Pedro Mercader
email: pedro.m@technion.ac.il

Daniel Rubin
email: rubdaniel@campus.technion.ac.il

Hoai-Nam Nguyen
email: hoai-nam.nguyen@ifp.fr

Alberto Bemporad
email: alberto.bemporad@imtlucca.it

Olof Gutman

Simple Interpolating Control

Keywords: Constrained control, uncertain linear systems, interpolation algorithms, predictive control, state feedback, robust stability

We present a new simple approach to extend the admissible region of a saturated control law for discrete-time linear systems under state and input constraints. The approach is based on the interpolation of a given, performance driven, control law and a low-gain controller. The latter is designed such that its admissible set has maximum volume. The interpolation does not require on-line numerical optimization, and an analytical formula for the controller is given.

Several numerical examples are presented to illustrate the control technique.

INTRODUCTION

A great deal of literature exists on the control of discretetime constrained plants. Relevant approaches include Model Predictive Control (MPC), described in e.g. [START_REF] Mayne | Model predictive control: Recent developments and future promise[END_REF], and Vertex Control, described in e.g. [START_REF] Gutman | Admissible sets and feedback control for discrete-time linear dynamical systems with bounded controls and states[END_REF]. In recent decades, MPC has become a leading control method in industry, and has received large academic interest; see e.g. [START_REF] Maciejowski | Predictive control: with constraints[END_REF], [START_REF] Rossiter | Model-Based Predictive Control: A Practical Approach[END_REF], and [START_REF] Borrelli | Predictive control for linear and hybrid systems[END_REF]. MPC offers a systematic approach to control multivariate constrained systems, however it requires online optimization at each time step. This limitation can be overcome by explicit MPC methods where an optimal control law at each state-space region is precomputed off-line [START_REF] Bemporad | The explicit linear quadratic regulator for constrained systems[END_REF], and by specialized optimization tools [START_REF] Wang | Fast model predictive control using online optimization[END_REF]. These algorithms, combined with tailored hardware [START_REF] Jerez | FPGA implementation of an interior point solver for linear model predictive control[END_REF], can decrease computation times and allow the implementation of MPC in fast dynamical systems.

The above nominal MPC algorithms are unable to guarantee robust stability and performance for uncertain systems. There exist robust MPC methods, such as the the linear matrix inequalities (LMIs) based MPC in [START_REF] Kothare | Robust constrained model predictive control using linear matrix inequalities[END_REF], the tube-based MPC in [START_REF] Langson | Robust model predictive control using tubes[END_REF], and the min-max MPC approach in [START_REF] Bemporad | Minmax control of constrained uncertain discrete-time linear systems[END_REF]. These may demand the on-line solution of large optimization problems, for the first two methods, or solving a point location problem in a large polyhedral partition, for the last mentioned method. Robust MPC methods thus

The first and second authors acknowledge the support from the Israel Ministry of Transport, and General Motors Company, respectively.

require excessive computational load, and therefore are impractical for implementation.

Interpolation based approaches allow the use of simpler algorithms, applicable for the same type of problems as MPC. Although no optimality of some cost function is guaranteed, these algorithms provide a good compromise between computational load, feasible region, and performance. A variety of interpolation based methods, closely related to MPC, are presented in [START_REF] Rossiter | Interpolation methods in model predictive control: an overview[END_REF]. An alternative is the recently developed Interpolating Control (IC) method by [START_REF] Nguyen | Implicit improved vertex control for uncertain, time-varying linear discrete-time systems with state and control constraints[END_REF]; [START_REF] Nguyen | Constrained Control of Uncertain, Time-Varying, Discrete-Time Systems[END_REF].

In IC, a high performance local controller is blended with low-gain global controllers, which are used to enlarge the domain of attraction. The interpolation makes use of the constraint-admissible invariant sets given by the local and global control laws. If polyhedral sets are used to describe the invariant sets, IC requires the solution of a single linear program (LP) at each time instant to derive a robustly stabilizing solution. However, the computation of such invariant sets for high-order systems and for systems with polytopic uncertainty is sometimes impractical from a computational perspective. The same issue goes with other polyhedral invariant set based interpolating methods such as the one in [START_REF] Pluymers | Interpolation based MPC for LPV systems using polyhedral invariant sets[END_REF]. The complexity of polyhedral invariant sets may motivate the use of the easily computed and stored ellipsoidal sets of the interpolation instead, as presented in [START_REF] Nguyen | Constrained interpolation-based control for polytopic uncertain systems[END_REF]. However, in that case the solution of a semidefinite program (SDP) at each time instant is required. This work presents a remarkably simple alternative for interpolation between two saturated control laws: a high-gain performance-driven control law and a low-gain control law. The interpolation makes use of the properties of the corresponding invariant sets for each law.

PRELIMINARIES

Consider the uncertain and/or time-varying linear discretetime system modeled by

x(k + 1) = A(k)x(k) + B(k)u(k)
(1) where x(k) ∈ R n is the state and u(k) ∈ R m is the control input. These signals are constrained by polytopes, assumed symmetrical w.r.t. the origin,

x(k) ∈ X ={x ∈ R n : Lx ∞ ≤ 1}, (2a) u(k) ∈ U ={u ∈ R m : u ∞ ≤ u max }, (2b) where L ∈ R nc×n and u max ∈ R m .
The matrices A(k) ∈ R n×n and B(k) ∈ R n×m are given with polytopic uncertainty as follows

A(k) = s i=1 α i (k)A i , (3a)
B(k) = s i=1 α i (k)B i , (3b)
s i=1 α i (k) = 1, α i (k) ≥ 0, ∀i = 1, . . . , s, (3c)
where α i (k) is unknown, and possibly time-varying. A more general form of polytopic uncertainty with different summations and indices in (3a) and (3b) can be brought to the form (3) [START_REF] Nguyen | Implicit improved vertex control for uncertain, time-varying linear discrete-time systems with state and control constraints[END_REF].

Before presenting the main results, notation and preliminary results related to invariant theory are given. The function sat(•) is used to denote the standard vector valued saturation function, for u ∈ R m , the i-th component of sat(u) is sign(u i ) min(u max , |u i |). An ellipsoid defined by a positive definite matrix P is denoted as E(P ) = {x :

x P -1 x ≤ 1}. Definition 1. An ellipsoid E(P ) is said to be robustly invariant with respect to the constrained system (1) and a given feedback control law u(k) = sat(Kx(k)) if x(k + 1) P -1 x(k + 1)x(k) P -1 x(k) ≤ 0 (4) for all x(k) ∈ E(P ) and E(P ) ⊂ X . If inequality (4) is strict, and is satisfied for any x(k) ∈ E(P ) with x(k) = 0, the ellipsoid E(P ) is called a robustly contractive ellipsoid.

Several methods for the computation of ellipsoidal invariant sets for saturated control laws exist in the literature. One example is the approach in [START_REF] Hu | Analysis and design for discrete-time linear systems subject to actuator saturation[END_REF], where the saturation non-linearity is modeled by linear difference inclusions (LDIs), and computation is done by the solution of an LMI problem. We note that these methods can be adapted to synthesize the saturated control law such that the associated ellipsoidal invariant sets is maximized [START_REF] Hu | Analysis and design for discrete-time linear systems subject to actuator saturation[END_REF].

MAIN RESULTS

The method proposed in this work relies on two saturating linear control laws, and two robustly contractive ellipsoids associated to these control laws. We consider a given robustly stabilizing controller, designed to satisfy a given performance requirement, u(k) = sat(K a x(k)). This control law is associated with a robustly contractive ellipsoid E(P a ). To extend the feasible region of the control law to be admissible outside E(P a ), a second controller u(k) = sat(K b x(k)) is synthesized such that the volume of its associated robustly contractive ellipsoid, E(P b ), is maximized. It is assumed that E(P a ) ⊂ E(P b ), as depicted in Fig. 1. Note that this maximization depends on the level of conservatism of the method used to estimate the robustly contractive ellipsoids. These two controllers are denoted as inner and outer, respectively.

The problem at hand is how to blend these two controllers in a way that the resulting controller can be applied for any state in E(P b ) \ E(P a ), with superior performance to the outer controller alone, and the inner controller in E(P a ), while avoiding chattering that often occurs when switching between controllers in the presence of noisy measurements. An Interpolating Controller that addresses all these issues, including proof of recursively feasibility and asymptotic stability, was presented in [START_REF] Nguyen | Constrained interpolation-based control for polytopic uncertain systems[END_REF]; it however requires the solution of an SDP at every time step. That limits the applicability of the method and calls for a more computationally efficient alternative.

The controller proposed here is equal to the inner when the state belongs to E(P a ); otherwise, it is based on interpolation between the inner and the outer controller. Any state x(k) ∈ E(P b ) \ E(P a ) can be decomposed as

x(k) = c(k)x b (k) + (1 -c(k))x a (k), (5) where x a (k) ∈ E(P a ), x b (k) ∈ E(P b ) and 0 ≤ c(k) ≤ 1.
Applying the same decomposition on the control signal yields

u(k) = c(k)u b (k) + (1 -c(k))u a (k), (6) with u a (k) = sat(K a x a (k)) and u b (k) = sat(K b x b (k)).
In terms of performance, it is desirable to have c(k) as small as possible which makes the inner (high-performance) controller dominant. Unfortunately, the problem of finding the minimum interpolation coefficient c(k) as well as the corresponding states x a (k) and x b (k) requires the solution of an SDP at every time step [START_REF] Nguyen | Constrained interpolation-based control for polytopic uncertain systems[END_REF]. With the aim of reducing the computational burden, we resort to a sub-optimal approach to perform the interpolation.

