Piotr Szyperski
email: piotr.szyperski@pwr.edu.pl

D Robert Iskander
email: robert.iskander@pwr.edu.pl

A novel phase-based approach to tear film surface quality assessment using lateral shearing interferometry

Keywords: in-vivo interferometry, Takeda's algorithm, two-dimensional phase unwrapping, Goldstein's algorithm

Lateral shearing interferometry (LSI) can be used for assessing the properties of tear film. In particular, it has the capability of acquiring dynamic variations in tear film surface quality (TFSQ) during an interblink interval in an in-vivo fashion. The purpose of this study was to assess the suitability of LSI based two-dimensional (2-D) phase estimation procedures in the analysis of tear film dynamics. The paper discusses the main difficulty in 2-D phase estimation ś the problem of phase unwrapping, proposes a modification of one of the popular phase unwrapping algorithms, and suggests a set of phase parameters that could be exploited as LSI-based TFSQ descriptors.

Introduction

Background. Lateral shearing interferometry (LSI) is one of the most sensitive methods for measuring tear film surface quality (TFSQ) in-vivo in human eyes [START_REF] Szczęsna | Lateral shearing interferometry, dynamic wavefront sensing, and high-speed videokeratoscopy for noninvasive assessment of tear film surface characteristics: A comparative studyž[END_REF]. Current analysis of LSI-based interferograms essentially includes parameters derived based on the analysis of the first harmonic of the amplitude Fourier spectrum [START_REF] Szczęsna | Robust estimation of tear film surface quality in lateral shearing interferometryž[END_REF]. It was of interest to ascertain whether the phase contained in the spectrum can be used to extract additional information from the interferogram that can be further utilized for the assessment of TFSQ. A classical method for phase estimation in interferometry and profilometry is based on the Takeda approach [START_REF] Takeda | Fourier-transform method of fringe-pattern analysis for computer-based topography and interferometryž[END_REF]. The main problem in LSI is that the spatial phase requires two-dimensional (2-D) unwrapping, for which the algorithms are not trivial [START_REF] Braganza | Analysis of phase-unwrap quality of OQM images[END_REF] and computationally very intensive. Furthermore, the results of 2-D phase unwrapping are highly dependent on the particular algorithm used. The aim of this work was to assess the applicability of 2-D phase estimation for LSI and design a set of phase parameters for the characterization of the dynamics in TFSQ analysis both on the eye's cornea and contact lens surface.

Hardware Setup of Experiments

The LSI hardware setup under consideration comprises single set optical wedge with predetermined shear angle. Conversely, Twyman-Green utilizes the reference mirror that allows measuring wavefront deformations in a direct manner [START_REF] Rottenkolber | High precision TwymanśGreen interferometer for the measurement of ophthalmic surfacesž[END_REF][START_REF] Licznerski | Application of TwymanśGreen interferometer for evaluation of in vivo breakup characteristic of the human tear filmž[END_REF][START_REF] Malacara | Interferogram analysis for optical testing[END_REF]. The drawback of this setup reducing its applicability in TFSQ assessment is the fact that it is more sensitive to even slight vibrations of the test surface (e. g. saccadic movements of the eye). These are inevitable during in-vivo experiments whereas LSI experimental setup is capable of mitigating their impact on the interference pattern [START_REF] Szczęsna | Robust estimation of tear film surface quality in lateral shearing interferometryž[END_REF]. Until now the analysis of the LSI images concerned only the amplitude information and little attention was paid to the phase [START_REF] Szczęsna | Interferometric measurements of dynamic changes of tear filmž[END_REF]. The purpose of this work was to examine the applicability of phase-based methods in the analysis of tear film.

Methods

The true wavefront phase cannot be estimated directly from LSI images [START_REF] Licznerski | Interferencyjne i modelowe badanie filmu łzowego oka ludzkiegož[END_REF], although some methods of evaluating an unknown wavefronts have been developed, e. g. Saunders method or Rimmer-Wyant method with Okuda improvements. The main limitation of these methods is that the wavefront evaluation is confined only to points separated by a distance of that is the lateral shear in the sagittal (0) direction [7, Sec. 1.5.2, 1.5.3].

Indirect Retrieval of Phase Information

There is some visual similarity between interferometric images in the single direction LSI and those of profilometry. Hence, it was of interest to ascertain whether methods developed for phase estimation in profilometry would be applicable also to LSI. The basic principle of phase estimation in profilometry has been outlined by Takeda [START_REF] Takeda | Fourier-transform method of fringe-pattern analysis for computer-based topography and interferometryž[END_REF][START_REF] Takeda | Fourier transform profilometry for the automatic measurement of 3-D object shapesž[END_REF] in which both 1-D and 2-D phase estimation algorithms were considered. In profilometry, such algorithms are usually followed by a phase unwrapping procedure which reveals the true surface of the wavefront exhibiting the shape of the scanned object. In case of 3-D objects, an algorithm for 2-D phase unwrapping has been proposed by Goldstein's et al. [START_REF] Goldstein | Satellite radar interferometry: Two-dimensional phase unwrappingž[END_REF] for application in satellite radar interferometry to measure ground surface deformation or terrain elevation. Goldstein's algorithm is considered as a good trade-off between trivial direct phase unwrapping methods and more sophisticated but also computationally very expensive procedures [START_REF] Braganza | Analysis of phase-unwrap quality of OQM images[END_REF][START_REF] Ghiglia | Two-dimensional phase unwrapping: Theory, algorithms, and software[END_REF]. Furthermore, for which there are few ready implementation routines. The Takeda's Phase Reconstruction Algorithm. This method was proposed by M. Takeda et al. in 1981 to enable automatic discrimination between elevation and depression of the object or wavefront form [START_REF] Takeda | Fourier-transform method of fringe-pattern analysis for computer-based topography and interferometryž[END_REF]. The chain of the operations constituting the routine is depicted by Fig. 3 and discussed below in greater detail. Assumptions on fringe pattern periodicity and phase disruptions. When a periodic fringe pattern is considered, it can be represented in the form of:

(,)=(,)+(,)cos[2 0 +(,)], (1)
where (,) contains the desired phase information and (,) and (,) are unwanted irradiance variations that, together with (,), in most cases present much slower spatial frequency than the variation introduced by 0 . Equation ( 1) can be rewritten equivalently as:

(,)=(,)+(,)exp(2 0 )+ * (,)exp(-2 0 ), (2)
where

(,)= 1 2 (,)exp[(,)], (3)
with • * denoting a complex conjugate.

Carrier sideband detection and extraction in spectral domain. During the analysis of 2-D interferogram, the following procedure can be performed in either of the two dimensions as well as in both. Since the operation in 2-D do not differ significantly from 1-D case, the latter is described to maintain simplicity of the notation. The Fast Fourier Transformation (FFT) algorithm can be applied to the fringe pattern along the axis of abscissae. The result of transforming Eq. ( 2) into spatial frequency domain is:

(,)=(,)+( -0 ,)+ * ( + 0 ,), (4)
with capital letters denoting the Fourier spectra (and used for the carrier side bands) and being the spatial frequency in 0 direction. In a typical case of an interferogram with low distortion grade, the sidebands Fourier spectra from Eq. ( 4) would be well-separated from the carrier frequency 0 . This is ensured as long as the variations of (,), (,) and (,) are sufficiently slower than the spatial frequency 0 . Either of the two sidebands spectra on the carrier can be used for phase information retrieval, and the commonly used is ( -0 ,).

A few simple operations are applied on the periodogram to mask and extract the carrier sideband spectrum. Then it is translated by -0 on the frequency axis toward its origin to obtain (,). Note that the unwanted background variation (,) representing has been filtered out in this stage. As (,) represents the value of the 0th order harmonic component in Fourier spectrum, this reduction can be further improved by shifting the interferogram brightness values during the preprocessing to reduce its mean to have zero value.

Fringe phase reconstruction. The Inverse FFT (IFFT) algorithm is used to compute (,), the inverse Fourier transform of (,) with respect to . It is defined by Eq. ( 3) and a complex natural logarithm of it can be computed:

ln[(,)]=ln[ 1 2 (,)]+(,). (5)
The phase (,) constitutes the imaginary part of the result, as Eq. ( 5) shows. Furthermore, it is completely separated from the real part that comprises the unwanted amplitude variation (,). The phase obtained in this manner is in fact the angular coordinate of (,) represented in polar form. Thus, it is indeterminate to a factor of 2, which is often referred to as wrapped phase. In most cases, a computer-generated function subroutine gives a principal value ranging fromto . This can lead to presence of discontinuities in reconstructed phase that sometimes need to be eliminated to allow further analysis of the absolute phase value in a process commonly referred to as phase unwrapping that is described further. Advantages and Limitations of Takeda's Algorithm. The method described above is more accurate and sensitive than e. g. moiré topography or conventional fringe-contour interferometry and does not require any moving components in experimental setup nor involve interpolation of the data in the regions between contour fringes [START_REF] Takeda | Fourier-transform method of fringe-pattern analysis for computer-based topography and interferometryž[END_REF][START_REF] Takeda | Fourier transform profilometry for the automatic measurement of 3-D object shapesž[END_REF]. Nevertheless, under specific circumstances, its results can be inaccurate. This was investigated on synthetic data involving Gaussian phase disruptions of maximum intensities of max (,) varying from low to high as well as low, intermediate and high fringe frequencies 0 . The phase disruption surface used for investigation of Takeda's algorithm implementation has maximum value in the center and zeros in the corners, q. v. Fig. 4. The wrapped phase surfaces in Fig. 4b were generated for comparison with actual results. Figures 5 to 8 show (clockwise): Takeda's algorithm inputs, intermediate results and reconstructed wrapped phase surfaces. In, e. g. Figs. 5a and5b there is the synthetically generated interferometric input image and its wrapped phase calculated directly from the disruption, in Figs. 5c and5d -periodograms of interferogram and extracted carrier sideband, in Fig. 5e -the algorithm output: retrieved information about phase (in this case properly reconstructed) and in Fig. 5e -fringe pattern generated on the basis of the reconstructed wrapped phase surface.

