Ivan Morandi

Renata Teixeira

Timur Friedman

Francesco Bronzino

Service traceroute: Tracing Paths of Application Flows

Traceroute is often used to help diagnose when users experience issues with Internet applications or services. Unfortunately, probes issued by classic traceroute tools differ from application traffic and hence can be treated differently by middleboxes within the network. This paper proposes a new traceroute tool, called Service traceroute. Service traceroute leverages the idea from paratrace, which passively listens to application traffic to then issue traceroute probes that pretend to be part of the application flow. We extend this idea to work for modern Internet services with support for automatically identifying application flows, for tracing of multiple concurrent flows as well as for UDP flows. We implement command-line and library versions of Service traceroute, which we release as open source. This paper also presents a calibration and an evaluation of Service traceroute when tracing paths traversed by Web downloads from the top-1000 Alexa websites and by video sessions from Twitch and Youtube. The goal of the calibration is to find the best parameters of Service traceroute for each application. Our evaluation shows that Service traceroute has no negative side effect on the vast majority of downloads, but that in some rare cases it can cause application flows to abort or increase flow completion times. In addition, the evaluation shows that Service traceroute obtains different paths in at least 30% of paths when compared with a standard traceroute. Using the same source and destination ports as the target application flow to analyze for standard traceroute's probes, Service traceroute still obtains different paths in at least 7% of analyzed paths.

INTRODUCTION

Internet services and applications rely on highly distributed infrastructures to deliver content. When applications stop working or when their performance degrades, service providers and more sophisticated users often resort to traceroute to narrow down the likely location of the problem. Traceroute issues probes with increasing TTL to force routers along the path towards a destination to issue an ICMP time exceeded message back to the source, which iteratively reveals the IP addresses of routers in the path [START_REF] Jacobson | traceroute[END_REF].

Traceroute, however, may fail to reveal the exact path that a given application flow traverses. For example, Luckie et al. [START_REF] Luckie | Traceroute Probe Method and Forward IP Path Inference[END_REF] have shown that depending on the traceroute probing method (ICMP, UDP, and TCP) the set of reached destinations and discovered links differ. The authors explain these differences by the presence of middleboxes in the path such as load balancers and firewalls that make forwarding decisions based on flow characteristics. These results imply that diagnosing issues on application flows must ensure that traceroute probes have the same characteristics as the application's packets.

This paper develops a traceroute tool, called Service traceroute, to allow discovering the paths of individual application flows. Service traceroute passively listens to application traffic to then issue probes that pretend to be part of the application flow. Some traceroute tools (for instance, paratrace [START_REF] Kaminsky | Parasitic Traceroute via Established TCP Flows & IPID Hopcount[END_REF], TCP sidecar [START_REF] Sherwood | Touring the internet in a tcp sidecar[END_REF], and 0trace [START_REF] Edge | Tracing behind the firewall[END_REF]) already enable probes to piggyback on TCP connections. These tools observe an active TCP connection to then insert traceroute probes that resemble retransmitted packets. TCP sidecar was developed for topology mapping, whereas paratrace and 0trace for tracing pass a firewall. As such, they lack of two important features in application debugging. The identification of the application flows to trace as they require as input the destination IP address and the destination port to detect the target application flow, and the support for tracing paths of modern application sessions, which fetch content over multiple flows that change dynamically over time. In addition, these tools lack the support for tracing application flows using UDP as transport protocol, which are increasing thanks to the adoption of QUIC protocol [START_REF] Langley | The quic transport protocol: Design and internet-scale deployment[END_REF] in new services as well as in popular services like Youtube. Our work makes the following contributions. First, we develop and implement Service traceroute ( §2), which we will release as open source software. Service traceroute is capable of identifying application flows to probe and tracing the paths of multiple concurrent flows of both TCP and UDP flows. For example, a user may simply specify trace 'Youtube' and Service traceroute will identify Youtube flows and then trace all of their paths. Service traceroute is configurable to cover a large variety of Internet services.

Our second contribution is the calibration of Service traceroute for two popular Internet services: video and web pages, in particular, the top-1000 Alexa websites as well as Twitch and Youtube video streaming. The goal of the calibration is to find the parameters of Service traceroute with the best trade-off between the probing network overhead and the amount of information gathered. The problem of Service traceroute is that application flows may close before Service traceroute ends the tracing, and hence middleboxes along the path may discard Service traceroute's probes.

We then use the configurations with the best tradeoff for the third contribution: evaluate Service traceroute. We focus the evaluation on the same Internet services used during the calibration. One issue with piggybacking probes with application traffic is that we may hurt application performance. Our evaluation shows that in the vast majority of cases, Service traceroute has no side-effect on the target application ( §5). For a few websites, however, application flows get reset when running with Service traceroute. This result indicates that piggybacking traceroute probes within application flows requires careful calibration to avoid hurting user experience. Finally, we compare Service traceroute with 0Trace, which also embeds probes within a target application flow, and with Paris Traceroute, which launches a new flow for probing ( §6). Our comparison with Paris traceroute shows differences in 37% of paths with Twitch, 9% with Youtube and 7% with web pages, even when running Paris traceroute with the same ports as the target application flow. We noticed that in some paths with web pages and Youtube videos, middleboxes discard UDP and TCP probes of Paris Traceroute before they reach the destination.

TOOL DESIGN AND IMPLEMENTATION

Service traceroute follows the same high-level logic as paratrace or 0trace. Given a target application flow, which we define as the application flow whose path we aim to trace, Service traceroute proceeds with two main phases. The first phase is the passive observation of a target application flow to define the content of the probes. Then, the active injection of TTL-limited probes within the application flow. The main difference is that Service traceroute identifies the flows to trace automatically and supports tracing paths traversed by multiple application flows concurrently. The user can either directly specify the set of target application flows or simply describe a high-level service (e.g., Youtube). Service traceroute will then trace paths traversed by all the flows related to the target service. This section first describes the two phases focusing on the new aspects of Service traceroute to allow per service tracing and then presents our implementation.

Observation of target application flow

Service traceroute passively observes traffic traversing a network interface to search for packets with the flow-id of the target application flows 2 . One novelty of Service traceroute is that it takes a set of target application flows as input, in contrast with previous tools which can only trace the path traversed by one single application flow. Users can either explicitly specify one or more target application flows or they can simply specify a service. Service traceroute uses a database of signatures of known services to inspect DNS packets in real-time and identify flows that match the target service. We release the DB as open source, so users can contribute to add or update the signatures in the database. We define as signature the set of IP addresses and domains corresponding to a specific service. For instance, 'google.com' or the corresponding IP addresses can be used in the signature to detect Google services. Our current database has signatures for popular video streaming services such as Netflix, Youtube, and Twitch. Web pages are not included in the database as Service traceroute can identify web flows simply from the domain or the host name given as input. For additional flexibility, it is possible to easily add ad-hoc domains and IP addresses via command line parameters or through the library API.

Path tracing

Only once it identifies a packet belonging to the target application flow, Service traceroute will start the tracing phase. This phase works as classic traceroute implementations sending probes with increasing TTL, but Service traceroute creates a probe that takes the form of an empty TCP acknowledgement that copies the 5-tuple of the flow as well as its sequence number and acknowledgement number (similar to paratrace and 0trace). We rely on the flow-id plus the IPID field to match issued probes with the corresponding ICMP responses. We note this is sufficient to correctly identify probes even when tracing multiple concurrent target application flows. The maximum number of concurrent target application flows varies based on the used configuration as the IPID field is dynamically sliced based on the number of probes that have to be generated. For example, with traceroute standard parameters, i.e. maximum distance of 32 and 3 packets per hop, Service traceroute can trace paths of 682 target application flows.

Service traceroute stops tracing when the target application flow closes to avoid any issues with middleboxes (which may interpret probes after the end of the connection as an attack) and also to reduce any net-work and server overhead. In contrast to prior tools that only support TCP, we add support for UDP. In this case, we create probes with empty UDP payload, but with the same 5-tuple flow-id as the target application flow. Given UDP has no explicit signal of the end of the flow (like the FIN in TCP), we stop tracing if the flow produces no further packet (either received or sent) after a configurable time interval.

Implementation

We implement Service traceroute in Go and release command-line and library versions. The command-line version is useful for ad-hoc diagnosis, whereas the library allows easy integration within monitoring systems.

The library version of Service traceroute outputs a json data structure that contains the discovered interfaces with the observed round trip time values. For the command line version, Service traceroute shows the results of each trace in the traceroute format, i.e. the list of hops with the corresponding round trips times.

