Chiara Fulgenzi

Christopher Tay

Anne Spalanzani

Christian Laugier

Probabilistic navigation in dynamic environment using Rapidly-exploring Random Trees and Gaussian Processes

The paper describes a navigation algorithm for dynamic, uncertain environment. Moving obstacles are supposed to move on typical patterns which are pre-learned and are represented by Gaussian processes. The planning algorithm is based on an extension of the Rapidly-exploring Random Tree algorithm, where the likelihood of the obstacles trajectory and the probability of collision is explicitly taken into account. The algorithm is used in a partial motion planner, and the probability of collision is updated in real-time according to the most recent estimation. Results show the performance of the navigation algorithm for a car-like robot moving among dynamic obstacles with probabilistic trajectory prediction.

I. INTRODUCTION

Autonomous navigation in populated environments represents still an important challenge for robotics research. The key of the problem is to guarantee safety for all the agents (people, vehicles and the robot itself) moving in the space. In contrast with static or controlled environments, where path planning techniques are suitable [START_REF] Latombe | Robot Motion Planning[END_REF] [START_REF] Lavalle | Planning Algorithms[END_REF], high dynamic environments present many difficult issues: the detection and tracking of the moving obstacles, the prediction of the future state of the world and the on-line motion planning and navigation. The decision about motion must be related with the on-line perception of the world and take into account all the sources of uncertainty involved:

1) The limits of the perception system: occluded zones, limited range, accuracy and sensibility, sensor faults; 2) The future behaviour of the moving agents: model error, unexpected changes of motion direction and velocity; 3) New agents entering the workspace; 4) Errors of the execution system. Many real world applications rely on reactive strategies: the robot decides only about its immediate action with respect to the updated local estimation of the environment [START_REF] Borenstein | The vector field histogram -fastobstacle avoidance for mobile robot[END_REF]- [START_REF] Fox | The dynamic window approach to collision avoidance[END_REF]. These strategies present however some major drawback: first of all the robot can be stuck in local minima; secondly, most of the developed approaches do not take into account the dynamic nature of the environment and the uncertainty of perception, so that the robot can be driven in dangerous or blocking situations. To face these problems, reactive techniques are combined with global planning methods: a complete plan from present Fulgenzi Chiara is supported by a grant from the European Community under the Marie-Curie project VISITOR MEST-CT-2004-008270 state to goal state is computed on the basis of the a priori information; during execution, the reactive algorithm adapts the trajectory in order to avoid moving and unexpected obstacles [START_REF] Quinlan | Elastic bands: connecting path planning and control[END_REF]- [START_REF] Large | Navigation autonome d'un robot mobile en environnement dynamique et incertain[END_REF]. If the perception invalidates the planned path replanning is performed. In all the cited methods however, uncertainty is not taken into account. From the more theoretical point of view instead, many works handle a non-deterministic or probabilistic representation of the information and the planning under uncertainty problem is solved using Markov Decision Processes (MDP), Partially Observable MDPs or game theory [START_REF] Simmons | Probabilistic robot navigation in partially observable environments[END_REF]- [START_REF] Foka | Real-time hierarchical pomdps for autonomous robot navigation[END_REF]. For an overview see [START_REF] Lavalle | Planning Algorithms[END_REF]. These approaches are however very expensive from the computational point of view, and are limited to low dimensional problems and to off-line planning. Some recent work proposes to integrate uncertainty in randomised techniques, such as Probabilistic Road Maps [START_REF] Missiuro | Adapting probabilistic roadmaps to handle uncertain maps[END_REF] and Rapidlyexploring Random Trees (RRT) [START_REF] Benenson | Integrating perception and planning for autonomous navigation of urban vehicles[END_REF] [START_REF] Melchior | Particle rrt for path planning with uncertainty[END_REF]. In this paper we address the problem of taking explicitly into account the behaviour of the obstacles, and the uncertainty in sensing and in prediction. We want our navigation algorithm to integrate new information coming from the acquisition system and to be able to react to the changes of the environment. We propose then a novel extension of the RRT algorithm to handle a probabilistic representation of the static environment and of the moving obstacles prediction. The search algorithm is then integrated in a navigation algorithm which updates the probabilistic information and chooses the best partial path on the searched tree. The navigation algorithm is based on the architecture of Partial Motion Planning (PMP, [START_REF] Petti | Safe motion planning in dynamic environments[END_REF]), where execution and local planning work in parallel to assure safe behaviour. In particular, we consider the case of a robot equipped with a distance sensor which models the static environment in an occupancy grid. The moving obstacles follow typical patterns with some amount of uncertainty: these patterns are a priori known and represented with Gaussian Processes (GP). The moving obstacles are detected and tracked on-line and the prediction of their future position is computed on the base of the known typical paths. The reminder of this paper is structured as follows: first the way the trajectories are represented and predicted by Gaussian Processes is described in Section II. Section III recalls the RRT basic algorithm and details the new proposed approach. Section IV recalls the PMP method and describes the planning and navigation algorithm developed. Results are presented in Section V: an experiment with a laser scan dataset with moving pedestrians is presented in V-A and results in a simulated environment are shown in V-B. Section VI ends the paper with remarks and ideas for future work.

II. GAUSSIAN PROCESSES FOR PATTERN MODELLING

We consider an environment in which moving objects do not move around randomly, but follow typical patterns. This is a well suited hypothesis in many typical scenarios, as cars in a traffic cross junction or people in a transit area.

Most existing models for modelling motion patterns require the discretization of the state space [START_REF] Th | Intentional motion on-line learning and prediction[END_REF]- [START_REF] Hu | A system for learning statistical motion patterns[END_REF]. These approaches mostly model motion trajectories as transitions between discretized states. The main disadvantage of discretization is the need to determine the discretization of the state spaces and the association of observations to these discretized state spaces.

In this paper, a path modelling approach based on Gaussian processes [START_REF] Rasmussen | Gaussian Processes for Machine Learning[END_REF] is used. Gaussian processes make it possible to represent paths as continuous functions in a probabilistic manner. The problem of discretization is conveniently side stepped. Prediction on the future path can be performed in a theoretically proper probabilistic framework.

The advantage of using a Gaussian process to model a paths is its ability to give a Gaussian probability distribution over paths. Figure 1(a) shows an example of a hypothetical path exemplar. We call a path exemplar a certain motion path pattern in workspace. The lines represent sample paths from the Gaussian process distribution. A Gaussian process for an exemplar path incorporates the representation of variations around its mean path. We suppose that path exemplars can be represented as a Gaussian. With a Gaussian distribution over a path exemplar, it is possible to obtain a mean and variance for possible future path motions.

A. Pattern Learning and Prediction

We consider the problem of learning a set of typical paths in a certain scene. In our approach, a training data set consists of motions executed by moving objects in the scene. An unsupervised learning approach is then applied to discover automatically the number of typical exemplar paths, along with a probabilistic description of the variations within each exemplar path.

As mentioned previously, an exemplar path can be represented using a Gaussian process and variations of paths belonging to the sample exemplar are Gaussian distributed. However, in realistic environments, there are often several exemplar paths. We model environments with several exemplars using a mixture of Gaussian processes. The training data can be viewed as realizations of the mixture of Gaussian process generative model and the aim of learning will be to recover the parameters of the mixture model.

Section II-B will give a short introduction to Gaussian processes, followed by a description of the probabilistic model for representing a single exemplar path (sect. II-C) and for situations involving several exemplar paths (sect. II-D). More information can be found in [START_REF] Tay | Modelling paths using gaussian processes[END_REF].

B. Gaussian Process

A gaussian process is a generalization of the gaussian probability distribution in function space. Given the set of gaussian distributed random variables {f (x 1 ), f (x 2 ), ..., f (x N )}, it can be represented mathematically using the mean function and covariance function [START_REF] Rasmussen | Gaussian Processes for Machine Learning[END_REF]:

f (x) ∼ G(m(x), k(x, x ′ )) (1) m(x) = E[f (x)] (2) k(x, x ′ ) = E[(f (x) -m(x))(f (x ′ ) -m(x ′ ))] (3)
Where G(µ, Σ) represents a Gaussian distribution with mean µ and covariance Σ. k(x, x ′ ) is the covariance function with domains from the input space. A pertinent property of the covariance function is that it has to be positive semidefinite. In this paper, the squared exponential covariance function is adopted:

k(x, x ′ ) = θ 2 0 exp- (x -x ′ ) 2 θ 2 1 + θ 2 2 δ(x -x ′ ) (4)
Where δ() is the Dirac delta function. The chosen covariance function is stationary since it is a function of the difference, xx ′ . Thus, covariance of paths are assumed to be the same throughout the input space. Θ = {θ 0 , θ 1 , θ 2 } are parameters for the covariance function, also known as the hyperparameters for the Gaussian process. The hyperparameters influence the form of the Gaussian process. Intuitively, the hyperparameters set a characteristic length scale for the Gaussian process covariance function and this length scale can be viewed as how much the difference xx ′ in input space has to be before there is a "significant" change in f (x)f (x ′ ). A short characteristic length scale gives a highly fluctuating Gaussian process whereas a longer length scale gives lower fluctuations.

