Human Activity Recognition (HAR) in smart environments is a well-explored research domain, given its diverse applications which include healthcare, surveillance, building management, and many more. While the majority of HAR research focuses on recognizing the activities of a single subject, in real-world scenarios smart environments are often populated by multiple subjects that may be engaged in both independent and joint activities. This gives rise to the challenge of Multi-Subject HAR, which is an open and complex problem. This survey paper aims to offer researchers and practitioners a comprehensive analysis of Multi-Subject HAR, encompassing its potential applications, sensing solutions, methods, datasets, evaluation metrics, and ongoing challenges. In addition to presenting the latest research works in this area and identifying open issues, our major contributions consist of a comprehensive problem formalization and a thorough discussion of the evaluation metrics to assess different dimensions of multi-subject HAR systems. • We provide a comprehensive formalization for multi-subject HAR in smart environments. • We review the latest research works and datasets in this area. • We explore evaluation metrics and dataset-splitting strategies.

Explainable Artificial Intelligence (XAI) aims to uncover the inner reasoning of machine learning models. In IoT systems, XAI improves the transparency of models processing sensor data from multiple heterogeneous devices, ensuring end-users understand and trust their outputs. Among the many applications, XAI has also been applied to sensor-based Activities of Daily Living (ADLs) recognition in smart homes. Existing approaches highlight which sensor events are most important for each predicted activity, using simple rules to convert these events into natural language explanations for non-expert users. However, these methods produce rigid explanations lacking natural language flexibility and are not scalable. With the recent rise of Large Language Models (LLMs), it is worth exploring whether they can enhance explanation generation, considering their proven knowledge of human activities. This article investigates potential approaches to combine XAI and LLMs for sensor-based ADL recognition. We evaluate if LLMs can be used: (a) as explainable zero-shot ADL recognition models, avoiding costly labeled data collection, and (b) to automate the generation of explanations for existing data-driven XAI approaches when training data is available and the goal is higher recognition rates. Our critical evaluation provides insights into the benefits and challenges of using LLMs for explainable ADL recognition.

The sensor-based recognition of Activities of Daily Living (ADLs) in smart home environments enables several applications in the areas of energy management, safety, well-being, and healthcare. ADL recognition is typically based on deep learning methods requiring large datasets to be trained. Recently, several studies proved that Large Language Models (LLMs) effectively capture common-sense knowledge about human activities. However, the effectiveness of LLMs for ADL recognition in smart home environments still deserves to be investigated. In this work, we propose ADL-LLM, a novel LLM-based ADL recognition system. ADL-LLM transforms raw sensor data into textual representations, that are processed by an LLM to perform zero-shot ADL recognition. Moreover, in the scenario where a small labeled dataset is available, ADL-LLM can also be empowered with few-shot prompting. We evaluated ADL-LLM on two public datasets, showing its effectiveness in this domain.

This paper describes the development of PRACTICE, a distributed healthcare technological platform that supports various research initiatives by the University of Milan and the Angelo Bianchi Bonomi Hemophilia and Thrombosis Center, Fondazione IRCCS Ca’ Granda, Ospedale Maggiore Policlinico. PRACTICE includes three main components: a mobile app that patients can use to self-acquire ultrasound images at home, a computer-aided diagnosis web application that supports the practitioners through a set of machine learning models, and a set of web tools for image annotation, a prerequisite for training the machine learning models. Although PRACTICE was designed in the specific context of supporting the detection of joint recess blood effusions in hemophilic patients, this paper describes the main design and implementation challenges that apply to other applications of a research-oriented health platform.

Context-aware Human Activity Recognition (HAR) is a hot research area in mobile computing, and the most effective solutions in the literature are based on supervised deep learning models. However, the actual deployment of these systems is limited by the scarcity of labeled data that is required for training. Neuro-Symbolic AI (NeSy) provides an interesting research direction to mitigate this issue, by infusing common-sense knowledge about human activities and the contexts in which they can be performed into HAR deep learning classifiers. Existing NeSy methods for context-aware HAR rely on knowledge encoded in logic-based models (e.g., ontologies) whose design, implementation, and maintenance to capture new activities and contexts require significant human engineering efforts, technical knowledge, and domain expertise. Recent works show that pre-trained Large Language Models (LLMs) effectively encode common-sense knowledge about human activities. In this work, we propose ContextGPT: a novel prompt engineering approach to retrieve from LLMs common-sense knowledge about the relationship between human activities and the context in which they are performed. Unlike ontologies, ContextGPT requires limited human effort and expertise, while sharing similar privacy concerns if the reasoning is performed in the cloud. An extensive evaluation using two public datasets shows how a NeSy model obtained by infusing common-sense knowledge from ContextGPT is effective in data scarcity scenarios, leading to similar (and sometimes better) recognition rates than logic-based approaches with a fraction of the effort.

Human Activity Recognition (HAR) with mobile and wearable devices has been deeply studied in the last decades. Research groups working on this topic evaluated their proposed methods mostly on public datasets. However, most of the existing datasets only include inertial sensor data, while it is well-known that additional context data (e.g., semantic location) has the potential to significantly improve the recognition rate. Only a few datasets for context-aware HAR are publicly available, and their annotations were mostly self-reported in-the-wild by the subjects involved in data acquisition. This method harms the quality of annotations, thus discouraging the application of supervised models. In this paper, we propose DOMINO, a new public dataset for context-aware HAR. DOMINO includes 25 users (wearing a smartphone and a smartwatch) performing 14 activities. During data acquisition, the mobile devices recorded both inertial and high-level context data while our team monitored the quality of the self-reported annotations. Our experiments on DOMINO show the positive impact of considering high-level context information for Human Activity Recognition.

