Adi Swissa
email: adi.swissa123@gmail.com

Ehud Gudes
email: ehudgu@openu.ac.il

An ABAC model with Trust and Gossiping (ABAC-TG) for online social networks

Keywords: Attribute based access control (ABAC), gossip, trust, online social networks

In this paper, we propose an attribute-based access control model called ABAC-TG for online social networks (OSNs). This model comprehensively considers user and object attributes and two main social attributes: trust and gossip, which are calculated based on the Ego-node (the user sharing the information) point of view. Each user is evaluated trust and gossip wise by several criteria, such as total number of friends, number of interactions between two users, and more. A new algorithm for calculating user gossiping value by graph clustering is defined, and this gossiping value can also be used for trust calculation. The ABAC model is formally presented, including rules and attribute definitions, and is demonstrated by several use case scenarios. The gossip and trust assessments provide more accurate and viable information-sharing decisions that serve the purpose of more precise and flexible authorizations.

This work is novel in two respects. First, we are using trust and gossip as dynamic attribute calculations. And second, we present a new algorithm for calculating the user's gossip value from the ego user point of view and use it either as part of the trust attribute calculation or as a separate attribute in the ABAC model.

Introduction

As online social networks (OSNs) increase in size and more people use them as their primary Internet website, the volume of information shared in OSNs keeps on growing. The public accessibility of such networks with the ability to share opinions, thoughts, information, and experience offers great promise to people and communities. In addition to individuals using such networks to connect to their friends and families, governments and enterprises have started exploiting these platforms for delivering their services to citizens and customers [START_REF] Sherchan | Cécile Paris: A survey of trust in social networks[END_REF]. Because of the sensitive and private information that is commonly stored in these networks, controlling access to this information is becoming very important and that depends largely on the level of trust that members have with each other. Several access control models for OSN based on trust have re-cently appeared [START_REF] Sherchan | Cécile Paris: A survey of trust in social networks[END_REF][START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF][START_REF] Pang | A new access control scheme for Facebook-style social networks[END_REF][START_REF] Voloch | An MST-based information flow model for security in Online Social Networks[END_REF], but none of them uses the attribute of gossiping as a significant factor in the access control model. Zhang et. al [START_REF] Hu | Guide to Attribute Based Access Control (ABAC) Definition and Considerations[END_REF] present an attribute-based access control (ABAC) model for OSN, but does not use either Trust nor Gossiping attributes. Since gossip is one of the oldest and most common means of information sharing among people, we consider it also very important for influencing access control.

This paper aims to demonstrate a new ABAC model called ABAC-TG, for an online social network, which combines privacy, trust, and a gossip model.

The general idea is to use the ABAC model with additional complex attributes such as user trust and gossip, calculated by clustering. The gossip attribute may be used as part of the trust calculation or as a separate attribute in an ABAC rule. The user selects attributes and defines rules for defining the access for a specific object. This model is extensible by adding additional dynamic attributes. The examples demonstrating the model use actions provided by a Facebook like network but are not limited to it. This new model has three significant advantages: First, the model calculation is dynamic -the trust is calculated based on user selection and network parameters, and the gossip is dependent on specific network interactions.

The second is flexibility and scalabilitywe can add or remove attributes and decide on threshold values for trust and gossip calculations. The third is simplicitythe user will choose simple attributes and define the access to his objects in terms of these attributes. Thus, our model provides a solution to one of the most significant social network problems, the control and prevention of the spread of sensitive private information in the network.

The rest of this paper is structured as follows: Section 2 provides background information and an overview of related work. Sections 3 and 4 describe the new ABAC model, where Section 3 describes the model, trust, and gossip attributes calculations, and Section 4 discusses the rules and attributes used in detail and presents several usecases of using the model. The last section presents the relevant conclusions and discusses future work.

Background and related work

As mentioned earlier, this paper's main goal is to propose a new ABAC model called ABAC-TG, which combines privacy, trust, and gossip attributes. In this section, the relevant background is provided.

An ABAC model relies upon evaluating attributes of the subject, attributes of the object, environment conditions, and the formal relationship or access control rule or policy defining the allowable operations for subject-object attribute combinations. All ABAC solutions contain these basic core capabilities to evaluate attributes and enforce rules or relationships between those attributes [START_REF] Hu | Guide to Attribute Based Access Control (ABAC) Definition and Considerations[END_REF]. Examples of such rules for a social network are presented in this paper in section 4.3.

The access control model in Facebook is based on roles. It does a reasonable job of access control while handling millions of operations/seconds from its billion users. The mechanism of Facebook is a function of communication history among users (for instance, the existence of friendship is necessary for certain policies), however even though it's a quite simple model, users often do not use it properly. An analysis of Facebook access control model and its privacy problems has recently appeared in [START_REF] Vishwas | Undoing of Policies on Facebook[END_REF][START_REF] Vishwas | Role of Apps in Undoing of Privacy Policies on Facebook[END_REF][START_REF] Pang | A new access control scheme for Facebook-style social networks[END_REF]. However, Facebook access control does not use trust or gossip and lacks reliance on users' specific attributes and objects for Access control.

Recently, a trust-based model for a social network called RTBAC was presented in [START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF]. The RTBAC model is a combination of User-Trust attributes, based on real OSN characteristics, within an RBAC model that usually grants permissions solely to roles.

The trust value is defined on a scale of 0 to 1 since the decision of sharing information with a certain user is defined as a probability variable, 0 being no sharing willingness at all, 1 being definite sharing willingness. The trust model is based on several criteria such as quality of Friendship, connection strength, and users' similarity. We will use this model in our new ABAC-TG model to calculate the trust value described in section 3.3. Another relevant work [START_REF] Voloch | An MST-based information flow model for security in Online Social Networks[END_REF] describes the way trust can be used to identify adversaries and limit information flow to them.

The fast spread of information is a common and essential feature of social networks. A simple model of diffusion shows how bounded rational individuals can, just by tracking gossip about people, identify those who are most central in a network according to "diffusion centrality." [START_REF] Banerjee | Jackson: Gossip: Identifying Central Individuals in a Social Network[END_REF][START_REF] Abhijit Banerjee | Jackoson: Using gossips to spread information: theory and evidence from two randomized controlled trial[END_REF]. Gossip can essentially be defined as information passed from one individual (originator) to another (gossiper) about an absent third individual [START_REF] Shaw | The effect of gossip on social networks[END_REF].