C. Representing a typical path using Gaussian Process

We assume that the observation of paths belonging to an exemplar path are generated by a Gaussian process. Each path corresponds to a typical path that an object takes in a given environment and is represented with 2 Gaussian processes, one each to represent the path in x and y axes as we assume the movements in the x and y axes to be independent. The mean of these Gaussian processes is the mean function (in the x and y axes each) representing the path. A single observation of a path is represented as two vectors of dimension D, where Dis the number of positions observed along the path. One vector represents the sequence of positions along the cartesian x axis and the other for the corresponding sequence in the y axis. The likelihood based on the N training data where each data is a sequence (x n , y n ) is then:

L x = N n=1 G(x n |µ x , Σ x ) (5)
L y = N n=1 G(y n |µ y , Σ y ) (6)
Where x n and y n are vectors of x and y positions for the n th observation. µ x , µ y , Σ x and Σ y are the mean vectors and covariances of the x and y positions for the typical path.

In almost all cases, the sequence of observations of positions are of different length for different path observations. In this case, a fixed dimension D can be chosen and the D positions can be obtained by choosing D points uniformly distributed along the interpolated path.

D. Multiple Typical Trajectories using Gaussian Mixture Model

Since each observed path corresponds to two D dimensional vectors and that a typical motion path is Gaussian distributed, the observed paths are Gaussian distributed from the generative point of view. A single typical motion path is a D dimensional Gaussian distribution and this can be easily extended to the case of representing several typical motion paths using a mixture model. Considering K components, the likelihood based on the N training data is then:

P (x|z, µ x , θ) = N n=1 K k=1 G(x n |µ x,k , C(θ k )) Z nk (7) P (y|z, µ x , θ) = N n=1 K k=1 G(x n |µ y,k , C(θ k )) Z nk (8)
Where z is the vector of component weights, θ the Gaussian process hyperparameters, µ the mean function of the Gaussian process, and C(θ k ) the covariance matrix of the Gaussian process parameterized by θ. The complete model used is a hierarchical probabilistic model where random variables include cluster component weights and cluster means unlike the standard Gaussian mixture model. As the hierarchical model is intractable, approximate learning methods are used. For practical purposes, it is desirable to have point estimates for the cluster component weights and the hyperparameters of the Gaussian processes. This leads to a learning approach closely related to Expectation-Maximization (EM) where in the E-step, variational mean field type learning is used. And in the M-step, maximization of the log likelihood over the space of parameters is performed. To determine the number of cluster components, training is performed by assuming a large number of cluster components. The training result gives small weights for certain clusters, and the clusters with small weights are be removed. For details refer to [START_REF] Tay | Modelling paths using gaussian processes[END_REF].

E. Prediction

When performing path prediction, the input is a partially observed path of dimension M < D. For the case of a D dimensional Gaussian with x 1 of dimension M and x 2 of dimension D -M :

P ′ (x 1 , x 2 ) ∼ G µ 1 µ 2 , Σ 11 Σ 12 Σ 21 Σ 22 (9)
The probability of a partial path observation of dimension M belonging to a Gaussian of dimension D is evaluated by integrating over the D -M dimensions of the Gaussian distribution to yield the marginal Gaussian distribution:

P ′ (x 1 ) ∼ G(µ 1 , Σ 11 ) (10)
The prediction of a path x 2 given observation x 1 can be obtained by the Gaussian conditional distribution for each cluster k:

P ′ k (x 2 |x 1 ) ∼ G µ 2 + Σ 21 Σ 11 (x 1 -µ 1 ), Σ 22 -Σ 21 Σ -1 11 Σ T 21 (11)
In order to choose the suitable clusters that corresponds to the observations made so far, the Mahalanobis distance can be calculated and then gated based on the appropriate chisquare values. Figure 2 shows an example of the prediction where the predicted path mean and variance are represented by the 'bars'. Clusters for prediction were selected according to the chi-square statistic corresponding to the 95% confidence interval. For each cluster, the Gaussian distribution of the predicted path can be obtained using eq. 11.

III. PROBABILISTIC RRTS

Consider a car-like robot moving in an unknown environment among static and moving obstacles. The task of the robot is to reach a given goal state avoiding collisions. The robot perceives its surroundings with a distance sensor (laser range finder) and is able to detect and track the moving obstacles in its view range. At each instant the robot knowledge about the world is incomplete and uncertain: incomplete in space because of the sensor range and the hidden areas and in time because of the limited validity of the motion models of dynamic obstacles and the unpredictability of new obstacles entering the scene. The uncertainty instead comes from the sensor error and accuracy and from the error of the motion models, the detection and tracking algorithms. Spatial uncertainty and incompleteness are represented by a probabilistic occupancy grid. In [START_REF] Benenson | Integrating perception and planning for autonomous navigation of urban vehicles[END_REF] the RRT algorithm is integrated in a worst case approach: obstacles are tracked in a dynamic environment and their kinematic model is used to bound the prediction of their future position. Also, partial planning is performed taking into account real-time constraints and the reliability of prediction. In [START_REF] Melchior | Particle rrt for path planning with uncertainty[END_REF] a particle filter is combined with an RRT method to perform path planning in environment with uncertain slipping: an a priori model of uncertainty is defined and planning is performed in a static environment.

In our paper we propose an algorithm to take into account a probabilistic representation of sensing and prediction uncertainty which can be updated by new incoming information. Spatial uncertainty and incompleteness are represented by a probabilistic occupancy grid. Temporal uncertainty is represented using Gaussian mixture predictions.

A. Probability of Collision

At a given instant, the robot knowledge about the state of the environment is represented by: 1) a list of pre-learned GPs which represent the typical patterns of the moving obstacles; 2) an occupancy grid, which represents the structure of the static environment around the robot, according to the previous observations; 3) a list of moving objects, their estimated position, velocity and previous observations; 4) an estimation of the state of the robot itself; 5) a goal state.

The configuration of the robot q = (x, y, θ, v, ω, t) at a time instant t is given by the position (x, y) and orientation θ of the robot in the plane, the linear velocity v, the angular velocity ω. For each configuration q, a probability of collision P c (q) can be computed considering the static and moving obstacles and the perception limits. The probability of collision with the static environment P cs is computed considering the maximum probability of occupation among the cells of the occupancy grid touched by the robot in that configuration. Let's consider M moving objects and K the number of GPs associated to the typical patterns learned. For an obstacle O m , the predicted position at time t is estimated by a gaussian mixture of K components. Considering each component k separately, the associated probability of collision P cd (k, m) is calculated considering the overlapping of the robot and the predicted Gaussian. In practice, the probability of collision is computed in a set of points in the area occupied by the robot and the maximum is considered.

B. The RRTs

The Rapid-exploring Random Tree (RRT) [START_REF] Lavalle | Randomized kinodynamic planning[END_REF] is a randomized algorithm to explore large state space in a relatively short time. The algorithm chooses a point P in the configuration space and tries to extend the current search tree toward that point. P is chosen randomly, but generally in singlequery planning, some bias toward the goal is applied in order to speed up the exploration. The nearest node neighbour of P within the nodes of the search tree T , is chosen for extension. A new node is obtained applying an admissible control from the chosen node s toward P . If the node is collision free the new node is added to the tree. The algorithm can be stopped once the goal is found, or it can keep on running to find a better path. Once the goal state is reached, the path from the initial state to the goal is retrieved.

