Performing high-level surgeries with endoscopy is challenging, and hence, an efficient surgical training method or system is required. Serious game–based simulators can provide a trainee-centered educational environment unlike traditional teacher-centered education environments since serious games provide a high level of interaction (feedback that induces learning).This study aimed to propose an epiduroscopy simulator, EpiduroSIM, based on a serious game for spatial cognitive training.EpiduroSIM was designed based on a serious game. For spatial cognitive training, the virtual environment of EpiduroSIM was modeled based on a cognitive map.EpiduroSIM was developed considering user accessibility to provide various functions. The experiment for the validation of EpiduroSIM focused on psychological fidelity and repetitive training effects. The experiments were conducted by dividing 16 specialists into 2 groups of 8 surgeons. The group was divided into beginner and expert based on their epiduroscopy experience. The psychological fidelity of EpiduroSIM was confirmed through the training results of the expert group rather than the beginner group. In addition, the repetitive training effect of EpiduroSIM was confirmed by improving the training results in the beginner group.EpiduroSIM may be useful for training beginner surgeons in epiduroscopy. An epiduroscopy is a highly effective minimally invasive surgery (MIS) used for chronic lumbago and lumbar disc herniation . In an MConventional surgical training is performed using surgery observations, animals, cadavers, and plastic models. Surgery observation is achieved by assisting expert surgeons in the operation room. Such surgical training has limited training opportunities, and the interaction between surgical instruments and human organs is difficult to train . SurgicaRecently, surgical training has been performed using a simulator. The simulator provides an opportunity for the trainee to repeatedly attempt various actions, including mistakes, in a virtual environment . In addiIn this study, we proposed an epiduroscopy simulator (EpiduroSIM) based on a serious game for spatial cognitive training. EpiduroSIM aims to provide a trainee-centered educational environment for teaching the insertion paths of the surgical instrument (catheter).In this study, we focused on EpiduroSIM based on a serious game and the cognitive map for self-directed learning of the beginner. Herein, the beginner means a surgeon who has no experience or has low understanding of epiduroscopy. Design of EpiduroSIM and modeling of the virtual environment were achieved through consultation with neurosurgeons.EpiduroSIM was designed based on the game elements of the serious game, as shown in Humans form a cognitive map through a series of processes that recognize the space or environment that they experience. In general, the cognitive map consists of an important point called a landmark and a surrounding area connecting these points . This isThe cognitive map is divided into the route map and survey map based on the form and characteristics . The rouThe virtual environment of EpiduroSIM is modeled based on the cognitive map as shown in Hierarchical spatial cognition  does notEpiduroSIM provides various catheter insertion scenarios for spatial cognitive training. EpiduroSIM consists of the input part, processing part, and output part, as shown in EpiduroSIM was developed using Unity3D (Unity technologies Corp), a commercial game engine. The developed EpiduroSIM provides an easy operation method and various functions considering user accessibility, as shown in The catheter insertion training in the developed EpiduroSIM proceeds in the following order: (1) select a training scenario, (2) begin training, (3) move the catheter tooltip to the destination (lesion), and (4) validate the training results. If the trainee selects a training scenario other than the free scenario, a virtual fixture in the form of a tube is created, as shown in The experiments were designed to focus on the fidelity and repetitive training effects. Fidelity represents the degree to which the simulator matches the real environment and skills ,21. FideThe training result in the simulator based on iterations generally appears as learning curves. This means that the training result is improved as the training using the simulator is repeated. This improvement in the training result does not necessarily imply that the trainee is acquiring actual skills. However, improved training results in simulators that train basic skills such as hand and tool movement can lead to the acquisition of actual skills . This tyThe experiments were conducted by dividing 16 specialists into 2 groups of 8 surgeons. The group was divided into beginner and expert based on their epiduroscopy experience. The sample size (n=16) of the subject was calculated with a .05 significance level, 0.9 power, and 0.3 effect size using G*Power 3 (Heinrich Heine University Düsseldorf) .P<.05 was set.The experimental environment consists of EpiduroSIM and gamepad as shown in The results of comparison between the 2 groups (beginner and expert) are shown in In this study, we proposed an epiduroscopy simulator (EpiduroSIM) based on a serious game for spatial cognitive training. EpiduroSIM was designed based on a game element of a serious game. The objective of EpiduroSIM was to help beginners learn the insertion path of the catheter inside the human body. Therefore, EpiduroSIM provides various scenarios of catheter insertion to the trainee as content in the virtual environment modeled by the cognitive map. The interaction between EpiduroSIM and the trainee was achieved through visual feedback based on the virtual fixture. Through this interaction, the trainee learns a correct insertion path. Finally, the EpiduroSIM provides the training results of the insertion completion time of the catheter and the mistakes (number of collisions) that occurred during the insertion process to improve the motivation and self-confidence of the trainee.The experiment for the validation of EpiduroSIM focused on the psychological fidelity and repetitive training effects. On the basis of a comparative result between the expert and beginner groups, it can be concluded that the expert group completed catheter insertion faster with fewer collisions than the beginner group. The result indicates that the understanding of actual surgery is well applied  in EpiduroSIM. From the repeated training results for each group, the beginner group showed a decrease in the number of collisions and completion time. Generally, surgery is evaluated based on the surgical time (completion time) and mistakes (number of collisions) that occur during the surgery. Therefore, the decrease in the completion time and the number of collisions in the beginner group means that the understanding of the surgery has increased. However, there was no repeated training effect in the expert group. The reason could be that experts have a higher understanding of the surgery before training by actual surgical experience compared with the beginners.Cognition is a general term used to describe mental activities related to thinking, learning, and memory . CognitiOwing to the proven efficacy in the sport and aviation sectors, studies have been conducted on using cognitive training for surgical training. In a study on the relationship between surgical proficiency and cognitive processes, surgical competence reportedly combined the intellectual movements of decision making with the ability to perform mechanical tasks . In a stOwing to MIS, the ability to perform mechanical tasks has become important but the importance of cognitive skills has not diminished. As laparoscopic surgeries and robotic surgeries require significant levels of cognitive and decision-making abilities , a few sWe herein proposed EpiduroSIM based on a serious game for spatial cognitive training. To learn the catheter insertion paths in the human body, EpiduroSIM was designed based on the game elements of the serious educational game. For spatial cognitive training, the virtual environment of EpiduroSIM was modeled based on a cognitive map. EpiduroSIM was developed to provide various functions considering user accessibility. The experiment for the validation of EpiduroSIM focused on the psychological fidelity and repetitive training effects. The psychological fidelity of EpiduroSIM was confirmed through the training results of the expert group rather than the beginner group. In addition, the repetitive training effect of EpiduroSIM was confirmed by improving the training results in the beginner group.Serious games based on the game elements for entertainment are differentiated from simulators for reflecting reality . A serioTherefore, EpiduroSIM provides high-level accessibility to beginners for self-directed learning without past knowledge of the simulator, but it has a limitation that it does not provide the same experience as actual surgery such as the kinesthetic sense.Serious games have begun to be applied to various applications, including medical education. However, further studies are still required to popularize serious games. We herein applied the cognitive map to the insertion paths training of a surgical instrument to study the cognitive development process during knowledge gain. In the future, we expect the importance of cognitive training in surgical education to increase, and we hope that the results of this study will be used in cognitive training studies.