Service traceroute is configurable to adapt to different applications. It includes three types of probing algorithms that capture the tradeoff between tracing speed and network overhead. The first, Packey-ByPacket, sends only one packet at a time. The second, HopByHop, sends a configurable number of packets with the same TTL at a time (3 by default). The third, Concurrent, sends all packets at once. Given that Service traceroute requires the target application flow to be active during tracing, some applications with short flows (e.g., Web) require the higher overhead of the third algorithm to complete all the probes within the flow duration. Service traceroute also allows configuring the number of probes for each TTL, the interprobe time, and inter-iteration time (i.e. the time between packets with different TTL) to further control this tradeoff between tracing speed and overhead. Finally, Service traceroute allows to specify three types of stop conditions: the maximum distance from the source, the maximum number of non replying-hops, like Paris Traceroute, or explicit stop points in the form of IP addresses. The last stopping condition is useful when one wants to focus the tracing. For example, one could use bdrmap [START_REF] Luckie | Bdrmap: Inference of borders between ip networks[END_REF] to identify the borders of the origin AS and then stop the trace at the border routers.

EVALUATION METHOD

We design the calibration to find the best configuration of Service traceroute for two popular applications: video and web pages. Our goal is to identify the optimal parameters setting to balance the tradeoff between completing the discovered paths and network probing load.

We then use the configurations from the calibration, i.e. the best trade-off for web and video, for our evaluation of Service traceroute and we design the evaluation around two questions. First, does Service traceroute affect the target application flows? Service traceroute injects new packets within the application flow. Although the majority of these packets will be discarded before they reach the servers, a few probe packets will reach the end-host and can potentially affect the target application flows. Second, do paths discovered with Service traceroute differ from those discovered with other traceroute methods? One assumption of our work is that paths taken by classic traceroute probes may not follow the same paths as the packets of the target application flows. We present an evaluation to help answer these questions, where we compare our results with that of Paris traceroute [START_REF] Augustin | Avoiding Traceroute Anomalies with Paris Traceroute[END_REF].

We conduct all experiments for the calibration and evaluation from 30 PlanetLab Europe nodes. These were the only ones working at the time of the analysis, PlanetLab US nodes were not compatible due to the lack of updated dependencies, like glibc.

Web. We select the top-1000 Alexa webpages on April 14 2018 as target web flows.

Video. We focus on two popular video streaming services: Twitch and YouTube. We select twitch videos on their homepage where Twitch shows dynamically a popular live streaming video. While for YouTube, we select 20 random videos from the catalog obtained after searching with the keyword "4K UHD". With YouTube, we evaluate both TCP and UDP by forcing Google Chrome to use or not QUIC.

Comparison with Paris traceroute. We select Paris traceroute because its Multipath Detection Algorithm (MDA) [START_REF] Veitch | Failure Control in Multipath Route Tracing[END_REF] can discover with high probability all paths between the source and the destination in case there is a load balancer in the path. This allows us to disambiguate whether the differences we may encounter between Paris traceroute and Service traceroute are because of load balancing or some other type of differential treatment. We evaluate Paris traceroute using two different versions. The first is Paris traceroute with MDA enabled using the three protocols ICMP, UDP, and TCP. We let MDA select the ports for Paris traceroute to discover multiple paths between the two end hosts. The second is the standard Paris traceroute using the same 5 tuple as the target application flow.

Comparison with 0Trace. We select 0Trace as it implements the idea of tracing paths of a target application flow and it has a working implementation. However, since 0Trace does not implement the DNS resolution, we used Service traceroute as a mediator to detect the target application flows to probe. Since the version of 0Trace we considered was released in 2007, we had to update the library for the transmission of probes from dnet to scapy, because it was crashing with the segmentation fault error on all PlanetLab servers while it was trying to send probes.

Experiment setup. Experiments for video and Web are similar. We first launch Service traceroute, then we start streaming a video or downloading a webpage, once that is done we run the three versions of Paris traceroute MDA back-to-back. Then, we stream again the same video or download the same webpage without Service traceroute. We have run a total of 459 videos, 153 for Twitch and 306 equally split between YouTube with TCP and with QUIC, and 1000 Web experiments during 30 days in July 2018.

Small Scale Measurement. We ran a preliminary small scale evaluation of Service traceroute during 14 days in May 2018. In this small scale analysis, we evaluated Service traceroute with Netflix, Youtube and Web pages. We used 7 PlanetLab Europe nodes as vantage points for web pages. While, for videos we used one laptop in a college located in Paris (France) because Netflix only allows from one to four concurrent videos with the same account. In this paper we omit the results of Netflix and Youtube as they are similar to the latest evaluation. While, we include some particular exceptions we encountered during the evaluation of Service traceroute with web pages.

Data representativeness. Our European-scale evaluation is useful to determine whether or not Service traceroute affects the application flows of popular services (top-1000 Alexa as well as Twitch/Youtube). It is also useful to shed some light on whether there are differences between paths discovered with Service traceroute and more traditional traceroute paths.

CALIBRATION OF Service traceroute

This section evaluates Service traceroute using different parameters to find the configuration with the optimal trade-off between the completeness of discovered paths and the network probing load.

We vary two parameters. The probing algorithm (PacketByPacket, HopByHop and Concurrent) and the number of probes per hop from 1 to 9. While, we set the other parameters to fixed values to simplify the calibration analysis. In particular, we set the maximum distance to 32, the inter-probe time to a negligible value of 1 micro second and the timeout to wait ICMP replies to 2 seconds.

Calibration Setup. The setup of the calibration is similar to the experiment setup. For each page and video, we run all configurations back to back to preserve the same network characteristics across all configurations.

Probe Overhead

We define probe overhead as the throughput of probes injected into the network. We compute the probe overhead by summing the total number of bytes transmitted divided by the time between the first and last probe. This metric helps us to evaluate the load that Service traceroute is adding to the network under different probing algorithm and number of probes per hop. Figure 1 shows the probe overhead for all probing algorithm when we vary the number of probes per hop. The result shows that Concurrent has a constant probe overhead of more than 100kbps irrespective of the number of probes sent per hop. Concurrent issues all probes without waiting for ICMP. Thus, Concurrent's probe overhead is only limited by the capacity of the source host. While, for HopByHop algorithm, the probe overhead increases from 100bps to 1kbps when we increase from 1 to 9 probes per hop. The reason of this positive trend is that HopByHop waits ICMP replies at the end of the transmission of all probes with the same TTL. For PacketByPacket, it has a slight negative trend. The reason is that the number of times PacketByPacket waits ICMP replies and timeouts is linearly increasing with the number of probes per hop and the time to receive the ICMP reply increases with the distance from Service traceroute.

Completed Traceroutes

We define completed traceroutes as the number of traceroutes where Service traceroute was able to probe all hops in the path before the end of the target application flow. We consider that a traceroute reached the destination when Service traceroute does not receive replies from three consecutive hops. We compute the ratio of completed traceroutes over the total number of traceroutes done by Service traceroute for a spe- cific configuration. This metric helps us to evaluate whether Service traceroute is able to discover all hops in a path under different probing algorithm and number of probes per hop. Figure 2 shows the ratio of completed traceroutes for all probing algorithms when we vary the number of probes per hop. Concurrent always achieves around 100% of completed traceroutes for all analyzed services. As expected, Concurrent is very fast on discovering paths since there are no timeouts to wait for incoming ICMP replies. HopByHop is able to reach the distribution in almost 100% of cases when tracing paths of Twitch and Youtube flows. For web flows however, HopByHop can only complete tracing in 70% of traceroutes. This difference is caused by the short duration of web flows and the added delay to receive ICMP replies at the end of the transmission of packets with the same TTL. PacketByPacket has the same problem as HopBy-Hop but for all services. Indeed, PacketByPacket waits the ICMP reply after the transmission of each packet, hence the time required to discover the path increases linearly with the number of probes per hop. Packet-ByPacket starts to have worse performance compared to HopByHop after 4 probes per hop for Youtube, 5 probes per hop for Twitch and 2 probes per hops for Web pages.

Results

The choice of the probing algorithm depends on different factors, like the application to probe and the added overhead on the network. For videos, like Youtube and Twitch, the best choice for the probing algorithm is HopByHop since the ratio of completed traceroutes is almost good as Concurrent but with a significant smaller probe overhead. While, for web pages, the best choice is Concurrent as the ratio of completed traceroutes is 30% more than the ratio with the other algorithms. The reason of this difference is that web flows have a shorter lifetime compared to video flows, so speed is crucial to probe all hops in the path before the end of the target application flow. Concerning the number of probes per hop, the best choice to maximize the information gathered by Service traceroute is 1 probe per hop. However, congested networks may drop probes and ICMP replies, so the packet concerning a specific hop is lost. Thus, we decided to use the default of 3 probes per hop to increase the probability to get a response from an interface.

Evaluation Settings. We decided to use two different configurations, one for videos and one for web pages. For videos, we use the HopByHop probing algorithm with a timeout of 2 seconds to wait ICMP replies. While, for web pages, we use the Concurrent probing algorithm. In both configurations, the maximum distance is 32 and the number of probes per hop is 3. The interprobe time and inter-iteration time are negligible, i.e. 1 microsecond.