C. Probabilistic Extension

The algorithm described above lies on a deterministic representation of the environment, i.e. the algorithm knows a priori if a node is collision free or not. If the environment is not completely known, or if there are moving obstacles with unknown trajectories, we would need to make recursion to a worst case approach. This could limit the search and prevent the algorithm from finding any solution or probable solution in most cases. In this paper, we propose an extension of the basic RRT algorithm to take into account the probability of collision both during the exploration of the space and at the choice of the path, so that the probability of noncollision of a path becomes a measure of its feasibility. All the explored configurations are maintained in the tree and their probability of collision is updated by more recently acquired information. Given an initial configuration s 0 , and a search tree T , the probability of collision of a path π(s N ) = {s 0 ...s N } is given by the probability to cross the tree from the root s 0 to the considered node s N . This is computed as the probability of not having collision in each of the traversed nodes. For a single obstacle m and a Gaussian process k :

P π (s N , m, k) = 1 - N n=0 (1 -P cd (s n , m, k)) (12)
The probability falls exponentially with the length of the path. This is a sign that longer paths are more dangerous, as the uncertainty accumulates over subsequent steps. Considering first all the GPs for one moving object and then integrating on all the objects we have:

P π (s N , m) = K k=1 l k,m • P π (s N , m, k) (13)
L π (s N ) = M m=1 (1 -P π (s N , m)) (14)
where we considered independent collision events for each obstacle. L πN is the probability that the robot traverses the path without entering in collision and we call it the probability of success or likelihood of the path. Once a point P is chosen in the configuration space, we have to decide which node to grow next. For each node s, a weight w S is computed considering the expected length of the path dist(s 0 , s, P ) and the probability of success. More precisely, L π (s) is normalized by the length of the path and multiplied by the inverse of the distance. This normalization is taken out so that the probability of success does not depend on the length of the path, that is taken into account by the distance term:

wsN = 1 dist(s 0 , s N , P ) N L π (s N ) (15)
w s = ws s ws

The function dist(s 0 , s N , P ) is a sum of the length of the path from the root s 0 to s N and of the shortest path from s N to P , which is a lower limit for the length of the eventual path to P . The weights are normalized over the set of nodes in the tree [START_REF] Th | Intentional motion on-line learning and prediction[END_REF]. The node to grow next is then chosen taking the maximum over the weights or drawing a random node proportionally to the weight. In our implementation we choose the second approach which appeared to be more robust to local minima. Even if a path to the goal is found, the algorithm continues to search for a better/safer path until the available time is out. All nodes are added to the tree, or eventually a threshold P saf e can be chosen to avoid the exploration to move toward too unlikely zones. Figure 3(a) shows of the described algorithm for an holonome robot within a static simulated environment. The initial position of the robot is in the bottom left corner, while the goal is in the upper right corner. Black rectangles are obstacles. The robot perceives the environment with a distance sensor, so that areas behind the obstacles are unknown ( P c ≃ 0.5). The colour of the edges of the tree depends on the probability of success of the associated path: the lighter the colour the lower the probability. In red, the path chosen. Figure 3(b) shows the described algorithm for a car-like robot within an observed occupancy grid.

IV. ON-LINE NAVIGATION

A. The Partial Motion Planning

In a dynamic environment the robot has a limited time to perform planning which depends on the time-validity of the models used and on the moving objects in the environment. The conditions used for planning could be invalidated at execution time: for example an obstacle could have changed its behaviour or some new obstacle could have entered the scene. The idea of Partial Motion Planning [START_REF] Petti | Safe motion planning in dynamic environments[END_REF] is to take explicitly into account the real-time constraint and to limit the time available for planning to a fixed interval. After each planning cycle, the planned trajectory is generally just a partial trajectory. The exploring tree is updated with the new model of the world and the final state of the previous trajectory becomes the root of the new exploring tree. The planning algorithm works in parallel with execution. Each node of the tree is guaranteed to be not an Inevitable Collision State (ICS, [START_REF] Fraichard | Inevitable collision states. a step towards safer robots?[END_REF]) by checking if it exists a collision free braking trajectory from the node. This is a conservative approximation that doesn't allow the robot to pass an intersection before an approaching moving obstacle. Our approach presents an adaptable time horizon for planning. The time for the planning iterations depends on the length of the previous computed trajectory and on the on-line observations. Safety of a path is guaranteed studying braking trajectories only for the last state of the path.

B. The developed solution

At the beginning of navigation, we suppose that the robot has some time to observe the environment and to plan before moving. From the initial state s 0 , the tree is grown. At the end of the available time, the tree have reached deep N . At each of the explored partial paths a weight is associated using equations 15 and 16. The best path (with the higher weight) is picked out. To guarantee that the robot does not choose a dangerous path, we can specify the maximum allowed risk using a safety threshold. Also, from the last state of the path, a safe braking trajectory is searched. If it exists, the path is considered safe and passed for execution, otherwise it is discarded and another one is chosen from the tree. The chosen path is a sequence of N 2 configurations to be attended, where 0 ≤ N 2 ≤ N . While the robot executes the path, the tree is updated and grown. At each timestep, the nodes of the tree that are not reachable (in the past) are pruned out and the probability of success of each path is updated with the new estimation of the likelihood of each GP, given by observation following equation 13 and 14. In the remaining available time, the tree is grown. At the same time, the robot acquires new observations and compares the planned path with the new estimation: if the path is still safe, the robot continues to follow it; if an unexpected event is detected, a new safe path is retrieved from the search tree. If no safe path is found within the available time, the robot proceeds to a braking manoeuvre. In a very unpredictable environment, the time horizon will be shortned by the unexpected events and the algorithm will act like a purely reactive algorithm. On the opposite, in the case of static known environment, the algorithm will allow longer and longer time to grow the tree, and it the result would be nearer to the solutions of a global planner. The algorithm has been tested with real data acquired on a car-like vehicle equipped with a laser range finder (Cycab [START_REF] Pradalier | The cycab: a car-like robot navigating autonomously and safely among pedestrians[END_REF]). During the experiment, the robot is manually driven in an outdoor environment and perceives static obstacles and moving pedestrians. Using the algorithm developed in [START_REF] Trung-Dung | Online localization and mapping with moving object tracking in dynamic outdoor environments[END_REF], [START_REF] Burlet | Suivi multi-objets adaptatif : Application la classification de comportements de mobiles[END_REF] the robot localizes itself, builds an occupancy grid map of the static environment and tracks the moving obstacles. The probabilistic predictions of the future state of the obstacles are computed using a constant velocity motion model and the position and velocity estimated, with their associated covariance. To test the planning algorithm we define a goal 20 meters ahead the robot at each observation cycle and let the algorithm run in parallel with the on-line mapping and tracking at 2Hz (fig. 4(b)). Each sequence is then tested with the real data, letting a virtual robot move through the map (fig. 4(c-e). Fig. 4(a) shows the observed occupancy grid: free space is grey, occupied space white, non-explored space is black. The robot is the green rectangle and the circle is the tracked pedestrian with his trajectory. Fig. 4(b) shows the tree of states explored in the available time: lighter blue is for higher probability of collision. The red line is the chosen path. Fig. 4(c-f) shows subsequent positions of the virtual robot; on the background the occupancy grid predicted for planning; red circles represent instead the position of the moving obstacles as estimated in real-time by the tracking algorithm. Results prove that the algorithm is able to compute safe trajectories in real time taking into account the static and moving obstacles perceived and the uncertainty in prediction of a real data set.

V. EXPERIMENTAL RESULTS

A. Laser Data Set

B. Simulation Results

Tests have also been conducted in a simulated environment. A set of 3000 trajectories has been simulated in a rectangular environment. A subset of 1000 trajectories have been used as training data set and, as a result, 26 Gaussian processes have been learned. To test the probabilistic planning, we simulate the robot navigating among circular obstacles with trajectories that are chosen randomly from the simulated set. The static environment is supposed to be free and the perception of the robot is simulated. The timestep chosen is of 0.5s. Planning and execution run in parallel. Figure 5 shows some snapshot from the obtained results. The robot is the red rectangle and perceives the circular obstacle (red full point). The goal of the robot is at the bottom of the image (black circle). Green paths represent the mean of the Gaussian Processes: the likelihood of each GP is estimated at each time step on the basis of the previous observations; lighter colour is for lower likelihood. The tree explored by the robot is given by the blue lines. Again, lighter blue means lower likelihood. Circles represent the prediction for the obstacle for each associated Gaussian process and at subsequent timesteps. Fig. 5(a) shows the planning at the first timesteps; in figure 5(b) the robot moves toward the goal, while the obstacle moves toward the upper left corner and the prediction gets better. around one GP only. In figure 5(c) the moving obstacle has disappeared behind the robot, while another one appears near the goal. Fig. 5(c), shows how the search tree is grown and the path is adapted to the new situation.