A systematic study of several SBR compounds filled with carbon black of various grades were analysed with the high-frequency Dynamic Mechanical Analyzer (HF DMA) in order to quantify the degree of nonlinearity induced by fillers in rubber compounds. These filler grades indirectly reflect different degrees of microdispersion, which seems to be the main influence on the superharmonic resonance phenomenon observed in HF DMA. This statement arises from the comparison of the microdispersion observed in TEM images. In the second part of the paper, a model compound filled with carbon black is enhanced with a standard reinforcing resin, which leads to a more compact filler network. This induces a higher superharmonic resonance response as well as a higher transmissibility behaviour. Fillers are introduced into rubber compounds to improve their mechanical properties such as elongation at break, shore hardness, and abrasion ,2,3. It Vibrational resonance was first reported by Landa and McClintock  in orderIn the previous investigation, a superharmonic resonance phenomenon was observed in rubber compounds using the Fourier analysis of the resonance peak from HF DMA . There eIn another investigation, it was concluded that novolac-type phenolic resin changes the interfacial properties of the carbon black (CB) filler network . This waThe current investigation is divided into two parts; the influence of polymer types and carbon black grades, and the influence of reinforcing resins. In the first part, an isoprene rubber (IR) filled with N339 carbon black is compared with a solution-polymerized styrene-butadiene rubber (SSBR)-type of the same filler grade. Then, using the SSBR compound as a base, three different filler grades, N121, N339, and N550 are used to compare the filler grade influence on the superharmonic resonance. The second part of the paper aims to further elucidate the superharmonic resonance by introducing reinforcing resin which has been proven to reduce the percolation threshold by modifying the carbon black interfaces.®, Netzsch, Alhden, Germany), while the high-frequency DMA is able to reach values of around 300 The main tool for this investigation is the high-frequency DMA, VHF104 by Metravib, Lyon, France. The general concept of the device is the measurement of the resonance peak on a system comprising of the sample and two metal cylinders; one acting as the excitation base and the other as the preload force onto the sample. The fundamental advantage of this device is the ability to directly measure the mechanical response of a material up to 10 kHz, as opposed to other traditional DMA devices which typically have a maximum frequency of 100 Hz. In terms of absolute deformation amplitude, the latter can achieve values of 9 mm at low frequencies  analysis was performed on a JEM1400 Instrument  using a voltage of 100 kV. In order to investigate the CB network structure, samples were measured in the bulk state. Thin slices of approximately 60 nm were prepared by using a cryo-ultramicrotome (Leica EM UC6/EM FC6) equipped with a diamond knife.The samples chosen for the investigation are solution-polymerized styrene-butadiene rubber (SSBR) compounds with three different grades of carbon black; N121, N339, and N550, at various concentration levels. Additionally, isoprene rubber (IR) compounds with various concentrations of CB N339 and reinforcing resin were investigated. These recipes are summarised in The analytical approach for the extraction of superharmonic resonance values has been discussed elsewhere . The firIn the same investigation, the amount of N339 carbon black was varied in SSBR and measured with HF DMA. Two distinct nonlinearities were observed; the nonlinearity originating from the polymer, and the filler-induced nonlinearity. Above the percolation threshold, the latter becomes more dominant than the former. In the aforementioned investigation, the applied strain was assumed to be constant throughout the measurement range. This assumption was sufficient within the experimental setup as to understand the nonlinear behaviour observed. Increasing the level of compound complexity requires a more rigorous consideration of the strains.When considering different compounds, it is important to note that the excitation input of the experiment is a function of both amplitude and frequency. There is, however, an instrumental limitation on the excitation since a substantial amount of power would be required to have a large amplitude at higher frequencies. As shown in Since the resonance frequency The nSHR values between SBR-filled compounds and IR-filled compounds are shown in The three variants of CB grades are known to have different filler structure and size. It is also known that the CB structure plays an important role in the nonlinearity of the compound within FT Rheology . TherefoWhen comparing the resonance frequency in HF DMA with respect to the CB volume fraction, as shown in The normalised superharmonic resonance as a function of CB volume fraction is shown in In the previous investigation, it was concluded that novolac-type phenolic resin changes the interfacial properties of the CB filler network . This reThe resonance amplitude is inversely proportional to the damping coefficient. Looking at the resonance amplitude of the first vibrational mode in Observing the normalised superharmonic resonance (nSHR) values in A systematic study of three variants of SBR matrix filled with either N121, N339, or N550 carbon black grades was performed in order to elaborate the superharmonic resonance effects in terms of filler volume fractions. The filler-induced nonlinearity in the N550 compound is much weaker than the other two counterparts, indicating that the microdispersion of the filler plays a role in the superharmonic resonance effects, as validated by TEM images. Following this, reinforcing resin was introduced in an IR matrix in order to investigate the effects of a compact filler network. The compactness of the filler network leads to the compounds with high resin content to exhibit a significantly high normalised superharmonic resonance, further consolidating the hypothesis that the filler network is indeed inducing a secondary mechanical propagation wave which leads to the nonlinearity effects of filled compounds.


Studies of orthognathic surgery often focus on pre-surgical versus post-surgical changes in facial shape. In contrast, this study provides an innovative comparison between post-surgical and control shape. Forty orthognathic surgery patients were included, who underwent three different types of surgical correction: Le Fort I maxillary advancement, bilateral sagittal split mandibular advancement, and bimaxillary advancement surgery. Control facial images were captured from volunteers from local communities in Glasgow, with patterns of age, sex, and ethnic background that matched those of the surgical patients. Facial models were fitted and Procrustes registration and principal components analysis used to allow quantitative analysis, including the comparison of group mean shape and mean asymmetry. The primary characteristic of the difference in shape was found to be residual mandibular prognathism in the group of female patients who underwent Le Fort I maxillary advancement. Individual cases were assessed against this type of shape difference, using a quantitative scale to aid clinical audit. Analysis of the combined surgical groups provided strong evidence that surgery reduces asymmetry in some parts of the face such as the upper lip region. No evidence was found that mean asymmetry in post-surgical patients is greater than that in controls. One of the main objectives of orthognathic surgery is to normalize the patient’s dentofacial morphology by bringing them within the range of normal facial shape. Quantitative evaluation of the outcome of orthognathic surgery is therefore essential, with characterization of the normal facial shape a crucial component in achieving this.Methods of assessing facial changes have predominantly been based on two-dimensional radiographs in the form of lateral cephalograms. Registration of pre- and post-surgical radiographs allows both bone and soft tissue changes to be quantifiedCurrently there are no standardized outcome measures to assess the soft tissue changes produced following orthognathic surgery. Previous studies have reported on soft tissue changes between pre-surgery and post-surgery facial shapes. Very few studies have reported on the outcome of surgery in comparison to a ‘normal’ reference groupSystematic analysis requires structured information to be derived from raw facial surface images, to allow clear anatomical interpretation. Landmarks are a traditional and very useful starting point, but representations of the full facial surface provide much richer mechanisms for studying the shapes, and shape changes, of interest. There are several approaches to constructing surface representations, with a majority of these employing landmarks as a starting point. A common approach employs a surface template that is deformed, or warped, so that landmark positions on the template match exactly those on the surface of interest. This approach has been used to develop a dense point correspondence model, where standardized non-landmark locations on the image of interest are identified as the closest points to the corresponding positions on the warped templateThe aim of this study was to perform a systematic analysis of images from post-surgical orthognathic patients in order to assess outcomes. The principal focus was on the comparison of postoperative facial appearance with the facial shape of controls. This was first conducted at the group level, to explore evidence of any systematic differences in outcome among patients undergoing orthognathic surgery. It was also applied at the individual level to assess the post-surgical shape of particular patients.The 3D facial images of 40 patients due to undergo orthognathic surgery were captured at the University of Glasgow Dental School using a stereophotogrammetric camera system  and a capture protocol developed by the Face3D project, funded by the Wellcome Trust (see funding acknowledgements).n = 20), bilateral sagittal split mandibular advancement (n = 8), and bimaxillary advancement surgery (n = 12). The vertical maxillary position did not require correction. None of the patients exhibited facial asymmetry that warranted surgical correction. All orthognathic patients were captured shortly before surgery and at 1 year post-surgery.All patients were diagnosed and had surgery planned using a comprehensive clinical and radiographic assessment performed by the multidisciplinary team. Patients were subdivided into three groups according to the surgical correction performed: Le Fort I maxillary advancement  all parents and grandparents of White British, White Scottish, or White Irish origin (note that White Scottish is not a subset of White British); (2) no history of cleft lip/palate in the individual or a first-degree relative; (3) no history of facial accidents, facial surgery, or interest in seeking facial surgery; (4) age <53 years, to match the age range of the orthognathic patients.In selecting control subjects, it was possible that some would exhibit facial dysmorphology that trained medical personnel might advise merits orthognathic correction. However, inclusion criteria 2 and 3 made the probability of severe clinical dysmorphology low, and the presence of a small number of cases of mild dysmorphology would not substantially affect results in a control group of this size. Retaining any such marginal cases also would have the merit of properly reflecting the facial variation present in the population at large.All images were manually annotated with 23 standard anatomical landmarks, as indicated in the left hand image of The first step in exploring differences between the post-surgical and control populations was to register the images through generalized Procrustes superimposition on the discretized mesh . A more detailed analysis of individual PCs was also performed through t-tests. PCs are constructed not to identify differences between groups but the shape changes that successively capture as much variability as possible. The first few components therefore correspond to the dominant general sources of variability in facial shape, while lower components are more likely to carry the information on group differences.Evidence of differences in mean shape was assessed through a two-sample Hotelling With several groups to be compared to controls, a single global assessment of the evidence for change in mean shape across all groups was conducted simultaneously. However, as different surgical groups may display different departures from the shape of controls, separate analyses based on the comparison of each group against controls were applied to maximize the opportunity for these differences to be expressed.t-tests were used to assess the evidence for