Manel Jerbi
email: manel.jerbi@gmail.com

Zaineb Chelly Dagdia
email: zaineb.chelly-dagdia@uvsq.fr

Slim Bechikh
email: slim.bechikh@fsegn.rnu.tn

Lamjed Ben Said
email: lamjed.bensaid@isg.rnu.tn

Malware Evolution and Detection Based on the Variable Precision Rough Set Model

To offer innovative malware evolution techniques, it is appealing to integrate approaches that handle imperfect data and knowledge. In fact, malware writers tend to target some precise features within the app's code to camouflage the malicious content. Those features may sometimes present conflictual information about the true nature of the content of the app (malicious/benign). In this paper, we show how the Variable Precision Rough Set (VPRS) model can be combined with optimization techniques, in particular Bilevel-Optimization-Problems (BLOPs), in order to establish a detection model capable of following the crazy race of malware evolution initiated among malware-developers. We propose a new malware detection technique, based on such hybridization, named Variable Precision Rough set Malware Detection (ProRSDet), that offers robust detection rules capable of revealing the new nature of a given app. ProRSDet attains encouraging results when tested against various state-of-the-art malware detection systems using common evaluation metrics.

I. INTRODUCTION

T HE amount of malware is increasing exponentially thanks to the use of advanced malware-development tools [START_REF] Ollmann | The evolution of commercial malware development kits and colour-by-numbers custom malware[END_REF]. Detection models struggle to keep up with these tricky intrusion malicious apps that do not refrain from using the most effective techniques, like the obfuscated malware, to invade the targeted systems. In this course of malware development, one can encounter some data inconsistency specially when dealing with conflictual features that may appear in both benign and malicious apps. In this context, few research has focused on dealing with the inconsistency encountered when extracting relevant features to either produce or detect malware. Authors in [START_REF] Li | Can we leverage predictive uncertainty to detect dataset shift and adversarial examples in android malware detection?[END_REF] proposed to adjust the malware detectors in order to deal with the change that occurs in the data labeling. More precisely, authors tackled the problem that appears when the labels used in the training set are different from the labels used in the testing set and proposed to empirically quantify the epistemic uncertainty of four combined deeplearning based Android malware detectors. Santos et al., in [START_REF] Santos | Semi-supervised learning for unknown malware detection[END_REF], proposed a semi-supervised learning based method to deal with the existing unlabelled apps (unknown nature beforehand) in the training process of a detection process. Also, Nauman et al. [START_REF] Nauman | A three-way decision making approach to malware analysis using probabilistic rough sets[END_REF] looked into a three-way decision-making process This work is supported by ANR PIA funding: ANR-20-IDEES-0002.

based on acceptance, rejection, or deferment. When there is not enough knowledge, the extra deferment choice option gives the opportunity to postpone a decision. It also seeks to reduce incorrect decisions at the model level by finding a trade-off between decision-making attributes like accuracy, generality, and uncertainty. The authors focused on three-way decisions using two probabilistic rough set models: gametheoretic rough sets (GTRS) and information-theoretic rough sets (ITRS). RoughDroid [START_REF] Riad | Roughdroid: operative scheme for functional android malware detection[END_REF] is a floppy analysis technique proposed by the authors that can detect Android malicious programs straight on the smartphone. It is based on seven feature sets extracted from the XML manifest file of an Android application and three feature sets extracted from the Dex file. Those feature sets pass through the Rough Set algorithm to classify the app either as benign or malicious. In this paper, we propose to specially focus on malware motif production and handling the "false" produced ones that may lead to data inconsistency. We genuinely propose to handle this challenging task and address it by evolving effective malicious motifs, a succession of frequent Application Programming Interface (API) call sequences, and exploit them afterwards in a bilevel-based method in order to produce detection rules capable of detecting them. In this work, we aim to attend the following contributions:

• Generate fraudulent motifs and then exploit them to produce robust detection rules by adopting a bilevel architecture where two Evolutionary Algorithms (EAs), an outer one (Genetic Programming algorithm (GP)) and an inner one (Genetic Algorithm (GA)), are in a mutual competition. • Inspect the generated fraudulent motifs, which are generated by the inner algorithm within the second layer using the GA, using the Variable Precision Rough Set (VPRS) model before sending them to the outer algorithm within the first layer, i.e., the GP. • Demonstrate the benefits of the selection made by VPRS reinforced by the bi-level competition between both algorithms since for every detection rule, there exists a whole search space of possible generated malicious motifs that should be effectively sampled to come up with fit and challenging generated motifs that positively affect the detection quality of the corresponding first layer rule. • Evaluate the outperformance of our ProRSDet approach compared to several state-of-the-art detection methods in terms of accuracy maximization and false alarms minimization. The remainder of this paper is structured as follows: Section II emphasizes past work that is most similar to our approach. The fundamentals of BLOP and VPRS used in this work are presented in Section III. Our suggested detection method is described in Section IV. The experimental setup and performance analysis results are presented in Section V. Finally, the conclusion and a description of some future directions are presented in Section VI.

II. RELATED WORK

Different malware detection techniques [START_REF] Piparia | Combinatorial testing of context aware android applications[END_REF], [START_REF] Alotaibi | Matrix profile for ddos attacks detection[END_REF], [START_REF] Kishore | Decentralized controller for software interconnected system subject to malicious attacks[END_REF] have been proposed in literature focusing, particularly, on generating new malware. These can be categorized into two heads. A first category is based on using machine learning based approaches and second category based on the use of evolutionary algorithms.

Among the works proposed in the first head, we mention the work of [START_REF] Xu | Droidevolver: Selfevolving android malware detection system[END_REF] where an Android malware detection system (DroidEvolver) was proposed that can automatically update itself during malware detection using online learning techniques with evolving feature set and pseudo labels. There were some methods which were based on generating adversarial samples. Among these, we mention, the work proposed in [START_REF] Cara | On the feasibility of adversarial sample creation using the android system api[END_REF], where the feasibility of generating adversarial samples specifically through the injection of system API calls was investigated. In [START_REF] Hu | Generating adversarial malware examples for blackbox attacks based on gan[END_REF], a generative adversarial network based algorithm (MalGAN) was proposed to generate adversarial malware examples able to bypass black-box machine learning based detection models. The paper of Moti et al. [START_REF] Moti | Discovering future malware variants by generating new malware samples using generative adversarial network[END_REF] presented a deep generative adversarial network to generate the signature of unseen malware samples; the generated signature is potentially similar to the malware samples that may be released in the future.

Other works proposed automated signature generation systems, such as the work proposed in [START_REF] Yegneswaran | An architecture for generating semantic aware signatures[END_REF], where a system for automatic generation of intrusion signatures from honey net packet traces was developed. The work of [START_REF] Singh | Automated worm fingerprinting[END_REF], proposed an automated approach called "content sifting" that generates precise signatures that can then be used to filter or moderate the spread of a worm. In [START_REF] Griffin | Automatic generation of string signatures for malware detection[END_REF], a string signature generation system (Hancock) was designed to create a minimal set of N-byte sequences from a set of malware samples. Another work, the work of [START_REF] Kephart | Automatic extraction of computer virus signatures[END_REF], used a 5-gram Markov chain model of good software to estimate the probability that a given byte sequence would show up in good software. In the paper of Li et al. [START_REF] Li | Hamsa: fast signature generation for zero-day polymorphic worms with provable attack resilience[END_REF], a network-based automated signature generation system (Hamsa) for polymorphic worms was proposed. The proposed model allowed to analyze the invariant content of polymorphic worms in order to make analytical attackresilience granted for the signature generation algorithm. In [START_REF] Newsome | Polygraph: automatically generating signatures for polymorphic worms[END_REF], Newsome et al. proposed a signature generation system, Polygraph, that produces signatures that match polymorphic worms. Polygraph generates signatures that consist of multiple disjoint content sub-strings and which typically correspond to protocol framing, return addresses, and poorly obfuscated code.

