e r ) , EQ ( S rc I PS ub sc r ib er ) ) ) 4 INSTANTIATE 5 RTPS FULL_RTPS . Type is DATAWSUB Or FULL_RTPS . Type is DATARSUB 6 switch ( FULL_RTPS . Type ) 7 case DATAWSUB : 8 if not SEARCH HashKey (. p i d t o p i c n a m e _ r t p s . topicname . name 9 IN Protoco ~serializ eddata ~topicdata : type , 10 P I D T O P I C N A M E _ R T P S _ V A L ) , Packet . srcIP , Packet . dstIP 11 : Hash = h a s h I C 1 1 _ D A T A R S U B 12 endif 13 case DATARSUB : 14 if not SEARCH HashKey (. p i d t o p i c n a m e _ r t p s . topicname . name 15 IN Protocol ~serial izeddata ~topicdata : type , 16 P I D T O P I C N A M E _ R T P S _ V A L ) , Packet . dstIP , Packet . srcIP 17 : Hash = h a s h I C 1 1 _ D A T A W S U B 18 endif 19 endswitch 20 BIND 21 RTPS FULL_RTPS . Type is DATAWSUB Or FULL_RTPS . Type is DATARSUB 22 switch ( FULL_RTPS . Type ) 23 case DATARSUB : /* Case Logic */ 24 if SEARCH HashKey (. p i d t o p i c n a m e _ r t p s . topicname . name IN Protocol seria lizeddata ~topicdata : type , P I D T O P I C N A M E _ R T P S _ V A L ) , Packet . dstIP , Packet . srcIP : Hash = h a s h I C 1 1 _ D A T A W S U B 25 endif 26 case DATAWSUB : /* Case Logic */ 27 if SEARCH HashKey (. p i d t o p i c n a m e _ r t p s . topicname . name IN Protocol seria lizedda ta ~topicdata : type , P I D T O P I C N A M E _ R T P S _ V A L ) , Packet . srcIP , Packet . dstIP : Hash = h a s h I C 1 1 _ D A T A R S U B 28 endif 29 endswitch Listing 1.2: The DSL Code for Constraint C11

  c I P A d d r e s s N e w J o i n ; 3 uint32_t S r c I P P a r t i c ip a n t ; 4 uint32_t G r o u p D e s t I P T o B e J o i n e d ; 5 uint32_t D e s t I P P a r t i c i p a n t ; 6 } treeHashC5 ; 7 int i n s e r t I V a l u e C 5 V 2 R e p o r t ( uint32_t key1 , uint32_t key2 , uint32_t SrcIPAddressNewJoin , uint32_t G r o u p D e s t I P T o B e J o i n e d ) ; 8 int d e l e t e V a l u e I h a s h I C 5 ( uint32_t key1 , uint32_t key2 ) ; 9 treeHashC5 * G e t V a l u e f r o m f h a s h I C 5 ( uint32_t key1 , uint32_t key2 ) ; 10 int i n s e r t I V a l u e C 5 V 3 R e p o r t ( uint32_t key1 , uint32_t key2 , uint32_t SrcIPAddressNewJoin , uint32_t G r o u p D e s t I P T o B e J o i n e d ) ; 11 int i n s e r t B V a l u e C 5 h a s h B C 5 ( uint32_t key1 , uint32_t SrcIPParticipant , uint32_t DestIPParticipant , treeHashC5 * treeInst ) ; 12 int d e l e t e V a l u e B h a s h B C 5 ( uint32_t key1 ) ; 13 treeHashC5 * G e t V a l u e f r o m f h a s h B C 5 ( uint32_t key1 ) ; 14 void clearC5 () ; Listing 1.4: Generated Code in hash.h for C5.

  5 int d e s t r o y C 5 _ V 2 L e a v e ( uint32_t key1 , unsigned long pktCount ) ; 6 int d e s t r o y C 5 _ V 3 L e a v e ( uint32_t key1 , unsigned long pktCount ) ; Listing 1.5: Generated Code in constraint.h for C5.

Listing 1 . 7 :

 17 1 void V 2 R e p o r t _ I G M P _ c a l l b a c k ( V2Report_IGMP * v2report_igmp , PDU * thePDU ) { 2 struct HeaderInfo * Packet = thePDU -> header ; 3 i n s t a n t i a t e C 5 _ V 2 R e p o r t ( Packet -> srcIP , 4 v2report_igmp -> groupaddr , Packet -> srcIP , 5 v2report_igmp -> groupaddr , Packet -> pktCount ) ;} IGMP V2Report with a trigger call to C5 Instantiate Phase. Finally, Listing 1.7 shows an example of triggering the C5 instantiate phase within the generated callback function of IGMP V2Report based on the instantiate phase of the C5 DSL in Listing 1.1. The callback function headers are predefined in the parser and used as inputs for the callback transformation. The callback functions passes the triggering packets defined in the constraint specifications and fills the required parameters of the tree phases. The transformation keeps appending the callback functions into the callback.c file for different triggering packets based on the constraint tree phases.