differences in pre-surgical and post-surgical mean asymmetry scores, within each surgical group.An assessment of facial asymmetry before and after orthognathic surgery was also carried out. The resulting asymmetry scores represent the square-root of the summed squared distances between each location on the surface representation and its partner in the reflected, relabelled, and Procrustes-matched version. Several different approaches to this have been proposedP-values by the number of tests carried out) were used when interpreting the results.In order to protect against the effects of multiple testing, Bonferroni adjustments T2 tests, as shown in n = 16) and hence the strongest potential to identify differences.Overall evidence for systematic differences was assessed through Hotelling t-statistic. Strong differences between controls and post-orthognathic cases were found in the third and seventh PCs, with P-values of 0.001 and 0.026, respectively. Bonferroni correction for multiple testing led to a reference of 0.05/10 = 0.005, which highlights the third PC as the source of shape differences between the female patients who had undergone maxillary Le Fort I osteotomy and the control cases.The evidence is further borne out in The shape change associated with the third PC is displayed in While it is of interest to identify systematic differences in shape between the post-surgical and control groups, it is also of considerable clinical interest to assess individual patients against the patterns exhibited in the control group. This is illustrated in This gives a very helpful scale against which individual post-surgical patients can be assessed. The shapes of two individual patients are shown above and below the control patterns. The two images for each patient correspond to the pre- and post-surgical shapes, and the post-surgical shape is placed on the scale at the position corresponding to the score on the third PC (now expressed in control standard deviations). For patients 1 and 2, the positions for the post-surgical shapes were 0.793 and 2.121, respectively. The pre-surgical shapes clearly reflect the inconsistency with control shape that prompted surgical intervention. For patient 1, the post-surgical shape was quite consistent with the controls, as it was found to lie within the normal range (±2 standard deviations) of the observed control variation. For patient 2, the outcome was a little unusual in the positive PC direction, with greater midface prominence than would normally be expected in controls. These two examples illustrate how surgical outcomes can helpfully be assessed in a quantitative manner.The asymmetry scores for controls together with pre-surgical and post-surgical orthognathic cases are illustrated in The rows of t-statistic for a pair-wise comparison with post-surgical measurements.  Strong evidence was found for a reduction in asymmetry in the upper lips , but only marginal evidence for the nose , with the evidence expressed in this latter value considerably diminished by the Bonferroni correction factor of a multiple of 6 for the number of tests involved. The post-surgical groups are coloured by the value of the t-statistic for a two-sample comparison of post-surgical cases with the controls. No convincing evidence was found here that post-surgical asymmetry was greater in comparison to controls. In the first column of plots, which display global asymmetry, colour is used to indicate the strength of evidence for differences in means. The pre-surgical groups are coloured by the value of the The most significant finding of this study is the residual mandibular prognathism that was detected in the group of patients who had undergone Le Fort I osteotomy for the correction of maxillary retrognathism. These cases had the facial characteristics of a class III skeletal relationship due to the combined maxillary hypoplasia and mandibular prognathism. The decision was taken to limit the correction to Le Fort maxillary osteotomy only, in order to minimize the magnitude of surgical intervention and eliminate the potential morbidities associated with the mandibular sagittal split osteotomy, which includes permanent numbness of the lower lip secondary to damage to the inferior alveolar nerve. It was also predicted and agreed with the patients that maxillary advancement only would achieve the desired improvement in facial appearance.The rationale of this study was to guide orthognathic surgery towards a 3D soft tissue facial shape that lies within the range of the relevant control population, with similar age, sex, and ethnic characteristics. The availability of 3D images of the soft tissue of the face provides the clinician with the opportunity to analyse, predict, and compare the outcomes in relation to a relevant control group. The results of this study suggest that there are significant differences in mean facial appearance between some post-surgical orthognathic patient groups and the corresponding control group. The results presented in this study give a clear indication of the benefits of auditing, and potentially improving, the outcome of surgery, using population-based data as an informative reference. It has been shown that although populations of white descent have strong similarities, they also display distinct morphological differencesMaxillary hypoplasia is usually managed with a Le Fort I maxillary advancement, while the need for simultaneous mandibular surgery depends on the magnitude of the maxillomandibular discrepancies. In class III skeletal relationships, the bilateral sagittal split osteotomy is indicated if clinical assessment leads to a diagnosis of mandibular prognathism that requires treatment, and/or the measured discrepancy between the maxilla and the mandible is more than 10 mm. In most of these cases, mandibular setback surgery reduces the magnitude of the required Le Fort I maxillary advancement, which impacts positively on the long-term stabilityAnother important aspect that influences the decision-making process regarding the need for a simultaneous mandibular surgical procedure is the patient’s perception of their facial appearance and the desired improvements following surgery. In class III skeletal relationships mainly due to predominant maxillary deficiency, patients are focused on their paranasal hollowing, increased sclera show above the lower eyelids, the flattened upper lip, lack of upper lip fullness, and the increased nasolabial angle. Most of these perceived facial dysmorphologies will be readily addressed with a Le Fort I advancement osteotomy. The clinical features of any accompanying mandibular prognathism are generally mild and are thought to be acceptable to both the patient and the surgical team following computerized 3D prediction planning. This result is not surprising, as the aim of treatment is to restore facial harmony, which is not absolute but within a range of levels of acceptability.When evaluating surgical outcomes, there is particular interest in asymmetry. All faces are asymmetric to some degree, but pronounced asymmetry is a feature to which the human visual system is strongly sensitive. With orthognathic patients, surgery is not conducted principally to reduce asymmetry, but these patients are more likely to exhibit asymmetry than others and so a post-surgical reduction in asymmetry is of interest. There is also the possibility that surgery may inadvertently increase asymmetryThe results reported here are based on modest numbers of patients from a single surgical centre. The issues of sample size become more acute when the data are split by sex or by surgical group. However, the study has demonstrated the value of 3D soft tissue analysis and given a valuable insight into orthognathic surgical outcomes.Wellcome Trust grant (WT086901MA) to the Face3D research consortium.This research was supported by a None.This study was approved by the West of Scotland Ethics Committee 5 (reference 10/S1001/19) for orthognathic patients and the Ethics Committee of the College of Science and Engineering, University of Glasgow, for controls.Not required.


Currently, effective crowd management based on the information provided by crowd monitoring systems is difficult as this information comes in at the moment adverse crowd movements are already occurring. Up to this moment, very little forecasting techniques have been developed that predict crowd flows a longer time period ahead. Moreover, most contemporary state estimation methods apply demanding pre-processing steps, such as map-matching. The objective of this paper is to design, train and benchmark a data-driven procedure to forecast crowd movements, which can in real-time predict crowd movement. This procedure entails two steps. The first step comprises of a cell sequence derivation method that allows the representation of spatially continuous GPS traces in terms of discrete cell sequences. The second step entails the training of a Recursive Neural Network (RNN) with a Gated Recurrent Unit (GRU) and six benchmark models to forecast the next location of pedestrians. The RNN-GRU is found to outperform the other tested models. Some additional tests of the ability of the RNN-GRU to forecast illustrate that the RNN-GRU preserves its predictive power when a limited amount of data is used from the first few hours of a multi-day event and temporal information is incorporated in the cell sequences. Crowd monitoring systems are maturing rapidly due to the fast advancement of sensor technologies. Wi-Fi sensors can be used to determine the activity patterns of pedestrians e.g., ,2) and m and m2])Even though crowd monitoring systems already provide much-needed insights into the unfolding of crowd movement dynamics, effective crowd management based on the information provided by these systems is difficult as this information comes in at the moment the adverse crowd movements are already occurring. That is, crowd monitoring systems do not yet provide enough response time to pre-emptively determine the perspective for action and implement the necessary crowd management solutions. In order to improve the effectivity and efficiency of crowd management, a method to forecast crowd movements in real-time based on real-time crowd monitoring information is wanted.Up to this moment, forecasting procedures to predict longer term crowd movements that do not rely on historic information regarding the crowds’ movements on previous days are limited. Most presented methods either use a very small prediction horizon, e.g., , or extrThe objective of this paper is to develop a forecasting method that can predict pedestrian movements at large-scale events in real-time which is fed using GPS traces. A promising data-driven urban vehicular traffic forecasting technique, namely that of , is adapThe main contribution of this paper is the application, tuning and extension of the techniques described in  and 16]16] for tThis paper continues as follows. First an overview of the current literature on model- and data-driven state forecasting techniques is provided in In recent years, several forecasting methods have been introduced. This section provides an overview of methods that are or can potentially be used to forecast crowd movements. First, model-driven crowd movement forecasting methods are discussed. Afterwards the data-driven crowd movement forecasting methods are examined. Subsequently, data-driven traffic forecasting methods are reviewed. This section ends with a discussion of the opportunities of contemporary forecasting methods with respect to the forecasting of crowd movements at large-scale events.From the 1970s onwards a number of pedestrian simulation models have been presented. In the early years predominantly microscopic multi-agent simulation models were presented, such as Cellular Automata , the SocMore recently, multiple macroscopic crowd simulation models have been presented, which treat a pedestrian crowd as a continuous moving medium . While earlier versions, such as ,22, coulMost studies featuring the forecasting of pedestrian movements design and train models that forecast pedestrian trajectories , dynamiWhile the prediction horizon of the trajectory prediction algorithms is too short, the destination sequence prediction algorithms could be used to predict the movements of visitors of a large-scale event. However, the presented algorithms are known for their lack of memory. As we expect that the future movements of visitors at a large-scale event are dependent on their previous movements, also the destination sequence prediction algorithms might suffice in their current form. An algorithm with long-term memory retention capabilities is sought after.In other transport-related fields, more specifically the modelling of highway and urban vehicular traffic, several interesting techniques have been introduced that can possibly be adapted to forecast crowd movements. These data-driven traffic forecasting techniques can be subdivided in three categories, being: (1) filtering