The use of supervised learning for Human Activity Recognition (HAR) on mobile devices leads to strong classification performances. Such an approach, however, requires large amounts of labeled data, both for the initial training of the models and for their customization on specific clients (whose data often differ greatly from the training data). This is actually impractical to obtain due to the costs, intrusiveness, and time-consuming nature of data annotation. Moreover, even with the help of a significant amount of labeled data, model deployment on heterogeneous clients faces difficulties in generalizing well on unseen data. Other domains, like Computer Vision or Natural Language Processing, have proposed the notion of pre-trained models, leveraging large corpora, to reduce the need for annotated data and better manage heterogeneity. This promising approach has not been implemented in the HAR domain so far because of the lack of public datasets of sufficient size. In this paper, we propose a novel strategy to combine publicly available datasets with the goal of learning a generalized HAR model that can be fine-tuned using a limited amount of labeled data on an unseen target domain. Our experimental evaluation, which includes experimenting with different state-of-the-art neural network architectures, shows that combining public datasets can significantly reduce the number of labeled samples required to achieve satisfactory performance on an unseen target domain.

Abstract The sensor-based recognition of Activities of Daily Living (ADLs) in smart-home environments enables several important applications, including the continuous monitoring of fragile subjects in their homes for healthcare systems. The majority of the approaches in the literature assume that only one resident is living in the home. Multi-inhabitant ADLs recognition is significantly more challenging, and only a limited effort has been devoted to address this setting by the research community. One of the major open problems is called data association, which is correctly associating each environmental sensor event (e.g., the opening of a fridge door) with the inhabitant that actually triggered it. Moreover, existing multi-inhabitant approaches rely on supervised learning, assuming a high availability of labeled data. However, collecting a comprehensive training set of ADLs (especially in multiple-residents settings) is prohibitive. In this work, we propose MICAR: a novel multi-inhabitant ADLs recognition approach that combines semi-supervised learning and knowledge-based reasoning. Data association is performed by semantic reasoning, combining high-level context information (e.g., residents’ postures and semantic locations) with triggered sensor events. The personalized stream of sensor events is processed by an incremental classifier, that is initialized with a limited amount of labeled ADLs. A novel cache-based active learning strategy is adopted to continuously improve the classifier. Our results on a dataset where up to 4 subjects perform ADLs at the same time show that MICAR reliably recognizes individual and joint activities while triggering a significantly low number of active learning queries.

In the general machine learning domain, solutions based on the integration of deep learning models with knowledge-based approaches are emerging. Indeed, such hybrid systems have the advantage of improving the recognition rate and the model’s interpretability. At the same time, they require a significantly reduced amount of labeled data to reliably train the model. However, these techniques have been poorly explored in the sensor-based Human Activity Recognition (HAR) domain. The common-sense knowledge about activity execution can potentially improve purely data-driven approaches. While a few knowledge infusion approaches have been proposed for HAR, they rely on rigid logic formalisms that do not take into account uncertainty. In this paper, we propose P-NIMBUS, a novel knowledge infusion approach for sensor-based HAR that relies on probabilistic reasoning. A probabilistic ontology is in charge of computing symbolic features that are combined with the features automatically extracted by a CNN model from raw sensor data and high-level context data. In particular, the symbolic features encode probabilistic common-sense knowledge about the activities consistent with the user’s surrounding context. These features are infused within the model before the classification layer. We experimentally evaluated P-NIMBUS on a HAR dataset of mobile devices sensor data that includes 14 different activities performed by 25 users. Our results show that P-NIMBUS outperforms state-of-the-art neuro-symbolic approaches, with the advantage of requiring a limited amount of training data to reach satisfying recognition rates (i.e., more than 80% of F1-score with only 20% of labeled data).

The recognition of human activities in sensorized smart-home environments enables a wide variety of healthcare applications, including the detection of early symptoms of cognitive decline. The most effective Human Activity Recognition (HAR) methods are based on supervised Deep Learning classifiers. Those models are usually considered as black boxes, and the rationale behind their decisions is difficult to understand for human beings. The recent advances in eXplainable Artificial Intelligence (XAI) offer promising tools to make HAR models more transparent. The state-of-the-art explainable HAR methods provide explanations for the output of classifiers that periodically predict the performed activity on short time windows (usually in the range of 15-60 seconds). However, non-technical users may be more interested in investigating explanations associated with complete activity instances (e.g., an instance of the cooking activity may last 30 minutes). Unfortunately, temporally extending the time window harms the recognition rate of HAR classifiers. In this paper, we propose DeXAR++: a novel method that generates explanations for human activity instances based on deep learning classifiers. The sensor data time windows used for classification are encoded as images. DeXAR++ aggregates the explanations generated by a computer-vision XAI approach on each time window to obtain a single explanation for approximated activity instances. Moreover, DeXAR++ includes a novel visualization approach particularly suitable for non-expert users. We evaluate DeXAR++ with both automatic and user-based evaluation methodologies on a public dataset of activities performed in smart-home environments, showing that our results outperform the ones obtained by state-of-the-art methods.

