Abstract The risk-based access control model is one of the dynamic models that use the security risk as a criterion to decide the access decision for each access request. This model permits or denies access requests dynamically based on the estimated risk value. The essential stage of implementing this model is the risk estimation process. This process is based on estimating the possibility of information leakage and the value of that information. Several researchers utilized different methods for risk estimation but most of these methods were based on qualitative measures, which cannot suit the access control context that needs numeric and precise risk values to decide either granting or denying access. Therefore, this paper presents a novel Adaptive Neuro-Fuzzy Inference System (ANFIS) model for risk estimation in the risk-based access control model for the Internet of Things (IoT). The proposed ANFIS model was implemented and evaluated against access control scenarios of smart homes. The results demonstrated that the proposed ANFIS model provides an efficient and accurate risk estimation technique that can adapt to the changing conditions of the IoT environment. To validate the applicability and effectiveness of the proposed ANFIS model in smart homes, ten IoT security experts were interviewed. The results of the interviews illustrated that all experts confirmed that the proposed ANFIS model provides accurate and realistic results with a 0.713 in Cronbach’s alpha coefficient which indicates that the results are consistent and reliable. Compared to existing work, the proposed ANFIS model provides an efficient processing time as it reduces the processing time from 57.385 to 10.875 Sec per 1000 access requests, which demonstrates that the proposed model provides effective and accurate risk evaluation in a timely manner.

The evolution of an Internet of Things-enabled Smart Grid affords better automation, communication, monitoring, and control of electricity consumption. It is now essential to supply and transmit the data required, to achieve better sensing, more accurate control, wider information communication and sharing, and more rational decision-making. However, the rapid growth in connected entities, accompanied by the increased demand for electricity, has resulted in several challenges to be addressed. One of these is protecting energy information exchange proactively, before an incident occurs. It is argued that Smart Grid systems were designed without any regard for security, which is considered a serious omission, especially for data security, energy information exchange, and the privacy of both the consumers and utility companies. This research is motivated by the gap identified in the requirements and controls for maintaining cybersecurity in the bi-directional data flow within the IoT-en.

There has been significant innovation in the domain of Internet of Things (IoT) as nowadays wireless data transmission is playing an essential role in various organizations like agriculture, defence, transportation, etc. Batteries are the most common option to power wireless devices. However, using batteries to power IoT devices has drawbacks including the cost and disruption of frequent battery replacement, and environmental concerns about battery disposal. Solar energy harvesting is a promising solution for long-term operation applications. However, solar energy harvesting varies drastically over location and time. Due to fluctuating weather conditions and the environmental effects on PV surface condition, output could be reduced and become insufficient. Environmental conditions including temperature, wind, solar irradiance, humidity, tilt angle and the dust accumulated over time on the photovoltaic (PV) module surface affects the amount of energy harvested. To address this issue, a novel solution is required to autonomously predict the harvested energy and plan the IoT device tasks accordingly, to enhance its performance and lifetime. Using Machine Learning (ML) algorithms could make it possible to predict how much energy can be harvested using weather forecast data. This research is ongoing, and aims to apply ML algorithms on historical weather data including environmental factors to generate solar energy predictions for IoT device energy budget planning.

The urban mobility landscape is evolving at an amazing rate, with the number of mobility services growing rapidly around the world. This evolution has brought about the concept of Mobility-as-a-Service (MaaS) in providing transportation services. MaaS capitalises on the Internet of Things to provide access to seamless multi- and inter-modal mobility to the end-user. A well implemented MaaS scheme involves many stakeholders, including passengers, producing, sharing, and consuming (personal) data. In order to encourage MaaS uptake in the general population, participating stakeholders must be confident of the ensuing data privacy and security, as part of their interactions with the system. In this paper, we use STRIDE Threat Modeling framework to analyse the threats that may arise in a MaaS ecosystem. From these threats, we develop mitigations that can be used to eliminate and/or reduce such threats. This threat elicitation and their accompanying mitigations can be used as springboards to establish the necessary security to engender trust in MaaS usage.

PBX hacking is a multi-billion dollar per year criminal and terrorism funding source. This paper follows on from a previous 10-day Honeypot experiment, to run a VoIP PBX Honeypot for a longer period of 103-day to not only validate any similarities, but to also analyse non-VoIP methods hackers use in an attempt to gain access to a VoIP System. Over the 103-day data collection period, the Honeypot recorded over 100 million SIP messages. Different techniques were used (including SQL injections in Invites) and hackers of the same IP subnet also attempted using web vulnerabilities in different telephony phone systems to gain access. Of specific interest, over the Christmas period of 2018, attack intensity decreased significantly. To validate these findings, the Honeypot experiment was also conducted for a short period over the Christmas period of 2019 which found that unlike Christmas 2018, attacks increased. The sophistication, scale and complexity of the fraud would suggest an Advance Persistent Threat exists with an aim to infiltrate a VoIP system (including a PBX) to conduct Toll Fraud and where possible to also add that system to a botnet of infected voice systems.