techniques and stochastic models that use very limited historic information when trained, (2) time series models and machine learning algorithms that incorporate some information regarding the transition probability between states and (3) machine learning algorithms that incorporate information about the recent past of the system in real-time when computing the future state of the system.The first group is dominated by Kalman Filter and Particle Filter applications. The Kalman Filtering technique, developed by , is a unThe Particle Filter (PF), applied among others by ,40, compOver the years, several uni- and multivariate time series models and simple neural networks have been introduced for traffic forecasting purposes, many of which incorporate the average dynamics of historic data. Most used are Gaussian Maximum Likelihood models (GML), support vector machines (SVM/SVR) and Hidden Markov Models (HMM). GML models forecast traffic using a stochastic model that combines the statistical properties of historic traffic data with real-time traffic data . This mThe last group of traffic forecasting techniques features machine learning. The ‘simplest’ version of a machine learning technique that incorporates dynamic features of the past realisations of traffic patterns is the auto-regressive integrated moving average (ARIMA) model ARIMA . This tThe dependencies in traffic are highly non-linear and the current movement pattern of an individual is related to its past actions. Consequently, to predict crowd movements a forecasting method is needed that can handle non-linear dependencies and has a memory. The review of contemporary works on the forecasting of crowds and traffic illustrates that especially recurrent neural networks are equipped to forecast crowd movements. Yet, up to this moment a RNN has never been applied for this purpose. Considering the work on traffic forecasting methods, the work of  is most Yet, the approach cannot be adopted without changes as the movement patterns of visitors at event terrains differ in three ways from vehicular traffic during morning rush hour. Firstly, the temporal dimension of the movement pattern differs. That is, movement patterns at events are dependent on the stage programming which changes quickly throughout the entire day. Specifically at the beginning and end of programmed shows high flows arise that develop quickly and disappear just as fast. In order to catch these sudden increases and decreases of flow rates predictions at 5 min intervals instead of hours are needed from opening till closing time. Secondly, activities do not only occur at the nodes of a network, but also on the links in between. As a result, in contrast to the original approach, the crowd movement forecasting approach should be capable to predict stay-in-place traffic as well as traffic that moves through the corridors of the network. Thirdly, pedestrians at events do not disappear from the traffic network when they reach their location. Consequently, no identification of the end of a cell sequence is necessary. As a result of the differences in the traffic and crowd movement patterns, adaptations to the original approach presented by  are needThe complete research methodology is visualized in In order to capture the movements over the network, first the raw GPS traces are translated into sequences of cells that have been visited by a pedestrian that are ordered by time. This has as advantage that each GPS trace is simplified into an array that contains only main movement features of the pedestrian. The discretized sequence of cells can be handled by an RNN. Any segmentation of space based on a purely mathematical description would be a behavioral assumption on the researchers’ side, which has as a disadvantage that the cell structure does not follow the travel behavior of the traffic. By allowing the data to show us the best segmentation of the network, we ensure that the especially the most heavily travelled corridors in the network are correctly segmented. More specifically, this research adopts the data-driven space segmentation technique presented in , which iEssential to this method is the choice of the order in which the seed points are fed to the algorithm. When seed points are randomly drawn from the data set, the structure of the segmented space changes with each attempt. In order to create a stable and behaviorally valid segmentation of space, the set of seed points is ordered based on density before are fed to the algorithm. This ensures that the most heavily travelled corridors in the traffic network are optimally represented by the cell structure. Yet, a sensitivity analysis is necessary to ensure a stable space segmentation solution is derived, which is not depending heavily on the seed points feeding order. Algorithm 1: Description of the data-driven space segmentation algorithm presented by ,,7], but The company Woov has built a smartphone application for the Mysteryland event which informs its users regarding the programming, the upcoming events and location of facilities  on the terrain. More importantly, this application allows its users to determine the current location of their friends on the terrain and provides the users all essential information to find their friends. Friends are, according to the definition of Woov, individuals that granted another specific person access to their location-information for the duration of the event within the region where the event takes place. In order to provide location information regarding a friends’ location, the smartphone application records the GPS locations of all individuals that use this app (with their consent) and some characteristics of each person . The application of Woov asks the location of all smartphones connected to their application, which they impersonalize and save in their database for short-term usage. The GPS data consists of latitude, longitude, timestamp, accuracy, id number of the person, age and gender. The services provided by the application  are the only incentives that users get for providing their location information and socio-demographic information. The terms of use of the smartphone application details what the company Woov is allowed to do with the data provided by the users. By accepting the terms of use, the users accepts that their location information is used for several purposes. Only the anonymized GPS data, and some metadata thereof, were shared with TU Delft, as a part of a joint project after the unfolding of the event. Each person in the shared GPS data is identified by an id number. Consequently, the researchers do not know to whom a certain trace belongs. The location-information of all users of the application is used in this research.The dataset of Woov captured location data on 9,748 distinct individuals at Mysteryland. After filtering (see the following section for the details), 13,461 continuous trajectories. As the GPS position is determined using a number of complex algorithms, the accuracy of the measurements is reasonably high .The raw GPS traces include a lot of noise. The first filter step is to detect outliers and discard those. Sudden changes in speed and direction are used to determine outlier data points. In order to allow state estimation, frequent location information of one individual is essential within the Mysteryland event terrain. That is, enough data points to allow one to determine the full route of a visitor through the network and have an estimate of the speeds that were travelled by the pedestrian on each link. This translates into three filtering criteria, namely: (1) all data points outside the Mysteryland event terrain are discarded, (2) if the absolute speed between two consecutive data points is larger than 5 m/s, these points are discarded, (3) if a trajectory contains a gap which is larger than 10 min, the trajectory is split into two separate parts. The average time interval of a GPS trace of one visitor was 17.8 h during which an average distance of 5.4 km was covered by the visitor. These traces are accordingly translated into a set of cells by the method described in The average number of cells in each sequence is 120.7. Two example cell sequences are visualized in An analysis of the average transition probabilities for a specific cell shows that in general adjoining cells have a relative higher transition probability than cells further afield. At the same time, in some cases the transition probabilities for all adjoining cells are almost similar see a, while In total, seven models have been estimated. The table illustrates that the Markov chain and RNN-GRU model structures are slightly better at predicting the next cell at the end of a sequence, than the beginning of a sequence. Contrary to our expectation, the difference in the error rates for the 1st, 5th and 20th predictions of a particular model vary only slightly. This suggests that only the previous one or two visited cells influence the current cell visited. At the same time, the fact that the RNN-GRU outperforms the Markov Chain models at any stage of a cell sequence. RNN-GRU’s includes more complex conditional probability distributions to model transitions between cells. Therefore, the outperformance suggests that long-term dependencies exist in the movement behavior of the visitors that are more easily captured by the RNN-GRU model.The table illustrates that the two goodness-of-fit measures indicate two distinct model structures. That is, the RNN-GRU predicts the next cell most often correctly. We expect the low error rate to be the consequence of the incorporation of the memory of earlier steps in the sequence. However, if the wrong next cell is predicted, the Markov chain is more likely to predict another next cell near the cell that was actually visited. Given that the 2nd-order Markov chains have a very high error rate and the average error distance of the RNN-GRU is almost similar to the error distance of the 3rd order Markov chain, the RNN-GRU is chosen to be the best model amongst the tested models to predict the cell sequence behavior of the visitors at Mysteryland. The RNN-GRU model predicts the correct next cell in approximately 82.3% of the time. Besides that, when the model predicts the wrong location, in many cases, a cell adjoining the correct cell is identified.However, these seven model structures have been trained in a very specific manner. The use of a training set with a random drawn selection of cell sequencing featuring crowd movements on both days and all hours of the event does limit the usage of the model for real-time prediction purposes. Moreover, the current cell sequencing method is time independent, which makes a translation from cell sequences to network flows very difficult. In order to determine whether the current model structure could be used for real-time prediction purposes, the RNN-GRU has also been trained using two other training methods  and two other sequencing methods (First and Longest). The results related to all combinations of the three training methods and three sequencing methods are displayed in This paper has tuned and enhanced an existing data-driven urban traffic forecasting technique presented by  and 16]16] to prConsequently, this research concludes that using cell sequence data and a RNN-GRU crowd movements at large-scale events can be predicted without first map-matching the GPS trajectories. Moreover, the features of the crowd movements at these terrains allow this type of network to be trained while the event is ongoing. Consequently, by means of the cell sequence data the RNN-GRU can be trained and applied for real-time crowd movement prediction purposes.This paper has tested a specific set of model types for the purpose of cell sequence prediction. The RNN-GRU is known for its good memory retention qualities and the fact that neural networks can cope very well with the non-linear dependencies in traffic. However, the field of deep learning progresses rapidly and more types of deep learning networks with interesting features have seen the light. LSTM networks, and other RNNs with a more complex design, might improve the goodness-of-fit even further.Moreover, this work determines how to best predict the sequence of cells traversed by one individual in order to predict the aggregate features of the crowd, such as flow and density. Noise might be introduced in the process of aggregating the individual predictions. Therefore, it is essential to also study methods that can directly estimate the characteristics of the crowd movement at an aggregate level. Lastly, the data of one large-scale event in The Netherlands is used to train the RNN-GRU. At this moment in time, it is unclear to what extent the features of this event, such as network size, stage programming, visitor type, influence the goodness-of-fit of this recurrent neural network. In order to determine the general applicability of a RNN-GRU for cell sequence prediction at large-scale events more research is needed.


