A gap analysis of Internet-of-Things platforms

We are experiencing an abundance of Internet-of-Things (IoT) middleware solutions that provide connectivity for sensors and actuators to the Internet. To gain a widespread adoption, these middleware solutions, referred to as platforms, have to meet the expectations of different players in the IoT ecosystem, including device providers, application developers, and end-users, among others. In this article, we evaluate a representative sample of these platforms, both proprietary and open-source, on the basis of their ability to meet the expectations of different IoT users. The evaluation is thus more focused on how ready and usable these platforms are for IoT ecosystem players, rather than on the peculiarities of the underlying technological layers. The evaluation is carried out as a gap analysis of the current IoT landscape with respect to (i) the support for heterogeneous sensing and actuating technologies, (ii) the data ownership and its implications for security and privacy, (iii) data processing and data sharing capabilities, (iv) the support offered to application developers, (v) the completeness of an IoT ecosystem, and (vi) the availability of dedicated IoT marketplaces. The gap analysis aims to highlight the deficiencies of today's solutions to improve their integration to tomorrow's ecosystems. In order to strengthen the finding of our analysis, we conducted a survey among the partners of the Finnish IoT program, counting over 350 experts, to evaluate the most critical issues for the development of future IoT platforms. Based on the results of our analysis and our survey, we conclude this article with a list of recommendations for extending these IoT platforms in order to fill in the gaps.Comment: 15 pages, 4 figures, 3 tables, Accepted for publication in Computer Communications, special issue on the Internet of Things: Research challenges and solution

Masquerader detection in mobile context based on behaviour and environment monitoring

Mobiilipäätelaitteiden, matkapuhelimien ja kämmentietokoneiden yleistymisen myötä riski näiden laitteiden väärinkäytölle on kasvanut. Matkapuhelimia ja kämmentietokoneita varastetaan ja hukataan koko ajan. Tällöin on mahdollista laitteen päätyminen henkilölle, joka voi käyttää laitetta luvattomasti. Luvattoman käytön estämiseksi on syntynyt tarve turvajärjestelmälle, jonka avulla voidaan varmistaa, että mobiilipäätelaitetta käyttävällä henkilöllä on oikeus laitteen käyttöön.Mazhelis kehitti väitöskirjassaan menetelmää, jonka avulla mobiilipäätelaitteen laillinen käyttäjä erotetaan muista henkilöistä. Tähän pyritään käytön aikaista toimintaa ja toimintaympäristön informaatiota analysoimalla.Mazhelisin kehittämä malli koostuu kolmesta osasta. Ensimmäiseksi määritellään käyttäjien persoonallisuutta heijastelevia käytön ja käyttöympäristön mittareita. Toiseksi muodostetaan yksiluokkaisten luokittelijoiden kokoelma. Kukin luokittelija analysoi mittausarvojen osajoukkoa. Kolmanneksi Mazhelis yhdisti yksiluokkaisten luokittelijoiden antamat tulokset mahdollisimman luotettavan lopputuloksen kokoamiseksi kehittämällä ja validoimalla uuden yhdistämistekniikan.In recent years, mobile terminals such as mobile phones and PDAs have evolved into functionally powerful devices that can be used to store, process, and communicate valuable information. The access to this information should be properly secured, and hence a great demand for security systems exists. The security issue emphasised in this thesis is the necessity to ensure that the current user of the terminal is its legitimate user. The importance of this issue stems from the fact that a number of mobile terminals are lost or stolen daily: the unauthorised use of such a terminal by a masquerader impersonating the legitimate user may involve abuse of sensitive information kept locally on the terminal or accessible over a network connection. The aim of the reported research is to develop a conceptual basis for differentiating between the legitimate user of the terminal and other individuals by analysing the information about user behaviour and environment, and to address the practical issue of applying it to the problem of mobile-masquerader detection.The main contribution of this thesis is a three-part model of mobile-masquerader detection developed and verified empirically in the thesis. In this model, the problem of mobile-masquerader detection is approached as a classification problem.The first part of the model identifies behavioural and environmental characteristics and measures that can be used for differentiating the user from other individuals. The second part of the model defines how the values of the identified measures can be classified by a set of one-class classifiers each analysing a subset of the measures. The third part addresses the issue of combining the outputs of the classifiers so that accurate final classification can be achieved; a new combining technique is proposed and validated using numerical experiments.Finally, the feasibility of the proposed mobile-masquerader detection model is experimentally validated on a real-world dataset describing the behaviour and environment of smart-phone user

One-Class Classifiers : A Review and Analysis of Suitability in the Context of Mobile-Masquerader Detection

One-class classifiers employing for training only the data from one class are justified when the data from other classes is difficult to obtain. In particular, their use is justified in mobile-masquerader detection, where user characteristics are classified as belonging to the legitimate user class or to the impostor class, and where collecting the data originated from impostors is problematic. This paper systematically reviews various one-class classification methods, and analyses their suitability in the context of mobile-masquerader detection. For each classification method, its sensitivity to the errors in the training set, computational requirements, and other characteristics are considered. After that, for each category of features used in masquerader detection, suitable classifiers are identified.peerReviewe