Abstract The Internet of Things (IoT) is becoming the future of the Internet with a large number of connected devices that are predicted to reach about 50 billion by 2020. With proliferation of IoT devices and need to increase information sharing in IoT applications, risk-based access control model has become the best candidate for both academic and commercial organizations to address access control issues. This model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. This model solves challenges related to flexibility and scalability of the IoT system. Therefore, we propose an adaptive risk-based access control model for the IoT. This model uses real-time contextual information associated with the requesting user to calculate the security risk regarding each access request. It uses user attributes while making the access request, action severity, resource sensitivity and user risk history as inputs to analyze and calculate the risk value to determine the access decision. To detect abnormal and malicious actions, smart contracts are used to track and monitor user activities during the access session to detect and prevent potential security violations. In addition, as the risk estimation process is the essential stage to build a risk-based model, this paper provides a discussion of common risk estimation methods and then proposes the fuzzy inference system with expert judgment as to be the optimal approach to handle risk estimation process of the proposed risk-based model in the IoT system.

The recent diagnosis of COVID-19 is based on real-time reverse-transcriptase polymerase chain reaction (RT-PCR) and is regarded as the gold standard for confirmation of infection. It has already been widely recognized that deep learning techniques can potentially have a substantial role in streamlining and accelerating the diagnosis of COVID-19 patients. Numerous open dataset enterprises have been set up over the past weeks to help the researchers develop and check methods that could contribute to countering the Corona pandemic. In order to report the above unique problems in the diagnosis of COVID-19, pioneering techniques should be developed. This special issue focuses on novel deep learning imaging analysis techniques related to COVID-19.

Flow cytometry (FCM) determines the characteristics of individual biological cells using optical and fluorescence measurements. It is a widely used standard method for analysing blood samples in medical diagnostics, through identifying and quantifying the different types of cells in the samples. The multidimensional dataset obtained from FCM is large and complex, so it is difficult and time-consuming to analyse manually. The main process of differentiation and therefore labelling of the different cell populations in the data is referred to as Gating. This is the first step of FCM data analysis and is highly subjective, an issue that significant research has focussed on reducing. However, a faster standard gating technique is still needed. Existing automated gating techniques are time-consuming or retain subjectivity by requiring many user-defined parameters. This paper presents and discusses FLOPTICS: a novel automated gating technique that is a combination of density-based and grid-based clustering algorithms. FLOPTICS has an ability to classify and label cell populations in FCM data faster and with fewer user-defined parameters than many state-of-the-art techniques.

The healthcare data are considered as a highly valuable source of information that can improve healthcare systems to be more intelligent and improve the quality of the provided services. However, due to security and privacy issues, sharing data between healthcare organisations is challenging. This has led to data shortage in the healthcare sector which is considered as a significant issue not only in the Kingdom of Saudi Arabia (KSA) but also worldwide. The primary objective of conducting this paper is to investigate the various factors that enable secure sharing and exchange of healthcare information between different healthcare providers in the KSA. It starts by discussing the current literature and frameworks for managing healthcare data information and the challenges that health providers encounter, particularly when it comes to issues such as data security, patient privacy, and healthcare information exchange. These challenges in managing healthcare data have necessitated the nee d for implementing a solution that can allow medical providers to have access to updated healthcare information. Attention in the healthcare sector has been drawn to blockchain technology as a part of the solution, especially after the technology was successfully applied in the financial sector to improve the security of financial transactions, particularly involving digital currencies such as Bitcoin. Therefore, a framework based on the blockchain technology has been proposed to achieve the goals of the present research.

Employment uses trusted records such as award certificates as a part of hiring procedures. Some countries practices for employment history reference; either a service certificate or systems based on pension records which are based on number of years of employment that are also can be used for pension eligibility. However, there is an increase on the number of issued award certificates which are, in most cases, do not follow an agreed standard, which increases challenges for an authenticated record sharing. Moreover, employment systems are not required to share employment history nor to accommodate record requests educational institutes. Additionally, public employment systems are by design isolated from interaction with private sector. The research suggest that distributed systems would reduce costs for verifying and authenticating records while being flexible on allocating trusted records such as employment history, awarded certificates and resumes.

The IoT is capable of communicating and connecting billions of things at the same time. The concept offers numerous benefits for consumers that alters how users interact with the technology. With this said, however, such monumental growth within IoT development also gives rise to a number of legal and technical challenges in the field of IoT forensics. Indeed, there exist many issues that must be overcome if effective IoT investigations are to be carried out. This paper presents a review of the IoT concept, digital forensics and the state-of-the-art on IoT forensics. Furthermore, an exploration of the possible solutions proposed in recent research and IoT forensics challenges that are identified in the current research literature are examined. Picks apart the challenges facing IoT forensics which have been established in recent literature. Overall, this paper draws attention to the obvious problems – open problems which require further efforts to be addressed properly.

