diff --git a/ACM-JRC/.gitignore b/ACM-JRC/.gitignore new file mode 100644 index 0000000..a39596f --- /dev/null +++ b/ACM-JRC/.gitignore @@ -0,0 +1,34 @@ +acmart.cls +acmart.pdf +acmguide.pdf +samples/sample-*.pdf +*.log +*.aux +*.cfg +*.glo +*.idx +*.toc +*.ilg +*.ind +*.out +*.lof +*.lot +*.bbl +*.blg +*.gls +*.cut +*.hd +*.dvi +*.ps +*.thm +*.tgz +*.zip +*.rpi +*~ +*.bcf +*.run.xml +samples/ACM-Reference-Format.bst +samples/*.tex +samples/*.bbx +samples/*.cbx +samples/*.dbx \ No newline at end of file diff --git a/ACM-JRC/Bibliography.bib b/ACM-JRC/Bibliography.bib new file mode 100644 index 0000000..033540f --- /dev/null +++ b/ACM-JRC/Bibliography.bib @@ -0,0 +1,1815 @@ +@article{AG-Analysis-Data-Knowledge, + title={Survey of Attack Graph Analysis Methods From the Perspective of Data and Knowledge Processing}, + author={Jianping Zeng and Shuang Wu and Yanyu Chen and Rui Zeng and Chengrong Wu}, + journal={Security Communications Networks}, + year={2019}, + volume={2019}, + pages={2031063:1-2031063:16} +} + +@article{AG-Analysis-Explan, + title = {Attack Graph Analysis: An Explanatory Guide}, + journal = "Computers \& Security", + volume = {126}, + pages = {103081}, + year = {2023}, + issn = {0167-4048}, + doi = {https://doi.org/10.1016/j.cose.2022.103081}, + url = {https://www.sciencedirect.com/science/article/pii/S0167404822004734}, + author = {Kengo Zenitani} +} + +@incollection{jajodia_topological_2005, + address = {Boston, MA}, + title = {Topological {Analysis} of {Network} {Attack} {Vulnerability}}, + isbn = {978-0-387-24230-9}, + url = {https://doi.org/10.1007/0-387-24230-9{\_}9}, + booktitle = {Managing {Cyber} {Threats}: {Issues}, {Approaches}, and {Challenges}}, + publisher = {Springer US}, + author = {Jajodia, Sushil and Noel, Steven and O'Berry, Brian}, + editor = {Kumar, Vipin and Srivastava, Jaideep and Lazarevic, Aleksandar}, + year = {2005}, + doi = {10.1007/0-387-24230-9{\_}9}, + pages = {247--266} +} + +@inproceedings{cao_assessing_2018, + address = {Cham}, + title = {Assessing {Attack} {Impact} on {Business} {Processes} by {Interconnecting} {Attack} {Graphs} and {Entity} {Dependency} {Graphs}}, + isbn = {978-3-319-95729-6}, + booktitle = {Data and {Applications} {Security} and {Privacy} {XXXII}}, + publisher = {Springer International Publishing}, + author = {Cao, Chen and Yuan, Lun-Pin and Singhal, Anoop and Liu, Peng and Sun, Xiaoyan and Zhu, Sencun}, + editor = {Kerschbaum, Florian and Paraboschi, Stefano}, + year = {2018}, + pages = {330--348}, +} + +@ARTICLE{8470942, + author={Husák, Martin and Komárková, Jana and Bou-Harb, Elias and Čeleda, Pavel}, + journal={IEEE Communications Surveys \& Tutorials}, + title={{Survey of Attack Projection, Prediction, and Forecasting in Cyber Security}}, + year={2019}, + volume={21}, + number={1}, + pages={640-660}, + doi={10.1109/COMST.2018.2871866} +} + +@misc{noauthor_health_1996, + title = {Health {Insurance} {Portability} and {Accountability} {Act} of 1996}, + note = {Pub. L. No. 104-191. 1996 [Online]. Available: https://www.govinfo.gov/content/pkg/PLAW-104publ191/html/PLAW-104publ191.htm}, +} + +@misc{PCI, + title = {Payment {Card} {Industry} {(PCI)} {Data} {Security} {Standard}}, + note = {{Available: https://www.pcisecuritystandards.org/documents/PCI{\_}DSS{\_}v3-2-1.pdf}}, + month = {May}, + year = {2018}, + author = {{PCI Security Standards Council}} +} + +@misc{fincen, + title={{Financial Crimes Enforcement Network, Title 31 U.S.C. 310}}, + year={2010}, + note={{Available: https://www.govinfo.gov/content/pkg/USCODE-2010-title31/html/USCODE-2010-title31-subtitleI-chap3-subchapI-sec310.htm}}, +} + +@misc{fdaqsr, + title = {Quality System Regulations}, + year = {1996}, + note = {Federal Register: Volume 61, Number 195. 1996 [Online]. Available: https://www.fda.gov/science-research/clinical-trials-and-human-subject-protection/quality-system-regulations}, + author = {{Food and Drug Administration}} +} + +@misc{nerccip, + title = {Critical Infrastructure Protection Reliability Standard CIP}, + year = {2020}, + note = {85 FR 8161. 2020 [Online]. Available: https://www.federalregister.gov/documents/2020/02/13/2020-02173/critical-infrastructure-protection-reliability-standard-cip-012-1-cyber-security-communications}, + author = {{Federal Energy Regulatory Commission}} +} + + +@article{centrality_causal, + title = {Node Centrality Measures Are a Poor Substitute for Causal Inference}, + volume = {9}, + issn = {6846}, + doi = {10.1038/s41598-019-43033-9}, + journal = {Scientific Reports}, + author = {Dablander, Fabian and Hinne, Max}, + year = {2019}, +} + +@inproceedings{Mieghem2018DirectedGA, + title={Directed Graphs and Mysterious Complex Eigenvalues}, + author={Piet Van Mieghem}, + year={2018}, + note={{Delft University of Technology.}} +} + +@article{Guo2017HermitianAM, + title={{Hermitian Adjacency Matrix of Digraphs and Mixed Graphs}}, + author={Krystal Guo and Bojan Mohar}, + journal={Journal of Graph Theory}, + year={2017}, + volume={85} +} + +@article{Brualdi2010SpectraOD, + title={{Spectra of Digraphs}}, + author={Richard A. Brualdi}, + journal={Linear Algebra and Its Applications}, + year={2010}, + volume={432}, + pages={2181-2213} +} + +@article {PMID:30064421, + title = {A Systematic Survey of Centrality Measures for Protein-Protein Interaction Networks}, + Author = {Ashtiani, Minoo and Salehzadeh-Yazdi, Ali and Razaghi-Moghadam, Zahra and Hennig, Holger and Wolkenhauer, Olaf and Mirzaie, Mehdi and Jafari, Mohieddin}, + DOI = {10.1186/s12918-018-0598-2}, + Number = {1}, + Volume = {12}, + Month = {July}, + Year = {2018}, + Journal = {{BMC Systems Biology}}, + ISSN = {1752-0509}, + Pages = {80}, + URL = {https://europepmc.org/articles/PMC6069823}, +} + +@Article{Katz, + author={Leo Katz}, + title={{A New Status Index Derived From Sociometric Analysis}}, + journal={Psychometrika}, + year=1953, + volume={18}, + number={1}, + pages={39-43}, + month={March}, + keywords={}, + doi={10.1007/BF02289026}, + abstract={No abstract is available for this item.}, + url={https://ideas.repec.org/a/spr/psycho/v18y1953i1p39-43.html} +} + +@article{ModKatz, + title={Katz Centrality of Markovian Temporal Networks: Analysis and Optimization}, + author={Masaki Ogura and Victor M. Preciado}, + journal={2017 American Control Conference (ACC)}, + year={2017}, + pages={5001-5006} +} + +@book{newman2010networks, + title={Networks: An Introduction}, + author={Newman, M.E.J.}, + isbn={9780191594175}, + url={https://books.google.com/books?id=sgSlvgEACAAJ}, + year={2010}, + publisher={Oxford University Press} +} + +@article{K_Path_Edge, + doi = {10.1016/j.knosys.2012.01.007}, + url = {https://doi.org/10.1016{\%}2Fj.knosys.2012.01.007}, + year = 2012, + month = {jun}, + publisher = {Elsevier {BV}}, + volume = {30}, + pages = {136--150}, + author = {Pasquale De Meo and Emilio Ferrara and Giacomo Fiumara and Angela Ricciardello}, + title = {A Novel Measure of Edge Centrality in Social Networks}, + journal = {Knowledge-Based Systems} +} + +@article{Adapted_PageRank, + title={An Algorithm for Ranking the Nodes of an Urban Network Based on the Concept of PageRank Vector}, + author={Taras Agryzkov and Jos{\'e} Luis Oliver and Leandro Tortosa and Jos{\'e}-Francisco Vicent}, + journal={Appl. Math. Comput.}, + year={2012}, + volume={219}, + pages={2186-2193} +} + +@article{PageRank, + title = {The Anatomy of a Large-Scale Hypertextual Web Search Engine}, + journal = {Computer Networks and ISDN Systems}, + volume = {30}, + number = {1}, + pages = {107-117}, + year = {1998}, + note = {Proceedings of the Seventh International World Wide Web Conference}, + issn = {0169-7552}, + doi = {https://doi.org/10.1016/S0169-7552(98)00110-X}, + url = {https://www.sciencedirect.com/science/article/pii/S016975529800110X}, + author = {Sergey Brin and Lawrence Page}, + keywords = {World Wide Web, Search engines, Information retrieval, PageRank, Google}, + abstract = {In this paper, we present Google, a prototype of a large-scale search engine which makes heavy use of the structure present in hypertext. Google is designed to crawl and index the Web efficiently and produce much more satisfying search results than existing systems. The prototype with a full text and hyperlink database of at least 24 million pages is available at http://google.stanford.edu/ To engineer a search engine is a challenging task. Search engines index tens to hundreds of millions of Web pages involving a comparable number of distinct terms. They answer tens of millions of queries every day. Despite the importance of large-scale search engines on the Web, very little academic research has been done on them. Furthermore, due to rapid advance in technology and Web proliferation, creating a Web search engine today is very different from three years ago. This paper provides an in-depth description of our large-scale Web search engine — the first such detailed public description we know of to date. Apart from the problems of scaling traditional search techniques to data of this magnitude, there are new technical challenges involved with using the additional information present in hypertext to produce better search results. This paper addresses this question of how to build a practical large-scale system which can exploit the additional information present in hypertext. Also we look at the problem of how to effectively deal with uncontrolled hypertext collections where anyone can publish anything they want.} +} + +@article{PageRank_Survey, + author = { Pavel Berkhin }, + title = {A Survey on PageRank Computing}, + journal = {Internet Mathematics}, + volume = {2}, + number = {1}, + pages = {73-120}, + year = {2005}, + publisher = "Taylor \& Francis", + doi = {10.1080/15427951.2005.10129098}, + URL = {https://doi.org/10.1080/15427951.2005.10129098}, + eprint = {https://doi.org/10.1080/15427951.2005.10129098} +} + +@inproceedings{dominance, + author = {Prosser, Reese T.}, + title = {Applications of Boolean Matrices to the Analysis of Flow Diagrams}, + year = {1959}, + isbn = {9781450378680}, + publisher = {Association for Computing Machinery}, + address = {New York, NY, USA}, + url = {https://doi.org/10.1145/1460299.1460314}, + doi = {10.1145/1460299.1460314}, + abstract = {Any serious attempt at automatic programming of large-scale digital computing machines must provide for some sort of analysis of program structure. Questions concerning order of operations, location and disposition of transfers, identification of subroutines, internal consistency, redundancy and equivalence, all involve a knowledge of the structure of the program under study, and must be handled effectively by any automatic programming system.}, + booktitle = {Papers Presented at the December 1-3, 1959, Eastern Joint IRE-AIEE-ACM Computer Conference}, + pages = {133–138}, + numpages = {6}, + location = {Boston, Massachusetts}, + series = {IRE-AIEE-ACM '59 (Eastern)} +} + +@article{10.1145/3491257, + author = {Li, Ming and Hawrylak, Peter and Hale, John}, + title = {Strategies for Practical Hybrid Attack Graph Generation and Analysis}, + year = {2021}, + publisher = {Association for Computing Machinery}, + address = {New York, NY, USA}, + issn = {2692-1626}, + url = {https://doi.org/10.1145/3491257}, + doi = {10.1145/3491257}, + abstract = {As an analytical tool in cyber-security, an attack graph (AG) is capable of discovering multi-stage attack vectors on target computer networks. Cyber-physical systems (CPSs) comprise a special type of network that not only contains computing devices but also integrates components that operate in the continuous domain, such as sensors and actuators. Using AGs on CPSs requires that the system models and exploit patterns capture both token- and real-valued information. In this paper, we describe a hybrid AG model for security analysis of CPSs and computer networks. Specifically, we focus on two issues related to applying the model in practice: efficient hybrid AG generation and techniques for information extraction from them. To address the first issue, we present an accelerated hybrid AG generator that employs parallel programming and high performance computing (HPC). We conduct performance tests on CPU and GPU platforms to characterize the efficiency of our parallel algorithms. To address the second issue, we introduce an analytical regimen based on centrality analysis and apply it to a hybrid AG generated for a target CPS system to discover effective vulnerability remediation solutions.