In [START_REF] Mishra | Clustering Social Networks[END_REF], an algorithm is given for provably finding the clusters, provided there is a sufficiently large gap between internal density and external sparsity. This clustering is used to build knots of trust between users in [START_REF] Gal-Oz | Identifying Knots of Trust in Virtual Communities[END_REF]. Knots of trust are groups of community members having overall "strong" trust relations between them. In order to provide a member with reputation information relative to her viewpoint, the system must identify the knot to which that member belongs and interpret its reputation data correctly. Such clustering can be used to identify and measure the amount of "gossipness" of users and groups of users since users tend to gossip with other users they trust on. We'll use this clustering to define a "gossipness" measure in our proposed ABAC model.

The most relevant article to this work is by Zhang et. al. [START_REF] Zhang | A novel attribute-based access control model or multimedia social netwroks[END_REF]. They present an ABAC model for social networks with many examples for rules involving various attributes. Our model is similar but more general than [START_REF] Zhang | A novel attribute-based access control model or multimedia social netwroks[END_REF] since it explicitly includes two important new attributes: Trust and Gossiping attributes. Our model is dynamic and extensible and can be used for any online social network.

3

A new ABAC model with trust and gossip for online social network

This section presents the main theme of this paper. The aim is to define a new ABAC model for online social networks (for instance, Facebook, Twitter, etc.) and to incorporate user trust calculation and gossip calculation in the ABAC model.

Establishment of ABAC-TG model for online social network

Today, Facebook, the world's most popular social network, uses the RBAC model to manage user roles on a specific object or action [START_REF] Vishwas | Undoing of Policies on Facebook[END_REF]. Our new ABAC-TG model will replace the RBAC model. The key difference with ABAC is the concept of policies that express a complex Boolean rule set that can evaluate many different attributes [START_REF] Hu | Guide to Attribute Based Access Control (ABAC) Definition and Considerations[END_REF].

In the ABAC-TG model, the user will choose attributes from a predefined list and define rules. For instance, the user doesn't want the specific objectA to be visible to users who are mostly gossiping; or the user doesn't want the particular objectA to be visible to teenagers or to users who have low trust value.

Relevant attributes may be: a number of friends, age, education, job title, work, family status, friends type (e.g., in comparing to ego user's age, education, work, city, etc.), action types (e.g., comment to friends with the same age, work, city), and attributes of the objects themselves. More attributes will be described in chapter 4.

Figure 1 demonstrates the access decision-making of the ABAC-TG model. For each object, the model checks if the object has roles restrictions, if yes, the model checks if the user has fitting attributes and grants access accordingly. GossipingAttthis attribute describes the gossiping level of the user. The value will be calculated using a network-directed graph containing the interactions (messages, likes, comments, shares, etc.) between the user to other users, applying the clustering algorithm, and deciding if the user is gossiping. The gossiping value is on a scale of 0 to 1, where 0 means a total gossiping user, and 1 means not gossiping at all. The gossiping algorithm is described in section 3.4.

TrustAttthis attribute describes the social trust level of the user. The value is calculated by the model presented in [START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF]. The trust calculation is described in section 3.3. Note that in [START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF] the main goal is to compute the user's trust, which is the base for access control, while in our model, trust is just one attribute among several attributes of the ABAC model. Besides, we can adjust the trust calculation by using the GossipingAtt attribute. In case that the user chooses TrustAtt and GossipAtt in the rules, we do not use them twice in the trust model calculation.

Therefore, our model is dynamic due to the dependency on the user selection in calculating trust and ABAC attributes that may change in time. This capability defines a new perspective on the trust model from [START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF] with the new GossipingAtt and user selection, which affects the trust calculation.

Dynamic ABAC-TG model

The decision algorithm of ABAC-TG is the same as the original ABAC model, by evaluating different attribute conditions and getting a Boolean value as a result for "allow access" or "deny access" (see figure1).

If the user chooses the TrustAtt and an attribute1 that is already part of the trust formula, we have two options: first is to adjust the trust formula and remove attribute1 in order not to use it twice. The second is not to change the trust formula and let the user influence the weight of the attributes. In this paper, we choose the first option by removing it from the trust formula and use it in the ABAC rules.

For example, if the user defines a rule of -"I want that only my trusted friends (0.8) and my non-gossiping friends (0.8) will be able to see my image1". In this case, we'll adjust the trust formula and remove the gossiping parameter and use it only once in the rule. As a result, the user affects the trust value as a dynamic trust value and changes the gossiping value's weight as a more effective attribute (due to the 50% of the rule and not just a small part in the trust value). This use case is demonstrated in section 4.3 on use case 3.

Trust Calculation

In our ABAC-TG model, we're using the trust attribute (denotes as TrustAtt) as yet another attribute. In order to calculate the TrustAtt value, we'll use the formula described in [START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF],

with an extension to include the new friendship characteristic of gossiping value. The original formula from [START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF] to compute the user trust value (denotes as UTV) is shown in Figure 2.

The different factors and their corresponding weights are explained in detail in [START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF]: taken into consideration user credibility factors (knowledge factors such as the total number of friends) denotes as u, and connection-based factors (friendship characteristics such as mutual friends) denotes as c. In order to add the gossiping value into the formula we just add another factor and its corresponding weight, such that the total sum of weights (denotes as w) is still 1.

The gossiping value will affect the trust value in the same manner of every friendship characteristic. The gossiping value calculation is described in section 3.4, and the value is the probability from a scale of 0 to 1, 0 mainly being gossiping, 1 being not gossiping at all.

The trust value is also expressed on a scale of 0 to 1, 0 being no sharing willingness at all, 1 being definite sharing willingness.

Gossiping Calculation

This section defines the algorithm for calculating the gossiping value for users in a social network. The gossiping attribute's goal is to identify a set of friends who would leak the shared information to an adversary. The gossiping value is the probability from a scale of 0 to 1, 0 being mostly gossiping, 1 being not gossiping at all.

The GossipAtt is calculated by taking into consideration connection-based factors: the number of human interactions between two users. The gossiping calculation is in the context of an Ego user perspective (the user sharing the information) to his friends and not general to the whole network. For example, from Alice's perspective, Bob's gossiping value is 0.8, but from David's perspective, it's 0.2, which leads to that Alice will share more information with Bob than David will share with Bob.