Within the second head, several works [START_REF] Aydogan | Automatic generation of mobile malwares using genetic programming[END_REF], [START_REF] Zolkipli | A framework for malware detection using combination technique and signature generation[END_REF], [START_REF] Kayacık | Can a good offense be a good defense? vulnerability testing of anomaly detectors through an artificial arms race[END_REF], [START_REF] Xue | Auditing anti-malware tools by evolving android malware and dynamic loading technique[END_REF], [START_REF] Sen | Coevolution of mobile malware and anti-malware[END_REF], focused on applying evolutionary algorithms to generate malware samples. Among the most recent and efficient ones, we mention the work of [START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF], where an Android Malware Detection System (AMD) was proposed that produces patterns using a GA in order to mimic real malware patterns. This is to keep the dataset used in the conception of the detection system as varied as possible, which allows AMD to be resistant to obfuscated malware. Also, the work of [START_REF] Sen | Coevolution of mobile malware and anti-malware[END_REF], opted for a system using co-evolutionary algorithms where a first population generates detection rules, and a second population generates artificial malware. In this work, both populations are executed in parallel without any hierarchy. In the works of [START_REF] Jerbi | Android malware detection as a bi-level problem[END_REF], [START_REF] Jerbi | Malware detection using rough set based evolutionary optimization[END_REF], authors adopted a co-evolutionary algorithm as a search engine to ensure better detection rules.

Despite the good reached results of the above mentioned state-of-the-art methods, they still suffer from some limitations. First, they refer to a limited number of malware samples which makes the produced base of malicious malware not varied enough which cannot be of much help for a detection system when facing real attacks. Second, there is no check of the structure of the generated malicious patterns as to be sure enough that they fit among the real samples. And third, the malware generation and detection tasks are achieved separately without interaction which leads to a lack of a "harmony" and hence creates an incompatibility between the tasks.

In in paper, we will introduce our newly developed ProRS-Det malware detection technique that overcomes the state-ofthe-art shortcomings via the hybridization of both evolutionary algorithms and the Variable Precision Rough Set model.

III. BLOP AND VPRS BASIC CONCEPTS

In this section, we introduce the main concepts and fundamentals of both BiLevel OPtimization and the Variable Precision Rough Set model as two tools, used in a hybrid fashion, to ensure the development of our proposed ProRSDet.

A. BiLevel OPtimization

BLOP is a distinctive optimization process where one problem is embedded within another. The inner problem, which is also referred to as the lower-level task, represents a constraint of the outer problem, which is also referred to as the upperlevel task, where only an optimal lower-level solution can be a possible solution to the upper-level one. Each level has its own fitness function to optimize where the considered solutions of each level affect the decision-making space of the other one. The technical formalization of a BLOP problem can be found in [START_REF] Colson | An overview of bilevel optimization[END_REF] and it can be presented as follows:

A BLOP contains two classes of variables: (1) the upperlevel variables x ∈ X ⊂ R n , and (2) the lower-level variables y ∈ Y ⊂ R m . For the follower problem, the optimization task is performed with respect to the variables y while the variables x act as fixed parameters. Thus, each x corresponds to a different follower problem, whose optimal solution is a function on Y and needs to be determined. All variables (x, y) are considered in the leader problem for given values of y (y * ).

In what follows, we give the formal definition of BLOP.

Assuming L : R n × R m → R to be the leader problem and f : R n × R m → R to be the follower one, a BLOP could be defined as follows:

min x∈X,y∈X L L(x, y) subject to G k (x, y) ≤ 0, k = 1, . . . , K. y ∈ argmin{f (x, y)| gj (x, y) ≤ 0, j = 1, . . . , J} (1)
In the given formulation, L represents the first layer objective function, f represents the second layer objective function, x represents the first layer decision vector and y represents the second layer decision vector. G k and g j represent the inequality constraint functions at both layers, respectively. The representation of a bilevel optimization problem is illustrated in Figure 1.

B. Variable Precision Rough Set

VPRS [START_REF] Ziarko | Set approximation quality measures in the variable precision rough set model[END_REF], an extension of RST, is a mathematical tool that deals with inconsistent information and came mainly to overcome the maybe found strictness within the rough set notions which may be too restricted in the sense that they ignore the degree of an overlap between a set and a concept. Let us consider a universe of objects U referred to as elementary events and let s(U) be the ∂ -algebra of measurable subsets of U referred to as random events. It is presumed that new objects e belonging to the universe are generated by a random process (on U). For each new object e, the event X ∈ s(U) occurred if the object e ∈ X. In addition, it is presumed the existence of the prior probability function P assigning probabilities P (X) to sets X belonging to s(U). P (X) > 0 means that all members of the family of sets s(U) are likely to occur, and, P (X) < 1means that their occurrence is not certain. These assumptions are justified by the fact that there is no need to construct a predictive model for events about which it is known that they are unlikely to occur or that they do occur with certainty [START_REF] Ziarko | Set approximation quality measures in the variable precision rough set model[END_REF]. In the context of defining the structure of rough approximation space, R denotes an equivalence relation on U with the finite number of equivalence classes (elementary sets) E 1 , E 2 , . . . , E n such that P (E i ) > 0 for all 1 ≤ i ≤ n. The assumption of finite number of equivalence classes does not mean that the universe U is finite. Each elementary set E can be assigned a measure of overlap with the set X by the conditional probability function defined as P (X | E) = P (X E) / P (E). The values of the conditional probability function are normally estimated from sample data by taking the ratio P (X | E) = card(X E) / card(E). The VPRS generalization of the original rough set model is based on the values of the probability function P and two lower and upper limit certainty threshold parameters l and u such that 0 ≤ l < P (X) < u ≤ 1. The requirement l < P (X) is an extra constraint on the values of the parameters which was proposed in [START_REF] Ziarko | Set approximation quality measures in the variable precision rough set model[END_REF]. The VPRS model is said to be symmetric if l = 1 -u. In this study, the symbol β such that 0 < P (X) < β ≤ 1 is used instead of the symbol u to denote the model upper threshold parameter. Also, the symbol α will substitute the previously defined l parameter.

IV. PRORSDET: THE VARIABLE PRECISION ROUGH SET MALWARE DETECTION TECHNIQUE

Figure 2 depicts ProRSDet's overall running process, which is divided into two principal layers (levels): (1) First layer is built on a GP with the goal of generating a set of effective detection rules (F DRB) and (2) Second layer relies on a GA to generate harmful (malicious) motifs (SHM ) (first step) and on a VPRS based component that exclusively preserves the most dependable set of harmful motifs with no structural flaws, referred to as "Relevant" motifs (F M M ) (second step).

Each of these two layers runs through a series of iterations in order to find the optimal solutions in both levels, which are interdependent. As presented in Figure 2, the evaluation of every upper detection rule solution (among DRB) requires running a search algorithm to find the best undetectable harmful motifs (F M M ) by this rule. The final set of detection rules produced by our ProRSDet (F DRB) is a set of detection rules that will perform the malware detection task.

1) First layer: The first layer's first step, as shown in Figure 2 and Algorithm 1, is to generate a set of detection rules (Algorithm 1, line 1), which will go through an evaluation procedure (Algorithm 1, lines 2-3). The coverage of the base of samples (input) as well as the coverage of the fraudulent motifs created by the second layer are used to make this evaluation. These two measures are used to be maximized by the population of detection rules solutions (Algorithm 1, lines 4-6). This module produces a collection of final detection rules (F DRB) that will be used by the detection job, which is in charge of classifying new apps as malicious or benign. The GP evolutionary operators require a specific formalization to cope with the generated solutions (i.e., the detection rules) by the first layer that relies on a GP process. These are the following:

• Solution representation: The solution is expressed as a series of terminals that relate to various motifs (API call sequences) and functions (Intersection (AN D) and Union (OR)), respectively. • Solution variation: By selecting one of the functions or terminals at random, the GP mutation operator is applied. If a terminal is selected then it is replaced by another terminal; if it is a function then it is replaced by a new function. As for the GP crossover operator, two parent individuals are selected, and a sub-node is picked on each selected parent. The crossover swaps the nodes and their related sub-nodes from one parent to the other. • Solution evaluation: An individual's encoding is quantified using a mathematical metric called the "fitness function", which measures the quality of a proposed detection rule and fraudulent motifs. For the GP adaptation, we used the fitness function f outer defined in Equation 2to evaluate detection-rules solutions (DR). p is the number of detected malicious motifs after executing the solution, i.e., the detection rule, on the base of malicious motifs examples (SM M ), t is the total number of malicious motifs within SM M , and DR i is the i th component of a detection rule DR such that:

DRi = 1 if the i th detected malicious motif exists in SM M 0 otherwise (4)
2) Second layer: The generation process of "Relevant" motifs (F M M , Algorithm 2, line 7) is performed as follows:

• Step 1: A GA is used to maximize the distance between the generated malicious motifs (SHM ) and the reference benign motifs (input, not-generated motifs (SBM ) while minimizing the distance between the generated malicious motifs (SHM ) and the reference malicious ones (SM M ). The GA also increases the amount of malicious motifs generated that are not detected by the first layer, i.e., the detection rules (DRB) (Algorithm 2, lines 1-5). The GA evolutionary operators need a special formalization to deal with the manipulated solutions in order to generate the motifs. The following are the adopted formalizations:

-Solution representation: The GA solutions are represented as chromosomes made up of API call sequences. These are identifiable by their identifiers (IDs) and defined by their class (labels), which indicate their nature (malicious or benign), calling depths, and a collection of binary values indicating whether or not an API call appears in the entire API call sequence. -Solution variation: For the GA crossover operator, two parent individuals (chromosomes) are chosen, and a gene from each parent is chosen. Crossover involves the transfer of genes from one parent to the other. Only parents with the same nature can be used with the crossover operator (malicious or benign). The mutation operation starts by randomly selecting a gene on the chromosome. The selected gene is then replaced with another gene from the same class if it belongs to that class. -Solution evaluation: A fraudulent motif (F M ) is evaluated based on the following GA fitness function:

finner(F M ) = M ax((#gamp-#dagmp)+ n i=1 f Qual (F Mi)) (5)
where i ∈ [1, n]; n indicates the total number of fraudulent motifs, and #gamp refers to the number of fraudulent motifs and #dagmp refers to the number of detected fraudulent motifs. The function f Qual () defined in Equation 6ensures the diversification of the fraudulent motifs.

f Qual (F M i ) = Sim 1 + Sim 2 + Overlap(F M i ) 3 (6) Sim1 = Sim(M S, F Mi) = M S j∈M S Sim(F Mi, M Sj ) |M S| (7)
where j ∈ [1, m];m indicates the total number of malicious motifs. The similarity between the generated motif F M i and the malicious set of motifs (M S).This measure of similarity needs to be maximized.

Sim2 = Sim(BS, F Mi) = BS k∈BS Sim(F Mi, BS k ) |BS| (8)
The similarity between the generated motif F M i where k ∈ [1, p]; p indicates and the benign motifs (BS) the total number of benign set of motifs and which has to be the lowest.

Overlap(F M i ) = 1 - F M l ,i̸ =l Sim(F M i , F M l ) |F M | (9)
Overlap() is measured as the average value of the individual Sim(F M i , F M l ) between the generated motif F M i and all the other generated motifs F M l in the generated dataset SF M . l refers to the total number of the generated motifs. We updated the Needleman-Wunsch alignment algorithm formula [START_REF] Nanni | Generalized needleman-wunsch algorithm for the recognition of t-cell epitopes[END_REF] to our context to determine the similarity Sim() between two motifs. This measure of similarity was employed in the above equations but with different parameters. A detailed description of the similarity function Sim() can be found in [START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF].

• Step 2: The GA evolutionary operators mentioned above may cause the manipulated solutions to be distorted, and hence ambiguous, in different ways and with different degrees. Technically, a set of motifs is declared to be ambiguous when they share the same values of the features (API calls) but do have different label values (malicious/benign). An illustration of this ambiguity is presented in Table I. The manipulated motifs by the lowerlevel are API call sequences. Each API call sequence is named M F X i (as shown in Table I) and is composed of different API calls named M LX j . A conflict (or inconsistency) may exist between objects (fraudulent motifs). It is the case of the objects M F X 7 and M F X 9 because they are indiscernible by condition attributes M LX 1 , . . . , M LX n and have different decision attributes (Nature) (we assume that all attribute values M LX j are the same).

Similarly, another inconsistency exists between objects M F X 3 and M F X 8 .

To handle this ambiguity issue and to guarantee the reliability of the generated malicious motifs, a VPRS component, namely Variable Precision Rough Set Analyzer (VPRS Analyzer in Figure 3) which uses mainly (F CF M, F P F M ) ← Pruning(SCF M ,SP F M ) F M M ← F CF M ∪ F P F M 16: end while the VPRS lower and upper limit certainty thresholds concepts, is plugged to the inner algorithm. Specifically, the VPRS Analyzer checks first the reliability of the generated malicious motifs (SHM ). Among this set, the VPRS Analyzer keeps the most relevant motifs (RF M ) which do not need any further check, and investigates the remaining ambiguous set (AF M ). Among the AF M set, the VPRS Analyzer calculates the lower limit certainty threshold to only keep the certain set of fraudulent motifs SCF M (Algorithm 2, lines 11-12), and the upper limit certainty threshold to keep the approved fraudulent motifs among the possible set of generated fraudulent motifs SP F M , together with SCF M . During the pruning operation (Algorithm 2, line 14), redundant motifs are removed. Finally, the joint sets of F F M and F P F M form the relevant, and the most relevant artificially generated fraudulent motifs (F M M ) (Algorithm 2, line 15). As possible fraudulent motifs cannot be considered relevant enough to be added to the initial set of malicious motifs, they need further evaluation that reflects their quality and measures Fig. 3. Second layer functioning process. their reliability. For every possible fraudulent motif, the VPRSbased component estimates its reliability using an index named Relevance_M alicious_index, which is defined as the ratio of the number of instances that belong to the possible set and having the same structure with a malicious label, and the number of the whole possible set of instances (Equation 10).

Malicious Condition attributes (API call) Decision

fraudulent motifs M LX 1 M LX 2 . . . M LXn (Nature) M F X 1 1 1 . . . 1 M M F X 2 0 0 . . . 0 M M F X 3 1 0 . . . 0 M M F X 4 1 0 . . . 1 M M F X 5 1 1 . . . 0 M M F X 6 1 0 . . . 1 M M F X 7 1 0 . . . 1 B M F X 8 1 0 . . . 0 B M F X 9 1 0 . . . 1 M M F X

Relevance_M alicious_index =

Instance_P ossible_M alicious_M otif Instance_P ossible_Original_Data [START_REF] Cara | On the feasibility of adversarial sample creation using the android system api[END_REF] where Instance_P ossible_M alicious_M otif refers to the number of instances that share the same structure and are labelled malicious and Instance_P ossible_Original_Data refers to the total number of instances within the whole possible set. This index can, therefore, be viewed as the probability of counting the ambiguous fraudulent motifs set (the possible generated motif set) correctly. It shows the extent to which a correct label can be given to a generated motif belonging to the possible set of generated motifs. Tacking into account that we are aiming to produce effective malicious fraudulent motifs, we will only keep the generated motifs that have a Relevance_M alicious_index > 50%. An illustrative example of this index is given below: Sup-pose that when generating 123 new fraudulent motifs, 100 among them were labelled as malicious and 23 were labelled as benign. The Relevance_M alicious_index of those 123 possible generated motifs is (100/123). This means that the Relevance_M alicious_index = 81,30% which is clearly greater than 50% and hence the common shared structure of these generated motifs will be added to the set of malicious motifs sent to the outer algorithm.

3) Detection task based on detection rules: Throughout this phase, our model will perform its classification task where a new app, the executable, will be classified either as a malware or as a benign. This is achieved using the set of detection rules (F DRB). Formally, the first step aims to extract the motifs of the executable. Each motif will be labeled as benign or as malicious by comparing it to the motifs of the SM M and SBM databases. Then, the obtained motifs are compared to the antecedent of F DRB. The comparison will allow the executable to be either classified as a malware or as a benign app.

V. EXPERIMENTAL SETUP AND RESULTS

A. Experimental Setup

An experimental investigation was done to evaluate ProRS-Det's performance in detecting new malware variants. For this purpose, we gathered data from a variety of sources (the theZoo dataset1 , from VirusTotal2 ) and from various portable benign tools such as Google play. We have gathered 5 540 Android apps where 3 440 are malicious and 2 100 apps are benign files. From those apps, a total of malicious motifs and a total of benign motifs were extracted. The conducted process is summarized in Table II. The Drebin dataset [START_REF] Arp | Drebin: Effective and explainable detection of android malware in your pocket[END_REF], which contains 123 453 benign applications and 5 560 malware samples, is used for the evaluation of our approach against the new variants of malware and 0-day attacks. The necessity for confirmation that ProRSDet is not fitting the base of examples led to the selection of a dataset that is different from the one used for the construction phase. For comparisons, various state-of-the-art methods were investigated. These are the classical classifiers named in Table V, tested using Weka with the proposed default parameters settings, three known methods (Rathore et al. [START_REF] Rathore | Robust android malware detection system against adversarial attacks using q-learning[END_REF], Gym-plus [START_REF] Wu | Enhancing machine learning based malware detection model by reinforcement learning[END_REF], and AMD [START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF]), and several commercial antimalware named in Table VII. The comparison made with the two recent state-of-the-art methods ( [START_REF] Rathore | Robust android malware detection system against adversarial attacks using q-learning[END_REF] and [START_REF] Wu | Enhancing machine learning based malware detection model by reinforcement learning[END_REF]) is justified by the fact that those approaches are somehow similar to ProRSDet. In fact, there are common traits between our developed approach and those approaches: they propose a two-task solution (a malware generation task and a malware detection task). Also, to ensure the fairness of comparisons between evolutionary approaches (AMD [START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF] and ProRSDet), we used the parameter settings described in Table III.

