Michal Valko

Richard Pelikan

Milos Hauskrecht

Learning predictive models for combinations of heterogeneous proteomic data sources

Multiple technologies that measure expression levels of protein mixtures in the human body offer a potential for detection and understanding the disease. The recent increase of these technologies prompts researchers to evaluate the individual and combined utility of data generated by the technologies. In this work, we study two data sources to measure the expression of protein mixtures in the human body: whole-sample MS profiling and multiplexed protein arrays. We investigate the individual and combined utility of these technologies by learning and testing a variety of classification models on the data from a pancreatic cancer study. We show that for the combination of these two (heterogeneous) datasets, classification models that work well on one of them individually fail on the combination of the two datasets. We study and propose a class of model fusion methods that acknowledge the differences and try to reap most of the benefits from their combination.

INTRODUCTION

Multiple novel technologies that measure expression levels of complex protein mixtures in the human body from a variety of specimen, such as blood or urine, offer a great potential for improved detection and understanding of the disease. With the recent increase in the number of these technologies the challenge becomes the understanding of individual and combined benefits of data generated by these technologies. As the possibilities increase, so does the data production and researchers are pressed to find the best methods suitable for their combined analysis. In this work we study two such technologies: [START_REF] Adam | Proteomic approaches to biomarker discovery in prostate and bladder cancers[END_REF] multiplexed protein arrays, and [START_REF] Wright | Proteinchip(R) surface enhanced laser desorption/ionization (SELDI) mass spectrometry: a novel protein biochip technology for detection of prostate cancer biomarkers in complex protein mixtures[END_REF] MS spectrometry proteomic profiling, and analyze their individual and combined benefits in context of disease detection.

Luminex arrays. Conventional assay methodologies, such as ELISA, RIA, or PCR permit the analysis of a single, or a limited number of markers. Assay techniques that can simultaneously examine a large number of pre-selected proteomic biomarkers from a small amount of serum are hence of great potential value for better characterization of the disease. Luminex Corporation (http://www.luminexcorp.com) has recently in-troduced a novel protein array system, xMAP®, which allows for simultaneous assessment and quantitation of up to 100 soluble analytes in one sample. These analytes are carefully picked and include immunogenic and growth factor markers such as: IL-2, IL 8, MMP-7, MMP-12, IP-10 and others. Time-of-flight mass spectrometry (TOF-MS) has become a widely used tool for the rapid analysis of protein-mass content in a variety of biospecimen (blood, urine, cell-lysates). Thousands of mass measurements of molecules present in the sample appear along the profile. Despite the overlap in mass signatures of these species, it is possible to find discriminatory patterns which distinguish the profiles of diseased and healthy patients. The technology has been used to successfully find patterns and predictive models for several diseases, including cancer [START_REF] Adam | Proteomic approaches to biomarker discovery in prostate and bladder cancers[END_REF][START_REF] Wright | Proteinchip(R) surface enhanced laser desorption/ionization (SELDI) mass spectrometry: a novel protein biochip technology for detection of prostate cancer biomarkers in complex protein mixtures[END_REF][START_REF] Petricoin | Use of proteomic patterns in serum to identify ovarian cancer[END_REF][START_REF] Petricoin | Serum Proteomic Patterns for Detection of Prostate Cancer[END_REF], arthritis [START_REF] Saulot | Presence of autoantibodies to the glycolytic enzyme alpha-enolase in sera from patients with early rheumatoid arthritis[END_REF], ALS [START_REF] Sickmann | Towards a high resolution separation of human cerebrofluid[END_REF] etc.

Disease detection.

Classification learning methods allow us to extract models that permit detection of a disease from data. Unfortunately, a single machine learning model or a method that fits all possible datasets and consistently gives the best possible performance does not exist. We investigate the individual and combined potential of data generated by these two technologies on detecting disease in patients with pancreatic cancer by learning and testing a variety of classification models. The samples are based on the study conducted at the University of Pittsburgh Cancer Institute and data used in [START_REF] Hauskrecht | Feature Selection for Classification of SELDI-TOF-MS Proteomic Profiles[END_REF].

Challenges. Luminex and SELDI-TOF-MS technologies provide data that may indicate through variety of patterns the presence or absence of the disease. However, the differences in the nature of data generated by them raise concerns that they are not easy to combine into a single machine learning model. First, the immunogenic and growth factor proteomic markers measured by Luminex xMAP ® technology are likely to be biologically independent of SELDI-TOF-MS profile features and patterns, thus providing complementary information about the disease. Second, SELDI-TOF-MS data are high dimensional and typically involve hundreds of measurements, while Luminex arrays are restricted to at most 100 probes (typically 30-60 probes) of preselected species. Third, MS-data tend to exhibit a large amount of signal correlates, while Luminex is a collection of independent probes with fewer correlations.

We show that features of the two data sources can be successfully captured by two different machine learning models. Second, we show and that a naïve combination of the data from both data sources does not lead to improvements in any of the two models and in one instance the results are much worse. To reap the benefits of the combination of the data-sources we propose and study machine learning models that acknowledge the differences in the two data streams and demonstrate their combined classification improvement.

DATA

The pancreatic dataset used in this study consists of 106 samples, with 56 cases and 53 smoking-age and gender matched controls collected at the University of Pittsburgh Cancer Institute. There are two different data sources for these samples: 1554 peaks from SELDI-TOF-MS profiles and 30 measurements from Luminex data.

Luminex array data. Luminex Corporation's xMAP® technology uses polystyrene microspheres internally

dyed with two spectrally distinct fluorophores to create a family of 100 spectrally addressed bead sets. Each bead set can be conjugated with a capture antibody specific for a unique target protein. In a multiplexed assay, antibody-conjugated beads are allowed to react with sample (plasma, serum or cell culture supernatant). After washing, secondary phycoerythrin (PE) conjugated antibodies are added to to form a capture sandwich immunoassay. The assay solution was analyzed by the array Bio-Plex reader from Bio-Rad, which obtains two readings for every single bead: one that identifies a fluorochrome labeled bead, and another that measures the amount of PE fluorescence of the PE-conjugated detection antibody associated with the bead. The amount of PE fluorescence is proportional to the amount of analyte captured in the immunoassay. Bio-Plex Manager software (Bio-Rad) correlates each bead set to the assay reagent that has been coupled to it and estimates the concentration of each analyte in the sample. Using the assay, thousands of beads can be analyzed in seconds, allowing up to 100 analytes to be measured in a 96-well microplate in one hour.

MS proteomic profiles

Mass spectrometry proteomic profiling of serum samples was performed using SEL-DI-TOF-MS profiling technology (Ciphergen Biosystems, Inc.) The samples from the study were analyzed are spotted in duplicate on the IMAC-3 ProteinChip® array in blinded combined case/control batches. The protocols for the preparation and loading of serum samples for SELDI-TOF-MS analysis are specific for the ProteinChipr Arrays (Ciphergen Biosystems, Inc.). Fully automated BioMek2000r protocols for processing of IMAC3 ProteinChipr Arrays are presently being utilized in the UPCI Clinical Proteomics Facility. Protocols for automated processing of these ProteinChipr Arrays, as well as performing mass spectrometry and preprocessing of the spectral data for analysis, have been derived and optimized from protocols implemented and validated in this facility.