The lack of patch management has been identified as the main reason for many ransomware attacks. The cost of patch management is still an obstacle for many small and medium-size businesses. There are many open source, free of charge, patch management systems but these require many pre-configuration steps making them complicated to use. Hence, this paper presents a patch management system that is cost-effective but also efficient in terms of set-up time. We have written the system in Python with Puppet and Mcollective to aid the configuration steps. An additional feature of this system is the ability to assess the security of the system being patched, using CVE scanning.

This paper examines the challenging problem of new user cold starts in subset labelled and extremely sparsely labelled big data. We introduce a new Isle of Wight Supply Chain (IWSC) dataset demonstrating these characteristics. We also introduce a new technique addressing these challenges, the Transitive Semantic Relationships (TSR) model, which infers potential relationships from user and item text content and few labelled examples. We perform both implicit and explicit evaluation of TSR as a recommender system and from new user cold starts we achieve a hit-rate@10 of 77% on a collection of 630 items with only 376 supply-chain consumer labels, and 67% with only 142 supply-chain supplier labels, demonstrating a high level of performance even with extremely few labels in challenging cold-start scenarios. TSR is suitable for any dataset featuring few labels and user and item content, where similarity of content indicates similar relationship forming capability. TSR can be used as a standalone recommender system or to complement existing high-performance recommender models that require more labels or do not support cold starts.

According to Cisco Global Cloud Index, cloud storage users will store 1.6 Gigabytes data per month by 2019, compared to 992 megabytes data per month in 2014. With this trend, it has been shown that more and more data will reside in cloud storage and it is expected to grow further. As cloud storage is becoming an option for users for keeping their data online, it comes with security concerns for protecting data from threats. This thesis addresses the need to investigate the security factors that will enable efficient security protection for data in cloud storage and the relationships that exist between the different security factors. Consequently, this research has developed a conceptual framework that supports security in cloud storage. The main contribution of this research is the development of a Cloud Storage Security Framework (CSSF) to support an integrative approach to understanding and evaluating security in cloud storage. The framework enables understanding of the makeup of security in cloud storage and measures the understanding of security in cloud storage. Drawing upon established theories and prior research findings, the framework indicates that security in cloud storage can be determined by nine factors: (1) security policies implementation in cloud storage, security measure that relates to (2) protecting the data accessed in cloud storage; (3) modifications of data stored; (4) accessibility of data stored in cloud storage; (5) non-repudiation to the data stored; (6) authenticity of the original data; (7) reliability of the cloud storage services; (8) accountability of service provision; and (9) auditability of the data accessed and stored in cloud storage. An example of CSSF application has been demonstrated through the development of a measuring instrument called Security Rating Score (SecRaS) and through a series of experiments, SecRaS has been validated and used in a research scenario. The instrument consists of several items generated using goal-question-metric approach. These potential items were evaluated by a series of experiments; the security experts assessed using content validity ratio while the security practitioners took part in the validation study. The validation study completed two experiments that look into the correlation analyses and internal reliability. SecRaS instrument was later applied in a research scenario; the validated instrument was distributed and a number of 218 usable responses were received. Using structural equation modelling, the data has revealed a good fit of the measurement analyses and structural model. The key findings were as follow: the relationships between factors were found to have both direct and indirect effects in the result. While establishing the relationship(s) among the factors, the structural model proposes three types of causal relationships in terms of how the security implementation in cloud storage could be affected by the security factors. This thesis presents a detailed discussion of the CSSF development, confirmation, and application in a research scenario. For security managers, CSSF offers a new paradigm on how stakeholders can make cloud storage security implementation successful in some depth. For security practitioners, the CSSF enables deconstruction of the concept of security in cloud storage into smaller, conceptually distinct and manageable factors to guide the design of security in cloud storage. For researchers, the CSSF provides a common framework in which to conceptualise their research and make it easier to see how the security factors fit into the larger picture.

Although the Internet of things (IoT) brought unlimited benefits, it also brought many security issues. The access control is one of the main elements to address these issues. It provides the access to system resources only to authorized users and ensures that they behave in an authorized manner during their access sessions. One of the significant components of any access control model is access policies. They are used to build the criteria to permit or deny any access request. Building an efficient access control model for the IoT require selecting an appropriate access policy language to implement access policies. Therefore, this paper presents an overview of most common access policy languages. It starts with discussing different access control models and features of the access policy. After reviewing different access policy languages, we proposed XACML as the most efficient and appropriate policy language for the IoT as it compatible with different platforms, provides a distributed and flexible approach to work with different access control scenarios of the IoT system. In addition, we proposed an XACML model for an Adaptive Risk-Based Access Control (AdRBAC) for the IoT and showed how the access decision will be made using XACML.

