Unsupervised panoptic segmentation aims to partition an image into semantically meaningful regions and distinct object instances without training on manually annotated data. In contrast to prior work on unsupervised panoptic scene understanding, we eliminate the need for object-centric training data, enabling the unsupervised understanding of complex scenes. To that end, we present the first unsupervised panoptic method that directly trains on scene-centric imagery. In particular, we propose an approach to obtain high-resolution panoptic pseudo labels on complex scene-centric data, combining visual representations, depth, and motion cues. Utilizing both pseudo-label training and a panoptic self-training strategy yields a novel approach that accurately predicts panoptic segmentation of complex scenes without requiring any human annotations. Our approach significantly improves panoptic quality, e.g., surpassing the recent state of the art in unsupervised panoptic segmentation on Cityscapes by 9.4 % points in PQ.

Semantic scene completion (SSC) aims to infer both the 3D geometry and semantics of a scene from single images. In contrast to prior work on SSC that heavily relies on expensive ground-truth annotations, we approach SSC in an unsupervised setting. Our novel method, SceneDINO, adapts techniques from self-supervised representation learning and 2D unsupervised scene understanding to SSC. Our training exclusively utilizes multi-view consistency self-supervision without any form of semantic or geometric ground truth. Given a single input image, SceneDINO infers the 3D geometry and expressive 3D DINO features in a feed-forward manner. Through a novel 3D feature distillation approach, we obtain unsupervised 3D semantics. In both 3D and 2D unsupervised scene understanding, SceneDINO reaches state-of-the-art segmentation accuracy. Linear probing our 3D features matches the segmentation accuracy of a current supervised SSC approach. Additionally, we showcase the domain generalization and multi-view consistency of SceneDINO, taking the first steps towards a strong foundation for single image 3D scene understanding.

In industrial environments, cyber threats are escalating at an unprecedented rate, yet many existing security solutions fail to account for both contextual factors and the criticality of different network segments. This challenge is especially pronounced in diverse, large-scale, and highly dynamic Industrial Internet of Things (IIoT) environments. This paper presents a dynamic Zero Trust Access Control (ZTA) model that adapts to real-time device status, network conditions, and user behavior to enforce context-aware, security-driven access decisions. At its core, our framework combines mathematical threat assessment with fuzzy logic-based state management (FSM) to continuously adjust trust levels and access permissions. We validated our approach, through a proof-of-concept using a cluster of virtual machines (VMs) to simulate a controlled environment. This setup demonstrates the ZTA models effectiveness in small-scale networks and provides a foundation for testing various access scenarios and evaluating security policies.

Cloud computing infrastructures availability rely on many components, like software, hardware, cloud man- agement system (CMS), security, environmental, and human operation, etc. If something goes wrong the root cause analysis (RCA) is often complex. This paper explores the integration of Machine Learning (ML) with Fault Tree Analysis (FTA) to enhance explainable failure detection in cloud computing systems. We introduce a framework employing ML for FT selection and generation, and for predicting Basic Events (BEs) to enhance the explainability of failure analysis. Our experimental validation focuses on predicting BEs and using these predictions to calculate the Top Event (TE) probability. The results demonstrate improved diagnostic accuracy and reliability, highlighting the potential of combining ML predictions with traditional FTA to identify root causes of failures in cloud computing environments and make the failure diagnostic more explainable.

While AI's accuracy is impressive, it often operates opaquely, leaving users puzzled by its decisions. Explainable AI (XAI) seeks to demystify these processes, yet it encounters usability hurdles, often favouring developers over end-users. This paper introduces EXPERT-DUO, a flexible framework for Explainable Object Classification. While demonstrated in the domain of surgical tool classification, EXPERT-DUO is a versatile system applicable across domains. Operating as an assistant system for the users, the framework accommodates varying levels of domain knowledge and provides understandable decisions through a hierarchical methodology. The framework pipeline starts by segmenting the object parts, recognizing and classifying the object parts that make up the main object, progresses to attribute classification, and culminates in the classification of the complete object using an expert decision tree that encodes the domain knowledge. EXPERT-DUO aims to assist users by offering transparent and understandable reasoning for the object classifications. This unique approach enables users to make rational and informed judgments regarding their trust in the model's decisions. Experimental results within the surgical context demonstrate the effectiveness of the approach. These results underscore EXPERT-DUO's potential to enhance user confidence in AI systems across a spectrum of domains, thereby facilitating more widespread adoption and utilization of AI technologies.