SIDE EFFECTS OF Service traceroute

This section evaluates whether Service traceroute affects target application flows as firewalls or servers may mistakenly interpret too many duplicated packets within a flow as an attack or losses, which in turn may cause application flows to be blocked or achieve lower throughput. Although the idea of piggybacking traceroute probes within application flows has been around for approximately a decade, there has been no prior evaluation of whether it can hurt target application flows. TCP sidecar evaluates the intrusiveness of their method, but only by measuring the number of abuse reports [START_REF] Sherwood | Touring the internet in a tcp sidecar[END_REF].

Metrics

We select different metrics to measure properties of target application flows. Flow duration refers to the time between the first and the last packet of a flow. For TCP, we measure the time from the server SYN to the first FIN or RST. For UDP, we measure the time from the first and the last packet coming from the server. We compute the average throughput of a target application flow as the total application bytes divided by the flow duration. In addition to these metrics, which we can compute for both TCP and UDP flows, we have three other TCP specific metrics: the number of resets, which capture the number of target application flows closed by resets; window size is the difference between the minimum and the maximum TCP window size of the server for an application flow; and the number of retransmissions is the number of retransmission from the server per application flow.

Aborted flows

We first study whether Service traceroute causes flows to be aborted. We have seen no video sessions that ended with resets in our experiments with 153 streaming sessions of Twitch and 153 video sessions of Youtube with TCP. Even though our analysis is only from European vantage points, we believe that this result will hold more generally for both Twitch and Youtube as these large video providers deploy multiple versions of the same software across servers/caches [START_REF]Netflix Open Connect OVerview[END_REF]. Any differences will depend on middleboxes placed either close to the clients or in the path towards the service.

Our results for webpage downloads are also encouraging, we see no aborted flows. However, in the small scale measurement, we detected few exception. The IPs of the servers are different to the ones obtained in the European scale experiment. Five of the top-1000 websites (kompas.com, patria.org.ve, mobile01.com, costco.com and softonic.com) ended with resets only for downloads with Service traceroute. We experience the same behavior consistently across PlanetLab vantage points for three of the sites, whereas for kompas we only see resets for three of the vantage points. Our manual inspection of the traces shows that these three vantage points downloaded the kompas page from one IP, whereas the other four downloaded from another IP. This analysis suggests that some firewall close to the website or the web server itself is resetting the flows due to the duplicate packets. In the small scale experiment, we note that for 88% of the measured websites we see the content downloaded from different IPs depending on the vantage point, but only in one case we saw this difference in behavior across the IPs.

Takeaway. We conclude that for Twitch and Youtube sessions as well as for most of the top-1000 Alexa websites, Service traceroute causes no aborted flows. In a few cases, however, the target application flow is aborted when running with Service traceroute. It is hence key to evaluate the particular target service in a controlled setting before launching any large-scale experiments to trace paths of user's traffic.

Flow performance

We next evaluate whether Service traceroute affects flow performance in terms of flow duration, throughput, TCP window size, and retransmissions. Figure 3 presents the cumulative distribution function of the flow duration in seconds with and without Service traceroute. We present eight curves: two for video sessions over TCP both for Twitch and Youtube, two for Youtube sessions over UDP, and two for all web page downloads. We see that the distributions with and without Service traceroute are mostly the same. During the small scale experiment, for web pages we observe one exception for softonic.com, where with Service traceroute the flow duration takes 600 seconds more. In this case, we see that all packets trigger ICMP time exceeded. At the end, the application flow is closed with a reset. We assume that some middlebox in the path prevents packets with increasing TTL. 4 presents the cumulative distribution of the average throughput of target application flows in our experiments for Web and video. Similar to flow duration, we observe that Service traceroute has no impact on target application flow throughput, since the evolution of distributions are the same without noticeable differences.

Figure 5 presents the cumulative distribution of the maximum difference of TCP windows size of target application flows for both web and video. The figure shows that Service traceroute does not affect the window size of the receiver, hence probes which are duplicate acknowledgments are not causing any reduction of the TCP window size.

Finally, Figure 6 shows the cumulative distribution of the number of TCP retransmissions of target application flows. In this case, web pages and twitch have the same distribution whether Service traceroute is used or not. For Youtube, there is a slight difference when Service traceroute is used but the number of cases is limited to 1% of Youtube application flows. The difference of the number of retransmissions is limited to 0 10 0 few application flows, so this issue may be due to some other factors.

COMPARISON WITH TRACEROUTE TOOLS

The key motivation for building Service traceroute is that we must send probes within the target application flow to discover the path of this flow. Although Luckie et al. [START_REF] Luckie | Traceroute Probe Method and Forward IP Path Inference[END_REF] have observed different paths depending on the traceroute method (UDP, ICMP, or TCP), no prior work has studied how often piggybacking traceroute probes within application flows will discover different paths. This section compares Service traceroute with different traceroute probing methods using Paris traceroute. In addition, this section compares Service traceroute with 0Trace, which also piggybacks probes

Metrics

We select two metrics to compare the discovered paths. The path length captures the distance from the source to the last hop that replies to probes. For Paris traceroute, we take the length of the longest path in case of multiple paths. The path edit distance is the edit distance between the path discovered with Service traceroute and that discovered with 0Trace and with Paris traceroute (in case Paris traceroute returns multiple paths, we select the one with the smallest edit distance). The first metric captures whether one tool discovers more hops than the other, whereas the second captures how much the two outputs differ.

When we observe differences between paths, we analyze where the differences are in the path: origin AS, middle of the path, or destination AS. We map IPs to ASes using the RIPEstat Data API [START_REF]RIPEstat Data API[END_REF]. The location where the two paths diverge help us understand the placement of middleboxes.

Path differences with Paris Traceroute

We compare Service traceroute with two versions of Paris traceroute. The multipath detection algorithm (MDA) enabled using TCP, ICMP, and UDP probes and the standard Paris traceroute using the same 5tuple as the target application flow.

Figure 7 and Figure 8 present the cumulative distribution functions of path length for each service: Web, Twitch, and Youtube (UDP and TCP), using Paris traceroute MDA and standard Paris traceroute respectively. Figure 7 shows that for all three services, probing with TCP and UDP discovers less hops. While, Figure 8 shows that probing with the same 5-tuple of the target application flow discovers the same number of hops as Service traceroute. This result implies that firewalls close to the destination may prevent TCP and UDP traffic that corresponds to no active flow to reach the destination. In addition, this result confirms Luckie et al. [START_REF] Luckie | Traceroute Probe Method and Forward IP Path Inference[END_REF]'s analysis from ten years ago, which showed that UDP probes cannot reach the top Alexa web sites as probes correspond to no active flow. ICMP and Service traceroute probes are able to obtain longer paths for all three services analyzed.

Figure 9 and Figure 10 compare the hops in the discovered paths using the path edit distance. A path edit distance of zero corresponds to the case when the Paris traceroute output contains Service traceroute's path. Figure 9 shows that the path discovered with Service traceroute only matches with the best path discovered by Paris traceroute MDA in about 55% of the webpage downloads, 50% of the Twitch sessions, and almost 75% of the Youtube streaming sessions. For Twitch, UDP discovers paths that are the most similar to Service traceroute's paths, whereas for both Web and Youtube, ICMP leads to the most similar paths. While, Figure 10 shows that for all services, standard Paris traceroute obtains the same paths of Service traceroute more often than Paris traceroute MDA, in about 63% of the Twitch To help interpret these results we study the location of the points where Service traceroute's and Paris traceroute's paths diverge, which we call the divergence point. Table 1 shows the fraction of experiments with divergence points at the origin AS, the middle of the path, and the destination AS. We first consider the divergence points using Paris traceroute MDA. For Twitch, we observe a large number of divergence points in the middle of the path for all probing protocols. For ICMP, we also observe few divergence points on both origin and destination side. For Youtube, we see few divergence points when probing with UDP and TCP, with a peak of 2% on the destination side. This result, together with short path lengths and large path edit distances confirm that some hop in the path discards UDP and TCP probes. While, using ICMP probes, most of divergence points are on the destination side, and a few in the origin and in the middle of the path. Finally, for web pages, we notice a negligible numbers of divergence points when probing with TCP and UDP, mostly focused in the middle of the path. While, when probing with ICMP we observe a large number of divergence points on both middle (22%) and destination (20%) side. Similarly for Youtube, the low divergence points encountered when probing with TCP or UDP, the high path edit distance and the low path length confirms that sometimes probes are not able to reach the top Alexa web sites. For standard Paris traceroute, we observe more divergence points than Paris traceroute MDA. For web pages, the vast majority of divergence points are focused in the origin and in the middle of the path and fewer on the destination side. For Twitch, there is a significant number of divergence points in the middle of the paths, few on the origin side and a negligible numbers on the destination side. Finally, for youtube, there are few divergence points on both the origin and destination side. Using the same ports as the target application flow increases the probability to get the same path discovered with Service traceroute. Even if the number of divergence points is larger with the standard version of Paris traceroute, the fact that probes are not blocked as those of Paris traceroute MDA yields better results in terms of path edit distance, hence standard Paris traceroute's paths are the most similar to Service traceroute's paths when compared with Paris traceroute MDA.