The flow complexity in today’s IoT supply chain is enormous. To produce an item in a global network of suppliers requires a delicate dance of people, assets, systems, information, companies, and even governments. The opportunities for security vulnerabilities abound. In this paper, we describe the security challenges facing an IoT supply chain. We first start by describing what an IoT endpoint is, their various types together with their concomitant security challenges. An IoT endpoint is an output of an IoT supply chain, and the enumeration of its security challenges is then used to describe what IoT attack surfaces are, together with the threats and vulnerabilities facing a typical IoT supply chain. We use the iPhone/Apple supply chain as an exemplar, creating a map, and using that map to depict likely vulnerabilities and attacks. We conclude by discussing the mitigations against potential vulnerabilities in such a supply chain.

As a result of the very difficult weather in Saudi Arabia during the summer, there is too high power peak demand in the grid and this is expected to increase in the next decade. To fix this problem, power consumers should participate in the power production. Vehicle-to-grid (V2G), one of the efficient sustainable technologies, can offer this opportunity. It is defined as a concept where electric vehicle (EV) provides electric to the grid when parked. This investigation looks at the feasibility of using V2G to mitigate the problem of highest electricity peak demand in the summer period in one of the warmest countries of the world (Saudi Arabia). We conduct a survey in order to serve this issue and we use information from Saudi Arabia electricity authority. We found that, V2G is a promising solution to the peak demand challenge in the summer in Saudi Arabia since there is about 80% of the sample interested in using V2G technology. Moreover, 90% of the participants used their vehicles less than 4 hours daily. Furthermore, in the summer period, most of the participants park their vehicles for the longest time between 13:00 to 18:00, which is the peak demand period.

The Internet of Things (IoT) represents a modern approach where boundaries between real and digital domains are progressively eliminated by changing over consistently every physical device to smart object ready to provide valuable services. These services provide a vital role in different life domains but at the same time create new challenges particularly in security and privacy. Authentication and access control models are considered as the essential elements to address these security and privacy challenges. Risk-based access control model is one of the dynamic access control models that provides more flexibility in accessing system resources. This model performs a risk analysis to estimate the security risk associated with each access request and uses the estimated risk to make the access decision. One of the essential elements in this model is the risk estimation process. Estimating risk is a complex operation that requires the consideration of a variety of factors in the access control environment. Moreover, the interpretation and estimation of the risk might vary depending on the working domain. This paper presents a review of different risk estimation techniques. Existing risk-based access control models are discussed and compared in terms of the risk estimation technique, risk factors, and the evaluation domain. Requirements for choosing the appropriate risk estimation technique for the IoT system are also demonstrated.

The smart devices have been used in the most major domain like the healthcare, transportation, smart home, smart city and more. However, this technology has been exposed to many vulnerabilities, which may lead to cybercrime through the devices. With the IoT constraints and low-security mechanisms applied, the device could be easily been attacked, treated and exploited by cyber criminals where the smart devices could provide wrong data where it can lead to wrong interpretation and actuation to the legitimate users. To comply with the IoT characteristics, two approaches towards of having the investigation for IoT forensic is proposed by emphasizing the pre-investigation phase and implementing the real-time investigation to ensure the data and potential evidence is collected and preserved throughout the investigation.

Due to the limited availability of fuel resources, there is an urgent need for converting to use renewable sources efficiently. To achieve this, power consumers should participate actively in power production and consumption. Consumers nowadays can produce power and consume a portion of it locally, and then could offer the rest of the power to the grid. Vehicle-to-grid (V2G) which is one of the most effective sustainable solutions, could provide these opportunities. V2G can be defined as a situation where electric vehicles (EVs) offer electric power to the grid when parked. We developed an agent to trade on behalf of V2G users to maximize their profits in a day-ahead price market. We then ran the proposed model in three different scenarios using an optimal algorithm and compared the results of our solution to a benchmark. We show that our solution outperforms the benchmark strategy in the proposed three scenarios 49%, 51%, and 10% respectively in terms of profit.

The area of visualization in cyber-security is advancing at a fast pace. However, there is a lack of standardized guidelines for designing and evaluating the resulting visualizations. Furthermore, limited end-user involvement in the design process leads to visualizations that are generic and often ineffective for cyber-security analysts. Thus, the adoption of the resultant cyber-security visualizations is low and this highlights a major research gap. This paper presents expert-interview based validation of EEVi - a model developed to aid in the design and evaluation process of cyber-security visualizations, with a view to make them more effective for cyber-security analysts. A visualization is considered effective if the characteristics of the visualization are essential for an analyst to competently perform a certain task. Thirteen experts were interviewed (six visualization designers and seven cyber-security analysts) and their feedback guided revisions to the model. The responses were subsequently transposed from qualitative data to quantitive data in order to perform statistical analyses on the overall data. This demonstrated that the perspectives of visualization designers and cyber-security analysts generally agreed in their views of effective characteristics for cyber-security visualization, however there was no statistically significant correlation in their responses.