Fig. 6 :

 6 Fig. 6: Performance Comparison between the Constraint Engines.

  Listing 1.6: Snippet of Generated Code in constraint.c for C5

	1 int bind1C5 ( uint32_t instantiate_key1 , uint32_t instantiate_key2 , uint32_t
		key1 , uint32_t SrcIPParticipant , uint32_t DestIPParticipant , unsigned
		long pktCount ) {
	2 if ( true ) {
	3	treeHashC5 * insTree = G e t V a l u e f r o m f h a s h I C 5 ( instantiate_key1 ,
		i n s t a n t i a t e _ k e y2 ) ;
	4	if ( insTree == NULL ) { iC5f ++; iC5bindf ++; return -1;}
	5	else {}
	6	treeHashC5 * bindTree = G e t V a l u e f r o m f h a s h B C 5 ( key1 ) ;
	7	bool noRepeat = false ;
	8	if ( bindTree != NULL ) { if (! noRepeat ) return 1;}
	9	bool split = false ;
	10	if ( split ) {
	11	treeHashC5 * splitedTree = malloc ( sizeof ( treeHashC5 ) ) ;
	12	memcpy ( splitedTree , insTree , sizeof ( treeHashC5 ) ) ;
	13	bindTree = splitedTree ;}
	14	else if (! noRepeat ) {
	15	treeHashC5 * splitedTree = malloc ( sizeof ( treeHashC5 ) ) ;
	16	memcpy ( splitedTree , insTree , sizeof ( treeHashC5 ) ) ;
	17	bindTree = splitedTree ;}
	18	else { bindTree = insTree ;}
	19	if ( i n s e r t B V a l u e C 5 h a s h B C 5 ( key1 , SrcIPParticipant , DestIPParticipant ,
		bindTree ) == -1)
	20	{ iC5f ++; iC5bindf ++; return -1;}
	21	if ( noRepeat ) { if (! split ) { if ( d e l e t e V a l u e I h a s h I C 5 ( i n s t a n t i a t e _ k e y 1 ,
		i n s t a n t i a t e _ k e y2 ) == -1) {
	22	iC5f ++; iC5bindf ++; return -1;}}}
	23	iC5bind ++; return 1;}
	24 else return 1;}

Table 1 :

 1 Test Cases with Four Constraints.

	C5 Tests	C8 Tests
	Normal	Normal
	Missing IGMP Packet in the Sequence Wrong Topic Name in DATA(W)
	Wrong Group Address in IGMP Report	-
	C11 Tests	C12 Tests
	Normal	Normal
	Wrong SrcIP in IGMP DATA(W)	Wrong SrcIP in IGMP DATA(W)
	Wrong DestIP in IGMP DATA(W)	Wrong SrcIP in IGMP DATA

Acknowledgements

This research is supported by the Department of National Defence (DND), Canada, The Natural Sciences and Engineering Research Council of Canada (NSERC), and The Ontario Research Foundation (ORF), Canada.


Deborah Bunker
email: deborah.bunker@sydney.edu.au

Stefan Stieglitz

Christian Ehnis

Anthony Sleigh

Bright ICT: Social Media Analytics for Society and Crisis Management

Keywords: ICT, Crisis Management, Social Media Analytics, Engaged Scholarship

Bright ICT promises a new era of IT adoption and use, however, in this current era of ubiquitous computing and social media platforms, we have witnessed IS users being rendered powerless in the information systems development process and professionally manipulated by large technology companies through the algorithmic structures of social networking platforms. In 1987 Markus & Bjorn-Andersen warned us of the potential of consequences of this situation which are now evident on a daily basis where data privacy is compromised, social media platform content is difficult if not impossible to manage and our political and economic systems are disrupted. This paper outlines an engaged research approach being taken by the RISE_SMA project to develop more innovative theoretical approaches and methods for analysing social media data for the assurance of social cohesion during times of crisis.

Introduction

Eras of IT Adoption

In 2012, Hirschheim & Klein [START_REF] Hirschheim | A Glorious and Not-So-Short History of the Information Systems Field[END_REF] wrote about the four eras of information technology (IT) adoption explaining the 40 year history of information systems and the possibility of sharing a history "that would be effective in helping to bridge the communications gap that exists between the different sub-communities that make up the discipline" [1p. 188]. Niederman et al. [START_REF] Niederman | On the Co-Evolution of Information Technology and Information Systems Personnel[END_REF] further developed the ideas of Hirschheim & Klein [START_REF] Hirschheim | A Glorious and Not-So-Short History of the Information Systems Field[END_REF] to relabel each IT adoption era to reflect the information systems development (ISD) skills orientation in each era from the "inner circle" of highly specialised IS expertise in the First Era right through to the Fourth Era "where people who previously had little engagement with information technology were suddenly power users" [2 -p 36]. Table 1 highlights the Eras of IT Adoption and the dominant technologies in use as outlined by Hirschheim and Klein [START_REF] Hirschheim | A Glorious and Not-So-Short History of the Information Systems Field[END_REF] and Niederman et al. [START_REF] Niederman | On the Co-Evolution of Information Technology and Information Systems Personnel[END_REF] but it also highlights the location of ISD expertise and power/control as well as the ISD trend for each adoption era. It is interesting to note that the First and Fourth Eras reflect much the same ISD expertise and power/control which is predominantly in the hands of technology companies. It appears we have come 'full circle'.

IFIP WG8.6 and Information Systems Development (ISD) Research

IFIP WG8.6 has the brief to "foster understanding and improve research in practice, methods, and techniques in the transfer and diffusion of information technology within systems that are developed and in the development process" 1 . Over the years, since establishment in 1993 (during the Third Era of the E-commerce Gold Rush), IFIP WG8.6 scholars have critically researched ISD practice and how it relates to adoption, diffusion, transfer and implementation of IS within society, government, organisations and on an individual level. In recent years membership of the group has been actively consolidating its scholarship in the current Fourth Era of Ubiquitous Computing.