}, + journal = {Digital Threats}, + month = {Oct}, + keywords = {attack graph, breadth-first search, cyber-physical system, high performance computing} +} + +@article{ZENITANI2023103081, + title = {Attack Graph Analysis: An Explanatory Guide}, + journal = "Computers \& Security", + volume = {126}, + pages = {103081}, + year = {2023}, + issn = {0167-4048}, + doi = {https://doi.org/10.1016/j.cose.2022.103081}, + url = {https://www.sciencedirect.com/science/article/pii/S0167404822004734}, + author = {Kengo Zenitani}, + keywords = {Attack graph, Exploit dependency graph, Cycle handling, Network security metrics, Network hardening, Bayesian attack graph}, + abstract = {Attack graph analysis is a model-based approach for network-security analysis. It analyzes a directed graph called an attack graph. Usually, each node in it corresponds to a malicious event caused by attackers, and the edges correspond to the causal relations between events. We can obtain an attack graph from the network topology, its configuration, and the distribution of vulnerabilities. An attack graph gives us various information relevant to network security. Also, there are several relevant algorithms to find desirable security controls applicable to the network. Over twenty years of research have made much progress in this field. However, it comprises a breadth of definitions and discussions, and it is difficult for people new to this field to comprehend the key ideas. This article aims to briefly introduce this method to prospective researchers by summarizing their progress by selecting and reviewing foundational studies. We elaborate on the essential concepts, such as exploit dependency, AND/OR graph, monotonicity, and cycle handling.} +} + +@article{Zeng2019SurveyOA, + title={Survey of Attack Graph Analysis Methods From the Perspective of Data and Knowledge Processing}, + author={Jianping Zeng and Shuang Wu and Yanyu Chen and Rui Zeng and Chengrong Wu}, + journal={Secur. Commun. Networks}, + year={2019}, + volume={2019}, + pages={2031063:1-2031063:16} +} + +@phdthesis{ming_diss, + author = {Li, Ming and Hawrylak, Peter and Hale, John}, + title = "A System for Attack Graph Generation and Analysis", + school = "The University of Tulsa", + year = "2021", + type = "{PhD} dissertation", + address = "Tulsa, OK", +} + +@phdthesis{noah_ths, + author = {Schrick, Noah and Hawrylak, Peter}, + title = "Compliance Graph Generation Techniques and Parallel Computing Implementations Using Message-Passing Interfaces", + school = "The University of Tulsa", + year = "2022", + type = "{MS} thesis", + address = "Tulsa, OK", +} + +@article{MO2019121538, + title = {Identifying Node Importance Based on Evidence Theory in Complex Networks}, + journal = {Physica A: Statistical Mechanics and Its Applications}, + volume = {529}, + pages = {121538}, + year = {2019}, + issn = {0378-4371}, + doi = {https://doi.org/10.1016/j.physa.2019.121538}, + url = {https://www.sciencedirect.com/science/article/pii/S0378437119309021}, + author = {Hongming Mo and Yong Deng}, + keywords = {Complex networks, Important nodes, Evidence theory, Multi-evidence centrality, Comprehensive measure}, +} + +@article{LI2018512, + title = {Identification of Influential Spreaders Based on Classified Neighbors in Real-World Complex Networks}, + journal = {Applied Mathematics and Computation}, + volume = {320}, + pages = {512-523}, + year = {2018}, + issn = {0096-3003}, + doi = {https://doi.org/10.1016/j.amc.2017.10.001}, + url = {https://www.sciencedirect.com/science/article/pii/S0096300317306884}, + author = {Chao Li and Li Wang and Shiwen Sun and Chengyi Xia}, + keywords = {Influential spreaders, Identification algorithms, Classified neighbors, Complex networks}, +} + + +@Article{sym11020284, + AUTHOR = {Agryzkov, Taras and Curado, Manuel and Pedroche, Francisco and Tortosa, Leandro and Vicent, José F.}, + title = {Extending the Adapted PageRank Algorithm Centrality to Multiplex Networks With Data Using the PageRank Two-Layer Approach}, + JOURNAL = {Symmetry}, + VOLUME = {11}, + YEAR = {2019}, + NUMBER = {2}, + ARTICLE-NUMBER = {284}, + URL = {https://www.mdpi.com/2073-8994/11/2/284}, + ISSN = {2073-8994}, + ABSTRACT = {Usually, the nodes’ interactions in many complex networks need a more accurate mapping than simple links. For instance, in social networks, it may be possible to consider different relationships between people. This implies the use of different layers where the nodes are preserved and the relationships are diverse, that is, multiplex networks or biplex networks, for two layers. One major issue in complex networks is the centrality, which aims to classify the most relevant elements in a given system. One of these classic measures of centrality is based on the PageRank classification vector used initially in the Google search engine to order web pages. The PageRank model may be understood as a two-layer network where one layer represents the topology of the network and the other layer is related to teleportation between the nodes. This approach may be extended to define a centrality index for multiplex networks based on the PageRank vector concept. On the other hand, the adapted PageRank algorithm (APA) centrality constitutes a model to obtain the importance of the nodes in a spatial network with the presence of data (both real and virtual). Following the idea of the two-layer approach for PageRank centrality, we can consider the APA centrality under the perspective of a two-layer network where, on the one hand, we keep maintaining the layer of the topological connections of the nodes and, on the other hand, we consider a data layer associated with the network. Following a similar reasoning, we are able to extend the APA model to spatial networks with different layers. The aim of this paper is to propose a centrality measure for biplex networks that extends the adapted PageRank algorithm centrality for spatial networks with data to the PageRank two-layer approach. Finally, we show an example where the ability to analyze data referring to a group of people from different aspects and using different sets of independent data are revealed.}, + DOI = {10.3390/sym11020284} +} + +@article{10.1093/bioinformatics/bty965, + author = {Parvandeh, Saeid and McKinney, Brett A}, + title = "{EpistasisRank and EpistasisKatz: interaction network centrality methods that integrate prior knowledge networks}", + journal = {Bioinformatics}, + volume = {35}, + number = {13}, + pages = {2329-2331}, + year = {2018}, + month = {11}, + abstract = "{An important challenge in gene expression analysis is to improve hub gene selection to enrich for biological relevance or improve classification accuracy for a given phenotype. In order to incorporate phenotypic context into co-expression, we recently developed an epistasis-expression network centrality method that blends the importance of gene–gene interactions (epistasis) and main effects of genes. Further blending of prior knowledge from functional interactions has the potential to enrich for relevant genes and stabilize classification.We develop two new expression-epistasis centrality methods that incorporate interaction prior knowledge. The first extends our SNPrank (EpistasisRank) method by incorporating a gene-wise prior knowledge vector. This prior knowledge vector informs the centrality algorithm of the inclination of a gene to be involved in interactions by incorporating functional interaction information from the Integrative Multi-species Prediction database. The second method extends Katz centrality to expression-epistasis networks (EpistasisKatz), extends the Katz bias to be a gene-wise vector of main effects and extends the Katz attenuation constant prefactor to be a prior-knowledge vector for interactions. Using independent microarray studies of major depressive disorder, we find that including prior knowledge in network centrality feature selection stabilizes the training classification and reduces over-fitting.Methods and examples provided at https://github.com/insilico/Rinbix and https://github.com/insilico/PriorKnowledgeEpistasisRank.Supplementary data are available at Bioinformatics online.}", + issn = {1367-4803}, + doi = {10.1093/bioinformatics/bty965}, + url = {https://doi.org/10.1093/bioinformatics/bty965}, + eprint = {https://academic.oup.com/bioinformatics/article-pdf/35/13/2329/36613945/bioinformatics\{\_}35\{\_}13\{\_}2329.pdf}, +} + +@article{li_combining_2019, + title = {Combining {OpenCL} and {MPI} to Support Heterogeneous Computing on a Cluster}, + issn = {9781450372275}, + doi = {10.1145/3332186.3333059}, + abstract = {This paper presents an implementation of a heterogeneous programming model which combines Open Computing Language (OpenCL) and Message Passing Interface (MPI). The model is applied to solving a Markov decision process (MDP) with value iteration method. The performance test is conducted on a high performance computing cluster. At peak performance, the model is able to achieve a 57X speedup over a serial implementation. For an extremely large input MDP, which has 1,000,000 states, the obtained speedup is still over 12X, showing that this heterogeneous programming model can solve MDPs more efficiently than the serial solver does.}, + journal = {ACM International Conference Proceeding Series}, + author = {Li, Ming and Hawrylak, Peter and Hale, John}, + year = {2019}, + keywords = {Heterogeneous computing, HPC, MDP, MPI, OpenCL, Parallelism}, + file = {Combining OpenCL and MPI to Support Heterogeneous Computing on a Cluster:/home/noah/Zotero/storage/TXHCQ5S8/Combining OpenCL and MPI to Support Heterogeneous Computing on a Cluster.pdf:application/pdf}, +} + +@mastersthesis{zeng_cyber_2017, + title = {Cyber {Attack} {Analysis} {Based} on {Markov} {Process} {Model}}, + author = {Zeng, Keming}, + school = "The University of Tulsa", + year = {2017}, + address = "Tulsa, OK", +} + +@misc{alaya2022mathematical, + title={Mathematical Analysis of a Delayed SEIRDS Epidemics Models: Deterministic and Stochastic Approach}, + author={Mohamed Ben Alaya and Walid Ben Aribi and Slimane Ben Miled}, + year={2022}, + note={arXiv:2208.07690}, + archivePrefix={arXiv}, + primaryClass={q-bio.PE} +} + +@article{NetworkX, + title = {Exploring Network Structure, Dynamics, and Function Using NetworkX}, + author = {Hagberg, Aric and Swart, Pieter J. and Schult, Daniel A.}, + doi = {}, + note = {{Available: https://www.osti.gov/biblio/960616}}, + journal = {}, + number = , + volume = , + place = {United States}, + year = {2008}, + month = {Jan} +} + +@Manual{igraph, + title = {{Igraph}: Network Analysis and Visualization in R}, + author = {Gábor Csárdi and Tamás Nepusz and Vincent Traag and + Szabolcs Horvát and Fabio Zanini and Daniel Noom and Kirill + Müller}, + year = {2023}, + note = {R package version 1.5.1}, + doi = {10.5281/zenodo.7682609}, + url = {https://CRAN.R-project.org/package=igraph}, +} + +@Manual{Graphviz, + title = {{Graphviz}: Graph Visualization}, + author = {The Graphviz Authors}, + year = {2023}, + note = {Graphviz release 8.1.0 [Online]. Available:https://www.graphviz.org/}, + doi = {10.1007/3-540-45848-4{\_}57}, + url = {https://www.graphviz.org/} +} + +@Manual{diffeqjl, + title = {{DifferentialEquations.jl: Efficient Differential Equation Solving in Julia}}, + author = {{Julia Programming Language}}, + year = {2023}, + note = {{DiffEq.jl v7.7.1}}, + url = {https://docs.sciml.ai/DiffEqDocs/latest/} +} + +@mastersthesis{RAGE, + title = {{RAGE}: {The} {Rage} {Attack} {Graph} {Engine}}, + author = {Cook, Kyle}, + school = {The {University} of {Tulsa}}, + year = {2018}, + file = {Kyle Cook Thesis:/home/noah/Zotero/storage/2SR28HM2/Kyle Cook Thesis.pdf:application/pdf}, +} + +@Manual{pracma, + title = {Pracma: Practical Numerical Math Functions}, + author = {Hans W. Borchers}, + year = {2022}, + note = {R package version 2.4.2}, + url = {https://CRAN.R-project.org/package=pracma}, +} + +@Manual{reticulate, + title = {Reticulate: Interface to 'Python'}, + author = {Kevin Ushey and JJ Allaire and Yuan Tang}, + year = {2023}, + note = {{R package version 1.28. Available: https://CRAN.R-project.org/package=reticulate}} +} + +@thesis{Kalavri2016PerformanceOT, + title={Performance Optimization Techniques and Tools for Distributed Graph Processing}, + author={Vasiliki Kalavri}, + school={{KTH Royal Institute of Technology, Sweden, and Université Catholique de Louvain, Belgium}}, + year={2016}, + type={{PhD}}, + url={https://api.semanticscholar.org/CorpusID:63506793} +} + +@article{10.14778/2947618.2947623, + author = {Kalavri, Vasiliki and Simas, Tiago and Logothetis, Dionysios}, + title = {The Shortest Path Is Not Always a Straight Line: Leveraging Semi-Metricity in Graph Analysis}, + year = {2016}, + issue_date = {May 2016}, + publisher = {VLDB Endowment}, + volume = {9}, + number = {9}, + issn = {2150-8097}, + url = {https://doi.org/10.14778/2947618.2947623}, + doi = {10.14778/2947618.2947623}, + journal = {Proc. VLDB Endow.