To eliminate systematic biases and noise in the MS data we apply five preprocessing steps implemented in the Proteomic data analysis package (PDAP) [START_REF] Hauskrecht | Feature Selection for Classification of SELDI-TOF-MS Proteomic Profiles[END_REF]: (1) variance stabilization, (2) baseline correction, (3) smoothing, (4) intensity normalization, and (5) profile alignment steps. Briefly, from many choices offered and implemented by PDAP we applied the following preprocessing choices: cube-root variance stabilization, PDAP's baseline subtraction routine based on the local moving window of width 200 time-points, Gaussian-kernel smoothing, peakbased dynamic programming alignment and the total ion current normalization restricted to the range of 1500-20000 Daltons. The qualities of profiles were tested beforehand on raw MS profile readings. None of the profiles used exhibited total ion current (TIC) that differed by more than two standard deviations from the mean TIC, which is our quality-assurance /quality-control threshold for sample exclusion.

Peak selection. The majority of proteomic data analyses in literature restrict their attention only to information represented in the peaks of the signal. Our peak selection procedure works with the mean profile obtained by averaging all profiles the training data. The approach is robust enough even if a specific peak is not recorded in all profiles, whilst it tends to average out random signal fluctuations. The peak locations are identified by calculating the signal derivatives. The peak intensities are average of readings in a local neighborhood of the peak location. Such a method reduces the chance of a noisy reading at a single m/z position.

METHODS OF ANALYSIS

Our aim is to build a classification model Y f → X :
that can, with a high accuracy, assign correct class labels Y (case or control) to profiles (X) collected for patients in the study. We adopt a machine learning approach in which the model is learned and evaluated from the data in the study.

A number of different models and algorithms built for the classification learning task exist. The methods include: linear discriminant analysis, CART, support vector machines, logistic regression, Naïve Bayes and others. However, many of these off-shelve classification models are not immediately applicable to analysis of high dimensional proteomic datasets. The main reason is a small sample size of studies combined with the dimensionality of the data. This lead to a model overfit where every sample in the dataset is fit via one or more parameters which in turn affects model's generalization performance. To address the problem our investigations have primarily focused on two classification models with robust generalization performances on both lower and high dimensional data: Support vector machines (SVMs) and Random Forests. These methods are currently available in our PDAP package [START_REF] Hauskrecht | Feature Selection for Classification of SELDI-TOF-MS Proteomic Profiles[END_REF].

The linear support vector machine or SVM [START_REF] Vapnik | The Nature of Statistical Learning Theory[END_REF][START_REF] Burges | A tutorial on support vector machines for pattern recognition[END_REF] learns a linear decision boundary that separates the ndimensional feature space into 2 partitions. The boundary is a hyperplane given by the equation 0

0 = + w T x w
, where w is the normal to the hyperplane, and 0 w is the distance separating the "support vectors" -representative samples from each class which most helpful for defining the decision boundary. The parameters of the model, w and 0 w , can be learned from data through quadratic optimization using a set of Lagrange parameters i α ˆ. These parameters allow us to redefine the decision boundary as where only samples in the support vector contribute to the computation of the decision boundary. The support vector machine comes with built in regularization abilities which perform very well when high dimensional datasets needs to be analyzed. [START_REF] Vapnik | The Nature of Statistical Learning Theory[END_REF][START_REF] Matheny | Effects of SVM parameter optimization on discrimination and calibration for post-procedural PCI mortality[END_REF] Random forest [START_REF] Breiman | Random forests[END_REF] is an ensemble classifier [START_REF] Hastie | The elements of statistical learning[END_REF] that combines the results of multiple decision trees classifiers through averaging. The decision trees in the ensemble are built using Classification and Regression Tree (CART) [START_REF] Breiman | Classification and Regression Trees[END_REF] or other tree-building algorithms, but the tree building is enriched through random feature selection process. Decision trees tend to work well for lower dimensional data and their advantage is the ability to capture various differences in between the groups via multiple non-linear decision splits. Random feature selection lets us to consider subsets of features rather than all features when learning the decision classifier which is believed to be an advantage if the dimensionality of the data is large when compared to the number of samples.

Combination of data sources

The simplest method to combine data from multiple data sources for classification purposes is to merge them together. A classifier is build for all data at once. The advantage of the approach is that no new models need to be considered, the limitation is that the performances of classifiers one can achieve on data corresponding to individual data sources may become hard to improve.

There is no universal classifier that works the best for all possible data sources. [START_REF] Caruana | Ensemble Selection from Libraries of Models[END_REF] Instead one often sees one classifier dominating the other on certain type of data. [START_REF] Caruana | Ensemble Selection from Libraries of Models[END_REF] Hence it is possible that different (base) classifiers exhibit the dominance for the data sources we have. The key challenge is to develop classification models that let us fit individual data sources well and after that combine their performance to improve the overall classification accuracy.

To address this problem we investigate two methods for combining different classification models: (1) model inclusion and (2) model composition. Both of these models take advantage of an opportunity to build soft discriminative projections from existing classification models. For SVM, it is a distance from a hyperplane ( 0 0 = + w T x w

). Likewise, in RF, we can compute the ratio of the trees that favor a particular class. We use these soft discriminative functions to design a compound classifier for the combined data sources.

Model inclusion:

First, we can use a soft output from one classifier as an extra feature for another. For example: We take SELDI data and learn a SVM for it. Then we the (train) data projected on a hyperplane and include this (1 dimensional) vector as an extra feature with the Luminex data. Eventually, we learn a RF classifier for the merged data. Conversely we can take tree ratio from the Luminex data and add it as and extra feature with SELDI for SVM.

Model composition approach builds a two layer classification model. On the first level a base classifier for a given data type is learned and its (soft) discriminative output is used as an input for a new (second level) classifier. For example, by doing this we can combine a distance from the hyperplane (from SVM) and tree ratio (from RF) to train a new classifier.

∑ ∈ + = + SV i T i i i T w y w 0 0 ) ( ˆx x x w α

Evaluation of the classification model quality

The quality of each model using random re-sampling validation schemes [START_REF] Efron | An introduction to the bootstrap[END_REF]. Briefly, our goal is to evaluate the generalization performance of the model, that is, its performance on samples we expect to see in the future. Since these are not available we split the data available to us into the training and test set. The model is always learned on the training set and tested on the test set. We use random sub-sampling approach to divide the dataset using 70/30 train/test split. To avoid potential biases due to a single train/test split we repeat the analysis on multiple (40) random splits and average their results. Each classification model is evaluated using: the accuracy, sensitivity and specificity of the model under 0-1 loss function and the Area under the ROC curve.

RESULTS AND DISCUSSION

Table 1 displays classification error (ACE), sensitivity, specificity statistics obtained by the SVM, CART, NB and RF models on MS proteomic data and the Luminex data both individually and after they are (data) merged. The first three statistics are obtained under the 0-1 classification loss model. Figure 1 and Figure 2 show ROC curves, their AUC statistics for the RF and SVM models. All reported statistics are averages over 40 independent train/test splits of the entire dataset.