Takeaway. Our analysis shows that the paths discovered by piggybacking traceroutes within the target application flow are often different by a few hops from paths discovered by typical traceroute tools. Although these results are for European vantage points and a small set of applications, they agree with previous large scale analysis of traceroute results with different methods [START_REF] Luckie | Traceroute Probe Method and Forward IP Path Inference[END_REF]. As such, we argue that a tool like Service traceroute is crucial for accurately debugging Internet services.

Path differences with 0Trace

We compare Service traceroute with 0Trace. Similarly with Paris Traceroute, we studied the cumulative distribution functions of path length and path edit distance. Unfortunately, the download time for web pages is extremely short and our script was too slow to detect the target application flows and then run 0Trace, so for this comparison we focused only on Twitch and Youtube. This experience shows that simply running 0Trace for application debugging is not trivial and that integrating the identification of flows with path tracing as we do in Service traceroute is key for application debugging. In the case of path length for Twitch, we observe that the distributions of path length of 0Trace and Service traceroute are similar. While for Youtube, the path length reaches the maximum distance of 10 hops, which is the same as Paris Traceroute MDA with TCP and UDP. This is quite surprising, since Service traceroute and ICMP are able to discover longer paths. This result suggests that some middleboxes near the destination discards both Paris Traceroute and 0Trace probes. From the analysis of 0Trace code, the tool copies the 5tuple identifier of the application flow, the sequence and acknowledgment numbers. However, during the execution it increases the sequence number by one for each probe and it does not update the sequence number when newer packets are transmitted. Thus, after the first transmitted probe from 0Trace, the other probes have a wrong sequence number compared to the target application flow and middleboxes might detect it and drop the probes for security reasons.

Considering the path edit distance, 0Trace obtains the same paths of Service traceroute in 45% of cases for both Youtube and Twitch. Comparing the distribution of path edit distance between 0Trace and Paris Traceroute, we observe that 0Trace obtains paths that are more similar to paths obtained from Service traceroute. Similarly as Paris Traceroute comparison, we study the location of points, where Service traceroute's and 0Trace's paths diverge, the divergence points. For both Twitch and Youtube, we observe a significant number of divergence points focused in the middle of the path (39% for Twitch and 48% for Youtube) and some on both the origin and destination side. The reason of these high values is that tracing paths of the same application flows but with different 5-tuple identifiers may yields different paths. Thus, even running the same script for Service traceroute and 0Trace, paths might differ at least one divergence point. Paris Traceroute MDA's paths have less divergence points because Paris Traceroute MDA returns multiple paths between two end hosts and one of these might be the one Service traceroute discovered.

Takeaway. Our analysis shows that 0Trace obtains paths that are more similar to Service traceroute's paths than comparing with Paris Traceroute's paths. However, some middleboxes detect the probes of 0Trace from the wrong sequence numbers and hence, for security reasons middleboxes discard the probes. Thus, preserving the sequence and acknowledgment numbers as Service traceroute does is key to reach the destination and obtain all replying hops when tracing the path of an application flow.

RELATED WORK

Since Jacobson's original traceroute tool [START_REF] Jacobson | traceroute[END_REF], a number of new versions have emerged with different features and with new methods for constructing probes (e.g., Paris traceroute [START_REF] Augustin | Avoiding Traceroute Anomalies with Paris Traceroute[END_REF][START_REF] Veitch | Failure Control in Multipath Route Tracing[END_REF] and tcptraceroute [START_REF] Torren | Tcptraceroute-a traceroute implementation using tcp packets. man page[END_REF]). All these traceroute versions have a drawback for the goal of diagnosing a target application flow because they start a new flow to send probes. As such, middleboxes may treat them differently than the target application flow. Service traceroute avoids this issue by pig-gybacking traceroute probes within active application flows. This idea was first introduced in paratrace [START_REF] Kaminsky | Parasitic Traceroute via Established TCP Flows & IPID Hopcount[END_REF], which is no longer available, and then re-implemented in 0trace [START_REF] Edge | Tracing behind the firewall[END_REF] with the goal of tracing through firewalls and in TCP sidecar [START_REF] Sherwood | Touring the internet in a tcp sidecar[END_REF] for reducing complaints of largescale traceroute probing for topology mapping. Unfortunately, none of these tools is actively maintained. Service traceroute adds the capability of automatically identifying application flows to trace by a domain name, of tracing UDP flows as well as of tracing multiple concurrent flows that compose a service. We release both a command-line and a library version as open source. Furthermore, we present an evaluation of the side-effects of piggybacking traceroute probes within application traffic as well as of its benefit by comparing the differences with Paris traceroute and with 0Trace. Our characterization reappraises some of the findings from Luckie et al. [START_REF] Luckie | Traceroute Probe Method and Forward IP Path Inference[END_REF], which show that the discovered paths depend on the protocol used in the probes. Their study, however, includes no traceroute tools that piggyback on application flows.

CONCLUSION

In this paper we present Service traceroute, a tool aimed at tracing paths from multiple concurrent flows generated by modern Internet services. Results from an European-scale evaluation performed using popular web and video services show that in the vast majority of cases, Service traceroute has no side-effect on the target application. It obtains paths not discovered by Paris Traceroute MDA in more than 40% of the traced paths, up to more than 70% with Youtube. While, it obtains paths not discovered by standard Paris traceroute using probes with the same 5 tuple as the target application flow in more than 7% of the traced paths, up to 37% with Twitch. 0Trace has a lower path edit distance compared with the path edit distance of Paris traceroute MDA, but the path length is generally lower than Service traceroute. In future work, we plan to add the support of IPv6 to Service traceroute. We further plan to perform a large-scale characterization of results of Service traceroute, across a wide-variety of services and global distributed vantage points. As part of this, we will evaluate possible side effects on different type of services different from video.

Figure 1 :

 1 Figure 1: Probe overhead of Service traceroute

Figure 2 :

 2 Figure 2: Ratio of completed traceroutes

Figure 3 :

 3 Figure 3: Flow duration distributions of target application flows with and without Service traceroute

Figure

  Figure4presents the cumulative distribution of the average throughput of target application flows in our experiments for Web and video. Similar to flow duration, we observe that Service traceroute has no impact on target application flow throughput, since the evolution of distributions are the same without noticeable differences.Figure5presents the cumulative distribution of the maximum difference of TCP windows size of target application flows for both web and video. The figure shows that Service traceroute does not affect the window size of the receiver, hence probes which are duplicate acknowledgments are not causing any reduction of the TCP window size.Finally, Figure6shows the cumulative distribution of the number of TCP retransmissions of target application flows. In this case, web pages and twitch have the same distribution whether Service traceroute is used or not. For Youtube, there is a slight difference when Service traceroute is used but the number of cases is limited to 1% of Youtube application flows. The difference of the number of retransmissions is limited to

Figure 4 :Figure 5 :

 45 Figure 4: Throughput distributions of target application flows with and without Service traceroute

Figure 6 :

 6 Figure 6: Number of TCP retransmissions of target application flows with and without Service traceroute

Figure 9 :

 9 Figure 9: Path edit distance between Service traceroute and Paris Traceroute, and between Service traceroute and 0Trace

Figure 10 :

 10 Figure 10: Path edit distance between Service traceroute and Paris Traceroute using the same source and destination ports

1

  The library and command-line version of Service traceroute is publicly-available and open source at

Table 1 :

 1 Location of divergence points [%]

		Web Pages (TCP)	Twitch (TCP)	Youtube (TCP and UDP)
	Configuration Origin Middle Dest. Origin Middle Dest. Origin Middle	Dest.
	MDA UDP	0.54	5.22	1.86	0.34	18.88	0.26	0.10	0.18	1.15
	MDA TCP	1.02	4.98	1.26	0.32	17.31	0.26	0.15	0.15	1.89
	MDA ICMP	4.86	21.94 19.96	3.43	44.31	1.54	0.68	0.56	17.94
	Standard PT	4.07	5.81	2.03	6.50	18.95	1.20	4.08	1.47	8.61
	0Trace	-	-	-	6.18	39.34	9.87	3.52	48.43	8.59

https://github.com/wontoniii/tracetcp/tree/servicetraceroute.[START_REF] Jacobson | traceroute[END_REF] We use the traditional 5-tuple definition of a flow (protocol, source and destination IP, as well as source and destination port).

Acknowledgments

This work was supported by the French ANR Project no. ANR-15-CE25-0013-01 (BottleNet), by the Inria Project Lab BetterNet, and by a Google Faculty Award.