Sensor-based Human Activity Recognition (HAR) has been a hot topic in pervasive computing for several years mainly due to its applications in healthcare and well-being. Centralized supervised approaches reach very high recognition rates, but they incur privacy and scalability issues. Federated Learning (FL) has been recently proposed to mitigate these issues. Each subject only shares the weights of a personal model trained locally, instead of sharing data. A cloud server is in charge of aggregating the weights to generate a global model. However, since activity data is non-independently and identically distributed (non-IID), a single model may not be sufficiently accurate for a large number of diverse users. In this work, we propose FedCLAR, a novel federated clustering method for HAR. Based on the similarity of the local model updates, the cloud server in FedCLAR derives groups of users that exhibit similar ways of performing activities. For each group, FedCLAR uses a specialized global model to mitigate the non-IID problem. We evaluated FedCLAR on two well-known public datasets, showing that it outperforms state-of-the-art FL solutions.

Neuro-symbolic AI methods aim at integrating the capabilities of data-driven deep learning solutions with the ones of more traditional symbolic approaches. These techniques have been poorly explored in the sensor-based Human Activity Recognition (HAR) research field, even if they could lead to multiple benefits such as improving model interpretability and reducing the amount of labeled data that is necessary to reliably train the model. In this paper, we propose DUSTIN, a novel knowledge infusion approach for sensor-based HAR. DUSTIN concatenates the features automatically extracted by a CNN model from raw sensor data and high-level context data with the ones inferred by a knowledge-based reasoner. In particular, the symbolic features encode common-sense knowledge about the activities which are consistent with the context of the user, and they are infused within the model before the classification layer. We experimentally evaluated DUSTIN on a HAR dataset of mobile devices sensor data that includes 14 different activities performed by 26 users. Our results show that DUSTIN outperforms state-of-the-art neuro-symbolic approaches, with the advantage of requiring a limited amount of training data and training epochs to reach satisfying recognition rates.

Abstract One of the major open problems in sensor-based Human Activity Recognition (HAR) is the scarcity of labeled data. Among the many solutions to address this challenge, semi-supervised learning approaches represent a promising direction. However, their centralized architecture incurs in the scalability and privacy problems that arise when the process involves a large number of users. Federated learning (FL) is a promising paradigm to address these problems. However, the FL methods that have been proposed for HAR assume that the participating users can always obtain labels to train their local models (i.e., they assume a fully supervised setting). In this work, we propose FedAR: a novel hybrid method for HAR that combines semi-supervised and federated learning to take advantage of the strengths of both approaches. FedAR combines active learning and label propagation to semi-automatically annotate the local streams of unlabeled sensor data, and it relies on FL to build a global activity model in a scalable and privacy-aware fashion. FedAR also includes a transfer learning strategy to fine-tune the global model on each user. We evaluated our method on two public datasets, showing that FedAR reaches recognition rates and personalization capabilities similar to state-of-the-art FL supervised approaches. As a major advantage, FedAR only requires a very limited number of annotated data to populate a pre-trained model and a small number of active learning questions that quickly decrease while using the system, leading to an effective and scalable solution for the data scarcity problem of HAR.

Recognition of activities of daily living (ADLs) is an enabling technology for several ubiquitous computing applications. Most activity recognition systems rely on supervised learning to extract activity models from labeled datasets. A problem with that approach is the acquisition of comprehensive activity datasets, which is an expensive task. The problem is particularly challenging when focusing on complex ADLs characterized by large variability of execution. Moreover, several activity recognition systems are limited to offline recognition, while many applications claim for online activity recognition. In this paper, we propose POLARIS, a framework for unsupervised activity recognition. POLARIS can recognize complex ADLs exploiting the semantics of activities, context data, and sensors. Through ontological reasoning, our algorithm derives semantic correlations among activities and sensor events. By matching observed events with semantic correlations, a statistical reasoner formulates initial hypotheses about the occurred activities. Those hypotheses are refined through probabilistic reasoning, exploiting semantic constraints derived from the ontology. Our system supports online recognition, thanks to a novel segmentation algorithm. Extensive experiments with real-world datasets show that the accuracy of our unsupervised method is comparable to the one of supervised approaches. Moreover, the online version of our system achieves essentially the same accuracy of the offline version.

This paper reports our ongoing effort in the development of the ROSSINI system, which looks to address emergency situations in industrial plants. The user interaction design of ROSSINI described in this paper takes into account the fact that the user can be subject to situational impairment (e.g., limited sight due to smoke in the environment). As such, it is envisioned that existing solutions designed for people with disabilities can be adopted and extended for this purpose.

Recognizing the activities of daily living (ADLs) in multi-inhabitant settings is a challenging task. One of the major challenges is the so-called data association problem: how to assign to each user the environmental sensor events that he/she actually triggered? In this paper, we tackle this problem with a contextaware approach. Each user in the home wears a smartwatch, which is used to gather several high-level context information, like the location in the home (thanks to a micro-localization infrastructure) and the posture (e.g., sitting or standing). Context data is used to associate sensor events to the users which more likely triggered them. We show the impact of context reasoning in our framework on a dataset where up to 4 subjects perform ADLs at the same time (collaboratively or individually). We also report our experience and the lessons learned in deploying a running prototype of our method.

In the last years we have witnessed large scale data privacy violations mostly due to security issues or to unauthorised use and communication of personal data. Among many events, millions of Yahoo e-mail accounts and Facebook private profiles were violated. Mobile and pervasive technology and services have a role in this scenario, since they introduce new devices with possible hardware and software security holes, new communication protocols, new types of personal data, and a new scale for the amount of data being collected. Location data of individuals collected through mobile devices is a natural example, and video imaging and speech collected in our homes by smart appliances and toys is another.