VI. CONCLUSIONS AND FUTURE WORK

The paper presents a navigation algorithm which integrates perception uncertainty and incompleteness in the planning strategy using a probabilistic framework. The use of prelearned typical patterns allows to have a medium-term prediction that is more reliable than what can be expected from a simple target tracking algorithm and that can easily handle non-linear motion. The integration of the likelihood of obstacle paths and of the probability of collision makes it possible to update previously explored states with the online estimation; this gives in result less dangerous and more intelligent paths for the robot. The use of an adaptable time The robot moves in a simulated environment with a moving obstacle. The prediction of the obstacle is given by a Gaussian mixture based on the pre learned Gaussian processes (green). The exploring tree maintains an estimation of the likelihood of the path that adapts to the incoming observation. horizon for planning makes the algorithm both reactive to unexpected changes of the environment and forward looking when previously planned trajectories are not invalidated by observation. Immediate work will deal with testing the navigation algorithm to have a measure of its performance in more complex and realistic scenarios. Also we will focus our study to reduce the complexity of the algorithm discarding unlikely Gaussian processes and obstacles that cannot interfere with the trajectory of the robot. Ideas for future work are directed to integrate in one framework the prediction coming from target tracking, which is more accurate in short term and the prediction coming from the pre-learned Gaussian processes, which is more reliable at medium term.

Fig. 1 .

 1 Fig. 1. (a) Variance and mean of a typical path exemplar. Lines are sample paths from the Gaussian process. (b) Prediction on future paths with its mean and variances given a partial path. Dotted lines represents samples from distribution.

Figure 1 (

 1 b) illustrates an example of a partially observed path and the prediction on future path with its variance indicated by the shaded area. Dotted lines in the figure are sample paths from this distribution.

Fig. 2 .

 2 Fig. 2. Prediction paths and path variance to 2 standard deviations

Fig. 3 .

 3 Fig. 3. Probabilistic RRT in static environment. Figures show the search tree and the likelihood of the nodes (lighter colour is for lower likelihood). Observations are taken with a distance sensors, and there are occluded zones. (a) A point holonome robot in a simulated environment; (b) A car-like robot in an occupancy grid.

Fig. 4 .

 4 Fig. 4. Results with a laser dataset. (a) The static environment is mapped and the moving obstacles are tracked. (b) The algorithm explores the state space and chooses a path. (c-e) the path is compared with the real observations acquired.

  Fig. 5.The robot moves in a simulated environment with a moving obstacle. The prediction of the obstacle is given by a Gaussian mixture based on the pre learned Gaussian processes (green). The exploring tree maintains an estimation of the likelihood of the path that adapts to the incoming observation.


Roberta Lupi

Sylvain Guyot

Jean-Yves Thebaudin

Carine Delayre-Orthez

Pascale Gadonna-Widehem

Marie Bodinier

Larré Colette

Maxime Perot

J-Y Thébaudin

Impact of different polyphenols on wheat allergic response in in vitro and in vivo models

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Impact of different polyphenols on wheat allergic response in in vitro and in vivo models

Pérot M 1,2,3 , Lupi R 3 , Guyot S 3 , Thébaudin J-Y 2 , Delayre-Orthez C 1 , Gadonna-Widehem P 1 , Bodinier M 3 , Larré C Wheat allergy is an IgE-mediated disease increasing in the last years. Currently the only treatment is based on dietary restriction and no effective preventive strategies have been reported. Some polyphenols are known to contribute health-promoting benefits. Some of them are able to interact with proteins via non covalent or covalent interactions. In this study, we screened different polyphenols sources for their capacity to interact with gliadins which represented the major wheat allergens, to mask epitopes and to impact degranulation which is the effector phase in the allergic reaction. Polyphenols from four plant sources were extracted and their composition was characterized by liquid chromatography coupled to mass spectrometry (MS). Mixed at different ratios with native or pepsic-hydrolysed gliadins they formed complexes that were characterized. The impact of these interactions on the binding of IgE from patients allergic to wheat was analysed by DotBlots. Their effect on the allergic reaction symptoms was tested in a mouse model of food allergy to gliadins and in RBL-2H3 model.

All tested polyphenols were able to interact with native gliadins, leading to the formation of insoluble complexes. A systematic screening revealed that the polyphenols obtained from cranberry extract (flavonoid and A-type of proanthocyanidins compounds) and maritime pine bark (flavanols and B-type of procyanidin) were the more efficient to induce the formation of insoluble complexes with either native or hydrolysed gliadins. These interactions between gliadins and these extracts decreased the IgG-and IgE-binding capacity with gliadins. Using animal model, we showed that gliadins alone or in complexes with maritime pine bark polyphenol were able to induce mice sensitization in the same way. However oral challenge with complexes did not induce any symptoms unlike gliadins alone. Finally, results obtained from the cell model showed the magnitude of effector cells activation depends on the polyphenols type involved.

The complexes formed by interaction between cranberry extract and gliadins showed a decrease in the recognition by antibodies, their effect in an in vivo model is more contrasted and need to be further explored.


Steven Furnell
email: steven.furnell@nottingham.ac.uk

Paul Haskell-Dowland

Manish Agrawal

Richard Baskerville

Anirban Basu

Matt Bishop

Jorge Cuellar

Sara Foresti

Lynn Futcher

Teju Herath

Christian Damsgaard Jensen

Allen Johnston

Wouter Joosen

Giovanni Livraga

Javier Lopez

Stephen Marsh

Fabio Martinelli

Fabio Massacci

Pasic

Stef Schinagl

Abbas Shahim

Kerry-Lynn Thom- Son

Jaideep Vaidya

Merrill Warkentin

Information Security and Privacy -Challenges and Outlook

Keywords:

The ongoing demand for new and faster technologies continues to leave consumers and business users to face the constant challenge of updating systems and software. This unrelenting pace of technological evolution has not always been matched with a commensurate focus on security and privacy matters. In particular, the obligatory move to embrace cloud and IoT -that frequently result in the collection and analysis of large data lakes has raised challenges for sovereign data protection and privacy legislation where data at rest can change overnight with mergers and acquisitions of service providers. This chapter examines the role of IFIP Technical Committee 11 (and its 14 underlying Working Groups) in this ever-changing and evolving domain. The discussion provides an outline of key issues in information security when viewed from technical, organisational and human perspectives, which collectively represent the breadth of areas within which TC-11 and its Working Groups are seeking to make contributions. The chapter as a whole gives a clear sense of the challenges involved in achieving and maintaining security and privacy, alongside insights into the ways that they are being tackled within IFIP activities.

Introduction

Alongside the global adoption and significant growth of information and communication technologies, comes the need to provide protection against potential breaches of security. These may result from deliberate and targeted attacks, as well as from misuse, inadvertent user errors, and system failures. In addition, with the volume and sensitivity of the related data that these systems store and communicate, there is an essential need to consider provisions for ensuring and maintaining privacy [START_REF]The OECD Privacy Framework[END_REF].

In recognition of these issues, IFIP Technical Committee 11 (TC-11) exists to increase the trustworthiness and general confidence in information processing, as well as to act as a forum for security and privacy protection experts and others professionally active in the field [START_REF]Aims and Scope[END_REF]. In parallel with the increasing importance of cyber security issues and concerns, the scope and activity of TC-11 has grown over the years, and at the time of writing encompasses 14 Working Groups, each focusing upon defined areas within the security and privacy landscape [START_REF]Working Groups[END_REF]. For the purpose of this chapter, each of the groups was asked to outline the challenges that they perceive in the future, resulting in the identification of a range of topical issues that can be broadly classified under the themes of technological, business and organisational, and human challenges. While each of these themes is distinct, this chapter considers how each of these perspectives combine and reflect the function of the Technical Committee while maintaining independent activities within each group. As may be expected, each working group approaches the issues of information security and privacy through the lens of their group role and scope.

After a short introduction to the working groups, this chapter first looks at the technological issues facing the ICT domain with consideration of the significant changes seen in recent years with new technologies and working approaches. The functional issues within organisations are then considered with due regard to policy, procedure and governance as well as a recognition of the changing (often global) legal frameworks in which ICT professionals must now function. Finally, the critical issue of human factors is considered. This is often overlooked but is a vital factor in ICT systems as humans design, implement and use the very systems that are then the cause of many security and privacy concerns.

Overview of Technical Committee 11

Technical Committee 11 (formally titled Security and Privacy Protection in Information Processing Systems) was originally established in 1983, and has the overall remit to:

• establish a common frame of reference for security and privacy protection in organizations, professions and the public domain; • facilitate the exchange of practical experience;

• disseminate information on, and the evaluation of, current and future protective techniques; • promote security and privacy protection as essential elements of information processing systems; • clarify the relation between security and privacy protection.

Since its inception, TC-11 has grown to be supported by 14 Working Groups [START_REF]Working Groups[END_REF] covering a diverse range of security-oriented areas.