Data Integration Systems (DIS) are concerned with integrating data from multiple data sources to resolve user queries. Typically, organisations providing data sources specify security policies that impose stringent requirements on the collection, processing, and disclosure of personal and sensitive data. If the security policies were not correctly enforced by the integration component of DIS, the data is exposed to data leakage threats, e.g. unauthorised disclosure or secondary use of the data. SecureDIS is a framework that helps system designers to mitigate data leakage threats during the early phases of DIS development. SecureDIS provides designers with a set of informal guidelines written in natural language to specify and enforce security policies that capture confidentiality, privacy, and trust properties. In this paper, we apply a formal approach to model a DIS with the SecureDIS security policies and verify the correctness and consistency of the model. The model can be used as a basis to perform security policies analysis or automatically generate a Java code to enforce those policies within DIS.

Electronic documents within any enterprise are an asset and securing these assets is a priority, since each year organizations losses billions in Intellectual Property (IP) due to document leakage. The challenge is that electronic documents cannot be fully protected outside the originators enterprise network with exception of a small number of propriety solutions. The solution presented in this paper proposes a framework to produce intelligent documents that can be programmed to detect its location within a network and be involved in the decisions process for basic operation (read, edit, and copy). Therefore, the document should maintain its integrity by preventing content modification. The framework incorporates active intelligent document concepts operating under Digital Right Management (DRM) to provide a measure of security for electronic documents beyond the boundaries of organizations supported by our illustration.

Cloud computing is paradigm that has emerged to deliver IT services to consumers as a utility service over the Internet. In developing countries, particularly Saudi Arabia, cloud computing is still not widely adopted. As a result, this study seeks to investigate the most influential factors that can encourage an organisation to use the cloud or which might impede them from moving to it. This research proposes an integrated model that incorporates aspects of the Technology-Organisation-Environment (TOE) framework and integrates the critical factors from existing theories along with other factors to examine the impact of this variable on the adoption decision of enterprises. Future work will be focused on confirming the proposed model.

As cloud becomes the tool of choice for more data storage services, the number of service providers has also increased. With these choices, organisations have a wide selection of services available to move their data to the cloud. However, the responsibility to maintain the security of sensitive data stored therein remains paramount. This paper will discuss some of the challenges of securing a cloud storage and putting it into context by reviewing relevant literature. The challenges associated with the three important security aspects (confidentiality, integrity and availability) are discussed together with the vulnerabilities linked to them. It is important to look into these challenges as cloud storage is not only about technological evolution but involves security considerations. We aim to provide insights of security challenges and its solutions to enhance cloud storage implementation.

This paper generally focus on how and where linked data could be integrated and used in the development of semantic feedback for teaching and learning in physical education. Feedback may currently be generated based upon a competence model. To achieve semantic interoperability and increase the level of reusability of feedback, competence should be represented as an explicitly defined, structured, and shared ontology. By providing shareable ways of representing a competence model, hierarchy or a cyclic directed graph, human and machine would be helped to communicate easily in comparing competence structures and exchanging semantic feedback. Competence structures and semantic feedback could be published on the web using linked data principles. Linked data allows both coaches and athletes to browse the athlete's feedback and navigate the related competence structures and training materials.

The paper proposes the intended learning outcome (ILO) diagram -" a novel conceptual model for curriculum development. The design of an ILO structure and its components are introduced, and its corresponding ILO diagram and relationships are presented and discussed. An experimental study of how structured ILOs (visualised through an ILO diagram) meets instructors' satisfaction is reported and summarised. The results revealed that the mean ratings of perceived usefulness, perceived ease of use, and attitude towards representing ILOs, were significantly higher with the ILO diagram.

Feedback is an important ingredient to enhance athletes' skill acquisition. Currently, feedback design in the motor skill domain via Computer-based Sport Training (CBST) can be categorized as: (1) feedback content, such as speed, accuracy, movement, time, and reaction time, (2) providing athletes with access to their feedback via an appropriate user interface, and (3) feedback modality, such as visual, audio, tactile, and haptic. The current feedback is led by technology and does not explicitly address the pedagogical issues on the achievement of intended training outcomes. To overcome the limitations of current feedback design in CBST, this paper suggests the design of feedback that is based on a pedagogical approach.