The results show that if the data are taken individually the RF model performs better on the Luminex data, while SVM is better on MS data. The fact that these two models perform differently can be explained by the differences in the measurements these data-sources represent. The MS data are high dimensional and involve a rather high number of correlated signals. On the other hand, the Luminex data are lower dimensional and represent independent probes and their measurements are less correlated. If the data are taken together both models lose their performance. The RF appears to be overwhelmed by the dimensionality of the SELDI data, while linear SVM is limited to linear decision boundary which does not appear to capture well discriminative signals in Luminex data. All these results demonstrate the difficulties arising from the straightforward combination of the two data sources. The model composition approach is implemented with the Naïve Bayes model as a second level classifier. For comparison sake we have included also the result for the RF classifier that was trained on Luminex data and top 50 differential features identified in the SELDI-TOF-MS data. The differential feature selection was based on the t-test scoring. Although, the difference between those ROC curves is not sta-tistically significant, each one of them is significantly better than the best ROC for the data fusion. For example, Figure 3. compares the ROCs for the best data fusion and the best model fusion scenario. The ROC for the model fusion model is significantly better (p < 0.0086) than the one for the Random Forest on merged data. For the significance analysis, we used variance corrected resampled paired t-test [START_REF] Nadeau | Inference for the Generalization Error[END_REF] The results in Table 2 and Figure 3 demonstrate improvement with the model combination approach over the classification when we merely merged the data.

Error

Compound classifiers seem to be able to merge the discriminative information along with merging the data. However, we note that the model combination results are only slightly better or comparable to plain luminex classification. This indicates that most of the discriminative information is offered by the Luminex panel.

CONCLUSION

With many new bioinformatics data-sources that will emerge in years to come, building of improved disease detection models by utilizing multiple data sources becomes a necessity. In this work we showed that simple data merge may not be the solution to the problem and that it may prevent us from maximizing the benefit of information in the data. More specifically, we showed that the data merge for two proteomic data sources and a fixed classification model may lead to the deteriora-tion of classifier's predictive performance over individual data sources. To address the problem we studied an alternative classification solution in which models built for different data-sources and not data are combined. We illustrated the benefit of the model approach on our two-source dataset. While the results of this initial study are hard to generalize, the mere existence of the problem shows that full utilization of multiple data-sources in classification tasks may go beyond the simple data merge solution .

Table 1 : Data Fusion

 1

				SN	SP
		CART	25.66%	63.31%	89.47%
		std	18.90%	31.93%	22.68%
	LUMINEX	NB std LogisticR std RF std	23.09% 12.07% 21.76% 5.64% 9.41% 4.77%	60.52% 22.30% 75.94% 10.99% 91.93% 6.56%	94.33% 6.14% 80.74% 10.95% 89.89% 8.79%
		SVM	23.97%	72.11%	80.08%
		std	7.37%	11.33%	10.08%

Figure 2: ROC for Random Forest

Table 2

 2 compares different model-combination solutions proposed for the data combination problem.

Figure 3: Comparison of the ROC curves for the best data fusion and the best model fusion model

  .

				ROCs
		1
		0.9
		0.8
		0.7
	sensitivity	0.4 0.5 0.6
		0.3	seldi peaks + luminex ::
		0.2	RF -AUC: 0.88 sd: 0.06 SVM(seldi peaks) + RF(luminex) ::
		0.1	NB -AUC: 0.98 sd: 0.02
		0 0	0.2	0.4	0.6	0.8	1
				1 -specificity
					Error	SN	SP
	SVM(seldi) + RF(luminex)	NB std	8.82% 4.42%	91.28% 7.90%	91.60% 7.91%
	SVM(seldi) + luminex	RF Std	9.71% 4.53%	'91.29% 7.22%	89.88% 8.40%
	seldi peaks + RF(luminex)	SVM Std	8.46% 3.78%	92.56% 5.98%	91.03% 6.58%
	T_test50(seldi) + luminex	RF std	9.85% 4.78%	88.83% 9.23%	92.12% 7.24%

Table 2 : Model Combination

 2

Acknowledgments

This work was supported by the DoD grant USAM-RAA W81XWH-05-2-0066, NLM training grant 5 T15 LM007059-20 and NCI grant P50 CA090440-06. The authors would like to thank Drs. Bigbee, Zeh, and Whitcomb for the data used in our analyses.


PhD Milos Hauskrecht

MSc Michal Valko

PhD Branislav Kveton

MD Shyam Visweswaran

MD, PhD Gregory F Cooper

Evidence-based Anomaly Detection in Clinical Domains

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Patient medical records today include thousands of electronic entries related to patient conditions and treatments. While these have proven useful in providing a better picture about the individual patient, the benefits of such data in decision support, or in discovery and acquisition of new clinical knowledge are far from being exhausted. The objective of this research is to develop computational tools that utilize previously collected patient data to detect unusual patient-management patterns. The hope is that these methods can eventually lead to systems that will alert clinicians to unusual treatment choices. Such systems would have the advantage of not requiring labor-intensive extraction and encoding of expert knowledge. Additionally, we envision these methods will enable knowledge discovery, where unusual outcomes and their contexts are identified.

We propose and investigate a new statistical anomaly framework to detect unusual patient-management decisions based on a probabilistic model. Briefly, our approach builds a probabilistic model M that captures stochastic dependencies among attributes in the data. We use the Bayesian belief network framework [START_REF] Pearl | Probabilistic Reasoning in Intelligent Systems[END_REF][START_REF] Lauritzen | Local computations with probabilities on graphical structures and their application to expert systems[END_REF][START_REF] Heckerman | A tutorial on learning with Bayesian belief networks[END_REF][START_REF] Cooper | A Bayesian method for the induction of probabilistic networks from data[END_REF] to compactly represent such dependencies. The probabilistic model is then used to compute a predictive statistic for a patient case that is based on the conditional probability p(A | C, M) of the target features A (representing patientmanagement decisions) given the values of other features C (such as patient symptoms). The target patient (that is, the patient we want to evaluate) is then compared to similar patient cases and unusual or anomalous decisions are detected based on the differences in their predictive statistics.

Probabilistic anomaly detection methods are sensitive to the sample of patient cases used to build the model, both in the number of patient cases used, as well as, the extent of their similarity to the target patient case. Balancing both objectives in practice can be very hard. The number of cases in the data that match well the target case is often too small to provide sufficient support to draw any statistically sound inferences. On the other hand, the naive comparison with all patient cases may lead to detection errors. For example, a patient case may be declared as anomalous by a detection method simply because it falls into a low prior probability cohort. To correct for this problem we investigate conditional anomaly detection methods that search for a subpopulation of past patient cases that is adequate both in terms of the quality of the match to the target patient case as well as in its size, so that sound anomaly conclusions can be drawn. As an example application, we empirically evaluate the performance of our methods on the problem of detection of unusual hospitalization patterns for patients with community acquired pneumonia.