Generative image models pose challenges to image authenticity and trustworthiness, blurring the line between real and fake content. This paper addresses these concerns by proposing a histogram-based approach using pre-trained models (vgg16, ResNet50, Xception) to train classification networks for distinguishing real from generated images. Leveraging histograms derived from images, the method aims to accurately classify images as authentic or synthetic. Through experiments, the paper examines the effectiveness of the approach in mitigating the risks associated with fake contents widespread dissemination. Results demonstrate promising advancements in detecting image manipulation and preserving the integrity of visual information amidst the spread of generative models. Using pre-trained models the paper shows high classification accuracy for detecting fake images.

Time series Classification is a vital task across various domains such as finance, healthcare, and environmental science. Recurrent Neural Networks in combination with Convolutional Neural Networks have emerged as powerful tools for Time series classification due to their ability to capture temporal dependencies. Long Short-Term Memory and Gated Recurrent Unit networks, along with their bidirectional variants have been widely employed for Time series tasks, but a comparison of these architectures under different hyperparameter configurations has not yet been analysed in detail. This paper fills the gap and provides a comprehensive comparison of these four architectures. We conduct experiments on two datasets representing a healthcare and industrial domain to evaluate there performance in terms of Classification accuracy, training time, and model complexity. The results of our experiments provide insights into the strengths and weaknesses of each architecture, aiding practitioners in selecting the most suitable model for their specific tasks. The superiority of the GRU architecture was demonstrated both in terms of learning speed and accuracy.

JPEG remains one of the most widespread lossy image coding methods. However, the non-differentiable nature of JPEG restricts the application in deep learning pipelines. Several differentiable approximations of JPEG have recently been proposed to address this issue. This paper conducts a comprehensive review of existing diff. JPEG approaches and identifies critical details that have been missed by previous methods. To this end, we propose a novel diff. JPEG approach, overcoming previous limitations. Our approach is differentiable w.r.t. the input image, the JPEG quality, the quantization tables, and the color conversion parameters. We evaluate the forward and backward performance of our diff. JPEG approach against existing methods. Additionally, extensive ablations are performed to evaluate crucial design choices. Our proposed diff. JPEG resembles the (non-diff.) reference implementation best, significantly surpassing the recent-best diff. approach by 3.47dB (PSNR) on average. For strong compression rates, we can even improve PSNR by 9.51dB. Strong adversarial attack results are yielded by our diff. JPEG, demonstrating the effective gradient approximation. Our code is available at https://github.com/necla-ml/Diff-JPEG.

Laparoscopic surgery is a surgical technique in which special instruments are inserted through small incision holes inside the body. For some time, efforts have been made to improve surgical pre-training through practical exercises on abstracted and reduced models. The authors strive for a portable, easy to use and cost-effective Virtual Reality-based (VR) laparoscopic pre-training platform and therefore address the question of how such a system has to be designed to achieve the quality of today's gold standard using real tissue specimens. Current VR controllers are limited regarding haptic feedback. Since haptic feedback is necessary or at least beneficial for laparoscopic surgery training, the platform to be developed consists of a newly designed prototype laparoscopic VR controller with haptic feedback, a commercially available head-mounted display, a VR environment for simulating a laparoscopic surgery, and a training concept. To take full advantage of benefits such as repeatability and cost-effectiveness of VR-based training, the system shall not require a tissue sample for haptic feedback. It is currently calculated and visually displayed to the user in the VR environment. On the prototype controller, a first axis was provided with perceptible feedback for test purposes. Two of the prototype VR controllers can be combined to simulate a typical both-handed use case, e.g., laparoscopic suturing. A Unity-based VR prototype allows the execution of simple standard pre-trainings. The first prototype enables full operation of a virtual laparoscopic instrument in VR. In addition, the simulation can compute simple interaction forces. Major challenges lie in a realistic real-time tissue simulation and calculation of forces for the haptic feedback. Mechanical weaknesses were identified in the first hardware prototype, which will be improved in subsequent versions. All degrees of freedom of the controller are to be provided with haptic feedback. To make forces tangible in the simulation, characteristic values need to be determined using real tissue samples. The system has yet to be validated by cross-comparing real and VR haptics with surgeons.