Larisa Bulysheva
email: abulyshev@nextvr.com

Alexander Bulyshev
email: lbulyshe@odu.edu

Michael Kataev
email: kataev.m@sibmail.com

Image Database Management Architecture: Logical Structure and Indexing Methods

Keywords: Image Database Management, Super-Resolution, Visual Data, Data Indexing, Hash Function, Content-Based Image Retrieval (CBIR), Industrial Information Integration Systems, Video Database

Visual information is an important type of information in modern life. However, it is still not used by organizations in a full capacity. The major reason for that is the lack of internal structure of visual information. The existence of this structure in numerical data allows to build very effective tools for classification, storage, and retrieval of numerical information, such as a relational data management system. In case of visual information, each value of the picture is basically meaningless, but the set of pixels starts carry meaningful information. In this paper, we aim to classify different types of images based on the areas of origination and application. We also suggest the possible structure of the database management system with images as elements of it. Another objective is to propose the indexing methods, which allow to avoid the direct comparison of visual query consequently to entire database. We also introduce the idea of applying multi frame superresolution method to development of store-retrieval procedures for a database with dynamical visual information.

Introduction

Accumulations of enormous amount of visual information, such as industrial images, aerial and satellite images, medical images, and others require development of new approaches on how to store, pre-process and retrieve it. The challenge to make of use of Big Data or vast information generated by industrial information integration systems should be addressed [START_REF] Xu | Enterprise Systems: State-of-the-Art and Future Trends[END_REF][START_REF] Xu | Engineering Informatics: State of the Art and Future Trends[END_REF][START_REF] Xu | Enterprise Integration and Information Architectures[END_REF]. In [START_REF] Bulysheva | A Hybrid Model for Image Databases[END_REF], one of the co-author of the current paper proposed a hybrid method of visual database organization and image retrieval. The main idea is to combine annotation approach with SBIR approach. In [START_REF] Bulysheva | A new approach for image databases design[END_REF], authors investigated several types of visual data, and proposed indexing algorithms for each of those types.

In general, there are two major approaches to store and retrieve visual information: text-based approach and content-based image retrieval (SBIR) approach. First approach operates not with image itself, but with a text which accompanies the image (annotation). In some sense the annotation serves as an index. When descriptive and reliable annotation exists, this method is very effective and efficient. However, it is rare the case. Since annotations are produced manually most of the time, the retrieval procedures suffer with low reliability.

Another approach extracts all necessary information from images themselves [START_REF] Liu | A survey of content-based image retrieval with high-level semantics[END_REF]. As a rule, intensity histograms and RGB proportions are major components. Both characteristics are important; however, they cannot be universal measures of image differences. There are some attempts (see for example [START_REF] Li | Object and Content Recognition for content-based Image Retrieval[END_REF][START_REF] Li | Object Recognition for content-based Image Retrieval[END_REF][START_REF] Oberoi | Content-Based Image Retrieval System for Medical Databases (CBIR-MD) -Lucratively tested on Endoscopy, Dental and Skull Images[END_REF]) to add the scene characteristics to the retrieval process, but they are very objects specific, and it is difficult to generalize those approaches.

In the current paper, we discuss extended version of the hybrid approach, and also discuss the possibility of database organization for storage and retrieval of data based on video information.

Different Types of Search

Talking about visual databases, authors very often mention entirely different types of storage and retrieval procedures. First, web-based storage is completely non-organized structure, where search is stochastic and produced "hits" or something similar on the query image. Second, database type storage where all elements are allocated into some logical structure, the search is deterministic, and the results are unique (including empty output).

In the current paper, we describe approach to image information organization, storage, and retrieval related to second type. Before an image is placed into database, it is pre-processed, annotated, and indexed [START_REF] Bulysheva | A new approach for image databases design[END_REF]. The process of annotation and indexing depends on the nature of images. As was discussed in [START_REF] Bulysheva | A new approach for image databases design[END_REF], the numerical indexing algorithms can be produced for different types of image collections: medical, satellite, aerial, virtual show room, forensic science. In all this cases annotation can be done based on meta information associated with the image itself. Simple but effective and efficient indexed method based on explicit hash functions are described in [START_REF] Bulysheva | A new approach for image databases design[END_REF].

Much more complicated situation arises, when collection of images comes from variety of non-organized sources, such as the Internet, images collections, surveillance images and videos. In this case, we propose to use B+ tree indexing algorithm [START_REF] Cormen | Introduction to Algorithm[END_REF][START_REF] Zhang | The Volume Cutting of Three-Dimensional Image Based on B+ Tree[END_REF][START_REF] Navathe | Fundamentals of database systems[END_REF].

3

Extended Hybrid Method

Stored Procedures

As was described in [START_REF] Bulysheva | A Hybrid Model for Image Databases[END_REF][START_REF] Bulysheva | A new approach for image databases design[END_REF], the hybrid method was intended to combine strengths of both approaches mentioned above. Prior the storage procedure, all images should be annotated automatically. Image processing steps can be described as shown in Figure 1. The main idea of the method, that the image is associated with physical object(s). The image database stores formal object descriptions (classification) and detailed categorical or numerical attributes of the object.

Annotations needs to be stored in the database for annotations together with links to the images themselves. Annotations should be converted into indexes. For medical, satellite, aerial, industrial, and surveillance databases an explicit expression of hash functions can be formulated. Using explicit formula with just a few arithmetical operations as a hash function is the most effective and efficient choice. Details are presented in [START_REF] Bulysheva | A new approach for image databases design[END_REF].

In case of general image collections or for collections with a priory unknown internal logical structures a B+ tree algorithms [START_REF] Cormen | Introduction to Algorithm[END_REF][START_REF] Zhang | The Volume Cutting of Three-Dimensional Image Based on B+ Tree[END_REF] Basic image attributes should be extracted and stored on the highest level of description. Attribute "Scene" will be determined as the result of imaging analysis. Major steps of the process are shown in Figure 3. Images can be easily classified and automated by identifying the sources where these images are acquired.

Image Segmentation

The major purpose of the annotation process is to understand what kind of object is represented in the image. However, in general case many different objects can be presented simultaneously. It makes the segmentation of image the important step. Image segmentation is a decomposition process, when parts of image with different characteristics are separated from each other. Image segmentation provides data compression also. The techniques for data segmentation are very mature now [START_REF] Bulyshev | Modeling segmentation algorithm[END_REF][START_REF] Bulysheva | Segmentation modeling algorithm: a novel algorithm in data mining[END_REF][START_REF] Pham | Current methods in medical image segmentation[END_REF][START_REF] Florack | The topological structure of scale-space images[END_REF]. However, the segmentation method which is capable of complete automation is still a challenging problem. We plan to use well known methods [START_REF] Bulyshev | Modeling segmentation algorithm[END_REF][START_REF] Bulysheva | Segmentation modeling algorithm: a novel algorithm in data mining[END_REF] to segment images. The result of image segmentation will be a plurality of sub-images derived from an original image.

Object Classification

After image is segmented into set of smaller images, each of which contains individual object, these objects should be identified by comparison with examples from database. This step is critical for entire method. There were many attempts to solve this problem for different types of objects [START_REF] Kumar | A Survey on Data Mining and Pattern Recognition Techniques for Soil Data Mining[END_REF][START_REF] Zare | Automatic medical X-ray image classification using annotation[END_REF]. We plan to use multi step hierarchical approach. The first task is to determine an object class: building, road, person, animal, crowd, and so on. For this purpose, object database contains major features of the objects of a given class. The most popular example is a face recognition. One of the well-known method in this area [START_REF] Viola | Robust Real-Time Face Detection[END_REF] was tested by us for the case of multiple faces. Some of results of this procedure are shown in Figure 4.

To recognize other objects like mountains, buildings, animals, ships, cars and so on, should be used different algorithms. It is important that these image classification procedures can be automated completely.

Generating Annotations

The last step is to assign individual characteristics to the objects. It is logical to use the tree type structure to store object parameters. Typically, very general objects descriptions are stored on the top level of this structure, and individual categorical and numerical values are stored in the leaves level. The set of individual characteristics and the total number will depend on the types of image. Very often the total number of the characteristics relate to geometries. For example, the dimensions and proportions of an object. There are many different algorithms to determine categorical and numerical values of parameters: neural networks [START_REF] Rowley | Neural network-based face detection[END_REF], regression [START_REF] Dowdy | Statistics for Research[END_REF], logistical regression [START_REF] Dreiseit | Logistic regression and artificial neural network classification models: a methodology review[END_REF], conditional probabilities approach [START_REF] Bishop | Pattern Recognition and Machine Learning[END_REF], Markov chains [START_REF] Chen | Image Parsing: Unifying Segmentation, Detection, and Recognition[END_REF], and others. Our experience shows that following methods are most effective in this case: correlation analysis [START_REF] Rowley | Neural network-based face detection[END_REF], Lucas-Kanade algorithm [START_REF] Baker | Lucas-Kanade 20 Years On: A Unifying Framework[END_REF], and conditional probability method [START_REF] Bishop | Pattern Recognition and Machine Learning[END_REF]. The image description, which is based on the annotation method, can be presented as a set of attributes, such as the types of image or landscape, type of crowd. It could be rural landscape features, urban landscape features, human face or figure features, or other unique characteristics of objects.