Under the assumption that E(P a ) ⊂ E(P b ), it is possible to select x a (k) and x b (k) on the same ray from the origin to x(k), as illustrated in Fig. 1

.Thus x a (k) = x(k)/a(k) where a(k) > 1 is given by a(k) 2 = x(k) P -1 a x(k). (7) Similarly, x b (k) = x(k)/b(k) where b(k) ≤ 1 is obtained as b(k) 2 = x(k) P -1 b x(k).
(8) Then, from (5) the interpolation coefficient is found as

c(k) = b(k)(a(k) -1) a(k) -b(k) . (9)
It is easily checkable that c(k) ∈ (0, 1] for any x(k) ∈ E(P b ) \ E(P a ). Note also that c(k) = 0 ∀x(k) ∈ E(P a ). Theorem 2. The control law ( 6) -( 9) is feasible for all x(k) ∈ E(P b ), i.e., u(k) ∞ ≤ u max and x(k + 1) ∈ E(P b ).

Proof. The proposed control action satisfies

x 1

x 2

x b x

x a E(P b )

E(P a ) Fig. 1. Illustration of the interpolation concept. u(k) ∞ = c(k)sat(K b x b (k))+(1-c(k))sat(K a x a (k)) ∞ ≤ c(k) sat(K b x b (k)) ∞ + (1 -c(k)) sat(K a x a (k)) ∞ = u max .
The state evolves under the proposed controller as

x(k + 1) = c(k) (A(k)x b (k) + B(k)u b (k)) + (1 -c(k)) (A(k)x a (k) + B(k)u a (k)) . We also have that A(k)x b (k) + B(k)u b (k) ∈ E(P b ), A(k)x a (k) + B(k)u a (k) ∈ E(P a
), E(P a ) ⊂ E(P b ). Therefore, it follows easily that x(k + 1) ∈ E(P b ).

2

Unfortunately, the proposed controller is not guaranteed to be asymptotically stabilizing. We present an example where the closed-loop system exhibits a limit cycle, see Example 1 below. The following result states that it is possible to check the asymptotic stability of the resulting closed-loop system by analyzing an uncertain discrete-time systems with convex polytopic uncertainty,

x(k + 1) = A c (k)x(k), (10
) where A c (k) belongs to a polytopic set defined by the 2 m+1 s vertices

A i + B i D j K a + D - j H a , (11a)
A i + B i D j K b + D - j H b , (11b) i = 1, 2, . . . , s, j = 1, 2, . . . , 2 m .
(11c) Here, D j denotes the j-th element of the set of diagonal matrices of dimension m whose diagonal elements are either 1 or 0, D - j = I m -D j , H a x(k) ∞ ≤ u max for all x(k) ∈ E(P a ) and H b x(k) ∞ ≤ u max for all x(k) ∈ E(P b ). Stability conditions for system with time-varying polytopic uncertainty have been presented in the literature, see e.g. [START_REF] Daafouz | Parameter dependent Lyapunov functions for discrete time systems with time varying parametric uncertainties[END_REF]; [START_REF] Geromel | Robust stability of time varying polytopic systems[END_REF]. So, if (10), ( 11) is asymptomatically stable by e.g. [START_REF] Daafouz | Parameter dependent Lyapunov functions for discrete time systems with time varying parametric uncertainties[END_REF], then the closed loop interpolating control system is asymptotically stable with any c(k). Another sufficient stability result, based on Hu and Lin ( 2001) is given in Theorem 3 below.

Remark: An alternative way to enhance the closed-loop stability is to fix, e.g., an inner control law, then solve an LMI optimization problem to obtain an outer one. Theorem 3. The closed-loop system composed by the constrained system (1) and the controller ( 6) -( 9) is asymptotically stable if the uncertain discrete-time systems with convex polytopic uncertainty (10) -( 11) is asymptotically stable.

Proof. The proof is a straightforward extension to the two-gain-case of (Hu and Lin, 2001, Proposition 7.5.1). The controller ( 6) -( 9) is given by

u(k) = c(k) sat K b x(k) b(k) + (1 -c(k)) sat K a x(k)
a(k) A saturated linear controller can be modeled using LDIs [START_REF] Hu | Analysis and design for discrete-time linear systems subject to actuator saturation[END_REF], the inner controller is modeled as sat

(K a x(k)/a(k)) ∈ a(k) -1 conv{D j K a x(k) + D - j H a x(k)}, j = 1, 2, . . . , 2 m , H a x(k) ∞ ≤ u max ∀x(k) ∈ E(P a ). The outer controller is modeled as sat(K b x(k)/b(k)) ∈ b(k) -1 conv{D j K b x(k) + D - j H b x(k)} j = 1, 2, . . . , 2 m H b x(k) ∞ ≤ u max ∀x(k) ∈ E(P b ). Noting that c(k)/b(k) + (1 -c(k))/a(k) = 1, it is possible to write u(k) = K(k)x(k)
where K(k) belongs to a polytopic set defined by the 2 m+1 vertices:

D j K a + D - j H a D j K b + D - j H b j = 1, 2, . . . , 2 m
Therefore, the resulting closed-loop system can be modeled as the uncertain discrete-time system with convex polytopic uncertainty given by ( 10) -( 11).

Example 1

This example presents a case where the controller ( 6) -( 9) exhibits a limit cycle, i.e. the closed-loop system is not asymptotically stable for all initial conditions in E(P b ). Let us consider the constrained system

x(k + 1) = Ax(k) + Bu(k), -10 ≤ x 1 ≤ 10, -10 ≤ x 2 ≤ 10, -1 ≤ u 1 ≤ 1, -1 ≤ u 2 ≤ 1, with A = -0.2 0.2 -2.0 -0.2 , B = 1 0 0 1 .
The inner and outer controller are given as

K a = 0.1 -2.2 2.2 0.1 , K b = 0.1 0 0 0.1 ,
and their associated ellipsoidal contractive sets are given by P a = 20.6631 -0.1375 -0.1375 5.0901 , P b = 24.6440 0.0052 0.0052 99.9995 .

For the sake of simplicity, these ellipsoidal contractive sets have been obtained for the linear controllers, i.e.

u a (k) = K a x a (k) and u b (k) = K b x b (k).
We note that A + B(K a + K b )/2 has the eigenvalue -1 and that the evolution of the system is given by

x(k + 1) = A + B 1 -c(k) a(k) K a + c(k) b(k) K b x(k)
Therefore, an initial condition placed along the eigenvector associated with the eigenvalue -1 in such a way that 1-c( 0) 0) b(0) = 0.5 will exhibit a limit cycle. The initial condition x(0) = [2.7685 2.7685] satisfies the above condition, and it exhibits a trajectory that alternates between the states [2.7685 2.7685] and [-2.7685 -2.7685] .

a(0) = c(

Example 2

Consider the following constrained system from [START_REF] Nguyen | Fast constrained LQR based on MPC with linear decomposition[END_REF] to be regulated to the origin

       x(k + 1) = 1 1 0 1 x(k) + 0.42 0.90 0.38 0.67 u(k), -40 ≤ x 1 ≤ 40, -10 ≤ x 2 ≤ 10, -0.1 ≤ u 1 ≤ 0.1, -0.1 ≤ u 2 ≤ 0.1. (12)
The proposed control technique, defined by ( 6) -( 9), is applied by considering a saturated LQR controller with weightings Q = I 2 and R = 30I 2 as the inner controller, and a saturated linear controller that maximizes the volume of the robustly contractive ellipsoid for the given constrained system (12) as outer controller. The outer controller is defined by the gain K b = -0.0430 -1.7220 -0.0271 -0.9796 .

For comparison purposes, a dual mode, infinite prediction horizon MPC controller [START_REF] Mayne | Constrained model predictive control: Stability and optimality[END_REF] was also simulated. The MPC was designed to achieve identical behavior as the LQR above within its terminal set by using the same weightings Q and R, and the corresponding terminal weight. The prediction horizon was set to 75 for it to have a feasible set equal to the maximum control invariant set that includes E(P b ). Both controllers were simulated for a set of 629 equiangular initial conditions along the boundary of E(P b ). Performance was measured in terms of the cost function

J = ∞ k=1 x (k)Qx(k) + u(k)Ru(k).
The histogram for the ratio between the cost functions of the MPC and the proposed controller is shown in Fig. 3. Fig. 4 shows the states and control inputs corresponding to the initial condition x(0) = [2.5429 2.5429] for both controllers, i.e. MPC and controller ( 6) -( 9).

We note that the proposed controller is (slightly) penalized in terms of feasible set (see Fig. 2) and performance (see Fig. 3 and4). On the other hand, the computational burden of the new controller is practically negligible, since neither numerical optimization nor a point-location algorithm in a polyhedral partition is needed.

Another benefit of the proposed controller is that the feasible set, E(P b ), is obtained a priori, off-line, by solving an LMI, while no efficient method is known to obtain this for MPC or standard polytopic IC, at least for highdimensional and/or uncertain systems. In many practical such cases, the already designed MPC would require a check of convergence to the setpoint for any given initial condition. However, practitioners usually skip this check ("play and pray").