In a typical case, low and intermediate (relatively to 0 ) phase disruptions were reconstructed properly irrespective of fringe frequency (q. v. Fig. 5). For odd fringes count, there was a phase shift of -, but further analysis showed that it was caused by the specificity of the fringe generator that was fixed to have zero phase and the local maximum of the cosine fringe function (i. e., =0) in the image center. In the leftmost pixel, there was a half-period of the cosine function and the local minimum of the fringe value. When the FFT is evaluated, this local minimum is equivalent to ± phase offset in the leftmost pixel associated with spatial point having =0 coordinate. Furthermore, for non-integer fringes count, there are some errors in the unwrapped phase that tend to accumulate near the border of the image, at the side from which the carrier side band was extracted (q. v. Fig. 6). The influence of above mentioned reconstruction faults is significant for small fringe frequencies and becomes almost negligible in the intermediate or higher bands. The significance of inter-pixel location of the true 1st order spectral peak is the most important cause of this effect, and the relative inaccuracy of peak localization, which in this case had 1 px precision, is inversely proportional to the value of 0 . Some overcomes have been proposed to mitigate this undesired property, i. a. by determining Fourier peaks at sub-pixel level [START_REF] Mainsah | Metrology and Properties of Engineering Surfaces[END_REF] (one attempt may be to infer about the peak exact location by utilizing the information of side band contour map). The applicability of these attempts is usually strongly restricted to interferograms with sufficiently low phase noise level and therefore the problem remains unsolved when the interferogram periodicity is strongly deteriorated (e. g. for tear film evaporating from contact lens surface).

Figures 7 and8 depicts the conditions, in which proper phase reconstruction was impossible and the result was distorted by the excessive level of phase disruption. When there are closed loops in the interference pattern, it means that there is a region where decrease of instantaneous phase introduced by the disruption is too fast and cannot be compensated by the increase from constant frequency 0 component. An area of local phase descent in one direction exhibits negative instantaneous frequency in that direction, as (,)= (,) . Negative frequency components from the ( -0 ,) carrier side band superimposes on the conjugate symmetric * ( + 0 ,) side band negative frequency component and vice versa for positive frequencies. This introduces ambiguity in at least part of the area between two 1st order Fourier peaks. Thus, the side bands become partially indistinguishable and in general case it is impossible to eliminate the overlapping components from the chosen band. When the band is extracted using circular mask, a part of it still maintains information about its conjugate counterpart. IFFT of spectrum extracted in such manner amplifies or weakens some frequency components when compared to the unobtainable pure single band transformation. This eventually leads to asymmetry and some artefacts occurring in the reconstructed wrapped phase and also distorts the reconstructed fringe pattern. Although the visual disturbance is not necessarily of a substantial extent, in many cases it breaks some of the phase discontinuity loops or introduces open areas of such discontinuity. Such structures are associated with phase residues and the presence of such residues is a sign of improper phase surface reconstruction. What is more, it is impossible to remove phase discontinuities by unwrapping the phase along any close loop encompassing a single residue. This makes the phase unwrapping task non-trivial for residue-afflicted surfaces and its result will always be imperfect. Various phase unwrapping algorithms, however, can diminish residues influence to a different degree. Nonetheless, as a rule of thumb one can state that the more effective in accomplishing this task a method is, the more complicated its implementation would be and its computational complexity may be also disproportionately higher than the achieved improvement [START_REF] Braganza | Analysis of phase-unwrap quality of OQM images[END_REF][START_REF] Ghiglia | Two-dimensional phase unwrapping: Theory, algorithms, and software[END_REF].

In preceding examples involving synthetic fringe pattern, windowing was not applied, both in the spatial division (before FFT) and in the frequency division (before carrier side band masking) due to its negligible role as the perfect fringes periodicity and lack of spectral background noise were guaranteed.

The Goldstein's Phase Unwrapping Algorithm. Whereas phase unwrapping is trivial in 1-D problems, this is not true for higher dimensionality. In an ideal situation of perfectly reconstructed wrapped phase this would still be a relatively simple task. However, it is not the case applicable to most in vivo measurements.

The phase in a complex images is subject to many factors that can disrupt its values. The influence of these phenomena reduces the useful signal detectability. Procedures have been developed that try to achieve a trade off between solution accuracy under these adverse conditions and computational requirements. No standard procedure to solve the phase unwrapping problem has been established, thus a large variety of algorithms are in use. Given the failure of a straightforward integration when applied to noisy data, other methods utilizing residue detection and branch cuts, quality maps or error minimization are commonly used. They can be divided into two main types [START_REF] Gens | Phase unwrapping[END_REF]: a) path-following methods and b) minimum-norm methods. They differ in efficacy and computational complexity. Detailed explanation of their quality, robustness and execution time is presented in [START_REF] Braganza | Analysis of phase-unwrap quality of OQM images[END_REF]. Goldstein's method (sometimes referred to as Goldstein-Zebken-Werner algorithm) has a fairly complex procedure structure [START_REF] Goldstein | Radar ice motion interferometryž[END_REF]. Firstly, the polarity is computed for the phase residues. This involves phase gradient calculation, residues detection and residue charge determination (±1). Subsequently, the branch areas to cut are located, along which a phase integration path may not intersect. These are, i. a. lines linking residues of opposite polarity and, in some implementations, isolated residues located near image borders together with their connections. Typical LSI contact lens image produces a numerous amount of branch cuts as compared to the corneal inter-ferograms, what indicates much higher level of image disruption caused by the drying of the tear film. Finally, the instantaneous phase surface is reconstructed during flood fill procedure that prevents every integration path from crossing the branch cuts.

Advantages and Limitations of Goldstein's Algorithm. Goldstein's algorithm takes a relatively short time to execute that makes one of the fastest phase unwrapping procedures. It also tries to reduce defects significance relative to a trivial phase unwrapping approach as depicted by Fig. 9 that shows failures during the unwrapping of imperfectly reconstructed phase. It takes measures to minimize the number of discontinuities and optimizes branch cuts location to locally minimize their length (q. v. Fig. 9b). Nonetheless, branch cuts placement can isolate segments of the image and thereby prevent them from being unwrapped. This occurs especially in datasets containing many residues. Figure 9b also reveals that the algorithm is subject to numerical pitfalls. In the utilized implementation, residues placed close to image borders are connected with them by two branch cuts directed at the angle of 45°instead of one at 90°. Thus a separated triangular areas are formed where no information about unwrapped phase was retrieved.

(a) a trivial approach without branch cuts (b) Goldstein's algorithm with branch cuts Fig. 9. examples of phase unwrapping results (without phase residues masking). Discontinuities of the surface are present where the algorithms were unable to unwrap phase due to residue-induced ambiguities There are some more efficient alternatives, but they are also of much higher computational complexity [START_REF] Braganza | Analysis of phase-unwrap quality of OQM images[END_REF][START_REF] Gens | Two-dimensional phase unwrapping for radar interferometry, Developments and new challengesž[END_REF]. Much better (i. e. the most discontinuity-free) solution is produced by, e. g. the minimum ℓ -norm algorithm. Average background noise is also minimized in comparison to other algorithms. However, this is the second slowest algorithm after the mask cut approach with execution time usually longer than Goldstein in about one to two orders of magnitude (actual value vary greatly, as it depends on the convergence speed [START_REF] Braganza | Analysis of phase-unwrap quality of OQM images[END_REF]).

Some additional steps can be performed to locally improve the quality of this method results. The modification of the Goldstein's algorithm described below al-lows complete reduction of significant branch cuts at the expense of losing phase information in some image parts outside its central area.

Algorithm Modification. After determining the residue polarities, the image is preliminary masked to achieve a region, where the mask contains only regions with no residues. Also accepted are the areas with pairs opposite charge residues separated by a short distance. All subsequent actions may be performed only within the masked region. This condition ensures lack of any significant discontinuities in unwrapped phase. The mask is calculated as a circle expanding (by default from the image center) as long as it fulfils the above conditions. Then, four more circles are created on its border and expanded. This subroutine is performed in a recursive manner and thus the modification is called a recursive bubble approach.

Phase Parameters as TFSQ Descriptors

Three phase components were derived from the phase coordinates (two spatial and one intensity component). The variance of all of them was significantly different than the variance of the phase itself. However, after applying the linear detrending of the unwrapped phase, the variance of phase was much smaller than of spatial components. Thus, PCA combined and transformed the coordinates into first two principal components, whilst the intensity of the phase map was assigned virtually intact to last component. Therefore phase and 3rd component variations were the same. This indicates that PCA procedure is redundant and phase variance is equally adequate TFSQ descriptor.

Results

There was an application developed that underwent tests on a set of static and dynamic data. The initial input data set consisted of 19 static PNG images and 13 AVI video sequences. Results for the synthetic undistorted images were consistent with theoretically predicted results. The output for in vivo LSI (q. v. Fig. 10) has shown that the algorithm is capable of reconstructing phase for slightly distorted images, but gives ambiguous output in case of strongly deteriorated film. Processing of a single movie in MATLAB environment lasted between 30 min and 16 h depending on disorder level.

Discussion and Conclusions

Spectral representation of LSI images provide mostly information of sub-global character related to the frequency of fringes. On the other hand, the phase extracted from those images carries information of local character. The unwrapped phase has no simple physical interpretation. Although it is not directly related to the wavefront, it is causally associated with it. However, there are similarities between the two considered representations. In case of deteriorating quality of tear film covering the eye cornea, the spectral representation of LSI images becomes less regular and the phase representation starts to loose its continuity. Conclusions Analysis of the measurements and theoretical background suggests that the method joining Takeda's and Goldstein's algorithms with phase variability analysis as tear film surface quality descriptor is capable of supplying useful information. Still, along with the increase of the phase noise occurring when tear film dries up, the efficacy of this solution decreases significantly. Tests on LSI images, frequently exhibited saddle-shaped formation in phase surface and chessboard-like structures in the phase maps. They were consistent with the visible input phase variations. Their occurrence might arise due to optical aberrations of objective lens and the natural corneal asphericity. Thus the method has a potential for serving in other closely-related applications, like testing and calibration of medical diagnostic equipment.