Retrieval Procedures

The procedures described above are done over the query image. Then, the search is performed using two stages: first, search by index, second, search by image itself. This approach allows to reduce processing time dramatically. The choice of index search algorithm depends on the type of images collection. As it was stated above, explicit hash functions can be used for indexing for most cases of structured image data. However, for initially unstructured data, like a random pictures collection, B+ tree approach [START_REF] Zhang | The Volume Cutting of Three-Dimensional Image Based on B+ Tree[END_REF][START_REF] Navathe | Fundamentals of database systems[END_REF] is the preferred method.

Video Database and Super-Resolution Method

Even more complicated case of visual information database is organization and retrieval information from movie collections. Since every individual movie is a set of mages (frames), the size of each individual element is large, and the size of all collection is extremely large. This circumstance requires using special approaches.

There are different kind of queries can be applied in case of a movie database. Queries based on textual information should be processed a traditional way. This option is widely used in our days. Visual based queries should be processed using approaches which are described above. However, there are two important differences are noted comparably with image databases.

First, there is dynamic information available in video databases. That means that some objects are moving and not just object itself but its velocity (or acceleration) could be subject of indexing [START_REF] Kotov | Indexing of video flow based of face recognition[END_REF].

Second, the fact that video is a sequence of scene which are slow changed from frame to frame opens new opportunities which were not available in case of static images. The set of frames can be used as input data for super-resolution algorithm [START_REF] Bulyshev | Three-dimensional super-resolution: theory, modeling, and field test results[END_REF]. It gives possibility to make query with depicted small object, which barely resolved in each individual frame, but becomes sufficiently resolved due to super-resolution method.

Combination of these two features can make possible to resolve and recognize a small moving object. It could be very useful for analysis of the surveillance camera or to find the image of unknown object, such as UAV (Unmanned Aerial Vehicle), for example.

Conclusion and Future Research

In the current paper, we investigate new possibility to construct databases which contain visual information. The description of a new indexing approach which covers the most complex case of unstructured data collection is presented. It was shown, that the data structure for image store -retrieval procedures can be built in general case. It was also shown, that object-based store-retrieval procedures can use already developed image processing functions. We provided examples of these functions.

We also propose a paradigm of the database which contains dynamical visual information. The idea is to apply multi frame super-resolution method to development of store-retrieval procedures with a higher spatial resolution. These procedures are not available on individual frame level and might be used to identify new moving objects. Using Super-Resolution Technique allows to create a database of digital movies with following advanced features comparable with static images:

-make queries not just about objects, but about objects velocity and acceleration; -make query about small objects which are not resolved and recognizable on standalone images.

The future research will be focused on building a prototype of visual database applying principles described in the current paper. We plan to demonstrate that using super-resolution method can provide high resolution store -retrieval procedures capable to work in real time on the modern mass-produced hardware.

Fig. 1 .

 1 Fig. 1. Image processing steps.

Fig. 2 .

 2 Fig. 2. Basic image attributes.



  Fig. 3. Image processing block diagram of storage procedure.

Fig. 4 .

 4 Fig. 4. The areas of human faces are underlined with white circles.

Acknowledgments. The authors would like to thanks the IFIP Confenis 2017, General Chairs: Dr. Zhou Zou and Dr.Li Rong Zheng, IFIP WG 8.9 members for making this conference a great success.


András Gábor
email: agabor@filab.hu

Ildikó Szabó
email: ildiko.szabo2@uni-corvinus.hufizarbd@yahoo.com

Fizar Ahmed

Systematic Analysis of Future Competences Affected by Industry 4.0

Keywords: Industry 4.0, future competence, skill gap analysis, I/O model

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Researchers emphasize different aspects of Industry 4.0. Lu [START_REF] Lu | Industry 4.0: A Survey on Technologies, Applications and Open Research Issues[END_REF] summarized it as "an integrated, adapted, optimized, service-oriented, and interoperable manufacturing process which is correlate with algorithms, big data, and high technologies". Nevertheless, it has social aspects as well, because it takes effect on the demand side of labor market due to the emerging technologies (e.g. Smart Systems, Blockchain, Virtual Reality, Internet of Things etc.) applied by organizations to improve the effectiveness of their business processes. Supply chain processes including human aspects are transforming. The communication between human and machine is getting more interactive, presenting two-way interaction due to the machine learning developments. Technological competences required to execute procurement, production or sales activities are continually changing due to the short technological lifecycles. Adaptive, innovative, responsible decision makers desiring for knowledge are ideal employees in this variant environment. Educational institutions must rethink how the students' attitudes, knowledge, skills, autonomy, responsibility, meaning competences have to be improved during their studies.

New pedagogical approaches, new teaching methods are not so efficient if the labor market needs different training scope than an educational institute can provide. Future needs have to be predicated not just detected, because the approval or accreditation processes are long-term process in the world of education.

From a long-term research point of view, it is more interesting the future demand compliance with supply, because this approach fits better to regional development, managing links between academia and economy. Several directives, surveys, studies try to envisage the future skill demand, just to mention a recent EU wide initiative: S3 strategy [START_REF]Home -Smart Specialisation Platform[END_REF]. In addition, demography can be mentionedthe growing silver economy, the economic growth, investments create new jobs, and the development of technology, a.o. ICT. According to a popular and scientifically less grounded topos many foresees the AI 'hostile' takeover of labor market. (There is life after AI winter.)

One possible solution is to model the economy and try to conclude the future workforce demand. Doing this via well-known and approved input-output analysis model and using standardized statistical data, mainly from open sources (CSO, Eurostat open data), the model mirrors with good accuracy the economy sector-wise. The overall output (GDP), and labor intensity are important results for the next phase of modelling. Labor usage is presented in occupational distribution. In the next step, there are three main tasks to be performed: (1) translate the occupational structure into competence structure, (2) using the model create several future scenario in order to generate the future demand; (3) match the demand with the supply.

The overall purpose of modelling and analysis is to conclude what skills (competences) will be required by the world of labor on the selected time horizon, in region, sector, in selected job roles and/or occupations. After having learnt the requested skills (competences), the supply can be compared with the demand. In our investigation, we narrowed the supply to the fresh graduates. In reality, the supply is bigger if we take into account the number of potential workforce having in mind career exchange, reintegrated unemployed people and the mobility. On one hand, this the bias of the analysis results, on other hand it is very difficult to get realistic and exact figures related to the mentioned subgroups. In order to conduct the analysis several steps need to be performed.

This paper presents a system met these above-mentioned requirements. Section 1 deals with other research approaches to predict future competences and their relation with our solution. Having clarified the related main concepts in Section 2-5, a systematic analysis performed with this system is presented in Section 6. Conclusions about limitations and future work are drawn in Section 7.

State of the Art

Different studies deal with forecasting future competences. Systematic analysis is our main goal, so Approaches using models or other methods for synthetizing knowledge sources fall into our scope. Hence two research groups and two international institutions (OECD and CEDEFOP) specialized on this topic were selected to present their approaches. Their main characteristics are collected in the following table.

 Authors identify the research approach unequivocally.

 Scope presents that this a general forecast or focuses on a specialized area.

 Input shows which sources were used to build a model or determining predictions.  Method is the key element of a research, because it reflects the reality in a restricted manner.  Flexibility means that this research is capable of evaluating the small changes of factors. These studies highlighted future competences based on the experts' actual opinions about the future or statistical analyses. The first two studies contained mostly qualitative analyses, diminishing the chance to examine the role of different influencing factors. However, they provide us new insights with defining new skills. The last two studies used quantitative analyses based on past data, so the changes of influencing factors can be examined within these databases. Nevertheless, the current skill categories served as a basis for these analyses.

Authors

The goal of this work is to develop a system for revealing the relative importance of different competences in the future. Hence, it exploits the result of the previous studies, but it complements them as well. The qualitative studies must be repeated in order to detect the changes in the environment. The quantitative studies have no interest to modify their categories, because trend analysis requires strict meta-data catalogues to discover patterns or correlations along time dimensions. These approaches can complement each other and information system can synthetizing their advantages. It is capable of monitoring current situations, collecting open data as past data, performing forecasts based on them, presenting the results of different business scenarios due to the changeable parameters, so it is dynamically changeable but the other ones are not.