Example 3

Consider the following constrained uncertain system from [START_REF] Nguyen | Model predictive control for constrained uncertain, time-varying systems[END_REF],

x(k + 1) = A(k)x(k) + B(k)u(k), -10 ≤ x 1 ≤ 10, -10 ≤ x 2 ≤ 10, -1 ≤ u ≤ 1. ( 13
)
The matrices A and B are given as

A(k) = α(k)A 1 + (1 -α(k)) A 2 , B(k) = α(k)B 1 + (1 -α(k)) B 2 , with A 1 = 1 0.1 0 1 , B 1 = 0 1 , A 2 = 1 0.2 0 1 , B 2 = 0 1.5 .
It is assumed that α(k) ∈ [0, 1] is an unknown, timevarying, uniformly distributed random number. The highgain control gain is chosen as The presented approach is compared with the LMI based infinite-horizon robust MPC method in [START_REF] Kothare | Robust constrained model predictive control using linear matrix inequalities[END_REF] with the weights Q 1 = I 2 and R = 1. Fig. 5 shows the states and control inputs obtained from a numerical simulation for the initial condition x(0) = [-3.95 9.80] over 30 time samples. Fig. 6 shows the trajectory for the same simulation, plotted together with the ellipsoidal invariant sets E(P a ) and E(P b ), and the feasible set for the MPC denoted by Ω. The presented method is shown to give faster convergence times than MPC and share very similar feasible sets. The major difference is, obviously, the computational burden: The MPC algorithm requires the solution of an SDP at each computation time. Here the SPDs were computed using the Yalmip modeling package [START_REF] Löfberg | YALMIP: A toolbox for modeling and optimization in MATLAB[END_REF] and Mosek (Mosek ApS, 2017), and their worst-case computation time took approximately 93 ms (15 ms on average). Our approach requires no solvers, and was executed in under 0.16 ms (0.04 ms on average) on the same platform.

CONCLUSION

This paper presents a new control approach for discretetime uncertain linear systems subjected to state constraints and actuator saturation. The presented approach is based on the interpolation of two saturated control laws. It is remarkably easy and simple to implement and gives reasonable trade-off between performance, feasible region size and computational load, in comparison to other interpolation based approaches and MPC. These benefits were demonstrated by two numerical examples.

In comparison with MPC, it should be noted that the presented method will obviously not give better performance in terms of the MPC criterion, but will always give a solution when the state is in the precomputed feasible ellipsoid. When using MPC, its feasible region is in general not precomputed since it is a highly demanding or even impossible task, see [START_REF] Rubin | Computation of polyhedral positive invariant sets via linear matrix inequalities[END_REF]. Note that, in general, our ellipsoidal feasible region may not be a subset of the MPC feasible region. Therefore, with a given measured state, the MPC is not guaranteed to give a solution even if that state belongs to our ellipsoid. Moreover, the new Simple Interpolating Control demands less computational effort.

Future development of the proposed method will include disturbance attenuation, output feedback, and reference tracking. Currently under development is an extension that has a built-in closed loop asymptotic stability guarantee; Theorem 3 will be thrown out to the garbage heap of history.

  three examples that serves to show the properties of the presented controller. A pathological case is presented in Example 1. The usage and the benefits of the presented algorithm is shown in the other examples.

Fig. 2 .Fig. 3 .

 23 Fig. 2. Set of valid initial conditions for MPC (gray polyhedron) and proposed controller (black ellipsoid E(P b )) in Example 2.

Fig. 4 .

 4 Fig. 4. States and control inputs for MPC (gray) and proposed controller (black) in Example 2. K a = [-1.1717 -0.9542] . The low-gain controller was computed such that E(P b ) has maximal volume, and its gain is K b = [-0.1525 -0.7780] .The presented approach is compared with the LMI based infinite-horizon robust MPC method in[START_REF] Kothare | Robust constrained model predictive control using linear matrix inequalities[END_REF] with the weights Q 1 = I 2 and R = 1.

Fig. 5 .Fig. 6 .

 56 Fig. 5. States and control input results for Example 3. Proposed approach (black) vs. the approach in Kothare et al. (1996) (gray).


Pavol Mulinka

Sarah Wassermann

Gonzalo Marín

Remember the Good, Forget the Bad, do it Fast Continuous Learning over Streaming Data

Continuous, dynamic and short-term learning is an effective learning strategy when operating in very fast and dynamic environments, where concept drift constantly occurs. In an on-line, stream learning model, data arrives as a stream of sequentially ordered samples, and older data is no longer available to revise earlier suboptimal modeling decisions as the fresh data arrives. Learning takes place by processing a sample at a time, inspecting it only once, and as such, using a limited amount of memory; stream approaches work in a limited amount of time, and have the advantage of performing a prediction at any point in time during the stream. We focus on a particularly challenging problem, that of continually learning detection models capable to recognize cyber-attacks and system intrusions in a highly dynamic environment such as the Internet. We consider adaptive learning algorithms for the analysis of continuously evolving network data streams, using a dynamic, variable length system memory which automatically adapts to concept drifts in the underlying data. By continuously learning and detecting concept drifts to adapt memory length, we show that adaptive learning algorithms can continuously realize high detection accuracy over dynamic network data streams.

Introduction

The application of learning models to network security problems is generally addressed as an off-line learning task, where models are trained once and then applied to the incoming stream of samples. This approach is very restrictive when dealing with highly dynamic environments, where concept drift occurs often and previous knowledge rapidly becomes obsolete. We therefore propose an online, stream learning approach for learning-based network security; stream learning consists of processing a data instance at a time, inspecting it only once, and as such, using a limited amount of memory. To understand the adaptability properties of different stream-learning schemes, we implement and test two popular adaptive learning algorithms on the detection of multiple types of network attacks, using real network measurements: Hoeffding Adaptive Trees (HAT) and Adaptive Random Forests (ARF) models.

We implement these models using a continually adaptive memory length, window-based approach known as ADWIN (ADaptive WINdowing) [START_REF] Bifet | Learning from time-changing data with adaptive windowing[END_REF]. In a nutshell, ADWIN maintains a memory window of variable size containing training samples. The algorithm automatically grows the window when no change is apparent, and shrinks it when the statistical properties of the stream changes. ADWIN automatically adjusts its window size to the optimum balance point between reaction time and small variance; for the sake of completeness, we also consider fix-length memory windows, of different lengths. Within the data stream mining domain, the most used evaluation scheme is known as the prequential or interleaved-test-then-train evolution. The idea is very simple, using each instance first to test an initial or bootstrapped model, and then to train or update the corresponding model, if decided by a particular rule, in general a performance-based threshold based on model accuracy. Prequential evaluation can be used to measure the accuracy of a model since the start of the evaluation, by keeping in memory all previous history of instances and evaluating the model in each new instance, but it is generally applied using sliding windows or decaying factors, which forgets previously seen instances in the model update process and focuses on those instances in current sliding window. Different from more traditional fold-cross validation, generally used in the evaluation of off-line learning models, the weakness of the prequential evaluation is in general its inherent operation on single experiment runs.

We evaluate the proposed algorithms following two new strategies to evaluate stream-based algorithms: prequential k-fold cross validation [START_REF] Bifet | Efficient online evaluation of big data stream classifiers[END_REF] and prequential Area Under the ROC Curve (AUC) [START_REF] Brzezinski | Prequential auc: properties of the area under the roc curve for data streams with concept drift[END_REF]. Prequential k-fold cross validation is basically an adaptation of cross-validation to the streaming setting. As evaluation metric, we simply take the model detection accuracy. Prequential AUC is an extension of the AUC metric, which is very simple to understand and informative, and provides more reliable comparisons when dealing with imbalanced data. We rely on an efficient incremental algorithm that uses a sorted tree structure with a sliding window to compute the prequential AUC using constant time and memory [START_REF] Brzezinski | Prequential auc: properties of the area under the roc curve for data streams with concept drift[END_REF].

Related Work

The data stream learning domain has a long standing tradition and many interesting references are worth mentioning when considering the application and evaluation of stream learning models; these cover general problems related to the learning properties for stream-based algorithms [Domingos andHulten, 2001, Stonebraker et al., 2005], the mining and evaluation processes when dealing with massive datasets [START_REF] Hulten | Mining massive data streams[END_REF], the identification of model evaluation issues [START_REF] Gama | Issues in evaluation of stream learning algorithms[END_REF] as well as propositions of general frameworks for data streaming [START_REF] Gama | On evaluating stream learning algorithms[END_REF]. Of particular relevance for stream learning model evaluation are the problems of imbalanced classes and concept drift, which are extensively addressed in [START_REF] Hoens | Learning from streaming data with concept drift and imbalance: an overview[END_REF].

Adaptive Stream Learning

The analysis of stream-based learning models on the detection of different types of network attacks is performed on real network traffic measurements collected at the WIDE backbone network, using the MAWILab dataset for attacks labeling [START_REF] Fontugne | Mawilab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking[END_REF]. MAWILab uses a combination of four traditional anomaly detectors to partially label the collected traffic. Attacks include DDoS attacks (DDoS), Flooding attacks (Flooding), distributed network scans (Scan) and flashcrowds (Flash).

A commonly applied approach to evaluate the performance of stream-based algorithms is to benchmark them against their corresponding off-line, batch implementations. Therefore, we use as baseline the results corresponding to batch-based algorithms, including Hoeffding Tree (HT-batch) and Random Forest (RF-batch). We subtract the batch metric results from the prequential results to show the performance of stream algorithms in comparison to their batch versions.

To perform the analysis in a stream-based manner, we split the traffic traces in consecutive time slots of five seconds each, and compute a set of features describing the traffic in each of these slots. In addition, each slot i is assigned a label l i , consisting of a binary vector l i ∈ R 4×1 which indicates at each position if attack of type j = 1..4 is present or not in current time slot. We compute a large number n = 245 of features describing a time slot i = 1..m, using traditional packet measurements.

Dynamic Memory Length with ADWIN

One of they key features of a stream-based learning model is that of continuously adapting to the changes on the underlying statistics describing current data under analysis, by periodically re-training or re-calibration. To deal with such changing data, one needs to define strategies for: firstly, detecting when changes occur; secondly, decide which data to use for a subsequent model Figure 3: Prequential 10-fold cross evaluation, using detection accuracy as performance metric.