For example, the recent working conferences 'Re-Imagining Diffusion of Information Technology and Systems: Opportunities and Risks' in 2017 at Guimaraes and 'Smart Working, Living and Organising' in 2018 in Portsmouth have taken the scholarship efforts of the group into areas such as social networks, social media, adaptive technologies, work systems, socio-technical approaches and perspectives, digital artifacts and boundaries, the colliding worlds of formal and self-organising systems, ICT4D, disruption and digital platforms, sharing economies, data and project governance, smart objects and systems, digital payments and security and privacy in the digital world. These new developments have reorientated our research agenda to more fulsomely consider the impact of IS and IT on society. The Working Conference to be held in June 2019 in Ghana is themed on 'Bright ICT' for societal benefit focussed on "development of relevant technologies, business models, public policies, social norms, international agreements, metrics for measuring national progress and preventing undesirable activities on the Internet". 2In this era of ubiquitous computing and digital disruption, however, large technology companies continue to abuse their ISD power [START_REF] Wong | Google snubs Senate hearings on election meddling' 5 Sept[END_REF] and this has an impact on Bright ICT potential. When looking at the ISD approaches to social media (SM) platforms issues such as data privacy, platform monitoring and surveillance, inability to manage platform content and disruption of political and economic systems are brought into sharp focus daily with a continuing stream of horror stories. Most recently a mass murder that occurred in Christchurch on 15 th March 2019 was live streamed by the perpetrator of the murders on Facebook [START_REF]Reuters World News 'French Muslim group sues Facebook, YouTube over footage of Christchurch massacre[END_REF] and currently we see the Australian government is grappling with how to deal with the impact of such an action that is facilitated by a SM platform architecture [START_REF] Hunter | Facebook censured by government for failure to act on live streaming concerns' 26 March[END_REF]. SM platforms are often criticized more widely: fake news and social bots can manipulate and disturb public communication [START_REF] Ross | Are social bots a real threat? An agent-based model of the spiral of silence to analyse the impact of manipulative actors in social networks[END_REF]. At the same time, they generate a large amount of data in real time during disasters -data that is important for the first response to such events. Also, the assurance of social cohesion during a disaster event becomes a problem when the sheer volume of messages generated means that SM messages are not able to be effectively analysed for essential information [START_REF] Stieglitz | Social Media Analytics -Challenges in Topic Discovery, Data Collection, and Data Preparation[END_REF]. This is in part due to the communications architectures of these platforms and current limitations in the development of SM analytics software.

The development of an open and unmanaged communications platform has unforeseen consequences that are now difficult to overcome. The jinn, as they say, is out of the bottle.

On the other hand, we must acknowledge that SM channels have become important communications channels for society. Twitter, Instagram and Facebook have changed public social communication enormously. They are used by individuals as well as by political, economic and scientific players to disseminate information and messages or to find out what others think. It is imperative that we develop suitable analytics approaches that render the users of these systems more aware of their design consequences and give them the ability to develop more socially positive and "bright ICT" applications of them.

This paper discusses the outcomes of a research workshop held in Sydney on March 6 th and 7 th , 2019 as part of the research project "RISE_SMA -Social Media Analytics for Society and Crises". RISE_SMA is a multi-partner EU project which aims to improve data analytics methods and approaches to more effectively filter out and use relevant information in an ethical way. A key focus of the project is to involve practitioner stakeholders as research project co-creators and collaborators through the use of an engaged scholarship approach and research methods, so as to effectively shape analytics solutions to meet the expectations of society and crisis responders.

In this paper, we firstly discuss the awareness of power in the ISD process and what this means for SM platform providers and their users. We then go on to highlight the unforeseen consequences of SM platform developments that are a result of the professional manipulation of the ISD process by social media vendors and that result in mistrust of SM messages and information. Next, we discuss how we might overcome these limitations through the RISE_SMA 3 project and its objective of mutual negotiation of the IS development process (in this case SM analytics) describing the project's engaged scholarship approach and live research methods to achieve this outcome. We then outline the workshop findings and conclude the paper with contributions which highlight the beginning of the fifth era of IT adoption and location of ISD power, limitations and areas of future research.

Awareness of Power and the Information Systems Development Process

Do the IT power users of today, as described by Niederman et al. [START_REF] Niederman | On the Co-Evolution of Information Technology and Information Systems Personnel[END_REF] have the knowledge and understanding of information systems development to allow them sufficient power and control over the systems that they adopt and use? We would contend that currently this isn't the case. By way of example, we have seen that the development activities behind platforms like Facebook and Twitter remain secretive due to their commercial value as well as a reluctance of SM platform providers to interfere with the structure and dynamics of their platform architectures. This problem will increase even more with the new developments in artificial intelligence and machine learning.

In 1987 Markus & Bjorn-Andersen [START_REF] Markus | Power Over Users: Its Exercise by System Professionals[END_REF] wrote "The potential of consequences of IS professional power for users is simply too significant to remain unexplored" (p. 498). This statement is still as relevant now as it was in 1987. "Awareness and the perceived legitimacy of power exercise will affect users' responses to [ISD] professionals and their acceptance of the solutions they propose. Furthermore, we believe that interventions that increase this awareness will pave the way to compromises by opening up previously covert issues. This would help prevent negative consequences from power use and help achieve solutions that are acceptable to both parties" (p. 502). When both system designers and system users are aware of their power in the ISD process then mutual negotiation over the design and use of the system takes place. When designers are unaware, but users are aware of their power then user resistance to systems design and deployment occurs. When designers are aware, but users are unaware then professional manipulation of users by IS designers can happen but when both are unaware of power then unintended influence (lack of successfully negotiated systems outcomes and opportunistic exercise of power) takes place (see Table 2). User Awareness Aware Unaware

Designer Awareness

Aware

Mutual negotiation Professional manipulation

Unaware User resistance Unintended influence

In this era of ubiquitous computing and social media we see companies like Facebook and Twitter who are aware of their power over the ISD process and users who have been rendered unaware of this by the algorithmic structures of these platforms. This gives rise to professional manipulation of users by technology companies and the development of data analytics approaches which are biased towards producing profits for them and their commercial partners. But are we now seeing a shift towards a new era of ICT adoption and use? Have technology designers been largely unaware of the power of their system designs and are the general users of these systems largely unaware of their social impact?