Role of Data Communications in Hybrid Cloud Costs

Rapid adoption of cloud services in recent years has been driven by multiple factors, such as faster time-to-market and improved scalability enabled by public cloud infrastructure. Hybrid clouds, combining the in-house capacities with on-demand capacity of public clouds, achieve both the increased utilization rate of the in-house infrastructure and the limited use of more expensive public cloud, thereby lowering the total costs for the cloud user. In this paper, an analytical model of hybrid cloud costs is introduced, wherein the costs of computing and data communication are taken into account. Using this model, the costefficient division of the computing capacity between the private and the public portion of a hybrid cloud can be identified. By analyzing the model, it is shown analytically that the greater the volume of data transferred to/from the public cloud, the greater portion of the capacity should be allocated to the private cloud.peerReviewe

The Place and Role of Security Patterns in Software Development Process

Security is one of the key quality attributes for many contemporary software products. Designing, developing, and maintaining such software necessitates the use of a secure-software development process which specifies how achieving this quality goal can be supported throughout the development life-cycle. In addition to satisfying the explicitly-stated functional security requirements, such process is aimed at minimising the number of vulnerabilities in the design and the implementation of the software. The secure software development is a challenging task spanning various stages of the development process. This inherent difficulty may be to some extent alleviated by the use of the so-called security patterns, which encapsulate knowledge about successful solutions to recurring security problems. The paper provides an overview of the state of the art in the secure software development processes and describes the role and place of security patterns in these processes. The current usage of patterns in the secure software development is analysed, taking into account both the role of patterns in the development processes, and the limitations of the security patterns available.peerReviewe

Cost Efficiency of Hybrid Cloud Storage : Shortening Acquisition Cycle to Mitigate Volume Variation

Hybrid cloud storage infrastructure, which combines cost-effective but inflexible private resources and flexible but premium-priced public cloud storage, allows organizations to operate cost-efficiently under demand volume uncertainty. The extant literature, however, offers a limited analytical insight into the effect that the variation of demand has on the cost-efficient mix of internal and external resources. This paper considers the storage capacity acquisition cycle, i.e. the interval at which the organization re-assesses and acquires additional resources, as a parameter shaping the optimal mix of resources. It introduces a model capturing the compound effect of the acquisition cycle and volume variation on the cost-efficiency of hybrid cloud storage. The model is analytically investigated to demonstrate its inherent regularities, and empirically evaluated in numerical experiments. The analysis indicates that shortening the acquisition cycle reduces the volume variability thus reducing the costs. The costs decrease further if shortening the cycle reduces the demand volume uncertainty.peerReviewe

Cost benefits of flexible hybrid cloud storage : Mitigating volume variation with shorter acquisition cycle

Hybrid cloud storage combines cost-effective but inflexible private storage along with flexible but premium-priced public cloud storage. As a form of concurrent sourcing, it offers flexibility and cost benefits to organizations by allowing them to operate at a cost-optimal scale and scope under demand volume uncertainty. However, the extant literature offers limited analytical insight into the effect that the non-stationarity (i.e., variability) and non-determinism (i.e., uncertainty) of the demand volume – in other words, the demand variation – have on the cost-efficient mix of internal and external sourcing. In this paper, we focus on the reassessment interval – that is, the interval at which the organization re-assesses its storage needs and acquires additional resources –, as well as on the impacts it has on the optimal mix of sourcing. We introduce an analytical cost model that captures the compound effect of the reassessment interval and volume variation on the cost-efficiency of hybrid cloud storage. The model is analytically investigated and empirically evaluated in simulation studies reflecting real-life scenarios. The results confirm that shortening the reassessment interval allows volume variability to be reduced, yielding a reduction of the overall costs. The overall costs are further reduced if, by shortening the interval, the demand uncertainty is also reduced.peerReviewe

Impact of Storage Acquisition Intervals on the Cost-Efficiency of the Private vs. Public Storage

The volume of worldwide digital content has increased nine-fold within the last five years, and this immense growth is predicted to continue in foreseeable future reaching 8ZB already by 2015. Traditionally, in order to cope with the growing demand for storage capacity, organizations proactively built and managed their private storage facilities. Recently, with the proliferation of public cloud infrastructure offerings, many organizations, instead, welcomed the alternative of outsourcing their storage needs to the providers of public cloud storage services. The comparative cost-efficiency of these two alternatives depends on a number of factors, among which are e.g. the prices of the public and private storage, the charging and the storage acquisition intervals, and the predictability of the demand for storage. In this paper, we study how the cost-efficiency of the private vs. public storage depends on the acquisition interval at which the organization re-assesses its storage needs and acquires additional private storage. The analysis in the paper suggests that the shorter the acquisition interval, the more likely it is that the private storage solution is less expensive as compared with the public cloud infrastructure. This phenomenon is also illustrated in the paper numerically using the storage needs encountered by a university back-up and archiving service as an example. Since the acquisition interval is determined by the organization's ability to foresee the growth of storage demand, by the provisioning schedules of storage equipment providers, and by internal practices of the organization, among other factors, the organization owning a private storage solution may want to control some of these factors in order to attain a shorter acquisition interval and thus make the private storage (more) cost-efficient.peerReviewe

Cloud Services Pricing Models

A major condition for commercial success is a well-defined pricing strategy, however, cloud service providers face many challenges around pricing. Clearness and transparency in pricing is beneficial for all the actors in the ecosystem, where the currently existing abundance of different pricing models makes decision making difficult for service providers, partners, customers and competitors. In this paper, the SBIFT pricing model is evaluated and updated to cloud context. As a result, a 7-dimensional cloud pricing framework is proposed that helps clarifying the possible pricing models in order to let companies differentiate themselves from competitors by price. The framework can be used also as a tool for price model development and communication about cloud pricing. The taxonomy is based on a broad literature review and empirical research on currently used pricing models of 54 cloud providers.peerReviewe