Values above zero show when the stream algorithm performance exceeds the batch result. Concept drifts are marked with dashed lines.

re-calibration (or, more in general, keeping updated sufficient statistics); and finally, re-train or recalibrate the model when significant change has been detected. Most strategies use variations of a simple sliding window approach, where a memory window containing the most recent measurements is kept and constantly updated, removing older measurements based on some specific criteria.

1: initialize window W 2: for each t > 0 do 3: W ← W ∪ {xt} (add xt to the head of W ) 4:

repeat drop instances from the tail of W 5:

until μW 0 -μW 1 ≥ holds for every 6:

split of W = W0 • W1 7:

return μW 8: end for The ADWIN algorithm keeps a sliding window W with the most recently observed measurements x i . At each time t, instance x t is generated according to an unknown probability distribution D t . Let µ t be the expected value of x t when it is generated according to D t . Naturally, µ t is unknown for all t. Let n be the length of W , μW the (computed) average of the measurements in W , and µ W the (unknown) average of µ t for t ∈ W . The idea of ADWIN is straightforward: whenever two large enough sub-windows of W exhibit distinct enough averages, we conclude that the corresponding expected values are different, and the older portion of the window is dropped. More specifically, as depicted in Figure 1, μW0 and μW1 are the averages of the instances in W 0 and W 1 respectively. ADWIN is therefore a simple statistical test for different distributions in W 0 and W 1 , which checks whether the observed average in both sub-windows differs by more than the threshold . This threshold is defined based on the global error δ of the statistical test and the lengths n 0 and n 1 of the corresponding sub-windows.

Concept Drift Detection

An important element to deal with when working with stream learning is the so-called concept drift; it happens when the statistical properties of the analyzed dataset abruptly shift in time. To detect concept drifts, we apply a standard statistical test for change detection known as the Page-Hinkley test, commonly used for change detection in time series analysis. Figure 2 depicts the cumulative number of changes observed in the dataset, as well as the times when those changes are detected. Concept drifts permit to better understand when and why the window size of the ADWIN algorithm changes along time.

3

Figure 1 :

 1 Figure 1: The ADWIN algorithm.

Figure 2 :

 2 Figure 2: Page-Hinkley Concept Drift Detection.

Experiments

We evaluate the performance and behavior of the algorithms in four binary classification variantsone for each attack type, resulting in four sets of results for each tested algorithm. Figure 3 reports the performance results for each attack type, considering detection accuracy as performance metric, and using the batch-algorithms accuracy as baseline. Here we take the ADWIN version of the algorithms, using an adaptive memory size. The prequential 10-fold cross-validation shows that the Adaptive Random Forests (ARF) model rapidly converges to the batch-based accuracy results, with minimum performance variations under concept drifts. On the other hand, the HAT model does not show any apparent convergence and results tend to oscillate around the batch algorithm baseline.

In the case of HAT we can appreciate the correlation between the detected concept drifts and the performance variations of the model.

Figure 4 shows the prequential AUC values along time -number of samples, considering the batchbased AUC values as baseline. Differently from ADWIN, now we take a fixed-size window length; in particular, we test the dependency of the results on the sliding window size, by setting it to a fraction of the total dataset size: {10%,20%,...,40%,...,100%}, i.e. {270,540,...,1080,...,2700}, i.e., considering 10 independent runs. As expected, we can first observe how increasing the window size smooths performance variations along time. However, as observed before for the case of ADWIN, using smaller or more fine-tuned window sizes can translate into better performance; for example, the HAT model achieves a performance gain of up to 40% (w.r.t. the baseline) when using 10%dataset window size. Indeed, the window size allows to track long or short-term changes better, depending on the tuning.

Concluding Remarks

Dynamic and adaptive-memory-based learning looks a promising learning strategy to adapt to very dynamic environments, where concept drift occurs often. We have compared and analyzed the results from the most recent evaluation approaches for sequential data on commonly used batch-based learning algorithms and their corresponding on-line, stream-based extensions, for the specific problem of on-line network security. Prequential 10-fold cross-validation using ADWIN for dynamic window memory sizing makes a good choice for stream-based algorithm benchmarking in these applications, as it can better track transient changes and concept drifts. Similar results can be obtained by fine-tuning the memory window size, but requires additional calibration efforts. Adaptive learning algorithms can continuously realize high detection accuracy over dynamic network data streams, when dynamically adapting their learning pace and memory to changes in the underlying samples' statistics.


Younes Abid

Abdessamad Imine

Michaël Rusinowitch

Online testing of user profile resilience against inference attacks in social networks

Keywords: Online Social Network (OSN), Inference Attacks, Privacy, Link Disclosure

To increase awareness about privacy threats, we have designed a tool, SONSAI, for Facebook users to audit their own profiles. SONSAI predicts values of sensitive attributes by machine learning and identifies user public attributes that have guided the learning algorithm towards these sensitive attribute values. Here, we present new aspects of the system such as the automatic combination of link disclosure attacks and attribute prediction. We explain how we defined sensitive subjects from a survey. We also show how the extended tool is fully interfaced with Facebook along different scenarios. In each case a dataset was built from real profiles collected in the user neighbourhood network. The whole analysis process is performed online, mostly automatically and with good accuracy. It is 0.79 in AUC when inferring the political orientation.

Introduction

Personal information if revealed may have serious consequences on social network users. This information can be exploited to carry out personalized spam attacks [START_REF] Garrett Brown | Social networks and context-aware spam[END_REF], identity theft attacks [START_REF] Bilge | All your contacts are belong to us: automated identity theft attacks on social networks[END_REF],cloning attacks [START_REF] Kontaxis | Detecting social network profile cloning[END_REF], Sybil attacks [START_REF] Kayes | A survey on privacy and security in online social networks[END_REF], etc. They might cause serious damages to companies such as degradation of reputation, copyright infringement, loss of intellectual property, etc.

Social networks provide several solutions in order to safeguard the privacy of users. However, their main deficiencies are related to complicated, non-uniform, periodically updated and unintelligible privacy policies, long and ambiguous user charters, and non-ergonomic privacy management interfaces. Although most social networks offer similar services (creating profiles, pages and groups, establishing links and interactions), their visibility management and the definition of links (symmetrical, non-symmetrical) are different. These design differences may be confusing for users of multiple social networks that are careless with checking each network settings. Moreover the default parameters promotes public dissemination but increases the risk of sensitive information leakage.

Most importantly, social networks do not provide protection against inference of implicit information. Derived by correlating different public attributes or different public profiles, as in collaborative recommendation, this information is actually the main profit source of social networks' business model as they can be exploited for targeted advertising. Therefore, knowledge accumulated in social networks about users goes beyond what is published and can be a threat to their privacy. In [START_REF] Mason | Politics and culture on facebook in the 2014 midterm elections[END_REF], Winter Mason has mined the cultural similarities between American Facebook users and their political view (Democrats or Republicans). He sampled Facebook users' profiles who liked the campaign pages of some Democrat or Republican politicians. Then, he collected their lists of liked pages. Finally, he statistically identified the page types that are most disproportionately liked by the supporters of one political view versus the other. The results of his work show that politics is highly correlated to musicians, landmarks, authors, books and TV shows.

Contributions. In order to combat privacy leakage, it is important to define which personal information is sensitive. Some researchers consider that all the unpublished values of attributes (masked or not specified) by a given user are sensitive for him [START_REF] Ryu | curso: protect yourself from curse of attribute inference: a social network privacy-analyzer[END_REF][START_REF] Vidyalakshmi | User attribute inference in directed social networks as a service[END_REF]. While others select a few attributes and consider them to be sensitive such as sexual orientation [START_REF] Heatherly | Preventing private information inference attacks on social networks[END_REF], political affiliation [START_REF] Heatherly | Preventing private information inference attacks on social networks[END_REF][START_REF] Conover | Predicting the political alignment of twitter users[END_REF] and age [START_REF] Perozzi | Exact age prediction in social networks[END_REF]. It is also possible to rely on the definition of sensitive information given by law. However, social networks are evolving faster than legislation. For instance, health data were not considered sensitive by the French law of January 6, 19781 related to computers, files and freedoms. It was considered sensitive much later. It is also possible to rely on a definition of sensitive subject given by social media themselves. But can we trust social networks in defining what is sensitive or not as they make most of their profit using personal information for targeted advertising?

Hence, we have first conducted a questionnaire survey to define sensitive subjects based on the behaviour of french Net-surfers. This method has the advantage of being fast, objective, accurate and up-datable. The most sensitive subjects according to Facebook french users who have participated in our survey are Religion, Money, Politics, Dating, Shopping and Health.

Then, we present SONSAI, our application to help Facebook users to protect their privacy. To that end, SONSAI tests a user profile against privacy attacks and tracks their origin. This approach allows one to delimit the perimeter of threats and to design effective countermeasures. Concretely, SONSAI performs online inference attacks on the world largest social network, Facebook. The attacks have been tested by several real volunteer profiles. SONSAI allows users to identify public attributes that are correlated with sensitive attributes and therefore to prevent these attacks by modifying these public attributes. In the context of General Data Protection Regulation (GDPR)2 , promulgated recently by the European Union, to stress on users' control over their personal data, our tool may contribute to increase user awareness as for the risks related to personal data processing.