Methodology

In anomaly detection, we are interested in detecting an event (a case) the occurrence of which deviates from past cases (or events). Let x be a patient case that we want to analyze and determine whether it is anomalous in terms of some target attribute (or a set of target attributes) A(x). Let E={x 1 , x 2 , … x n } be a set of past cases similar to x and M be a probabilistic model that represents the distribution of cases in E.

To assess the anomaly we analyze a predictive statistic of A(x) obtained for the target case x with respect to M and the remaining (non-target) attributes C(x). We say the case x is anomalous in the target attribute(s) A(x), if the probability p(A(x) | C(x), M) is small and falls below some threshold.

To build a working anomaly detection algorithm, we need to provide answers to the following three questions: (1) How should the probabilistic model M be constructed? (2) How should the anomaly be detected using the predictive statistic? (3) How should cases E that are similar to the case x be selected? We provide answers to these questions in the remainder of the paper.

Building a probabilistic model: The calculation of p(A(x) | C(x), M) assumes the existence of an underlying probabilistic model M that describes stochastic relations among the attributes. However, the number of attributes in real-world datasets, especially those that are collected in medical applications, can be enormous. In general, it is not feasible to represent the model by enumerating the full joint probability distribution since its complexity grows exponentially in the number of attributes. To address this concern, we adopt succinct probabilistic representations, in particular, the Bayesian belief network (BBN) model [START_REF] Pearl | Probabilistic Reasoning in Intelligent Systems[END_REF][START_REF] Lauritzen | Local computations with probabilities on graphical structures and their application to expert systems[END_REF], and its special instance: the Naïve Bayes classifier model [START_REF] Domingos | On the optimality of the simple bayesian classifier under zero-one loss[END_REF].

A BBN model M is represented by a pair (S M , θ M ), where S M denotes the model structure and θ M its parameters. We adopt the Bayesian framework [START_REF] Lauritzen | Local computations with probabilities on graphical structures and their application to expert systems[END_REF] to learn the parameters of the model and to compute any related statistics. In this framework the parameters θ M of the model are treated as random variables and are described in terms of a density function p(θ M | S M ). The probability of an event u is obtained by averaging over all possible parameter settings of the model M:

M M M M M M d S p S u p S u p M θ θ θ θ ) | ( ) , | ( ) | ( ∫ = To incorporate the effect of cases E, p(θ M | S M ) corresponds to the posterior p(θ M | E, S M ), which is obtained via Bayes rule: p(θ M | E, S M ) = p(E | θ M , S M ) p(θ M ) / p(E, S M ),
where p(θ M ) defines the prior for parameters θ M . To simplify calculations, we assume (1) parameter independence and (2) conjugate priors [START_REF] Lauritzen | Local computations with probabilities on graphical structures and their application to expert systems[END_REF]. With these assumptions, the posterior follows the same distribution as the prior and the computation reduces to updates of sufficient statistics. Similarly, many of the probabilistic calculations can be performed in closed form.

Anomaly detection: Multiple threshold approaches can be used to make anomaly calls based on the predictive statistic. These include: absolute thresholds, relative thresholds, and the k-standarddeviation thresholds. In our work, we build upon the absolute threshold test. In the absolute threshold test, the case x is anomalous if p(A(x) | C(x), M) falls below some fixed probability threshold p ε . Intuitively, if the probability of the target attributes A(x) for x is low with respect to the model M and its other attributes C(x), then the value of the target attribute is anomalous. Note that the absolute threshold test relies only on the model M and there is no direct comparison of the predictive statistic for x with those of the cases in E that are similar to it. However, recall that the cases in E are used to construct the model M and hence their effect is reflected in the statistic.

Selection of similar cases: Probabilistic detection criteria are sensitive to the choice of cases E used to learn the model M. A simple solution is to use all cases in the data repository in constructing the set E. The problem with this approach is that the resulting statistic is likely to be biased towards cases that are more frequent in the dataset, which in turn can affect the statistic used in the detection criterion. For example, if the target case happens to fall into a small subpopulation of patient cases, the management choice that is routinely made for the patients in this group, but rarely outside of this group, can be declared anomalous simply because the subpopulation is relatively small. A solution to the above problem of false positives is to identify a subpopulation of cases that is relevant to the target case. Only these cases are then used in anomaly detection. However, this rather intuitive approach leaves two open questions: How should cases most relevant to the target case be selected? What is the minimal size of E sufficient to warrant any statistically sound inferences?

Clearly, the best subpopulation is the one that exactly matches the attributes C(x), of the target case, that is, E = {x i : such that C(x i )= C(x)}. However, in realworld databases few if any past cases are likely to match the target case exactly; so there is little basis on which to draw statistically sound anomaly inferences. To meet the minimum size condition, we propose strategies based on similarity metrics that relax the exact match criterion.

Similarity-based match:

The distance (similarity) metric defines the proximity of any two cases in the dataset. We define a similarity metric on the space of attributes C(x) that lets us select cases closest to the target case x. The k closest matches to the target case then define the best subpopulation of size k. Different distance metrics are possible. An example is the generalized distance metric r 2 defined as:

T j i j i r ) ( ) ( ) ( 1 2 x x x x x , x j i - Γ - = - , where 1 -
Γ is a matrix that weights attributes of patient cases in proportion to their importance. Different weights lead to a different distance metrics. For example, if 1 -Γ is the identity matrix I, the equation defines the Euclidean distance of x i relative to x j . The Mahalanobis distance [START_REF] Mahalanobis | On the generalized distance in statistics[END_REF] is obtained by setting Γ  to the population covariance matrix Σ which lets us incorporate dependencies among the attributes.

Attribute importance:

In practice, some of the attributes are more important for defining the similarities than others. For example, attributes that are known to be correlated with the target attribute should be accorded more importance than attributes that are not. To address this issue we propose to reweight the Mahalanobis distance metric according to the ability of each attribute to predict the target attribute, so that attributes influencing the target attribute matter more.

We define the weighted Mahalanobis distance as:

T j i j i w r )) ( * ( ) ( * ) ( 1 2 x x w x x w x , x j i - Γ - = - ,
where * defines the element-wise multiplications of the two vectors. The importance weight vector w can be obtained using a variety of scoring metrics that measure the strength of (univariate) dependencies between the attributes C and the target attribute A.

The similarity-based population selection method finds a subpopulation of cases in the data that consists of k-best matches to the target case. However, it is still unclear if the matches are of good quality. To address this we calculate, for each case in the subpopulation, its average distance from its k-best matches and reject the subpopulation for detection purposes if the average distance for the target case deviates significantly from the average distances observed for all other cases. We use a threshold of 2 standard deviations for making this call.