Information Security Management

There is a growing trend for senior business management to be held answerable for the reliable and secure operation of their information systems, as they are for control of their financial aspects. Information Security is, and should always be, an obligation on upper management with appropriate delegated responsibility [START_REF] Connolly | Managing Employee Security Behaviour in Organisations: The Role of Cultural Factors and Individual Values, ICT Systems Security and Privacy Protection[END_REF]. Information security professionals and WG 11.1 in particular, should therefore be responsible for the development of all types of tools, mechanisms and methods to support top management in this new responsibility.

Pervasive Systems Security

Pervasive systems shall be defined to be large scale systems that are comprised of nodes ranging from RFID tags, through embedded systems, to personal mobile devices, interconnected by a mixture of short-range wireless and wide are wired networks. The typical characteristics of a pervasive system are: resource constrained nodes, often physically unreachable or without user interface, whose interconnections often span a large number of administrative domains with conflicting interests. Security of such systems is therefore an emergent property.

Data and Applications Security and Privacy

IFIP WG 11.3 was formed in 1986 to stimulate activities in both data security and privacy research and in the application of data security and privacy techniques. The goal in forming the working group was to encourage the development of better techniques for stating data security and privacy requirements, for designing, building, and implementing data management systems that satisfy security and privacy requirements, and for assuring that the systems meet their requirements in actual operation.

Network & Distributed Systems Security

Management in any organization is responsible for the reliable and secure operation of the information systems that support the organization. As inter and intra-organization networking between information systems become the rule as well as the daily operational environment, the scope of concern takes on new aspects and new technical details come into play. Management must not only address the security issues of wholly internal systems together with any networks to which they might be connected, but also must assure that the protective mechanisms installed in them are not accidentally or intentionally thwarted or subverted by other systems with which data exchange connections are established.

IT Assurance and Audit

The current attention for digitalization and regulatory compliance has significantly changed the way in which IT has been organized, managed and consumed. Given their strict corresponding control objectives, organizations must transparently prove that they act in accordance with the applicable laws and regulations and manage digital risk in a proper fashion. Hence, reasonable assurance with respect to IT is crucial in this case to build confidence whether IT solutions and underlying infrastructures preserve resources, maintain data integrity as well as availability, meet the service levels, satisfy the regulatory requirements and accordingly assist in attaining their goals. For this essential purpose, a number of IT assurance and audit engagements are normally conducted. The aim of the working group is to study and develop detailed knowledge on IT assurance and audit models, standards, processes and techniques to meet the needs of organizations from a wider business perspective.

Identity Management

The aim of WG11.6 is to promote -through education, research and outreach -the awareness and understanding of issues including identity management applications and methodologies, identity management issues at the national level (including issues of federated and multilateral identity management), and the role and effectiveness of identity management in fighting fraud and other forms of crime [START_REF] Wiefling | Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild, ICT Systems Security and Privacy Protection[END_REF]. The working group is also specifically interested in biometric technologies that increasingly contribute to the IM landscape, including legal and operational aspects of biometrics, methods and techniques that can help to evaluate and improve the technologies, and their associated impact upon society [START_REF] Giorgi | Walking Through the Deep: Gait Analysis for User Authentication Through Deep Learning, ICT Systems Security and Privacy Protection[END_REF][START_REF] Diaz-Tellez | Context-Aware Multifactor Authentication Based on Dynamic Pin[END_REF].

Information Technology: Misuse and The Law

The WG focuses on the relations between IT Misuse, the Law and Society. As "Misuse" depends very much on the point of view and the cultural background of the viewer a very broad understanding of the term "Misuse" turned out to be appropriate. The WG studies technical, organisational, legal and social aspects of information infrastructures and electronic services with regard to their trustworthiness. The emphasis is on legal implications of new technology and vice versa.

Information Security Education

The aim of WG11.8 is to promote information security education and training in university, government and industry through the encouragement of the development of course models [START_REF] Damopoulos | Introducing Research into the Undergraduate Curriculum in Cybersecurity[END_REF]. The WG also aims to establish an international resource center for the exchange of information about education and training in information security and to collect, exchange and disseminate information, relating to information security courses conducted by private organizations for industry [START_REF] Solms | Identifying Security Requirements Body of Knowledge for the Security Systems Engineer[END_REF]. The WG further aims to collect and periodically disseminate an annotated bibliography of information security books, feature articles, reports, and other educational media.

Digital Forensics

The growth of the Internet and the plethora of technology devices has resulted in more and more information being stored, transmitted and processed in digital form than ever before [START_REF] Thing | Smartphone Volatile Memory Acquisition for Security Analysis and Forensics Investigation, Security and Privacy Protection in Information Processing Systems[END_REF]. At the same time this connectivity is also enabling criminals to act transjurisdictionally with ease. Increasingly we are witnessing that a perpetrator of a crime is being brought to justice in one jurisdiction while the digital evidence needed to prosecute the perpetrator residing in other jurisdictions. This requires that all nations have the ability to collect, preserve and examine digital evidence for their own needs as well as for the potential needs of other nations. Digital Forensics is the scientific study of the processes involved in the recovery, preservation and examination of digital evidence, including audio, imaging and communication devices with consideration of forensic evasion techniques [START_REF] Agarwal | Anti-forensic = Suspicious: Detection of Stealthy Malware that Hides Its Network Traffic[END_REF]. The efforts of the working group in digital forensics strive to discover, define and foster fundamental scientific principles that support the investigation of digital wrongdoings from all perspectives, legal, business and military.

Critical Infrastructure Protection

The "information infrastructure" -comprising computers, embedded devices, networks and software systems -is vital to day-to-day operations in every sector: agriculture, food, water, public health, emergency services, government, defense, information and telecommunications, energy, transportation, banking and finance, chemicals and hazardous materials, and postal and shipping [START_REF] Dupont | A Matter of Life and Death: Analyzing the Security of Healthcare Networks, ICT Systems Security and Privacy Protection[END_REF]. Global business and industry, governments, indeed society itself, cannot function effectively if major components of the critical information infrastructure are degraded, disabled or destroyed [START_REF] Yoo | Control Logic Injection Attacks on Industrial Control Systems[END_REF]. Working Group 11.10 on Critical Infrastructure Protection seeks to engage the international information security research community to work together on applying scientific principles and engineering techniques to address current and future problems in information infrastructure protection. In addition to engaging the research community, the WG draws other interested parties (government agencies, infrastructure owners, operators and vendors, and policy makers) in a constructive dialog on critical infrastructure protection.

Trust Management

The deployment of a global computing infrastructure raises new and difficult security and privacy issues. Global computing allows entities to reason about the trustworthiness of other entities and to make autonomous security decisions on the basis of trust. This requires the development of a computational trust model that enables entities to reason about trust and to verify the security properties of a particular interaction [START_REF] Vossaert | Trusted Computing to Increase Security and Privacy in eID Authentication[END_REF]. The global computing infrastructure is highly dynamic with continuously appearing and disappearing entities and services [START_REF] Eckel | Secure Attestation of Virtualized Environments[END_REF]. It is vital that the associated computational trust model is able to incorporate this dynamism and that equally flexible legislative and regulatory frameworks emerge.

Human Aspects of Information Security and Assurance

Achieving security within information systems is no longer simply a technical problem but increasingly involves the active participation of people in order to securely design, deploy, configure and maintain systems [START_REF] Kitkowska | Facilitating Privacy Attitudes and Behaviors with Affective Visual Design, ICT Systems Security and Privacy Protection[END_REF]. Whilst the level and sophistication of this interaction may vary; anyone who is engaged with technology, from administrators of the most complex of IT systems to owners of simple devices, all need to make decisions that have an impact on the security and privacy of their device and information. Unfortunately, while people represent a key facet in achieving security, evidence demonstrates that this is often the point of failure [START_REF] Simonet | The Influence of Organizational, Social and Personal Factors on Cybersecurity Awareness and Behavior of Home Computer Users, ICT Systems Security and Privacy Protection[END_REF]. With security now impacting all aspects of society, from the young to old, enterprise organisation to the individual, it is imperative that systems are designed, policies are put in place that assist people in ensuring the security of their systems. It is against this context that Working Group 11.12 aims to contribute.

Information Systems Security Research

The aim of the working group is the creation, dissemination, and preservation of wellformed research about information systems security. While relevant for advanced practical development, our primary audience consists of researchers in this area. We value research products with highly reliable and validated theory, empirical data, or quantitative/qualitative social scientific methodology.