Outline. In Sec. 2 we discuss the problems. In Sec. 3 we recall some related works. In Sec. 4 we present the result of a survey conducted to identify sensitive subjects. In Sec. 5 we overview the architecture and component functionalities of SONSAI, a tool for users to test their profile against inference attacks. In Sec. [START_REF] Conover | Predicting the political alignment of twitter users[END_REF] we describe experiments on real data. Finally we discuss accuracy of SONSAI attacks in Sec. 7, countermeasures in Sec. 8, and conclude in Sec. 9.

Discussion

Let us discuss briefly the problems that had to be solved in order to design SON-SAI. In order to effectively track privacy leakage, it is important to combine link prediction and attribute prediction. For instance, an adversary can perform link prediction attacks in order to disclose the local network of his target (friends and group members). Then, he can perform more accurate attribute prediction attacks with extra information provided by the discovered local network. Online attribute prediction attacks encompasses two steps: (i) data collection and (ii) data analysis. Data collection must be fast, selective, passive and unnoticed. Since social networks are highly dynamic and contain a huge amount of data, random collection may result in useless data. On the other hand, massive collection is time wasting. A fast and selective sampling algorithm must be used in order to guide the collector toward most relevant data and speed up the process. Moreover, the adversary must limit his interaction with his target. He must perform his attack in a passive way in order to go unnoticed by the target to him. The adversary should only send legal requests to collect data and should not exceed some threshold to remain unnoticed by the social network. Data analysis should be fast, accurate and deal with sparsity. We recall that the system (collection and analysis) is meant to help users safeguard their privacy against real attacks. Hence, data analysis must not exceed a few minutes in order to rapidly put the hand on the origins of threats and quickly put countermeasures into action. Analysis results should be accurate in order to reduce false positive alerts and cover all threats. As the collector only samples a few data from an ocean of them, the analyser should deal with the fact that collected data may be sparse and incomplete.

Related works

In [START_REF] Chester | Social network privacy for attribute disclosure attacks[END_REF] the authors propose to combat attribute prediction attacks in social network by creating new links between users in order to reduce the difference of the distribution of attribute values in the user local network and in the global one. In [START_REF] Heatherly | Preventing private information inference attacks on social networks[END_REF], the authors propose a content&link-based classifier that outperforms both content-based classifiers and link-based classifiers when predicting the political views and the sexual orientation of Facebook users. In addition, they explore the effectiveness of sanitization techniques to prevent such attacks. In contrast to [START_REF] Chester | Social network privacy for attribute disclosure attacks[END_REF], sanitization solutions in [START_REF] Heatherly | Preventing private information inference attacks on social networks[END_REF] consist of removing contents and links. However, selecting the right contents and links to remove or to add without altering the utility of the social network is a challenging task. In our present work we aim to help users to identify the critical attributes that are correlated to sensitive subjects in their communities and that lead to the undesirable inference. It is then up to users to intervene by adding links in order to alter the accuracy of inference due to data disagreement or by deleting links in order to disrupt inferences by lack of data. In [START_REF] Conover | Predicting the political alignment of twitter users[END_REF], the authors design a classifier to predict the political alignment of Twitter users based on the tweet contents and the re-tweet network.They show that such classifiers widely outperform classifiers that are based only on content. Our first tests [START_REF] Abid | Sensitive attribute prediction for social networks users[END_REF] show that some attributes such as political alignment are correlated to the network structure (e.g., friendship links). However, this is not the case for other ones such as gender and relationship status (e.g., married, . . . ). In [START_REF] Zhang | An information extraction attack against on-line social networks[END_REF], the authors introduce an information re-association attack in order to predict the values of sensitive attributes of users. This attack consists in combining web search with information extraction and data mining techniques. This study shows that the attack is more successful when including information about the target university networks. In addition, it shows that Facebook graduated users from top schools are more vulnerable under this attack than random users. In our work, we quantify the correlation between attributes. SONSAI generates inference rules that depends on the behaviours of users in the target neighborood. For instance, SONSAI can automatically decide whether the university networks around the target is an important factor for inference success or not. In [START_REF] Ryu | curso: protect yourself from curse of attribute inference: a social network privacy-analyzer[END_REF] the authors show that an adversary can infer sensitive attribute values of a target based only on the target local network (1-hop friendship network) and the public attribute within it. The proposed predictor takes into consideration the network structure by quantifying the importance of friendship relations. Then, it measures the power of each attribute value according to the importance of the target friend that publishes it. In [START_REF] Gong | Joint link prediction and attribute inference using a socialattribute network[END_REF], the authors extend the attribute-augmented social network model that is introduced in [START_REF] Yin | A unified framework for link recommendation using random walks[END_REF]. In the initial model, attribute values are represented by nodes. The users that publishes a particular value of an attribute are linked to its representing node in the model. The extended model adds negative links between users and their hidden attribute values and mutex links between mutually exclusive values of the same attribute such as male and female. This model is used with both supervised and unsupervised methods to predict links between users as well as links between users and attribute values. In [START_REF] Vidyalakshmi | User attribute inference in directed social networks as a service[END_REF], the authors design a classifier to predict the missing attribute values of a Google+ user. The classifier only takes into consideration users that are one hop distant from the target. In addition to attributes, the designed classifier exploit the direction of links (follower or followings), the type of links (acquaintance, family, friend . . . ) and the tie-strength of the links. In [START_REF] Gong | Attribute inference attacks in online social networks[END_REF], the authors the attribute-augmented social network model [START_REF] Yin | A unified framework for link recommendation using random walks[END_REF] by adding behaviours nodes to the framework.Then, they design a vote distribution attack to predict attribute values. They show that by taking into account social friendship, attributes and behaviours, the accuracy of attacks is considerably increased.

In our work, we analyse the local friendship network of the target (direct friends). When the target hides friends we first perform link disclosure attack with certainty to disclose his local network. This combination of link disclosure (with certainty) and attribute inference coordinated within the same system (fully interfaced with Facebook) seems to be unique. Each attribute is represented by a bipartite graph where edges connect users to the attribute values they like. The system also relies on our previous works: specific graph comparison techniques to measure attribute correlations [START_REF] Abid | Sensitive attribute prediction for social networks users[END_REF], a clustering algorithm to group similar sensitive attribute values (for instance similar politicians) and a shallow neural network to infer semantic proximity between public values and sensitive ones [START_REF] Abid | Two-phase preference disclosure in attributed social networks[END_REF].

Definition of sensitive subjects

We have conducted a questionnaire survey to define sensitive subjects according to the behaviours of french net-surfer. We have analysed the behaviours of 232 users of social media aged between 20 and 78 years that live in 21 different French regions. We have classified the subjects discussed on social media according to four criteria: rate of discussion on social networks, rate of discussion on forums and websites, rate of anonymous publication and avoided subjects. Based on those criteria, we have proposed a definition of sensitive subjects. Sensitive subjects. Let V be the set of avoided subjects, N the set of subjects whose rate of anonymous publications on forums and websites is above average and D the set of subjects whose discussion rate on the forums/websites or3 social networks are below the threshold of the mean of all discussions minus the standard deviation on that media. A discussed subject on social media is sensitive, if and only if, it belong to at least two sets from the defined sets (V , N and D). The most sensitive subjects according to french Facebook users that participate in our survey are Religion, Money, Politics, Dating Shopping and Health. Table 1 details the statistics related to the defined sensitive subjects with regard to the analysed criteria. Additionally, the analysis of the participants behaviours results in the following privacy attack vector statistics:

Category

-52.05% use the same e-mails and 65.75% use the same user-names on different social networks. -90% have the same friends over different networks.

-72.16% do not cleanly delete their profiles when leaving social networks. -15.96% publish photos without asking the consent of people appearing in these photos.

-8.45 % add strangers to their friend lists only because they have common friends. -In a test, 6.10 % are not able to recognize a person added randomly to their friend lists.

SOcial Networks Sensitive Attribute Inference

In this section we detail the SOcial Networks Sensitive Attribute Inference system (SONSAI). Algorithm 1 details the flow of tasks performed by SONSAI in order to detect privacy threats. SONSAI first collects the 1-hop friendship network around the user u and their attributes (lines 1-6). If the user u hides his friend list then SONSAI performs link disclosure attacks as detailed in [START_REF] Abid | Online link disclosure strategies for social networks[END_REF] in order to disclose with certainty some of his friends. The attacker model is passive as the attack does not require interaction with users. The preparation of the link disclosure attack consists of sampling users that have high probability to be friend with u and that publish their friend list. To that end, SONSAI explores the group network at distance 2 from u. After that, it performs friendship and mutual friend disclosure attacks by taking advantages of queries provided by the social networks APIs. A friendship attack consists of disclosing the links between u and the members of the explored groups. A mutual friend attack consists of disclosing the links between u and the friends of the members of the explored groups. The results of our previous study [START_REF] Abid | Online link disclosure strategies for social networks[END_REF] show that about half of Facebook users are exposed to the danger of friendship disclosure through their membership to groups of less than 50 members .

In Section 4 we have identified the most sensitive subjects for french users. Assume a user u wants to check with SONSAI whether a sensitive subject information can be inferred from his profile. He first selects through a Combobox an attribute correlated to these sensitive subjects (line 7). For instance he can select politicians or political parties for Politics subject. Correlation of attributes is quantified by comparing their bipartite graph representation (see [START_REF] Abid | Sensitive attribute prediction for social networks users[END_REF]).

The sensitive attribute is selected from a displayed list of attributes discovered in the user local social network. To simulate an inference attack on the selected sensitive attribute, the user is asked to provide two pieces of information: (i) top_n, the percentage of attributes to be selected for learning and (ii) whether the sensitive attribute values have to be clustered by similarity to reduce the search space (lines 9-11).