We assume, for this paper, that gossip serves to strengthen the relationship between gossipers and weakens the relationship between the victim and each gossiper [START_REF] Shaw | The effect of gossip on social networks[END_REF]. Therefore, the friends with which the Ego user has fewer interactions will have the potential to gossip about him. Thus, in our algorithm, we focus on gossiping friends and exclude the "Ego's best friends" from the graph. We define "best friends" as users who have more than R interactions with each other. For example, a relationship of 100 interactions and above is with a high probability of being a best friend.

In our model, we consider only two levels of ego user's friends and friends of friends, for three reasons: the first reason is to have a comprehensive perspective on user's interactions and an extensive network graph. The second reason is to enable the ego user to share his post object with a wide enough forum (but not to a huge subnetwork) and limit it to non-gossiping users. The third reason is to restrict the network size to a reasonable amount of nodes to achieve better running time.

To compute the gossiping value, we use graph clustering based on the logic described in [START_REF] Gal-Oz | Identifying Knots of Trust in Virtual Communities[END_REF][START_REF] Mishra | Clustering Social Networks[END_REF]. A knot [START_REF] Gal-Oz | Identifying Knots of Trust in Virtual Communities[END_REF] is a subset of community members identified as having overall strong interaction relations. Two members i and j should belong to the same knot if i has high direct interaction in j denoted I_M (i, j). Knots are groups of members with strong interactions, sharing the same gossiping value from the Ego user perspective. Ego is an individual focal node, which is the specific user from which we consider the gossiping flow. It is, therefore, plausible that the gossiping of the same user may differ significantly between different Ego users.

A community is modeled as a directed graph G = (V, E) that describes a social network, where V is the set of network's users, and E is the set of directed and weighted edges representing the users' interactions. The weight on a directed edge from vertex i to vertex j is the level of direct interactions i has in j at time t and is denoted by I_Mt(i, j). Since we deal with the state of the graph at time period t, we omit the time indicator for simplicity. An edge (ui ,uj) ∈ E exists only if ui has interactions with uj.

We refer to the task of identifying knots as graph clustering. In a social networking graph, these clusters could represent users with similar interactions. More specifically, we aim to find a partition of the community graph based on the direct interactions between pairs of members. For this purpose, we replace the interaction relations between any two members I_M(i, j) and I_M(j,i) with a weaker relation named Mutual Interactions in Member (MIM) which is the minimum of the above two values, that is, the two directed edges (i, j) and (j,i), are replaced by a single, undirected edge whose weight is MIM(i, j) = MIM(j,i) = min{IM(i, j),I M(j,i)}.

This way, we can use the edge relation as the input for the clustering algorithm, which must decide if its two end-vertices should reside in the same cluster or not. Intuitively, the new relation is more stringent because it considers the minimum level of mutual interactions between any two members as the representing value of gossiping between them.

Gossip Algorithms:

Algorithm 1. calculates the gossiping value for Ego user's friends. The algorithm returns a map of clusters and their gossip value.

Algorithm 1. CalcGossipGraph(G, ue)

Input: G = (V, E) an undirected graph that describes the social network of Ego's user, which vertices represent users and edges represent the interactions relations between the users at their end-point vertices ue the ego user. Output: M: a map of clusters and their gossip value. 1: R = 100 2: for each ego's direct friends ui do 3: if the MIM (ue, ui) >= R then 4:

Remove ui from graph G.

5:

Add ui to cluster "best friends" and set in the map M with gossipValue equal to 1. 6: end if 7: end for 8: Remove ue from graph G 9: Create clusters based on the graph G. 10: for each cluster C do 11:

set gossipValue = min {Sum of MIM in C / (number of vertices in C * r), 1}. 12: end for 13: Return M as map of clusters and gossipValues.

In Algorithm1, we defined Ego's best friends as friends which MIM bigger than 100 interactions, denotes as R, (a parameter which obviously can be changed), as gossip serves to strengthen the relationship between gossipers and weakens the relationship between the victim and each gossiper [START_REF] Shaw | The effect of gossip on social networks[END_REF].

Lines 1-8 remove the ego user and his best friends from the graph. Line 9 creates the clusters based on the algorithm described in [START_REF] Gal-Oz | Identifying Knots of Trust in Virtual Communities[END_REF]. Finally, line 11 sets the gossiping value of each user to the average MIM in the cluster, normalized by the factor R. An example for this calculation is shown below.

Algorithm 2. returns the gossiping value for a specific user from the Ego user perspective. This algorithm is calls algorithm 1 to calculate the gossiping clusters.

Algorithm 2. GetUserGossipValue(G, ue, ui)

Input: G = (V,E) an undirected graph that describes the social network of Ego's user, which vertices represent users and edges represent the interactions relations between the users at their end-point vertices ue the ego user. uithe user to evaluate the gossip value. Output: V: U ui 's gossiping value 1: M = CalcGossipGraph (G, ue). 2: Find ui in M. 3: V = ui 's clustering gossiping value. 4: Return V. Table 2 and figure 3 that appears below present an example of Algorithm 1, with ten users: friends and friends of friends of Alice. Based on their interactions, we calculate the gossiping value of each user from Alice's perspective. The edges represent the interactions with the value of MIM.

Users 1,2,3 have more than R interactions with ue and defined as "Ego's user best friends" with a gossiping value of 1 (see cluster "best friends" in figure).

Formalization and applications of the ABAC-TG model

This section describes ABAC-TG model's formalization by defining user's attributes, object's attributes, and rules. We also represent five main use cases for using this model in an online social network.

Definition and formal descriptions of ABAC-TG model components

We define a rule definition for our ABAC-TG model. Our syntax is based on article [START_REF] Zhang | A novel attribute-based access control model or multimedia social netwroks[END_REF], but it's simpler and focuses on trust value, gossiping value, and the dynamic model, which the user defines.