}, + month = {may}, + pages = {672-683}, + numpages = {12} +} + +@inproceedings{10.1145/3229710.3229730, + author = {Kim, Jong Wook and Choi, Hyoeun and Bae, Seung-Hee}, + title = {Efficient Parallel All-Pairs Shortest Paths Algorithm for Complex Graph Analysis}, + year = {2018}, + isbn = {9781450365239}, + publisher = {Association for Computing Machinery}, + address = {New York, NY, USA}, + url = {https://doi.org/10.1145/3229710.3229730}, + doi = {10.1145/3229710.3229730}, + booktitle = {Workshop Proceedings of the 47th International Conference on Parallel Processing}, + articleno = {5}, + numpages = {10}, + keywords = {All-pairs shortest paths, Parallel Algorithms, Shared-memory parallelism}, + location = {Eugene, OR, USA}, + series = {ICPP Workshops '18} +} + +@article{Jha2002TwoFA, + title={Two Formal Analyses of Attack Graphs}, + author={Somesh Jha and Oleg Sheyner and Jeannette M. Wing}, + journal={Proceedings 15th IEEE Computer Security Foundations Workshop. CSFW-15}, + year={2002}, + pages={49-63}, + url={https://api.semanticscholar.org/CorpusID:16108364} +} + +@article{Islam2008AHA36, + title={A Heuristic Approach to Minimum-Cost Network Hardening Using Attack Graph}, + author={Tania Islam and Lingyu Wang}, + journal={2008 New Technologies, Mobility and Security}, + year={2008}, + pages={1-5}, + url={https://api.semanticscholar.org/CorpusID:6625112} +} + +@article{10.1016/j.comcom.2006.06.01837, + author = {Wang, Lingyu and Noel, Steven and Jajodia, Sushil}, + title = {Minimum-Cost Network Hardening Using Attack Graphs}, + year = {2006}, + issue_date = {November, 2006}, + publisher = {Elsevier Science Publishers B. V.}, + address = {NLD}, + volume = {29}, + number = {18}, + issn = {0140-3664}, + url = {https://doi.org/10.1016/j.comcom.2006.06.018}, + doi = {10.1016/j.comcom.2006.06.018}, + journal = {Computer Communications}, + month = {nov}, + pages = {3812-3824}, + numpages = {13}, + keywords = {Intrusion detection, Vulnerability analysis, Intrusion prevention} +} + +@inproceedings{10.1109/IAS.2008.38, + author = {Chen, Feng and Wang, Lingyu and Su, Jinshu}, + title = {An Efficient Approach to Minimum-Cost Network Hardening Using Attack Graphs}, + year = {2008}, + isbn = {9780769533247}, + publisher = {IEEE Computer Society}, + address = {USA}, + url = {https://doi.org/10.1109/IAS.2008.38}, + doi = {10.1109/IAS.2008.38}, + abstract = {Attack graphs can reveal the threat of sophisticated multi-step attacks by enumerating possible sequences of exploits leading to the compromise of given critical resources. Finding a solution to remove such threats by hands is tedious and error prone, particularly for larger and poorly secured networks. Existing automated approaches for hardening a network has an exponential complexity and is not scalable to large networks. This paper proposes a novel approach of applying the Reduced Ordered Binary Decision Diagram (ROBDD) method to network hardening. Existing mature optimization techniques in ROBDD makes the proposed approach an efficient solution that can potentially be applied to large networks.}, + booktitle = {Proceedings of the 2008 The Fourth International Conference on Information Assurance and Security}, + pages = {209-212}, + numpages = {4}, + keywords = {Attack Graphs, Minimum-Cost, network securty, vulnerability}, + series = {IAS '08} +} + +@article{JUNCHUN20113227, + title = {A Minimum Cost of Network Hardening Model Based on Attack Graphs}, + journal = {Procedia Engineering}, + volume = {15}, + pages = {3227-3233}, + year = {2011}, + note = {CEIS 2011}, + issn = {1877-7058}, + doi = {https://doi.org/10.1016/j.proeng.2011.08.606}, + url = {https://www.sciencedirect.com/science/article/pii/S1877705811021072}, + author = {MA Jun-chun and WANG Yong-jun and SUN Ji-yin and CHEN Shan}, + keywords = {network security, attack graphs, bidirectional-based search, genetic algorithms, minimum-cost}, +} + +@article{0.1117/12.60424, + author = {Liu, Yu and Man, Hong}, + year = {2005}, + month = {03}, + pages = {}, + title = {Network Vulnerability Assessment Using Bayesian Networks}, + journal = {Proc SPIE}, + doi = {10.1117/12.604240} +} + +@inproceedings{10.1145/1456362.1456368, + author = {Frigault, Marcel and Wang, Lingyu and Singhal, Anoop and Jajodia, Sushil}, + year = {2008}, + month = {10}, + pages = {23-30}, + title = {Measuring Network Security Using Dynamic Bayesian Network}, + doi = {10.1145/1456362.1456368} +} + +@article{10.1145/3105760, + author = {Mu\~{n}oz-Gonz\'{a}lez, Luis and Sgandurra, Daniele and Paudice, Andrea and Lupu, Emil C.}, + title = {Efficient Attack Graph Analysis Through Approximate Inference}, + year = {2017}, + issue_date = {August 2017}, + publisher = {Association for Computing Machinery}, + address = {New York, NY, USA}, + volume = {20}, + number = {3}, + issn = {2471-2566}, + url = {https://doi.org/10.1145/3105760}, + doi = {10.1145/3105760}, + journal = {ACM Trans. Priv. Secur.}, + month = {Jul}, + articleno = {10}, + numpages = {30}, + keywords = {Bayesian networks, approximate inference, probabilistic graphical models} +} + +@article{10.1155/2017/3407642, + author = {{Hu, Hao and Zhang, Hongqi and Liu, Yuling and Wang, Yongwei and Du, Xiaojiang}}, + title = {{Quantitative Method for Network Security Situation Based on Attack Prediction}}, + year = {2017}, + issue_date = {2017}, + publisher = {{John Wiley \& Sons, Inc.}}, + address = {USA}, + volume = {2017}, + issn = {1939-0114}, + url = {https://doi.org/10.1155/2017/3407642}, + doi = {10.1155/2017/3407642}, + journal = {Security and Communications Networks}, + month = {jan}, + numpages = {19} +} + +@article{Abraham2014CyberSA, + title={Cyber Security Analytics: A Stochastic Model for Security Quantification Using Absorbing Markov Chains}, + author={Subil Abraham and Suku Nair}, + journal={Journal of Communications}, + year={2014}, + url={https://api.semanticscholar.org/CorpusID:8554925} +} + +@misc{abraham2015predictive, + title={A Predictive Framework for Cyber Security Analytics Using Attack Graphs}, + author={Subil Abraham and Suku Nair}, + year={2015}, + eprint={1502.01240}, + archivePrefix={arXiv}, + primaryClass={cs.CR} +} + +@article{Durkota2019HardeningNA, + title={Hardening Networks Against Strategic Attackers Using Attack Graph Games}, + author={Karel Durkota and V. Lis{\'y} and Branislav Bosansk{\'y} and Christopher Kiekintveld and Michal Pechoucek}, + journal={Computer Security}, + year={2019}, + volume={87}, + url={https://api.semanticscholar.org/CorpusID:201134692} +} + +@article{10.1145/3418897, + author = {Hu, Zhisheng and Zhu, Minghui and Liu, Peng}, + title = {Adaptive Cyber Defense Against Multi-Stage Attacks Using Learning-Based POMDP}, + year = {2020}, + issue_date = {February 2021}, + publisher = {Association for Computing Machinery}, + address = {New York, NY, USA}, + volume = {24}, + number = {1}, + issn = {2471-2566}, + url = {https://doi.org/10.1145/3418897}, + doi = {10.1145/3418897}, + journal = {ACM Transactions on Privacy and Security}, + month = {nov}, + articleno = {6}, + numpages = {25}, + keywords = {adaptive cyber defense, Thompson sampling, Reinforcement learning} +} + +@article{Miehling2018APA, + title={A POMDP Approach to the Dynamic Defense of Large-Scale Cyber Networks}, + author={Erik Miehling and Mohammad Reza Rasouli and Demosthenis Teneketzis}, + journal={IEEE Transactions on Information Forensics and Security}, + year={2018}, + volume={13}, + pages={2490-2505}, + url={https://api.semanticscholar.org/CorpusID:13705714} +} + +@article{Nguyen2017AnAT, + title={An Approach to Incorporating Uncertainty in Network Security Analysis}, + author={Hoang Hai Nguyen and Kartik Palani and David M. Nicol}, + journal={Proceedings of the Hot Topics in Science of Security: Symposium and Bootcamp}, + year={2017}, + url={https://api.semanticscholar.org/CorpusID:16666067} +} + +@Inbook{Wang2017, + author="Wang, Lingyu + and Jajodia, Sushil + and Singhal, Anoop + and Cheng, Pengsu + and Noel, Steven", + title="k-Zero Day Safety: Evaluating the Resilience of Networks Against Unknown Attacks", + bookTitle="Network Security Metrics", + year="2017", + publisher="Springer International Publishing", + address="Cham", + pages="75--93", + isbn="978-3-319-66505-4", + doi="10.1007/978-3-319-66505-4{\_}4", + url="https://doi.org/10.1007/978-3-319-66505-4{\_}4" +} + +@InProceedings{10.1007/978-3-030-64793-3_24, + author="Anwar, Ahmed H. + and Kamhoua, Charles", + editor="Zhu, Quanyan + and Baras, John S. + and Poovendran, Radha + and Chen, Juntao", + title="Game Theory on Attack Graph for Cyber Deception", + booktitle="Decision and Game Theory for Security", + year="2020", + publisher="Springer International Publishing", + address="Cham", + pages="445--456", + abstract="Game Theory provides a set of tools and a framework suitable to study security problems. In this paper, a class of games is developed to study cyber deception and the interactions between the network defender who is deceiving an adversary to mitigate the damage of the attack. In order to capture network topology, each game is played over an attack graph that can be generated according to the vulnerabilities associated with each node. The defender's goal is to take deceptive actions to prevent the attacker from taking control over the network resources exploiting the incomplete information of the attacker regarding the deceptive network gained through the attack reconnaissance stage. To this end, we present several games such as normal form static, dynamic, hypergame, and a partially observable stochastic game (POSG) to study the game dynamics at different information structures. For the most general class of games, (i.e., POSG), we provide multiple solution approaches to overcome the intractability of the game model and finally present numerical result samples to show the effectiveness of each solution approach.", + isbn="978-3-030-64793-3" +} + +@INBOOK{9124037, + author={Xi, Bowei and Kamhoua, Charles A.}, + booktitle={Modeling and Design of Secure Internet of Things}, + title={A Hypergame-Based Defense Strategy Toward Cyber Deception in Internet of Battlefield Things (IoBT)}, + year={2020}, + volume={}, + number={}, + pages={59-77}, + doi={10.1002/9781119593386.ch3} +} + +@InProceedings{10.1007/978-3-030-64793-3_9, + author="Kulkarni, Abhishek N. + and Fu, Jie + and Luo, Huan + and Kamhoua, Charles A. + and Leslie, Nandi O.", + editor="Zhu, Quanyan + and Baras, John S. + and Poovendran, Radha + and Chen, Juntao", + title="Decoy Allocation Games on Graphs with Temporal Logic Objectives", + booktitle="Decision and Game Theory for Security", + year="2020", + publisher="Springer International Publishing", + address="Cham", + pages="168--187", + isbn="978-3-030-64793-3" +} + +@conference{1503283, + title = {Security Scheduling for Real-World Networks }, + booktitle = {International Conference on Autonomous Agents and Multiagent Systems (AAMAS)}, + year = {2013}, + author = {Jain, Manish and Vincent Conitzer and Tambe, Milind} +} + +@article{HORAK2019101579, + title = {Optimizing Honeypot Strategies Against Dynamic Lateral Movement Using Partially Observable Stochastic Games}, + journal = {Computers \& Security}, + volume = {87}, + pages = {101579}, + year = {2019}, + issn = {0167-4048}, + doi = {https://doi.org/10.1016/j.cose.2019.101579}, + url = {https://www.sciencedirect.com/science/article/pii/S0167404819300665}, + author = {Karel Horák and Branislav Bošanský and Petr Tomášek and Christopher Kiekintveld and Charles Kamhoua}, + keywords = {Dynamic honeypot allocation, Lateral movement, Partially observable stochastic games, Compact representation, Incremental strategy generation} +} + +@article{10.1080/23311916.2018.1502242, + author = {Gunantara, Nyoman}, + year = {2018}, + month = {07}, + pages = {}, + title = {A Review of Multi-Objective Optimization: Methods and Its Applications}, + volume = {5}, + journal = {Cogent Engineering}, + doi = {10.1080/23311916.2018.1502242} +} + +@Inbook{Awange2023, + author="Awange, Joseph L. + and Pal{\'a}ncz, B{\'e}la + and Lewis, Robert H. + and V{\"o}lgyesi, Lajos", + title="Multiobjective Optimization", + bookTitle="Mathematical Geosciences: Hybrid Symbolic-Numeric Methods", + year="2023", + publisher="Springer International Publishing", + address="Cham", + pages="319--352", + isbn="978-3-030-92495-9", + doi="10.1007/978-3-030-92495-9{\_}9", + url="https://doi.org/10.1007/978-3-030-92495-9{\_}9" +} + +@article{MIRJALILI2015228, + title = {Moth-Flame Optimization Algorithm: A Novel Nature-Inspired Heuristic Paradigm}, + journal = {Knowledge-Based Systems}, + volume = {89}, + pages = {228-249}, + year = {2015}, + issn = {0950-7051}, + doi = {https://doi.org/10.1016/j.knosys.2015.07.006}, + url = {https://www.sciencedirect.com/science/article/pii/S0950705115002580}, + author = {Seyedali Mirjalili}, + keywords = {Optimization, Stochastic optimization, Constrained optimization, Meta-heuristic, Population-based algorithm} +} + +@INPROCEEDINGS{7732428, + author={Vikas and Nanda, Satyasai Jagannath}, + booktitle={2016 International Conference on Advances in Computing, Communications and Informatics (ICACCI)}, + title={Multi-Objective Moth Flame Optimization}, + year={2016}, + volume={}, + number={}, + pages={2470-2476}, + doi={10.1109/ICACCI.2016.7732428} +} + +@INPROCEEDINGS{9563556, + author={Bingi, Kishore and Kulkarni, Rakshit Raghavendra and Mantri, Rhea}, + booktitle={2021 IEEE Madras Section Conference (MASCON)}, + title={Development of Hybrid Algorithm Using Moth-Flame and Particle Swarm Optimization}, + year={2021}, + volume={}, + number={}, + pages={1-6}, + doi={10.1109/MASCON51689.2021.9563556} +} + +@article{Sharifi2021ANO, + title={A New Optimization Algorithm to Solve Multi-Objective Problems}, + author={Mohammad Reza Sharifi and Saeid Akbarifard and Kourosh Qaderi and Mohamad Reza Madadi}, + journal={Scientific Reports}, + year={2021}, + volume={11}, + url={https://api.semanticscholar.org/CorpusID:238860219} +} + +@book{10.1007/978-3-540-24777-7, + author = {Kellerer, Hans and Pferschy, Ulrich and Pisinger, David}, + year = {2004}, + month = {Jan.