On the way to the smart factory, the manufacturing companies investigate the potential of Machine Learning approaches like visual quality inspection, process optimisation, maintenance prediction and more. In order to be able to assess the influence of Machine Learning based systems on business-relevant key figures, many companies go down the path of test before invest. This paper describes a novel and inexpensive distributed Data Acquisition System, ARTHUR (dAta collectoR sysTem witH distribUted sensoRs), to enable the collection of data for AI-based projects for research, education and the industry. ARTHUR is arbitrarily expandable and has so far been used in the field of data acquisition on machine tools. Typical measured values are Acoustic Emission values, force plate X-Y-Z force values, simple SPS signals, OPC-UA machine parameters, etc. which were recorded by a wide variety of sensors. The ARTHUR system consists of a master node, multiple measurement worker nodes, a local streaming system and a gateway that stores the data to the cloud. The authors describe the hardware and software of this system and discuss its advantages and disadvantages.

Explainable Artificial Intelligence (XAI) seeks to enhance transparency and trust in AI systems. Evaluating the quality of XAI explanation methods remains challenging due to limitations in existing metrics. To address these issues, we propose a novel metric called Explanation Significance Assessment (ESA) and its extension, the Weighted Explanation Significance Assessment (WESA). These metrics offer a comprehensive evaluation of XAI explanations, considering spatial precision, focus overlap, and relevance accuracy. In this paper, we demonstrate the applicability of ESA and WESA on medical data. These metrics quantify the understandability and reliability of XAI explanations, assisting practitioners in interpreting AI-based decisions and promoting informed choices in critical domains like healthcare. Moreover, ESA and WESA can play a crucial role in AI certification, ensuring both accuracy and explainability. By evaluating the performance of XAI methods and underlying AI models, these metrics contribute to trustworthy AI systems. Incorporating ESA and WESA in AI certification efforts advances the field of XAI and bridges the gap between accuracy and interpretability. In summary, ESA and WESA provide comprehensive metrics to evaluate XAI explanations, benefiting research, critical domains, and AI certification, thereby enabling trustworthy and interpretable AI systems.

As industrial networks continue to expand and connect more devices and users, they face growing security challenges such as unauthorized access and data breaches. This paper delves into the crucial role of security and trust in industrial networks and how trust management systems (TMS) can mitigate malicious access to these networks.The TMS presented in this paper leverages distributed ledger technology (blockchain) to evaluate the trustworthiness of blockchain nodes, including devices and users, and make access decisions accordingly. While this approach is applicable to blockchain, it can also be extended to other areas. This approach can help prevent malicious actors from penetrating industrial networks and causing harm. The paper also presents the results of a simulation to demonstrate the behavior of the TMS and provide insights into its effectiveness.

Hyperparameter tuning is an important aspect in machine-learning especially for deep generative models.Tuning models to stabilize training and to get the best accuracy can be a time consuming and protracted process.Generative models have a large search space requiring resources and knowledge to find the best parameters.Therefore, in most cases the search space is reduced and parameters are limited to a selected few to save time and computation time.This paper explores three different strategies to predict high impact hyperparameters for Pix2Pix.The achieved results show, that binary classification and regression achieve good results and reliably predict good hyperparameter combinations.

Data processed in context is more meaningful, easier to understand and has higher information content, hence it derives its semantic meaning from the surrounding context. Even in the field of acoustic signal processing. In this work, a Deep Learning based approach using Ensemble Neural Networks to integrate context into a learning system is presented. For this purpose, different use cases are considered and the method is demonstrated using acoustic signal processing of machine sound data for valves, pumps and slide rails. Mel-spectrograms are used to train convolutional neural networks in order to analyse acoustic data using image processing techniques.

Decentralized Attribute-based Encryption (DABE) is an extension of public key cryptography that allows the ciphertext to be decrypted by any node that has a predefined set of attributes. DABE can be used to control access to Internet of Things (IoT) devices and data based on attributes such as the type of device, the location, and the role of the user. Due to its heavy computation requirements, the DABE either can not be implemented on the weak devices or will be implemented with significant delay.In this paper, we study two distributed solutions of lightweight encryption in DABE using secret sharing and outsourcing. The analysis of our results showed that both approaches provided a lightweight encryption property of DABE. The secret sharing outperformed the outsourcing in small number of attributes, and both provided close efficient results in case of high number of attributes.