Experimental evaluation

To evaluate the potential of the our anomaly detection framework, we applied it to the Patient Outcomes Research Team (PORT) cohort study's dataset [START_REF] Kapoor | Assessment of the variantion and outcomes of pneumonia: Pneumonia patient outcomes research team (port) final report[END_REF][START_REF] Fine | A prediction rule to identify low-risk patients with community-acquired pneumonia[END_REF] to detect unusual patient admission decisions. The PORT dataset has data on 2287 patients with community acquired pneumonia that were collected in a study conducted from October 1991 to March 1994 at five medical institutions. The original PORT data were analyzed by Fine et al. [START_REF] Fine | A prediction rule to identify low-risk patients with community-acquired pneumonia[END_REF], who derived a prediction rule for predicting 30-day mortality. To explore data-driven detection methods, we experimented with a simpler version of the PORT dataset that contains, for each patient, only those attributes identified as most relevant by Fine's study. These attributes are summarized in Table 1

Study design:

To evaluate the performance of our anomaly detection methods, we used 100 patient cases (out of a total of 2287 of cases). The chosen cases included 21 cases that were found to be anomalous according to the Naïve Bayes detector (using a 5% detection threshold) that was trained on all data but the target case (i.e. 2286 cases); the remaining 79 cases were selected randomly from the rest of the dataset. Each of the 100 cases was then evaluated independently by each member of a panel of three physicians. The physicians were asked whether they agreed with the hospitalization decision for a patient case based on the values of the attributes listed in Table 1. Using the panel's answers, the admission decision was labeled as anomalous when (1) at least two physicians disagreed with the actual admission decision that was taken for a given patient case or (2) all three indicated they were unsure about the appropriateness of the management decision. We used these labels as the gold standard for defining anomalous hospitalization decisions. Out of the 100 cases, the panel judged 23 as anomalous hospitalization decisions, and the remaining 77 as not anomalous.

Experiments: All anomaly detection experiments that we performed followed the leave-one-out scheme. That is, for each case in the dataset of 100 patient cases evaluated by the panel, we identified a set of cases E most similar to it in the PORT dataset while excluding the just evaluated case, and used them to train one of the probabilistic models (see below). Given the trained model, the posterior probability of the target case was calculated. The target case was declared anomalous if its posterior probability value fell below the detection threshold.

The anomaly determinations made by our algorithms were compared to the assessment of the panel and evaluation statistics (sensitivity, specificity, precision) were calculated. To gain insight into the overall performance of each method, we varied its detection threshold and calculated the corresponding Receiver operating characteristic (ROC) and Precision-Recall (PR) curves and the areas under these curves.

Probabilistic models:

We used two different BBN models: (1) the Naïve Bayes model and (2) a BBN model whose structure was learned from the PORT dataset. The Naive Bayes model [START_REF] Domingos | On the optimality of the simple bayesian classifier under zero-one loss[END_REF] was constructed such that the target decision variable "Hospitalization" was represented by the class variable. The parameters of the model were learned from patient cases chosen by the population-selection method. To learn the structure of the second model, we used all but the 100 patient cases (= 2187 cases) selected for the evaluation and identified the structure with the maximal marginal likelihood score [START_REF] Cooper | A Bayesian method for the induction of probabilistic networks from data[END_REF] using greedy BBN construction methods [START_REF] Heckerman | A tutorial on learning with Bayesian belief networks[END_REF]. The structure was then kept fixed and the parameters of the model were learned from the cases picked by the population-selection method.

Population selection: We applied three different population-selection methods to learn the parameters of the model M: (1) the unrestricted population (excluding only the target case), (2) the 40 best matches based on the standard Mahalanobis distance, and (3) the 40 best matches based on the weighted Mahalanobis metric. The weight of each attribute was based on the Wilcoxon ranksum statistic that measures the ability of that attribute to predict the target "Hospitalization" variable.

Results

Table 2 summarizes the performance results obtained for different anomaly detection methods The summary statistics listed are the area under the ROC and the area under the PR curve. The ROC analysis lets us analyze the performance of the detection model under different misclassification error tradeoffs. The PR curve and its area statistic are typically used in the evaluation of information retrieval systems and reflect the tradeoff between sensitivity (recall) and the true alarm rate (positive predictive value). Figure 1 illustrates the PR curve for one of the models: the BBN-based model trained on cases with the weighted Mahalanobis fit. Figure 2 shows the sensitivity and specificity for different detection thresholds for the same model.

Prob. model

Discussion

The Naïve Bayes model trained on all patient cases represents a baseline detection model. The model was easily outperformed by the BBN model also trained on all cases. This result can be explained by the ability of the BBN structure learning procedure to capture additional conditional independence relations among attributes which in turn helps to better assess the probability of the decision.

The similarity-based subpopulation selection leads to improved detection performance when it is combined with the Naïve Bayes model. In terms of the similarity metrics tested, the weighted Mahalanobis metric outperforms the standard Mahalanobis metric. This implies that the attributes that are not important for predicting the target decision should be weighted less than those with high predictive ability.

The BBN-based detection model does not appear to benefit from the population-selection enhancement when applied to PORT data. For the standard Mahalanobis metric, we even observe a drop in the model's detection performance. These results are likely due to higher complexity of the BBN model and a relatively small sample (40 best matches) that is used to train it. While a smaller sample may provide a better fit to the target case, it also decreases the accuracy of the parameter estimates of the model, especially if the model is more complex. This demonstrates the key trade-off of our populationselection enhancement. In terms of the two similarity metrics, we can once again observe the benefit of the metric re-weighted by the attributes' predictive performance, which, similar to the Naïve Bayes model, leads to better detection performance.

The PR curves and statistics indicate the precision of our methods to be 0.5 (1 correct anomaly in 2 anomalies reported) at 0.53 recall, which is very encouraging. However, given the method we used to construct the 100 test cases, the proportion of anomalies in the test data is likely inflated. Hence, the precision related statistics calculated from the data may be biased. Note that this, however, is not a problem for the relative comparison of the methods in Table 1, but can lead to an overestimate of the precision. Applying a conservative estimate of the prior occurrence of anomalies in the PORT dataset that is based on the incidence of anomalies in the randomly selected portion of the data, we estimate the precision of the method on the PORT data to be 0.32 (1 correct anomaly in every 3 anomalies reported) at 0.3 recall, which is still very encouraging.

Conclusions

Statistical anomaly detection is a promising methodology for detecting unusual events that may correspond to medical error or unusual clinical outcomes. The advantage of the method over standard error detection approaches based on expertextracted rules is that it works fully unsupervised and with little input from domain experts. Since it is complementary to rule-based anomaly detection, they could be applied jointly. A limitation of the method is that it is based on the conjecture that actions that are anomalous based on prior local practice are worth raising as alerts. The potential of the method is demonstrated on the PORT dataset with respect to anomalous hospitalization decisions. The initial results are promising and several further refinements of the approach remain to be investigated. For example, our current research aims to eliminate the effect of small subpopulation size on the parameter estimation process through subpopulation smoothing methods.

Figure 1 .Figure 2 .

 12 Figure 1. The Precision-Recall (PR) curve for the BBN model with the weighted Mahalanobis population selection.

Table 1 .

 1 Attributes of the PORT dataset.

	. All

Table 2 .

 2 Comparison of probabilistic anomaly detection models based on the Naïve Bayes and the learned BBN for various population-selection criteria.