Beyond the State of the Art

These studies use models to collect the experts' current thoughts about the future. They do not capitalize the benefits of information systems which are capable of formalizing experts' thinking processes, opinions to create models, continually detecting the actual situations and mixing these outcomes to get a more precise estimation.

Different factors can influence the relative importance of future competences. Economic factors -like GDP, imports and exports can, sectoral outputs etc.and technological innovationslike smart systems, blockchain etc. -can influence the labor intensity of different sectors. This takes effect on occupations as well. The relative importance of occupations belonging to a more labor-intensive sector will increase. But competences are required to execute different tasks of these occupations. Therefore, the relative importance of these skills will grow. Input-output model developed by Leontief suits this problem, because it is widely used to model industrial outputs, cross-consumptions and labor intensity. Input data of this model can be downloaded due to the Open Government Data initiative. Sectors categorized by NACE represents the industries in this model. Occupations classified by ISCO-08 are connected to these NACE sectors and their distributions are published as open data. The relative importance of different ISCO-08 groups is determined on this way.

Unfortunately, the distributions of ISCO-08 subgroups per sector are not available therefore, another source have to be used to estimate them.

The aim of SMART project (2012-1-ES1-LEO05-49395) [START_REF]Smart-Project[END_REF] was to monitor actual competence needs via online posted job vacancies and compare them with the competences acquired during VET studies in the tourism industry. The SMART + project (2016-1-ES01-KA202-025304) [START_REF]Smart Plus Project -Official Website[END_REF] as its successor is to provide a comprehensive system for detecting skill gap for students and for institutions as well. Besides a comprehensive skill mismatch report, it provides a report concerned on just some positions. This system is capable of downloading and categorizing job vacancies by position, company, time and regional dimension, and extracting, storing competences required by the position. Another but connected research deals with creating a data warehouse from these datasets in order to monitor and analyze skill mismatches anytime and anywhere. At the end of the development process, monthly data will reside in this data warehouse (DW). ESCO [9] helps to connect the stored positions to occupations and it presents competences per occupation, which can be used to extend the above-mentioned extracted competence sets with new ones. The predicated competence sets per occupation will be calculated within the DW. Their relative importance means that we can state that a competence will be more important than another one, but we cannot state how many times it is. This relative importance will be calculated based on the predicated competence sets per occupation and the aggregated relative importance of the occupations requiring these competences within the ISCO-08. We assumed that the competence can inherit the importance of an occupation, because it is needed to execute a task and if more this kind of position is published then more this kind of task and its competences are required.

Main concepts and areas are clarified in the following sections.

Competence

One of the objectives of European Union long term strategy (EU2020) is to create the Single European Market (SEM). In the context of SEM, the macro-regional mobility highlights the questions of free movement of manpower. One aspect of the free movement of manpower is the workforce knowledge, skill and attitudecompetences in short -compliance from the perspective of the different Member States. Member States are not only geographically different, but differ significantly in terms of work culture. On corporate level, in the context of employees and employers it is a vital interest to get evidence of existing competences of the new employees, or having a timely monitored competence evolution of the staff.

There is a big terminology bonanza in this area. We are talking about competency and competences, knowledge, skill and attitude, autonomy and responsibility, job role, position and occupation, match and mismatch skills, job seekers, free movements of manpower, migrants and refugees, mobility, career development, employability and unemployment, labor market integration and re-integration …. the list is endless.

Competences has many interpretations in the literature and academia, especially in accreditation processes. In this paper, in our understanding competence is a mix of knowledge, hard/soft and transversal skills, attitude, autonomy, responsibility. This interpretation is often mentioned as employability skills. On micro level, required competences are linked to the job to be performed. From modelling point of view, jobs emphasized in tasks, and tasks are organized into business processes. Job roles, and their descriptions (in the sense what performers need to know and be able to perform the task) are part of one or more positions, connecting this way process and organizational views together.

While employers, corporates look for competences in connection with positions and connected job roles, on macro level the competences grouped and associated with occupational structure. An occupation is an element of the statistical nomenclature, positions and occupations are strictly linked together by administrative means. The mutual assignment is not without problems: the competence structure mirrors the present and future demand of industry, service sectors, and changes dynamically, however occupational structure is a rather rigid, follows a statistical nomenclature and changes are much less frequent. The occupational structure depends on macro structural variables, educational and training systems.

Stakeholders /interested parties

Competence matching is a wider issue, than many of us would have thought. Many types of stakeholders are interested in it, from different perspectives. On supply side, first of all employers, owners and managers of individual firms play the most significant customer roles. In addition, different (traditional and online) manpower services either from recruiting or selection purposes are significant stakeholders, but many professional associations offers also guidelines, conduct surveys in this direction. Finally, education sector, as one of the largest suppliers of graduates must know how effective they are.

On demand side, we must mention graduates, employees with mobility or career exchange motivation, unemployed to be re-integrated, any job seeker, in general.

4

Supply / demand

Supply

Available workforce may come from several sources. Academia, education sector is one of the main source, the output of the sector is well planned and it is relatively easy to forecast. From available or potential competences, we must take into consideration other forms of education/training, like informal, non-formal education, on the job-training, continuous education. From motivational point of view, the career exchange is an important driver, resulting extra job seekers with new or changed competences. Another source is the internal or macro-regional mobility, especially within EU, although this is not without any problem (cf. Brexit). We may mention also the re-integration of the unemployed people. Finally, the migration plays important role, which is a more complex problem, than just a manpower issue

Demand

Demand is also complex. Employers are quite different regarding their expectations, in the first group there are employers who request well-trained workforce whom they can use on the next day with full capacity, while another group of employers demand intelligent, 'smart' people, who are able and know how to learn, while training remain the employers' responsibility. The scale between the two groups is long and colorful. We need to highlight three specific drivers, which influences the demand: replacement due to the mobility, additional workforce due to economic growth and workforce with different competences due to the development.

I/O Model

Model selection: why input-output model?

The Leontief model, known as I/O analysis emphasizes the effects of change in the final demands for goods and services on particular industry with respect to its sales and purchases.

"The input-output method is an adaptation of the neoclassical theory of general equilibrium to the empirical study of the quantitative interdependence between interrelated economic activities. It was originally developed to analyze and measure the connections between the various producing and consuming sectors within a national economy… The specific structural characteristics of the system are thus determined by the coefficients of these equations. These coefficients must be determined empirically; in the analysis of the structural characteristics of an entire national economy, they are usually derived from statistical input-output tables" [START_REF]Encyclopedia.com, Input-Output Analysis -Dictionary definition of Input-Output Analysis | Encyclopedia.com: FREE online dictionary[END_REF] Leontief gave an extended interpretation to the coefficients the most important among them were the following: the coefficients have a statistical character, therefore they can be estimated; different coefficients based on the estimation statistically are quite stable, hence the model is suitable for different kinds of analyses, like assumption of different economic growth, changes in industry structure, etc.; the analyses may lead to quantitative evaluation of different economic policies, comparison of their indirect effects, accelerator effects or counter effects.

Later in the light of quite different economic theories and also due to the radical changes of global economy, many argued that I/O model has not reflect anymore objectively to the real life of national economy. However, the coefficientsin other word technological matrixare based on statistical data and still the most reliable although not the only data source for modelling. Adding to the model the capital investments, taking into account the modification effects of export-import activities, the I/O model still gives a good starting point for analysis. On the basis of the model results environmental effects, ecological considerations, the strengthening of third sector will be more understandable and lead to a more complex approach [START_REF] Stilwell | Input-output analysis: its potential application to the mining industry[END_REF].

From the perspective of this paper, we must emphasize the biggest advantages of using I/O model that is it can be built on official statistical data. The validity of data ensured by the national and macro-regional statistical data collection systems, and most of them is available in 'open data' format. The later mentioned feature means, the experiments; analyses can be reproduced in an automated fashion.

Data sources

Open Data / OGD / GOD

Central Statistical Office (CSO), Hungary

The data on persons employed in the Hungarian economy, according to NACE Rev. 2 (2008) 1 classification, is published by the Hungarian Central Statistical Office on its website together with other information of the national accounts. The information on persons relating to national account is important mainly for the calculation of the ratio, value added per worker in each industry of the national economy.

Eurostat

EUROSTAT provides industry-by-industry symmetric input-output tables. Hungarian data in ESA 1995 format was used from their data source. The matrix is an object as it is structured by industry. This organization presents supply and use tables and symmetric input-output tables that are a fundamental part of the European System of Accounts (ESA 1995).

OECD

The Organization for Economic Co-operation and Development (OECD) is involved for preparing Inter-Country Input-Output (ICIO) tables which based on different International Standard Industrial Classification of all economic activities (ISIC) revised version. The previous OECD national Input-Output tables present matrices of inter-industrial flows of goods and services (produced domestically and imported in current prices (USD million), for all OECD countries including 28 members of European Union and G20 economies, covering the years 1995 to 2011 based on the ISIC Revision 2.