Definitions:

Definition 1. (User set, U): User represents the entity that performs social network's user accesses. In the social network, the set U contains all users. The users can upload and access media resources and perform various operations on other users and resources available in the system. The set AU includes user basic information attributes, user social relationships attributes, and user community attributes. The user basic information attributes include name, age, identity, hobbies, and user-level attributes (as described below in section 4.2). Definition 5. (Object attribute set, OU): The set OU includes object basic information attributes. The object's basic information attributes include attributes such as publish date time, location, object type, related objects (e.g., comment on an object has a related object of the original objectpost). Image object has corresponding objects of the users who appear in the image, check-in object has a location type attribute such as restaurant, work office, etc.). Definition 6. (Attribute expression set, AE): The set AE includes AU and OU expressions, separated by the and (∧) and or (∨) operations. The not sign is allowed by adding '!' before an expression. Definition 7. (Basic Rule set, BR): a rule definition in ABAC-TG model as < U, OB, AC, AE>. If the rule condition is true, the user can access the object. If the rule is false, the user cannot access the object. Definition 8. An ABAC-TG instance is a tuple of < U, OB, AC, AE>, which is a combination of user, object, actions, and attributes. Figure 4 describes the ABAC-TG model and the connections between the various components. In this section, we define the main attributes that will be used in our ABAC-TG model. These attributes are examples, and we can add any attribute that is relevant to online social networks.

Attributes definitions:

Definition 1. (TrustAtt): this attribute describes the user's social trust level, calculated as described in section 3.3. Definition 2. (GossipingAtt): this attribute describes the user's gossiping level, calculated as described in section 3.4. Definition 3. (AgeLevel): this attribute describes the user's age level (e.g. level1 is age 10-20, level2 is age 20-40, level3 is age 40-60, level4 is 60+). Definition 4. (Education): this attribute describes the education of the user, for example: "Bachelor of Science in Computer Science," "Bachelor of Laws in Law", etc. Definition 5. (Job title): this attribute describes the job title of the user, for example: "development manager", "software developer", "product owner", etc.). Definition 6. (Work): this attribute describes the workplace of the user, for example: "Microsoft", "Google", "Amazon", etc.

Use cases and examples

This section demonstrates the expressiveness and usability of the ABAC-TG model. We design several real-life scenarios and give their corresponding rules in our logic. We can define additional scenarios as needed as this model is dynamic and extensible.

Use case 1. The user defines a rule which includes trustAtt and few attributes that are not part of the trust formula.

Scenario 1. Alice, a student 26 years old, post her locations and events, but she is suspicious. Therefore, she wants to share with users that she trusts them and at the same age and same university. The rule for this scenario is as follows:

S1: <R = {Alice}, {obj1}, {display}, {(trustAtt > 0.7) ∧ (ageLevel =myAgeLevel) ∧ (education =myEducation)}>. Table 3 shows an example of two users with different social trust values, which leads to different access results in scenario1. Use case 2. The user defines a rule which includes gossipingAtt, and more attributes. Scenario 2. Bob, a political man in the United States that doesn't care who will see his posts in his country. He wants to get the most likes and comments; therefore, he shares his post with gossiping users. The rule for this scenario is as follows:

S2: <R = {Bob}, {obj2}, {display, comment, like}, {(gossipingAtt < 0.7) ∧ (friendTypeCountry = mycountry)} > Table 4 shows an example of two users with different gossiping values, which leads to different access results in scenario2. S3: <R = {Carlos}, {obj3}, {display}, {(gossipingLevel > 0.7) ∧ (trustLevel > 0.7) ^ (friendTypeWork = mywork)} > Table 5 shows an example of two users with different gossiping values and social trust value, which leads to different access results in scenario3. Use case 4. The user defines a rule which includes trustAtt and few attributes that are part of the trust formula. Scenario 4. David, a seller in the Facebook marketplace, would like to share his new items for selling with trusted users and popular users that will share his items. The rule for this scenario is as follows:

S4: <R = {David}, {obj4}, {display, like, comment, share}, {(TrustAtt > 0.7) ∧ (numOfFriends > 300)} > Table 6 shows an example of two users with different social trust values and a number of friend's values, which leads to different access results in scenario4. Use case 5. The user defines a rule which includes simple attributes Scenario 5. Erin, a teenager 22 old, looks for a girlfriend and wants all the girls in his city to see and like his post. The rule for this scenario is as follows: S5: <R = {Erin}, {obj5}, {display, like}, {(friendTypeCity = myCity) ∧ (FamilyStatus =Single) ∧ (ageLevel =myAgeLevel)} > Table 7 shows an example of two users with different city attribute values, which leads to different access results in scenario5.

Conclusions and future work

Conclusion

In this paper, we have presented a new Access-Control model for an online social network. Our ABAC-TG model's novelty is its combination of user-attributes that includes trust and gossiping values based on real online social characteristics.

The algorithm for computing the trust attribute is based on [START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF] but enables the addition and removal of attributes in its formulation based on what appears in the ABAC rules. We described a new algorithm for calculating the gossiping value uses graph clustering, and this value may be either included in the trust calculation or treated separately in the ABAC rule. This makes the model very flexible and adaptive. The attributes of this model were carefully picked, but there could be flexibility in these choices and their values that are debatable. This model can help to make important permission decisions and prevent unwanted information leakage from users, making online social network privacy better in many ways.

Our ABAC-TG model is dynamic and extensible and can be used for any social network that would like to enable users to choose who will see their data. We decided to demonstrate the new model by five different use cases on Facebook, as it's the world's most popular social network.

Future work

In future work, we intend to continue exploring in several directions. First, we plan to conduct an extensive evaluation experiment. We like to evaluate the new ABAC model with Trust and Gossiping on a Facebook DB, as it's the world's most popular social network. We plan to build a database that includes users, objects, and user actions and attributes. These items will be extracted from a real Facebook network of at least 100 users. We plan to do three experiments, in one we let the users define their own rules using our model and get their feedback on its usability. In the second, we'll set ourselves rules and threshold values and compare our model results with the user's perceptions and expectations. Third, we like to evaluate the new gossiping algorithms on the same Facebook DB.

Second, we like to define an anonymity mechanism for Facebook objects for protecting shared objects by using summarization, filtering, blurring, and other techniques. Recently, initial work on this was published in [START_REF] Voloch | A Role and Trust Access Control Model for Preserving Privacy and Image Anonymization in Social Networks[END_REF]. We plan to extend it in several ways and integrate it with the ABAC-TG model. For exampledefine a filtering model for sharing entities. The filter model will anonymize the data. For example, hide the username, hide the age and display range of ages, hide the gender, location, etc. This mechanism will be part of the ABAC attribute definition by the user. For instance, this action is relevant for the "sharing" action on Facebook. Today the user adds a post, and his friends can share it, and the original user doesn't know who will see his post. Therefore, we would like to protect the objects, so that the other users will not be able to see the full object, but only part of it (the anonymization result).