Secure Engineering

The Information and Communication Technology (ICT) landscape is continuously changing. We are now witnessing the emergence and consolidation of unprecedented models for service-oriented computing (SOC): Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS) [START_REF] Eckel | Secure Attestation of Virtualized Environments[END_REF][START_REF] Rios | Query Privacy in Sensing-as-a-Service Platforms[END_REF]. These models have the potential to better adhere to an economy of scale and have already shown their commercial value fostered by key players in the field. Nevertheless, those new models present change of control on the applications that will run on an infrastructure not under the direct control of the business service provider. For business-critical applications this could be difficult to be accepted, when not appropriately managed and secured. These issues are of an urgent practical relevance, not only for academia, but also for industry and governmental organizations [START_REF] Lin | Formal Analysis of Sneak-Peek: A Data Centre Attack and Its Mitigations[END_REF]. New Internet services will have to be provided in the near future, and security breaches in these services may lead to large financial loss and damaged reputation.

There thus the need and opportunity to organize, integrate and optimize the research on engineering secure services and related software systems to deal effectively with this increased challenge is pertinent and well recognized by the research community and by the industrial one.

Technological issues

The ICT landscape is continuously changing. For example, we have seen the consolidation of models for service-oriented computing (Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS)), the increased use of automation, and the emergence of new paradigms such as cloud and the Internet of Things (IoT). However, new developments open up the potential for vulnerability to new threats (or indeed old threats in new guises). As such, some of the consequent challenges are perceived to be:

• maintaining effective cyber defence, as technology and functionality grow faster than security; • achieving trust in devices specially when they operate remotely;

• security and interoperability of new communication technologies;

• the fact that evidence has moved from being on media in a computer in a single location to existing in myriad locations and forms (e.g. mobile devices, distributed internet-enabled (IoT) electronics, and on corporate controlled servers with serverside processing and storage).

These challenges create fundamental requirements in relation to security engineering, but they also create knock-on implications for issues such as incident handling, response, and forensic investigation, where the scale and complexity of systems calls for new capabilities to maintain effectiveness. Security professionals are also having to address the growing threat to critical infrastructure where industrial control systems (ICS) are connected to operational networks and even to the public Internet [START_REF] Adepu | Using Process Invariants to Detect Cyber Attacks on a Water Treatment System, ICT Systems Security and Privacy Protection[END_REF]. With technology continuing to evolve, the distributed nature of infrastructure will increase and the expansion of autonomous vehicles and increased artificial intelligence/machine learning will all present significant challenges to the security community.

Securing applications and data

Data are today the new oil, as the ability to collect, share, process and analyse data are at the centre of the great advancements we are enjoying in our society. Providing effective techniques for ensuring proper security and privacy is of utmost importance, for both enabling such advancements (as fear of exposure of private information can have detrimental impact on their adoption) as well as enabling their development (as by developing techniques for ensuring data protection can widen the range of scenarios where data can be used). The evolution of ICT has radically changed our lives, enabling information to be available from anywhere at any time. The growing availability of computational power and network connections at competitive prices facilitates collecting, sharing, processing, and accessing huge amounts of information. Thanks to the wide diffusion of devices collecting information (e.g., IoT devices, smart meters, fitness bands) and of personal devices connected to the network (e.g., smartphones, tablets, laptops), the amount of data generated on a daily basis by companies and final users has grown exponentially and is expected to grow at a continuously increasing rate in the future. Also, the cost of data storage and processing has significantly decreased, enabling the longterm storage and analysis of data and making it accessible when needed. Pictures and videos can be stored in the cloud, analysis performed over huge data collections, third party computational power purchased or leased for heavy elaborations, information collected from sensors spread in the environment where we live, appliances controlled in our houses from a smartphone. These are only a few examples of the advantages of living in a globally interconnected society, where every object is a smart object and anything we need is available from anywhere and at any time.

The advantages of the technological evolution, however, do not come for free as they introduce unprecedented security and privacy risks, due to the increased amount of (possibly sensitive) information collected, stored, and distributed, and to the loss of control of data by their owners when external subjects are involved in the information lifecycle. Users are becoming more and more concerned about their privacy, since collected data can be used to identify individuals and/or infer information that was not intended for disclosure -permission often being provided unknowingly through terse terms and conditions [START_REF] Drozd | Privacy CURE: Consent Comprehension Made Easy, ICT Systems Security and Privacy Protection[END_REF]. The location information collected by our phones, the pattern of walking recorded by surveillance cameras, seemingly innocuous information provided when subscribing to a service (e.g., date of birth and city of residence), biometric information used for authentication, are only a few examples of data that can be exploited to identify the person to whom they refer. Sensitive information not intended for disclosure is often collected by devices such as: fitness bands, home assistants, smart home appliances and sensors, social networks, just to mention a few. In all these scenarios, users are not in control over their own data and their privacy is possibly at risk. Indeed, users are often not even aware of the fact that data about themselves are collected and/or cannot control the collection, storage, use, analysis, or deletion of their data [START_REF] Paul | Assessing Privacy Policies of Internet of Things Services, ICT Systems Security and Privacy Protection[END_REF]. The loss of control is one of the problems slowing the wide adoption of externalized services (cloud, fog, and edge scenarios as well as digital data markets) as an enabling technology for data storage and elaboration. While external providers can be considered reliable for guaranteeing basic security protection (e.g., protection from unauthorized accesses to data and resources by external third parties), they might not be considered trusted for confidentiality (i.e., authorized to know the data content) or for guaranteeing integrity of the data they store or process. Many challenges need to be addressed to guarantee proper security and privacy in the emerging scenarios, including the need to provide confidentiality and integrity of data stored at, shared with, or processed by external parties, while providing needed access and computational functionalities [START_REF] Caelli | Evolving a Secure Internet, Security and Privacy Protection in Information Processing Systems[END_REF]. Advancements in artificial intelligence, which on one side may make the data more exposed and hence user privacy more at risks, can also help in developing better techniques for ensuring protection of information.

The problem of data security and privacy is evolving with technology: the technological evolution provides benefits, but also introduces new vulnerabilities. Data security and privacy in the modern digital society are complex concepts that require attention from several points of views (e.g., legal, social, economic, technological) and raise novel challenges that need to be addressed to enable users to fully enjoy the advantages of technological evolution [START_REF] Simonet | The Influence of Organizational, Social and Personal Factors on Cybersecurity Awareness and Behavior of Home Computer Users, ICT Systems Security and Privacy Protection[END_REF].

Engineering for better security

While the service-Oriented Computing (SOC) models bring significant savings and convenience for organisations and users alike, they also introduce challenges for the security engineering community. These models have the potential to better adhere to an economy of scale and have already shown their commercial value fostered by key players in the field. Nevertheless, those new models present change of control of the applications that will run on an infrastructure not under the direct control of the business service provider. For business-critical applications this could be difficult to be accepted, when not appropriately managed and secured. These issues are of an urgent practical relevance, not only for academia, but also for industry and governmental organizations.

New Internet services will have to be provided in the near future, and security breaches in these services may lead to large financial loss and damaged reputation.

There is a need to organize, integrate and optimize research on engineering secure services and related software systems. This challenge is well recognized by the research and industrial communities. Some of the specific challenges that need to be addressed in security engineering include:

•

Investigating the inevitable

Historically, the focus of digital forensics, incident response and electronic discovery has been on gathering evidentiary trace from desktop computers and small enterprises.

While the processes and formalisms remain the same, where the evidence is found, and the volume of evidentiary sources has led to some fundamental challenges. Currently, evidence has moved from being on media in a computer in a single location to existing in mobile devices, internet enabled (IoT) electronics, and on corporate controlled servers with server-side web processing and storage. Additionally, enterprise computing has increased and evolved with data being stored in a myriad of forms in appliances, services, and alternative compute architectures. The digital forensics community needs verifiable and validated capabilities to address these changing computing environments. This is further complicated by the use of service-oriented computing with storage and processing of data moving from on-premise to frequently cloud-based locations. This also introduces complex legal problems with the potential for multi-jurisdictional investigations.

Business and organisational issues

The current attention for regulatory compliance has visibly changed the way in which IT has been organised and managed. Given their strict corresponding control objectives, organisations must transparently prove that they act in accordance with the applicable laws and regulations. This gives rise to a number of challenges, that collectively span areas such as information security management, audit and governance:

• ensuring adherence to organisational information security policies and procedures;

• transparently proving that organisations are acting in accordance with the applicable laws and regulations; • better techniques for stating data security and privacy requirements, for designing, building, and implementing data management systems that satisfy security and privacy requirements, and for assuring that the systems meet their requirements in actual operation;

Reasonable assurance with respect to IT is crucial in this case to build confidence whether IT solutions and underlying infrastructures preserve resources, maintain data integrity as well as availability, meet the service levels, satisfy the regulatory requirements and accordingly assist in attaining their goals.