Image augmentation has become an important part of the data preprocessing pipeline, helping to acquire more samples by altering existing samples by cutting, shifting, etc.. For some domains, augmenting existing images is not sufficient, due to missing samples in the domains (e.g., faulty work pieces or events that occur infrequently). In such a case, new samples must be generated, since images with surface quality defects are often rare occurrence in metalworking and the amount of samples even with standard augmentation techniques does not meet requirements to train a Convolutional Neural Network (CNN) for fault detection. This paper utilizes Pix2Pix for image augmentation to generate new images with surface quality defects. The approach allows specifying the kind of defect, location, and size and transforms images by adding new defects. Furthermore, metrics to evaluate the augmented images are discussed and a recommendation of the best performing metric within the domain of metalworking is given.

Abstract To achieve a fully connected network in Internet of Things (IoT) there are number of challenges that have to be overcome. Among those, a big challenge is how to keep all of the devices accessible everywhere and every time. In the IoT network, the assumption is that each IoT device can be reached by any client at any given time. In practice, this is not always possible and without a proper mechanism the nodes behind a NAT are unable to communicate with each other directly, and their addresses have to be shared through a trusted third party. This challenge becomes harder by taking into consideration that most NAT traversal approaches have been developed prior to rising of the IoT, without taking into account the constrained nature of the participating devices and mostly depend on a centralized entity. In this paper we proposed the Distributed Address Table (DAT), a decentralized, secure and lightweight address distribution model that allows any two nodes to get the addresses of the other end without relying on a trusted third party. Structured Peer-to-Peer (P2P) overlay by utilizing Distributed Hash Table (DHT) technique is generated as its underlying communication scheme to ensure that all participating devices are accessible at any given time. This is achieved through simple, yet secure and efficient decentralized model. The DAT adopts the edge/fog computing paradigms to ensure a decentralized address distribution. The results showed that the proposed model is efficient. In addition, the security properties of the proposed model have been defined and proved.

Currently, the need for more efficient use of energy is in the spotlight more than ever. For optimal energy management the forecast of energy consumption is of great interest.This paper takes a novel approach for forecasting the energy demand in households by using a hybrid AI approach. On the one hand, we use an interpretable model creation by using fuzzy rules. Those rules are then combined with an evolutionary strategy to create new simulation data which calibrates the reality and sometimes uncertainty behind the data. Based on this newly created data, a simple artificial neural network (ANN) model is created. It is shown, that there is no need to create an unnecessarily complex deep learning architecture for achieving good results. Simple ANN models can achieve excellent results, when using data created by inferred fuzzy rules. Of great advantage is, that one part of this hybrid AI approach can still be interpreted by humans and furthermore improved by adding the knowledge of human domain experts in form of fuzzy rules.

Detecting and segmenting object instances is a common task in biomedical applications. Examples range from detecting lesions on functional magnetic resonance images, to the detection of tumours in histopathological images and extracting quantitative single-cell information from microscopy imagery, where cell segmentation is a major bottleneck. Attention-based transformers are state-of-the-art in a range of deep learning fields. They have recently been proposed for segmentation tasks where they are beginning to outperform other methods. We present a novel attention-based cell detection transformer (CellDETR) for direct end-to-end instance segmentation. While the segmentation performance is on par with a state-of-the-art instance segmentation method, Cell-DETR is simpler and faster. We showcase the method's contribution in a the typical use case of segmenting yeast in microstructured environments, commonly employed in systems or synthetic biology. For the specific use case, the proposed method surpasses the state-of-the-art tools for semantic segmentation and additionally predicts the individual object instances. The fast and accurate instance segmentation performance increases the experimental information yield for a posteriori data processing and makes online monitoring of experiments and closed-loop optimal experimental design feasible. Code and data sample is available at https://git.rwth-aachen.de/ bcs/projects/cell-detr.git.

Cell segmentation is a major bottleneck in extracting quantitative single-cell information from microscopy data. The challenge is exasperated in the setting of microstructured environments. While deep learning approaches have proven useful for general cell segmentation tasks, existing segmentation tools for the yeast-microstructure setting rely on traditional machine learning approaches. Here we present convolutional neural networks trained for multiclass segmenting of individual yeast cells and discerning these from cell-similar microstructures. We give an overview of the datasets recorded for training, validating and testing the networks, as well as a typical use-case. We showcase the method's contribution to segmenting yeast in microstructured environments with a typical synthetic biology application in mind. The models achieve robust segmentation results, outperforming the previous state-of-the-art in both accuracy and speed. The combination of fast and accurate segmentation is not only beneficial for a posteriori data processing, it also makes online monitoring of thousands of trapped cells or closed-loop optimal experimental design feasible from an image processing perspective.