Both evolutionary approaches perform 798 000 function evaluations in each run. Also, to help determine the most IV. Indeed, Table IV shows that the best results were reached with a pair of α and β value that equals 0.5, respectively. When running the experiments, we concluded that the fitness functions become stabilized around the 36 th generation. For these reasons, the algorithms did not suffer from premature convergence. The metrics used for the evaluation are: true positives (TP), false positives (FP), true negatives (TN), false negatives (FN), recall (RC), specificity (SP), accuracy (AC), precision (PR), F1_score (FS), and the Area Under the Receiver Operating Characteristics (ROC) Curve (AUC). All of the conducted experiments, based on a 10-fold cross validation, are run on an Intel ® Xeon ® Processor CPU E5-2620 v3, with a 16 GB RAM.

B. Results Analysis

In this section, we compare the ProRSDet obtained results to a set of classifiers (Table V), three state-of-the-art approaches (Rathore et al. [START_REF] Rathore | Robust android malware detection system against adversarial attacks using q-learning[END_REF], Gym-plus [START_REF] Wu | Enhancing machine learning based malware detection model by reinforcement learning[END_REF] and AMD [START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF]) and five antivirus engines (Table VI andTable VII). More precisely, to determine how accurate our predictive model will perform in practice, we used 10-fold cross-validation. We considered all of the collected programs and hence all of the obtained motifs stored in SBM and SM M (see Table II). So, concerning the comparison with the top-five classifiers (Table V), and based on all of the evaluation metrics, ProRSDet surpasses all other classifiers. In comparison to the LDA and J48 classifiers, which produced the second best results among the rest of the classifiers with a pair of precision and accuracy of (98.36%, 97.82%) for LDA and (97.73%, 96.58%) for J48 and a pair of F1_score and specificity of (97.32%, 97.31%) for LDA and (98.37%, 97.13%) for J48, ProRSDet achieved a precision of 98.20%, an accuracy of 98.22%, an F1 score of 98.21%, and a specificity of 98.20%. These remarkable ProRSDet results are based on its high true positives (98.20%) and low false positives (1.80%), which are the best achieved values among the results of the classifiers. These encouraging findings show that ProRSDet is capable of distinguishing between the two possible designations (malicious and benign). Also, regarding the comparison between the EA-based approaches (ProRSDet and AMD [START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF]), we used an unknown dataset (Drebin dataset [START_REF] Arp | Drebin: Effective and explainable detection of android malware in your pocket[END_REF]) and ProRSDet outperformed AMD in terms of the used evaluation metrics as stated in Table VI. This can be explained by the contribution brought by the VPRS Analyzer which helped keep the most "relevant" malicious motifs.

Moreover, we may derive from Table VI and Table VII that, when compared to competing state-of-the-art approaches, (Rathore et al. [START_REF] Rathore | Robust android malware detection system against adversarial attacks using q-learning[END_REF], Gym-plus [START_REF] Wu | Enhancing machine learning based malware detection model by reinforcement learning[END_REF] and AMD [START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF]) using the unknown dataset [START_REF] Arp | Drebin: Effective and explainable detection of android malware in your pocket[END_REF], ProRSDet came in top with an accuracy of 97.66%, a specificity of 97.32%, a recall of 97.99%, a precision of 97.31%, and an AUC of 86.15%. Rathore et al., Gym-plus and AMD, obtained an accuracy of 93.81%, 93.50% and 92.28%, respectively, which are lower than those obtained by our proposed technique. addition, the interesting detection results obtained by ProRSDet are endorsed by the results presented in Table VII which refers to the comparison with the commercial antivirus engines. Table VII shows that ProRSDet reached an accuracy rate of 97.66% whereas the ESET NOD32 engine, which is ranked first among all the other malware antivirus engines, registered only 66.68% of accuracy. It is to be noted that the accuracy values of the four remaining antivirus engines varied approximately between 56% and 66%.

The results reported from Tables V, VI and VII highlight the ability of ProRSDet -thanks to its set of efficient produced rules which are generated using the most relevant set of the generated fraudulent malware; both guaranteed via the use of the BLOP architecture and the VPRS component -to achieve accurate detection operations against new and unknown variants of malware.

To better clarify the efficiency and benefits of relying on the bilevel architecture within ProRSDet, we analyse the results in terms of false positive and the false negative rates. The registered ProRSDet values of those two metrics (Table VI) confirm the usefulness of a bilevel architecture to detect a malicious code efficiently. The continuous competition between both levels (first layer and second layer) permitted generation of good solutions (detection rules and fraudulent motifs) and this had positive impact on the values of FPR (02.69%) and FNR (01.99%). In comparison to ProRSDet, the registered FPR and FNR values for AMD [START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF], which rely on a single-layer based architecture via the use of evolutionary algorithms, are 06.37% and 08.84%, respectively. In addition, referring to Table VIII, we can state that the Variable Precision Rough Set based module succeeded to set apart 198 522 ambiguous instances (possible set) among the generated fraudulent motifs SHM (468 000 instances). More precisely, a set of 92 689 of false motifs were removed from the whole set of ambiguous motifs. The removal of those false motifs was performed thanks to the Relevance_M alicious_Index and after being processed by the lower and upper limit certainty thresholds explained and illustrated in Section IV-2. This distinction brings to light the VPRS component's important contribution in improving the quality of the fraudulent motifs by the second layer and which, consequently, positively affected the false alarms rate. Let us recall that ProRSDet provides a set of robust detection rules thanks to the set of malicious motifs produced by the second layer's GA reinforced by the VPRS module. The VPRS module helps determine the set of "certain" malicious motifs and the set of "possible" malicious motifs. When dealing with this set of possible motifs, a Relevance_M alicious_index (Equation 10) that estimates the reliability degree of each possible malicious motif is also provided to the user (as presented in Section IV-2). This metric, specific to the evaluation of each possible malicious motif, will help determine the fate of this specific motif: add it to the set of malicious motifs or remove it. To be more specific, Figure 4 represents the number of the obtained possible malicious motifs with regards to their Relevance_M alicious_index. Figure 4 shows that 51.28% of possible malicious motifs have a Relevance_M alicious_index that exceeds 50%. Also, 17.98% of possible rules succeeded to correctly classify apps with rates that lie between 41% and 50%. 18.23% of those rules ranked just below with a Relevance_M alicious_index comprised between 31% and 40%. Approximately only 13% of the rules failed to have a Relevance_M alicious_index above 30%. An example of the use of this index was previously given in Section IV-2. Also, an important aspect in our proposed ProRSDet approach that needs to be clarified concerns the setting of the α and β VPRS parameters. In fact, in this study we adopted the the trial and error method which consists of choosing randomly values and apply them in our algorithm. For instance, we conducted four different experiments (Table IV) which helped us determine the best pair of α and β values that leads to better detection results. More precisely, we tried different combination of α and β values and each time we assessed the recall (RC), specificity (SP ), accuracy (AC), precision (P R), F1_score (F S), Area under ROC curve (AU C), false positive rate (F P R) and false negative rate (F N R). The best values were reached with α = 0.5 and β = [START_REF] Wu | Enhancing machine learning based malware detection model by reinforcement learning[END_REF] 93.50 Rathore et al. [START_REF] Rathore | Robust android malware detection system against adversarial attacks using q-learning[END_REF] 93.81 (with RF) 0.5. Indeed, we specifically registered an AC of 97.66%, a P R of 97.31% a F P R of 02.69% and a F N R of 01.99%. Those significant values found their way thanks to great reached percentages of true positives and true negatives.

VI. CONCLUSION AND FUTURE DIRECTIONS

In this research, we developed ProRSDet, a malware detection technique that combines the Variable Precision Rough Set model and bilevel optimization. Within the bilevel architecture, the malware generation task (inner algorithm or second layer) and the rules generation task (detection task, outer algorithm or first layer) are in mutual competition. The second layer generates "Relevant" malicious motifs which are generated by a GA and thoroughly checked by a VPRS component that only keeps the most "pertinent" ones, and which are capable of eluding the GP's set of detection rules in the first layer.

Fig. 1 .