The central question addressed in this paper is the appropriate formal representation of learning outcomes in the motor skill domain so they can be interpreted and manipulated by computers as well as humans for the implementation of Computer based Sport Training (CBST). Instructional design usually begins with the specification of behavioural objectives or intended learning outcomes. The field of educational psychology has long been sensitive to the desirability of establishing learning objectives for instruction. Computer-processable learning outcomes in the motor skill domain, however, seem to have remained the silent partner of learning outcomes in both the cognitive and affective domains. This paper presents a conceptual model of learning outcomes in the motor skill domain for the implementation of CBST. The heart of this model is to treat athlete's skill as a contextualized space of capability either actual or potential. Rowing is the sport chosen as the study domain.

There exists a traditional conflict in teaching between constructivism (learner’s perspective) and instructionism (instructor's perspective) because they are mutually exclusive and practitioners will support either one idea or the other. In this paper we attempt to bridge the gap between these two theories via a matching strategy through the intended learning outcomes. We propose that the philosophies of constructivism and instructionism can be used to balance the learner's knowledge and instructor's knowledge in order to provide the suitable learning activities to the learners.

This paper reviews current cloud computing business models and presents proposals on how organisations can achieve sustainability by adopting appropriate models. Using the Jericho Forum's Cloud Cube Model (CCM), we classify cloud computing business models into eight types: (1) Service Provider and Service Orientation; (2) Support and Services Contracts; (3) In-House Private Clouds; (4) All-In-One Enterprise Cloud; (5) One-Stop Resources and Services; (6) Government Funding; (7) Venture Capitals; and (8) Entertainment and Social Networking. We newly propose the Hexagon Model that includes six key elements for sustainability based on Sun Tzu's Art of War and literature review, and the sixth factor is rated based on case studies and peer reviews. Areas occupied in the Hexagon can represent strengths and weaknesses of a cloud business, and several cases are presented with rationale explained. Apart from the qualitative approach, the quantitative approach we use is the Capital Asset Pricing Model and Modern Portfolio Theory, both of which aim computing organisational sustainability and predict how well an organisation can perform. The OMII-UK data is used to demonstrate sustainability and study the impact on cloud businesses, and is presented by statistical computation, 3D visualisation and the Hexagon Model. We believe that adopting an appropriate cloud computing business model will help organisations investing in this technology to stand firm at all times.

This paper reviews current cloud computing business models and presents proposals on how organisations can achieve sustainability by adopting appropriate models. We classify cloud computing business models into eight types: (1) Service Provider and Service Orientation; (2) Support and Services Contracts; (3) In-House Private Clouds; (4) All-in-One Enterprise Cloud; (5) One-Stop Resources and Services; (6) Government funding; (7) Venture Capitals; and (8) Entertainment and Social Networking. Using the Jericho Forum's 'Cloud Cube Model' (CCM), the paper presents a summary of the eight business models. We discuss how the CCM fits into each business model, and then based on this discuss each business model's strengths and weaknesses. We hope adopting an appropriate cloud computing business model will help organisations investing in this technology to stand firm in the economic downturn.

Formative eAssessment can be very helpful in providing high quality higher education assignments. However, there are obstacles restricting the uptake of formative eAssessment in higher education including both cultural and technical issues. When a university is encouraging the uptake of formative eAssessment internally it is useful to have case studies from academic schools detailing how academics enthusiastic about formative eAssessment have used it in their modules. It is particularly helpful if these case studies document: i.) the principle obstacles that these champions had to deal with, ii.) a cooperative-design process through which these obstacles have been dealt with by the champions (with assistance from e.g. learning technologists), and iii.) an evaluation of the effectiveness of the resulting formative eAssessments. However there is a shortage of such real-world long-term case studies. This paper helps fill this gap in the literature by describing the case of a Modern Languages module within a Russell Group university (Southampton). The formative eAssessment solution resulting from the case study utilises our QTI, mobile QTI, accessibility, and web 2.0 tools and can be positioned at the cutting edge of formative eAssessment practice. We have evaluated this with undergraduate student volunteers from Spanish modules and received positive feedback.

Most e-learning systems require intervention from a teacher. The development of adaptive hypermedia systems, such as intelligent tutoring systems, aimed to reduce the teachers' task. However, such systems are still at risk of inconsistently modelling the user when estimating a learner's knowledge level. We propose a system called CBSR (Competence based System for Recommending Study Materials) which recommends appropriate study materials from the Web without requiring teacher intervention, based upon a competency model. This has the benefit of an improved pedagogical approach to e-learning, and a more consistent profile of learners' competences which can persist though their life.

Behavioural interventions packages of advice and support for behaviour change are one of the most important methodologies and technologies employed by social scientists for understanding and changing behaviour. A typical web-based behavioural intervention study includes the designing, deploying, piloting and trialling of the intervention as well as data analysis. We have developed a research environment named LifeGuide, which covers the full scope of this process, enabling social scientists to carry out intervention studies with minimal technical expertise. In this paper, we present how the LifeGuide can assist and accelerate intervention research, particularly focusing on supporting the running and analysis of trials of web-based behavioural interventions along with the case study of an intervention that has been developed within the LifeGuide.