The role of audit and IT assurance

Today's audit implications are associated with the view on digitalization and the impact of this technology-centric and global phenomenon on the business strategies across the globe. The centre of this digital journey is dominantly filled in by the far-reaching deployment of technology. The intensive use of this evolutionary capability empowers to reinvent business models, improve customer experience, optimize processes and operations, reshape the trade with partners, and more. It is all needed to remain attractive in the modern digital chains, and survive in the current ever-demanding marketplace. It has become a technology-driven environment and business climate that seems not to tolerate low-techs, and appears not to accept the large distances between the traditional physical world and the new digital world any longer. We are entering an age in which the technology defines the bright future, and dictates the way in which we conduct business and how we live our lives. IT has already become business. This continuously evolving technology forms the beating heart of organizations, and is thus almost a core part of a day-to-day responsibility of average business officials as well as top executives. Their changing view and act for strategizing, steering, transforming, positioning, governing, managing, and running organizations in the digital age calls for a revamped orientation of IT auditing to remain as relevant as before.

A key finding of research among business leaders and Chief Executive Officers (CEOs) with respect to the key business issues facing their organizations was about the new and higher level of risks created by the digital era which are not properly dealt with [START_REF] Wheeler | Top 10 factors for integrated risk management success[END_REF][START_REF]Digital transformation of industries: Digital enterprise[END_REF]. This demanding world characterized by a technology-centric perspective requires a broader and more balanced picture of IT auditing that shifts the focus from controlling "around IT" towards the hard-core side of IT, and with the use of IT. The purpose is to concretely discover the technical details about the reality of IT, just the way it is without vagueness. In this challenging context, IT auditing is perceived as an instrument that can provide an independent and objective opinion on the extent to which IT is adequately controlled to ensure that this technology does not affect the risk profile of business practices. In addition, this global discipline can help to address risks and governance concerns so that insight is obtained into the gained degree of trust and acceptance as well as the achieved level of strategic progress and performance.

The demand for IT auditing and control has never been greater. But then, this growing need also implies that a new day has come that imposes to frequently, if not constantly, audit and control through IT and with IT because of the highly ever-increasing level of reliance on technology. However, research in this area is scarce and requires attention to initiate a wide range of studies in this field.

Establishing Trust in an untrusted environment

ICT systems, often known as Supervisory Control and Data Acquisition (SCADA) systems, control our critical infrastructure and are increasingly used to control production of products (known as "Industry 4.0") and services, e.g. through e-Government, Big Data and Cloud Services. IoT and digital communication technologies are forming the fabric of our social interactions through Social Media (SoMe) that have also become the primary source of information and news for many people. In order for humans to live and thrive in this environment, it is essential that they are able to trust the ICT infrastructure on which their existence depends.

Trust management technologies address the problems of how people can build trust in each other across computer networks (inter-personal trust), how people can decide what devices and infrastructure to trust (personal-device trust and infrastructure trust), and how components in computer systems and networks can reason about the trustworthiness of other system components (inter-device trust).

Inter-personal trust is generally based on a combination of personal experience, recommendations from a trusted entity or the reputation of the other party. Personal experience requires the ability to authenticate, or at least recognize, other entities, observe, and record the behaviour of these entities. This implies a study of entity authentication and entity recognition mechanisms, message authentication and authenticated encryption primitives, and mechanisms supported by secure hardware modules, e.g. remote attestation technologies, but also secure and authenticated storage technologies, such as digital signatures and blockchains. Recommendations are authenticated statements regarding one named entity made by another and trusted entity. As such, the technological challenges are very similar to the challenges that arise in building personal experience, e.g. recommendations are commonly carried in digitally signed certificates. The value of recommendations depend on the ability to authenticate the named entity. Reputation systems aggregate behavioural information about a named entity from a multitude of sources. Depending on the reputation system, the behavioural information may be verified and the named entity as well as (some of) the behavioural information providers may be authenticated by the system; the identity of the source of reputation information is not always made available to the users of the reputation system. The success of a reputation system depends on the ability to ignore malicious or incompetent input and the aggregation mechanism, which is typically based on simple heuristics, statistical analysis, machine learning, game theory or other theoretical frameworks.

The aims of trust management, in a business and organisational context, is to support a virtuous circle of formation, distribution, exploitation and evolution of trust in other entities in the system. This means that the many challenges are similar to the challenges outlined above and that trust management technologies may help people decide which businesses or services to rely upon or what information to believe Human society is built on trust and people need assurance that the environments, technologies and social relationships that they rely on continue to function in the ways they expect. In particular, the technology (devices and services) that they employ must work to their benefit at a visible and reasonable cost. One societal problem that trust management technologies may help to address is "fake news" (or other forms of fake information).

Trust management is by nature a "horizontal" multi-disciplinary area that brings together communities to support "vertical" areas such as reputation systems, security, identity and access management, social networks, risk and compliance, formal models, legal IT, economics, etc.

Human issues

The human aspect has traditionally, but often unfairly, been portrayed as the weakest link in cybersecurity. Unfortunately, adversaries are indeed likely to target people where they are perceived to be the route to exploitation, and it is also important to ensure that people themselves do not act in ways that introduce avoidable vulnerability. Key areas for attention are considered to include the following:

• the growing volume of threats that explicitly target the human element, such as increasingly sophisticated social engineering and phishing scams; • major cybersecurity skills gap that needs to be addressed through formalised education; • addressing resistant user attitude and resistant behaviour to information security by fostering an information security/cybersecurity culture.

Without effective consideration of the human aspect, the overall protection of systems and data will remain sub-optimal. We need to find effective means to support people and help them engage, while at the same time protecting them from the attacks that seek to directly exploit them.

Addressing the human factor

The problem with the focus on human weaknesses is that humans are solely viewed as 'threats' and 'risks' to the organisation. However, it can be argued, that this is only one dimension of the human aspects of cybersecurity and that humans could become the best defence an organisation has to actively defend against cyberattacks. In order to empower employees to become part of the cybersecurity defence of an organisation, there must be a conscious effort to foster an information or cybersecurity culture in an organization [START_REF] Connolly | Investigation of Employee Security Behaviour: A Grounded Theory Approach, ICT Systems Security and Privacy Protection[END_REF]. Both sides of the human aspects of cybersecurity, the threats and the defence, should be acknowledged and addressed. Having said that, there are many challenges related to the human aspects of cybersecurity which are discussed below. Many organisations implement complex technological controls to protect their network perimeter from external threats, as the perception often is that the greatest threats come from attackers outside the organisation. However, insider threats can be particularly dangerous for organisations, as insiders have legitimate access to information systems to accomplish daily tasks. There are typically two broad types of insider threats; malicious users (employees who willfully extract data) and negligent/apathetic users (employees who are careless about cybersecurity).

Malicious users are those who purposefully try to benefit themselves at the organisation's expense or directly damage the organisation. They might steal confidential data, commit financial fraud or sabotage IT systems because they are disgruntled. Malicious insiders are notoriously difficult to identify. However, technological controls, such as behaviour analytics, anomaly detection, threat intelligence and predictive alerts, can be used to attempt to identify and mitigate against malicious users and their actions. Fortunately, for most organisations, malicious users are the exception and not the rule.

However, one of the greatest challenges organisations may face is human error introduced through negligent or apathetic users. Negligent or apathetic users are those who are not aware of or do not realise how important cybersecurity is for an organisation. These users do not appreciate the important role they should play in protecting an organisation from cyberthreats. One of the major challenges with regard to these users is social engineering. Social engineering is the psychological manipulation of users to exploit them into performing actions for, or divulging information to, the attacker. There are a wide variety of social engineering attacks, including, but not limited to; phishing, pretexting, baiting and quid pro quo. Social engineering attacks rely on building trust relationships with targets, and then exploiting these relationships for gain (usually financial).

From a societal point of view, there are a number of cyber vulnerabilities related to both adults and children. Cyberbullying is an online form of traditional bullying where cyberbullies send threatening or humiliating messages to their adolescent victims, and can lead to depression, isolation, illness and, sometimes, suicide.

In addition, social media platforms continue to be very popular ways for people to keep in contact with friends, upload content and share information online. However, there are many privacy concerns related to these social media platforms, for example, many users being unaware of the extent to which their personal information is spread after sharing.

Another societal challenge that is seemingly on the rise is that of fake news. One of the difficulties is that different people have different views of fake news. For many, fake news is seen as it was intended -false information being spread. For others, fake news is seen as anything that goes against their own beliefs or biases. The issue is that, more than making people believe false information, the rise of fake news is making it harder for people to see the truth. In other words, people may become less informed.