				Population selection			AUC		AUC
				method						PR		ROC
	NB			All cases					0.42		0.74
	NB			Mahalanobis					0.49		0.77
	NB			Weighted Mahalanobis		0.60		0.80
	BBN		All cases					0.56		0.81
	BBN		Mahalanobis					0.52		0.79
	BBN		Weighted Mahalanobis		0.56		0.80
						Precision/recall curve
		1
											AUC: 0.56
		0.9
		0.8
		0.7
		0.6
	precision	0.4 0.5
		0.3
		0.2
		0.1
		0	0	0.1	0.2	0.3	0.4	0.5	0.6	0.7	0.8	0.9	1
								recall

Acknowledgements

This research was funded by grants R21-LM009102 and R01-LM008374 from the National Library of Medicine, and grant IIS-0325581 from the National Science Foundation.


Khaled Gaaloul
email: khaled.gaaloul@tudor.lu

Henri Tudor

Delegation Protocols in Human-Centric Workflows

Keywords: Workflow, Delegation, Access Control, Policy

Organisations are facilitated and conducted using workflow management systems. Currently, we observe a tendency moving away from strict workflow modelling towards dynamic approaches supporting human interactions when deploying a workflow. One specific approach ensuring human-centric workflows is task delegation. Delegating a task may require an access to specific and potentially sensitive data that have to be secured and specified into authorisation policies. In this paper, we propose a modelling approach to secure delegation. In doing so, we define delegation protocols supporting specific constraints based on both workflow and access control systems. Moreover, we develop an advanced access control framework to integrate delegation constraints within existing policies. The novelty consists in the proactivity aspect of our framework to cope with dynamic delegation of authority in authorisation policies.

I. INTRODUCTION

In the classical software engineering approach the organisational context and related security requirements are often considered during the design phase of a workflow, but internal controls are later defined and implemented in a manual fashion disjoint from predefined models [START_REF] Clavel | Model-driven security in practice: An industrial experience[END_REF]. Workflows model and control the execution of business processes in an organisation. Internal controls depend on the organisational aspect to support human-centric interactions and to analyse resources specifications. Dealing with that, organisations establish a set of authorisation policies that regulate how processes and resources should be managed within a workflow [START_REF] Atluri | Supporting conditional delegation in secure workflow management systems[END_REF].

Moreover, workflow systems are determined by a mix of adhoc as well as human-centric processes. Human interactions are also related with the environment in which organisations cooperate dynamically, but are strictly constrained by regulations and policies at the same time [START_REF] Muehlen | Workflow-based Process Controlling. Foundation, Design, and Application of workflow-driven Process Information Systems[END_REF]. This highly dynamic environment must be supported by mechanisms allowing flexibility, security and on-the-fly shift of rights and responsibilities both on a (atomic) task level and on a (global) process level [START_REF] Gaaloul | A Secure Framework for Dynamic Task Delegation in Workflow Management Systems[END_REF]. One specific set of mechanisms ensuring human-centric interactions is that of task delegation.

We define task delegation as a means of assigning tasks and its access rights (privileges) from one user to another user. The user who performs a delegation is referred to as a "delegator" and the user who receives a delegation is referred to as a "delegatee". Delegation can be very useful for real-world situations where a user who has to perform a task is either unavailable or too overloaded with work to successfully complete it. It is frequently the case that delaying these tasks executions would violate time constraints, thereby impairing the entire process execution. Therefore, delegation works on ensuring flexible execution to cope with unavailable workflow's actors and the organisation rigidity. Additionally, we aim to ensure a userto-user delegation with heavily human interactions. To that end, we need to support additional requirements related to the organisation flexibility and the authorisation policy definition when granting privileges to access delegated resources.

Delegating a task consists of the definition of a user-to-user dialogue to issue a delegation request. Here, human interactions depict delegation protocols involving the main principals, the delegated task and eventually the granted privileges to access task's resources. In addition, we have to consider additional constraints with regards to the process definition and the authorisation policy. In doing so, we have to come up with a new modelling approach that bridge the gap between workflow (process) and access control (policy) systems. Further, we leverage our approach to align the security requirements for delegation within secure workflows. Moreover, we develop an advanced access control framework supporting the dynamic aspect of authority when delegating privileges.

The remainder of this article is organised as follows. Section 2 presents fundamental concepts of the organisational management and security in workflows. In section 3, we motivate our work with an eGovernmental scenario supporting task delegation. Section 4 presents our contribution in terms of delegation protocols ensuring dynamic and secure human interactions within a workflow. In section 5, we develop an access control framework to specify delegated privileges into authorisation policies. In Section 6, we conclude our approach and outline future work.

II. BACKGROUND

The fundamental concepts of this work are related to the organisational management as well as the security enforcement in workflow systems. We aim to address issues related to the organisational needs and security requirements for modelling and securing task delegation.

A. Organisational management in workflows

In the context of heavily human-centric workflows, business processes are determined by a mix of ad-hoc as well as process-based interactions. We currently observed, when substituting members of an organisation during workflow deployment, a move away from the predefined modelling workflow towards approaches supporting flexibility on the organisational level. This highly dynamic environment must be supported by mechanisms allowing the monitoring, secure and on-the-fly shift of rights with respect to an ongoing human interactions both on a (atomic) task level and on a (global) process level [START_REF] R4egov | Towards e-administration in the large[END_REF].

The requirements for interactions and monitoring can be summarised as transparency and control [START_REF] Wolter | Modeldriven business process security requirement specification[END_REF]. Transparency addresses the revelation of the control flow dependencies. This allows to react accordingly to exceptions and compensations during execution. Control fosters the behaviour of organisations according to their defined policies. One type of transparency and control supporting mechanism in humancentric workflows is that of task delegation. We do believe that user-to-user delegation is a suitable approach to handle such interactions.

During the design time, the workflow application designer has to design both the structure of the business process to be automated, and the structure of the resources that carry out the process [START_REF] Muehlen | Workflow-based Process Controlling. Foundation, Design, and Application of workflow-driven Process Information Systems[END_REF]. Resources and workflow's tasks are linked through the construct role. From a process perspective, a role is a subject to authorisations that define permissions (operations) for the execution of a task. From a resource perspective, a role represents a granted authorisation for a workflow's actor (so-called user). In this paper, we aim to address issues related to the user's assignments and resource's access for the organisational management in workflow systems.

B. Access control over workflows

Typically, organisations establish a set of security policies, that regulate how business processes and resources should be managed within a workflow. A security policy defines the expected standard of security enforcement using access control mechanisms [START_REF] Pfleeger | Security in Computing (4th Edition)[END_REF]. An access control has to be defined to check the authorisation of the initiated user (the subject).