With increasingly rapid development in Computer-based Sport Training (CBST), feedback plays an important role in both coaching and learning. A good CBST system includes not only good training strategies but also effective feedback design. Feedback in the motor skill domain via CBST may be synthetically designed to allow athletes to practise in a more effective way, and enhance their skill acquisition. Existing designs lack pedagogical elements. To bridge the gap, we propose a framework for the design of pedagogically-informed feedback based on learning transactions, competence, cybernetics, and behaviourism.

Multimedia has become technically easier to create (e.g. recording lectures) but while users can easily bookmark, search, link to, or tag the WHOLE of a podcast or video recording available on the web they cannot easily find, or associate their notes or resources with, PART of that recording. This paper describes the development of a web based application that makes multimedia web resources (e.g. podcasts) easier to access, search, manage, and exploit for learners, teachers and other users through the creation of notes, bookmarks, tags, links, images and text captions synchronized to any part of the recording.

A considerable number of serious games have been developed over the last ten years, with varying degrees of success. Due to a lack of clear standards and guidelines for game developers, it is difficult to justify claims that a specific game meets the learnerpsilas requirements and/or expectations. This paper defines a conceptual model for serious games that will contribute to their design and the measurement of achievement in meeting their learning outcomes.

This paper describes electronic integrity in the context of curbing double submissions during e-assessments. Submission of examination answers is an important part of assessment whether paper or electronic based. As will be discussed in this paper, double submission of an assessment test by one student is a breach in electronic integrity and it breeds electronic corruption. The proposed solutions will present a method to reduce this problem, by combining studentspsila login ID with static IP addresses for the duration of an e-assessment. This technique will ensure single submission of tests per student in e-learning systems.

Students often build up portfolios of their achievements as they study and present them when they apply for jobs or for further study. Of increasing interest is the concept of an online "ePortfolio" which enables greater power and flexibility in displaying achievements. However, the issue of cheating needs to be addressed, especially where certificates of attainment are being presented. An eCertification project, named ldquoeCertrdquo, has recently been run at Southampton in order to explore these issues. This paper documents how we approach the validation of applicants' claims of attainment.

As research continues into the use of computer games for educational purposes, the differences between different gaming genres become increasingly more important. These differences, however, appear to have been largely overlooked by the academic community, potentially resulting in incomplete results when considered against computer gaming as a whole. This paper studies a selection of games from several different genres, assessing each one in its ability to fulfill a set of previously identified requirements for a good educational resource. The results of the investigation showed that there were indeed differences between the genres, allowing for some suggestions to be made regarding their use, as well as leaving room for some interesting future work.

Work related accidents in the construction industry are at an unacceptably high level. Better education (particularly related to re-training) across all skill levels in the industry is seen as an integral part of any solution. Traditional lecture-based courses often fail to re-create the dynamic realities of managing health and safety (H&S) on-site. They therefore do not sufficiently engage the students in deeper learning (which results in remembering and using what was learned). Interactive video appears to be one method which can aid this process by better engaging students with the material. This paper describes the development of an interactive video used to teach students about risks in setting out on-street traffic engineering experiments.

Students whose professional qualifications are gained through work placement-based learning are assessed as to their competency to carryout tasks. These students are usually supported by mentors, qualified practitioners who regularly meet with them and give feedback on their progress. This support can be highly variable, affecting the quality of the studentspsila learning experience. Through a process of co-design the mPLAT project has created a mobile toolkit to connect studentspsila placement experiences with the professional competency model that they are assessed against. The toolkit does this by matching their learning requirements to a placement and producing an action plan that acts as a focus for their reflection and for their meetings with their mentors.

Interest in educational gaming is on the rise once again, and particular interest has started to peak in the area of lightweight educational mini-games. But are these games really as useful as people suggest, or are they simply too shallow to convey sufficient pedagogical meaning? And how do we assess how well these games measure up as educational resources? This paper first generates a "conclusive" list of educational requirements from a structured review of other researchers proposed requirements. It then presents details of the three most interesting educational mini-games taken from an investigation of around 30. Whilst some games were able to offer immersive, curiosity-provoking experiences full of relevant information, many of the games were shallow, formulaic, and lacking in information. Finally, conclusions and future work are proposed, including the packaging of mini-games into compendia to add depth, the use of mini-games in blended learning scenarios, and mechanisms to harvest the relatively simple player interactions to assist learner assessment. These findings aim to help educators make a more informed decision as to whether these games are right for their educational aims.