Most of these challenges can start being addressed by raising the awareness of both employees and society in general to cyberthreats. The cybersecurity awareness, however, must go further through cybersecurity educational programs to provide a deeper understanding of why cybersecurity is important and the role they should be playing in the defence of their organisation. Often, however, these programs are generic and are not very effective in addressing users and the threats they may be introducing, which may result in people developing the 'it won't happen to me' mindset. Therefore, information and cybersecurity awareness and education programs should be specifically contextualised to become relevant to the audience to ensure they become advocates for information and cybersecurity. In organisations, for example, as part of management's duties, an organisational vision for cybersecurity should be expressed in policies. These policies should be enforced to assist management in curbing incorrect behaviour in their organisation and, ultimately, change the corporate culture. Transforming the corporate culture, however, takes time and perseverance, as it entails the unlearning of beliefs and changing the attitudes of employees, which can be a painful process [START_REF] Tolah | A Comprehensive Framework for Understanding Security Culture in Organizations[END_REF]. The fostering of an information or cybersecurity culture in an organisation could, ultimately, positively influence the attitude and behaviour of employees towards information and cybersecurity. Although an organisation can never completely eliminate the cybersecurity risk posed by humans, the chances of a breach could be reduced if the cybersecurity education of users is made a priority.

Raising awareness and providing access to educational programs for the general public could also assist in creating a societal cybersecurity culture.

5.2

The importance of education Many organizations, nations, businesses, and individuals are actively seeking to expand their knowledge of, and skills in, cybersecurity. Unfortunately, the amount of misinformation in this area, and the shortage of skilled, knowledgeable cybersecurity practitioners and experts, inhibits the ability to protect information and cyberinfrastructure. Worse, some organizations and individuals do not understand the need to protect themselves, or believe their measures are adequate when in reality they are not. The only cure for this lack of personnel, knowledge and understanding of how to determine and implement measures necessary for protection, is education. This skills gap requires a multi-faceted solution with a combination of not only formalised education, but also training and awareness programs. It is also important to recognise that for most government departments, organisations and businesses, security is rarely achieved without some impact on performance, usability or cost.

Current estimates indicate that there are about 1 million unfilled cybersecurity positions worldwide, potentially rising to 3.5 million by 2021 [START_REF]Cybersecurity Talent Crunch to Create 3.5 Million Unfilled Jobs Globally By[END_REF]. In order to address this rapidly increasing demand for cybersecurity skills, academic institutions worldwide are introducing and adapting courses and programs to teach students about information and cybersecurity. Among the main concerns for academics in computing, however, is what cybersecurity and related topics to cover and to what depth, as most computing courses already cover an expanse of content.

This broad domain encompasses an extensive set of technologies and concepts that can be taught in various ways. Current research in this domain covers both technical aspects (secure programming, network security, offensive security, cryptography, etc.) and human aspects (privacy, social engineering, cyber law, ethics, etc.). In addition, one of the key challenges is to ensure that the methods for teaching and learning in this domain are adapted to suit the specific context. This field is somewhat unique in terms of its cross-cutting multi-disciplinary nature. A further challenge is therefore to inculcate the principles of information and cybersecurity into even the most basic and entrylevel courses.

A panel discussion during WISE11 highlighted some of the main challenges of building national cybersecurity workforces. These included how to estimate the size and make-up of national cybersecurity workforces based on needs; how to characterise such workforces; and how to achieve balance between employing organisation's priorities and national needs. During this panel discussion it was also noted that these challenges and the role of educational institutions in addressing the cybersecurity skills gap may differ across nations.

In 2017, a joint task force developed guidelines for undergraduate cybersecurity education programs. The resulting document, the Cybersecurity Curricula 2017 [START_REF]Cybersecurity Curricula 2017 -Curriculum Guidelines for Post-Secondary Degree Programs in Cybersecurity[END_REF], addressed academic aspects of some of these challenges regarding the cybersecurity workforce and skills demand.

Further challenges will include the use of online technologies (for example, MOOCs) to share information and cybersecurity teaching and learning content and how training programs and academic education programs can work together to provide both practical experience and a deeper understanding of why the practical material works. This way, practitioners can adapt their knowledge and experience to circumstances beyond that covered in the training and in their environment, and academics can better understand the problems encountered in practice, and learn how to prevent those problems or handle them.

As noted above, the need for cybersecurity is generally understood. But its practice must be balanced with the cost in financial and human terms, and all too often the latter dominates the need. The need to strike an appropriate balance, and how to do so, will dominate much of the field in the near future.

5.3

The value of research

The challenges of behavioral compliance are focused on the adoption and use of protective security practices by individuals seeking to benefit themselves or their firms, or to avoid any negative consequences that may occur from non-adoption or misuse of security procedures and methods. Substantial research efforts have focussed on policy related compliance, but other forms of compliance, such as digital warnings, communicated alerts, and compliance with emerging technical standards have also appeared more recently. It is likely that this area of focus will continue to be of great interest for the foreseeable future. Another primary challenge of interest is the problem of risk management. As described in the MIS Quarterly curation [START_REF] Hui | Securing Digital Assets[END_REF], the problem of risk management by security scholars has been mostly approached from a normative lens. Research over the years has addressed risk management through a variety of frameworks, models, and management techniques, with focused efforts made toward the extension and contextualization of managerial frameworks and theories that help to measure and control risk at the individual level.

Moving forward, emerging challenges such as neurosecurity (neurophysiological data collection), forensics analysis, and the behavioral analysis of design science treatments that enhance or balance security and privacy trade-offs will be explored. There is a new scale and scope of organizational and managerial challenges that are created by the growing prevalence of advanced persistent threats, securing blockchain data structures, protecting privacy in big data analytics, and the looming potential of commercial cyberspace collisions between defensive AI and offensive AI, and the cryptanalysis capabilities of quantum computing.

6

Future opportunities

Many of the areas discussed in the chapter serve to highlight opportunities for future research, and the Working Group agendas will be shaped accordingly. Space does not permit all of them to be catalogued and explored in this chapter, the magnitude of the challenge can be illustrated by homing in on a single area and looking at the issues that the related Working Group has identified as requiring attention. To this end, we present an example of some issues from WG11.5 in relation to IT auditing. Organizations are turning into open and global digital factories that are built around customer experience, speed, agility, mobility, cost, automation, connectivity, and accuracy to drive success. Given this present and future reality, IT auditing can no longer be a profession that suffices with a tick-in-the-box examination without a clear orientation. To provide digital value and capture it we provide a House of IT Auditing, Fig. 1. The House of IT Auditing includes three main components of IT audit research that we consider the main areas of interest. The first area is concerned with the foundation of the profession: technology (e.g. cloud and digital platforms). It is put right at the center of business models, thereby becoming the beating heart and the base of modern organizations. The second component is related to the strategic pillars linked to the foundational developments: cybersecurity, analytics, and regulatory. Being exposed to serious dangers, data-minded, and subject to laws and regulations are simply accepted as facts of today's life. The third and last component pertains to the professional support that can be provided to make a desired and recognized contribution. It is about the delivery of support in the areas of most need: assurance, advisory, and financial audit.

Conclusions

The collective challenges across these areas are considered to be of increasing importance, especially in the context of emerging technologies (e.g. Cloud, IoT) that collect and analyse large data collections, and serve to further amplify the potential for impact in the event of security incidents and breaches. At the same time, there are also potential solutions that can work across the areas, such as the potential for AI technology to defend the human user from malicious hackers, rather than the human trying to recognize malicious intent. This in turn has the potential to serve and support the business objective in terms of effective governance and compliance.

8 ‡ Anirban Basu works at Hitachi R&D within Hitachi Ltd. The views, opinions, and/or findings contained in this article are those of the authors. These are not related to work at Hitachi and should not be interpreted as an official Hitachi position, policy, or decision, unless so designated by other documentation.

  Security requirements engineering • Secure Service Architectures and Design • Security support in programming environments • Service composition and adaptation • Runtime verification and enforcement • Risk and Cost-aware Secure Service Development • Security assurance and certification • Quantitative security for assurance

Fig. 1 .

 1 Fig. 1. House of IT Auditing.

Acknowledgments

We would like to acknowledge the contributions from working group officers and members in addition to the named authors of this chapter. Specifically: Raja Naeem Akram, Kam-Pui Chow, Richard George, Konstantinos Markantonakis, Gilbert Peterson, Damien Sauveron and Sujeet Shenoi.