The latest version of ICIO tables are based on ISIC revision version 3. The better integration with collections of statistics accumulated according to industrial activity such as research and development expenditure, employment, foreign direct investment and energy consumption. The OECD I/OT database is a very useful experiential tool for economic research and structural analysis at the international level as it highlights inter-industrial relationships covering all sectors of the economy.

World Input-Output Database (WIOD)

1 NACE is the statistical classification of economic activities in the European Community which imposes the job classification uniformly within all the member states of European Union. NACE Rev. 2 reflects the technological developments and structural changes of the economy, enabling the modernization of the community statistics and contributing, through more comparable and relevant data at both community and national level.

The World Input-Output Database (WIOD) is the first public database that contains new information on the nature of international trade and trends and provides the opportunity to analyze the consequences of division for shifting patterns in demand for skills in labor markets. These tables have been put up in a clear conceptual framework on the basis of officially published input-output tables in concurrence with national accounts and international trade statistics. In addition, the WIOD provides data on labor and capital inputs at industry level.

Concluding to demand

As it was outlined in the previous sections, the I/O model is used to do predictions on the changes of occupational structure, due to the economic growth, changes in productivity and the expected technological developments. In order to get the results, the gross domestic output per sector, used labor force / output unit, distribution of labor force / sector / occupation will be used as variables. With the help of ESCO ontology and database, we conclude to the expected competences / occupation. Difference between the expected and supplied competencies already provides sound basis of portfolio decisions.

6

Comparison (matching) competences

Requested competences / occupation

The first problem is how to conclude from the I/O model to the requested skills/competence structure. As we saw in the previous sections, I/O model, the coefficients results output per sectors, labor intensity and quantity per occupations, as they are classified by NACE. The granularity of occupations is very rough. We increase the specificity of occupations combining the occupations with sector. At this point, the ESCO database can be of great help, and with the help of ESCO the requested competences can be better positioned per job roles.

Available (provided) competences / occupation -EQF/National QF

The othersupplyside of competences seems to be easier issue. The EU accepted the European Qualification Framework (EQF) [START_REF]European qualifications framework (EQF)[END_REF], similar frameworks exist elsewhere, too. The EQF is very general, the national qualification frameworks are more detailed and localized, and on institutional level, we can get very precise and concrete competence (often called as learning outcome) listsat least what institutions claim to provide. For the sake of simplicity less assume, graduates have those competences.

The comparison of supply and demand will undertake by using SMART and SMART+ system2,3 .

Analysis: 'What if' scenarios

Time horizon / preference selection

The next problem is to select the suitable time horizon. The lower limit will be the minimum time, during which any change is becoming 'visible' on the national accounts, become manifest statistically. Theoretically, there is no upper limit, only limitation how far we can see in the future to keep the possible scenarios still realistic. If we consider the 'lead time' of a typical higher education institution, the most appropriate time horizon is between 3-5 years.

The growing economy (Foreign Direct Investment)

In general, economy may grow due to several reasons, increasing productivity, growing export, growing domestic demand, large volume of international aid (e.g. EU Structural and Cohesion Funds), etc. A special case is the Foreign Direct Investment, the investor is not selling or buying something but creates production sites, jobs, and the economic growth is based both on the direct investment and the additional gross domestic products due to the accelerator effect4 [START_REF]Foreign Direct Investment Statistics: Data, Analysis and Forecasts -OECD[END_REF]. I/O model is suitable to reflect both (direct and indirect) effect. In the first scenario we assume, the recently experienced fast development of electric car manufacturing will effect on the volume and structure of FDI. Retail sale of fossil energy is expected decreasing, energy sector as a whole need to be restructured, more investments, and technological development is needed, while the agro-based renewable energy production will decrease.

As a result, the inter-relations of the sectors will change, the overall domestic output will be increased. As one of the consequence, the labor-part of the GDP will change as well, both in terms of quantity and occupation structure, hence the change requests different skill-set and follows the changes in occupational structure (for the sake of simplicity linearity is assumed, which results some bias).

Changing the requested labor force (productivity, unchanged structure)

In the EU and G20 countries, a sound increase of productivity is monitored [START_REF]Level of GDP per capita and productivity[END_REF]. The annual average is around 20%, with very big differences among the countries. The largest improvement happened in Ireland and 135% productivity index is expected by 2018 (2010=100). From the point of occupational structure and demanded skill set point of view we may model the quantitative changes through the labor coefficients. The question is, in what extent will follow the occupational structure the increasing productivity (the assumption is the less-skilled workers' ratio will decrease).

Changing the requested labor force (technology, different structure)

The new technological phenomenon, the fast growing ratio of electric cars among the vehicles. Norway e.g. expects electric or hybrid cars make up half of new vehicle registrations in 2017 [START_REF]Half of all new cars in Norway are electric or hybrid[END_REF] . E-car manufacturing needs significantly less skilled jobs in the traditional machinery sectors, although less but better trained and skilled workers in the designer and constructing parts of car manufacturing. These changes will lead to the changes in the occupational structure.

On the other hand, the forecasted technology breakthrough will affect not only the manufacturing sector but significant changes are expected in the energy sector, too. Electric Vehicles (EVs) promise technology for reducing the environmental burden of road transport. Other energy types like renewable energy production provides the largest market swing over time: from 19% of production in 2010, 32% is expected in 2020 and will continuously grows up to 50% by 2050 [START_REF] Van Essen | Impacts of electric vehicles: summary report[END_REF].

Technology plays a vital role for changing labor market trends. Several industry studies in equal extent say that fully autonomous vehicles are to be commercially available before 2020. In 2030, the share of electrified vehicles could range from 10 percent to 50 percent of new-vehicle sales.

As a consequence the technological impact on the demand side of labor market implies structural changes of required competencies. Educational institutes need time to change their educational portfolio due to the lead-time of formal education. A system, which is capable to predict the future occupational structure and conclude to the required competencies, can facilitate decision making processes both in the educational institutes and in the world of labor.

Fig. 1. Number and distribution of managerial position by sectors

A business scenario reflecting the influence of growing number of electric car was used to present the working of this system. Fig. 1. shows the expected changes in terms growth of output, improving productivity and creating new (skilled) jobs will change the localization of the managerial positions. The result is almost double the demand for skilled workers, and the relatve need is bigger in the productive sectors (first economy) than in the second and third.

Nowadays ESCO collected the main managerial aspect like "plan, organize, coordinate, control and direct the work done by others." Fig. 1. presents that managerial jobs and related competences will be important in the future. There are managerial competences specialized in a given sector e.g. monitoring fields and managing agricultural staff by a crop production manager or monitoring technological trends and managing contracts by an ICT production manager and there are general competences related to different managerial job roles [9]. Fig 2 . presents how these general competences are distributed among 19 selected occupations . It shows that the "adhere to organisational guidelines" competence is required by seven different managerial occupations.

The system presented in this paper is capable of estimating the importance of occupations affected by changes in industrial structures and the importance of specific and general competences belonging to these occupations

The selected most important competences can be compared with the competences provided by a training program via Smart+ system. This gives very clear indication to the education sector how and in which direction develop their portfolio.

To execute deeper analysis along the hierarchy of ISCO occupations, the distributions of these occupations per main group are needed. If publishing governmental data on Internet will be a best practice, it solves this problem.

Discussion, conclusion

It is difficult to validate that our prediction is appropriate or not, because different factors are counted in by different research groups. The goal of this paper is not to predict the future. Its goal is to present a conception about developing an information system in order to formalize experts' thoughts via business scenarios by input-output model and check the influence of labor-intensive sectors on related occupations and competences.

The development of this system is ongoing. The concept of Open Government Initiative (OGI) has to be adapted widely in order to get relevant databases from every year in order to make this system capable of monitoring actual open data and modifying results based on them, meaning to make it dynamically adaptive to the variant environment. The distributions of occupations per ISCO-08 main group, per industry, per country are missing. OGI can solve this problem or a data warehouse that can provide statistical analysis based on past data as we plan.

The novelty of this system is to collect input-output and labor market data dynamically from Internet, it these data are available, apply directly input-output model to these data, provide opportunity to test future scenarios about the effects of technological changing on the labor market and determine competence sets for further analysis. It helps to redesign competence sets provided by training programs in the light of business scenarios derived from the business climate of Industry 4.0.

SMART -Supporting dynamic MAtching for Regional development, 2012-1-ES1-LEO05-

SMART PLUS 2016-1-ES01-KA202-025304

However in 2016 the FDI fall 7% according to the OECD data, on a longer term increase is expected[START_REF]Foreign Direct Investment Statistics: Data, Analysis and Forecasts -OECD[END_REF]

Acknowledgement cLINK (Centre of excellence for Learning, Innovation, Networking and Knowledge) ERUSMUS MUNDUS Project, Ref: 372242-1-2012-1-UK-ERA MUNDUS-EMA21