Future Recommendations. As a way of overcoming issues encountered, a enhanced or new method of interferogram analysis may be adapted. In particular an extended set of both wrapped and unwrapped phase parameters might be considered, e. g.: a) excess kurtosis; b) texture statistics derived from gray-level co-occurrence matrix (GLCM): homogeneity, energy/uniformity, correlation and contrast; c) Rényi entropy and d) Kass-Witkin coherence [START_REF] Kass | Analyzing oriented patternsž[END_REF]. Thereafter a modification of hardware in experimental setup can be taken into account to improve the input data quality.

Fig. 1 .

 1 Fig. 1. LSI scheme: M ś mirrors, BS ś beam splitter, OW ś optical wedge

Figure 1

 1 Figure 1 depicts a typical LSI configuration employed for corneal and contact lens tear film surface topography data acquisition while Fig. 2 shows few examples of output interferograms.

Fig. 2 .

 2 Fig. 2. typical cases of tear film interferograms showing pre-corneal tear film in good condition (a), slightly deteriorated (b) and pre-lens tear film (c)

Fig. 3 .

 3 Fig. 3. image processing chain in Takeda's algorithm

Fig. 4 .

 4 Fig. 4. Gaussian phase disruption to be reconstructed by Takeda's algorithm: (a) unwrapped, used for phase modulation of fringes, and (b) wrapped mod2π for mimicking the error-less output (disruption scale increases from left to right)

Fig. 5 .

 5 Fig. 5. Takeda's algorithm with medium fringe frequency and moderate phase disruption

Fig. 6 .Fig. 7 .

 67 Fig. 6. Takeda's algorithm: non-integer fringe frequency, moderate phase disruption

Fig. 8 .

 8 Fig. 8. Takeda's algorithm: low (top row) and high (bottom row) fringe frequencies, intense phase disruption

Fig. 10 .

 10 Fig. 10. exemplary outputs of the tear film surface quality assessing system

Acknowledgments

The authors would like to express their gratitude to Prof. Ewa Skubalska-Rafajłowicz and Dr. Dorota Szczęsna-Iskander for extensive and fruitful cooperation and for their encouragement, advice and support.

Supported by the European Regional Development Fund within Innovative Economy Operational Program co-financed by the Foundation for Polish Science (POMOST/-//).


Olga Siedlecka-Lamch

Imed El Fray
email: ielfray@zut.edu.pl

Miroslaw Kurkowski
email: mkurkowski@uksw.edu.pl

Jerzy Pejaś
email: jpejas@zut.edu.pl

Verification of Mutual Authentication Protocol for MobInfoSec System

Keywords: authentication protocols, one-to-many protocol, mobile device, sensitive information, secure communication channel

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The modern people process tens of gigabytes of information a day, most of which is transferred electronically, by mobile devices. Phones and tablets have become personal, handheld offices by which users download and often send sensitive content: emails, business and banking transactions, etc. Each participant of that mobile/distributed system wants one -security of transmitted and stored data. Security has many aspects: information is only accessible to the defined destination (it should not be stolen or intercepted), the encrypted information can not be lost or deciphered by inappropriate entity (see [7][8][9]).

Cryptographic protocols provide security relevant to the needs of information systems. This security concerns, inter alia: authentication of entities, session key agreement between the parties, provides confidentiality, integrity, anonymity and non-repudiation. Participants of cryptographic protocol exchange messages through a specific communication channel. Communication channels can be divided into three types: channel point-to-point (or one-to-one) connecting the two participants, broadcast channels (one to many) connecting the sender and multiple recipients and conference channels (many to many) connecting all participants in the protocol and allow for exchange of messages between all participants.

Cryptographic protocols are subject of rigorous analysis, as they represent a critical component of any secure distributed computer system. They are easy to write, but on the basis of the code its very difficult to estimate their level of safety. Their simple structure is often confusing and leads to false conclusions in the evaluation of their safety. Therefore, an important element in the selection and design of cryptographic protocol is to verify its correctness.

The article shows a mutual authentication protocol designed for system MobIn-fSec, which enables cryptographic protection of sensitive information in accordance with Originator Controlled access control rules [14,6]. The ORCON rules release a user from the obligation to monitor any information (especially against unauthorized copying). The information is removed when a user is no longer allowed to access it.

A description of the assumptions, architecture, and the rules of functioning of the system MobInfoSec are included in the next chapter. A further section describes the objectives and requirements for the proposed protocol. The next chapter describes its functioning and at the end the verification of its correctness. The whole is closed by summary, containing further directions of research.

Objective

The paper gives mutual authentication protocol under the name of SP2SP_Mutual_Auth (Secret Protection module of user A to Secret Protection module of user B mutual authentication) designed for MobInfSec system that allows protection of cryptographic confidential information in accordance with the ORCON rules.

This protocol is initialized by an entity A (called the chairman). The chairman executes (sequentially or simultaneously) n times the one-to-one protocol with every other member B 1 , B 2 , . . . , B n from the group B. Successful completion of each instance of SP2SP_Mutual_Auth protocol enables to authenticate every pair of users (A, B i ), i = 1, . . . , n, and to establish n independent secure communication channels between them with different key material used by each pair of participants.

The security analysis of SP2SP_Mutual_Auth protocol is based on its specification written in HLPSL and ProToc languages and next used in well-known tools of automatic protocol verification like AVISPA, VerICS and PathFinder (see [1,10,13]. We assume that the adversaries inside our system have many capabilities of the standard Dolev-Yao intruder, namely, they are able, within their bounded storage capacity, to compose, decompose, overhear, and intercept messages as well as update values with fresh ones. Hence, it is commonly believed that Dolev-Yao intruder is the most powerful attacker because following the seminal work of Dolev and Yao [4], the communication media are assumed to be under absolute control of the intruder. This intruder can in particular destroy all transmitted messages.

The results of our security analysis have showed the correctness of the proposed protocol for the different states of S P.B i and S P.A i tokens when performing cryptographic operations and during authentication.

MobInfoSec system can be seen as a set of cooperating applications, including trusted parts, that are distributed in different locations and communicate with each other. More detailed assumptions, the architecture and functioning of the system MobInfoSec are described in [5]. At this point, we focus only on a description of those elements that have an impact on SP2SP_Mutual_Auth protocol and its security analysis. Applications can be closed in the domain of trust. A single domain is created around a trusted application or a group of trusted applications. We assume that communication between applications within the same trust domain is secure, could be caused by placing them in one location or the use of ready-made security technologies (eg. SSL).

Communication between domains therefore remains an open problem, namely: communication between components located in different domains, which will require the compilation of trusted paths and channels. Paths/channels created by the use of strong cryptography, allows applications from different domains to trust each other and accept their decisions. The main task is to define domains of trust and determine trusted paths and channels [7,5].

Basic Authentication Protocols

The aim of the cryptographic authentication protocol is to identify a particular or all of the participants of communication. Typically, the additional effect of the protocol is the key -established between the participants of the protocol, which will be used to build a trusted channel or a trusted path.

Another goal is to provide for messages exchanged during protocol execution the following (all or some) security features: confidentiality, authentication, integrity or non-repudiation. As mentioned earlier authentication protocols can be divided into unilateral, mutual and multilateral protocols of authentication of entities.

In the case of MobInfoSec system the secure communications between multiple entities is required. The main point is to ensure the proper authentication between the SP components which are located in different trust domains. One of the domains (a chairman) is the initiator of communication and should be mutually authenticate with each of the other domains of trust and establish a secure communication channel. Legend + Means that the protocol has indicated property, perhaps after meeting additional requirements presented in footnote 1) It applies also to the case when the protocol is used to authenticate the initiator of the protocol with other members of the participants group 2) N/A -not applicable 3) Applies to all participants of the protocol 4) Applies only to the initiator of the protocol 5) If session key is used by all members of the group 6) Lack of information about the existence of a formal security proof There are few potentially useful protocols (Table 1) that can be considered in MobIn-foSec ([15, 11, 16]). All of them guarantee mutual authentication, key integrity, key authentication, key control or confirmation, but only the first has a formal security proof. None of them provides a common communication channel or the secret handling. No matching of existing solutions to the system assumptions forced to design a new mutual authentication protocol.

Mutual Authentication Protocol

Cryptographic protocol design must be preceded by a clear definintion of project objectives and a determination of the impact of violations of these assumptions on achieving planned objectives of security. Examination of protocol defects that were not included in the assumptions (eg. Due to the lack of knowledge related to a given defect) motivates and allows to understand the various design features of the protocol, and the knowledge of successful (and known) attacks helps designers to avoid standard attacks.

Principles of engineering design of cryptographic protocols are associated with the three phases [3]:

analysis of the protocol requirements phase, detailed protocol design phase, proving protocol security phase. Below, we present SP2SP_Mutual_Auth one-to-many group mutual authentication protocol. In this protocol the group members are authenticated by the chairman "oneby-one". That is, n authentication messages are required to authenticate n group members. Then, these members share individual keys for the communication with the group chairman.

Assumptions and Notations

For the proposed protocols the following assumptions have been made:

types of connection and transmission medium (LAN, WLAN, WWAN, ...) used by the parties involved in the protocol are not significant, the term 'address' of the device means: complete and current information that helps to communicate with the device through the selected communication medium; method of processing and distribution of this information is beyond the scope of this paper, -All parties involved in the described authentication protocol are equipped with SP, under their exclusive control, -SP provides an interface compatible with the PKCS#11. Mutual certificate We assume that for a given set of entities P = A, B 1 , ..., B n , where n ≥ 1, the entity A is the preferred entity responsible for initiating the protocol. The aim of the protocol is the mutual authentication with each entity B i , i = 1, . . . , n, and generation of a key material necessary to ensure the confidentiality and authenticity of information exchanged between the parties. Additionaly we assume that:

The protocol specification uses the following symbols and markings

-SP tokens have the same root CA certificate; the case of several certificates is not included in the protocol; however, if we assume that the two root CAs have is-sued cross certificates to each other, the protocol -after the introduction of minor modifications -will also work correctly; token SP.X of the entity X stores in its memory: the root CA's certificate C.RCA.AUT, the intermediate CA's certificate C.CASP.X.CS_AUT CA issued by root CA, and certificate C.SP.X.AUT of the token SP.X.