}, + pages = {}, + title = {Knapsack Problems}, + isbn = {978-3-540-40286-2}, + journal = {Knapsack Problems}, + doi = {10.1007/978-3-540-24777-7}, + publisher = {Springer Berlin, Heidelberg}, +} + +@INPROCEEDINGS{8204118, + author={Gupta, Indresh Kumar and Choubey, Abha and Choubey, Siddhartha}, + booktitle={2017 8th International Conference on Computing, Communication and Networking Technologies (ICCCNT)}, + title={Clustered Genetic Algorithm to Solve Multidimensional Knapsack Problem}, + year={2017}, + volume={}, + number={}, + pages={1-6}, + doi={10.1109/ICCCNT.2017.8204118} +} + +@ARTICLE{9142411, + author={Li, Zuocheng and Tang, Lixin and Liu, Jiyin}, + journal={IEEE Transactions on Cybernetics}, + title={A Memetic Algorithm Based on Probability Learning for Solving the Multidimensional Knapsack Problem}, + year={2022}, + volume={52}, + number={4}, + pages={2284-2299}, + doi={10.1109/TCYB.2020.3002495} +} + +@INPROCEEDINGS{9308380, + author={Gu, Hanyu}, + booktitle={2020 IEEE Symposium Series on Computational Intelligence (SSCI)}, + title={Optimal Lagrangian Multipliers for the Multidimensional Knapsack Problem: A Bayesian Optimisation Approach}, + year={2020}, + volume={}, + number={}, + pages={3149-3155}, + doi={10.1109/SSCI47803.2020.9308380} +} + +@INPROCEEDINGS{5455187, + author={Shan, Bowei}, + booktitle={2009 First International Conference on Information Science and Engineering}, + title={The Spread of Malware on the WiFi Network: Epidemiology Model and Behaviour Evaluation}, + year={2009}, + volume={}, + number={}, + pages={1916-1918}, + doi={10.1109/ICISE.2009.1285} +} + +@INPROCEEDINGS{8228672, + author={Mitchell, Robert}, + booktitle={2017 IEEE Conference on Communications and Network Security (CNS)}, + title={Epidemic-Resistant Configurations for Intrusion Detection Systems}, + year={2017}, + volume={}, + number={}, + pages={487-494}, + doi={10.1109/CNS.2017.8228672} +} + +@ARTICLE{6414589, + author={Kim, Hyoungshick and Anderson, Ross}, + journal={IEEE Systems Journal}, + title={An Experimental Evaluation of Robustness of Networks}, + year={2013}, + volume={7}, + number={2}, + pages={179-188}, + doi={10.1109/JSYST.2012.2221851} +} + +@INPROCEEDINGS{9450250, + author={Wang, Yingxu and Plataniotis, Kostas N. and Wang, Jane Z. and Hou, Ming and Zhou, Menchu and Howard, Newton and Peng, Jun and Huang, Runhe and Patel, Shushma and Zhang, Du}, + booktitle={2020 IEEE 19th International Conference on Cognitive Informatics \& Cognitive Computing (ICCI*CC)}, + title={The Cognitive and Mathematical Foundations of Analytic Epidemiology}, + year={2020}, + volume={}, + number={}, + pages={6-14}, + doi={10.1109/ICCICC50026.2020.9450250} +} + +@INPROCEEDINGS{9457692, + author={Parwez, Md. Aslam and Abulaish, Muhammad and Jahiruddin, Jahiruddin}, + booktitle={2020 IEEE/WIC/ACM International Joint Conference on Web Intelligence and Intelligent Agent Technology (WI-IAT)}, + title={A Social Media Time-Series Data Analytics Approach for Digital Epidemiology}, + year={2020}, + volume={}, + number={}, + pages={852-859}, + doi={10.1109/WIIAT50758.2020.00131} +} + +@misc{j_hale_compliance_nodate, + title = {Compliance {Method} for a {Cyber}-{Physical} {System}}, + author = {{J. Hale} and Hawrylak, P. and Papa, M.}, + note = {U.S. Patent Number 9,471,789, Oct. 18, 2016.}, + number = {9471789}, + file = {Complaince{\_}Graph{\_}US{\_}Patent{\_}9471789:/home/noah/Zotero/storage/55BZN4U7/Complaince{\_}Graph{\_}US{\_}Patent{\_}9471789.pdf:application/pdf}, +} + +@inproceedings{baloyi_guidelines_2019, + address = {Skukuza South Africa}, + title = {Guidelines for {Data} {Privacy} {Compliance}: {A} {Focus} on {Cyberphysical} {Systems} and {Internet} of {Things}}, + doi = {10.1145/3351108.3351143}, + booktitle = {{SAICSIT} '19: {Proceedings} of the {South} {African} {Institute} of {Computer} {Scientists} and {Information} {Technologists} 2019}, + publisher = {Association for Computing Machinery}, + author = {Baloyi, Ntsako and Kotzé, Paula}, + year = {2019}, +} + +@article{allman_complying_2006, + title = {Complying With {Compliance}: {Blowing} It Off Is Not an Option.}, + volume = {4}, + number = {7}, + journal = {ACM Queue}, + author = {Allman, Eric}, + year = {2006}, +} + +@ARTICLE{9914620, + author={Ahn, Sujin and Kwon, Minhae}, + journal={IEEE Journal of Biomedical and Health Informatics}, + title={Reproduction Factor Based Latent Epidemic Model Inference: A Data-Driven Approach Using COVID-19 Datasets}, + year={2023}, + volume={27}, + number={3}, + pages={1259-1270}, + doi={10.1109/JBHI.2022.3213175} +} + +@INPROCEEDINGS{9929470, + author={Roy, Tamal Joyti and Mahmood, Md. Ashiq and Mohanta, Aninda and Roy, Diti}, + booktitle={2021 IEEE International Conference on Robotics, Automation, Artificial-Intelligence and Internet-of-Things (RAAICON)}, + title={An Analytical Approach to Predict the COVID-19 Death Rate in Bangladesh Utilizing Multiple Regression and SEIR Model}, + year={2021}, + volume={}, + number={}, + pages={42-45}, + doi={10.1109/RAAICON54709.2021.9929470} +} + +@INPROCEEDINGS{9628991, + author={Chumachenko, Dmytro and Bazilevych, Kseniia and Meniailov, Ievgen and Yakovlev, Sergiy and Chumachenko, Tetyana}, + booktitle={2021 IEEE 4th International Conference on Advanced Information and Communication Technologies (AICT)}, + title={Simulation of COVID-19 Dynamics Using Ridge Regression}, + year={2021}, + volume={}, + number={}, + pages={163-166}, + doi={10.1109/AICT52120.2021.9628991} +} + +@INPROCEEDINGS{9630798, + author={Zhang, Siqi and Yang, Hui}, + booktitle={2021 43rd Annual International Conference of the IEEE Engineering in Medicine \& Biology Society (EMBC)}, + title={Spatial Modeling and Analysis of Human Traffic and Infectious Virus Spread in Community Networks}, + year={2021}, + volume={}, + number={}, + pages={2286-2289}, + doi={10.1109/EMBC46164.2021.9630798} +} + +@INPROCEEDINGS{9678822, + author={Dakhno, Natalia and Leshchenko, Olga and Kravchenko, Yurii and Dudnik, Andriy and Trush, Olexandr and Khankishiev, Victor}, + booktitle={2021 IEEE 3rd International Conference on Advanced Trends in Information Theory (ATIT)}, + title={Dynamic Model of the Spread of Viruses in a Computer Network Using Differential Equations}, + year={2021}, + volume={}, + number={}, + pages={111-115}, + doi={10.1109/ATIT54053.2021.9678822} +} + +@INPROCEEDINGS{10227113, + author={Tang, Yuyang and Williams, Richard A.}, + booktitle={2022 IEEE International Symposium on Technology and Society (ISTAS)}, + title={Investigating Relationship Conflict Within the Social Network of Large IS Projects Using a SIR Model}, + year={2022}, + volume={1}, + number={}, + pages={1-5}, + doi={10.1109/ISTAS55053.2022.10227113} +} + +@INPROCEEDINGS{9856356, + author={Mathebula, Dephney}, + booktitle={2022 International Conference on Artificial Intelligence, Big Data, Computing and Data Communication Systems (icABCD)}, + title={Novel Data-Based Model for Future Epidemiology}, + year={2022}, + volume={}, + number={}, + pages={1-6}, + doi={10.1109/icABCD54961.2022.9856356} +} + +@INPROCEEDINGS{9593147, + author={Fedorov, Dmitriy and Tabarak, Yrys and Dadlani, Aresh and Kumar, Muthukrishnan Senthil and Kizheppatt, Vipin}, + booktitle={2021 International Balkan Conference on Communications and Networking (BalkanCom)}, + title={Dynamics of Multi-Strain Malware Epidemics Over Duty-Cycled Wireless Sensor Networks}, + year={2021}, + volume={}, + number={}, + pages={1-5}, + doi={10.1109/BalkanCom53780.2021.9593147} +} + +@Article{Lou2021, + author={Lou, Yuan + and Salako, Rachidi B.}, + title={Control Strategies for a Multi-Strain Epidemic Model}, + journal={Bulletin of Mathematical Biology}, + year={2021}, + month={Nov}, + day={27}, + volume={84}, + number={1}, + pages={10}, + issn={1522-9602}, + doi={10.1007/s11538-021-00957-6}, + url={https://doi.org/10.1007/s11538-021-00957-6} +} + +@article{10.1371/journal.pone.0257512, + doi = {10.1371/journal.pone.0257512}, + author = {Arruda, Edilson F. AND Das, Shyam S. AND Dias, Claudia M. AND Pastore, Dayse H.}, + journal = {Plos One}, + publisher = {Public Library of Science}, + title = {Modelling and Optimal Control of Multi Strain Epidemics, With Application to COVID-19}, + year = {2021}, + month = {09}, + volume = {16}, + url = {https://doi.org/10.1371/journal.pone.0257512}, + pages = {1-18}, + number = {9}, +} + +@inproceedings{GCAI-2018:Analysis_of_Attack_Graph, + author = {Tom Gonda and Tal Pascal and Rami Puzis and Guy Shani and Bracha Shapira}, + title = {Analysis of Attack Graph Representations for Ranking Vulnerability Fixes}, + booktitle = {GCAI-2018. 4th Global Conference on Artificial Intelligence}, + editor = {Daniel Lee and Alexander Steen and Toby Walsh}, + series = {EPiC Series in Computing}, + volume = {55}, + pages = {215--228}, + year = {2018}, + publisher = {EasyChair}, + bibsource = {EasyChair, https://easychair.org}, + issn = {2398-7340}, + url = {https://easychair.org/publications/paper/ZBHj}, + doi = {10.29007/2c1q} +} + +@article{10.1371/journal.pone.0053095, + doi = {10.1371/journal.pone.0053095}, + author = {Piraveenan, Mahendra AND Prokopenko, Mikhail AND Hossain, Liaquat}, + journal = {Plos One}, + publisher = {Public Library of Science}, + title = {Percolation Centrality: Quantifying Graph-Theoretic Impact of Nodes During Percolation in Networks}, + year = {2013}, + month = {01}, + volume = {8}, + url = {https://doi.org/10.1371/journal.pone.0053095}, + pages = {1-14}, + number = {1}, +} + +@inproceedings{10.1145/3288599.3295597, + author = {De, Sanghamitra and Barik, Mridul Sankar and Banerjee, Indrajit}, + title = {A Percolation-Based Recovery Mechanism for Bot Infected P2P Cloud}, + year = {2019}, + isbn = {9781450360944}, + publisher = {Association for Computing Machinery}, + address = {New York, NY, USA}, + url = {https://doi-org.utulsa.idm.oclc.org/10.1145/3288599.3295597}, + doi = {10.1145/3288599.3295597}, + abstract = {Execution of any recovery procedure in compromised nodes of a Cloud should aim at covering as many nodes as possible in a given time. The authors propose an innovative approach using the concept of percolation centrality to spread the execution of a recovery procedure across adjacent nodes in a P2PCloud. Compromised networks can be large since botnets and malware infections use the advantage of the internet to spread rapidly. Using percolation centrality to choose a node from where to begin, the recovery procedure runs in parallel in different nodes which can be reached from a chosen node and spreads fast.