Fig. 1 .

 1 Fig. 1. Access decision in the ABAC-TG model

Fig. 2 .

 2 Fig.2. The formula from[START_REF] Voloch | An Access Control Model for Data Security in Online Social Networks Based on Role and User Credibility[END_REF] to calculate the trustAtt value. User Trust Value (UTV) is calculated as the weighted average of user credibility and connection strength. The weight is set according to the relative number of attributes in each category.For example, in table 1, we have two users: UserA and UserB, which are friends of Alice. Alice gave them different scores regarding what she thinks, based on her friendship experience. In this case, UserA and UserB have different gossiping values that affect the calculated trust value.

Users 4 ,

 4 5 has less than R MIM value, and they are sharing the same cluster1, with gossiping value of C1 = min {60/ (3 * 100), 1} = 0.2. Users 7,8,10 sharing the same cluster2 with gossiping value of C2 = min {245/ (6 * 100), 1} = 0.4. Users 9,6 sharing the same cluster3 with gossiping value of C3 = min {250/ (4 * 100), 1} = 0.62.

Definition 2 .

 2 (Object set, OB): a post entity. The entity includes many items such as images, texts, videos, comments, etc. Definition 3. (Actions set, AC): a post action. The actions include different activities such as display, share, post, like, comment, etc. Definition 4. (User attribute set, AU):

Fig. 4 .

 4 Fig. 4. ABAC-TG model components

Definition 7 .

 7 (Family status): this attribute describes the family status of the user, for example, single, married, divorced, etc. Definition 8. (Friends type): this attribute describes the "friends' type", for example: in comparison to a user's age, education, work, city etc. Definition 9. (Action types): this attribute describes the "Action types" of the user, for example, comments to friends with the same age, work, city, etc. Definition 10. (Gender): this attribute describes the gender of the user: female or male

Table 1 .

 1 An example of trust value including gossiping attribute

	Username	Knowledge	GossipingAtt Friendship	TrustAtt	Result
		Value (u)		Value (c)	(UTV)
	UserA	0.51	0.23	0.35	0.43	The trust value is
						lower with a gos-
						siping user
	UserB	0.77	0.98	0.92	0.845	The trust value is
						higher with non-
						gossiping user

Table 3 .

 3 An example of using scenario 1

	Username TrustAtt (in-	GossipingAtt	AgeLevelAtt	Education Result
		cluding gos-
		siping value)
	UserA	0.6	0.5	27	Harvard U Deny access
	UserB	0.8	0.8	28	Harvard U Allow access

Table 4 .

 4 An example of using scenario 2 Carlos, a COO of "FX" high-tech company, doesn't want to share his locations (check-in posts and event posts) with untrusted nor gossiping users but to share with employees who work with him. The rule for this scenario is as follows:

	Username	gossipingAtt	friendTypeCountry	Result
	UserA	0.5	USA	Allow access
	UserB	0.8	USA	Deny access
	Use case 3. The user defines a rule which includes trustAtt, gossipingAtt, and more
	attributes.
	Scenario 3.

Table 5 .

 5 An example of using scenario 3

	Username	TrustAtt (with-	gossipingAtt	friendTypeWork	Result
		out gossiping
		value)
	UserA	0.7	0.5	FX	Deny access
	UserB	0.9	0.8	FX	Allow access

Table 6 .

 6 An example of using scenario 4

	Username	TrustAtt (including gossiping value,	numOfFriends	Result
		without numOfFriends value)
	UserA	0.55	85	Deny access
	UserB	0.75	350	Allow access

Table 7 .

 7 An example of using scenario 5

	Username	City	Family status	AgeLevelAtt	Result
	UserA	Palo Alto	Single	28	Deny access
	UserB	San Francisco	Single	22	Allow access

Note that the gossiping value calculation may run once for each ego user and stored in cache memory. The recalculation of it, which reflects the model dynamics, may be a parameter that depends on the number of new interactions in the ego user subnetwork, which the network administrator can set.


D V N Siva Kumar
email: dvnsivakumar@gmail.com

P Santhi Thilagam

Preserving Privacy of Co-Occurring Keywords over Encrypted Data

Keywords: OPE, Frequency leakage, Index keywords' confidentiality

The indexes of ranked searchable encryption contain encrypted keywords and their encrypted relevance scores. The encryption scheme of relevance scores must preserve the plaintext order after encryption so as to enable the cloud server to determine ranks of the documents directly from the encrypted keywords' scores for a given trapdoor. Existing schemes such as Order Preserving Encryption (OPE) and One-to-Many OPE preserve the plaintext order. However, they leak the distribution information, i.e., the frequency of ciphertext values, due to the insufficient randomness employed in these schemes. The cloud server uses frequency analysis attack to infer plaintext keywords of the indexes based on the frequency leakage. In this paper, an Enhanced One-to-Many OPE scheme is proposed to minimize the frequency leakage. The proposed scheme reduces not only the frequency leakage of individual keywords but also the co-occurring keywords of the phrases like "computer network", and "communication network".

Introduction

In spite of numeric benefits with cloud computing services, privacy, and confidentiality are significant concerns for the data owners who store sensitive documents at the cloud servers. The stored documents are accessible to the snooping administrators, who could misuse the sensitive information for their own benefits. Therefore, storing documents in plaintext form at cloud servers poses a threat to the confidentiality of data owners' sensitive information. Although the encryption guarantees confidentiality, it makes the retrieval process more complicated. A cryptographic paradigm called Searchable Encryption (SE) facilitates searching over encrypted documents by uploading encrypted indexes, i.e., searchable indexes corresponding to the uploaded encrypted documents.