3

The Unforeseen Consequences of Social Media Design

The unforeseen consequences (unintended influence) of SM platforms limit their scope for Bright ICT outcomes for society. Unforeseen consequences include: system personalisation (not mass systematisation) and the difficulty in using SM information and messages for decision making; haphazard facilitation of convergence behaviour; and enablement of anti-social behaviour. We will now discuss each of these consequences in turn.

Platforms for System Personalization Not Mass Systematization

We know that SM platforms facilitate communication, collaboration and coordination of social networks when information is input to, processed by and output from a SM platform [START_REF] Oh | Community Intelligence and social media services: A rumour theoretic analysis of tweets during social crises[END_REF]. We also know that information is input and output from these platforms in many different formats, such as tweets, micro-blog posts, wiki posts, maps, etc. While these formats can work very well for personal decision-making, enhancement of social interactions, and are easily accessible on personal devices (mobile phones, pads and laptops) SM platforms and the information generated by them lack mass 'systematization' i.e. the ability to derive an optimal understanding of the 'facts at hand' for a systemic approach to decision making -such as that found in proprietary business software systems. So, on one hand the lack of systematization is a major strength of SM platforms as they allow a relatively novice user to propagate, access, use and communicate information in a personal and relevant way. Lack of systematization does, however, also represent a major weakness of SM platforms to address common problems, as the multiple personal 'representations' of information are difficult to combine, interpret and apply to derive common analytical solutions [START_REF] Kroenke | Experiencing MIS[END_REF]. In many instances the volume of SM information and communications often gets out of hand during a major organisational or societal event, adding further to the difficulty that organisations and governments have in interpreting and using information that is generated in this way [START_REF] Sleigh | Comment by NSW Police, regarding listening for messages from inside Lindt Café, during the hostage crisis[END_REF].

In order for decision-making to be effectively underpinned by the use of SM, these efforts would require a minimum level of systematization of SM platforms that enables and supports the interpretation, combination and application of multiple personal 'representations' into synthesized information and processes. SM has not been designed for mass systemization and decision-making activities, however, and attempts to use it in this way can seriously backfire.

For example, enabling a SM user to upload an image of a flood can greatly enhance the effectiveness of the information they are making available to other SM users; while on the other hand, by adding the GPS coordinates of the user to the message they are uploading, (in order to systematize the information) makes the information take on extra characteristics that once interpreted by an agency may assist in rescuing the user (if they are in imminent danger) or breaching their privacy (if they are not).

Platforms Which Haphazardly Facilitate Convergence Behavior

Convergence behavior is a phenomenon that occurs during mass events like crises or protests i.e. the spontaneous and mass movement of assets, people, resources (and now information) towards the event area [START_REF] Mirbabaie | Examining Convergence Behaviour during Crisis Situations on Social Media -A Case Study on the Manchester Bombing 2017[END_REF]. For instance, in the physical world, many people may converge on an event to look at it unfold [START_REF] Fritz | Convergence Behavior In Disasters: A Problem in Social Control Committee on Disaster Studies[END_REF]. In the virtual world you may use a commonly available social media platform such as Twitter, to converge on and comment on an event. Subba and Bui [START_REF] Subba | An Exploration of the Physical-Virtual Convergence Behaviours in Crisis Situations[END_REF] explain that some convergence behaviors can be expressed in both physical and virtual worlds, some in the physical world only and some in the virtual world only. They argue that all convergence behaviors i.e. physical and virtual have interaction "properties" which include:

• Local vs Global e.g. an event may be local but its impact global;

• Complementarity vs Substitutability e.g. a doctor may go online as a helper but may not necessarily substitute for a doctor at the scene; • Formality vs Informality e.g. there is formal agency response versus informal community response;

• Legitimacy vs Illegality e.g. desirable, proper and appropriate versus illegal or morally wrong behaviors; • Planning vs Spontaneity e.g. planned reactions versus ad hoc and emergent behaviors for example the phenomenon of "spontaneous volunteers"; and • Centralized vs Decentralized e.g. response on the ground versus collaboration and co-operation online. They also contend that convergence behaviors are a "double edged sword phenomena" (p. 9) as they provide additional assistance and resources to an event response, but they also bring congestion that can cause problems to manage. These behaviors are also context driven i.e. dependent on the type of event, its impact and the resilience of the community it affects, so that convergence behavior is difficult to anticipate. Event managers "have no other option but to spend time in pulling strings to manipulate the convergence process after the convergence process takes place" (p. 9).

Their conclusions focus on the initial work of Fritz and Matthewson [START_REF] Fritz | Convergence Behavior In Disasters: A Problem in Social Control Committee on Disaster Studies[END_REF] which recommended that an "initial attack on the problems of convergence requires the development of a systematic policy and programs for handling information and communications" (p. 9) as it is the characteristics of event information provision and communication that drives convergence behavior towards an event. SM platforms lack the mass systematization of proprietary business systems to coordinate and communicate information in a systemic manner. They instead produce information and communication in a haphazard, organic and disorganized way often producing emergent, persistent, undesirable and unwanted convergence behavior.

This presents a problem for any individual or organization that wishes to either communicate via, or to use information generated by SM to make decisions and negotiate outcomes in relation to an event. It is virtually impossible to authenticate the source and validate the content of SM generated information and communications, and as such, platforms generally rely on community or government agency moderation of tweets and posts for this purpose [START_REF] Starbird | Chatter on The Red: What Hazards Threat Reveals about the Social Life of Microblogged Information[END_REF].