Despite the extensive implementation of control measures and achievements in morbidity reductions, malaria continues to contribute to substantial morbidity and mortality in children under-five. Innovative approaches involving the use of mobile phones have been suggested to improve health outcomes. However, evidence of its effect on reducing the prevalence of malaria is limited. This study, therefore, aimed to assess the effect of a theory-driven mHealth intervention on the prevalence of malaria among children under-five living in rural districts of Ghana.We conducted a quasi-experimental study of a 12-month intervention using a random sample of 332 caregivers with children under-five from two rural districts, assigned to either an intervention or a control group. Caregivers in the intervention group received voice short message service (SMS) on malaria prevention based on a behavior change theory to improve their health behaviors and practice, once a week for twelve months, while caregivers in the control group received none. Pre- and post-intervention assessment of the treatment effect (ATT) on malaria in children under-five was conducted using propensity score and difference-in-difference (DiD) analyses.p = 0.043).Among children whose caregivers received the intervention, the prevalence of malaria decreased from 58.4% at baseline to 37.8% at endline  compared with children in the control group, where a reduction of 65.0 to 59.9%  was observed. The treatment effect at endline revealed a statistically significant reduction in malaria prevalence  compared with the baseline . Overall, the intervention effect showed a significant reduction in the prevalence of malaria among children under-five was positive  contains supplementary material, which is available to authorized users. Worldwide, millions of children under-five continue to die before their fifth birthday, with almost all of such deaths occurring in developing countries; sub-Saharan Africa alone accounts for almost half of these deaths . Malaria. As part of the efforts to control malaria in the country, a number of control programs including the Roll Back Malaria Initiative and Home Management of Malaria were initiated to implement a combination of curative and preventive interventions. The main activities of the malaria control programme in Ghana include the distribution of insecticide-treated bed nets at health facilities and to households with pregnant women and children under-five, intermittent preventive treatment for infants, intermittent preventive treatment in pregnancy, indoor residual spraying, seasonal malaria chemoprevention, and social behavior change communication. Unfortunately, these control measures undertaken over the years have been met with limited success due to poor health infrastructure, focus on single strategies, lack of funding, poor human resource capacity and non-involvement of some stakeholders [Malaria is endemic in Ghana and continues to pose a public health threat, especially to children under-five living in the rural parts of the country with limited access to health care. The 2015–2020 Ghana Malaria Strategic Plan aims to reduce malaria burden by 75.0% by the year 2020 . As parteholders .An innovative approach involving the use of mobile phones is yet to be explored in Ghana as a potential malaria control tool. Mobile health , involving the use of mobile devices to support clinical and public health care has the potential to improve the numerous healthcare challenges faced by many developing countries . For exaIn order to prevent early childhood death and improve survival, caregivers must change their health behaviors. A growing body of evidence suggests that public health and health-promotion interventions that are based on social and behavioral science theories are more effective than those lacking a theoretical basis –20. SociDespite the potential of mHealth, little is known about its effect on the prevalence of malaria among children under-five living in rural settings with limited access to health care. We hypothesised that this theory-driven mHealth intervention could significantly lead to a reduction in the prevalence of malaria among children whose caregivers received the mHealth intervention compared with those who did not. The objective of this study, therefore, was to examine the effect of the theory-driven mHealth intervention, delivered by one-way voice SMS approach to caregivers, on the prevalence of malaria among children under-five living in a rural district of Ghana.Anopheles mosquito (Anopheles gambiae and Anopheles funestus) [We conducted a quasi-experimental study, using pre- and post-intervention surveys, in a rural district of the Asante Akim North District , located in the Ashanti Region of Ghana from February 2016 to March 2017. The district has four sub-districts, of which two were randomly selected; one as the intervention area (Agogo) and another as the control area (Juansa). The two study areas are approximately thirteen (13) kilometres apart, which helped to reduce any possible contamination. Both areas are dominated by the Akan ethnicity, with subsistence farming as their main source of income. The region is characterized by high malaria transmission especially during the rainy season from May–July through to August . The preunestus) . The disWe included primary caregivers and their children under-five. A primary caregiver was defined in this study as a person who takes primary responsibility and is the legal guardian of the child under-five. We only included caregivers who were able to give written informed consent and had access to a mobile phone – either owned by themselves or their families but accessible to the caregiver. The intervention was designed to target the health behaviors of the caregivers.Telephone numbers obtained from caregivers during recruitment were uploaded onto a mobile phone-based health information system (mHIS). This system was setup to automatically deliver a one-way voice SMS to only the intervention group at their own convenient time – received in the form of a phone call. Scheduled based on the time indicated by the caregivers, the health messages were delivered automatically once every two weeks to the caregivers via their mobile phones in their local language (Twi) for twelve 12) months. The content of the message, which was designed to improve the health behaviors of the caregivers was developed based on the EPPM of behavior change. The content of the message was motivational, designed to prompt the caregiver and provide cues for action on how to protect their children from malaria. An example of the messages was, “Malaria can kill your child if you don’t protect them by consistently using an insecticide-treated net.” In order to maintain the interest of the caregivers, the content of the messages was varied on 5 themes  participants dropped out of the study due to personal reasons, giving a response rate of 97%; 97.5% for the intervention group and 98.8% for the control group. We first selected the community clusters within each study area and then selected households in the study communities. Based on the World Health Organization (WHO) cluster-sampling methodology, we randomly selected 20 clusters (communities) from each study site. In each cluster, we listed all households with children under-five and randomly selected an average of 8 households per cluster, representing approximately 20% of the households. Where a household had more than one eligible caregiver and child, we randomly selected one of each for the survey. A household was defined as a group of people living in the same dwelling space and who acknowledged the authority of a man or woman whom they mostly depend on for their livelihoods.strongly disagree) to 5 (strongly agree). Questions measuring the key aspects of the behavior change theory such as perceived severity, susceptibility, self-efficacy and response efficacy were assessed at baseline and repeated at endline. Table Caregivers who consented to participate in the study were recruited and registered. The registration involved recording of their names, mobile phone numbers, the name of community and Global Positioning System (GPS) data, and consequently exported to the mHIS database. Using a structured questionnaire, we collected information on the age and sex of all children under-five. In addition, caregivers’ demographic characteristics such as age, education level, marital status, religion, parity, access to and use of mobile phones were recorded. We assessed the primary endpoint, prevalence of malaria at baseline and endline, by asking the caregivers whether the child had experienced fever in the last twelve 12) months preceding the survey. Information on all children under-five included in the study who were taken to a health facility was retrieved from the health records and recorded and checked for the diagnosis: malaria was confirmed by either Rapid Diagnostic Test (RDT) or microscopy. For children who were treated at home, further questions were asked to ascertain whether the child was provided with an anti-malaria drug. An episode of malaria in our study was defined as a child having a fever and being confirmed by either RDT or microscopy, or being treated with anti-malaria at home by the caregiver based on the signs shown by a febrile child. The secondary endpoint, behavior change, was assessed using a Likert-scale responses , 28, 29,2 months The pre-intervention questionnaire was administered during early February 2016 and respondents were followed up after the 12 months intervention period as shown in Fig. p-values < 0.05 considered statistically significant. Malaria prevalence was compared between baseline and endline surveys using t-test. This was done in two stages; first, confirmed and presumptive cases and only confirmed cases for the second stage.We used Chi-square/Fisher’s exact test to examine the pre-existing differences between the intervention and control group with regard to the baseline sociodemographic characteristics of the caregivers and the children, with Sensitivity analysis for matching estimators [We conducted Propensity Score Matching (PSM) analysis to obtain approximately unbiased estimates of the Average Treatment Effect on the Treated (ATT) by improving covariate balance. The greedy nearest neighbor method was used to estimate the ATT after estimating the propensity scores for each participant. timators  was condχ2)/Fisher’s exact tests revealed a statistically significant difference between the two groups with respect to the sex of the child (p < 0.001), marital status of the caregiver (p < 0.001) and household wealth (p = 0.006) Table The socio-demographic characteristics of the study sample at baseline are shown in Table We observed a higher reduction in the prevalence of malaria among children under-five in the intervention group compared with the control group at endline Fig. . The pret-tests were undertaken to examine the change in perceptions of threat and efficacy towards malaria. According to the behavior change model, EPPM, comparison of these perceptions allows determination of whether people would engage in danger control and avert the threat or not. With the exception of response efficacy, the intervention group had a significant improvement in perceived severity , perceived susceptibility  and self-efficacy  at post intervention. In contrast, there were significant reductions in these perceptions among the control group at post intervention.Table Using the PSM analysis, we estimate the counterfactual (average treatment effect on the treated if they were not treated) after matching using the nearest neighbor approach. Based on the propensity scores generated after matching the intervention and the control groups, the two groups did not significantly differ with regards to key baseline sociodemographic variables such as sex of the child, marital status of caregiver and the household wealth index Fig. . The avesensatt command in Stata. The re-estimated effect (using ‘readwrite’ variable as the simulated confounder) both at baseline and endline suggested that the effect of the intervention on malaria prevalence was insensitive to the omission of plausible unobserved confounders [We tested for the robustness of the PSM analysis in order to account for possible unmeasured confounder by