Peer assessment (or peer review) is a popular form of reciprocal assessment where students produce feedback, or grades, for each others work. Peer assessment activities can be extremely varied with participants taking different roles at different stages of the process and materials passing between roles in sophisticated patterns. This variety makes designing peer assessment systems very challenging. In this paper we present a number of peer assessment case studies and show how a simple review cycle can be used as a building block to achieve the more complex cases. We then propose a canonical use case for peer assessment, in which a review plan is used to describe how review cycles can be combined to achieve the required complexity.

In this paper we present a new approach to enabling pedagogically sound reuse and re-purposing of online learning objects in a community of practice. The lack of specific software for non-technical users inspired the development of an innovative toolkit. The toolkit allows users to edit learning objects collaboratively in a Wiki-type editing environment and to add and modify context-rich metadata which greatly assists in the efficient retrieval of learning objects. The focus of this paper is on the development of the Wiki-type editor which provides an effective way of re-purposing learning objects in disparate communities.

The design and maintenance of complex engineering systems such as a jet engine generates a significant amount of documentation. Increasingly, aerospace manufacturers are shifting their focus from selling products to providing services. As a result, when designing new engines, engineers must increasingly consider the life-cycle requirements in addition to design parameters. To identify possible areas of concern, engineers must obtain knowledge gained from the entire life of an engine. However, because of the size and distributed nature of a company's operation, engineers often do not have access to front-line maintenance data. In addition, the large number of documents accrued makes it impossible to examine thoroughly. This paper presents a prototype knowledge-based document repository for such an application. It searches and analyzes distributed document resources, and provides engineers with a summary view of the underlying knowledge. The aim is to aid engineers in creating design requirement documents that incorporate aftermarket issues. Unlike existing document repositories and digital libraries, our approach is knowledge-based, where users browse summary reports instead of following suggested links. To test the validity of our proposed architecture, we have developed and deployed a working prototype. The prototype has been demonstrated to engineers and received positive reviews.

Assessment is one of the more established areas of e-learning, but it cannot be described as mature due to the disparate nature of the tools and standards available. As part of our efforts within the FREMA project to create a reference model for assessment we have produced a database of existing resources. As a way of presenting that database we have also developed concept maps that describe the domain and place the resources in context. In this paper we present the process concept map and an initial analysis of the resources behind the map in an effort to map the e- Learning Assessment landscape and show where most development effort has been spent.

It is difficult for a student to learn how to program and to build an understanding of the rationale which underpins the development of a program’s componentparts. Conventional tools and approaches for explaining this essentially dynamic process are limited and typically static in nature. This paper presents AnnAnn, an animated code annotator, which can be used for self study and to present code development to large groups. The technical and educational benefits of this approach are examined.

Increasingly, manufacturing companies are shifting their focus from selling products to providing services. As a result, when designing new products, engineers must increasingly consider the life cycle costs in addition to any design requirements. To identify possible areas of concern, designers are required to consult existing maintenance information from identical products. However, in a large engineering company, the amount of information available is significant and in wide range of formats. This paper presents a prototype knowledge desktop suitable for the design engineer. The Engineering Knowledge Desktop analyses and suggests relevant information from ontologically marked-up heterogeneous web resources. It is designed using a Service-Oriented Architecture, with an ontology to mediate between Web Services. It has been delivered to the user community for evaluation.

Many Semantic Web applications address the needs of human readers of the Web (e.g. searching, annotating), but these technologies can also address the needs of human writers of the Web. The WiCK project has explored the application of knowledge bases and services to the Office desktop, in order to assist document production, culminating in the WiCKOffice environment. This aim of this demonstration is to showcase the most recent offshoot of the WiCKOffice development, WiCKLite: a lightweight component for connecting knowledge services to document templates in order to deliver targeted assistance to end users.

VOEU is a virtual university which we designed, implemented and deployed in the Wessex Region of the UK for use by higher surgical trainees in the orthopaedic domain. A particularly original part of this virtual university is the virtual research environment (VRE) which provides the infrastructure to support trainee surgeons in carrying out and publishing research and clinical trails. The current implementation of the VRE is tightly coupled, but we are now engaged in a new project to redeploy the VRE as loosely coupled grid services. This paper describes the VRE, and discusses the advantages that will be achieved by implementing it as grid services.

The Web is full of documents which must be interpreted by human readers and by software agents (search engines recommender systems clustering processes etc.). Although Web standards have addressed format obfuscation by using XML schemas and stylesheets to specify unambiguous structure and presentation semantics interpretation is still hampered by the fundamental ambiguity of information in PCDATA text. Even the most easily distinguishable kinds of knowledge such as article citations and proper nouns (referring to people organisations projects products technical concepts) have to be identified by fallible post-hoc extraction processes. The WiCK project has investigated the writing process in a Semantic Web environment where knowledge services exist and actively assist the author. In this paper we discuss the need to make knowledge an explicit part of the document representation and the advantages and disadvantages of this step.