 1 Fig. 1. Representation of a bilevel optimization problem (Inspired by [28])

Fig. 2 .

 2 Fig. 2. Illustration of the ProRSDet functioning process.

fAlgorithm 1

 1 outer (DR) = M ax( P recision(DR)+Recall(DR) 2 where #damp refers to the number of detected fraudulent motifs and #amp refers to the number of fraudulent motifs and P recision(DR) = p i=1 DRi t , Recall(DR) = Outer Algorithm (First layer) Input: SM M : set of malicious motifs, SBM : set of benign motifs, F M M : set of "Relevant" fraudulent motifs, N DR: number of detection rules, N F M : number of "Relevant" fraudulent motifs in SHM , N F : number of iterations in the first layer, N S: number of iterations in the second layer Output: Final set of detection rules F DRB DRB 0 ← Initialization(N DR,SHM ,SBM ) /*First generation of detection rules*/ 2: for each DR 0 in DRB 0 do /*DR means detection rule*/ SF M 0 ← FMGeneration(DR 0 ,F M M ,N F M ,N S) /*call second layer*/ DR 0 ← Evaluation(DR 0 ,SHM ,SF M 0 ) 4: end for k ← 1 6: while k < N F do Qt ← Variation(DRB t-1 ) 8: for each DRt in Qt do /*Evaluate each rule based on upper fitness function*/ DRt ← OuterEvaluation(DRt,SHM ) 10: SF Mt ← FMGeneration(DRt,SHM ,N F M ,N S) DRt ← EvaluationUpdate(DRt,SF Mt) 12: end for Ut ← Qt∪ DRBt 14: DRB t+1 ← Selection(N DR,Ut) k ← k+1 16: end while F DRB ← FittestSelection(DRBt)

Fig. 4 .

 4 Fig. 4. Number of possible motifs with regards to the Relevance_M alicious_index.

TABLE I EXAMPLES

 I OF AMBIGUOUS MOTIFS.

TABLE V COMPARISON

 V BETWEEN PRORSDET AND THE CLASSICAL CLASSIFIERS. ProRSDet 98.20 01.80 98.24 01.76 98.23 98.20 98.22 98.20 98.21 86.79 01.80 01.76 LR 93.81 06.19 96.75 03.25 96.65 93.98 95.28 93.17 95.60 63.69 06.01 03.34 NB 92.30 07.70 28.41 71.59 56.31 78.67 60.35 92,37 93,62 65.06 02.13 09.03 RF 97.41 02.59 95.90 04.10 96.00 98.37 97.16 97.36 97.17 73.04 02.62 04.03 J48 97.18 02.82 93.98 06.02 94.27 97.13 96.58 97.73 98.37 83.90 02.91 05.83 k-NN 89.52 10.48 95.21 04.79 94.92 90.08 92.37 85.74 90.56 57.69 09.91 05.07 LDA 97.29 02.71 98.36 01.64 98.34 97.31 97.82 98.36 97.32 75.96 02.68 01.65 LR: Logistic Regression; LDA: Linear Discriminant Analysis; RF: Random Forest; J48: Decision Tree; NB: Naive Bayes; k-NN: k-Nearest Neighbours.

	Classifier/ TP approach	FP	TN FN RC	SP	AC PR	FS AUC FPR FNR

TABLE VI COMPARISON

 VI BETWEEN PRORSDET AND AMD[START_REF] Jerbi | On the use of artificial malicious patterns for android malware detection[END_REF] USING THE DREBIN DATASET[START_REF] Arp | Drebin: Effective and explainable detection of android malware in your pocket[END_REF]. ProRSDet 97.31 02.69 98.01 01.99 97.99 97.32 97.66 97.31 96.65 86.15 02.69 01.99 AMD 93.80 06.19 90.90 09.10 96.20 92.70 92.28 93.60 92.37 57.69 06.37 08.84

	Classifier/ TP approach	FP	TN FN RC	SP	AC PR	FS AUC FPR FNR

TABLE VII ACCURACY

 VII RESULTS OF PRORSDET AND TOP FIVE COMMERCIAL ENGINES BY VIRUSTOTAL 3 ON THE DREBIN DATASET [31]. Anti-malware Reference Accuracy (%) ProRSDet Our current approach 97.66 ESET NOD32 https://www.eset.com 66.68 AegisLab www.aegislab.com 66.23 NANO antivirus http://www.nanoav.ru 66.23 VIPRE https://www.vipre.com 62.53 McAfee https://www.mcafee.com 56.21 Gym-plus

TABLE VIII NUMBERS

 VIII OF RELEVANT AND AMBIGUOUS GENERATED MALICIOUS MOTIFS.

	Number of generated motifs in ProRSDet
	Possible instances	Certain instances
	False motifs Approved motifs
	92 689	105 833	269 478

https://thezoo.morirt.com/

https://www.virustotal.com/gui/home/upload 2 https://www.cs.waikato.ac.nz/ml/weka/

These effective created detection rules, in turn, attempt their hardest to detect the second layer's set of fraudulent patterns.

ProRSDet outperformed a variety of state-of-the-art approaches and commercial engines, achieving encouraging detection rates of 97.66% accuracy and 2.69% false positives. We plan to investigate other methods to help determine the best values of α and β concerning the VPRS. It would be interesting to design an adaptive parameter tuning strategy that aims to approximate the best values of the VPRS parameters. Also, we can consider other theories that deal with the inconsistency in the future (i.e., [34], [35]), as well as consider expanding the scope of the proposed work to encompass other operating systems.


Zaineb Chelly Dagdia
email: zaineb.chelly-dagdia@uvsq.fr

Vania Bogorny
email: vania.bogorny@ufsc.br

Towards a Granular Computing Framework for Multiple Aspect Trajectory Representation and Privacy Preservation: Research Challenges and Opportunities

Towards a Granular Computing Framework for Multiple

Aspect Trajectory Representation and

I. INTRODUCTION AND MOTIVATION

T ODAY, we are living the era of movement monitoring and mining where large volumes of mobility data are being captured about our everyday lives and routines. The collected data is characterized not only but its volume and velocity but also by its heterogeneity (variety) and uncertainty, and most importantly by its sensitive aspect. The collection and enrichment of this tremendous amount of mobility data with information from several sources is made possible by the popularization and frequent use of mobile devices [START_REF] Kucharski | Use of fuzzy cognitive maps for enhanced interaction with multiple mobile devices[END_REF], applications, sensors, internet channels, social networks, among many other services and instruments.

For instance, via the use of social networks such as Facebook and Twitter and navigation applications such as Google Maps, detailed information about our routines can be collected including the places that we have visited, the time that we have spent at each visited place, our emotions at a specific time and place, our means of transportation, etc. These are referred to This work has received funding from the European Commission's Horizon 2020 research and innovation programme under the Marie Sklodowska-Curie grant agreement N. 777695.

as "semantic trajectories" which are characterized by their different aspects or dimensions, and their complex nature [START_REF] Bogorny | Constant-a conceptual data model for semantic trajectories of moving objects[END_REF]. With this explosion of enriched trajectory data, emerged the problem of data privacy. The more information that is linked to mobility data, the more sensitive is the user privacy. Therefore, it became critical and essential to protect users' privacy.

When it comes to trajectory representation, the same semantic trajectory can be represented with respect to different aspects [START_REF] Bogorny | Constant-a conceptual data model for semantic trajectories of moving objects[END_REF]. As an example, a raw trajectory can be represented as a sequence of stops and moves, or as a sequence of transportation means, or as a sequence of weather conditions, of activities performed during the movement, and so on. This led to the "Multiple Aspect Trajectory" (MAT) concept.

Multiple aspect trajectory representation is a hot topic and it is very recently that the MASTER model was proposed in [START_REF] Mello | Master: A multiple aspect view on trajectories[END_REF]. The MASTER model allows the representation of the trajectory with space, time and several aspects, any of which might violate the user privacy. Therefore, there is a need to consider a novel structure that permits the representation of multiple aspect trajectories while considering privacy preservation.

The aim of this paper is to highlight the perspectives of applying Granular Computing (GrC) formal settings (e.g., rough set theory, rough set theory, set theory, etc.) to multiple aspect trajectory representation. We present a representation based on granular computation that we named GrC -M AT . The paper, also, presents the important aspects of granular computation that can be considered for privacy preservation. It is to be noted that the objective of this paper is not to make a survey of the state-of-art methods that deal with MAT representation and privacy preservation, nor to discuss their limitations.