Providing city navigation instructions to people with motion disabilities requires the knowledge of urban features like curb ramps, steps or other obstacles along the way. Since these urban features are not available from maps and change in time, crowdsourcing this information from end-users is a scalable and promising solution. Our preliminary study on wheelchair users shows that an automatic crowdsourcing mechanism is needed, avoiding users' involvement.In this contribution we present a solution to crowdsource urban features from inertial sensors installed on a wheelchair. Activity recognition techniques based on decision trees are used to process the sensors data stream. Experimental results, conducted with data acquired from 10 real wheelchair users navigating in an outdoor environment show that our solution is effective in detecting urban features with precision around 0.9, while it is less reliable when classifying some fine-grained urban feature characteristics, like a step height. The experimental results also present our investigation aimed at identifying the best parameters for the given problem, which include number, position and type of inertial sensors, classifier type, segmentation parameters, etc.

Due to the emerging popularity of pervasive healthcare applications, tools for monitoring activities in smart homes are gaining momentum. Existing methods mainly rely on supervised learning algorithms for recognizing activities based on sensor data. A key issue with those approaches is the acquisition of comprehensive training sets of activities. Indeed, that task incurs significant costs in terms of manual labeling effort; moreover, labeling by external observers violates the individual's privacy. For these reasons, there is an increasing interest in unsupervised activity recognition methods. A popular approach relies on knowledge-based models expressed by ontologies of activities, environment and sensors. Unfortunately, those models require significant knowledge engineering efforts, and are often limited to a specific application. In this paper, we address the issues of existing methods by proposing a novel hybrid approach. Our intuition is that a generic knowledge-based model of activities can be refined to target specific individuals and environments by collaboratively acquiring feedback from inhabitants. Specifically, we propose a collaborative active learning method to refine correlations among sensor events and activity types that are initially extracted from a high-level ontology. Generic correlations are personalized to each target smart-home considering the similarity between the feedback target and the feedback provider in terms of environment and inhabitant's profiles. Moreover, thanks to this method, new sensors installed in the home are seamlessly integrated in the recognition framework. In order to reduce the burden of providing feedback, we also propose a technique to carefully select the conditions that trigger a feedback request. We conducted experiments with a real-world dataset and a generic ontology of activities. Results show that our hybrid method outperforms state-of-the-art supervised and unsupervised activity recognition techniques while triggering an acceptable number of feedback queries.

According to the World Health Organization, the rate of people aged 60 or more is growing faster than any other age group in almost every country, and this trend is not going to change in a near future. Since senior citizens are at high risk of non communicable diseases requiring long-term care, this trend will challenge the sustainability of the entire health system. Pervasive computing can provide innovative methods and tools for early detecting the onset of health issues. In this paper we propose a novel method relying on medical models, provided by cognitive neuroscience researchers, describing abnormal activity routines that may indicate the onset of early symptoms of mild cognitive impairment. A non-intrusive sensor-based infrastructure acquires low-level data about the interaction of the individual with home appliances and furniture, as well as data from environmental sensors. Based on those data, a novel hybrid statistical-symbolical technique is used to detect first the activities being performed and then the abnormal aspects in carrying out those activities, which are communicated to the medical center. Differently from related works, our method can detect abnormal behaviors at a fine-grained level, thus providing an important tool to support the medical diagnosis. In order to evaluate our method we have developed a prototype of the system and acquired a large dataset of abnormal behaviors carried out in an instrumented smart home. Experimental results show that our technique has a high precision while generating a small number of false positives.

Large datasets of real network flows acquired from the Internet are an invaluable resource for the research community. Applications include network modeling and simulation, identification of security attacks, and validation of research results. Unfortunately, network flows carry extremely sensitive information, and this discourages the publication of those datasets. Indeed, existing techniques for network flow sanitization are vulnerable to different kinds of attacks, and solutions proposed for microdata anonymity cannot be directly applied to network traces. In our previous research, we proposed an obfuscation technique for network flows, providing formal confidentiality guarantees under realistic assumptions about the adversary's knowledge. In this paper, we identify the threats posed by the incremental release of network flows, we propose a novel defense algorithm, and we formally prove the achieved confidentiality guarantees. An extensive experimental evaluation of the algorithm for incremental obfuscation, carried out with billions of real Internet flows, shows that our obfuscation technique preserves the utility of flows for network traffic analysis.

Recommender systems suggesting venues offer very useful services to people on the move and a great business opportunity for advertisers. These systems suggest venues by matching the current context of the user with the venue features, and consider the popularity of venues, based on the number of visits (“check-ins”) that they received. Check-ins may be explicitly communicated by users to geo-social networks, or implicitly derived by analysing location data collected by mobile services. In general, the visibility of explicit check-ins is limited to friends in the social network, while the visibility of implicit check-ins limited to the service provider. Exposing check-ins to unauthorized users is a privacy threat since recurring presence in given locations may reveal political opinions, religious beliefs, or sexual orientation, as well as absence from other locations where the user is supposed to be. Hence, on one side mobile app providers host valuable information that recommender system providers would like to buy and use to improve their systems, and on the other we recognize serious privacy issues in releasing that information. In this paper, we solve this dilemma by providing formal privacy guarantees to users and trusted mobile providers while preserving the utility of check-in information for recommendation purposes. Our technique is based on the use of differential privacy methods integrated with a pre-filtering process, and protects against both an untrusted recommender system and its users, willing to infer the venues and sensitive locations visited by other users. Extensive experiments with a large dataset of real users' check-ins show the effectiveness of our methods.

Through this software the authors aim to promote the sharing of network logs within the research community. The (k, j)obfuscation technique opens sundry interesting future directions. In fact, many networking and security tasks can be re-thought based on obfuscated datasets, for instance, quality of service (QoS), traffic classification, anomaly detection and more.