The information in searchable indexes includes unique keywords of the dataset and their corresponding keywords' relevance scores,e.g., Term Frequency (TF), and Term Frequency-Inverse Document Frequency (TF-IDF), which convey keywords' distribution information of the documents and the dataset, respectively. This information should not be direclty exposed to the cloud servers. Hence, these relevance scores must be encrypted alongside the index keywords. The relevance scores should be encrypted so that the cloud server could still perform rank-ordering of the documents directly from the keywords' encrypted relevance scores. The encryption scheme must maintain the plaintext order of relevance scores after their encryption to meet this requirement. Various encryption schemes exist such as Order Preservation Encryption (OPE) [START_REF] Boldyreva | Order-preserving symmetric encryption[END_REF], and One-to-Many OPE [START_REF] Wang | Enabling secure and efficient ranked keyword search over outsourced cloud data[END_REF]. However, they leak frequency information due to the insufficient randomness in mapping plaintext scores to encrypted values. The frequency information is leaked especially when two or more keywords contain the same plaintext score in the same document.

Various attacks such as correlation attack [START_REF] Bindschaedler | The tao of inference in privacy-protected databases[END_REF] and frequency analysis attack [START_REF] Naveed | Inference attacks on property-preserving encrypted databases[END_REF][START_REF] Cash | Leakage-abuse attacks against searchable encryption[END_REF] exploit frequency information from the encrypted scores to infer index keywords of the dataset. Hence, it is required to minimize or prevent the frequency information leakage in order to use it for encrypting sensitive information. There are many schemes like Paillier encryption for preventing frequency information leakage, but they do not preserve plaintext order due to which the cloud server cannot perform rank-ordering of the documents. As a result, only OPE schemes should be used but they should not leak frequency information. An Enhanced One-to-Many OPE scheme is proposed in this paper, which reduces the frequency leakage of individual keywords and also the co-occurring keywords of the dataset. The summary of our contributions are provided below.

-An Enhanced One-to-Many OPE scheme is proposed to return a ciphertext value for a given plaintext relevance score. -A thorough analysis of the proposed approach and its demonstration that it is safer in frequency leakage than the conventional OPE and One-to-Many OPE schemes.

The rest of the paper is presented as follows: The preliminary details are presented in Section 2. Section 3 presents the related work, followed by the proposed approach in Section 4, results and discussion in Section 5, and the conclusion in Section 6.

Preliminaries

(a) Term Frequency (TF): The TF value of a keyword captures its relevance in the corresponding document. Another measure, TF-IDF, could also be used, but TF is more suitable for demonstrating the frequency leakage. The normalized TF value a of keyword kw of a document d i can be measured using the below equation.

T F (kw, d i ) = 1 |d i | (1 + log(tf i )) (1)
where, |d i | denotes the length of the document, i.e., the total number of unique keywords of the document d i and tf i denotes the number of a keyword kw occurs in document d i .

(b) Frequency Analysis Attack: This attack aims to deduce the plaintext index keyword from the encrypted TF values of the encrypted index [START_REF] Naveed | Inference attacks on property-preserving encrypted databases[END_REF][START_REF] Kumar | Searchable encryption approaches: attacks and challenges[END_REF]. It is based on the premise that the distribution details of plaintext TF values and the corresponding encrypted TF values will be the same for some specific keywords. The cloud server infers frequently occurring keywords of the dataset from the encrypted index by relating the frequency of the same encrypted TF values to the frequency of plaintext TF values of frequently occurring keywords of the publicly available datasets. Sometimes, index keywords also are guessed by observing the frequency information of some encrypted TF values. This attack is more likely to succeed With the help of background knowledge of the dataset, which could be about what data the data owners stored at the cloud server, and what probable keywords that are most likely to occur. For example, assume that the data owners store Request for Comments [START_REF]RFC: Request for comments database[END_REF] dataset in encrypted form at the cloud server. This dataset is all about how information can be transmitted from one host to another over the internet using different "computer network" protocols. It can be assumed that some of the specific keywords like "computer", "network" and "communication" may appear in most of the documents of this dataset. The cloud server then infers one or all of these specific keywords by generating frequency histograms (i.e., showing distribution information) for all encrypted TF values of each encrypted index keyword. The cloud server then examines the histograms and distinguishes those of a much higher frequency (i.e., same encrypted TF values) than the others. The corresponding encrypted keywords of those histograms are noted. The encrypted keywords of histograms may be related to one or all of those specific keywords of the dataset. The cloud server thus infers plaintext index keywords by observing the frequency information of encrypted TF values.

(c) Coordinate Matching: It is a similarity metric that uses the inclusion of query keywords in the document to assess the document's relevance score [START_REF] Witten | Managing Gigabytes: Compressing and Indexing Documents and Images[END_REF]. The score of a document for a trapdoor can be determined by adding the encrypted TF values of each trapdoor's keywords in that document.

Related Work

Order Preserving Encryption (OPE) [START_REF] Boldyreva | Order-preserving symmetric encryption[END_REF] and Order Revealing Encryption (ORE) [START_REF] Chenette | Practical order-revealing encryption with limited leakage[END_REF][START_REF] Liu | Encodeore: Reducing leakage and preserving practicality in order-revealing encryption[END_REF] support ranked search as they preserve plaintext order after encryption. The problem with ORE schemes is the output of these schemes is not numerical, due to which an additional public function is required that will let the cloud server know the order of the given ciphertexts. Swaminathan et al. [START_REF] Swaminathan | Confidentiality-preserving rank-ordered search[END_REF] proposed an OPE scheme based approach, but it leaks frequency information, i.e., returns the same ciphertext value for the same plaintext value. Wang et al. [START_REF] Wang | Enabling secure and efficient ranked keyword search over outsourced cloud data[END_REF] proposed using the One-to-Many OPE scheme, an extension of the OPE scheme, but leaks frequency information when two or more keywords contain the same TF values in the same document's index. Kerschbaum proposed a frequency hiding OPE scheme [START_REF] Kerschbaum | Frequency-hiding order-preserving encryption[END_REF] to conceal the frequency information. However, this approach still leaks frequency information in the form of the tree's linear depth, where each new ciphertext value is stored in a new node for the same plaintext value. This depth precisely reflects the frequency of plaintext scores. Several works like Grubbs et al. [START_REF] Grubbs | Leakageabuse attacks against order-revealing encryption[END_REF] and Maffei et al. [START_REF] Maffei | On the security of frequency-hiding orderpreserving encryption[END_REF] demonstrated the inference of plaintext information from the encrypted values of frequency-hiding OPE scheme.