conducting a sensitivity analysis using the founders  (Table 7p = 0.216) in the prevalence of malaria between the intervention and the control groups. On the other hand, the endline estimate revealed a statistically significant difference  between the two groups. The overall impact of the intervention revealed a statistically significant reduction of malaria prevalence  among children whose caregivers received the intervention.We used the difference-in-difference model to account for the non-parallel modification before and after introducing the intervention as shown in Table The findings of our study showed that sending theory-driven voice SMS via mobile phones to caregivers is an effective means of reducing the prevalence of malaria among children under-five. We found that the reduction of malaria prevalence among children under-five in the intervention group was higher compared with the control group. This is, to our knowledge, the first study that attempts to assess the effect of a theory-driven mHealth intervention on the prevalence of malaria among children under-five living in a resource-limited setting.Evidence from previous studies suggests that mHealth interventions have the potential to improve the sub-optimal adherence of caregivers to artemisinin-based combination therapy , patientWe observed a higher reduction in the prevalence of malaria among children in the intervention group. This could be due to an improved health behaviors among the caregivers, an endpoint associated with adoption of healthy behaviors , 35. As This study had some limitations. Firstly, although we attempted to control as many threats as possible, the internal validity of the study design due to lack of random assignment of participants to either an intervention or a control group may have been affected. The matching analysis was, however, conducted to minimize the threat to this validity. Secondly, due to the poor data recording and limited resources, it is possible that not all the febrile cases that reported at the health facilities were confirmed by RDT or microscopy although recorded in the clinician’s report. Thirdly, children who were treated at home with anti-malarial drugs due to fever may not have exactly been confirmed cases of malaria. Also, maturation effect may have affected the outcome due to the frequency of the messages delivered and the duration of the study. This may be due to participants being tired of listening to the same pattern of messages for the entire duration of the study, as the rate at which participants answered and listened to the voice SMS was 15% lower than expected. In addition, the cluster effect and the confounding effects of other factors including social and behavioral change programs on malaria control organized in some communities was not adequately addressed in the analysis. Also, the reliability of the questionnaire used to measure the EPPM constructs may not reflect the true stage of the behavior change of participants due to the low Cronbach’s alpha. Finally, recall bias may have affected the interval validity of the estimate, although health records of majority of the children who were reported ill were assessed and confirmed to have had malaria at baseline and endline. These may have affected the observed effect, although the sensitivity analysis suggests otherwise.Findings of this study suggest that innovative approaches involving the use of mobile technology could be used as a strategy for controlling malaria in children under-five especially those living in rural settings where healthcare resources are limited. The Ghana National Malaria Control Program could adopt the use of mobile phones as part its malaria control strategies.Additional file 1:SMS script used. (DOCX 19 kb)


The increase of Software Defined Networks (SDN) and Network Function Virtualization (NFV) technologies is bringing many security management benefits that can be exploited at the edge of Internet of Things (IoT) networks to deal with cyber-threats. In this sense, this paper presents and evaluates a novel policy-based and cyber-situational awareness security framework for continuous and dynamic management of Authentication, Authorization, Accounting (AAA) as well as Channel Protection virtual security functions in IoT networks enabled with SDN/NFV. The virtual AAA, including network authenticators, are deployed as VNF  dynamically at the edge, in order to enable scalable device’s bootstrapping and managing the access control of IoT devices to the network. In addition, our solution allows distributing dynamically the necessary crypto-keys for IoT Machine to Machine (M2M) communications and deploy virtual Channel-protection proxys as VNFs, with the aim of establishing secure tunnels among IoT devices and services, according to the contextual decisions inferred by the cognitive framework. The solution has been implemented and evaluated, demonstrating its feasibility to manage dynamically AAA and channel protection in SDN/NFV-enabled IoT scenarios. Edge and fog technologies  shift ceFog computing can drastically improve network connectivity at the edge by leveraging NFV  and SDN (Software Defined Networks). NFV presents remarkable advantages for deliver virtual appliances in the edge and remote cloud data centers . DynamicIn this context, Authentication, Authorization and Accounting (AAA) as well as Channel-Protection Network Security Functions (NSF) can be timely and dynamically deployed and configured at the edge in virtualized and softwarized fog entities, such as cloudlets, and IoT gateways, in order to facilitate the security management in IoT networks. To this aim, new context-aware holistic security solutions are needed to allow the orchestration  of NFV mFurthermore, there is a strong need to define proper, inter-operable and highly-expressive security policy languages and models to empower users and administrators to manage, in a high-level fashion, the overall security and privacy aspects of their Fog and IoT entities across the whole ecosystem. Those policy models could serve as input for framework orchestrators to organize and choreograph the aforementioned security services. Some security policy models  and framOn the other hand, AAA and Channel protection NSFs have been already successfully studied and addressed in IoT networks . HoweverThis paper extends our previous conference paper  by evaluThe rest of the paper is organized as follows. Large scale IoT deployments  are compThe Zigbee IP  standardWe can distinguish protocols that establish a security association (SAP); protocols that use the Security Association (SA) to protect the channel; and protocols that bootstrap all of the above. In small scale deployments, a simple SAP with the key material set up at both ends of the authentication process normally suffices. For instance, DTLS can be employed to set up the necessary key material to establish the security association between the IoT device and the Gateway, but when large scale deployments and multi-domains are considered, it is interesting to rely on more scalable alternatives such as AAA and EAP to bootstrap the key material in order to establish security associations like the aforementioned DTLS channel. Therefore, our solution leverages EAP to facilitate scalable key management in IoT deployments, and then manages the establishment of DTLS channels to protect IoT communications with such a derived key material.The SDN has demonstrated to be a flexible and powerful enabler to new network solutions. The centralized control provides complete network information, therefore enhancing control decisions. SDN based solutions endow the architecture with desirable features such as flexibility, dynamism, centralized management and scalability.Current works like  show howOn the other hand, regarding NFV technologies, they avoid the deployment of specific hardware equipment through the use of virtual machines running specific network functions on commodity servers. NFV provides among others, flexible provisioning, deployment and centralized management. The possibility to employ Virtual Network Functions (VNF) to deploy security appliances is an interesting alternative to enhance an architecture with adaptive and reactive security capabilities. Since it is possible to deploy security appliances as virtual network functions (VNF) in a Network Function Virtualization environment, this approach becomes really interesting in order to provide adaptive and reactive security capabilities to an architecture .In this sense, in , the autThis section overviews the ANASTACIA architecture (ANASTACIA Project ) in ordeThe ANASTACIA framework ,25 proviThrough the use of networking technologies such as SDN-NFV and intelligent and dynamic security policy enforcement and monitoring methodologies, different virtual security appliances such as vFirewall, vIDS, vAAA, vSwitch/Router, vHoneynet, vVPN are orchestrated dynamically at the network edge.User Plane includes interfaces, services, and tools to end-users for policy definition, system monitoring and service management. Its policy editor provides an intuitive and user-friendly tool to configure security policies governing the configuration of the system and network, such as authentication, authorization, filtering, channel protection, and forwarding. More detailed information on the framework can be found in its web page and in particular motivation and security analysis regarding ANASTACIA can be found in Public Deliverables 1.2 [A high level view of the framework is depicted in bles 1.2 , 2.2 [27bles 1.2 , respectSecurity Orchestration plane enforces policy-based security mechanisms and provides run-time reconfiguration and adaptation of security enablers, thereby providing the framework with intelligent and dynamic behavior. It is an innovative layer of our architecture and provides self-protection and self-healing capabilities for softwarized networks through novel modules. The Policy Interpreter module receives as input the policies and identifies the capabilities needed to enforce such policies (capability matching). Then, the Interpreter interacts with the Security Enablers Provider to identify the SDN/NFV-based/IoT specific enablers that are able to enforce the desired capabilities. The Security Orchestrator selects the enablers to be effectively deployed, accounting for the security requirements, the available resources in the underlying infrastructure, and optimization criteria. The Monitoring component collects security-focused real-time information related to the system behavior from physical/virtual appliances. Its main objective is to provide alerts for the reaction module in case something is misbehaving. Security probes are deployed in the infrastructure domain to support the monitoring services. Then, the Reaction component is in charge of providing appropriate countermeasures, by dynamically defining reconfiguration of the security enablers according to the circumstances. The reaction outcomes are then analyzed by the Security Orchestrator, which enforce the corresponding enablers’ countermeasures.The Control and management domain modules supervise the usage of resources and run-time operations of security enablers deployed over software-based and IoT networks. A set of distributed SDN controllers takes charge of communicating with the SDN-based network elements to manage connectivity in the underneath virtual and physical infrastructure. ETSI’s NFV-MANO (Management and Network Orchestration)-compliant modules supports secure placement and management of virtual security functions over the virtualized infrastructure. The IoT Controller is intended to manage IoT devices and networks, such as LoWPANs  and LPWAN (Low-power Wide-Area Network).The Infrastructure and Virtualization domain This domain comprises all the physical machines capable of providing computing, storage, and networking capabilities to build an Infrastructures as a Service (IaaS) layer by leveraging appropriate virtualization technologies. This plane also includes the network elements responsible for traffic forwarding, following the rules of SDN controllers, and a distributed set of security probes for data collection to support the monitoring services. The VNF domain accounts for the VNFs deployed over the virtualization infrastructure to enforce security within network services. It