The aim of proximity services is to raise alerts based on the distance between moving objects. While distance can be easily computed from the objects' geographical locations, privacy concerns in revealing these locations exist, especially when proximity among users is being computed. Distance preserving transformations have been proposed to solve this problem by enabling the service provider to acquire pairwise distances while not acquiring the actual objects positions. It is known that distance preserving transformations do not provide formal privacy guarantees in presence of certain background knowledge but it is still unclear which are the practical conditions that make distance preserving transformations “vulnerable”. We study these conditions by designing and testing an attack based on public density information and on partial knowledge of distances between users. A clustering-based technique first discovers the approximate position of users located in the largest cities. Then a technique based on trilateration reduces this approximation and discovers the approximate position of the other users. Our experimental results show that partial distance information, like the one exchanged in a friend-finder service, can be sufficient to locate up to 60% of the users in an area smaller than a city.

Different recommender systems suggest points of interest (POIs) based on data shared through geo-social networks (GSN). These systems are a very useful resource for mobile users, and an important business opportunity for advertisers. However, GSN data (e.g., the check-in of a person in a particular place) may be private information that a user may not want to release outside her social network. Even if the GSN service is trusted, and users' data is not directly released, an adversary may be able to reconstruct the data of a GSN user by mining the received recommendations. In this demo we will illustrate an implementation of the POI-Ti-Dico platform for privacy-conscious geo-social recommendation of POIs. The platform includes a server-side private recommender system and a mobile application for the Android framework. Recommendations are computed using a very large dataset of real check-ins.

Proximity services alert users about the presence of other users or moving objects based on their distance. Distance preserving transformations are among the techniques that may be used to avoid revealing the actual position of users while still effectively providing these services. Some of the proposed transformations have been shown to actually guarantee location privacy with the assumption that users are uniformly distributed in the considered geographical region, which is unrealistic assumption when the region extends to a county, a state or a country.

In the last decade, the release of network flows has gained significant popularity among researchers and networking communities. Indeed, network flows are a fundamental tool for modeling the network behavior, identifying security attacks, and validating research results. Unfortunately, due to the sensitive nature of network flows, security and privacy concerns discourage the publication of such datasets. On the one hand, existing techniques proposed to sanitize network flows do not provide any formal guarantees. On the other hand, microdata anonymization techniques are not directly applicable to network flows. In this paper, we propose a novel obfuscation technique for network flows that provides formal guarantees under realistic assumptions about the adversary's knowledge. Our work is supported by extensive experiments with a large set of real network flows collected at an important Italian Tier II Autonomous System, hosting sensitive government and corporate sites. Experimental results show that our obfuscation technique preserves the utility of network flows for network traffic analysis.

Web queries, credit card transactions, and medical records are examples of transaction data flowing in corporate data stores, and often revealing associations between individuals and sensitive information. The serial release of these data to partner institutions or data analysis centers in a nonaggregated form is a common situation. In this paper, we show that correlations among sensitive values associated to the same individuals in different releases can be easily used to violate users' privacy by adversaries observing multiple data releases, even if state-of-the-art privacy protection techniques are applied. We show how the above sequential background knowledge can be actually obtained by an adversary, and used to identify with high confidence the sensitive values of an individual. Our proposed defense algorithm is based on Jensen-Shannon divergence; experiments show its superiority with respect to other applicable solutions. To the best of our knowledge, this is the first work that systematically investigates the role of sequential background knowledge in serial release of transaction data.

The mobile data management community is experiencing a rapid evolutionary change due to the worldwide diffusion of always-on mobile devices and to the increased popularity of location and context-aware mobile applications. Accordingly to recent studies, in two years from now one fourth of the total mobile data will come from audio and video streaming and nearly all the rest from other Internet services. A large part of the increase in mobile data will come from cloud computing applications that are massively used for storing personal data, for sharing data, as well as for utility software (such as maps) and productivity tools. Social networking will strongly influence the way mobile users choose, share and use content from mobile devices. On the other side mobile devices are changing the way social networks have been used till now introducing geo-tagging, location sharing, and many innovative location based services.

The retrieval of close-by points of interest (POIs) is becoming a popular location-based service (LBS), often integrated with navigational services and geo-social networks. However, the access to POI services is prone to potentially serious privacy issues, since requests for POIs often include sensitive information like the user's location and her personal interests. Many techniques to enforce privacy in LBS have been proposed in the literature, in some cases focusing on anonymizing the requests and in others on obfuscating information in order to decrease its sensitivity. In many cases privacy protection comes at some cost in terms of service precision and performance. In this paper we propose a novel technique that combines the above cited approaches, overcomes some of their limitations in terms of assumptions on adversary knowledge, while still guaranteeing service precision. Our privacy solution has been integrated in an existing distributed system to share and retrieve POIs based not only on the user's current location but also on other (possibly sensitive) context data.

Online social networks often involve very large numbers of users who share very large volumes of content. This content is increasingly being tagged with geo-spatial and temporal coordinates that may then be used in services. For example, a service may retrieve photos taken in a certain region. The resulting geo-aware social networks (GeoSNs) pose privacy threats beyond those found in location-based services. Content published in a GeoSN is often associated with references to multiple users, without the publisher being aware of the privacy preferences of those users. Moreover, this content is often accessible to multiple users. This renders it difficult for GeoSN users to control which information about them is available and to whom it is available. This paper addresses two privacy threats that occur in GeoSNs: location privacy and absence privacy. The former concerns the availability of information about the presence of users in specific locations at given times, while the latter concerns the availability of information about the absence of an individual from specific locations during given periods of time. The challenge addressed is that of supporting privacy while still enabling useful services. We believe this is the first paper to formalize these two notions of privacy and to propose techniques for enforcing them. The techniques offer privacy guarantees, and the paper reports on empirical performance studies of the techniques.