}, + booktitle = {Proceedings of the 20th International Conference on Distributed Computing and Networking}, + pages = {474-479}, + numpages = {6}, + keywords = {churning, botnet, P2PCloud, P2P network, percolation centrality}, + location = {Bangalore, India}, + series = {ICDCN '19} +} + +@INPROCEEDINGS{9680376, + author={Chandramouli, Athreya and Jana, Sayantan and Kothapalli, Kishore}, + booktitle={2021 IEEE 28th International Conference on High Performance Computing, Data, and Analytics (HiPC)}, + title={Efficient Parallel Algorithms for Computing Percolation Centrality}, + year={2021}, + volume={}, + number={}, + pages={111-120}, + doi={10.1109/HiPC53243.2021.00025} +} + +@article{AUDRITO2021102584, +title = {Aggregate Centrality Measures for IoT-based Coordination}, +journal = {Science of Computer Programming}, +volume = {203}, +pages = {102584}, +year = {2021}, +issn = {0167-6423}, +doi = {https://doi.org/10.1016/j.scico.2020.102584}, +url = {https://www.sciencedirect.com/science/article/pii/S0167642320301921}, +author = {Giorgio Audrito and Danilo Pianini and Ferruccio Damiani and Mirko Viroli} +} + +@article{MO2019121538, +title = {Identifying Node Importance Based on Evidence Theory in Complex Networks}, +journal = {Physica A: Statistical Mechanics and Its Applications}, +volume = {529}, +pages = {121538}, +year = {2019}, +issn = {0378-4371}, +doi = {https://doi.org/10.1016/j.physa.2019.121538}, +url = {https://www.sciencedirect.com/science/article/pii/S0378437119309021}, +author = {Hongming Mo and Yong Deng}, +keywords = {Complex networks, Important nodes, Evidence theory, Multi-evidence centrality, Comprehensive measure}, +} + +@article{LI2018512, +title = {Identification of Influential Spreaders Based on Classified Neighbors in Real-World Complex Networks}, +journal = {Applied Mathematics and Computation}, +volume = {320}, +pages = {512-523}, +year = {2018}, +issn = {0096-3003}, +doi = {https://doi.org/10.1016/j.amc.2017.10.001}, +url = {https://www.sciencedirect.com/science/article/pii/S0096300317306884}, +author = {Chao Li and Li Wang and Shiwen Sun and Chengyi Xia}, +keywords = {Influential spreaders, Identification algorithms, Classified neighbors, Complex networks}, +} + +@article{brandes, +author = {Ulrik Brandes}, +title = {A Faster Algorithm for Betweenness Centrality* }, +journal = {The Journal of Mathematical Sociology}, +volume = {25}, +number = {2}, +pages = {163-177}, +year = {2001}, +publisher = {Routledge}, +doi = {10.1080/0022250X.2001.9990249}, + + +URL = { + + https://doi.org/10.1080/0022250X.2001.9990249 + + + +}, +eprint = { + + https://doi.org/10.1080/0022250X.2001.9990249 + + + +} + +} + +@misc{stankovic2023fourier, + title={Fourier Analysis of Signals on Directed Acyclic Graphs (DAG) Using Graph Zero-Padding}, + author={Ljubisa Stankovic and Milos Dakovic and Ali Bagheri Bardi and Milos Brajovic and Isidora Stankovic}, + year={2023}, + note={arXiv:2311.01073}, + archivePrefix={arXiv}, + primaryClass={cs.IT} +} + +@misc{seifert2023causal, + title={Causal Fourier Analysis on Directed Acyclic Graphs and Posets}, + author={Bastian Seifert and Chris Wendler and Markus Püschel}, + year={2023}, + note={arXiv:2209.07970}, + archivePrefix={arXiv}, + primaryClass={eess.SP} +} + +@BOOK{laug, + AUTHOR = {Anderson, E. and Bai, Z. and Bischof, C. and + Blackford, S. and Demmel, J. and Dongarra, J. and + Du Croz, J. and Greenbaum, A. and Hammarling, S. and + McKenney, A. and Sorensen, D.}, + title = {{LAPACK} Users' Guide}, + EDITION = {3rd}, + PUBLISHER = {Society for Industrial and Applied Mathematics}, + YEAR = {1999}, + ADDRESS = {Philadelphia, PA}, + ISBN = {0-89871-447-8 (paperback)} } + +@article{MACEDO2016999, +title = {Gaussian Elimination Is Not Optimal, Revisited}, +journal = {Journal of Logical and Algebraic Methods in Programming}, +volume = {85}, +number = {5, Part 2}, +pages = {999-1010}, +year = {2016}, +issn = {2352-2208}, +doi = {https://doi.org/10.1016/j.jlamp.2016.06.003}, +url = {https://www.sciencedirect.com/science/article/pii/S2352220816300529}, +author = {Hugo Daniel Macedo}, +} + +@misc{williams2023new, + title={New Bounds for Matrix Multiplication: From Alpha to Omega}, + author={Virginia Vassilevska Williams and Yinzhan Xu and Zixuan Xu and Renfei Zhou}, + year={2023}, + eprint={2307.07970}, + archivePrefix={arXiv}, + primaryClass={cs.DS} +} + +@misc{alman2020refined, + title={A Refined Laser Method and Faster Matrix Multiplication}, + author={Josh Alman and Virginia Vassilevska Williams}, + year={2020}, + eprint={2010.05846}, + archivePrefix={arXiv}, + primaryClass={cs.DS} +} + +@article{bordacent, +author = {Madotto, Andrea and Liu, Jiming}, +year = {2016}, +month = {Dec.}, +pages = {}, +title = {Super-Spreader Identification Using Meta-Centrality}, +volume = {6}, +journal = {Scientific Reports}, +doi = {10.1038/srep38994} +} + +@article{6023c4f8-ecc1-3dbe-9f88-265b318523d2, + ISSN = {00115266}, + URL = {http://www.jstor.org/stable/20026529}, + author = {John G. Kemeny}, + journal = {Daedalus}, + number = {4}, + pages = {577--591}, + publisher = {The MIT Press}, + title = {Mathematics Without Numbers}, + urldate = {2024-03-01}, + volume = {88}, + year = {1959} +} + +@article{doi:10.1137/0135023, +author = {Young, H. P. and Levenglick, A.}, +title = {A Consistent Extension of Condorcet’s Election Principle}, +journal = {SIAM Journal on Applied Mathematics}, +volume = {35}, +number = {2}, +pages = {285-300}, +year = {1978}, +doi = {10.1137/0135023}, + +URL = { + + https://doi.org/10.1137/0135023 + + + +}, +eprint = { + + https://doi.org/10.1137/0135023 + + + +} +, +} + +@misc{OSHA, + author = {{Occupational Safety and Health Administration}}, + title = {{Standard} 1910 {Subpart} {H} {Hazardous} {Materials}}, + year = {{Last Amended 2024 via Code of Federal Regulations Title 29}} +} + + +@onlne{AutoInd, + author = {{International Trade Administration, U.S. Department of Commerce}}, + title = {{Automotive Industry}}, + year = {August 2021}, + note = {{[Online]. Available: https://www.trade.gov/selectusa-automotive-industry}}, + urldate = {2023-11-07} +} + +@onlne{AutoIndFS, + author = {{International Trade Administration, U.S. Department of Commerce}}, + title = {{Foreign Direct Investment (FDI): Automotive}}, + year = {August 2021}, + note = {{[Online]. Available: https://www.trade.gov/sites/default/files/2021-09/Automotive{\%}20-{\%}20FINAL.pdf}}, + urldate = {2023-11-07} +} + +@online{BEAFS, + author = {{U.S. Bureau of Economic Analysis}}, + title = {{Industry Factsheet: Transportation and Warehousing}}, + year = {2023}, + note = {{[Online]. Available: https://apps.bea.gov/industry/factsheet/factsheet.html\#48TW}}, + urldate = {2024-02-25} +} + +@online{BEATables, + author = {{U.S. Bureau of Economic Analysis}}, + title = {{Value Added by Industry}}, + year = {2023-12-21}, + urldate = {2024-02-25} +} + +@online{BEATablesOutput, + author = {{U.S. Bureau of Economic Analysis}}, + title = {{Gross Output by Industry}}, + year = {2023-12-21}, + urldate = {2024-02-25} +} + +@online{GMInsight, + author = {{Singh, A, and Singh, S.}}, + title = {{Automotive Repair and Maintenance Service Market Size}}, + year = {Feb. 2024}, + note = {{[Online]. Available: https://www.gminsights.com/industry-analysis/automotive-repair-maintenance-services-market}}, + urldate = {2024-02-25} +} + +@online{Corolla, + author = {{Toyota Motor Sales, U.S.A., Inc.}}, + title = {{Downloadable Manuals}}, + note = {{[Online]. Available: https://www.toyota.com/owners/warranty-owners-manuals/}}, + urldate = {2024-02-25} +} + +@online{carDOE, + author = {{U.S. Department of Energy}}, + title = {{Alternative Fuels Data Center}}, + note = {{[Online]. Available: https://afdc.energy.gov/data/categories/driving-patterns}}, + urldate = {2024-02-25} +} + +@online{carDOT, + author = {{National Transportation Statistics Datasets}}, + title = {{United States Department of Transportation Bureau of Transportation Statistics}}, + note = {{[Online]. Available: https://www.bts.gov/product/national-transportation-statistics}}, + urldate = {2024-02-25} +} + +@online{carFWHA, + author = {{U.S. Department of Transportation Federal Highway Administration}}, + title = {{Highway Statistics Series}}, + note = {{[Online]. Available: https://www.fhwa.dot.gov/policyinformation/statistics.cfm}}, + urldate = {2024-02-25} +} + +@online{carCR, + author = {{Preston, B.}}, + title = {{Car Brands and Models That Can Save You Money Over Time}}, + year = {2023-04-02}, + note = {{[Online]. Available: https://www.consumerreports.org/cars/car-repair-maintenance/car-brands-and-models-that-can-save-you-money-over-time-a9081677414}}, + urldate = {2024-02-25} +} + +@online{carAAA, + author = {{AAA}}, + title = {{Planning for Auto Maintenance and Repair Costs}}, + note = {{[Online]. Available: https://www.aaa.com/autorepair/articles/planning-for-auto-maintenance-and-repair-costs (visited on Feb. 25, 2024.)}} +} + +@online{carFarmers, + author = {{Farmers Insurance}}, + title = {{Auto Service and Repair Shop Insurance}}, + note = {{[Online]. Available: https://www.farmers.com/business/industry/auto-service-repair/ (visited on Feb. 25, 2024.)}} +} + +@online{carext, + author = {{AAA}}, + title = {{Your Driving Costs}}, + note = {{[Online]. Available: https://newsroom.aaa.com/wp-content/uploads/2020/12/Your-Driving-Costs-2020-Fact-Sheet-FINAL-12-9-20-2.pdf}}, + year = {2020-12-09}, + urldate = {2024-02-25} +} + +@online{CMS, + author = {{Centers for Medicare \& Medicaid Services}}, + title = {{NHE Fact Sheet}}, + year = {2022}, + note = {{[Online]. Available: https://www.cms.gov/data-research/statistics-trends-and-reports/national-health-expenditure-data/nhe-fact-sheet}}, + urldate = {2024-02-25} +} + +@online{WB, + author = {{The World Bank}}, + title = {{Current Health Expenditure (\% of GDP)}}, + year = {2023-04-07}, + note = {{[Online]. Available: https://data.worldbank.org/indicator/SH.XPD.CHEX.GD.ZS?name\_desc\\=true\&locations=US}}, + urldate = {2024-02-25} +} + +@online{OECD, + author = {{Organisation for Economic Co-operation and Development}}, + title = {{OECD Health Statistics 2023}}, + year = {2023}, + note = {{[Online]. Available: https://www.oecd.org/health/health-data.htm}}, + urldate = {2024-02-25} +} + +@online{CDC, + author = {{Centers for Disease Control and Preventation}}, + title = {{Health Expenditures}}, + year = {2019}, + note = {{[Online]. Available: https://www.cdc.gov/nchs/fastats/health-expenditures.htm}}, + urldate = {2024-02-25} +} + +@online{NCSES, + author = {{National Center for Science and Engineering Statistics}}, + title = {{R\&D; Most Pharmaceutical R\&D Focused on Biotechnology}}, + year = {2018}, + note = {{[Online]. Available: https://ncses.nsf.gov/pubs/nsf21316}}, + urldate = {2024-02-25} +} + +@online{DefHC, + author = {{Definitive Healthcare}}, + title = {{Healthcare Insights}}, + year = {2023-08-22}, + note = {{[Online]. Available: https://www.definitivehc.com/resources/healthcare-insights/urgent-care-clinics-us}}, + urldate = {2024-02-25} +} + +@online{AHA, + author = {{American Hospital Association}}, + title = {{Fast Facts on U.S. Hospitals, 2024}}, + year = {2024}, + note = {{[Online]. Available: https://www.aha.org/statistics/fast-facts-us-hospitals}}, + urldate = {2024-02-25} +} + +@online{AAMC, + author = {{Association of American Medical Colleges}}, + title = {{Workforce Data}}, + year = {2019}, + note = {{[Online]. Available: https://www.aamc.org/data-reports/workforce/data/active-physicians-us-doctor-medicine-us-md-degree-specialty-2019}}, + urldate = {2024-02-25} +} + +@online{CBO, + author = {{Congressional Budget Office}}, + title = {{Research and Development in the Pharmaceutical Industry}}, + year = {April 2021}, + note = {{[Online]. Available: https://www.cbo.gov/publication/57126}}, + urldate = {2024-02-25} +} + +@online{BEAHC, + author = {{Bureau of Economic Analysis}}, + title = {{New Health Care Statistics for First Year of COVID-19 Pandemic}}, + year = {2023-02-10}, + note = {{[Online]. Available: https://www.bea.gov/news/blog/2023-02-10/new-health-care-statistics-first-year-covid-19-pandemic}}, + urldate = {2024-02-25} +} + +@online{BEAHCM, + author = {{Bureau of Economic Analysis}}, + title = {{Experimental Data Map Health Care Estimates in GDP to Centers for Medicare \& Medicaid Framework}}, + year = {2023-09-25}, + note = {{[Online]. Available: https://www.bea.gov/news/blog/2023-09-25/experimental-data-map-health-care-estimates-gdp-centers-medicare-medicaid}}, + urldate = {2024-02-25} +} + +@article{PhysRevLett.87.198701, + title = {Efficient Behavior of Small-World Networks}, + author = {Latora, Vito and Marchiori, Massimo}, + journal = {Phys. Rev. Lett.}, + volume = {87}, + issue = {19}, + pages = {198701}, + numpages = {4}, + year = {2001}, + month = {Oct}, + publisher = {American Physical Society}, + doi = {10.1103/PhysRevLett.87.198701}, + url = {https://link.aps.org/doi/10.1103/PhysRevLett.87.198701} +} + +@online{HHS, + author = {{U.S. Department of Health and Human Services}}, + title = {{Compliance Enforcement Data}}, + year = {2024-01-31}, + note = {{[Online]. Available: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/numbers-glance/index.html}}, + urldate = {2024-02-25} +} + +@online{HHSDol, + author = {{U.S. Department of Health and Human Services}}, + title = {{Enforcement Highlights}}, + year = {2024-01-31}, + note = {{[Online]. Available:https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/data/enforcement-highlights/index.html}}, + urldate = {2024-02-25} +} + +@ARTICLE{10124989, + author={Schrick, Noah L. and Hawrylak, Peter J.