Protocol description

The SP2SP_Mutual_Auth(A, B 1 , ..., B n ) protocol provides authentication of each pair of entities (A, B i ), i = 1, . . . , n and consists of the following states: State 0: SP.B_i and SP.A tokens do not possess the public keys of the opposite side.

1 Authentication MU.A module initiates the protocol, establishes a connection to authentication module MU.B_i of mobile device B_i and and carries protocol in the initial state.

Protocol analysis was performed using known automatic verification tools: Avispa [1], VerICS [10] and PathFinder [12,13]. In the case of communication over an insecure channel, in an open way, without any encryption, and in which the goal for subprotocol is not to maintain the confidentiality of the new data (keys, nonces) or user authentication, then automatic verification tools could not be used.

The need to introduce this type of communication results from the fact that the parties haven't established yet a secure communication channel. In these cases, the intruder can perform only flooding-type attack or disrupt communications. They are, however, risks faced by all communication systems. Justification of subprotocols' correctness, in such cases, is based on the analysis of the correctness of data transfer scheme, in order to achieve the objectives and the assumption of a trusted repository safety and duly signed certificates.

Accordingly, only two parts of the protocol (subprotocols of states 3 and 4) are designed to maintain the confidentiality of the new data (keys, nonces), and providing Because the messages sent are independent of each other, it is important to note that the subprotocol of state 4 is unambiguously symmetrical (similar) to the subprotocol of state 3. Therefore, in the description of these subprotocols we will focus only on the subprotocol of state 3. It is easy to observe that in other subprotocols there is no possibility of possessing by Intruder important data, so correctness of the whole protocol from security and authentication point of view is assured. The analysis of the correctness and the security of subprotocol of state 3 is made on the basis of the data transmission diagram (Fig. 2) and the experimental results obtained by using formal methods and aforementioned automatic tools.

In conducted studies the Dolev-Yao Intruder model was used, which is widely considered in the literature. According to this model the Intruder has full access to the network and transmitted data, he can decompose and compose transmitted data according to held by him cryptographic keys. The only assumption that limits privileges of the Intruder is the perfect cryptography assumption -the inability to decode the corresponding ciphertext without knowing the encryption key.

Specifications were made according to the syntax of HLPSL and ProToc languages and the data transmission of tested subprotocol. Users participating in the protocol and security goals guaranteed by this protocol were also modeled. Specifications in HLPSL is extensive, and does not introduce no additional information in relation to the specifications in ProToc, which is demonstrated below (see Listing 1).

From the viewpoint of the tested security properties, all modules of AVISPA tool reported the SP2SP_Mutual_Auth protocol correctness for a limited number of sessions, and one of AVISPA module reported also the correctness to an unlimited number of sessions.

VerICS tool generated 18 hypothetical runs, and for each of them built an automata model, which was then encoded into the Boolean formula. The formula was verified by the SAT solver MiniSAT. The result showed that in the surveyed space and with the adopted assumptions, protocol is correct and no errors were found in its structure.

For generated runs the PathFinder tool created chains of states. An attempt to construct a tree of runs containing a path of attack failed. This proves the correctness of subprotocol. Verification for selected parts of the protocol for all assumed parameters, fared well -the protocol is correct and secure.

All results and times are listed in the table 2.

Summary

In the paper a mutual authentication protocol was presented, it was designed specifically for MobInfoSEc system, to guarantee secure communication for mobile devices. The protocol provides mutual authentication between each pair of participants of communication, establishing a common key material, and thus setting up a secure communication channel.

The most important security properties of the described protocol were tested using three different automatic verification tools. During the verification perfect cryptography and the Dolev-Yao intruder model were assumed. The SP2SP_Mutual_Auth(A, B 1 , ..., B n ) protocol has passed verification and achieved its objectives.

Fig. 1 :

 1 Fig. 1: Trust domains concept for different mobile devices

Fig. 2 :

 2 Fig. 2: Simplified diagram of subprotocol: State 3

Listing 1 :

 1 Authentication protocol specification in ProToc language BEGIN U s e r s ( 2 ) P l a y e r s ( 3 ) S t e p s ( 2 ) I n t r u d e r (DY) P r o t o c o l : A ; N_A , i (A ) ; N_A ; N_A | i (A ) ; B ; B ; +K_A , -K_B , K_AB , N_A , i (A ) ; K_AB ; <<K_AB , h (K_AB , i (A)) > _-K_B>_+K_A ; S e s s i o n (A, B , I ) G o a l s A u t h e n t i c a t i o n ( B , A) S e c r e c y (K_AB) End

Table 1 :

 1 Authentication protocols comparison

					Protocol (variant)
				Transport RSA	Key transport	Lim-Lee key
	No.	Property	(EN 14890) [15] ISO/IEC 11770-3	agreement
					Mechanism 5 [16] protocol 5 [11]
	1. Mutual authentication	+	+	+
	2. Multi-party authentica-	-	-	-
		tion (one to many and
		many to one)
	3. Key integrity		+	+	+
	4. Key authentication	+	+	+
	5. Personal	(indepen-	+ 1)	+ 1)	+ 1)
		dent) communication
		channels
	6. Common communica-	-	-	-
		tion channel
	7. Forward secrecy	-	-	-
	8. Backward secrecy	N/A 2)	N/A	N/A
	9. Liveness		+ 3)	+ 3	+
	10. Key control		+	+ 4	+
	11. Key freshness		+ 3	+ 3	+ 3
	12. Key confirmation	+	+	+
	13. Formal security proof	+	+ 6	+

Table 2 :

 2 Summary of the results

Acknowledgement. This scientific research work is supported by NCBiR of Poland (grant No PBS1/B3/11/2012) in 2012-2015.


Damian Rusinek

Bogdan Ksiezopolski

Adam Wierzbicki

AQoPA: Automated Quality of Protection Analysis framework for complex systems

Keywords: modelling and protocol design, security protocol analysis, quality of protection, applied cryptography

Analysis of security economics for the IT systems is one of the important issues to be solved. The quality of protection (QoP) of IT System can be achieved on different levels. One can choose factors which have a different impact on the overall system security. Traditionally, security engineers configure IT systems with the strongest possible security mechanisms. Unfortunately, the strongest protection (especially in low resource devices) can lead to unreasoned increase of the system load and finally influence system availability. In such a situation the quality of protection models which scales the protection level depending on the specific requirements can be used. One of the most challenging issues for quality of protection models is performing quality of protection evaluation for complex and distributed systems. The manual analysis of such systems is almost impossible to perform. In the article, we proposed the Automated Quality of Protection Analysis framework (AQoPA). The AQoPA performs the automatic evaluation of complex system models which are created in the Quality of Protection Modelling Language (QoP-ML). In the article the case study of complex wireless sensor network analysis is presented. The network is deployed on a roller-coaster.

Introduction

The security analysis of the IT systems and simultaneously that of its influence on the system performance is one of the most important topics to be solved. On one hand, the traditional approach assumes that implementation of the strongest security mechanisms makes the system as secure as possible. Unfortunately, on the other hand, such reasoning can lead to the overestimation of security measures which causes an unreasonable increase in the system load [START_REF] Stubblefield | Managing the Performance Impact of Web Security[END_REF][START_REF] Sklavos | Design, Architecture and Performance Evaluation of the Wireless Transport Layer Security[END_REF][START_REF] Ksiezopolski | Adaptive approach to network security[END_REF][START_REF] Ksiezopolski | On QoP method for ensuring availability of the goal of cryptographic protocols in the real-time systems[END_REF]. The system performance is especially important in the systems with limited resources such as the wireless system networks or the mobile devices. Another example where such analysis should be performed is cloud architecture. The latest research indicates three main barriers for using cloud computing which are security, performance and availability [START_REF] Jürjens | Security and Compliance in Clouds[END_REF]. Unfortunately, when the strongest security mechanisms are used, then it will decrease system performance and further influence system availability. This tendency is particularly noticeable in complex and distributed systems. The latest results show [START_REF] Ksiezopolski | On the modelling of Kerberos protocol in the Quality of Protection Modelling Language (QoP-ML)[END_REF][START_REF] Ksiezopolski | On the efficiency modelling of cryptographic protocols by means of the Quality of Protection Modelling Language (QoP-ML)[END_REF] that in many cases the better way is to determine the required level of protection and adjust security measures to these security requirements [START_REF] Lambrinoudakis | Security requirements for e-government services: a methodological approach for developing a common PKIbased security policy[END_REF]. Such approach is achieved by means of the Quality of Protection models where the security measures are evaluated according to their influence on the system security.

One of the most challenging issues for the QoP models is performing quality of protection evaluation for complex and distributed systems [START_REF] Ksiezopolski | Quality of Protection Evaluation of Security Mechanisms[END_REF]. The manual analysis of such systems is almost impossible to perform. The analysis of any type of the security protocol is difficult when the experts do not use automated tools. In literature, we can indicate programs which helped the experts analyse the protocols. We can indicate the AVISPA tool [START_REF] Blanco | AVISPA: visualizing the performance prediction of parallel iterative solvers[END_REF][START_REF] Vigano | Automated Security Protocol Analysis With the AVISPA Tool[END_REF] or ProVerif [START_REF] Blanchet | Automated Formal Analysis of a Protocol for Secure File Sharing on Untrusted Storage[END_REF] application, which verifies security properties for cryptographic protocols. From the Quality of Protection analysis point of view, AVISPA and ProVerif have two limitations. The first one refers to the types of the function which can be modelled. One can model only cryptographic primitives and cryptographic algorithms. The full QoP analysis must refer to all security factors which affect the overall system security. The second limitation is that these languages do not provide the structure for evaluation of the security factors performance. In the literature one can indicate the tool for QoP analysis which are modelled in the UMLsec [START_REF] Jürjens | Tools for Secure Systems Development with UML[END_REF]. This tool can be used for automated analysis of simple models but when we would like to analyse the scenarios when thousands of hosts take part in the protocol, then the analysis is too complex and cannot be done properly. The UMLsec is used for model-driven security as the part of model-driven development.