We present an access control framework (ACF) to support authorisation policies within workflows. ACF is mostly based on the eXtensible Access Control Markup Language (XACML) specifications [START_REF] Moses | eXtensible Access Control Markup Language (XACML) Version 2.0[END_REF]. The main components are described as follows:

• Policy Manager: It allows an administrator to define policies. Through a graphical user interface, the administrator can navigate through the policy document, select document elements (e.g., targets, authorisation rules, obligations), and specify values for selected elements. • ACF: An access control framework (ACF) is defined as a set of software components which accept requests to access resources, analyse these against policies representing actual access rights to resources, and return a response based on this analysis. To illustrate the original architecture of an ACF, a request is issued by the requestor, which is received by the Receiver component in ACF. This is then sent to the Analyser component that queries policies stored in a policy database. A response is generated by the Responder component, which defines a decision (permit, deny, or not applicable) that is sent back to the requestor. It should be noted, that the above appears asynchronous for the requestor; they provide the request, and a response is produced. Authorisation policies are predefined in the access control framework. Significant contributions to ensure dynamic policy enforcement can be found in [START_REF] Chadwick | Adding support to xacml for multi-domain user to user dynamic delegation of authority[END_REF]. While much of the work is limited to role-based access control, the goal of our paper is to consider task delegation constraints in workflow systems. Delegation constraints needs to tackle several issues with regards to workflow's invariants in terms of users, tasks and resources. Moreover, we need to support dynamic changes of authority when cancelling/revoking delegation and its granted privileges.

III. DELEGATION IN EGOVERNMENT CONTEXT

To understand the motivation of our research, we present a scenario from an eGovernment case study supporting delegation [START_REF] R4egov | Towards e-administration in the large[END_REF]. Mutual Legal Assistance (MLA) defines a workflow scenario involving national authorities of two European countries regarding the execution of measures for witness protection in a criminal proceeding. Here we describe the MLA process part in the Eurojust organisation A. Users with roles Prosecutor and Assistant are assigned to execute activities of the MLA process which are represented as tasks (see Fig. 2).

A. Task delegation scenario

The MLA process consists of receiving the request of assistance from Europol member in order to process it and send it to the concerned authority in Eurojust B. The task "Translate Documents" T3 is originally only accessible (read/write) by the user Alice member of role Prosecutor, a fact defined in the workflow security policy. We define a workflow policy as a means for defining access rights to a task's resources also called authorisation policy.

Let P an authorisation policy for the MLA process. Task T3 is a long-running task and is expected to take 5 working days to complete. The Prosecutor Alice is unavailable to execute this task due to illness, and will delegate it to a subordinate During delegation, the policy P is updated so that user Bob with role Assistant is now allowed to complete task T3. The policy P will grant an access right to Bob to execute the task T3 and therefore to access task's resources (e.g., legal documents). As such, users with roles Prosecutor and Assistant are here the delegator and the delegatee, respectively.

In the meanwhile, Alice interrupts her sick leave and returns to work. Once again, Alice is able to claim T3. Due to qualification considerations, it is decided that Alice should complete the task, and that her Assistant Bob should revoke his actions, and free the task. The policy P needs to be updated to reflect that only Alice has access to the task. As such, the grant access to Bob would now evaluate to a deny decision which has to be integrated dynamically in the existing policy.

B. Problem statements

The authorisation policy P needs to reflect the new requirements for delegation. In order to derive a delegation policy from the existing policy, we have to specify additional authorisation rules to support delegation, where a rule defines the policy decision effect (e.g., permit, deny). Delegation rules depend on several delegation constraints such as time (i.e., 5 days) and have to be included in the delegation policy to define specific conditions to validate the policy decision effect.

Delegation constraints define the delegation behaviour within the business process. This behaviour interprets human interactions when deploying a workflow. Accordingly, it is not possible to foresee a deny rule for revocation during the policy definition. Moreover, a manual review of the current access control rights and task executions is costly, labor intensive, and prone to errors.

Based on the delegation scenario, we aim to address two important issues related to task delegation in workflows. At the organisational level, we have to identify the list of potential delegatees having the ability to execute the delegated task. At the security level, we have to decide how to ensure the delegation of authority to a delegatee to access task's resources. The delegation of authority has to be defined in the access control system. It expresses new delegation policies enforcement defined in a dynamic manner and integrated in the existing policy. Finally, we have to take into account how delegation requests are issued.

Crampton et al. [START_REF] Crampton | Delegation in role-based access control[END_REF] identified two modes to issue a delegation request. The pull mode assumes that a delegator has at his disposal a pool of delegatees to be selected to work on his behalf. The push mode assumes that a delegator is waiting for an acceptance from a potential delegatee. In this paper, we consider both modes and explain how we model them in a secure manner within workflows.

IV. MODELLING AND SECURING DELEGATION

Delegation defines a mechanism to support user-to-user interactions. We introduce delegation protocols to support both push and pull modes. Delegation protocols define two different models that depict the dialogue between a delegator and a delegatee. These protocols will ensure the delegation of authority in access control systems.

A. Security alignment

We aim to address the modelling issue of delegation since we have to cope with the security constraints when granting new rights (privileges) and enforcing new policies decisions. In doing so, we align the security requirements for delegation with the workflow specification. To that end, we have to consider the delegated task status and the delegatee's worklist. The delegated task has to be managed by a specific component to control its states (e.g., starting, execution, cancellation). The worklist defines a list of work items (tasks) associated with a given workflow participant (users) [START_REF] Wfmc | Workflow Management Coalition Terminology and Glossary[END_REF].

Our approach is aligned with the fundamental concepts introduced in Sect. 2. In others words, our modelling technique will bridge the gap between workflow and access control systems. We leverage the ACF mechanism as the main Authorisation Component (AC) in the delegation protocols to support delegation policies. Some of these policies may contain dynamic constraints depending on the current task state and the process history. To get this information the decision point will ask a workflow component for the current process state. This component is the Task Service Manager (TSM) that retrieves all relevant state information and returns it to the authorisation decision point in the AC component. For instance, if the task is already assigned and being executed, no further assignment will be allowed. In the following, we model delegation protocols using a sequence diagram in Unified Modelling Language (UML). It is a kind of interaction diagram that shows how actors, workflow's components and access control system operate with one another and in what order.

B. Pull delegation

We define a subject as an assigned user who is member of a role to claim a task instance. Then the task is added to the subject worklist. Here, the pull delegation model is based on a direct allocation of the task through a delegation without any notion of role. This model associates implicitly an authorisation to the selected subject (see Fig. 3). When a subject holding a task initiates a delegation request, then the following procedure manages it:

1) First the delegator is sending a request for delegation to the Delegation Component for a specific task (delegated task) and a specific subject (the delegatee).

2) The Delegation Component checks with the help of the Authorisation Component (AC) if the delegator can delegate and the delegatee can receive the request.

• a) The AC first retrieves the attributes affecting the policy and conducts an initial evaluation regarding the delegator's right to delegate. This is due to the fact that certain task assignments are exclusive and are not allowed to be delegated. In the context of an access control policy, it is defined as an obligation to a rule effect (e.g. accept, deny) [START_REF] Moses | eXtensible Access Control Markup Language (XACML) Version 2.0[END_REF]. • b) The AC checks then the task status with the Task Service Manager (TSM) component which browses the current task assignment list to check the availability of the task (e.g. executed, aborted). • c) The AC receives the history list from TSM.

Finally, the AC sends a response to the delegation component based on the intermediate results received.

3) The Delegation Component then keeps track of the current delegation within internal history records.

4) The delegation component updates the appropriate policy in the policy repository. 5) The delegation component updates the appropriate worklists (delegator and delegatee). 6) The delegation request is forwarded to the corresponding delegatee.