SONSAI uses random walks (line 12) and Word2Vec algorithm (line 13) in order to infer the sensitive values of the target based on his preferred values for the selected attributes for learning. The results of the inference attack help the users understand the source of information leakage. SONSAI ranks the list of the selected attribute for learning according to their correlation to the sensitive attributes (line 14).

Finally, SONSAI interacts with the users in order to check the accuracy of the inference (i.e., whether the infered values are correct) and assess the risk of privacy leakage (line 15). Verdicts returned by the SONSAI depends solely on the collected data around the user. This verdict is given as a score quantifying the risk of inferring correct values for a given sensitive attribute. The score is obtained by comparing the ranking of sensitive values to the values that are really liked by user u. We use Area Under the Curve to compute this score. The risk of disclosing values of a sensitive attribute is considered to be high when the score is higher than 65%, moderate when the score is between 50% and 65% and low when the score is less than 50%.

Inference scenarios

In the following we detail two scenarios of inferring the pages of politicians liked by two real Facebook users u 1 and u 2 . Table 2 gives a sample of values of the pages of Musicians/Bands, News/Media Websites and Communities that are liked by u 1 and u 2 . Target u 1 is a french user. He publishes his friend list on Facebook. Target u 2 is a canadian user that hides his friend list. SONSAI performs then link disclosure attack in order to first disclose the friends of u 2 . Then, it crawls the his friendship network and collects the values of attributes liked by his direct friends.

After the analysis, a first table that summarizes the list of the top correlated attributes to the sensitive one is displayed. The correlations are quantified in percentage. A second table presenting sorted values of the sensitive attribute according to the probability they are liked by the user is displayed too. Values in the second table are grouped in clusters in a way that maximizes the similarity between values inside a cluster and minimizes it between values from different clusters. The size of clusters is controlled so that any of them never gets twice larger than any other one. The similarity inside a cluster is the mean of all similarity indexes of its elements. It is computed by Equation 1.

similarity(c) = 2 (v,v )∈c×c similarity_index(v,v ) |c|(|c|-1) (1)
|c| is the number of values in Cluster c. The similarity index computes the similarity between two values. In order to select an adequate similarity index to be implemented in SONSAI, we have first tested four well-known indexes. These indexes are defined in Table 3. Γ (v) is the set of users that like value v.

Jaccard |Γ (v)∩Γ (v )| |Γ (v)∪Γ (v )| Adamic Adar z∈Γ (v)∩Γ (v ) 1 log |Γ (z)| Common Neighbours |Γ (v) ∩ Γ (v )| Preferential Attachment |Γ (v)|×|Γ (v )| |Γ (v)|+|Γ (v )|
Table 3: Similarity indexes SONSAI implements the algorithm detailed in [START_REF] Abid | Two-phase preference disclosure in attributed social networks[END_REF] to define clusters. The clustering algorithm is greedy. It defines one cluster at a time. At each step, it adds the most similar value from the set of non clustered values to the last created cluster. When size conditions are met and when adding any non clustered values will only decrease the average similarity of the cluster values, a new cluster is initialized that contains the most liked non clustered value. Overall, the algorithm computes the n(n -1)/2 similarities between all couples of values.

Figure 1 gives the similarity variations with respect to the sizes of clusters. The algorithm clusters 4 589 politician pages. The x-axis represents the minimal sizes of clusters. The y-axis represents the similarities inside clusters computed using the corresponding similarity index. We notice that Adamic Adar, Common Neighbours and Preferential Attachment based clustering method are very Fig. 1: Variations of similarities with respect to the size of clusters.

sensitive to the size of clusters. In fact, when the size of cluster increases the similarities dramatically decreases. On the other hand, Jaccard based clustering method maintains high similarities inside clusters even when the size of cluster is √ n, with n is the total number of values. Four volunteers have manually checked the similarities of clusters based on their political backgrounds. They confirmed that Jaccard based clustering method generates better clusters than Adamic Adar, Common Neighbours and Preferential Attachment based clustering method. Hence, SONSAI uses Jaccard index to measure the similarity between sensitive attribute values. Moreover, the mean Jaccard index, M J, between the values of a cluster C can be interpreted as follows: If a user likes a particular value from the cluster C then he tends to like M J × 100% of values of the rest of values from the same cluster C.

SONSAI allows users to open any cluster displayed on the table and click on any value to open its corresponding Facebook page. For each cluster, the user can specify the number of his real liked values inside. The algorithm measures then the accuracy of the ranking using the Area Under the Curve (AUC). Table 4 summarizes the politicians that are liked by u 1 and u 2 . Target u 1 is a french user politically right-oriented. The inference accuracy for the politician pages he like is 0.72. Target u 2 is a canadian user of left political orientation. The inference accuracy for the politician pages he like is 0.97.

Accuracy of SONSAI inferences

We have crawled the friendship network of 100 Facebook profiles of users that live in North-East France. For each crawled profiles we have collected the list of liked pages, the list of friends, the gender and the relationship status. The dataset contains 1 926 different types of pages, 1 022 847 different pages and 15 012 different crawled Facebook profiles. It counts 4 589 different pages of politicians that are liked by 2 554 user profiles. We have performed several tests to evaluate the accuracy of inferences made by SONSAI. We have first generated a new auxiliary dataset from the original dataset by selecting 10% of the users that publish their liked pages of politicians. Then we have removed all their preferences concerning politicians. The experiments have consisted then in inferring back the deleted preferences by analysing the new auxiliary dataset. When the analyser selects the top 23 most correlated attributes to the attribute pages of politicians, the precision of inference is equal to 0.79 in AUC. In other words, in average, the inferred set of pages of politicians by the analyser is 79% similar to the ones that are really liked by the target. However, inference accuracy is only 41% when the 23 attributes are selected randomly.

8 Toward efficient countermeasures SONSAI discloses friendship networks, quantifies the correlation between attributes and analyses the behaviours of users in order to infer the values of a target sensitive attribute. It helps users safeguard their privacy by identifying attributes that are correlated to the sensitive one. Users should then act on these correlated attributes to prevent these sensitive correlations. However, SONSAI is not fine-grained enough to identify which attribute values must be modified to hinder a sensitive value inference. First, to derive effective countermeasures one has to somewhat trade network utility for privacy by hiding some information. Second, a collaboration has to be established between users since their respective private data are interrelated. Figure 2 depicts an example of social network where music is correlated to politics. It is easy to correlate the Beatles music to Democrats and George Strait music to Republicans. Consequently, it is easy to infer that the target is more likely to like democrats as he likes the Beatles. One solution to hinder this inference is to delete the link between the target and the Beatles. However, the target will remain connected to Beatles through Lady Gaga that is in its turn correlated to Beatles. David and the target need to collaborate and delete their preference for Beatles in order to safeguard their privacy. It is obvious that any decision taken by David or the target can affect their mutual privacy. This shows that deriving a general solution is a challenging problem.

Conclusion

We have presented a first prototype for self-auditing Facebook profile resilience against inference attacks. As it will probably take time before legal enforcement of privacy is fully implemented by social networks, SONSAI may contribute in the period to user awareness against privacy threats. E-reputation awareness raising has already motivated the recent development of tools to analyse how a person or a brand is perceived on social medias. "Soyez net sur le net"4 and "mes datas et moi"5 are such platforms oriented toward teenagers. These tools are based on explicit content processing. However many companies and their recruiters are nowadays equipped with AI systems that are also able to extract latent information by machine learning. Our proposed approach is to defeat or at least degrade the performance of these systems by letting basic users, and also entities or companies, anticipate the leakage of their information. Hence our results may contribute too to a new generation of E-reputation management applications.

Fig. 2 :

 2 Fig. 2: Musics and politics.

Table 1 :

 1 Statistics related to the sensitive subjects.

		Discussion on	Discussion on	Anonymous	Avoided
		social networks (in %) forums and websites (in %) publications (in %) subject (in %)
	Money	0.94	54.42	25	10.14
	Religion	5.63	26.05	14.28	33.33
	Shopping	1.88	66.05	9.09	0
	Dating	5.16	24.19	0	21.74
	Health	17.37	66.05	9.09	5.8
	Politics	25.82	54.42	25	50.72

Table 2 :

 2 Some attribute values of targets u 1 and u 2 .

Table 4 :

 4 Politicians liked by targets u 1 and u 2 .

	Targets	u 1	u 2
		Marine Le Pen	Simon Marcill
		Jean-François Copé	Martine Ouellet
		Laurent Wauquiez	Amir Khadir
		Bruno Le Maire	Jack Layton
	Liked Politicians	Jean-Marie Le Pen Nicolas Dupont-Aignan	Jocelyn Beaudoin Alain Therrien
		Xavier Bertrand	Justin Trudea
		Nathalie Kosciusko Morizet Bernard Drainville
		Francois Fillon	Robert Aubi
		Marion Maréchal-Le Pen Alexandre Boulerice
	Accuracy of inference in AUC	0.72	0.97

Loi n o 78-17 du 6 janvier 1978 relative á l'informatique, aux fichiers et aux libertés

https://www.eugdpr.org/

Or indicates an inclusive disjunction.

http://www.ereputation.paris.fr/

https://www.mesdatasetmoi.fr/

www.fondation-maif.fr/

Acknowledgements. This work is supported by MAIF Foundation 6 .