The rest of the paper is organized as follows: Section II introduces the main concepts and fundamentals of multiple aspects trajectories and granular computation. Section III highlights the representation of multiple aspect trajectory. Section IV, introduces the proposed granular computing framework, GrC -M AT , for multiple aspect trajectory representation as well as covering its evolving aspect. In Section V, we discuss our vision of the future research challenges and opportunities in multiple aspect trajectory representation and privacy preservation from a granular computing perspective. Finally, Section VI concludes the paper.

II. BACKGROUND

In this section, we introduce the main concepts and fundamentals of multiple aspects trajectories and granular computation.

A. Trajectory data models

When an individual or an object is moving, his/her/its location data is collected over time via mobile devices or applications or any other collection instruments. This data is in the form of a sequential spatiotemporal points, called raw trajectory, and is denoted as Seq =< p 1 , p 2 , . . . , p n >, where each p i = (x i , y i , t i ), with p i ∈ Seq, x i and y i are the spatial position of the moving individual/object in space at a specific time frame t i .

Several data models have been presented in the last decade to represent and augment trajectories with semantic information. These can be categorized into three main time frames. For instance, the work proposed in [START_REF] Hornsby | Modeling moving geospatial objects from an event-based perspective[END_REF] initiated trajectory modelling via the use of sequences of events in space and over a specific time window. These are typically raw trajectories which represent the first category of trajectory data models, and are the simplest. Later on, and during the period of 2008 and 2018 which is characterized by the explosion of social networks and navigation applications, works have been around enriching trajectories with semantic information. In this concern, in [START_REF] Spaccapietra | A conceptual view on trajectories[END_REF], authors proposed the integration of geographic information while distinguishing stops and moves. The segments of a trajectory where the moving individual/object has stayed for a minimal amount of time define the stops, whereas the movement between stops define the moves. In this work, semantic trajectories can have each stop linked to Points of Interest (POI), which are usually a place name, reflecting semantic information; which are added as a third dimension to space and time. In 2014, a semantic trajectory data model called CONSTANT was proposed in [START_REF] Bogorny | Constant-a conceptual data model for semantic trajectories of moving objects[END_REF]. The model associates the moving individual/object trajectories to a set of other information such as the visited POIs, the activities performed at a specific POI, and the transportation means. Also, within this second category, the BAQUARA framework was proposed in [START_REF] Fileto | The baquara2 knowledge-based framework for semantic enrichment and analysis of movement data[END_REF]. The semantic model enriches trajectories with ontologies and linked open data.

Very recently, in [START_REF] Mello | Master: A multiple aspect view on trajectories[END_REF] and within the third category, authors introduced the MASTER model, which introduces the multiple aspect trajectory concept. Multiple aspect trajectories can be defined as the enhancement of the basic view of semantic trajectories with the notion of multiple heterogeneous aspects, characterizing different semantic dimensions related to the pure movement data. MASTER allows the augmentation of trajectories with any type of information, dubbed aspects. The model addresses the issue raised by [START_REF] Ferrero | Multiple aspect trajectory data analysis: research challenges and opportunities[END_REF], in which different aspects were taken into account independently. The model permits the representation of a trajectory in terms of space, time, and a variety of other aspects. Figure 1 depicts a multiple aspect trajectory with aspects that differ along the trajectory, as defined by [START_REF] Mello | Master: A multiple aspect view on trajectories[END_REF].

As shown in Figure 1, the trajectory contains a wealth of information, aspects, about the moving individual, including:

(1) the heart rate and the sleeping stage which are collected by a smartwatch, at home, from 11pm to 8am; (2) the humor is provided by a tweet when the individual walks to work;

(3) the environmental information such as noise, temperature, and pollution are collected by sensors at a smart office; and (4) from 6:30pm to 9pm, the characteristics of the places visited by the individual, such as price, reviews, and open-close hours of a restaurant are collected as well [START_REF] Portela | Trajectory data privacy: Research challenges and opportunities[END_REF].

This recent category of trajectory displays a person's very precise daily routine in depth than earlier models, while revealing lots of sensitive information. Hence, raising privacy concerns.

B. Granular computing models

Granular Computing (GrC) [START_REF] Pedrycz | Handbook of granular computing[END_REF] is an emerging information processing computing paradigm that focuses on representing and processing complex entities, known as "granules", which are produced from the process of data abstraction and knowledge extraction from information or data. The roots of GrC can be traced back to the works of Zadeh [START_REF] Zadeh | Toward a theory of fuzzy information granulation and its centrality in human reasoning and fuzzy logic[END_REF] defining a granule as a clump of points (objects) drawn together by indistinguishability or indiscernibility, similarity, proximity, or functionality.

Granules can be decomposed into a set of smaller and finer granules which are known as "subgranules". Levels, hierarchies, and granular structures can all be used to organize granules and subgranules. Granulation is a procedure or a process which is needed for constructing or decomposing granules. In [START_REF] Pedrycz | Granular computing: analysis and design of intelligent systems[END_REF], author provides a comprehensive overview of the unified principals of granular computing along with its comprehensive algorithm framework and design practices.

The origins of the granular computing ideology are to be found in the rough sets and fuzzy sets literature [START_REF] Wang | Rough sets, fuzzy sets, data mining, and granular computing[END_REF], [START_REF] Pawlak | Granularity of knowledge, indiscernibility and rough sets[END_REF], but they can also be found in some other formal settings for GrC such as interval calculus, set theory, shadowing sets, and probabilistic granules [START_REF] Pedrycz | Handbook of granular computing[END_REF]. The concept of granules and granulation are defined differently in each of these settings, and the work of [START_REF] Dubois | Bridging gaps between several forms of granular computing[END_REF] offers a preliminary way to uncover commonality and bridge the gap across these settings.

All of these formal settings, allow, in general, the formation of granular structures. Space and temporal aspects are naturally represented via multi-level structures in which high-level granules reflect more abstract notions and low-level granules represent more particular and more specific concepts. Such granular structures are critical to our predefined goals. GrC is based on a large set of interactions and relationships as defined in [START_REF] Yao | A triarchic theory of granular computing[END_REF]. These may be used to organize granules in several structures such as hierarchies, trees, and networks. A granule g is a refinement of G (or G is a coarsening of g), denoted by g ⪯ G, if all of g's data or subgranules are contained in some subgranules of G. When just some data or subgranules of g are contained in some subgranules of G, refinement (coarsening) can be partial, and is denoted as g ⊑ G.

Structuring and forming the granules in the correct and most appropriate manner is an open research question that has been inspected by numerous researchers and is rather dependent on the application's requirements. The principle of justified granularity was developed in [START_REF] Pedrycz | Building the fundamentals of granular computing: A principle of justifiable granularity[END_REF], [START_REF] Pedrycz | Clustering in augmented space of granular constraints: a study in knowledge-based clustering[END_REF] as a way to evaluate the performance of informational granules. The principle of justified granularity is based on a tradeoff between the coverage and specificity measures, which do not exclusively depend on the application. Formally, coverage refers to the ability to cover data, while specificity refers to the granule prototype's level of abstraction as measured by its size. The proper expression of these two measures is dependent on the nature of the set formed.

For crisp sets, a measure of coverage may be Cov(P ) = 1 N card{X k |x k ∈ P }, but for fuzzy sets, the sum of the degree of memberships of the elements can be used Cov(P ) = 1 N N k=1 µ p (X k ). Cov(P ) should, ideally, be equal to 1, indicating that the prototype covers all data. The intervals must be as narrow (specific) as feasible to achieve specificity. An interval's specificity can be assessed in a variety of ways. A specificity measure must meet two criteria: it must achieve a maximum value for a single element, and the larger the interval, the lower the specificity measure. The two concepts of coverage and specificity are at odds. To visualize their relationship, consider arranging them in the form of a coverage-specificity plot, which may also be parameterized, and calculating the area under the curve to derive a global measure of quality.

Another criterion for granule design is the principal of uncertainty level preservation as defined in [START_REF] Livi | Data granulation by the principles of uncertainty[END_REF], [START_REF]Granular computing, computational intelligence, and the analysis of non-geometric input spaces[END_REF], which is primarily concerned with assessing the quality of the granulation itself. This principle considers the quantification of uncertainty as an invariant property to be retained during the granulation process by considering information granulation as a mapping between some input and output. The discrepancy between the input and output entropy is considered as an error that must be decreased in order to achieve optimal information granulation [START_REF] D'aniello | A granular computing framework for approximate reasoning in situation awareness[END_REF].