Interaction properties between convergence behavior archetypes in both physical and virtual environments are also directly impacted by the haphazard nature of SM information production and communication i.e. lack of systematization can lend an unpredictability to how people will all negotiate and interact with each other, their communities, governments, organisations and other entities both online and in the physical world, during an event.

Platforms that Enable Anti-Social Behavior

While it is well known that SM platforms have greatly benefited society and individuals by enabling communication, collaboration and co-ordination activities on an unprecedented scale, due to their design and nature i.e. system personalization, they are also enablers of anti-social, narcissistic and ego centric behavior which manifests itself in activities such as propagation of false information or manipulated images, rumours (including misrepresentation of identity), bullying, harassment and coercion, privacy breaches and much more.

Online social networks and SM platforms provide an enabling platform for anti-social and narcissistic behavior as they provide an information and communications channel that is easily manipulated, controlled and personalized to project an image of an individual that may (or may not) be reflective of that individual. This notion also extends to group and convergence behavior.

This type of convergence behavior through the use of SM platforms is also in evidence all around us on a day-to-day basis through the activity of "trolling" where individuals make off-topic or inflammatory statements to provoke others and disrupt supplementary activities and discussions [START_REF] Golbeck | Negativity and anti-social attention seeking among narcissists on Twitter: A linguistic analysis[END_REF]. A study by Buckles et al. [START_REF] Buckles | Trolls just want to have fun[END_REF] highlights that SM trolls have narcissistic tendencies (as well as other negative behavioral traits). On a wider scale and at a societal level, we have also seen this type of intentional negative behavior play out in terrorist, anti-government, and political manipulation of social media platforms to cause general havoc and disruption to society [START_REF] Stieglitz | Social Media Analytics -Challenges in Topic Discovery, Data Collection, and Data Preparation[END_REF] [12].

Social Media Distrust

We contend that these three factors, which are the unintended consequences of current SM platform ISD approaches, form a significant barrier to trust in SM platforms for society and crisis managers who wish to use them as potential information and communications platforms for Bright ICT for the common good (see Figure 1). Roy Morgan Research [START_REF] Morgan | Social Media deeply distrusted by Australians' 26[END_REF] surveyed Australians and found that 47% distrusted information provided on social media platforms. Their respondents, top 5 distrust drivers were:

• Fake News / manipulation of the truth;

• False statistics / audience measurement;

• Personal information stolen & distributed;

• Anyone can make claims without any evidence; and • News is sensationalised / becomes entertainment. Distrust of SM platforms limits their application for Bright ICT and the associated benefits to society. This distrust is tied to the lack of mass systematisation (social media analytics) and the resulting antisocial and haphazard convergence behaviours that result. How then can we mitigate for the unintended consequences of the fourth era of ICT adoption and use so that SM technologies can more effectively produce societal benefits?

RISE_SMA Project Aims and Objectives

The RISE-SMA project seeks to develop more innovative theoretical approaches and methods for analysing social media data which are very important for the assurance of social cohesion during times of crisis. The project team is tackling the project from a multi-disciplinary/academic-practitioner perspective that will define and scope the project inclusive of multiple viewpoints and which will create analytic solutions including all stakeholders in the ISD process. This will ensure effective outcomes by rendering the users of these analytics solutions aware of their power in the ISD process.

The RISE_SMA project team is co-ordinated by University of Duisburg-Essen (Germany) and consists of partners from Leiden University (Netherlands), the University of Agder (Norway), the University of Sydney (Australia), Queensland University of Technology (Australia), UNISINOS (Brazil) and the University of Padjadjaran (Indonesia) as well as the software development company Virtimo in Berlin (Germany) and the municipality of Kristiansand (Norway).

Social Methodology and Research Design

We took an engaged research approach to the development of more innovative theoretical approaches and methods for analysing social media data by holding a 2-day workshop with academics and practitioners. This followed a similar live methods design process used in a number of successful projects for the Communications and Technology for Society Research Group4 including elements such as: 1) imprography -for structured presentations and unstructured discussions; 2) collaboration -bringing together academics/practitioners to co-create a research agenda, problem statement/s and proposed solutions from all perspectives; and 3) creativity -imprography facilitates all workshop participants to put their ideas and suggestions forward without "fear of failure" [19] [20].

During our workshop researchers/practitioners engaged with each other without taking control of the course or direction of the discussion, emphasizing and respecting the equality of experience of all participants from their own perspective "No input to the workshop is superior to any other" [START_REF] Elbanna | Emergency management in the changing world of social media: Framing the research agenda with the stakeholders through engaged scholarship[END_REF].

Our live research methods approach to workshop design differs in important aspects from other workshop methods where usually an academic research team sets the research agenda and controls the workshop structure and discussions [START_REF] Tarr | On liveness: using arts workshops as a research method[END_REF]. Our approach to the workshop documented for this paper aims for the co-creation and reframing of problems and solutions by all workshop participants. Hence, it is not limited to simply analysing existing knowledge and modes of thought. Importantly, our engaged scholarship approach allows for new thinking about and deep understanding of the research area that participants i.e. academics/practitioners develop through their participation in the workshop.

Our approach also presents and re-presents the research agenda, problems and solutions in real-time; as participants work through cycles of discovery, framing and cocreation throughout the workshop. The workshop design was as follows.

Location, Date and Timing: Sydney Australia, 6 th & 7th March 2019 from 10am-4pm.