The major contribution of this study is introduction of Automated Quality of Protection Analysis framework which performs the automatic evaluation of QoP-ML models created in the Quality of Protection Modelling Language [START_REF] Ksiezopolski | QoP-ML: Quality of Protection modelling language for cryptographic protocols[END_REF][START_REF] Ksiezopolski | Multilevel Modeling of Secure Systems in QoP-ML[END_REF]. It allows to analyse complex systems which may consist of thousands of hosts representing a wide area network which are actors in the cryptographic protocol or a complex IT system. One can balance security against performance. The full description of the AQoPA will be presented in the next sections. The AQoPA framework can be downloaded from the web page of the Quality of Protection Modelling Language Project [11].

2 Automated Quality of Protection Analysis framework (AQoPA)

In this section we present the architecture of AQoPA and data flow of model during the analysis process. The architecture of AQoPA is presented in Fig. 1. The figure presents four successive stages: stage 1 -model creation, stage 2security metrics definition, stage 3 -scenarios definition and stage 4 -simulation. These stages refer to the methodology of creating QoP-ML models defined in the article [START_REF] Ksiezopolski | QoP-ML: Quality of Protection modelling language for cryptographic protocols[END_REF] where the details about syntax and semantics can be found.

Stage 1 -Model Creation

Model creation stage is the first stage which must be performed in the AQoPA framework. The goal of this stage is to create the QoP-ML model that will be evaluated in the analysis process. The stage is divided into 4 phases. Initially the designer has to define functions (phase 1), functions equations (phase 2) and channels (phase 3). Later he can use them to create protocol flow (phase 4). Protocol flow is defined for hosts as they are the highest level elements of the analysis. Hosts contain processes and processes can contain subprocesses. Each process and subprocess contain instructions list.

Stage 2 -Security Metrics Definition

The second stage is the security metrics definition stage which is divided into 4 phases, too. In the first phase the designer has to gather metrics and configurations of analysed devices (servers, sensors, etc.). In the second phase the designer has to select subset of metrics for the functions that are used in the protocol flow created in the first stage.

The aim of last two phases is to group selected metrics in sets and assign them to hosts. The designer can model different devices therefore the metrics for the same functions may have different values. For example, the encryption operations are many times faster on high-performance servers than on the wireless sensors nodes. The designer has to group metrics into sets representing one device and assign these sets to hosts created in the first stage.

Stage 3 -Scenarios Definition

The aim of the third stage is to define the scenarios of the analysis process. The protocol flow is already created and the designer has to define versions that he would like to evaluate.

Versions selection Versions represent different variants of the evaluated protocol. Versions include a list of executed hosts, their processes and subprocesses that will be included in independent evaluations. The designer does not have to choose all processes from the host, but any subset that will create the target protocol flow. The differences in versions may come from using different devices or security mechanisms resulting in different metrics or from different protocol flows (i.e.. including additional processes or subprocesses in the version that implement additional security mechanism). Versions allow to evaluate complex models with a large number of hosts using repetition. The designer can repeat hosts and processes. At the end of the analysis, the designer obtains results for all evaluations and can compare them.

Modules selection Besides versions, the designer must select modules that he would like to use in the analysis process. The AQoPA is module based what means that the designer can easily add modules to the analysis process. The core of AQoPA is responsible for generating next states according to the protocol flow. The additional operations that bring results of analysis are executed in modules.

Stage 4 -Simulation

Simulation stage is the core stage of AQoPA architecture. The analysis process is realized by this stage and proceeds automatically without the user's interaction.

Static Checker Firstly, the provided model is passed to Static Checker which is responsible for syntax validation of the model. Any syntax error is passed to the Error Analyzer.

Versions creator When the model is validated by Static Checker, it is passed to the Versions creator. The task of this component is to create independent analysis process for each version selected in the Scenarios Definition stage. Creating versions involves the modification of protocol flow according to the list of executed hosts, processes and subprocesses in a particular version. As a result, AQoPA obtains as many protocol flows as many versions were selected. Each modified protocol flow is passed to the States Generator component and is analysed independently.

States Generator In the States Generator component AQoPA generates successive states of evaluated hosts executing their instructions. This process is repeated until all hosts are finished or an error occurs. Each process of next state generation includes execution of the instruction that was modelled in the QoP-ML.

This component is also responsible for detection of QoP-ML model errors. These errors may result from the designer's mistake during modelling the system (or protocol) or from the limitations due to the metrics (i.e.. using sensorsdevices with limited resources). These errors may lead to the situation when a variable is used before assignment, to deadlock in communication or to ambiguity of equations. This component detects these kinds of problems and passes them to Error Analyzer which outputs the information to the user.

QoP-ML introduces equations that are used to reduce complex function calls (nested function calls in parameters). Syntax validation checks all equations according to the syntax rules, finds and reports contradictory equations and checks if one equation contains the other one. The States Generator component finds ambiguity during the reduction process. All above situations pass an error to Error Analyzer.

Modules operation handler Modules selected in the Scenarios Definition stage take part in the process of generating the next state of protocol. Execution of all instructions is passed to the modules so that they can retrieve information about the current state and prepare the results. Additionally, modules can change default instructions flow.

Error Analyzer Error Analyzer is the last component of simulation stage. It outputs the information about the error received from Static Checker or States Generator. When the analysis finishes successfully, Error Analyzer creates a result report.

Case Study

In this section we present the analysis of complex system performed by means of the AQoPA framework. This case study presents the features of AQoPA as the tool used to analyse the wireless sensor networks in terms of security and efficiency.

We analyse the wireless sensor network used for structural health monitoring deployed on roller-coaster. Its main aim is to collect acoustic emission data during the ride which is transmitted to the gateway and analysed for cracks. This method has been studied in [START_REF] Yuyama | Fundamental Aspects of Acoustic Emission Applications to the Problems Caused by Corrosion[END_REF] and is still widely used as inspection method [START_REF] Elbatanouny | Early Corrosion Detection in Prestressed Concrete Girders Using Acoustic Emission[END_REF]. Using wireless sensor network gives a possibility to react to detected failures in real time.

In the case study we have used the Rougarou roller-coaster from Cedar Point theme park [17]. It is interesting example because the roller-coaster was opened in 1996 and named Mantis while now it is being rebuilt to be a floor-less coaster. Therefore the main structure remains and is going to be operated by new coaster.

The Rougarou is about 1200 meters length, 44 meters high and the speed goes up to 97 kmph. In Fig. 1ffig:rollercoaster we present an example of sensor placement on 270 degrees turn. Sensing nodes are placed every 3 meters on the track while the sink is mounted to the car and collects data from sensors during ride. During the analysis we would like to evaluate how the quality of protection of exchanging data influence the system efficiency and finally the lifetime of system.

C A R Fig. 2. WSN deployed on Rougarou roller-coaster.

Protocols

We propose three protocols to collect acoustic emission data presented in Fig. 3, 4 and5. When data is collected the algorithms for fatigue cracks detection are used and report any suspicious results in real time. Protocols present communication between sink, which collects data, and sensor, which senses data. The wireless sensor network consist of many sensors mounted on the track and one sink mounted to the car. The technique of sink mobility is used to collect data from sensors [START_REF] Rault | Energy efficiency in wireless sensor networks: A top-down survey[END_REF].

The first protocol is the simple one where no security is guaranteed. The second and the third protocols are modified version of protocol presented in verified in [START_REF] Mansour | Multihop Node Authentication Mechanisms for Wireless Sensor Networks[END_REF] which is used to authenticate new nodes in a sensor network.

In the description of protocols we use the following notation:

S -Sensor, Sink -Sink, R
-empty request for SHM data, D -acoustic emission data sampled by sensors, n I -nonce generated by I, sk(I) -private key of I, pk(I) -public key of I, {M } K -encryption of M with symmetric or asymmetric key K.

Protocol 1

In the first protocol we analyse the network without security mechanisms. The protocol is presented in Fig. 3. The sink node sends empty request for acoustic emission data to sensor when the car is near its place of mounting. In response the sensor collects acoustic emission data and returns it back unencrypted.

Protocol 2

The second protocol includes security mechanisms which provide confidentiality and authentication of sink and sensors. The communication is encrypted with pre-deployed, symmetric key N K. The presented is shown in Fig. 4.

Protocol 3

The difference between second and third protocol is that the third one uses asymmetric cryptography to ensure security. We assume that the pairs of keys were pre-deployed and sink knows public keys of all sensors while sensors know the public key of sink. The protocol is presented in Fig. 5. The difference be-

Sink Sensor R = {n Sink , Sink} K DH (Sink,S)
{n Sink , S, D} pk(Sink)

Security : High tween original version from [START_REF] Mansour | Multihop Node Authentication Mechanisms for Wireless Sensor Networks[END_REF] and the third protocol is returned data. In the original version, the session key is returned while in the proposed protocol it is acoustic emission data. Additionally, in the second protocol data is encrypted with network key which has two advantages: encryption takes less time and protocol does not require asymmetric keys management. However, using network key gives possibility of reading and modifying packets to all nodes in network. Therefore, the assumption of all trusted nodes is required.

AQoPA evaluation

As the result of the case study we want to estimate the lifetime of wireless sensor network deployed on the roller-coaster depending on the protocol and type of sensor node. Firstly, we have to define the assumptions about the monitoring system.

Assumptions:

-Number of measurements. We assume that there are 100 rides with measurement each day. -Number of sensors. We assume that the network consists of one sink mounted to the car and 400 sensors mounted to the track at equal intervals. -Battery. We assume that nodes are equipped with standard AA battery with 1200 mAh capacity. After this, we defined two type of factors which influence the lifetime of the wireless sensor network monitoring system.