Yinling Liu
email: yinling.liu@insa-lyon.fr

Tao Wang

Haiqing Zhang
email: zhanghq@cuit.edu.cn

Vincent Cheutet
email: vincent.cheutet@insa-lyon.frtao.wang@univ-st-etienne.fr

Information Systems Simulation for Performance Evaluation -Application in Aircraft Maintenance

Keywords: Agent-based simulation modeling, Information system, Business process, Civil aircraft maintenance

In the design phase, an effective performance evaluation on the information system model for aircraft maintenance helps better iteratively refine the system design. Although many works have emerged to achieve this aim, complex systems are hard to be completely described and the consideration of real-world processes is missing. Thus, how to investigate the system performance with consideration of the real-world aircraft maintenance is our focus. From our point of view, an agent-based simulation modeling is a promising approach to overcome such problem. In this paper, we develop an agent-based simulation model for the whole maintenance process, focusing on cooperation among sub business processes. This model describes the flight process, cooperation between stakeholders and failure repairs, where scheduled/unscheduled maintenance and with/without uncertain event scenarios have been addressed. The performance evaluation of this model is based on the analysis of impacts of key factors on the airline's service level and maintenance cost.

Introduction

The unified business process for aircraft maintenance has been proposed as an AMSS (Aircraft Maintenance Service System) model [START_REF] Liu | An Architecture Modeling Methodology for Aircraft Maintenance Service System[END_REF], which is capable of providing a platform where all the relevant information can be collected and a decision can be made from the global point of view. This architecture of the AMSS explains the aircraft maintenance from the business point of view [START_REF] Liu | Towards Standards Analysis and Application in Process of Aircraft Maintenance Repair Overhaul[END_REF]. Seven components, including Customer Requirement Component (CRC), Service Strategy Component (SSC), Service Task Component (STC), Workshop Component (WC), Supply Chain Component (SCC), Quality Control Component (QCC) and Service Decision Component (SDS), have been involved. The CRC determines maintenance requirements. The SSC is to provide strategies for maintenance issues. How to carry out maintenance work and keep aircraft serviceable are illustrated in the STC, WC, SCC. Moreover, the improvement of maintenance is implemented with the help of the QCC and SDC.

In this paper, we focus on the performance evaluation of the AMSS with a consideration of real-world maintenance processes. The AMSS model emphasizes the individuality of stakeholders and the cooperation between them. Performance evaluation is a tedious task since it is almost impossible to quantitatively estimate it a priori (i.e. before the implementation). Simulation is known as a powerful approach to meet this objective in other contexts [START_REF] Alrabghi | A novel approach for modeling complex maintenance systems using discrete event simulation[END_REF].

More precisely, an agent-based modeling can be defined simply as essentially decentralized, individual-centric approach to model design [4]. The real-world maintenance process and decentralized stakeholders provide this method with the possibility of detecting unknown (or unexpected) behaviors of complex system [START_REF] Bonabeau | Predicting the unpredictable[END_REF]. The agent is autonomous [START_REF] Jennings | On agent-based software engineering[END_REF], which is just sensible to present stakeholders. For example, the agent may refuse the request from another agent. Because inside agents, they own their own internal states. Specific states receive specific signals. If the signal is sent at an inappropriate time, it will be neglected. Therefore, the agent-based modeling simulation method is a good choice for modeling the AMSS and evaluating a priori its performance.

In this paper, section 2 discusses the application of simulation methods in aircraft maintenance domain and information system performance evaluation approaches. Section 3 provides an approach to realize the agent-based simulation modeling. The experiments are conducted to analyze the impacts of key factors on airline's maintenance cost and service level in the section 4. Finally, section 5 concludes the paper with future perspectives.

Literature Review

Aircraft Maintenance Simulation

Simulation approaches have been widely used in the both civil and military aircraft maintenance. In the military domain, some earlier works [START_REF] Kang | Cycletime reduction for naval aviation deports[END_REF][START_REF] Balaban | A Simulation Approach To Estimating Aircraft Mission Capable Rates For The United States Air Force[END_REF] involve the military logistic application analysis, but these do not consider the whole maintenance process. Although Mattila's work [START_REF] Mattila | A simulation model for aircraft maintenance in an uncertain operational environment[END_REF] tends to describe the whole maintenance process, his work lacks the consideration for the importance of impacts of individuality on the performance of the model. Recently, MacKenzie et al. proposes an agent-based simulation for application to the sortie generation process, focusing on a single fighter aircraft unit [START_REF] Mackenzie | Application of agent based modelling to aircraft maintenance manning and sortie generation[END_REF], and Datta et al. develop a discrete-event simulation model representing an end-to-end repair line for jet aircraft to evaluate different manpower resource utilization decisions [START_REF] Datta | A simulation study on maintainer resource utilization of a fast jet aircraft maintenance line under availability contract[END_REF]. However, the evaluation of manpower utilization decisions is just based on the utilization rate of manpower and neglects other factors like maintenance cost, service level, etc.

In the civil aircraft domain, the simulation method for aircraft maintenance tends to be prevailing. Most of the works [START_REF] Lee | Multi-objective simulation-based evolutionary algorithm for an aircraft spare parts allocation problem[END_REF][START_REF] Van Den Bergh | A three-stage approach for aircraft line maintenance personnel rostering using MIP, discrete event simulation and DEA[END_REF][START_REF] Regattieri | An innovative method to optimize the maintenance policies in an aircraft: General framework and case study[END_REF] attempt to combine simulation methods with optimization objectives. Simulation methods are principally used for estimating the performance of optimal model. However, these works either only underline some specific phases of maintenance like spare parts allocation, personal scheduling, etc., or are inadequate to the stress of behaviors of individual objects. Therefore, the evaluation indicators for proposed models appear to be insufficient. In addition, the combination of multi-agent system modeling and interdisciplinary approach is proposed to model the safety culture, in order to evaluate workers' commitment to safety [START_REF] Passenier | Modeling safety culture as a socially emergent phenomenon: a case study in aircraft maintenance[END_REF]. The agent-based model was implemented in Java instead of any agent modeling tools, because they thought that conceptual models of agents and specification languages limited their purposes. Thus, that work is contributed more to the theory development of safety culture.

To conclude, on the one hand, most works are dedicated to the solving of formulated problems rather than to the methodological details; on the other hand, little description of the complexity of the aircraft maintenance such as cooperation between stakeholders is addressed.

Information System Evaluation

The evaluation of information systems is utterly difficult, as its multidimensionality, quantitative and qualitative aspects, and conflicts among evaluator viewpoints [START_REF] Hamilton | Evaluating information system effectiveness-Part I: Comparing evaluation approaches[END_REF]. Most of works [START_REF] Petter | Measuring information systems success: models, dimensions, measures, and interrelationships[END_REF][START_REF] Petter | The past, present, and future of "IS Success[END_REF][START_REF] Khodakarami | Exploring the role of customer relationship management (CRM) systems in customer knowledge creation[END_REF] contribute to providing more complete indicators for evaluating the existing information systems, in order to investigate their performances. From our point of view, the evaluation is principally relied on developed information systems. They are evaluated either intrinsically with informatics indicators or a posteriori observations once they are deployed inside the organization. Nevertheless, very few works try to evaluate a priori impacts of their deployment and the performance of the new organization.

Maintenance systems for aircraft are kinds of complex systems, which concentrate on individuality of stakeholders, distributed and ephemeral cooperation between stakeholders. Jennings [START_REF] Jennings | On agent-based software engineering[END_REF] points out the flexible, high-level interactions of agents make the engineering of complex system easier. The author recalls that complex systems are always distributed and agent decomposition is very important to manage complexity. Agent-based systems are essentially decentralized and individual-centric. Moyaux et al. [START_REF] Moyaux | Supply chain management and multiagent systems: an overview[END_REF] explains that the system complexity makes it difficult to know every possible interaction in the system, because the system only has partial control and observability over its environment, and thus, this environment is highly unpredictable. Agent-based decentralization takes this into account by letting each agent continuously coordinate its actions with other agents, instead of making this agent apply a behavior prescribed at design-time.

As for our simulation model, the distributed and ephemeral characteristics are captured by agents. For example, the flight agent schedules the plane agent to service, while the service task agent maybe is requesting a specific part. Two agents accomplish their tasks independently. If the signal from the flight agent reaches the plane agent at an inappropriate moment, this signal will be neglected by the plane agent. Because agents are autonomous. Thus, in this case, the cooperation between agents is ephemeral. Thanks to the simulation tool Anylogic, we can build our agent-based simulation model easily dealing with distributed and ephemeral issues. Additionally, since agents own high level of individuality, the cooperation of them may make the system produce some unknown behaviors.

The major contributions of our work are: (1) effectively describing the behaviors of the AMSS; (2) enabling maintenance designers to fully investigate the system performance. Therefore, the simulation analysis allows maintenance designers to have enough flexibility in the phrase of model design. Additionally, this analysis is automatic and has improved the traditionally manual analysis process to be more accurate, more rapid and less error-prone.

The Agent-based Simulation Framework

Aiming at investigating the performance of the AMSS, an agent-based simulation model is developed, which is shown in figure 1. This model is capable of dealing with four kinds of maintenance scenarios: scheduled/unscheduled maintenance and with/without uncertain events. The unscheduled maintenance and uncertain events are determined by fault events and uncertain events respectively. In this model, we have created nine agents: Flight Agent (FA), Plane Agent (PA), Equipment Agent (EA), Customer Requirement Agent (CRA), Service Strategy Agent (SSA), Service Task Agent (STA), Supply Chain Agent (SCA), Quality Control Agent (QCA) and Service Decision Agent (SDA). The maintenance logic is completely from the AMSS model. Therefore, we derive agents from components of the model. In addition, we add the FA, PA and EA to run the simulation more smoothly. FA is dedicated to scheduling plane. PA is created to just simulate a plane. EA allows us to get a better insight of repairing issues. In the following, the development of PA, EA and STA is discussed in details.