Orencik et al. [START_REF] Orencik | A practical and secure multi-keyword search method over encrypted cloud data[END_REF] proposed a multi-keyword ranked SE scheme using TF-IDF and Forward indexing techniques. They used the Paillier Encryption (PE) scheme to encrypt TF-IDF values. A fully homomorphic Encryption (FHE) and a partially homomorphic encryption (PHE) [START_REF] Ristic | Secure fast covariance intersection using partially homomorphic and order revealing encryption schemes[END_REF] also can be used in ranked search approaches and for encrypting TF-IDF values. The PE, FHE and PHE prevent the frequency leakage, but they do not preserve the plaintext order after the encryption. Roche et al. [START_REF] Roche | Pope: Partial order preserving encoding[END_REF] proposed a partial order preserving encryption (POPE) approach for encrypting keywords' relevance scores. However, all the ciphertext values in this approach do not preserve the plaintext order, and it is maintained only for some relevance scores. Hence, this approach is also not completely suitable for ranked search approaches.

Proposed Approach

Objectives

It is aimed to meet the following two objectives:

1. Relevance Score Encryption Scheme: A novel approach is designed based on the existing OPE schemes to minimize frequency leakage. 2. Efficiency: The proposed approach should encrypt the keyword's relevance scores efficiently as the existing approaches.

Proposed Methodology

It consists of the Initialization Phase and the Retrieval Phase.

Initialization Phase: It includes the following activities to be done by data owner, who owns the dataset:

1. Build the Encrypted Index: The steps required to generate the encrypted index I for all the documents of dataset D is explained as follows:

(a) Building Dictionary, W : Construct the dictionary W by extracting all the unique keywords kw from the input file dataset D. (b) Building Plaintext Index I: For each keyword kw in W , determine its T F value (1) for each document D i if it is present in D i and store it as

I[kw]= [D i ][T F ]. Otherwise, set its T F value to 0, i.e., I[kw]= [D i ][0]. (c) Generate Encrypted Index, I:
The generated index I is encrypted as follows:

-Each keyword in I is hashed by using a one-way secure hash algorithm SHA-2 with a 256-bit key.

-The T F value of each keyword kw of every document D i is encrypted using the proposed Enhanced One-to-Many OPE scheme, which is explained in Section 4.3. -The document Ids are not necessary to encrypt as they do not convey any information. The encrypted index generated would then be:

I = [ T F ][D i ]. 2.
Encrypting Documents: After generating the encrypted index, the data owner also encrypts his/her documents D using AES algorithm with 128 bit key size.

Retrieval Phase: It includes the following activities to be done by a data user, who will be allowed by the data owner to retrieve documents of his/her interest.

1. Query Masking: The masked query M Q kw is generated by hashing each keyword of his/her query Q kw using a secure SHA-256 hash function. Then, the data user sends the masked query and the parameter k to the cloud server to retrieve only the relevant top-k documents.

Searching:

(a) The cloud server then utilizes the encrypted index I and adopt the coordinate matching similarity measure [START_REF] Witten | Managing Gigabytes: Compressing and Indexing Documents and Images[END_REF] to assign the scores to each document D id . Then it sorts the scores of the documents in descending order and sends the top-k of them to the user. (b) The data user then uses the corresponding secret key shared by the data owner to decrypt the retrieved documents. The proposed Enhanced One-to-Many OPE scheme returns a possible unique ciphertext value c for each keyword kw's TF value, i.e., a plaintext relevance score pscore by mapping it to one of the output range of values. The mapping procedure is explained in Algorithm 1. It takes Key (K), input domain (D), output range (R), pscore, document identity id(doc), and keyword (kw) and returns a possible unique ciphertext value c. During mapping, the range R is divided into some non-overlapping interval buckets each with different size. Each bucket contains some range of values. For the given pscore, the random-sized bucket is determined using a Binary Search(.) procedure, which is explained in Algorithm 2. Binary Search(.) is a recursive procedure, which returns a new domain and a new range of values for a given pscore based on an HYGEINV(.) function. HYGEINV(.) is a hypergeometric sampling process that returns an integer value based on the initial domain, range, and middle value. This integer helps Binary Search(.) in choosing a new domain, and a new range of values for the given pscore. In each iteration of binary search, the size of domain D and range R will be reduced by an integer value. Binary Search(.) stops when the size of the domain becomes 1 where it contains only the given pscore. The pscore then will be mapped to one of the values in a new range R using a TapeGen(.) function, which is a random coin generator, which generates the seed value. This seed value helps in choosing one of the values in the new range as the ciphertext value c for the given pscore.

Algorithm 2: Binary Search

Input: K, D, R, pscore Output: D,R 1 M ← length(D); N ← length(R) 2 d ← min(D) -1; r ← min(R) -1 3 y ← r+ceil( N 2 ) 4 coin R ← -TapeGen(K,(D,R,0||y))

Results & Discussion

The proposed approach has been implemented using Python 3.6 version and tested on Intel i7-4770 CPU system. The experiments are conducted on a Requests for Comments (RFC) [START_REF]RFC: Request for comments database[END_REF] dataset. The effectiveness of the proposed approach is compared in terms frequency leakage with the OPE and One-to-Many OPE schemes for different keywords and phrases of the dataset.

Frequency Analysis Attack

The proposed Enhanced One-to-Many OPE scheme is an extension of One-to-Many OPE [START_REF] Wang | Enabling secure and efficient ranked keyword search over outsourced cloud data[END_REF], which in turn is an extension of OPE [START_REF] Boldyreva | Order-preserving symmetric encryption[END_REF]. In our experiments, the input domain is the actual plaintext relevance scores, and the output range is set between 0 and 2 45 -1. In OPE, the plaintext score pscore, .i.e., the T F value of the keyword is mapped to a ciphertext, which is a value within the new range, R (also can be treated as a bucket), which is determined by using the binary search algorithm 2. The selection of ciphertext value within the bucket values for the given pscore is based on the seed value generated by the TapeGen(.). In OPE, this seed value is entirely dependent on the plaintext score pscore due to which the same pscore is mapped to the same ciphertext value. For the given dataset, if the plaintext score is repeated n number of times, then there will be a ciphertext c that will also be repeated n number of times. Thus, frequency information is leaked from OPE encrypted values.