Factors:

1. Protocol. We want to check the lifetime depending on the type of protocol selected from three previously described. 2. Hardware. We estimate the lifetime for two types of nodes: MicaZ with 8MHz ATmega128L CPU and Imote2 with 104MHZ PXA271 XScale CPU.

In case of page limit we do not present the QoP-ML model of the roller-coaster but the QoP-ML model of the case study can be found on the QoP-ML Project web page [11] and in the AQoPA framework. Presented model consists of hundreds of sensors and the analysis of such complex network is impossible to be performed manually. Using AQoPA the network can be analysed automatically in short time. The lifetimes of nodes (in days) estimated with AQoPA are presented in Table 1. One can see that lifetime of sink node for protocol 1 (NO security) is very long. When we compare it with other protocols one can notice significant influence of security operations on lifetime of the network. When the security mechanisms are introduced (protocol 2 and 3) the sink becomes the bottle neck of the network. One can see that in case of MicaZ and HIGH security protocol the lifetime of network decreases to 5 days while for Imote2 it becomes 27 days. One of the important factor which is worth for estimating is the wireless sensor network lifetime. We define the network lifetime as the minimum of nodes' lifetimes because we assume that each node must be operative in order to keep network working correctly. In case of HIGH security protocol using MicaZ sensors, lifetime of network could be extended five times only if the sink was replaced with Imote2 sensor (both nodes have the same radio chip CC2420). Another element which can be analysis by means of AQoPA framework is the influence of measurements granularity to the network lifetime. The lifetime results in Tables 1 were estimated with assumption that there are 100 rides with measurements during one day. Figure 6 presents the decrease of lifetime depending on daily number of measurements for the protocols which guarantees the security on MEDIUM and HIGH security level. The protocol 1 (NO security) has not been included on Fig. 6 because in this protocol the performance is obviously much more effective than other protocols.

In the article we proposed the Automatic Quality of Protection Analysis framework. One of the main contributions of AQoPA is quality of protection and efficiency analysis of complex systems which are modelled in QoP-ML (Quality of Protection Modelling Language). The complexity of models may result by e.g. a large number of hosts (actors) in the protocol flow which can be executed simultaneously or by a specifically defined order. For illustrating the capabilities of AQoPA we present an example of SHM wireless sensor network deployed on roller-coaster in order to find cracks in the track. The AQoPA has been used to estimate the lifetime of such network under different conditions depending on the level of security and hardware. The AQoPA can verify whether a proposed network which uses given protocol can be operative for questioned length of time under given, environmental circumstances. The presented in the article analysis of the wireless sensor network deployed on roller-coaster show that one can gather the results which can help designers for making the best decision about complex system parameters.

Modelling tools used for computer security applications may however be found to prospective co-existence and cooperation with modelling tools used in computational neuroscience [START_REF] Wojcik | Electrical parameters influence on the dynamics of the hodgkinhuxley liquid state machine[END_REF][START_REF] Wojcik | Analysis of the neural hypercolumnin parallel pcsim simulations[END_REF]. We have undertaken some steps in order to merge security aspects of computer systems with hypothesised existence of brain activity fingerprint characteristic for particular users. These research will be continue as the future work. That kind of analysis of complex system cannot be prepared manually.

Fig. 1 .

 1 Fig. 1. AQoPA architecture and data flow

Fig. 3 .

 3 Fig. 3. Protocol 1: No security.

Fig. 4 .

 4 Fig. 4. Protocol 2: Symmetric cryptography

Fig. 5 .

 5 Fig. 5. Protocol 3: Asymmetric cryptography

Fig. 6 .

 6 Fig.6. The lifetime of networks depending on the number of daily measurements.

Table 1 .

 1 Lifetime (in days) of nodes in SHM network.

			Lifetime (in days)
		MicaZ	Imote2
		Sink Sensor Sink Sensor
	Protocol 1 -NO security	87378 5378 86677 653
	Protocol 2 -MEDIUM security 38	3974	61	636
	Protocol 3 -HIGH security	5	1089	27	597

Acknowledgements

This work is supported by Polish National Science Centre grant 2012/05/B/ST6/03364.


Bozena Kostek
email: bokostek@audioakustyka.org

Music Information Retrieval -Soft Computing versus Statistics

Keywords: Music Information Retrieval (MIR), feature extraction, soft computing, collaborative filtering (CF), similarity measures

Music Information Retrieval (MIR) is an interdisciplinary research area that covers automated extraction of information from audio signals, music databases and services enabling the indexed information searching. In the early stages the primary focus of MIR was on music information through Query-by-Humming (QBH) applications, i.e. on identifying a piece of music by singing (singing/whistling), while more advanced implementations supporting Queryby-Example (QBE) searching resulted in names of audio tracks, song identification, etc. Both QBH and QBE required several steps, among others an optimized signal parametrization and the soft computing approach. Nowadays, MIR is associated with research based on the content analysis that is related to the retrieval of a musical style, genre or music referring to mood or emotions. Even though, this type of music retrieval called Query-by-Category still needs feature extraction and parametrization optimizing, but in this case search of global online music systems and services applications with their millions of users is based on statistical measures. The paper presents details concerning MIR background and answers a question concerning usage of soft computing versus statistics, namely: why and when each of them should be employed.

Introduction

Music Information Retrieval is a very well-exploited field. They are venues devoted to MIR only (e.g. ISMIR, MIREX) [START_REF] Lidy | Combining audio and symbolic descriptors for music classification from audio[END_REF][20] [START_REF] Pampalk | Improvements of audio-based music similarity and genre classification[END_REF][34] in which state-of-the-art MIR methods and achievements are critically evaluated, also sessions, workshops, discussion panels dedicated to this domain occur within artificial intelligence, audio, multimedia and other symposia and conferences [START_REF] Kostek | Representing Musical Instrument Sounds for their Automatic Classification[END_REF] [START_REF] Kostek | Report of the ISMIS 2011 Contest: Music Information Retrieval[END_REF][17] [START_REF] Ness | Improving automatic music tag annotation using stacked generalization of probabilistic SVM outputs[END_REF]. On the other hand, there exist many music recommendation services, commercial and non-commercial that are based on social networking rather than on MIR-related methods [31][38][39[40][41]. This is often the case when a query for specific song or music genre may be performed based on similarity measures retrieved from large music archives [START_REF] Ness | Improving automatic music tag annotation using stacked generalization of probabilistic SVM outputs[END_REF] [START_REF] Schedl | Music Information Retrieval: Recent Developments and Applications[END_REF]. In this context the stress should be on 'large' because smaller databases could easily be managed by human resources. Most prior research done into the audio genre recogni-tion within the field of Music Information Retrieval were based on rather small music databases with a few classes of music genres [START_REF] Aucouturier | Representing musical genre: A state of art[END_REF][8] [START_REF] Hyoung-Gook | MPEG-7 Audio and Beyond: Audio Content Indexing and Retrieval[END_REF][17] [START_REF] Pachet | A classification of musical genre[END_REF].

Even though collaborative (commercial) music services exist for many years, there are still some key problems that should be addressed in this field. This is especially important in cases when human-based evaluation doesn't always give correct answers or is far from giving correct answers, but nevertheless the user-based annotation is utilized in predicting the user's music preference. Moreover, there remains the key problem related to the scalability of the proposed solutions, regardless of the type of application (research-or commercial-based).

Applications that may be discerned within MIR area are: music genre classification, automatic track separation, music transcription, music recommendation, music generation, music emotion recognition (MER), music indexing, intellectual property rights management, and others. Many of the applications recalled above are based on a similar approach that consists in music pre-processing including parametrization, and the usage of soft computing methods [START_REF] Hyoung-Gook | MPEG-7 Audio and Beyond: Audio Content Indexing and Retrieval[END_REF][10] [START_REF] Kostek | Music Information Retrieval in Music Repositories, Chapter 17 in Rough Sets and Intelligent Systems Reference Library[END_REF] [START_REF] Kostek | Music Data Processing and Mining in Large Databases for Active Media, Active Media Technology[END_REF][13] [START_REF] Kostek | Perception-Based Data Processing in Acoustics[END_REF][19] [START_REF] Ness | Improving automatic music tag annotation using stacked generalization of probabilistic SVM outputs[END_REF] [START_REF] Tzanetakis | Musical genre classification of audio signal[END_REF]. These background notions are to be shortly reviewed with a focus on whether they need to be readdressed by MIR community.

The aim of this paper is paper is two-fold. First of it discusses MIR-related research and background measures utilized in music services. Secondly, it is to answer a question concerning usage of soft computing versus statistics, namely: why and when each of them should be employed. Section 2 reviews state-of-the-art in MIR in the context of search-based analysis, while in Section 3 issues related parametrization and softcomputing-based approach to genre classification are shown. Section 4 reviews background research that lies behind the song prediction in music services. Finally, summary remarks are formulated forming Conclusion Section.

Queries in MIR

Without any doubts one may say that MIR is a global research concentrated on the practical use of technical implementations and systems applications to music. Supported by soft computing, MIR evolved into a new domain, namely musical informatics. One of the crucial issues is the improvement of the efficiency of music recognition (e.g. in terms of performance), close to classification performed by human. However one of the problems is that human-based evaluation is not always able to give correct answers. Thus, we expect better soft-computing-than human-based performance. This concerns both music genre and emotion recognition.

During its early stages, MIR focus was on studies that allowed for searching for music information through QBH, Query-by-Humming/Singing/Whistling. Since singing or whistling is a natural ability of humans, humming to a microphone seemed to be the most convenient way to search for a given melody.