}, + journal={IEEE Open Journal of the Computer Society}, + title={State Space Explosion Mitigation for Large-Scale Attack and Compliance Graphs Using Synchronous Exploit Firing}, + year={2023}, + volume={4}, + number={}, + pages={147-157}, + keywords={Firing;Explosions;Automobiles;Computer security;Flexible printed circuits;Cyber-physical systems;Regulation;Attack graph;compliance and regulation;compliance graph;cybersecurity;high-performance computing;speedup;synchronous firing}, + doi={10.1109/OJCS.2023.3276370}} + + +@online{HHSPen, + author = {{U.S. Department of Health and Human Services}}, + title = {{Resolution Agreements}}, + year = {2024-02-06}, + note = {{[Online]. Available: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html}}, + urldate = {2024-02-25} +} + +@online{HHSCong, + author = {{U.S. Department of Health and Human Services}}, + title = {{Reports to Congress on Privacy Rule and Security Rule Compliance}}, + year = {2022}, + note = {{[Online]. Available: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/reports-congress/index.html}}, + urldate = {2024-02-25} +} + +@online{HHSAud, + author = {{U.S. Department of Health and Human Services}}, + title = {{HIPAA Privacy, Security, and Breach Notification Audit Program}}, + year = {2020}, + note = {{[Online]. Available: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html}}, + urldate = {2024-02-25} +} + +@online{HHSCE, + author = {{U.S. Department of Health and Human Services}}, + title = {{Case Examples}}, + year = {2023-11-01}, + note = {{[Online]. Available: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/index.html}}, + urldate = {2024-02-25} +} + +@online{Census, + author = {{United States Census Bureau}}, + title = {{Oil \& Natural Gas}}, + year = {2019}, + note = {{[Online]. Available: https://www.census.gov/history/pdf/api-082021.pdf}}, + urldate = {2024-02-25} +} + +@online{EnergyGov, + author = {{U.S. Department of Energy}}, + title = {{Economic Impact of Oil \& Gas}}, + year = {2020}, + note = {{[Online]. Available: https://www.energy.gov/articles/economic-impact-oil-and-gas}}, + urldate = {2024-02-25} +} + +@online{IEA, + author = {{International Energy Agency}}, + title = {{R\&D Technology Innovation}}, + year = {2020}, + note = {{[Online]. Available: https://www.iea.org/reports/world-energy-investment-2020/rd-and-technology-innovation}}, + urldate = {2024-02-25} +} + +@online{EIA, + author = {{U.S. Energy Information Administration}}, + title = {{Financial Review of the Global Oil and Natural Gas Industry: Third-Quarter 2023}}, + year = {December 2023}, + note = {{[Online]. Available: https://www.eia.gov/finance/review/pdf/3Q2023{\%}20Financial{\%}20Review.pdf}}, + urldate = {2024-02-25} +} + +@online{oshonline, + author = {{Smart, S.J.}}, + title = {{Keeping Oil and Gas Workers Safe and Avoiding Costly Penalties}}, + year = {June 2015}, + note = {{[Online]. Available: https://ohsonline.com/Articles/2015/06/01/Keeping-Oil-and-Gas-Workers-Safe-and-Avoiding-Costly-Penalties.aspx}}, + urldate = {2024-02-25} +} + +@online{OSHAHist, + author = {{U.S. Department of Labor, Occupational Safety and Health Administration}}, + title = {{Industry Profile for an OSHA Standard Results}}, + year = {2023}, + note = {{[Online]. Available: https://www.osha.gov/ords/imis/industryprofile.html}}, + urldate = {2024-02-25} +} + +@online{OSHAPen, + author = {{U.S. Department of Labor, Occupational Safety and Health Administration}}, + title = {{Standard Number 1903.15 - Proposed Penalties}}, + year = {2024-01-15}, + note = {{[Online]. Available: https://www.osha.gov/laws-regs/regulations/standardnumber/1903/1903.15}}, + urldate = {2024-02-25} +} + +@article{https://doi.org/10.1112/plms/s1-28.1.486, +author = {Mathews, G. B.}, +title = {On the Partition of Numbers}, +journal = {Proceedings of the London Mathematical Society}, +volume = {s1-28}, +number = {1}, +pages = {486-490}, +doi = {https://doi.org/10.1112/plms/s1-28.1.486}, +url = {https://londmathsoc.onlinelibrary.wiley.com/doi/abs/10.1112/plms/s1-28.1.486}, +eprint = {https://londmathsoc.onlinelibrary.wiley.com/doi/pdf/10.1112/plms/s1-28.1.486}, +year = {1896} +} + +@book{10.5555/98124, +author = {Martello, Silvano and Toth, Paolo}, +title = {Knapsack Problems: Algorithms and Computer Implementations}, +year = {1990}, +isbn = {0471924202}, +publisher = {John Wiley \& Sons, Inc.}, +address = {USA} +} + +@incollection{RA, + author = {Rausand, M}, + title = {Introduction}, + booktitle = {Risk Assessment: Theory, Methods, and Applications}, + publisher = {John Wiley \& Sons Inc.}, + year = {2013}, + pages = {1-28}, + chapter = {1}, + isbn = {9780470637647} +} + + +@article{CAPRARA2000333, +title = {Approximation Algorithms for Knapsack Problems With Cardinality Constraints}, +journal = {European Journal of Operational Research}, +volume = {123}, +number = {2}, +pages = {333-345}, +year = {2000}, +issn = {0377-2217}, +doi = {https://doi.org/10.1016/S0377-2217(99)00261-1}, +url = {https://www.sciencedirect.com/science/article/pii/S0377221799002611}, +author = {Alberto Caprara and Hans Kellerer and Ulrich Pferschy and David Pisinger} +} + +@article{Jangir2018NonDominatedSM, + title={Non-Dominated Sorting Moth Flame Optimizer: A Novel Multi-Objective Optimization Algorithm for Solving Engineering Design Problems}, + author={Pradeep Jangir}, + journal={Engineering Technology Open Access Journal}, + year={2018}, + url={https://api.semanticscholar.org/CorpusID:212452626} +} + +@manual{Octave, + title = {{GNU Octave} Version 8.4.0 Manual: A High-Level Interactive Language for Numerical Computations}, + author = {John W. Eaton and David Bateman and S{\o}ren Hauberg and Rik Wehbring}, + year = {2023}, + note = {{[Online]. Available: https://www.gnu.org/software/octave/doc/v8.4.0/}} +} + +@misc{gplv3, + title = {{GNU General Public License}}, + version = {3}, + shorthand = {GPL}, + organization = {Free Software Foundation}, + note = {{[Online]. Available: http://www.gnu.org/licenses/gpl.html}}, + pagination = {section}, + language = {english}, + date = {2007-06-29} +} + +@article{10.1162/106365600568202, + author = {Zitzler, Eckart and Deb, Kalyanmoy and Thiele, Lothar}, + title = "{Comparison of Multiobjective Evolutionary Algorithms: Empirical Results}", + journal = {Evolutionary Computation}, + volume = {8}, + number = {2}, + pages = {173-195}, + year = {2000}, + month = {06}, + abstract = "{In this paper, we provide a systematic comparison of various evolutionary approaches to multiobjective optimization using six carefully chosen test functions. Each test function involves a particular feature that is known to cause difficulty in the evolutionary optimization process, mainly in converging to the Pareto-optimal front (e.g., multimodality and deception). By investigating these different problem features separately, it is possible to predict the kind of problems to which a certain technique is or is not well suited. However, in contrast to what was suspected beforehand, the experimental results indicate a hierarchy of the algorithms under consideration. Furthermore, the emerging effects are evidence that the suggested test functions provide sufficient complexity to compare multiobjective optimizers. Finally, elitism is shown to be an important factor for improving evolutionary multiobjective search.}", + issn = {1063-6560}, + doi = {10.1162/106365600568202}, + url = {https://doi.org/10.1162/106365600568202}, + eprint = {https://direct.mit.edu/evco/article-pdf/8/2/173/1493199/106365600568202.pdf}, +} + +@article{doi:10.1287/mnsc.27.1.1, + author = {Fisher, Marshall L.}, + title = {The Lagrangian Relaxation Method for Solving Integer Programming Problems}, + journal = {Management Science}, + volume = {27}, + number = {1}, + pages = {1-18}, + year = {1981}, + doi = {10.1287/mnsc.27.1.1}, + URL = {https://doi.org/10.1287/mnsc.27.1.1}, + eprint = {https://doi.org/10.1287/mnsc.27.1.1} +} + +@article{3c419982-0884-3763-8914-983157eab6e5, + ISSN = {0030364X, 15265463}, + URL = {http://www.jstor.org/stable/168028}, + abstract = {The usefulness of Lagrange multipliers for optimization in the presence of constraints is not limited to differentiable functions. They can be applied to problems of maximizing an arbitrary real valued objective function over any set whatever, subject to bounds on the values of any other finite collection of real valued functions defined on the same set. While the use of the Lagrange multipliers does not guarantee that a solution will necessarily be found for all problems, it is 'fail-safe' in the sense that any solution found by their use is a true solution. Since the method is so simple compared to other available methods it is often worth trying first, and succeeds in a surprising fraction of cases. They are particularly well suited to the solution of problems of allocating limited resources among a set of independent activities.}, + author = {Hugh Everett}, + journal = {Operations Research}, + number = {3}, + pages = {399--417}, + publisher = {INFORMS}, + title = {Generalized Lagrange Multiplier Method for Solving Problems of Optimum Allocation of Resources}, + urldate = {2024-03-13}, + volume = {11}, + year = {1963} +} + +@inproceedings{Nocedal2018NumericalO, + title={Numerical Optimization}, + author={Jorge Nocedal and Stephen J. Wright}, + booktitle={Fundamental Statistical Inference}, + year={2018}, + url={https://api.semanticscholar.org/CorpusID:189864167} +} + +@Manual{pracma, + title = {Pracma: Practical Numerical Math Functions}, + author = {Hans W. Borchers}, + year = {2023}, + note = {{R package version 2.4.4 [Online]. Available: https://CRAN.R-project.org/package=pracma}} + } + +@article{c8bc284a-942a-3e27-9ea0-6db64782cbb2, + ISSN = {00129682, 14680262}, + URL = {http://www.jstor.org/stable/1909582}, + abstract = {Several models for limited dependent variables (variables having a non-negligible probability of exactly equaling zero) are examined. Estimation in and discrimination among the various models are considered, followed by a small sampling experiment into the procedures and an example of their application.}, + author = {John G. Cragg}, + journal = {Econometrica}, + number = {5}, + pages = {829--844}, + publisher = {[Wiley, Econometric Society]}, + title = {Some Statistical Models for Limited Dependent Variables With Application to the Demand for Durable Goods}, + urldate = {2024-03-27}, + volume = {39}, + year = {1971} +} + +@article{fc317238-6f24-34d1-86ea-e81c1292d7e9, + ISSN = {00401706}, + URL = {http://www.jstor.org/stable/1269547}, + abstract = {Zero-inflated Poisson (ZIP) regression is a model for count data with excess zeros. It assumes that with probability p the only possible observation is 0, and with probability 1 - p, a Poisson(λ) random variable is observed. For example, when manufacturing equipment is properly aligned, defects may be nearly impossible. But when it is misaligned, defects may occur according to a Poisson(λ) distribution. Both the probability p of the perfect, zero defect state and the mean number of defects λ in the imperfect state may depend on covariates. Sometimes p and λ are unrelated; other times p is a simple function of λ such as p=1/(1+λ τ) for an unknown constant τ. In either case, ZIP regression models are easy to fit. The maximum likelihood estimates (MLE's) are approximately normal in large samples, and confidence intervals can be constructed by inverting likelihood ratio tests or using the approximate normality of the MLE's. Simulations suggest that the confidence intervals based on likelihood ratio tests are better, however. Finally, ZIP regression models are not only easy to interpret, but they can also lead to more refined data analyses. For example, in an experiment concerning soldering defects on printed wiring boards, two sets of conditions gave about the same mean number of defects, but the perfect state was more likely under one set of conditions and the mean number of defects in the imperfect state was smaller under the other set of conditions; that is, ZIP regression can show not only which conditions give lower mean number of defects but also why the means are lower.