Plane and Equipment Agent

The plane agent is a kind of composite agents, which contains the equipment agents. The data for this agent consist of aircraft data (aircraftNumber, aircraft-Type, aircraftState), the flight data (flightNumber, flightHours, city), scheduled maintenance data (ACheckTime, BCheckTime, CCheckTime, DCheckTime) and parts data (type, changeoverTime, repairTime, repairingTime, serialNumber, price, equipmentState).

When all the aircraft are loaded from the database, they are in the state "Ready". They are scheduled by departure and arrival events, which are defined in the FA. In the state "SidedTransitCheck", we assume that fault events occur with a specific probability. This state is the only place where the CRA may be triggered. When one aircraft needs to do the scheduled maintenance like "TransitCheck", "ACheck", "BCheck", "CCheck" or "DCheck", the EA will be called to check states of relevant parts.

In terms of the EA, the major objectives of this agent are to check the states of parts and determine the repairing strategies for faulty parts. As for the unscheduled maintenance, one faulty parts list will be delivered to the EA. The repairing strategies for them are determined by decision rules shown in table 1. When receiving the scheduled maintenance, the parts will be checked just to see whether it needs to be replaced. It should be noted that the repairTime refers to the overhaul time of parts. The repairingTime implies the repairing time of part is short.

Service Task Agent

The data of the STA are the aircraftNumber, aircraftType, interval, state, fault-Desc, detailedFaultDesc, parts, partsChecking and aircraftTechnicians. The state chart of the STA is shown in figure 2. This agent is capable of dealing with issues like fault identification, maintenance planning(resource request and labor assignment) and uncertain events. When receiving signals from CRA, it will trigger fault identification process. When receiving signals from SSA, it means the set of possible faulty components has been determined by SSA. Thus, it starts to make maintenance plans. During the process of repairing ("WorkPackages" state), uncertain events maybe happen. Then, it will trigger agents like SSA, QCA and SDA, in order to find better solutions. The logic of dealing uncertain events is shown as blue arrows in figure 1.

It should be noted that we recognize unknown events occurring during the process of repairing of dysfunctional components as uncertain events.

Case Study

Experiment Design and Data

The performance evaluation of the AMSS is conducted via examining the impacts of the number of aircraft (experiment 1) and technicians (experiment 2) on service level (sl) and maintenance cost. In this model, the key factors are: the probabilities of the occurrence of fault events and uncertain events, and the numbers of aircraft and technicians. We expect to create a severe simulation environment to see the responses of the system. Thus, the probabilities of the occurrence of fault events and uncertain events are amplified, which are assigned as 0.5 and 1 respectively.

In terms of cost analysis, the downtime cost, labor cost, stock cost and parts purchase cost are taken into consideration. The definitions of costs are shown below in equation ( 1)-( 4), where the totalRepairTime (shown in table 2) and interval are counted by seconds, the salary (i) and time (i) represent the ith aircraft technician's salary counted by hours and the corresponding working time, the number (i) implies the number of the ith kind of parts and the days means the number of storing days, and the cost (j) means the cost of the jth kind of parts. In addition, all the costs are counted by dollars. It should be noted that the scheduledTime in table 2 means the total repair time of scheduled maintenance. DowntimeCost = (totalRepairT ime -interval) * 2.8;

(1)

LaborCosts = n (i=1)
salary(i) * time(i);

(2)

StockCosts = n (i=1)
number(i) * 10 * days;

(3)

P artsP urchaseCosts = n (j=1) cost(j); (4)
The industrial relevance of values for data is explained in the following. The data interval (around 1h), inventoryPrepare(1-3h), repairingTime(20-120 mins)(the faulty parts that can be repaired on site) and repairTime(5-30h)(the faulty parts that have to be repaired at workshops) are of a certain level of industrial relevance. The value for data inventoryPrepare is given by the random distribution unif orm discr(min, max). The rest are determined by the data stored in the database. However, in terms of the data informationDelivery and maintenancePlanning, the values for them are assumed as 2 seconds and 10 minutes respectively, which are of less of industrial relevance. The data of the faultIdentification, exceptionalEventSSA and exceptionalEventSTA are determined depending on knowledge stored in the database. If the solution has been stored in the database, they will take 0 minute. If not, they will take either 30 minutes or one hour. The definition of service level is shown as follow:

servicelevel = totalRepairT ime -interval. (5)
The relation between the delayed time and service level is shown in table 3.

When analyzing the service level for aircraft maintenance, the first two important indicators are the "sl=10" and "sl=0". The indicators of "sl=9 to 6" are the second most important indicators.

Experiment Hypothesis

The major experiment hypotheses consist of:

all the aircraft fly from London to the other cities around the world. Then, they will fly back to London; fault events can happen only when aircraft reach the "SidedTransitCheck" state in the PA. Uncertain events always take place in the STA; each faulty part only occupies one technician who is randomly distributed and has matched skills; all maintenance business processes are included in the combination of scheduled/unscheduled maintenance and with/without uncertain events; for the departure event, if there is no available aircraft for the departure of one flight, this flight will be canceled. For the arrival event, if the downtime for departure is over 4 hours, this flight will be canceled neither; fixed parts are as good as news after maintenance actions.

Experiment Results and Analysis

This simulation experiment is implemented in Anylogic PLE 8.2.3. The configurations of running laptop are 8G memory and 4 processors (i7-6500U CPU). The simulation is set as two weeks, which takes around 4.5 hours. The experiment results are divided into two parts: impacts of the number of aircraft (Fig. 3) and the number of technicians (Fig. 4) on airline's service level and maintenance cost.

The result of the first experiment is very interesting. With the increase of the number of aircraft, the number of on-time flights (sl=10) goes up steadily. But the number of the canceled flight represents variability. For instance, when the number of aircraft rises from 14 to 34, the canceled flight increases regularly. While when the number of aircraft equals to 44, the number of canceled flights just shows a slight increase. Thus, based on the result of the service level, we have found 44 is the most appropriate sum for the number of aircraft for airlines. For the maintenance cost, the downtime costs increase regularly and the part purchase costs rise slowly, with the increase of the number of aircraft. However, the stock cost and labor cost are less significant.

The second experiment is very significant as well. The major trend for all the indicators remain stable. Comparing with the impacts of the number of technicians on the number of flights, we find that 49 is the most suitable sum for the number of technicians. If the number of technicians equals to or less than 49, the number of flights increases gradually despite a slight fluctuation when the number of technicians ranges from 19 to 39. When comparing the cases of the number of technician equaling to 49 and 59, they almost share the same level of the number of flights, but the former shows better in the indicators of "sl=0" and canceled flight. As for "sl=7 and 6", they are much less important than the indicators of "sl=0" and canceled flight. At the same time, they almost share the same changing trend. As a result, we suggest that 49 is better for the number of technicians. As for the maintenance cost, the downtime cost firstly increases then decreases, with the increase of the number of technicians. When the number of technicians equals to 39, the values of the downtime cost and part purchase cost both reach the peak. Above all, the maintenance cost does not experience any remarkable change with the increase of the number of technicians.

Even though we just conduct two experiments on the evaluation of the system, this agent-based model simulation allows us to evaluate almost all the aspects of the system. In fact, the impacts each significant factor and mainte-nance strategies on system performance can be explored via changing their values and strategies respectively. As a result, in this paper, we provide the basic simulation model for aircraft maintenance, which enables maintenance designers to fully examine the system.

Conclusion

In this paper, the agent-based simulation model describes the AMSS behavior via combining flight scheduling, cooperation between stakeholders, and failure repairs as a whole maintenance process, concentrating on scenarios of the combination of scheduled/unscheduled maintenance and with/without uncertain events. The experiment results show this method not only has the strong capability of describing complex information systems but enables us to investigate the system performance from the global point of view. When maintenance designers need to investigate the impacts of some environment variables and maintenance strategies on maintenance efficiency and cost, our approach can provide a qualitative and quantitative analysis on this problem. The authenticity of initial data is a big issue in our work. In order to realize this experiment, some key data is still based on our hypothesis. Thus, one of our perspectives is to apply more realistic data to the proposed simulation model for better evaluation and improvement. Moreover, the theoretical verification of this model is still missing. In the future, the formal method will be employed to verify the feasibility of the AMSS model.

Fig. 1 .

 1 Fig. 1. Agent-based Simulation Model for AMSS

Fig. 2 .

 2 Fig. 2. The state chart of the STA

Fig. 3 .

 3 Fig. 3. The impacts of the number of aircraft on airline's service level and maintenance cost

Table 1 .

 1 The decision rules for repairing strategies

	if (currentU seT ime ≥ changeoverT ime)	repairT ype = "replace";
	else{
	if (repairingT ime ≥ plane.interval)	repairT ype = "replace&repair";
	else {
	if (changeoverT ime -currentU seT ime ≥ plane.interval)
	repairT ype = "repair";
	else
	repairT ype = "replace";
	}
	}

Table 2 .

 2 The definitions of total repair time on maintenance scenarios

	Maintenance Scenario	total repair time
	Scheduled	informationDelivery, maintenancePlanning,
		inventoryPrepare, repairing
	Scheduled+ Uncertain event	exceptionalEventSTA(eSTA),
		exceptionalEventSSA(eSSA), scheduledTime
	Unscheduled	faultIdentification,faultAnalysis, scheduledTime
	Unscheduled+ Uncertain event	faultIdentification,faultAnalysis,
		eSTA, eSSA, scheduledTime

Table 3 .

 3 The relation between delayed time(minute) and service level

	delayed time	0 (0,30] (30,60] (60,120] (120,240] (240,+∞)
	service level(0-10) 10 9	8	7	6	0

Acknowledgments This research work is supported by the China Scholarship Council.