From the RFC dataset, it is found that the keywords "computer", "network", and "communication" are the frequently occurring keywords. The plaintext distribution information of these three keywords is respectively shown in figures

(c). The values on the x-axis represent the actual plain-

text TF values and values on y-axis represent the frequency, i.e., the number of points having the same TF value. As the OPE maps the same plaintext score to the same ciphertext, the distribution of ciphertext values of these keywords would be the same. To infer the plaintext keyword, the cloud server plots the graphs for each encrypted keyword's relevance scores in index. Then, it will note down the encrypted or masked keyword of the index for which the frequency (the repetition of the same encrypted score) is higher than the frequency of scores of other encrypted keywords. This encrypted keyword is more likely to be the frequently occurring keyword, e.g., "computer". Thus, frequency leakage from OPE scores allows the cloud server to deduce plaintext keyword.

In One-to-Many OPE scheme [START_REF] Wang | Enabling secure and efficient ranked keyword search over outsourced cloud data[END_REF], for the given plaintext score pscore, it uses both the pscore, and document identity id(doc) for generating a different seed for the same pscore. Due to this seed, it maps the same plaintext to different ciphertext value within the values of the bucket. There is a scope for frequency leakage with this scheme when two or more keywords have the same score in the same document. This is possible especially when some keywords equally cooccur in the same document, e.g., the keywords of the phrases like {"computer", "network"} or {"communication", "network"}. The cloud server first plots the histogram for each phrase and then identifies the histogram of the phrase in which the frequency of relevance score is higher than the frequency of other possible phrases. The cloud server notes the histogram of this phrase, and the encrypted keywords of this histogram are more likely to be the most co-occurring keywords of the phrases. Thus, the cloud server could infer the phrases' plaintext keywords from the One-to-Many OPE encrypted scores.

The proposed Enhanced One-to-Many OPE scheme, explained in Section 4.3, minimizes the frequency leakage of the phrases caused by the One-to-Many-OPE scheme. This approach also uses the same algorithm 2 (Binary search) to select the bucket, but the TapeGen(.) here uses pscore, document identity, id(doc) and keyword kw for generating a different seed value for the same plaintext score pscore. Due to this seed, the same pscore of co-occurring keywords will be mapped to different values within the values of the bucket. Thus, it minimizes the frequency leakage of co-occurring keywords of the phrases. This minimization is due to the improvement of the randomness in generating the seed value. Due to this seed, this approach reduces not only the frequency leakage of phrases but also the individual keyword's. To demonstrate the reduction of frequency leakage for an individual keyword, we compare the frequency leakage of One-to-Many OPE encrypted scores, and the proposed Enhanced One-to-Many OPE encrypted scores for the keyword "computer". The distribution information (frequency) of One-to-Many encrypted scores and the proposed Enhanced One-to-many encrypted scores for the keyword "computer" is shown in Fig. 2.(a) and 2.(b) respectively. The values on x-axis represent the normalized encrypted scores using the min-max normalization approach [START_REF] Margae | Traffic sign recognition based on multi-block lbp features using svm with normalization[END_REF]. The values of the y-axis represent information about the frequency, i.e., the number of points having the same encrypted TF value. Figure 2.(b) demonstrates that the frequency leakage for some encrypted scores of the keyword "computer" using the proposed Enhanced One-to-Many OPE scheme is lower than the frequency leakage of Oneto-Many OPE scores, shown in Fig. 2.(a). As it is already mentioned, the proposed scheme also minimizes the frequency leakage of phrases due to the usage of plaintext score pscore, document identity id(doc) and keyword kw for generating a different seed value. Due to this seed, different value within the bucket will be chosen as the ciphertext value for the same plaintext relevance score In RFC dataset, "computer network" and "communication network" are the most occurring phrases. The proposed Enhanced One-to-Many OPE scheme's frequency leakage is compared with the One-to-Many-OPE scheme to demonstrate the reduction of frequency leakage for the phrases. The distribution information of One-to-Many-OPE encrypted scores and the proposed Enhanced One-to-Many-OPE encrypted scores for the phrase "computer network" is shown in figures Fig. 3 and4, respectively. It can be observed from Fig. 4 that the frequency leakage of the proposed approach is much lesser than the frequency leakage of the One-to-Many OPE scheme, shown in Fig. 3. Similarly, Fig. 5 and 6 respectively show the distribution information for the phrase "communication network". Fig. 6 shows that the frequency leakage of the proposed approach is much lesser than the frequency leakage of the One-to-Many OPE scheme, shown in Fig. 5. Thus, the proposed approach makes it difficult for the cloud server to infer plaintext keywords of the phrases from the Enhanced One-to-Many OPE scores.

Conclusion

In this paper, an Enhanced One-to-Many OPE scheme is proposed that maps the same plaintext relevance score to a different ciphertext value even when multiple keywords have the same plaintext score within the same document. The proposed scheme may prevent complete frequency leakage if it is used for encrypting information that is moderately distributed. Our future work would be to extend the proposed scheme to minimize the frequency leakage further with the help of constrained random numbers as the seed value in mapping process.

4. 3

 3 Enhanced One-to-Many OPE Algorithm 1: Enhanced One-to-Many OPE Input: K (Key), D (domain), R (range), pscore, id(doc), kw Output: Cipher text c 1 while |D|! = 1 do 2 {D, R} = Binary Search(K, D, R, pscore) 3 coin ← TapeGen(K,(D,R,1||pscore, id(doc), kw) 4 c coin ⇐ == = R return c

7 D 8 Relse 10 D 11 R

 781011 d + HYGEINV(coin,M ,N ,y -r) 6 if pscore ≤ x then ← {d + 1, ...., x} ← {r + 1, ...., y} 9 ← {x + 1, ...., d + M } ← {y + 1, ...., r + N } 12 return D,R

Fig. 1 .

 1 (a), 1.(b) and 1.

Fig. 1 :

 1 Fig. 1: Plaintext keyword relevance score distribution for keywords: (a) computer (b) network (c) communication

Fig. 2 :

 2 Fig. 2: Encrypted score distribution for "computer": (a)One-to-Many OPE (b)Enhanced One-to-Many OPE

Fig. 3 :Fig. 4 :

 34 Fig. 3: One-to-Many OPE scores distribution for "Computer Network"

Fig. 5 :5. 2 EfficiencyFig. 6 :Fig. 7 :

 5267 Fig. 5: One-to-Many OPE scores distribution for "communication network"