International audience

Container environments permeate all areas of computing, such as HPC, since they are lightweight, efficient, and ease the deployment of software. However, due to the shared host kernel, their isolation is considered to be weak, so additional protection mechanisms are needed. This paper shows that neural networks can be used to do anomaly detection by observing the behavior of containers through system call data. In more detail the detection of anomalies in file and directory paths used by system calls is evaluated to show their advantages and drawbacks.

As today’s manufacturing domain is becoming more and more knowledge-intensive, knowledge-based systems (KBS) are widely applied in the predictive maintenance domain to detect and predict anomalies in machines and machine components. Within a KBS, decision rules are a comprehensive and interpretable tool for classification and knowledge discovery from data. However, when the decision rules incorporated in a KBS are extracted from heterogeneous sources, they may suffer from several rule quality issues, which weakens the performance of a KBS. To address this issue, in this paper, we propose a rule base refinement approach with considering rule quality measures. The proposed approach is based on a rule integration method for integrating the expert rules and the rules obtained from data mining. Within the integration process, rule accuracy, coverage, redundancy, conflict, and subsumption are the quality measures that we use to refine the rule base. A case study on a real-world data set shows the approach in detail.

Data-driven Industry 4.0 applications require low latency data processing and reliable communication models to enable efficient operation of production lines, fast response to failures and quickly adapt the manufacturing process to changing environmental conditions. Data processing in the Cloud has been widely accepted and in combination with Fog technologies, it can also satisfy these requirements. This paper investigates the placement of service containers and wheater they should be carried out in the Cloud or at a Fog node. It shows how to provide an uniform well-monitored execution environment to automatically distribute services concerning their application-specific requirements. An infrastructure is presented, that utilizes measurement probes to observe the node and environmental conditions, derive and evaluate appropriate distribution algorithms and finally deploy the application services to the node that meets the requirements.

In order to further support the secure operation of containerized environments and to extend already established security measures, we propose a rule-based security monitoring, which can be used for the detection of a variety of misuse and attacks. The capabilities of the open-source tools used to monitor containers are closely examined and the possibility of detecting undesired behavior is evaluated on the basis of various scenarios. Further, the limits of the approach taken and the associated performance overhead will be discussed. The results show that the proposed approach is effective in many scenarios and comes at a low performance overhead cost.

As private data is key to applications in the field of Ambient Assisted Living, access control has to be in place to regulate data flows within the environment and to preserver the privacy of a user. We present a data access control system based on an easy to understand policy language with the ability to be extended by context information. Context information are enabling applications in the field of Ambient Assisted Living to adapt their behaviour to temporal, emergency or environmental conditions. The system is able to monitor and control data flows in OSGi environments by proxy services, without the need of modifying the core platform or the service logic of bundles. This is necessary to inform data subjects, to enable the data subject to control the environment and to enforce data access policies that are compatible with legal requirements.

The rise of digital twins in the manufacturing industry is accompanied by new possibilities, like process automation and condition monitoring, real time simulations and quality and maintenance prediction are just a few advantages which can be realized. This paper takes a novel approach by extracting the fundamental knowledge of a data set from a production process and mapping it to an expert fuzzy rule set. Afterwards, new fundamental augmented data is generated by exploring the feature space of the previously generated fuzzy rule set. At the same time, a high number of artificial neural network (ANN) models with different hyperparameter configurations are created. The best models are chosen, in line with the idea of survival of the fittest, and improved with the additional training data sets, generated by the fuzzy rule simulation. It is shown that ANN models can be improved by adding fundamental knowledge represented by the discovered fuzzy rules. Those models can represent digitized machines as digital twins. The architecture and effectiveness of the digital twin is evaluated within an industry 4.0 use case.