Proximity services are a particular class of location-based services (LBS) in which a subscriber is alerted when other participants (called buddies) are nearby. Existing works in the field of privacy preservation in LBS propose techniques specifically designed for this type of service. The objective of this demo is to present the Pcube system that makes it possible to visually show the different performances of these techniques in terms of privacy protection and precision of the service. The system includes a server component providing the proximity service, a web-based client application and a client application for mobile devices. Four different privacy-preserving techniques existing in literature have been implemented and will be compared during the demo, with a particular focus on the evaluation of the recently proposed Longitude protocol.

Proximity based services are location based services (LBS) in which the service adaptation depends on the comparison between a given threshold value and the distance between a user and other (possibly moving) entities. While privacy preservation in LBS has lately received much attention, very limited work has been done on privacy-aware proximity based services. This paper describes the main privacy threats that the usage of these services can lead to, and proposes original privacy preservation techniques offering different trade-offs between quality of service and privacy preservation. The properties of the proposed algorithms are formally proved, and an extensive experimental work illustrates the practicality of the approach.

One of the privacy threats recognized in the use of LBS is represented by an adversary having information about the presence of individuals in certain locations, and using this information together with an (anonymous) LBS request to re-identify the issuer of the request associating her to the requested service. Several papers have proposed techniques to prevent this, assuming that the use of the service is considered sensitive. In this paper we investigate the more general case in which the adversary is also able to recognize traces of LBS requests by the same anonymous user, so that the identification of the issuer of one request can lead to the disclosure of the same user being in other possibly sensitive locations at different times or using sensitive services.Using the notion of "historical k-anonymity", this paper provides the first formalization of this class of privacy threats. Through extensive experiments based on realistic simulations, and runs of an optimal algorithm, we show some negative results for the defenses based on spatial generalization against these attacks under very conservative assumptions. Under more realistic location knowledge assumptions, we propose two defense algorithms, based on a strategy of changing and reusing of pseudo-identifiers, whose correctness is formally proved. Our experiments show that, among all the proposed algorithms, the ProvidentHider algorithm is particularly effective in protecting privacy for reasonably long sequences of requests.

The anonymization of location based queries through the generalization of spatio-temporal information has been proposed as a privacy preserving technique. We show that the presence of multiple concurrent requests, the repetition of similar requests by the same issuers, and the distribution of different service parameters in the requests can significantly affect the level of privacy obtained by current anonymity-based techniques. We provide a formal model of the privacy threat, and we propose an incremental defense technique based on a combination of anonymity and obfuscation. We show the effectiveness of this technique by means of an extensive experimental evaluation.

A privacy violation occurs when the association between an individual identity and data considered private by that individual is obtained by an unauthorized party. Uncertainty and indistinguishability are two independent aspects that characterize the

This paper presents preliminary results on anonymization and obfuscation techniques to preserve users' privacy in context-aware service provisioning. The techniques are based on generalizing request parameters as well as the context data provided to the application. Local context semantic aggregation is used to improve the quality of service that can be achieved while preserving privacy. The paper also shows how the software architecture of the CARE middleware can be extended to implement the proposed techniques.

The large scale adoption of adaptive services in pervasive and mobile computing is likely to be conditioned to the availability of reliable privacy-preserving technologies. Unfortunately, the research in this field can still be considered in its infancy. This paper considers a specific pervasive computing scenario, and shows that the application of state-of-the-art techniques for the anonymization of service requests is insufficient to protect the privacy of users. A specific class of attacks, called shadow attacks, is formally defined and a set of defense techniques is proposed. These techniques are validated through the use of a simulator and an extensive set of experiments.

Due to the widespread availability of accurate localization technologies, navigation systems are more and more present on mobile devices. These applications usually provide facilities for managing and searching points of interest. However, currently available navigation software does not support sharing of points of interest, and the search facilities are quite primitive, being exclusively based on location and categories. In this paper we present novel algorithms for context-aware retrieval of distributed resources. These algorithms can be executed on any unstructured peer-to-peer network, and are based on the distributed evaluation of a scoring function that takes into account a wide set of context data. The algorithms preserve the correctness of the result set until a certain time-to-live, while reducing the exchange of data in the network. The proposed algorithms have been integrated into a Web service-based, peer-to-peer system for management and sharing of an extended form of points of interest.

A general consensus is that the proliferation of location- aware devices will result in a diffusion of location-based services. Privacy preservation is a challenging research issue for this kind of service. A possible solution consists of ensuring users' anonymity, i.e., ensuring that the user issuing a request is indistinguishable, among a group of users, by any attacker who has access to the service requests. In this paper we propose a formal framework to model the problem of guaranteeing anonymity when requiring location-based services. The proposed framework extends existing approaches by allowing to model different kinds of knowledge that may be available to the attacker. We show application examples of our framework, modeling both known scenarios and new ones. From a practical point of view, the framework makes it possible to define anonymity-preserving techniques that best suite the system assumptions as derived from the applicative context, and the level of privacy protection defined by the user.

Spatial generalization has been recently proposed as a technique for the anonymization of requests in location based services. This paper presents the results of an extensive experimental study, considering known generalization algorithms as well as new ones proposed by the authors.