}, + author = {Diane Lambert}, + journal = {Technometrics}, + number = {1}, + pages = {1--14}, + publisher = {[Taylor & Francis, Ltd., American Statistical Association, American Society for Quality]}, + title = {Zero-Inflated Poisson Regression, With an Application to Defects in Manufacturing}, + urldate = {2024-03-27}, + volume = {34}, + year = {1992} +} + +@dataset{data, + author = {Schrick, Noah and + Hawrylak, Peter}, + title = {Compliance Graph Network Files and Exploit Models}, + month = jul, + year = 2024, + publisher = {Zenodo}, + doi = {10.5281/zenodo.12741129}, + url = {https://doi.org/10.5281/zenodo.12741129} +} + diff --git a/ACM-JRC/Schrick-Noah_CG.tex b/ACM-JRC/Schrick-Noah_CG.tex new file mode 100644 index 0000000..a6e732c --- /dev/null +++ b/ACM-JRC/Schrick-Noah_CG.tex @@ -0,0 +1,340 @@ +\documentclass[acmsmall]{acmart} +\RequirePackage{setspace} +\usepackage{graphicx} % Images +\graphicspath{ {./images/} } + +\usepackage{float} % Table captions on top +\floatstyle{plaintop} +\restylefloat{table} + +\usepackage{ifpdf} % Detect PDF or DVI mode +\usepackage{babel} % Bibliography +\usepackage{dsfont} % mathbb + +\usepackage[utf8]{inputenc} +\usepackage{indentfirst} +\setlength{\parskip}{\baselineskip} + +% Table of Contents/Figure Spacing +\usepackage[titles]{tocloft} +\cftsetindents{figure}{0em}{3.5em} +\cftsetindents{table}{0em}{3.5em} + +\usepackage{dsfont} % mathbb +\usepackage{amsmath} + +\usepackage{url} + +\AtBeginDocument{% + \providecommand\BibTeX{{% + Bib\TeX}} +} + +\setcopyright{acmlicensed} +\copyrightyear{2024} +\acmYear{2024} +\acmDOI{XXXXXXX.XXXXXXX} + +% +%\acmJournal{JRC} +%\acmVolume{1} +%\acmNumber{4} +%\acmArticle{0} +%\acmMonth{8} + +\begin{document} + +\title{Generation of Compliance Graphs Across Industries for Providing an Analysis Testbed} + +\author{Noah L. Schrick} +\email{Noah.L.Schrick@erdc.dren.mil} +\orcid{0000-0003-0875-8927} +\affiliation{% + \institution{Information Technology Laboratory, U.S. Army Corps of Engineers, Engineer Research and Development Center} + \city{Vicksburg} + \state{Mississippi} + \country{USA} +} + +\author{Peter J. Hawrylak} +\email{peter-hawrylak@utulsa.edu} +\orcid{0000-0003-3268-7452} +\affiliation{%} + \institution{Tandy School of Computer Science, College of Engineering and Computer Science, The University of Tulsa} + \city{Tulsa} + \state{Oklahoma} + \country{USA} +} + +\begin{abstract} + Compliance graphs provide the ability to analyze an environment in terms of its standing to a regulation, mandate, or standard. These graphs are directed acyclic graphs, and share commonalities with attack graphs. Though generator tools and example graph sets are available for attack graphs, the novelty of compliance graphs presents its own set of challenges with a lack of publicly available data that has been processed and formatted in order to generate example graphs. In order to develop analysis techniques for compliance graphs, thorough examination and testing processes should be conducted, particularly on known, available data sets in the form of compliance graphs or compliance graph input files. This work presents the generation of compliance graphs and releases their affiliated data for use in furthering the analysis process of this research area. +\end{abstract} + +%% +%% The code below is generated by the tool at http://dl.acm.org/ccs.cfm. +%% +\begin{CCSXML} + + + 10003456.10003462 + Social and professional topics~Computing / technology policy + 500 + + + 10010520.10010575 + Computer systems organization~Dependable and fault-tolerant systems and networks + 300 + + + 10010147.10010341.10010342 + Computing methodologies~Model development and analysis + 500 + + + 10002951 + Information systems + 300 + + + 10011007.10010940 + Software and its engineering~Software organization and properties + 300 + + +\end{CCSXML} + +\ccsdesc[500]{Social and professional topics~Computing / technology policy} +\ccsdesc[300]{Computer systems organization~Dependable and fault-tolerant systems and networks} +\ccsdesc[500]{Computing methodologies~Model development and analysis} +\ccsdesc[300]{Information systems} +\ccsdesc[300]{Software and its engineering~Software organization and properties} + +\keywords{ + Compliance Graph, Attack Graph, Automotive Industry, Healthcare Industry, HIPAA, Oil and Gas Industry, OSHA 1910H +} + +\received{31 October 2024} +\received[revised]{XXXXXX} +\received[accepted]{XXXXXX} + +\maketitle + + +\section{Introduction} +Attack graphs are a common tool used to address and examine a system or set of systems under a cybersecurity lens \cite{AG-Analysis-Explan}. These graphs are directed acyclic graphs (DAGs) that present the paths from a state of information for an environment to any potential state of vulnerability. Compliance graphs \cite{j_hale_compliance_nodate} aim to shift the focus of attack graphs to focus on the standings of environments to any local, private, or federal regulations. Each node in a compliance graph can be embedded with information regarding maintenance schedules for industrial equipment, insurance policy terms, physical component characteristics, or any other descriptor for an asset as it relates to an environment's standing toward compliance. Each edge in the compliance graph defines the transition that leads to a deviation in a previous node's information. These changes could include a repair or replacement of a component, the addition or removal of an asset, or changes to policies. Work and investigations have already been conducted to present the semantic and generator tool changes required to generate these graphs \cite{noah_ths}. Though the generation of compliance graphs has been the primary focus of the research topic, there is an increasing need of analysis work to address the challenges of maintaining compliance. Governance, Risk, and Compliance (GRC) Officers assist groups or organizations with preventing or mitigating incurred costs as a result of a violation of a mandate. With the wide array of mandates that organizations may need to follow regarding health or personally identifiable information (PII), specific industry standards such as FinCEN \cite{fincen}, FDA QSR \cite{fdaqsr}, NERC-CIP \cite{nerccip}, internal standards, or equipment maintenance schedules to avoid voiding a warranty, it becomes increasingly difficult for GRC Officers to manage and track all mandate statuses. In addition, organizations rapidly and frequently bring changes into environments with new software, new equipment, new products, new contracts, or new processes. Each of these changes propagates additional change, all of which may affect the standing in regard to a compliance or regulation mandate. Rather than manual compliance checks, compliance graphs can be automatically generated, and analysis can be conducted on the resulting graph to aid in decision-making and visualization. + +To determine the adaptivity and soundness of compliance graph analysis work, example networks across multiple, disconnected sectors are generated in this work for future analysis use. These sectors maintain their own different set of local, private, and federal regulations that must be adhered to in order to avoid penalties. For the generated examples, each additionally possesses unique characteristics and properties that allow for the examination of the depth and range of any compliance graph analysis techniques, especially under the consideration of edge cases or unexpected behaviors. To fully examine the accuracy and level of analysis output detail, this work strove to generate example cases that were accurately sourced, described fully, scalable, and of high fidelity. This work presents and describes the example networks that can be used and referenced for future compliance graph analysis works. Section \ref{sec:Automotive} describes the Automobile Maintenance application that falls under the automotive industry. Section \ref{sec:Healthcare} describes a small network of healthcare clinics striving to maintain HIPAA \cite{noauthor_health_1996} compliance through the lens of the healthcare industry. Section \ref{sec:OSHA} describes an engineering firm as they attempt to maintain compliance with OSHA Standard 1910 Subpart H (Hazardous Materials) \cite{OSHA} within the oil and gas industry of the energy sector. Each of these example networks has been made publicly available, and their data files can be found at \cite{data}. + +For each example network in the subsequent Sections, their properties are described. These properties are defined below. Each compliance graph was generated using a modified version of RAGE \cite{RAGE}. +\begin{itemize} + \item{Nodes: The number of states in the network that contain embedded information.} + \item{Edges: The number of edges in the network that caused a change or deviation from a prior state.} + \item{Exploits: The number of events, mandates, regulations, or checks that are investigated.} + \item{Assets: The number of entities in the network or environment. Examples include devices, vessels, people, policies, etc.} + \item{Qualities: The total number of descriptors for all assets. Examples include versions, make or model, material, policy limits, etc.} + \item{Average Degree: The average number of new nodes that a node directs to.} +\end{itemize} + +\section{Automotive} \label{sec:Automotive} +The automotive industry is a substantial sector in the United States, and is one of the largest automotive markets globally \cite{AutoInd}. This industry invests \$7.5 billion in innovative R\&D, supports over 500,000 direct jobs in the US alone, has a Foreign Direct Investment of over \$115 billion, and expands the US exports by over \$56 billion \cite{AutoInd}, \cite{AutoIndFS}, \cite{BEAFS}, \cite{BEATables}, \cite{BEATablesOutput}. This work includes a compliance graph within this sector as a means to showcase its application and utility for analyzing cost-savings and methodologies for following compliance mandates. Specifically, this work examines the Automotive Repair and Maintenance Service subsector of this industry. This subsector is globally applicable, and has a wide range of focal points and scale that include personal passenger vehicle maintenance and commercial vehicle servicing. This market has an estimated CAGR (Compounded Annual Growth Rate) of 10.2\%, and passenger car maintenance holds a market share of 35\% \cite{GMInsight}. Due to the size of this market share, its applicability, its ease-of-understanding in compliance graph format, and its ability to scale to larger, more complex challenges in the automotive industry, this work generates and analyzes an automobile maintenance compliance graph. This Section discusses the generation process, graph properties, unique features, and incurred challenges with this example application. + +\subsection{Network Properties, Data, and Violation Specifications} +The automobile maintenance example is centered around the maintenance of a single, 2006 Toyota Corolla over the span of 6 years. For this example, the compliance requirements follow the provided warranty and maintenance specifications as provided by the vehicle manufacturer. This document is accessible through the manufacturer's website \cite{Corolla}. The maintenance schedule provides the recommended maintenance routine based on either mileage or time since last maintenance, depending on which condition is met sooner. Following the recommended maintenance schedule is imperative to comply with any vendor or purchaser warranty, as well as to ensure proper operating conditions of the vehicle. Compliance graph generator input files were created following the maintenance document, and the properties for the generated automotive maintenance compliance graph are listed below. +\begin{itemize} + \item{Number of Nodes: 66,945} + \item{Number of Edges: 468,221} + \item{Number of Exploits: 28} + \item{Number of Qualities: 93} + \item{Number of Assets: 1} + \item{Average Degree: 6.994} +\end{itemize} + +Properties and assumptions of the Toyota Corolla are listed below. +\begin{itemize} + \item{The vehicle is brand new, with 0 miles.} + \item{It has a gas engine.} + \item{It is an automatic.} + \item{It includes a daytime running light system.} + \item{The owner will perform minimal maintenance every 6 months or 6000 miles:} + \begin{itemize} + \item{Oil and fuel filter change.} + \item{AC filter replacement.} + \item{Maintain proper tire pressure.