Within manufacturing processes, anomalies such as machinery faults and failures may lead to the outage situation of production lines. The outage of production lines is detrimental for the availability of production systems and may cause severe economic loss. To avoid the economic loss that may be caused by the outage situation, the prediction of anomalies on production lines is a crucial concern for manufacturers. Recently, data mining techniques have been applied to the manufacturing domain for predicting occurrence time of anomalies, such as the moment of machinery failure. However, existing predictive maintenance approaches have been limited to the prediction of the time of occurrence of machinery failures, while lacking the capability for identifying the criticality of the failures. This may lead to inappropriate maintenance plans and strategies. In this context, in this paper, we introduce a novel ontology-based approach to facilitate predictive maintenance in industry. The proposed approach is a combination use of fuzzy clustering and semantic technologies, where fuzzy clustering techniques are used to learn the criticality of failures based on machine historical data, and semantic technologies use the results of fuzzy clustering to predict the time of failures and the criticality of them. As results, a domain ontology for modeling predictive maintenance knowledge is developed, and a set of Semantic Web Rule Language (SWRL) predictive rules are proposed to reason about the time and criticality of machinery failures. A case study on a real-world industrial data set is followed to evaluate the usefulness and effectiveness of the proposed approach.

Following the trend of Industry 4.0, automation in different manufacturing processes has triggered the use of intelligent condition monitoring systems, which are crucial for improving productivity and availability of production systems. To develop such an intelligent system, semantic technologies are of paramount importance. This paper introduces an ontology that will be used to develop an intelligent condition monitoring system. The proposed ontology formalizes domain knowledge related to condition monitoring tasks of manufacturing processes. After introducing the ontology in detail, we evaluate the proposed ontology by instantiating it with a case study: a conditional maintenance task of bearings in rotating machinery.

Cloud computing has been advancing at a feverish pace. It has become one of the most important research topics in computer science and information systems. Cloud computing offers enterprise-scale platforms in a short time frame with little effort. Thus, it delivers significant economic benefits to both commercial and public entities. Despite this, the security and subsequent incident management requirements are major obstacles to adopting the cloud. Current cloud architectures do not support digital forensic investigators, nor comply with today's digital forensics procedures - largely due to the dynamic nature of the cloud. When an incident has occurred, an organization-based investigation will seek to provide potential digital evidence while minimizing the cost of investigation. However, all members engaging in digital forensics must rely, to a very significant degree, upon the assistance of cloud providers to present relevant evidence. Unfortunately, providers often lack appropriate tools and features to perform adequate acquisition and analysis. Therefore, dependence on the CSPs is considered one of the most significant challenges when investigators need to acquire evidence in a timely yet forensically sound manner from cloud systems. This paper aims to achieve two objectives: the first objective is the development and validation of a forensic acquisition system in an Infrastructure as a Service (IaaS) model in order to ensure organizations remain in complete control, remove the burden/liability from the CSPs and make it easy to acquire the evidence in a forensically sound and timely manner. Secondly, it is to investigate the technical implications and costs resulting from such a system on the day-to-day operation of a cloud system.

Elasticity is one of the essential characteristics for cloud computing. The presented use case is a Software as a Service for Ambient Assisted Living that is configurable and extensible by the user. By adding or deleting functionality to the application, the environment has to support the increase or decrease of computational demand by scaling. This is achieved by customizing the auto scaling components of a PaaS management platform and introducing new components to scale a distributed OSGi environment across virtual machines. We present different scaling and load balancing scenarios to show the mechanics of the involved components.

Although cloud computing can be considered mainstream today, there is still a lack of trust in cloud providers, when it comes to the processing of private or sensitive data. This lack of trust is rooted in the lack of transparency of the provider's data handling practices, security controls and their technical infrastructures. This problem worsens when cloud services are not only provisioned by a single cloud provider, but a combination of several independent providers. The main contributions of this paper are: we propose an approach to automated auditing of cloud provider chains with the goal of providing evidence-based assurance about the correct handling of data according to pre-defined policies. We also introduce the concepts of individual and delegated audits, discuss policy distribution and applicability aspects and propose a lifecycle model. Our previous work on automated cloud auditing and Cloud Security Alliance's (CSA) CloudTrust Protocol form the basis for the proposed system for provider chain auditing.