In the recent years several research efforts have focused on the concept of time granularity and its applications. A first stream of research investigated the mathematical models behind the notion of granularity and the algorithms to manage temporal data based on those models. A second stream of research investigated symbolic formalisms providing a set of algebraic operators to define granularities in a compact and compositional way. However, only very limited manipulation algorithms have been proposed to operate directly on the algebraic representation making it unsuitable to use the symbolic formalisms in applications that need manipulation of granularities. This paper aims at filling the gap between the results from these two streams of research, by providing an efficient conversion from the algebraic representation to the equivalent low-level representation based on the mathematical models. In addition, the conversion returns a minimal representation in terms of period length. Our results have a major practical impact: users can more easily define arbitrary granularities in terms of algebraic operators, and then access granularity reasoning and other services operating efficiently on the equivalent, minimal low-level representation. As an example, we illustrate the application to temporal constraint reasoning with multiple granularities. From a technical point of view, we propose an hybrid algorithm that interleaves the conversion of calendar subexpressions into periodical sets with the minimization of the period length. The algorithm returns set-based granularity representations having minimal period length, which is the most relevant parameter for the performance of the considered reasoning services. Extensive experimental work supports the techniques used in the algorithm, and shows the efficiency and effectiveness of the algorithm.

In this paper we extend the notion of k-anonymity in the context of databases with timestamped information in order to naturally define k-anonymous views of temporal data. We also investigate the problem of obtaining these views. We show that known generalization techniques, despite being applicable under certain conditions, have some limitations, and propose a new generalization algorithm based on the hierarchy of time granularities.

Context-awareness in mobile and ubiquitous computing requires the acquisition, representation and processing of context information which is not limited to the device features, network status, or user location but includes semantically rich data like user preferences and user current activity.

Context-awareness in mobile and ubiquitous computing requires the acquisition, representation and processing of information which goes beyond the device features, network status, and user location, to include semantically rich data, like user interests and user current activity. On the other hand, when services have to be provided on-the-fly to many mobile users, the efficiency of reasoning with these data becomes a relevant issue. Experimental evidence has lead us to consider currently impractical a tight integration of ontological reasoning with rule based reasoning at the time of request. This paper illustrates a hybrid approach where ontological reasoning is loosely coupled with the efficient rule-based reasoning of a middleware architecture for service adaptation. While rule-based reasoning is performed at the time of service request to evaluate adaptation policies and reconcile possibly conflicting context information, ontological reasoning is mostly performed asynchronously by local context providers to derive non-shallow context information. A limited form of ontological reasoning is activated at the time of request only when essential for service provisioning.

This paper addresses the technical problem of efficiently reducing the periodic representation of a time granularity to its minimal form. The minimization algorithm presented in the paper has an immediate practical application: it allows users to intuitively define granularities (and more generally, recurring events) with algebraic expressions that are then internally translated to mathematical characterizations in terms of minimal periodic sets. Minimality plays a crucial role, since the value of the recurring period has been shown to dominate the complexity when processing periodic sets.

Mobile and ubiquitous computing emphasize the need for highly adaptive delivery of Internet services. While several systems and even products exist that guarantee shallow or deep adaptation, they are usually based on profile information and customer relationship management modules stored and operating at the service provider. On the contrary, We assume that profile information, including user personal data and preferences, device capabilities, network bandwidth, location and other contextual information, as well as policy rules that can dynamically change this data, are provided by different sources. We describe a formal framework for aggregating this information and for solving conflicts between policy rules. We provide both a theoretical study of the properties of our techniques and a practical evaluation study obtained through a prototype implementation.

An effort has been devoted in the recent years to study and formalize the concept of time granularity and to design applications and services using the formalization. Among other proposals, a calendar algebra has been defined to facilitate the specification of new granularities and to perform conversions among them. This paper shows how granularities defined as algebraic calendar expressions can be represented as periodical sets of instants. More precisely the paper shows how each algebraic operator changes the periodical structure of the granularities given as operands. These results have an immediate application enabling users to easily specify new granularities and using them in the only constraint solver supporting time granularities that is currently available.

We first briefly illustrate the concept of time granularity and review the emerging approaches for modeling and reasoning with it. We then advocate the need for a set of Web services that distributed applications can use to define and manipulate time granularities. As an example of these services, we discuss in detail the GSTP service, a constraint solver for networks of temporal constraints with time granularities, developed at the University of Milan, and based on recently published theoretical results. The GSTP service can be accessed from applications through the Internet as a Web service, or can be accessed by a human user through a sophisticated Java interface. A system demonstration was given during the talk.

Data explicitly stored in a temporal database are often associated with certain semantic assumptions. Each assumption can be viewed as a way of deriving implicit information from explicitly stored data. Rather than leaving the task of deriving (possibly infinite) implicit data to application programs, as is the case currently, it is desirable that this be handled by the database management system. To achieve this, the paper formalizes and studies two types of semantic assumptions: point based and interval based. The point based assumptions include those assumptions that use interpolation methods over values at different time instants, while the interval based assumptions include those that involve the conversion of values across different time granularities. The paper presents techniques on: (1) how assumptions on specific sets of attributes can be automatically derived from the specification of interpolation and conversion functions; and (2) given the representation of assumptions, how a user query can be converted into a system query such that the answer of this system query over the explicit data is the same as that of the user query over the explicit and the implicit data. To precisely illustrate concepts and algorithms, the paper uses a logic based abstract query language. The paper also shows how the same concepts can be applied to concrete temporal query languages.