III. MULTIPLE ASPECT TRAJECTORY REPRESENTATION

In this Section, we replicate the example given in [START_REF] Ferrero | Multiple aspect trajectory data analysis: research challenges and opportunities[END_REF], illustrated in Figure 2, to show the challenge in representing multiple aspect trajectories.

Figure 2 shows three trajectories, P , Q, and R, which are represented using four different aspects: (1) as raw trajectories (Figure 2 If every aspect is considered separately, and by considering only the space and semantic dimensions, excluding time for simplification, the three trajectories would be analyzed as follows:

• If Aspect = raw trajectory then P and Q are spatially closer than P and R or Q and R. • If Aspect = stops then P and Q are the most similar.

• If Aspect = transportation means then P and R are the most similar. • If Aspect = weather condition then Q and R are the most similar. Two issues can be reported from the standpoint of similarity analysis: (1) the trajectories must consider multiple aspects, such as raw data, stops, transportation means, activities, weather conditions, and others; (2) existing similarity measures only consider a single representation (aspect). Now from a mining view point, the following important issue can be reported: multiple aspect trajectory data analysis can lead to new types of trajectory patterns that cannot be detected so far by existing data mining methods. More details about the illustration of these issues via examples can be found in [START_REF] Ferrero | Multiple aspect trajectory data analysis: research challenges and opportunities[END_REF]. Now in terms of representation, one would wonder why not simply combine all relevant data into a single trajectory representation. When evaluating the stops representation, for example, one may claim that it is straightforward to enrich the trajectory with all relevant information such as weather, transportation means, activities, and so on. The issue is not as straightforward as it appears.

Let us assume the moving individual is walking and the weather changes from sunny to rainy during one stop. In the activity aspect, the moving individual changed his/her activity from meeting to coaching when the weather is rainy. All of these changes happen at a single stop (POI); labelled office.

It would be very hard to correctly split and annotate the stop into two weather conditions, each one having a different start and end time, splitting it in different activities [START_REF] Ferrero | Multiple aspect trajectory data analysis: research challenges and opportunities[END_REF]. The same stop would have multiple semantic labels for weather, transportation modes, stop names, activity names, and so on, as well as multiple time intervals associated with each semantic label, such as the start and end times of a stop, the duration of a transportation mode, the distance traveled by one transportation mode, and possibly different space information [START_REF] Ferrero | Multiple aspect trajectory data analysis: research challenges and opportunities[END_REF].

As it can be noted, the issues reported from the standpoint of similarity analysis and from a mining view point, are connected to the challenges linked to the multiple aspect trajectory representation. This leads to the ultimate challenge of how to efficiently represent trajectories with all this information while offering an appropriate why to conduct similarity analysis and mining tasks.

IV. A GRANULAR COMPUTING FRAMEWORK FOR MULTIPLE ASPECT TRAJECTORY REPRESENTATION

The concept of "multiple aspect" trajectories can be modeled using the hierarchical structure of granular computing. Data granules are formal entities that aid in the organization of data and relationship knowledge. The use of data granules to represent the different aspects of MAT and the characteristics of each aspect can help to detect hidden patterns, as well as increase the logicality, systematicity, and efficiency of decision-making [START_REF] Zhou | Periodic pattern detection algorithms for personal trajectory data based on spatiotemporal multi-granularity[END_REF], [START_REF] Cabrerizo | Improving consensus in group decision making with intuitionistic reciprocal preference relations: A granular computing approach[END_REF] In this section, we present a tentative representation of multiple aspect trajectory using granular computation, called GrC -M AT . In this representation, we consider that every aspect (or dimension) can be seen as a granule, and each granule can be, in its turn, represented using sub-granules. All of these granules are connected between each other to ensure an overall representation of the multiple aspect trajectory.

A. Definitions

Introducing GrC into multiple aspect trajectory generates the following related concepts:

Definition 1 (MAT Data Granule): Multiple aspect trajectory data granule, denoted as M at -Gr, refers to a mobility data chunk defined via a set of mobility data elements drawn together by space, time, proximity, or indistinguishability [START_REF] Zadeh | Some reflections on soft computing, granular computing and their roles in the conception, design and utilization of information/intelligent systems[END_REF].

Definition 2 (MAT Data Granulation): Multiple aspect trajectory data granulation refers to the process that partitions the mobility rich data into fine grained and semantically clear mobility data granules with respect to a set of criteria which are associated with spatial and temporal scale features together with other considered aspects.

Definition 3 (MAT Data Granular Layer): Multiple aspect trajectory data granular layer, denoted as M at -Lay, is composed of a set of mobility data granules with respect to a certain set of granulation criteria.

Definition 4 (MAT Data Granular Structure): Multiple aspect trajectory data granular structure, denoted as M at-GrS, refers to the relational structure generated by the links between several mobility data granules corresponding to various granulation criteria.

Definition 5 (MAT Granular Computing): Multiple aspect trajectory granular computing refers to the process that uses mobility data granules to describe, analyze, and solve multiple aspect trajectory data mining problems from different scales and perspectives.

B. A granular representation of multiple aspect trajectories: a tentative representation

Multiple aspect trajectory data granule is a complete entity with multiple dimensions, such as space, time, weather, transportation means, emotion status, and activity. As all of these dimensions are related to the spatial and temporal scales, then the granular representation of multiple aspect trajectories should consider the spatiotemporal aspect. This can be guaranteed by integrating the time and space dimensions, as attributes of data granules, into a single systematic model.

Figure 3 represents the multiple aspect trajectory data granule structure. Every considered data granule M at -Gr is represented via a layer M at-Lay l , where l ∈ {1, . . . , L}, and L is the maximum number of layers for the different considered dimensions. With respect to this structure, every M at -Gr can be defined in different scales; denoted as M at -Gr l . The data granules in each upper scale M at -Gr l are transformed into those in the lower scale M at -Gr l+1 using a granulation criteria (rule) GCr i , where i ∈ {1, . . . , L -1}. The data granules decrease (increase) as the scale decreases (increases). A correlation, representing the connection between the different aspects of the multiple aspect trajectory, is reflected by the different edges between the various M at-Gr l . All M at-Gr l are connected between each other as well as between their corresponding granules. For a simplified view, in Figure 3, only few edge are represented.

Example 4.1 (Example of a granular representation of a multiple aspect trajectory): Let us suppose that during one stop the object is moving on foot and the weather condition changes from Sunny to Rainy. Figure 4 represents a simplified view of a type-2 granular structure of such representation. The edges represent the different correlations between the different granules; i.e., temporal-spacial, temporal-activity, spaceweather, . . . , and space-temporal-weather-activity.

With respect to this granular structure, we can define the following roots:

• At POI, Weather = "Sunny" during "Start-time" and "Endtime", and Activity = "Foot" Fig. 3. A granular representation of multiple aspect trajectories (inspired by [START_REF] Yunxian | Correction: Measuring multi-spatiotemporal scale tourist destination popularity based on text granular computing[END_REF]) Fig. 4. Example of a granular representation of a multiple aspect trajectory

• At POI, Weather = "Rainy" during "Start-time" and "Endtime", and Activity = "Foot" With respect to the need of representing different aspects at a time, sub-granular structures can be extracted from Figure 3. This is to achieve landscape law mining at a specific scale for different granules.

Example 4.2 (Example of reasoning):

The "Weather" granule can be considered as a "localized or a particular view or aspect" of the MAT presented in Figure 4. "Sunny" and "Rainy" are examples of granules of the sub-layer (M at -Lay 2 ) of the "Weather" granular layer (M at -Lay 1 ). Data granules in M at -Lay 2 , for instance, can be viewed as an "information table", with a binary values representation, and different granules can be further generated from it. For example, if we consider "Rough Set Theory" as a GrC theory, we can generate three disjoint regions (granules) by applying the "lower approximation" and "upper approximation"; namely, the ''positive region" which comprises those data objects certainly related with the decision class, the "negative region" which comprises those objects certainly not related with the decision class, and the "boundary region" which comprises those objects possibly related with the decision class. The connections and relationships between the granules may be interpreted by the rough set "dependency degree". All granules of the different granular layers provide a collective description of the MAT.

C. An evolving granular representation

So far we have created a hierarchical granular structure resembling the hierarchies existing between the different aspects that can be considered in multiple aspect trajectories. To accommodate other aspects that can be further considered in multiple aspect trajectories, either in M at -Gr or/and in M at -Lay l , we can leverage on the concept of evolvable granules [START_REF] Antonelli | Multiobjective evolutionary design of granular rule-based classifiers[END_REF], [START_REF] Pedrycz | Evolvable fuzzy systems: some insights and challenges[END_REF].