Purpose: To develop more innovative theoretical approaches and methods for analysing social media data for the assurance of social cohesion during times of crisis.

Participants: 12 practitioner and academic participants (50/50 split) with experience in: emergency services; social media management and analytics; industry; government emergency co-ordination; geospatial information management; software development; and disaster recovery research.

Research Team: Two senior researchers, one post-doctoral researcher and three PhD candidates from Information Systems with an emphasis on IS in crisis situations and methods as they apply to data analytics.

Structure: Day 1-Sessions Expected Research Outcomes: The RISE_SMA project's official kick off workshop is scheduled for April 2018. In order to create a good basis for this kick-off event, the project co-ordinator (University of Duisburg-Essen) as well as research partners from Communications and Technology for Society Research Group (University of Sydney), conducted a joint workshop with practitioners from crisis social media, communications and emergency information managers to trial an engaged scholarship approach [START_REF] Van De Ven | Engaged scholarship: A guide for organizational and social research[END_REF] [23] [START_REF] Elbanna | Emergency management in the changing world of social media: Framing the research agenda with the stakeholders through engaged scholarship[END_REF]. One goal was to firstly better understand issues surrounding the use of SM platforms for crisis communications as well as to co-create project areas of focus with both academic and practitioner team members. We utilised a "live" collaborative form of engaged scholarship i.e. workshops, so that all academic/practitioner project participants could develop insight together regarding the unforeseen consequences of SM platform, inform each other and develop a mutual understanding of research problem while formulating a focus for comprehensive and relevant analytics solutions. "We also believe that diffracting academic and professional expertise contributes to each other's development and can contribute to generating innovative ideas" [22 -p. 114] In sum, this workshop was focussed on developing a better understanding of the problems and issues of social media use for crisis management and situational awareness purposes; and then on co-producing and framing a research agenda with all of the workshop participants.

Results and Discussion

The workshop gave us the opportunity to include all stakeholders in the process of project creation and agenda setting as well as identifying areas of focus for the production of useful and relevant analytics. It was facilitated by the two senior researchers on the project team and there was a planned agenda order. This was not strictly followed so as to allow workshop participants to 'free wheel' with ideas of importance if and when they occurred out of the workshop sequence. Practitioner presentations assisted participants to better understand the problems associated with SM platform use for society and crisis management and academic presentations assisted participants to better understand what SM research trends might be important for the future.

Workshop Insights

Over the course of the 2 days of the workshop the group created an assessment of the current situation of SM platform use in crisis and emergency management. The assessment highlighted that:

• SM communications management within crisis management agencies can have many different areas of focus e.g. roles such as public information officer, warning officer, public intelligence and social media intelligence analyst are created to manage SM communications to and from the general public; • Crisis management agencies continually improve their SM analysis procedures based on their own experiences and are often driven by a high degree of selforganisation and intrinsic motivation; • Due to the current cost of SM analytics, government may use a combination of proprietary and open source analytics packages to work with social media information. Use of appropriate public domain tools to analyse SM communications, however, may have associated privacy issues or they may be too complex to use and/or be unsupported; • Spread of misinformation on SM platforms is an ongoing issue i.e. people may not trust SM platforms, but they do trust their online local communities/local groups where rumours may take root and be difficult to quash; • Moderation tools like SpreadSocial are essential to the connection of all crisis management agency pages and Twitter accounts; • Community expectations of the efficacy and use of SM platforms for crisis information seeking and reporting must be continually managed i.e. not just during a crisis; • Well-being of crisis agency social media officers must be continually managed i.e. negative comments especially police postings about crimes / missing people can have a deep psycho/social impact on officers dealing with these communications; • SM analytics training for government SM managers is paramount in order to effectively gather community intelligence for situational awareness as well as how to structure outgoing information and messaging; and • Incident control and situational awareness through SM use needs to be managed over: a) multiple jurisdictions i.e. national, state, regional level and locally and 2) various threat types and levels. As a result of this current assessment of SM adoption and use, the group highlighted possible research opportunities and areas. These included the co-development of analytics methods, frameworks and approaches that addressed:

• Identification, credentialing, organizing, managing, training and utilizing of digital volunteers (from all over the world) for public good;

Post Workshop Analysis of Research Notes and Workshop Materials

Post workshop, our research team (two senior researchers, one post-doctoral researcher and 3 PhD candidates) met to debrief the workshop and further synthesized and refined workshop outputs and our notes to highlight the following key areas: Multiple research agendas for the assessment and development of social media analytics for Bright ICT in society for crisis management became evident as we analysed the workshop brainstorming and clustering activities which mainly occurred on Day 2. These research agendas included:

• Digital volunteers and systems to manage them i.e. a virtual operations support team (VOST). This agenda is of critical focus as crisis management agencies already have tried and tested systems to recruit, train and manage their existing and considerably skilled volunteer teams. Digital volunteers, whether present online or in person, can supplement agency volunteers but they present a particular challenge for crisis managers; • Development of SM bots as a benign and useful influence on social media crisis communications; and • Social media crisis communication for the development of situational awareness. Multiple project areas were also identified by workshop participants to be pursued by the RISE_SMA research group which include:

• Development of 'proof of concept' training bots for crisis management SM analysis purposes -in conjunction with RISE_SMA project partners and IEERG member institutions and their student programmers; • Organizational framework development for a VOST implementation. A possibility might be to look at matching resources/capability with demand e.g. Uber or AirBnB model could be useful but what are the limitations; and • Creation of multiple 'fact sheets' highlighting the current 'state of the art' in plain English (and echoing the three research agendas) for consumption by practitioners and the general public on the current status of: Digital volunteers and VOST; Intelligent agents in crisis communications e.g. chatbots; and SM models for crisis communications i.e. integrated situational awareness/intelligence.