Full representation of a non-polyphonic piece is often called 'melody profile'. 'Sequence of frequencies' is a representation losing time-domain information, that is onsets and durations of sounds, but the information about pitches is preserved. In melodies represented as 'sequences of intervals', tonality information is lost, but the sizes of intervals between each pair of two consecutive sounds are known. The most simplified representation is the 'sequence of the directions of intervals' -only the directions of pitch of subsequent sounds in a melody are known. The last representation contains significantly reduced information, but at the same time preserves enough information for retrieval, i.e. it is resistant to rhythm changes (as no rhythm is retained), tonality and transposition errors. One of the most often cited work within QBH research studies is by Ghias et al. [START_REF] Ghias | Query by humming -musical information retrieval in an audio database[END_REF], who implemented a system able to detect coarse melodic contour based on Parsons code and retrieved by text string search. Even though the system had some constraints, i.e. usage of MIDI code, easily discerned notes, no rhythmic information, each pair of consecutive notes simply coded as "U" ("up") if the second note is higher than the first note, "R" ("repeat") if the pitches are equal, and "D" ("down") otherwise, it performed surprisingly well on a prepared database. This is especially interesting, when one takes into account fact that a human ability to recognize hummed melody is not very high. It was observed that the average human accuracy in recognizing hummed queries is approximately 66% [27][37]. This is why formulating queries in that way may not be fully sufficient, even though it is intuitive for humans or musicians, but still may be inconvenient for non-musicians.

A simple measure used for non-polyphonic pieces and single-channel melodies, which are common in the MIDI standard is based on the distance d between a query q=q 1 , q 2 , …, q m and object t= t 1 , t 2 , …, t n is calculated with Eq. 1. The length of the query equals to m, the length of the object is n. The average difference in pitch between the query and an object in the database is calculated, the minimum average difference is acknowledged to be the distance between the query and the objectthe shifts of j positions in a melody and transpositions of ∆ semitones are committed to minimize the value of the distance.

∑ = = + ∆ - = ∆ + - = m i i j i i m n j t q m t q d (1)
In melody retrieval systems, a query is usually a fragment of a full melody, so the matching is done in many locations of a melody, the pattern given in the query is matched against all objects in the database. In addition, queries do not exactly match the melodies in the database, so time-consuming approximate string matching techniques should be used. All those factors enlarge the computational complexity of the music retrieval task. Although optimizations to the classical approach by Baesa-Yates to approximate string matching were proposed, algorithms for melody retrieval may still be time-consuming, especially if the database contains large amount of musical files or/and rhythm information by detecting periodicity in time domain [START_REF] Mcnab | Toward the digital music library: tune retrieval from acoustic input[END_REF] or by analyzing note duration is added to music database.

More advanced MIR applications support Query-by-example searching. They are strongly rooted in collaborative music social networking when a given song may be used as a query for similar music. However more broaden retrieval refers to contentbased analysis. In particular, search for similar musical styles, genres or mood/emotions of a musical piece is called Query-by-category: musical style, genre, mood/emotion (content-based) [START_REF] Kostek | Music Information Retrieval in Music Repositories, Chapter 17 in Rough Sets and Intelligent Systems Reference Library[END_REF]. These types of information retrieval are visible in both research-based and music services, however the most significant difference between these two approaches lies in the size of music databases. Research-based data-bases contain a few hundred or the most a few thousands music excerpts, typically 30 (or less) second-long because of their copyright situation which should allow processing and presenting them to the public, while music services offer million of songs. These facts translate straightforward into the answer when and why soft computing or similarity-based approach can be applied.

The need for user-centric music recommendation created music services. Search may use tags contained in the ID3v.2 format (a query may consist of the song title, artist, genre, composer, album title, song length, lyrics, etc.). Music databases contain songs assigned to music genres, described by low level feature vectors or higher level descriptors, such as an instrument name, lyrics, etc., often annotated manually. Music services collect also interaction traces between the user and the song or between the users. A simple "interaction" means to play a song by the user and save it to the list of the so-called "favorite songs" This is the way of creating the user's profile. This information can be sent from the user's computer in the form of an application (e.g. scrobbler -an application installed by the service last.fm [39], which involves automatic transmission of metadata for all of the music tracks for the user's computer for analysis and the so-called collaborative filtering (CF) [START_REF] Ekstrand | Collaborative Filtering Recommender Systems[END_REF][6][22] [START_REF] Sarwar | Item-Based Collaborative Filtering Recommendation Algorithms[END_REF].

With regard to the effectiveness of music search, when low level-feature-based approach is used for small databases, the achieved effectiveness varies depending on a feature vector of used parameters and decision algorithms and is in the range of 60-90% [START_REF] Mandel | LABROSA's audio music similarity and classification submissions[END_REF] [START_REF] Kostek | Report of the ISMIS 2011 Contest: Music Information Retrieval[END_REF][17] [START_REF] Weinstein | Query By Humming: A Survey[END_REF]. It should be noted that efficiency is comparable to results obtained in the process of musical genre classification by human. In the case of databases based on tags IDv3.2 format, the accuracy of searching depends on the efficiency of the search algorithm to search the database (e.g., SQL), which means that a typographical error contained in the query within the well-known music databases such as FreeDB or GRACENOTE may cause a lack of response.

Annotating music manually requires a large number of "experts" with musical background, and is time-consuming. However, when performed by statistically significant number of people participating in the process, this starts to be to some extent reliable and effective method. This method is also called social tagging and takes the form in which key words describing a musical piece are added by users. Of course, it must be remembered that manual annotation can also be problematic in the context of various musical tastes and preferences, which can lead to a situation where the same track is assigned to different genres by individuals with diverse musical experience. That is why, it is often observed that users are not able to fully objectively assign a given musical piece to appropriate musical styles.

Parametrization and Decision Systems

Paramerization, a part of the pre-processing, aims at differentiating objects between different classes, recognizing unclassified objects (from unknown class) and determining whether an object is a member of a certain class. The underlying need to parametrize musical signals is their redundancy, thus a parametrization process results in the creation of feature vectors. Therefore, the decision process can be based on a set of parameters that are characteristic for e.g. musical style. Feature vectors containing time-, frequency or time-frequency-domains descriptors are often completed by adding statistical parameters.

As mentioned already retrieval that performs based on a low-level description of music depends on the quality of parametrization and the associated decision system. Low-level descriptors are usually based on the MPEG 7 standard, Mel-frequency cepstral coefficients (MFCC's) or, finally, dedicated parameters suggested by researchers [START_REF] Bergstra | Aggregate features and AdaBoost for music classification[END_REF][7] [START_REF] Kostek | Representing Musical Instrument Sounds for their Automatic Classification[END_REF][15] [START_REF] Lindsay | MPEG-7 and MPEG-7 Audio -An Overview[END_REF][24] [START_REF] Pachet | A classification of musical genre[END_REF]. Within this approach, feature descriptors are assigned to a given music excerpt in order to perform automatic annotation of a given piece. Thus, the adequate selection of parameters, the algorithm optimization in terms of signal processing and data exploration techniques serve as key technologies that provide effective music tagging automatically.

An example of a set of descriptors (191 in total) based on MPEG 7 standard, mel cepstral and dedicated parameters before optimization is given in Table 1 [START_REF] Hoffmann | Music Genre Recognition in the Rough Set-Based Environment[END_REF][10] [28][29]. This was the feature vector created for the ISMIS'2011 (19 th International Symposium on Methodologies for Intelligent Systems) music recognition contest. Prepared by the author and her collaborators was then incorporated into the ISMIS database [START_REF] Kostek | Report of the ISMIS 2011 Contest: Music Information Retrieval[END_REF]. The database contains over 1300 music excerpts, represented by 6 music genres (classical, Jazz, Blues, Rock, Heavy Metal, Pop). The winners of this competition got around 88% of correct classification [START_REF] Schierz | High-performance Music Information Retrieval System for Song Genre Classification, Foundations of Intelligent Systems[END_REF]. As mentioned before the original FV contains 191 descriptors. Such a large number of parameters allows for an effective classification of musical genres, but at the same time it leads to a very high data redundancy, what results in a reduced classification effectiveness in terms of time consumption. That's why the author and her Ph.D. student applied PCA-based (Principal Component Analysis) optimization, and they obtained even higher accuracy in the classification process, but most important -classifying music genres was possible in real time based on buffered parts of the processed signals [START_REF] Hoffmann | Music Genre Recognition in the Rough Set-Based Environment[END_REF].

In general, the input signal is analyzed in the frequency sub-bands and then a set of parameters are calculated. That's why the optimization process of the feature vectors containing low-level features is further needed. Further, an important issue is that the available music excerpts represents typically 30 seconds (or less) of the whole track, which in most cases it is the beginning of the track (which not always is a perfect match for this music genre). Due to that fact even such a genre as Rap&HipHop which is quite easy to distinguish by the listener, can be hard to classify by the pretrained system, since these 30 seconds can be represented either by the musical part or lyrics, differing much in style. The same feature vector was applied to a larger database (but diminished to 173 parameters because not all frequency bands were present in the signal), called Synat, containing approximately 52,000 30 seconds-long music excerpts [START_REF] Hoffmann | Music Genre Recognition in the Rough Set-Based Environment[END_REF].They are allocated to 22 music genres: Alternative Rock, Blues, Broadway&Vocalists, Children's Music, Christian&Gospel, Classic Rock, Classical, Country, Dance&DJ, Folk, Hard Rock&Metal, International, Jazz, Latin Music, Miscellaneous, New Age, Opera&Vocal, Pop, Rap&Hip-Hop, Rock, R&B, and Soundtracks. The database contains additional metadata, such as: artist name, album name, genre and song title. In addition to the items listed in the database, songs include also track number, year of recording and other parameters typically used for annotation of recordings. The user interface of this system is shown in Fig. 1.

Fig. 1. Synat system user interface

From the whole Synat database 32,110 audio excerpts were chosen representing 11 genres (it is to note that this gives 5 555 030 parameters altogether, i.e. 32,110 x 173-element feature vector). That's why the PCA was applied to diminish this number for classification process. The system allows for an effective recommendation of music, experiments performed on 11 genres with an optimized feature vector returned classification accuracy of above 92% [START_REF] Kostek | Music Information Retrieval in Music Repositories, Chapter 17 in Rough Sets and Intelligent Systems Reference Library[END_REF].