An important usage of time sequences is to discover temporal patterns. The discovery process usually starts with a user specified skeleton, called an event structure, which consists of a number of variables representing events and temporal constraints among these variables; the goal of the discovery is to find temporal patterns, i.e., instantiations of the variables in the structure that appear frequently in the time sequence. The paper introduces event structures that have temporal constraints with multiple granularities, defines the pattern discovery problem with these structures, and studies effective algorithms to solve it. The basic components of the algorithms include timed automata with granularities (TAGs) and a number of heuristics. The TAGs are for testing whether a specific temporal pattern, called a candidate complex event type, appears frequently in a time sequence. Since there are often a huge number of candidate event types for a usual event structure, heuristics are presented aiming at reducing the number of candidate event types and reducing the time spent by the TAGs testing whether a candidate type does appear frequently in the sequence. These heuristics exploit the information provided by explicit and implicit temporal constraints with granularity in the given event structure. The paper also gives the results of an experiment to show the effectiveness of the heuristics on a real data set.

Access control models, such as the ones supported by commercial DBMSs, are not yet able to fully meet many application needs. An important requirement derives from the temporal dimension that permissions have in many real-world situations. Permissions are often limited in time or may hold only for specific periods of time. In this article, we present an access control model in which periodic temporal intervals are associated with authorizations. An authorization is automatically granted in the specified intervals and revoked when such intervals expire. Deductive temporal rules with periodicity and order constraints are provided to derive new authorizations based on the presence or absence of other authorizations in specific periods of time. We provide a solution to the problem of ensuring the uniqueness of the global set of valid authorizations derivable at each instant, and we propose an algorithm to compute this set. Moreover, we address issues related to the efficiency of access control by adopting a materialization approach. The resulting model provides a high degree of flexibility and supports the specification of several protection requirements that cannot be expressed in traditional access control models.

The purpose of good database logical design is to eliminate data redundancy and isertion and deletion anomalies. In order to achieve this objective for temporal databases, the notions of temporal types , which formalize time granularities, and temporal functional dependencies (TFDs) are intrduced. A temporal type is a monotonic mapping from ticks of time (represented by positive integers) to time sets (represented by subsets of reals) and is used to capture various standard and user-defined calendars. A TFD is a proper extension of the traditional functional dependency and takes the form X → μ Y, meaning that there is a unique value for Y during one tick of the temporal type μ for one particular X value. An axiomatization for TFDs is given. Because a finite set TFDs usually implies an infinite number of TFDs, we introduce the notion of and give an axiomatization for a finite closure to effectively capture a finite set of implied TFDs that are essential of the logical design. Temporal normalization procedures with respect to TFDs are given. Specifically, temporal Boyce-Codd normal form (TBCNF) that avoids all data redundancies due to TFDs, and temporal third normal form (T3NF) that allows dependency preservation, are defined. Both normal forms are proper extensions of their traditional counterparts, BCNF and 3NF. Decompositition algorithms are presented that give lossless TBCNF decompositions and lossless, dependency-preserving, T3NF decompositions.

) Claudio Bettini Dept. of Computer Science (DSI) University of Milan via Comelico 39, 20135 Milan, Italy [email protected] X. Sean Wang, Sushil Jajodia Dept. of Info.& Software Systems Eng. George Mason University Fairfax, VA 22030, USA fxywang, [email protected] Abstract An important usage of time sequences is for discovering temporal patterns of events (a special type of data mining). This process usually starts with the specification by the user of an event structure which consists of a number of variables representing events and temporal constraints among these variables. The goal of the data mining is to find temporal patterns, i.e., instantiations of the variables in the structure, which frequently appear in the time sequence. This paper introduces event structures that have temporal constraints with multiple granularities (TCGs). Testing the consistency of such structures is shown to be NP-hard. An approximate algorithm is then presented. The paper also introduces ...

The paper presents a discretionary access control model in which authorizations contain temporal intervals of validity. An authorization is automatically revoked when the associated temporal interval expires. The proposed model provides rules for the automatic derivation of new authorizations from those explicitly specified. Both positive and negative authorizations are supported. A formal definition of those concepts is presented, together with the semantic interpretation of authorizations and derivation rules as clauses of a general logic program. Issues deriving from the presence of negative authorizations are discussed. We also allow negation in rules: it is possible to derive new authorizations on the basis of the absence of other authorizations. The presence of this type of rule may lead to the generation of different sets of authorizations, depending on the evaluation order. An approach is presented, based on establishing an ordering among authorizations and derivation rules, which guarantees a unique set of valid authorizations. Moreover, we give an algorithm detecting whether such an ordering can be established for a given set of authorizations and rules. Administrative operations for adding, removing, or modifying authorizations and derivation rules are presented and efficiency issues related to these operations are also tackled in the paper. A materialization approach is proposed, allowing to efficiently perform access control.

When querying a temporal database, a user often makes certain semantic assumptions on stored temporal data. This paper formalizes and studies two types of semantic assumptions: point-based and interval-baaed, The point-based assumptions include those assumptions that use interpolation methods, while the interval-based assumptions include those that involve different temporal types (time granularities). Each assumption is viewed as a way to derive certain implicit data from the explicit data stored in the database. The database system must use all explicit as well as (possibly infinite) implicit data to answer user queries. This paper introduces a new method to facilitate such query evaluations. A user query is translated into a system query such that the answer of this system query over the explicit data is the same as that of the user query over the explicit and the implicit data. The paper gives such a translation procedure and studies the properties (safety in particular) of user queries and system queries. 1

This paper presents a discretionary access control model in which authorizations contain temporal information. This information can be used to specify temporal intervals of validity for authorizations and temporal dependencies among authorizations. A formal definition of those concepts is presented in the paper, in terms of their interpretation in first order logic. We characterize sets of temporal dependencies that can lead to undesirable states of the authorization system and we sketch an algorithm for their detection. Finally, operations to add, remove, or modify authorizations and temporal dependencies are described.