In [START_REF] Pedrycz | Evolvable fuzzy systems: some insights and challenges[END_REF], the behavior of evolving granules is reported via Figure 5, and explained as follows, when considering only time and space: the time window shows different objects registered by sensors in three time slices, t, 2t, and 3t. The top of the figure shows three granular structures, where granules denote the position of the objects in the space dimension. During time = t, singleton granular structures are created comprising {a}, {b} and {c}. During time = 2t, two additional objects, {d} and {e}, are recognized and merged with the existing granules to form higher level granules {a, d}, {b, e}, and {c}. This process continues to iterate in the next time windows, and, as output, granular structures evolve with granules that can be either merged, split, removed or new granules formed. In [START_REF] Pedrycz | Evolvable fuzzy systems: some insights and challenges[END_REF], a complete formalism to deal with splitting and merging criteria in the case of granules created with Fuzzy c-means can be found.

To accommodate other aspects in M at -Gr or/and M ay -Lay l , we should reason on the evolution of granular structures. To do so, the transitions between M ay -Lay l and M ay -Lay l+1 should be considered with respect to the applied granulation criteria GCr i . This can be achieved depending on Fig. 5. Behavior of evolving granules by granulating time and space [START_REF] D'aniello | A granular computing framework for approximate reasoning in situation awareness[END_REF] previous knowledge about the rules (GCr i ) that govern the evolution of phenomena under observations and/or the actions that can enable situations transitions.

V. RESEARCH CHALLENGES AND OPPORTUNITIES

In [START_REF] Ferrero | Multiple aspect trajectory data analysis: research challenges and opportunities[END_REF], authors presented a set of challenges and opportunities tied to multiple aspect trajectory data analysis. These include multiple aspect representation, feature extraction, data storage, similarity analysis and data mining, visualization, and privacy protection. The later challenge was further detailed in [START_REF] Portela | Trajectory data privacy: Research challenges and opportunities[END_REF] where authors presented a survey of the state-of-theart trajectory anonymization methods for privacy preservation, together with a description of a set of challenges for anonymizing multiple aspect trajectories. Therefore, in this section, we mainly focus on presenting the main challenges tied to multiple aspect trajectory representation and privacy preservation from a granular computing perspective.

Representing multiple aspect trajectories reveals many challenges when it comes to defining the concrete structure and connections, between the different considered aspects. Among these challenges, we mention the uncertainty and the imprecision that can be found in mobility data. Let us consider a basic scenario in which people wander around a city and reveal their locations twice an hour. To avoid stalking, the disclosed location is chosen at random from within a one-kilometer radius circle that contains the user's location. Not being conscious of uncertainty may lead to erroneous deductions. For example, we could mistakenly believe that a group of individuals have met or that someone has stayed at a a privacy-sensitive location. If we take uncertainty in account, such erroneous conclusions can be avoided. For instance, if an individual was more than one kilometer away from the location of an accident, we may safely assume that that individual was not involved in that accident [START_REF] Silvestri | Mobility and Uncertainty[END_REF].

By considering a granular computing representation, our GrC -M AT model car efficiently handle such type of uncertainty in mobility data. Settings related to GrC implementation, including fuzzy sets, rough sets, and inclusion degree theory, contain all the results of uncertain reasoning (e.g., inclusion degree [START_REF] Xu | Granular computing methods and applications based on inclusion degree[END_REF] based on conditional probability as is a form of uncertain reasoning).

A resulting challenge from the above is how to formally define the granular computing model based on the formal setting used to implement GrC. Now from a building point of view, the definition of the granules, the construction of the granule layers in an optimized way using the granulation criteria -which also needs to be defined-, the definition of the edges between the different granules as well as the strength (degree) of these edges, present all major challenges. Now when it comes to the privacy preservation challenge, the hierarchical or tree or network structure adopted to build the GrC -M AT model can be use to hide sensitive/private information. This can be achieved by several means such as moving from a granular layer to another to avoid specificity and ensure generality and vice-versa, by ignoring/not reporting some edges (correlations) connecting the different granules, or by switching a granule by another. Also, the fact of using the fundamentals of the GrC theories to report some granules instead of the actual granules that need to be reported can deal with the privacy issues. For instance, when referring rough set theory, we can report the "boundary region", as a granule, comprising those objects possibly related with the decision class, instead of reporting the ''positive region" which comprises those data objects certainly related with the decision class or instead of the "negative region" which comprises those objects certainly not related with the decision class. The challenge, in this concern, is to formally study the feasibility of these assumptions.

The GrC structure can still lead to a privacy leak as the deductive route from non-sensitive to sensitive features can be mined; which is another challenge to be considered. The sensitive features can be defined as the set of features that should be hidden using algorithms in such a way that they cannot be reasonably approximated using the set of nonsensitive features. This is quite a challenge since the nonsensitive features may contain concepts on which sensitive features inferentially depend; these are known as "quasiidentifiers". To cut the deductive route to any potential privacy leak, these quasi-identifiers must be appropriately hidden. However, they must be uncovered first. In this concern, rough set theory as a GrC example, seemed to be one among the right tools to be used to undermine the deductive route from non-sensitive to sensitive features by modelling and analyzing the dependency "non-sensitive -→ sensitive" [START_REF] Bishop | Relationships and data sanitization: A study in scarlet[END_REF]. Rough set theory provides numerical quantities that measure the degree of dependency of attributes. This study was presented in [START_REF] Soh | Learning quasiidentifiers for privacy-preserving exchanges: A rough set theory approach[END_REF], where authors have learned the quasi-identifiers, computed a granulation of the information system that maximizes the distribution of sensitive features in each granule, and masked the deductive route from non-sensitive to sensitive attributes. This rises the challenge of how to undermine this deductive route within a multiple aspect scenario. It would be also interesting to investigate this challenge when coupling it with the evolving structure of the GrC model.

Another challenge is how to defined similarity in multiple aspect trajectories based on granular computation. As previously mentioned, in the era of big data, large amounts of semantically rich mobility data became available. This called for the need for new trajectory similarity metrics in the context of multiple-aspect trajectories. Existing techniques have several constraints concerning the links between characteristics and their semantics. These techniques are too rigid, demanding a match on all features, or too lenient, treating all features as unrelated. Granular computing formal settings can be used to represent the appropriate dependencies between the features and hence new similarity measures dedicated to multiple aspect trajectories can be defined.

Granular computing methods offer plenty of opportunities to handle the challenges tied to multiple aspect trajectory representation and privacy preservation. This will present a considerable addendum to the mobility data management, analytic and privacy communities and fields.

VI. CONCLUSION

In this paper, we presented a granular computing view for multiple aspect trajectory representation. Such representation will allow a more natural, a flexible, and a complete representation of multiple aspect trajectories. Additionally, by using the fundamentals of some granular formal settings such as fuzzy sets and rough sets, there are several opportunities and possibilities to deal with the privacy aspect and hence, ensure multiple aspect trajectory privacy preservation.

From a practical and applied perspectives, the potential advantages of this GrC -M AT approach can be reflected by the following aspects: (i) a good semantic scalability ensured by data granularization based on the extendable granulation criteria which cover not only the spatiotemporal scales but also the other aspects of mobility data with clear semantics; (ii) the adaptation to vertical dynamic changes in the data. This implies when introducing modifications to granular layers. This dynamic adaptation is ensured by the independency of the granulation criteria of each layer, which implies that the only required change will be the update of the granulation criteria between the affected adjacent granular layers; hence, not affecting other granular layers; and last but not least (iii) the adaptation to horizontal dynamic changes in the data. The granular structure of the GrC -M AT model allows dynamic incremental data expansion in a specific granular layer without affecting other adjacent layers. As previously mentioned, granular computing will present a considerable addendum to the mobility data management, mobility data mining, analytic and privacy communities and fields.

As future works, we will focus on the discussed challenges of the multiple aspect trajectory representation and privacy preservation from a granular computing perspective, to find efficient approaches that handle all these aspects.

Fig. 1 .

 1 Fig. 1. Example of a multiple aspect trajectory as defined in [3].

Fig. 2 .

 2 Fig.2. Multiple trajectory representation[START_REF] Ferrero | Multiple aspect trajectory data analysis: research challenges and opportunities[END_REF]

  (a)); (2) as stops and moves (Figure 2(b)), where the labeled parts are the stops; (3) as transportation means (Figure 2(c)); and (4) according to weather conditions (Figure 2(d)).

ACKNOWLEDGMENT

This work has received funding from the European Commission's Horizon 2020 research and innovation programme under the Marie Sklodowska-Curie grant agreement N. 777695.