provides advanced security VNFs , capable of providing the defense mechanisms and threat countermeasures requested by security policies. The IoT domain comprises the IoT devices to be controlled. This includes the security enablers, actuators or software agents needed to enforce the security directives coming from the orchestration plane and managed, at the enforcement plane, by the IoT controller.The solution relies on the ANASTACIA framework architecture shown in As it can be seen in the figure, some of the components such as the virtual EAP (vEAP) Server VNF and virtual Proxy (vProxy) VNF are meant to be deployed in a centralized location, accessible by different IoT networks/domains. On the other hand, other components like the virtual PAA (vPAA) VNF are deployed at the edge of those IoT Networks to facilitate the bootstrapping, authentication and the key management, required to establish secure tunnels.Namely, the vEAP VNF is responsible for making authorization/authentication decisions, according to the security policies enforced by the ANASTACIA framework through the Orchestrator. Likewise, the vProxy VNF is in charge of managing the channel protection set-up, in the other side of the channel, abstracting end-point services from this task. Thus, vProxy can be deployed and configured dynamically, on demand, by the Orchestrator to facilitate the security association set-up for those entities (like for instance IoT context brokers or cloud-data repositories), which are not aware and capable of establishing DTLS tunnels.The SDN Controller, as demanded by the security Orchestrator, manages the network communications between the different components, enforcing, through the southbound Application Programming Interface (API), flow rules to drop, filter, allow or redirect traffic, from and towards the IoT devices. Additionally, the IoT controller intermediates to perform key provisioning to the IoT devices, according to the Orchestrator commands. In addition, although it is not shown in the figure for the sake of simplicity, those VNFs are deployed by the NFV-MANO, whenever decided and commanded by the Security Orchestrator. This solution assumes that the network has at least one SDN capable switch located on the edge of the IoT network in order to be able to enforce traffic rules dynamically.The following sections describe in deep our SDN/NFV-based solution for vAAA and vChannel protection management in IoT networks.Security has evolved from a desired feature to a requirement to be provided by networking infrastructures. In order to provide a certain level of security, cryptographic material needs to be deployed to the elements involved in the communication. To that end, AAA solutions have been used historically and a whole area of research has been developed around them. This work aims not only to face the AAA architecture virtualization as a network function (NFV) triggered by security or business originated policies challenge, but also taking into account the precise considerations needed to enable these kind of solutions into IoT environments.The Authentication, Authorization and Accounting (AAA) framework is used and instantiated, typically, in protocols such as RADIUS  and DiamSecurity management through policies endow administrators with abstraction capabilities of the underlying systems, enabling the definition of high-level security intents independent from the low configurations, which becomes a powerful tool for achieving interoperability and scalability. A policy framework can even provide different abstraction levels through policy refinement, facilitating the interaction with the user based on the later knowledge level. In this way, two users with different level of knowledge could model the same security policy at different levels  obtaining the same effect. Likewise, medium level policies can be translated to vendor-specific technical configuration over the system. The policy level separation allows abstracting policy definitions which could potentially be implemented by many different end-points leveraging on different technologies, and therefore making the policies entity and technology agnostic from the underlying system.In this sense, our solution is based on developed plugins which translate authentication, authorization, and channel protection medium-level security policies into specific device configurations . The plugin selection decision is made by the Security Orchestrator who has a global cyber-situational awareness  vision oFollowing this approach, we have extended the ANASTACIA security framework in order to apply security policies in AAA scenarios. To this aim, our proposal extends the security policy models provided by SECURED  project Listing 1subject, which aims to perform some action over a specific target resource. In this case, the example is indicating that the SensorA (subject) is ALLOWED to access the resource /60001 using the PUT method (action) against the IoT Broker (target). Regarding the other two policies, they allow bidirectional communications, for the authentication protocol, between the IoT device and the network authentication service. This kind of authorization policy is usually composed of a Listing 2At this point, it is important to highlight that in case the security enabler is not already deployed, the SO will request to a NFV-MANO the deployment of the VNF, and once it has been instantiated, it will be configured with the generated security enabler configuration. To this aim, the SO drives this process and the communication with the NFV-MANO. The SO holds the VNF definitions and NS catalogs, manages workflow of the service deployment and can query the status of already deployed services. The OS interfaces with the Service Orchestrator, and, in turn with the Resource Orchestrator (RO) to provision services over a particular NFV Infrastructure (NFVI) provider  in a given location. Then, the VNFConfiguration and Abstraction (VCA) is contacted by the RO in order to perform the the VNF configuration using Juju Charms. For more information about this process, the reader is referred to our previous work .Once the SDN policies have been enforced, the SDN switch is properly configured in order to allow the authentication traffic among the IoT device and the PAA -step 9.IoT brings heterogeneity of devices and radio technologies, with different capabilities and requirements which have to cooperate and coexist. This paper leverages ANASTACIA framework, providing the design and implementation of different VNFs and security policies needed to deal with bootstrapping AAA and channel protection in IoT. Namely, a VNF is deployed to deal with EAP lower layer . At this point, the Security Orchestrator verifies whether there is also some default reaction behaviour for the specified IoT device. For this AAA case, the orchestrator is programmed with an reactive behavior when an IoT device is authorized to use the network, the IoT Controller must be able to reach the aforementioned device, so the Security Orchestrator not only generates a MSPL policy in order to allow the connectivity among the IoT device and the IoT broker, but it also generates a second security policy in order to allow the communication among the IoT Controller and the IoT device -step 10.Once the security policies have been generated, the Security Orchestrator selects the best security enabler which will be in charge of enforcing each security policy -step 11.Although it is out of the scope of this research, this authorization model can be improved further to consider trust and reputation scores about IoT devices as proposed in , or, in Channel protection has become a main actor in secure communications for guarantying confidentiality and integrity. Nowadays, several techniques are available to protect the communication channel, depending on the Open System Interconnection (OSI) stack level we aim to protect. For instance, at network level, Internet Protocol Security (IPSec) can be applied, while at transport level, depending on the transport protocol used, Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS) could be employed. The latter guarantees equivalent security levels than TLS but using non connection oriented datagrams as underlying transport.In the IoT deployment, we use DTLS to protect the communications for the aforementioned reasons and because the current standard protocol to protect the communications defined within CoAP  is DTLS.Similarly to the AAA case, we have followed a policy-based security management approach. A high-level channel protection policy allows for specifying protection requirement regardless of the underlying channel protection techniques and protocols, and the high-level security policy is translated into a medium-level security policy capable of defining more specific securization parameters but still independent from the final implementation.(DTLS-Proxy) and the IoTDevice using AES as encryption algorithm with a key size of 128 bits in Counter with CBC-MAC (CCM) mode. Once the policy has been instantiated, the Security Orchestrator decides the suitable technology to use. In this case, since the devices involved in the securization of the communications are DTLS-enabled (a DTLS-Proxy service is running on the top of the IoT Broker), the Security Orchestrator will choose a plugin in order to translate the DTLS policy to specific configurations of each involved technology, e.g., it generates configurations in order to activate DTLS in the IoT device through the IoT Controller and in the IoT Broker Server. On the other hand, if the device is not DTLS-enabled, a DTLS-Proxy will be deployed at the edge, as close as possible to the mentioned device, and, in that case, the Security Orchestrator will choose a DTLS-proxy plugin as a translator plugin, and it will be also required to apply a forwarding policy in order to collocate the DTLS-Proxy in the path between the two selected devices; ideally, the closer to the non DTLS-enabled device, the better.Listing 3Depending on the requirements of the organization such as business strategies, the channel protection could be mandatory or not. If the channel must be always protected, this process can be part of the authorization process, establishing the channel protection policy as another default policy after the authorization as it was shown in Once the Security Orchestrator has received the configurations, it has to enforce them in the security enablers. At this point, it is important to highlight that we have used PANA protocol for carrying the authentication (note that Network Authenticator has been instantiated as PANA Agent), and the PANA Client and Enforcement Point Master Key (PEMK) will be used for the channel protection.The PEMK is calculated from the MSK, but the IoT device generated the MSK in the bootstrapping process; therefore, the configuration for the other side of the channel (IoT Broker) must be completed with a valid PEMK to establish the tunnel. To this aim, the Security Orchestrator requests the PANA Agent for a specific PEMK to be delivered to the IoT Broker through a secure channel.The PANA Agent calculates the PEMK (using the MSK it obtained for the IoT device in the bootstrapping process) following pseudo-random function (prf) defined in ,39 as: PThen, such a PEMK is provided by PANA Agent to the Security Orchestrator trough a secure channel. At this point the Security Orchestrator has ready the DTLS configurations translated from the security policy, for both sides of the communication channel, i.e., the IoT device and and IoT Broker, so it initiates the process to deliver the configuration to each them.To this aim, on the one hand, the IoT Controller receives the request from the security orchestrator, which in turn, it generates an IoT protocol specific message  with the channel protection configuration to be enforced in the IoT device. The IoT device receives the CoAP message and will try to create a DTLS connection against the IoT Broker using the specific DTLS parameters received. On the other hand, the IoT Broker also receives the DTLS configuration enforcement request from the Security Orchestrator, along with the PEMK required for establishing the connection, and it prepares a DTLS socket, being able to receive DTLS secure connections from the IoT device.As a result, a softwarized, centralized and dynamic