With the increasing importance of cloud computing, compliance concerns get into the focus of businesses more often. Furthermore, businesses still consider security and privacy related issues to be the most prominent inhibitors for an even more widespread adoption of cloud computing services. Several frameworks try to address these concerns by building comprehensive guidelines for security controls for the use of cloud services. However, assurance of the correct and effective implementation of such controls is required by businesses to attenuate the loss of control that is inherently associated with using cloud services. Giving this kind of assurance is traditionally the task of audits and certification. Cloud auditing becomes increasingly challenging for the auditor the more complex the cloud service provision chain becomes. There are many examples for Software as a Service (SaaS) providers that do not own dedicated hardware anymore for operating their services, but rely solely on other cloud providers of the lower layers, such as platform as a service (PaaS) or infrastructure as a service (IaaS) providers. The collection of data (evidence) for the assessment of policy compliance during a technical audit is aggravated the more complex the combination of cloud providers becomes. Nevertheless, the collection at all participating providers is required to assess policy compliance in the whole chain. The main contribution of this paper is an analysis of potential ways of collecting evidence in an automated way across cloud provider boundaries to facilitate cloud audits. Furthermore, a way of integrating the most suitable approaches in the system for automated evidence collection and auditing is proposed.

One of the biggest advantages of cloud infrastructures is the elasticity. Cloud services are monitored and based on the resource utilization and performance load, they get scaled up or down, by provision or de-provision of cloud resources. The goal is to guarantee the customers an acceptable performance with a minimum of resources. Such Quality of Service (QoS) characteristics are stated in a contract, called Service Level Agreement (SLA) negotiated between customer and provider. The approach of this paper shows that with additional imprecise information (e.g. expected daytime/week- time performance) modeled with fuzzy logic and used in a behavior, load and performance prediction model, the up and down scaling mechanism of a cloud service can be optimized. Evaluation results confirm, that using this approach, SLA violation can be minimized.

Security is still a major concern in Cloud computing, especially the detection of nefarious use or abuse of cloud instances. One reason for this, is the ever-growing complexity and dynamic of the underlying system design and architecture. To be able to detect misuse of cloud instances, this work presents an anomaly detection system for Infrastructure as a Service Clouds. It is based on Cloud customers' usage behaviour analysis. Neural networks are used to analyse and learn the normal usage behaviour of Cloud customers, to then detect anomalies which could originate from a cloud security incident caused by an overtaken virtual machine. It increases transparency for Cloud customers about the security of their Cloud instances and supports the Cloud provider to detect misuse of their infrastructure. A simulation environment and an anomaly detection prototype get presented. Experiments validate the effectiveness of the proposed system.

Today's cloud services process data and let it often unclear to customers, how and by whom data is collected, stored and processed. This hinders the adoption of cloud computing by businesses. One way to address this problem is to make clouds more accountable, which has to be provable by third parties through audits. In this paper we present a cloud-adopted evidence collection process, possible evidence sources and discuss privacy issues in the context of audits. We introduce an agent based architecture, which is able to perform audit processing and reporting continuously. Agents can be specialized to perform specific audit tasks (e.g., log data analysis) whenever necessary, to reduce complexity and the amount of collected evidence information. Finally, a multi-provider scenario is discussed, which shows the usefulness of this approach.

Cloud and IT service providers should act as responsible stewards for the data of their customers and users. However, the current absence of accountability frameworks for distributed IT services makes it difficult for users to understand, influence and determine how their service providers honour their obligations. The A4Cloud project will create solutions to support users in deciding and tracking how their data is used by cloud service providers. By combining methods of risk analysis, policy enforcement, monitoring and compliance auditing with tailored IT mechanisms for security, assurance and redress, A4Cloud aims to extend accountability across entire cloud service value chains, covering personal and business sensitive information in the cloud.

One characteristic of a cloud computing infrastructure are their frequently changing virtual infrastructure. New Virtual Machines (VMs) get deployed, existing VMs migrate to a different host or network segment and VMs vanish since they get deleted by their user. Classic incidence monitoring mechanisms are not flexible enough to cope with cloud specific characteristics such as frequent infrastructure changes. In this paper we present a prototype demonstration of the Security Audit as a Service (SAaaS) architecture, a cloud audit system which aims to increase trust in cloud infrastructures by introducing more transparency to user and cloud provider on what is happening in the cloud. Especially in the event of a changing infrastructure the demonstration shows, how autonomous agents detect this change, automatically reevaluate the security status of the cloud and inform the user through an audit report.

The idea behind cloud computing is to deliver Infrastructure-, Platform- and Software-as-a-Service (IaaS, PaaS and SaaS) over the network on an easy pay-per-use business model. In this paper, we present our work, Virtual Cluster as a Service (ViteraaS), that provides on-demand high performance computing for research projects, and e-Learning and teaching purposes in a private cloud. Moreover, ViteraaS can be extended to use Amazon's public cloud infrastructure as needed. ViteraaS can be categorized as PaaS that leverages Open Nebula, a virtual infrastructure manager, to dynamically create a cluster of virtual machines (VMs) on idle resources or dedicated servers. In addition, ViteraaS is integrated within the university's existing IT infrastructure like Single Sign-On for seamless authentication and authorization. Finally, a Quality of Service monitoring module is used by ViteraaS to monitor the performance and status of these VMs.