6

Contribution, Limitations and Future Research Directions

Contribution

It would seem that we are now entering a fifth era of IT adoption and use of social influence. This presents us with some difficult issues and unintended consequences to overcome. Users of technologies in the fourth era have been intentionally professionally manipulated in their understanding of the design architectures and choices made by technology companies, as they have had little awareness of the ISD processes behind these platforms. The technology companies, however, also seem to have been largely unaware of the utility of their system designs to disrupt society by allowing negative and socially disruptive behaviour to flourish without consequence [START_REF]New Zealand Privacy Commissioner Calls Facebook Morally Bankrupt[END_REF]. Added to this, we are now bringing more smart sensors online, embedding more goods with computing power as well as developing and launching applications that depend on locationbased services that can track individuals via GPS. This situation has ultimately led to general user distrust of SM platforms, which then impacts their usefulness for crisis communications. Development of digital volunteering and VOST organisational frameworks, targeted bot applications and appropriate SM management models and frameworks all offer potential solutions to the restoration of trust in social networking platforms and new technological developments for crisis communication purposes. As the fifth ICT adoption era of social influence gains momentum, it is of critical importance that we develop frameworks, approaches, applications and analytics to deal with the unintended consequences of the fourth era and to enable Bright ICT outcomes for society. RISE_SMA is clearly focused on this task.

Limitations

We are aware that our workshop results depend on the opinions and ideas of participating stakeholders and their operating context. The Australian setting of crisis response and management, therefore, has been the starting position for discussion of this topic.

In our opinion this workshop format was quite effective, however, to identify the existing lack of knowledge and requirements for action regarding the use of SM platforms in crisis situations from both an academic perspective and practice-driven point of view. This workshop presented us with a unique opportunity to work with practitioners to co-develop a deeper understanding of the critical issues, problems and limitations with SM use for crisis communications, management and situational awareness purposes (and hence better facilitation of the application of SM platforms to Bright ICT outcomes). It also enabled us to co-create, with experienced practitioners and researchers, a relevant data analytics research agenda and identify research projects of importance to practice for RISE_SMA to focus their efforts on.

Future Research Directions

This workshop has also enabled us to take an engaged scholarship approach and utilize a live workshop method that we had previous project success with. There is potential for this approach and method to be replicated and utilized by other RISE_SMA partner institutions at other locations to assess whether the same research agendas and potential projects might be applicable in other jurisdictions or whether there might be significant differences between jurisdictions. An area of particular importance for the future direction of the project confirmed by our workshop participants is identifying and defining mechanisms for organization/selforganization of digital volunteers in crisis situations via SM platforms. SM platforms have enabled self-organizing group structures, outside of the already well established and effective volunteer teams in crisis management agencies, where individuals and communities may take an active role in a crisis through their convergence behaviour, for example as happened in the Christchurch Earthquake in 2011 with the Student Volunteer Army [START_REF] Bunker | Crisis Management and Social Media: Assuring Effective Information Governance for Long Term Social Sustainability[END_REF]. It is expected that new information and ideas will emerge from the RISE_SMA project on how individuals and communities organize via SM in crises and disaster scenarios, as will factors influencing the future role of SM to enable resilient communities. For instance, Taylor et al. [START_REF] Taylor | B 'The role of social media as psychological first aid as a support to community resilience building. A Facebook study from 'Cyclone Yasi Update[END_REF] explored public SM use from January to March 2011 in Australia and New Zealand during a time where a number of natural disasters occurred. They focused in particular on the 'Cyclone Yasi Update' Facebook page, which was a community-run disaster information hub. This hub combined official information with personalized 2-way communication (which also facilitated the quashing of rumors) and orientated people to the applicable accurate sources of information. This provided "a single initial trusted point of contact for people who needed to prioritize their activities to protect themselves, rather than spend time searching for information" [26 -p. 22]. Examples such as the 'Cyclone Yasi Update' Facebook community information hub, can teach us valuable lessons about digital volunteers. Convergence behavior as it relates to the principles of self-organizing systems is a little understood topic that has the potential to make a major contribution to enhancing the use of SM to organize digital volunteers in crisis situations.

The changing nature of communities from groups of close friends and relatives to extended group members of networks, and how community dynamics are affected by SM in times of disasters, is intricately bound up with, crisis agency organization and management practices and convergence behavior archetypes and their properties.

There is an urgent need to study these management practices and their interrelationship with these archetypes and their evolution in the online world. This is particularly critical if we are to better understand the interplay of convergence behaviors, information and communications personalization characteristics of SM and the enablement (or disablement) of anti-social behavior that occurs during a disaster.

Fig 1 .

 1 Fig 1. Factors Contributing to Social Media Distrust

Table 1 .

 1 Eras of IT Adoption and Location of ISD Power -adapted from Hirschheim & Klein[START_REF] Hirschheim | A Glorious and Not-So-Short History of the Information Systems Field[END_REF] and Niederman et al.[START_REF] Niederman | On the Co-Evolution of Information Technology and Information Systems Personnel[END_REF]