When reviewing MIR-related sources, one may see that among known classifiers the most often used are: SVMs (Support Vector Machines), minimum-distance methods, to which the k-Nearest Neighbor (k-NN) method belongs, Decision Trees, Random Forests, Rough Sets, etc. [START_REF] Kostek | Perception-Based Data Processing in Acoustics[END_REF][17] [START_REF] Pawlak | Rough Sets[END_REF][34] [START_REF] Tzanetakis | Musical genre classification of audio signal[END_REF]. Each of these systems should ideally be considered in terms of high robustness and efficiency, not being computationally expensive, 'protecting' against overfitting, etc. Even though there is room to refine most of the given criteria, but when this list of criteria and conditions is reviewed one can say that the most problematic to achieve is the condition of not being computationally expensive when applied to large databases. That's why music recommendation services relies on statistics rather than on learning algorithms.

Music Recommendation

There are at least two layers of analysis when talking about music recommendation systems. It concerns both understanding and predicting user preferences. A recommender system must interact with the user, both to learn the user's preferences and provide recommendations based on the nearest neighbor for any query [START_REF] Ekstrand | Collaborative Filtering Recommender Systems[END_REF]. Systems should collect reliable data from which to compute their recommendations and preferences, reducing the noise in user preference data sets.

Before some background notions related to recommender systems are recalled, the problem of scalability should be pointed out, first. Scalability of search solutions imposes either small databases (utilized in research) and typically not showing results in real-time or utilizing techniques that reduce the number of users or items (or/and both) in search. One of the well-known solutions aimed to reduce the complexity and high dimensionality of database spaces is Locality Sensitive Hashing (LSH) belonging to randomized algorithms [START_REF] Slaney | Locality-Sensitive Hashing for Finding Nearest Neighbors[END_REF]. Its role is not to return exact answer but to guarantee a high probability that will bring in an answer close to the correct one. The algorithm builds a hash table, i.e., a data structure that allows for mapping between a symbol (i.e., a string) and a value. Then an arbitrary, pseudorandom function of the symbol that maps the symbol into an integer that indexes a table is calculated [START_REF] Slaney | Locality-Sensitive Hashing for Finding Nearest Neighbors[END_REF]. LSH is based on the idea that, if two points are close in a predefined space, then after the mapping operation these two points will remain close together [START_REF] Slaney | Locality-Sensitive Hashing for Finding Nearest Neighbors[END_REF].

The basis for a collaborative filtering is a collection of users' preferences for various (music) items (see Fig. 2 for explanation) [START_REF] Guy | Social media recommendation based on people and tags[END_REF][10] [START_REF] Mu | User-Based Collaborative Filtering Based on Improved Similarity Algorithm[END_REF][30] [START_REF] Wang | Unifying User-based and Item-based Collaborative Filtering Approaches by Similarity Fusion[END_REF]. Preference expressed by the user for an item is called a rating. The (user-item ) matrix X with dimensions K×M, is composed of K users, and M songs. A single matrix element is described by x k,m = r, which means that the kth user assigns the r rate for the mth song. The matrix X may be decomposed into row vectors, representing each individual rating and may be treated as a separate prediction for the unknown rating [START_REF] Guy | Social media recommendation based on people and tags[END_REF][10] [START_REF] Mu | User-Based Collaborative Filtering Based on Improved Similarity Algorithm[END_REF][30] [START_REF] Wang | Unifying User-based and Item-based Collaborative Filtering Approaches by Similarity Fusion[END_REF]:

X = [u 1 , … , u K ] T , u k = [x k,1 , … , x k,M ] T , k = 1, … , K (2)
Vector u k T describes the kth user's profile as it is a set of all ratings assigned (where: T denotes transpose of the matrix X). Such decomposition of the matrix X constitutes a foundation for the users-based collaborative filtering.

It is also possible to present the matrix X as column vectors [START_REF] Guy | Social media recommendation based on people and tags[END_REF][10] [START_REF] Mu | User-Based Collaborative Filtering Based on Improved Similarity Algorithm[END_REF][30] [START_REF] Wang | Unifying User-based and Item-based Collaborative Filtering Approaches by Similarity Fusion[END_REF]:

X = [i 1 , … , i M ], i m = [x 1,m , … , x K,m ], m = 1, … , M (3)
where i m is a set of ratings of the mth song assigned by all K users. In this case this forms a basis for representing song(item)-based collaborative filtering (this process is illustrated in Fig. 3). Both types of collaborative filtering need further processing, i.e. in the case of the user-based collaborative filtering each raw denoted above is sorted by its similarity towards the kth user's profile. The set of similar users can be identified by employing a threshold or selecting a group of top-N similar users. More detailed mathematical description of this method may be found in the work by Wang et al. [START_REF] Wang | Unifying User-based and Item-based Collaborative Filtering Approaches by Similarity Fusion[END_REF].

For calculating a similarity between the users k and a in the collaborative filtering typically Pearson correlation (Eq. 4) or cosine similarity (Eq. 5) measures are used, which belong to memory-based algorithms:

s u (u k , u a ) = , , 2 2 , , ( ) ( ) ( ) (
)

km k am a m M km k am a m M m M x u x u x u x u ∈ ∈ ∈ - ⋅ - - ⋅ - ∑ ∑ ∑ (4)
where:

-x k,m , x a,m -is mth rate of a song assigned by the k and a users, k u , a u -mean values of ratings assigned by the k and a users. Reassuming, the cosine similarity is represented by a scalar product and magnitude, in the information retrieval the resulting similarity ranges are within 0 (indicating decorrelation),1 (exactly the same). These are only examples of measures and metrics that are used, adjusted cosine similarity is another metric employed in the ranking area. To memory-based algorithms K-Nearest Neighbor also belongs.

Other techniques such as smoothing the estimate from the collection statistics, using the linear smoothing method are employed towards derivation of the ranking formulas [START_REF] Guy | Social media recommendation based on people and tags[END_REF] Due to the sparsity of the data, considering the co-occurrence statistics is unreliable. Thus in some recommender systems Similar User Ratings, Similar Item Ratings or Similar User-Item Ratings are used for diminishing the matrix X. For example in the Similar User Ratings approach for prediction only those songs are taken into account that were ranked highly in the ranked list, reducing the retrieval performance of the top-N returned items. In general, it is assumed that in systems with a sufficiently high user to item ratio, adding the user or changing ratings is unlikely to significantly change the similarity between two items, particularly when the items have many ratings. Therefore, pre-computing similarities between items in an item-item similarity matrix may be reasonable.

As brought by researchers working in the recommendation systems field, collaborative filtering is not risk-free. If there are millions of songs in a music service, then even very active users are not able to listen even to 1% of the music sources. This may result in unreliable recommendation. Thus, the fundamental question in modelling collaborative filtering is how to relate users and items through this usually very sparse user-item matrix.

When reviewing literature sources concerning collaborative filtering important issues related to sparsity, scalability, privacy of data, reliability, etc. are pointed out One of the very interesting ones lying at the roots of CF concerns how much confidence may be placed in the users' preferences, and whether it should be 'measured' with their consent or not. That's why the ultimate goal may be collaborative filtering without a community.

Conclusions

In this paper challenges in music retrieval and music recommendation systems were outlined. Also, reasons behind the answer to the question why and when statistics versus soft computing methods should be employed was given. Based on the review presented it may be concluded that issues of retrieval and recommendation are interconnected and these two approaches when joint together may make both processes more reliable. Also, new strategies such as for example separating music tracks at the pre-processing phase [START_REF] Eweret | Score-Informed Source Separation for Musical Audio Recordings[END_REF][8] [START_REF] Rosner | Classification of Music Genres Based on Music Separation into Harmonic and Drum Components[END_REF][29] and extending vector of parameters by descriptors related to a given musical instrument components that are characteristic for the specific musical genre to music genre classification should be more thoroughly pursued [START_REF] Eweret | Score-Informed Source Separation for Musical Audio Recordings[END_REF][28] [START_REF] Rosner | Influence of Low-Level Features Extracted from Rhythmic and Harmonic Sections on Music Genre Classification[END_REF].

s

  u (u k , u a ) = cos(u k , u a ) u k • u a -scalar product of u k and u a , -||u k ||, || u a || -length of vectors u k and u a .

  [START_REF] Konstan | Evaluating Collaborative Filtering Recommender Systems Herlocker[END_REF][START_REF] Mu | User-Based Collaborative Filtering Based on Improved Similarity Algorithm[END_REF][30][START_REF] Wang | Unifying User-based and Item-based Collaborative Filtering Approaches by Similarity Fusion[END_REF]. Apart from memory-based and model-based algorithms among CF algorithms one may discern ranking-based and probabilistic model-based[START_REF] Guy | Social media recommendation based on people and tags[END_REF][10][START_REF] Mu | User-Based Collaborative Filtering Based on Improved Similarity Algorithm[END_REF][30][START_REF] Wang | Unifying User-based and Item-based Collaborative Filtering Approaches by Similarity Fusion[END_REF].

Fig. 3 .Fig. 4 .

 34 Fig. 3. Illustration of the user-based preference prediction for various (music) items (green lines indicate what the user listens to (and how many times), if two users (interconnected by a red arc) listen to the given song, and one of the pair listens to another one, then the implication is that the second one of the pair may want to listen to this one as well (violet dashed line)

Table 1 .

 1 Audio features an overview by the total number and description per type[START_REF] Hoffmann | Music Genre Recognition in the Rough Set-Based Environment[END_REF][START_REF] Rosner | Influence of Low-Level Features Extracted from Rhythmic and Harmonic Sections on Music Genre Classification[END_REF]

	No. of param.	Audio Feature Description
	1	Temporal Centroid
	2	Spectral Centroid and its variance
	34	Audio Spectrum Envelope (ASE) in 34 subbands
	1	ASE mean
	34	ASE variance in 34 subbands
	1	Mean ASE variance
	2	Audio Spectrum Centroid (ASC) and its variance
	2	Audio Spectrum Spread (ASS) and its variance
	24	Spectral Flatness Measure (SFM) in 24 subbands
	1	SFM mean

Acknowledgements

The study has been supported by the project no. PBS1/B3/16/2012 entitled "Multimodal system supporting acoustic communication with computers" financed by the Polish National Centre for R&D.