channel protection solution is obtained, leveraging on the authentication process to provide dynamic key management for M2M channel protection, driven by the security orchestrator. In addition, the solution allows for reacting dynamically regenerating and redistributing a new set of keys in case of security breach.Regarding keys updates, the process is already addressed by PANA. Thus, when the PANA session is close to expire, the PANA Client (PaC) and PAA engage in a re-authentication that has as a result a new EAP exchange, and a new MSK derived from it. As a consequence, the new MSK and all the keys used derived from MSK have to be updated.It is important to highlight that we considered the end-points are DTLS-enabled, but this is not a mandatory condition. The end-points (including the IoT device) could be DTLS-agnostic. In this case, the framework provides a dynamic DTLS-Proxy VNF. When an end-point requires enabling a channel protection, the Security Orchestrator can request the deployment of a DTLS-Proxy as closer as possible to the end-point, and also request the SDN controller a network configuration in order to redirect the traffic through the new VNF. We want to highlight that the DTLS channel protects the communication between the IoT device and the Proxy-DTLS, the communication between the later and the real end-point might be protected or not, it simplifies the integration of new end-points.The use case considers an internal attacker performing a sabotage in the building, and the ANASTACIA framework detecting and reacting with the deployment of the softwarized vAAA architecture proposed in this paper.The actors involved in this use case are the attacker and the security administrator. The attacker is represented by an infected IoT device or a management terminal with a non-trusted operator. On the other hand, the security administrator is the one managing the security policies of the framework.The triggering of the use case occurs when a terminal within the building network is compromised and starts attacking the infrastructure, thereby the external intrusion defense systems, such as firewalls, are ineffective. At this point, the ANASTACIA framework is able to detect the intrusion and react accordingly.The ANASTACIA platform, through the Monitoring service and vID, is able to detect an intrusion, firstly analyzing the detected abnormalities and outliers and evaluating the severity of the situation, finally activating prediction mechanisms to ensure that the rest of the building’s system operations continue as expected. Although it is out of the scope of this paper, it is worth mentioning that, in ANASTACIA framework, the attack and intrusion detection can be done using diverse agents and analysis tools, which can employ both signature-based pattern recognition and anomaly-based analysis, according to deviations from the normal behavior of devices monitored by the agents .The platform identifies the attacks and triggers the autonomic self-healing capabilities to deploy dynamically, in the proper location, the vAAA VNF and vBootstrapping VNF and reconfigure the system enforcing the authorization policies in the PDP, and enforcing also, through SDN, in the vSwitch the AC network rules. The vBootstrapping VNF instantiation in our evaluation corresponds to vPAA, but alternate bootstrapping mechanisms might be offered and instantiated based on security or business policies as well as devices’ restrictions.As a consequence, the devices must be authenticated to gain access to the network. The network is configured to drop any communication from an unauthenticated device, therefore isolating the attacker from the infrastructure. In addition, the communications from trustworthy devices are protected by means of the DTLS tunneling to the vProxy, avoiding traffic inspection and man-in-the-middle attacks among others.ANASTACIA is currently being validated in a real Smart Building scenario; this paper takes profit from ANASTACIA’s testbed to perform an evaluation of the proposal and integrate the vAAA approach into ANASTACIA’s framework. The deployment used in the testbed follows the overall schema depicted in The Policy Interpreter, Policy Repository, Security Enabler Provider and Security Orchestrator are virtualized and dockerized in an Intel(R) Core(TM) i7-2600 CPU at 3.4 GHz, using three vCores, 3.5 GB of RAM and 30 GB of HDD.The IoT Controller is virtualized and dockerized in an Intel Core Processor at 1.5 GHz using 2vCores, 2 GB of RAM and 15 GB of HDD.The PAA Network Authenticator, Capability manager, AAA Server, PDP and IoT broker are virtualized and dockerized in an Intel(R) Xeon(R) CPU E5-2603, v3 @ 1.60 GHz with 12 cores and 32 GB RAM and SATA 10k in mode RAID 1 disk drives.The SDN Controller is ONOS version 1.15.0.9e4972c5 which has been virtualized and dockerized in an Intel Core Processor (Haswell) at 1.5 GHz using two vCores, 4 GB of RAM and 15 GB of HDD. Control plane is assumed to be isolated from data plane, in this case by means of VLANs.The SDN Switch is an HP model 2920, software revision WB.16.04.0008, ROM version WB.16.03.The IoT devices are MSP430F5419A-EP at 25 Mhz, 128 KB ROM and 16 KB RAM, running a customized version of Contiki OS 2.7 and erbium CoAP server.The 6lowPAN bridge is a MSP430F5419A-EP at 25 Mhz, 128 KB ROM and 16 KB RAM, running a customized version of Contiki OS 2.7 in order to allow the communication between 802.15.4 and 802.3.Regarding the hardware used for the experiment phase, all the components have been deployed in the University of Murcia and they have the following features:https://sourceforge.net/projects/panatiki/) implementation for the IoT device, and a modified version of the OpenPANA implementation (https://sourceforge.net/projects/openpana/) for the PAA.The PANA authentication software is based on PANATIKI (The distributed authorization token is based on an implementation of the Capability Token .https://sourceforge.net/projects/tinydtls/) is used within the IoT device while Californium  is employed within the DTLS proxy in charge of enable the DTLS communication and decrypt the IoT egressed DTLS/CoAP messages to the CoAP required by the IoT broker to publish information.For the DTLS communication, tinyDTLS . For the resource authorization, only one policy is generated . Lastly, for the channel protection, a medium-level policy is generated and replicated , therefore reducing the time consumption in comparison with network authorization process where two complete policies need to be generated.During the Policy Translation phase, the network authentication policies generate two different SDN rules for the same technology  and the resource authorization policy only is translated in an XACML policy for the PDP ; meanwhile, the channel protection security policies generate two different configurations, for the proxy DTLS and for the IoT Controller .The Policy Enforcement phase implies the communication with the SDN controller to add the SDN rules that will later be installed by the former into the devices  that will enable the Authentication, followed by the Authorization performed by simply installing the XACML policy into the PDP . Finally, as part of the channel protection phase Policy Enforcement process , the PEMK for the IoT, DTLS Proxy pair is retrieved by the Security Orchestrator. The PEMK with the needed configuration is then provided to the DTLS Proxy that will prepare a DTLS socket with the provided configuration (43% of this phase time) and also provided in parallel to the IoT controller that provides the cryptographic material in addition to the configuration via CoAP message through the IoT network (implying 57% of this phase time).The evaluation of the solution from the perspective of the IoT devices is shown graphically in We can appreciate by observing the values in The first row of The scalability evaluation has been focused on the DTLS management, from the point in which the security administrator requests the policy deployment  until the DTLS Proxy receives the DTLS configuration and the IoT controller sends the DTLS configuration to the IoT devices. It is worth mentioning that DTLS configuration provisioning to the IoT devices is detached from this process using non-confirmable CoAP messages; the IoT controller will then attend each device independently depending on specific factors such as the availability or the network load.As can easily be seen, for one IoT device, the policy enforcement is more expensive than the refinement and translation processes since the processing of one security policy is lighter than the PEMK calculation, distribution and the IoT configuration through the IoT network. When the number of IoT devices increases, the most expensive process becomes the policy translation (around 43% of the DTLS policy deployment time for 100 devices); this process translates two completely different MSPL policies per DTLS configuration into DTLS Proxy configurations and into IoT Controller DTLS configurations. The following process in terms of time consumption is the policy enforcement (around 38% of the DTLS policy deployment time for 100 devices) in which the DTLS Proxy is configured while the IoT Controller launches a thread for each IoT device configuration. The rest of the deployment time is spent by the refinement process (around 19% of the DTLS policy deployment time for 100 devices), which generates the same MSPL twice, one for each target of the DTLS connection.It is important to highlight that As a global view, the biggest test, with 500 IoT device DTLS policies deployed (refinement + translation + enforcement) took around 30 seconds. The data show that the solution clearly provides a linear deployment time increase trend related to the number of IoT devices being secured.Regarding the experimental replicability of the obtained results, similar results should be achieved when similar hardware is employed. That is, the more constrained equipment and IoT devices, the worse result in the performance. Furthermore, the radio technologies used are also a factor in the performance. We consider that this deployment is an instantiation of the use case that provides a reference by using affordable hardware (the newest CPU is five years old) and software, so enhancing the CPUs employed would clearly lead to enhanced results.This paper has evaluated a novel on-demand virtualized AAA and an associated channel protection mechanism specially designed to work on IoT deployments and orchestrated by a wider security architecture, the ANASTACIA framework.The paper has described how the vAAA can bootstrap an IoT device and distribute the encryption material to the involved network elements and how DTLS channel protection is achieved. In addition, sample authorization and channel protection policies describing the aforementioned mechanisms have been proposed and instantiated by implementing the refinement process as well as the proper translation plugins. Finally, it has been also provided a performance evaluation of the solution for the authentication, authorization and channel protection processes in a testbed that mimics a real scenario, comparing the results with previous research based on simulation. The evaluation serves also as a demonstration of the feasibility in terms of the time employed by an IoT device to join a secure IoT deployment. Special focus have been put on the scalability of the system evaluating an IoT network integrated by up to 500 IoT devices. The results show that complex security policy operation like the DTLS enforcement for 500 IoT devices is achieved in around 30 s, which is an affordable response time in the most common IoT deployments. An overload of 12% of the time per operation is a low price to pay taking into account the solution capabilities.Along with the experiments, we also identified interesting new challenges that we will consider as future work, such as using different authentication protocols on demand in a transparent way for the final devices, or extending the IoT controller functionality in order to enforce an adaptive behaviour based on the contextual inferred decision taken by the cognitive framework. In addition, as future work, we envisage managing AAA and Channel protection security functions in 5G-enabled IoT networks (NB-IoT) to enable end-to-end network traffic isolation and slicing.