	IT Adoption	Technology in	Location of IS De-	IS Development
	ERA	Use	velopment Exper-	Trend
			tise and Power
	First Era (mid	Third generation	Tech companies -	Outsourcing (bu-
	1960s to mid	mainframe (IBM	high	reaux);
	1970s)	360); Languages	Business -low	Insourcing (vendor
	Computing In-	(Assembler,	Government -low	controlled);
	ner Circle	Fortran, COBOL);	End users -none	Proprietary net-
		Databases; Ether-		works.
		net.
	Second Era	Minicomputers;	Tech companies -	Insourcing (vendor
	(mid-1970s-	Mid-range comput-	high	and organisational
	mid-1980s)	ers; PCs; Fifth gen-	Business -moderate	partnerships)
	End User	eration computing	Government -mod-	Proprietary net-
	Revolution	project.	erate	works;
			End users -moder-	Personal compu-
			ate	ting.
	Third Era	Internetworking	Tech companies -	Insourcing (in
	(mid-1980's	leading to the	low	house developed);
	to mid/late-	emergence of the	Business -high	Proprietary net-
	1990s)	internet.	Government -high	works;
	E-Commerce		End users -moder-	Early internet.
	Gold Rush		ate
	Fourth Era	Internet age; Ubiq-	Tech companies -	Integrated (formal)
	(2000 to now)	uitous computing	high	enterprise systems;
	Ubiquitous	(laptops, netbooks,	Business -low	Outsourcing (cloud
	Computing	tablets,	Government -low	IT service commod-
		smartphones etc);	End users -low	itisation); Commer-
		Search engines;		cial internet;
		Social media.		Social network
				(personal) compu-
				ting.

Table 2 .

 2 Awareness of the Exercise of ISD Power -reproduced from Markus & Bjorn-Andersen[START_REF] Stieglitz | Social Media Analytics -Challenges in Topic Discovery, Data Collection, and Data Preparation[END_REF]

  All practitioners were asked to prepare three PowerPoint slides outlining: 1) what social media means to your organisation (what do you use it for currently?); 2) key issues, problems and expectations with the use of social media in your organisation (what needs improving for the future?); and 3) your "wish list" of key outcomes for the RISE_SMA project. All academics were asked to prepare 2 PowerPoint slides outlining: 1) what research you're conducting now that relates to RISE_SMA; and 2) what you'd like to research in the future in the context of the project.

	what should we do about it? -discussion facilitated by project co-ordinator and
	administrator (University of Duisburg Essen);
	• Academic Presentations -Current and Future Research That Relates to
	RISE_SMA Objectives -all academics; and
	• RISE_SMA Planning and Next Steps -all workshop participants.
	Preparation:
	• RISE_SMA Description and Objectives -project co-ordinator and administrator
	(University of Duisburg Essen);
	• Workshop Introduction and Outline (15 minutes) -project co-ordinator (Univer-
	sity of Duisburg Essen) and team leader (University of Sydney);
	• Practitioner Presentations -areas of importance for RISE_SMA -all practition-
	ers;
	• Aggregation, prioritisation and representation of practitioner areas of im-
	portance i.e. similarities, differences, systems integration issues, relationship of
	areas of importance to experience etc. What would a practitioner "wish list" for
	RISE_SMA outcomes look like? -all workshop participants; and
	• Social Media Research Presentation: Issues, Trends and Future Directions -pro-
	ject co-ordinator (University of Duisburg Essen) and team leader (University of
	Sydney).
	Day 2 -Sessions
	• Practitioner Areas of Importance -Alignment With RISE_SMA Project Objec-
	tives i.e. what issues align, what issues don't align, why do we think this is and

  Creation of bots to manage and influence SM communications e.g. a ChatBot to disseminate warnings or interact with people in trouble;• Use of geospatial information with SM data to assess crisis situations (location, spread, impact etc.), locate individuals impacted by or victims of the situation, dispatch resources to the crisis location through a multi-disciplinary approach to develop systems to combine social media with GIS data; and • Techniques and approaches to integrate location information into SM posts as a matter of priority i.e. management of the debate over data protection vs importance of data use in crisis management

	platforms e.g. how validate and assess photos, information etc. early enough to
	adequately and accurately inform situational awareness;
	• 24x7 monitoring and assessment centre capability with trained people;
	• Community education regarding tools and techniques on: 1) how to upload use-
	ful crisis information, and 2) how to receive and use information e.g. how to
	stay cool in a heat wave;
	•
	• E-learning training modules for SM analytics approaches, frameworks and tech-
	niques;
	• Automated threat analytics;
	• Big data analytics (including geospatial data) i.e. more effective assessment and
	use of high volumes of information (text, image, video, sound) generated by SM

Table 3 .

 3 Fifth Era of IT Adoption and Location of ISD Power

	IT Adoption	Technology in	Location of IS De-	IS Development
	ERA	Use	velopment Exper-	Trend
			tise and Power
	Fifth Era (now	Ubiquitous per-	Tech companies -	Cloud computing;
	into the fu-	sonal computing	low	Social networks: Lo-
	ture)	(smart phones);	Manufacturing	cation-based ser-
	Social Influ-	Search engines;	companies -high	vices; Corporate data
	ence.	Social media;	Data/information	harvesting and profil-
		Smart sensors;	services -high	ing; Shared market-
		Spatial systems;	Business -low	ing intelligence; Cor-
		5G communica-	Government -low	porate and personal
		tions; GPS track-	End users -low	brand curation; Mass
		ing; Digital imag-		social manipulation
		ing; Rapid visual-		and influencing; Em-
		isation; Artificial		bedded autonomous
		intelligence; Sat-		systems; Digital twin
		ellites; Computer		simulation (for de-
		embedded		sign and develop-
		"things" (cars,		ment purposes).
		protheses, etc).

http://ifipwg86.wikidot.com/about-us last access 5 April

http://ugbs.ug.edu.gh/ifipwg86-2019/index.html last accessed 5 April 2019

RISE_SMA is funded by the European Union from 2019-2022, https://social-media-analytics.org/ last accessed 5 April 2019

https://sydney.edu.au/business/our-research/research-groups/communications-and-technologyfor-society.html