C. Push delegation

The push model is based on an allocation of the task through a delegation to a role and not directly to a subject (see Fig. 4). When a subject holding a task initiates a delegation request, then the following procedure manages it:

Response Fig. 4. Task delegation push model 1) First the delegator is sending a request for delegation to the delegation component for a specific task and a specific role (Role A).

The delegation component checks with the help of the Authorisation Component (AC) if the delegator can actually delegate based on his policy attributes, then with the task service manager regarding the delegated task status.

3) The delegation component notifies all the subjects belonging to the role (Role A) of the availability of the task. 4) The first one to respond is allocated with the task. 5) The delegation component checks with the help of the AC if the delegatee can actually receive the task. 6) The delegation component then keeps track of the current delegation within internal history records. 7) The delegation component updates the appropriate policy in the policy repository. 8) The delegation component updates the appropriate worklists (delegator and delegatee).

9) The delegation is forwarded to the corresponding delegatee.

D. Access control enforcement

The access control component needs to express the associated authorisation for delegation and update it in the existing policy.

• In the pull model, the delegatee is not granted with a new role. The delegation request does not need further control of the permission; the access control model handles normally a delegated task and does not need to be modified.

There is no need of granting additional privileges for the delegatee. • In the push model, the link of the authorisation with the role is kept. It allows us to reuse the established rolebased access control model [START_REF] Sandhu | Rolebased access control models[END_REF].

The pull model answers the requirements defined in the delegation scenario in the MLA process. User Bob exists in the delegatees list of the delegator Alice and is directly assigned to the task T3. In this case, Bob as a delegatee can claim achieving the task as he is provided with the same access rights (privileges) as the previous owner of the task (the delegator Alice) to execute an instance of the task T3.

Moreover, the access control enforcement has to take into account new changes to be integrated in the existing policy afterwards. Policy changes are related to delegation constraints during task execution. Such constraints depend on user-to-user interactions when executing a delegated task. For instance, Alice is back to work before T3 delegation is done. Alice asks Bob to revoke his work. Subsequently, the policy P has to change dynamically the previous policy decision (permit) for the delegatee Bob, thereby cancelling his work and assigning back T3 to user Alice. This dynamic policy enforcement is discussed in the next section.

V. A SECURE FRAMEWORK FOR TASK DELEGATION

We present a modular architecture ensuring dynamic delegation of authority and show how delegation policy decisions will be implemented on the existing access control framework (ACF). In the context of delegation, when a request is issued, it is stored along with details of how to inform the requestor (the delegatee) if the policy decision to the request changes. When a policy is changed, previous requests are re-evaluated, and the requestor is informed that his access rights have changed.

To support this approach, we propose an extension to the ACF architecture that permits proactive enforcement of policies.

A. Architecture overview

We describe the main components of the task delegation framework supporting proactive policy enforcement. We detail what parts were changed and what the new extended architecture looks like (see Fig. 5).

• Policy Manager: see section II-B.

B. Architecture requirements

On an architectural level, as requests are required to be re-evaluated upon a policy change, a storage mechanism of previous requests and the given response are needed. If a previous request is re-evaluated and a different response to the one stored is produced, the ACF must inform the requestor of the new result. Thus, a mechanism must exist that triggers a reevaluation when it detects a policy change. These effects of the policy change would be automatically captured, and conveyed back to the requestor for appropriate actions. In addition, an invocation component is needed that actually marshals this information to the requestor.

On a language level, the approach would require new constructs to describe the invocation method that the ACF can use to contact the requestor. As such, this acts as a "contact point" for the requestor. In a service-oriented architecture (SOA), this contact point could consist of the endpoint of a service that could be invoked (see the Invoke Web Service in Fig. 5). Subsequently, all access policies must be centralised and referenced by the SOA architecture which is protected. We give an SOA a single point of access and we let the services register with our ACF. Since services are essentially black boxes, we define how to contact them and to sort out what it means when policy changes.

On a technical level, the Policy Manager generates policies and subsequently embed credentials attributes for authentication and authorisation purposes. Credentials providers such as certification of authorities issue digital certificates to the requestor in order to compute his request by the ACF. At this stage, the Receiver component acts as a policy enforcement point to perform access control by making decision request and enforcing decisions. For instance, an attribute certificate is issued to the delegatee for authentication and authorisation purposes [START_REF] Chadwick | Adding support to xacml for multi-domain user to user dynamic delegation of authority[END_REF]. Attribute certificates will ensure integrity, protection and non-repudiation through a digital signature. The Receiver gets his attributes certificate and checks his permissions afterwards. The retrieved attributes are validated against the policy (e.g. subject attributes, validity time). Once the delegatee has been successfully authenticated, he will attempt to perform specified actions on task resources. At each attempt, the Receiver passes the access request to the Analyser to decide. Decisions results (permit, deny, or not applicable) are then sent via the Responder.

A new re-evaluation of a policy defines new attributes for further request with regards to policy changes. As a first solution, a service is invoked to contact the delegatee and based on the mutual agreement between delegation principals, appropriate actions will take place. For instance, the cancellation of his work and the log off from the system.

VI. CONCLUSION

In this paper, we developed a solution to model task delegation within workflows and to specify delegation constraints into access control systems. The motivation of this work was based on human-centric workflow from an eGovernment case study. We defined delegation protocols to support user-to-user interactions. In doing so, we modelled delegation protocols with regards to workflow's invariants in terms of users, tasks and resources. We then explained how to align delegation constraints between both workflow and access control systems. Moreover, we developed an extension to an existing access control framework in order to ensure dynamic delegation of authority.

The next stage of our work is the implementation of our framework using XACML (eXtensible Access Control Markup Language) standard supporting delegation constraints. Additionally, we are looking to enrich the access control framework with a listener component that permits dynamic changes within existing policies.

Fig. 1 .

 1 Fig. 1. Access control framework

Fig. 2 .

 2 Fig. 2. MLA delegation scenario

Fig. 3 .

 3 Fig. 3. Task delegation pull model

Policy Enforcement Component:

  It implements our approach to support proactive policy decisions. We extend the ACF architecture with additional components related to the policy database. When the Receiver receives a request, it sends this to a Request Database that stores this request. A Policy Adaptation Listener component polls the Policy Database and sends an event to a Re-evaluator component when a policy has changed. This queries the Request Database to retrieve the previous requests made, and sends this to the Analyser component for re-evaluation. The Analyser then sends back a new response to the Re-evaluator, which queries the Request Database to see if this is different to the response given to the request being analysed. If this is a different response, the Invocation Manager component invokes the "contact point" provided by the requestor (and stored in the Request object) with the new response.

					Invoke Web Service
		Request	Requestor	Response
	Receiver			Analyser	Responder
		Policy			Request
	Define	Database				Existing ACF
	Policy Manager	Policy Adaptation Listener	Policy	Re-Evaluator	Response	Invocation Manager
					Request
					Database
	Fig. 5. Architectural extension supporting delegation policies

• ACF: see section II-B.

• Dynamic