Classic intrusion detection mechanisms are not flexible enough to cope with cloud specific characteristics such as frequent infrastructure changes. This makes them unable to address new cloud specific security issues. In this paper we introduce the cloud incident detection system Security Audit as a Service (SAaaS). It is build upon intelligent autonomous agents, which are aware of underlying business flows of deployed cloud instances. Business flows are modelled in form of Security Service Level Agreements, which enable the SAaaS architecture to be flexible and to supported cross customer event monitoring of a cloud infrastructure. As contribution of this paper we provide a high-level design of the SAaaS architecture, an introduction into the concept of Security Service Level Agreements, a first prototype of an autonomous agent and an evaluation about, which cloud specific security problems are addressed by the presented architecture.

The idea behind cloud computing is to deliver Infrastructure-, Platform- and Software-as-a-Service (IaaS, PaaS and SaaS) over the Internet on an easy pay-per-use business model. However, current offerings from cloud providers are based on proprietary technologies. As a consequence, consumers run into a risk of a vendor lock-in with little flexibility in moving their services to other providers. This can hinder the advancement of cloud computing to small- and medium-sized enterprises. To address these issues, standardization efforts have to take place in order to support further developments in the clouds. Standardized exchange mechanisms and interfaces are crucial in order to facilitate interoperability. In this paper, we look at several cloud standards, such as Open Virtualization Format, Open Cloud Computing Interface, and Cloud Data Management Interface, and analyze them against a taxonomy in order to point out their role for interoperability in IaaS. The taxonomy presents important IaaS topics, such as access mechanism, virtual appliance, security, and service-level agreement.

For finding the critical path in electrical circuit designs, a shortest-path search must be carried out. This paper introduces a new two-level shortest-path search algorithm specially adapted for parallelization. The proposed algorithm is based on a module-based partitioning algorithm and a shortest-path search parallelized for the usage on multi-core systems. Experimental results show the impact of this approach.

In this paper we present an autonomic Web services architecture that manages both the performance of service containers and the interconnection of those containers into a service overlay network. The advantages of this approach include the easing of management tasks through the autonomic systems ability to self-configure, self-optimise and self-heal. We also benefit from improved resilience and anticipate an improvement in overall performance. In our architecture we incorporate a structured distributed hash table peer-to-peer overlay network within our autonomic Web services container. Our architecture is inherently non-hierarchical, widely distributed and enables SLA compliant deployment of WSRF services. We have simplified the management of such a system by adhering to autonomic principles, and we maintain the performance of the system by tightly integrating SLA compliance and migrating services between containers to preserve QoS. We have developed a workable system for both service deployment and migration without the need for global state.

Service-oriented architectures provide integration of interoperability for independent and loosely coupled services. Web services and the associated new standards such as WSRF are frequently used to realise such service-oriented architectures. In such systems, autonomic principles of self-configuration, self-optimisation, self-healing and self- adapting are desirable to ease management and improve robustness. In this paper we focus on the extension of the self management and autonomic behaviour of a WSRF container connected by a structured P2P overlay network to monitor and rectify its QoS to satisfy its SIAs. The SLA plays an important role during two distinct phases in the life-cycle of a WSRF container. Firstly during service deployment when services are assigned to containers in such a way as to minimise the threat of SLA violations, and secondly during maintenance when violations are detected and services are migrated to other containers to preserve QoS. In addition, as the architecture has been designed and built using standardised modern technologies and with high levels of transparency, conventional Web services can be deployed with the addition of a SLA specification.

This article shows how the idea of continuous software testing by Rothermel and Harrold (1996) of a world wide working group can be well integrated into the grid computing paradigm using the Globus Toolkit (Saff and Ernst, 2004). This kind of testing assumes a lot of computational resources provided by a regression test center. The interaction with the test center is done through Web services implemented by the new developed Unit Test Center Grid Web Service (UTCGWS). UTCGWS is the interface to the developer IDEs and does compiling, deploying, distributing regression test and information managing. For the distribution of unit tests in a grid environment a simple distribution algorithm has been developed