} + \end{itemize} + \item{The owner will take the vehicle to a mechanic shop every 1 year and 6 months for the following inspections and repairs:} + \begin{itemize} + \item{Drive Belts} + \item{Battery} + \item{Spark Plugs} + \item{Brake Pedals} + \item{Brake Pads and Discs} + \item{Tires (Pressure, Alignment, Rotation)} + \item{Lights, Horn, Wipers, Windshield Washers} + \item{Refrigerant and Coolant} + \end{itemize} + \item{Additional components modeled in this compliance graph include:} + \begin{itemize} + \item{Fuel tank lines} + \item{Steering wheel, linkage, and gear box} + \item{Brake pipes and hoses} + \item{Drive shaft boots} + \item{Suspension ball joints} + \item{Front and rear suspensions} + \item{Fuel tank cap, lines, connections, and fuel vapor control valve} + \end{itemize} +\end{itemize} + +For this example, there is a single asset used to represent the 2006 Toyota Corolla. All parts, maintenances, timelines, properties, or any other features or components were considered to be a ``quality" of the asset. By reducing the example graph to center around a single asset, state space explosion is able to be mitigated by preventing the deviation and permutation exploration of assets. Various exploit locks and flags were also implemented to prevent diverting, duplicated branches of simultaneous exploit triggers. This was implemented through the use of precondition guarding, and was necessary since exploits could be fired through either time or mileage, but should only be fired once. Additionally, the problem space was able to be reduced through the use of combined events. Rather than having exploits or events contain single quality changes, events could be grouped to update multiple qualities simultaneously. This was implemented through maintenance events, which acted as the single point of action for all inspections, repairs, maintenances, or any other event that would service the vehicle and return it to a state of compliance. To further prevent divergence, all pre-defined events were also described using locks and flags, so the event (e.g. a traffic citation for a broken brake light) would happen a single time at a specific point in the generation. + +The data sourcing for the violation specifications and prior-knowledge network consisted of maintenance and repair estimates at large, as well as for individual components or malfunctions. This also included mileages per year, by month, and various other personal automobile transportation statistics. Sourcing was collected from government entities like the Department of Energy \cite{carDOE}, Department of Transportation \cite{carDOT}, and Federal Highway Administration \cite{carFWHA}, aggregated car performance, reliability, and safety reports from Consumer Reports \cite{carCR}, and insurance companies like AAA \cite{carAAA}, Farmers \cite{carFarmers}, and external reports \cite{carExt}. At the time of this release, the prior-knowledge network is undergoing additional formatting and feature work before its release. The prior-knowledge networks are intended to be added to the released dataset, and the initial work is described in this publication. The prior-knowledge network contained additional detail about each exploit in the network. For each exploit, the cost of occurrence was described. These costs were expressed as one-time monetary costs, recurring monetary costs and their rate of charge, and one-time time-commitment costs, recurring time-commitment costs and their rate of charge. For each exploit, possible mitigation schemes were described. Each exploit could have zero or many mitigation options. Each mitigation option described one-time monetary costs, recurring monetary costs and their rate of charge, and one-time time-commitment costs, recurring time-commitment costs and their rate of charge for preventing the exploit. For this example, most exploits had at least one mitigation that was represented as a maintenance or service event. + +\subsection{Objectives and Goals of the Network} +The primary objective of this example is to highlight the usefulness of the analysis methods for small, individual scale problems. Though the analysis methods are intended to work at a large scale, showcasing the utility of the approaches at a daily, understandable, personal level can lead to a greater adoption. In addition, this example network has unique properties not seen in the other example networks. This network is isolated to a single asset to highlight how the analysis methods can function even when centered on only one object of interest. Budgetary constraints are allocated at a monthly rate, rather than through lump sums. Many individuals may be able to allocate a limited amount of their monthly income to repairs and maintenance, but may have a more difficult time paying for unexpected costs and repairs all at once. This example includes a large number of qualities in proportion to the number of assets, and bolsters how effective the analysis techniques are when given more information. This example showcases how repeated, consistent, small-scale investments in repair and maintenance pay off significantly over the lifespan of a vehicle in terms of avoided malfunctions, damages, or fines. + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% + +\section{Healthcare} \label{sec:Healthcare} +The healthcare industry is another significant sector in the United States, and accounts for 17.3\% of the GDP \cite{CMS, WB, OECD, CDC}. National Health Expenditures (NHE) have grown to over \$4.5 trillion \cite{CMS, WB, OECD, CDC, BEAHC}, Medicare and Medicaid spending have grown to over \$944 billion and over \$805 billion, respectively \cite{CMS, CDC, BEAHCM}, R\&D spending has grown to over \$114 billion spread across biotechnology, nanotechnology, and software \cite{NCSES} (with \$83 billion in the pharmaceutical industry alone \cite{CBO}), and there are over 6,100 \cite{AHA} hospitals, 10,200 urgent care clinics \cite{DefHC}, and 938,000 active physicians \cite{AAMC}. This work includes a compliance graph within this sector as a means to showcase its application and utility for analyzing cost-savings and methodologies for following compliance mandates. This work examines compliance of the Health Insurance Portability and Accountability Act (HIPAA) \cite{noauthor_health_1996}. This is a broadly applicable federal act that mandates proper handling for the containment and dissemination of all healthcare information. HIPAA complaints have now exceeded 350,000, with 2,074 complaints being referred to the U.S. Department of Justice \cite{HHS}. A total dollar amount exceeding \$142 million has been collected as a result of noncompliance \cite{HHSDol}. The Office for Civil Rights of the U.S. Department of Health and Human Services have reported the following as the most common occurrences of noncompliance complaints \cite{HHSDol}: +\begin{itemize} + \item{``Impermissible uses and disclosures of protected health information."} + \item{``Lack of safeguards of protected health information."} + \item{``Lack of patient access to their protected health information."} + \item{``Lack of administrative safeguards of electronic protected health information."} + \item{``Use or disclosure of more than the minimum necessary protected health information."} +\end{itemize} + +Due to the applicability of HIPAA to all healthcare related activities and processing, the quantity of noncompliance complaints, and the total monetary collection as a result of noncompliance, this work generates and analyzes a HIPAA compliance graph. This Section discusses the generation process, graph properties, unique features, and incurred challenges with this example application. + +\subsection{Network Properties, Data, and Violation Specifications} +The HIPAA example is centered around a network of urgent care clinics and their compliance to HIPAA over the span of one year. For this example, the compliance requirements follow the provided guidelines as set by HIPAA. Since this is a federal regulation, specific guidelines and mandates are publicly accessible through the U.S. Department of Health and Human Services, as well as with summaries through the Center for Disease Control. HIPAA necessitates a range of requirements be met to ensure compliance, which include document control, training, reporting options, officers, physical and digital access control, and mandatory assessments. Compliance graph generator input files were created following the HIPAA guidelines, and the properties for the generated HIPAA compliance graph are listed below. + +\begin{itemize} + \item{Number of Nodes: 62,217} + \item{Number of Edges: 400,917} + \item{Number of Exploits: 27} + \item{Number of Qualities: 62} + \item{Number of Assets: 5} + \item{Average Degree: 6.444} +\end{itemize} + +Properties and assumptions of the urgent care clinics are listed below. +\begin{itemize} + \item{Each clinic has five employees.} + \item{The organization has an in-house IT staff (that is \textbf{not} modeled).} + \item{Each clinic will submit a HIPAA attestation letter.} + \item{HIPAA attestation letters are not sent simultaneously.} + \item{Each employee has a different renewal date for their trainings.} + \item{Employee trainings and requirements enforced by the organization include the following:} + \begin{itemize} + \item{HIPAA training.} + \item{Mobile and/or portable device regulation agreements.} + \item{Hardware inventories.} + \item{Security awareness.} + \end{itemize} + \item{There are three total, distinct HIPAA officers:} + \begin{itemize} + \item{HIPAA Compliance Officer} + \item{HIPAA Privacy Officer} + \item{HIPAA Security Officer} + \end{itemize} + \item{Audits and assessments include:} + \begin{itemize} + \item{Security risk assessment.} + \item{Privacy standing audit.} + \item{HIPAA audit.} + \item{Security standing audit.} + \item{Physical audit.} + \item{Device and asset audit.} + \end{itemize} + \item{Additional components modeled in this compliance graph include:} + \begin{itemize} + \item{An encrypted database.} + \item{Reporting processes.} + \item{A ``company" asset that is independent of the employee and database assets.} + \item{Certificate expirations.} + \end{itemize} +\end{itemize} + +For this example, multiple assets are implemented to capture and model their relationships individually, as well as to other assets. These assets include employee assets, a database asset, and a company asset which is used to model the organization overall. Each asset had its own set of qualities, and their own quality for measuring the progression of time. In order to prevent unnecessary state space exploration on unfeasible states caused by a deviation in time progression, a synchronous firing feature \cite{10124989} in the generator tool was used. Various exploit locks and flags were also implemented to prevent diverting, duplicated branches of simultaneous exploit triggers. This was implemented through the use of precondition guarding, and was necessary since exploits could be fired through multiple conditions, but should only be fired once. Additionally, the problem space was able to be reduced through the use of combined events. Rather than having exploits or events contain single quality changes, events could be grouped to update multiple qualities simultaneously. This was implemented through audit, assessment, or time-based events, which acted as a single point of action for all assessments, audits, services, or any other event that would correct any violation and return the organization to a state of compliance. To further prevent divergence, all pre-defined events were also described using locks and flags, so the event (e.g. an addition to or the removal of the number of employees) would happen a single time at a specific point in the generation. + +The data sourcing for the violation specifications and prior-knowledge network consisted of imposed civil monetary penalties for noncompliance, time closures for noncompliance, and implementation or mitigation costs to prevent a compliance violation. At the time of this release, the prior-knowledge network is undergoing additional formatting and feature work before its release. The prior-knowledge networks are intended to be added to the released dataset, and the initial work is described in this publication. The penalty structure as set by the Office for Civil Rights (OCR) consists of four tiers. Tier 1 is defined as a lack of knowledge of the violation, Tier 2 is for having reasonable cause for possessing knowledge of the violation, Tier 3 is for willful neglect, and Tier 4 is for willful neglect and a lack of correction within 30 days. Each tier has an associated minimum and maximum, with annual caps. These violations are stipulated by the Office of Management and Budget (OMB). In addition, the U.S. Department of Health and Human Services publishes a yearly summary of all OCR HIPAA settlements and judgments \cite{HHSPen}. Reports to Congress \cite{HHSCong}, audits \cite{HHSAud}, and case examples \cite{HHSCE} are also published. The prior-knowledge network was constructed around all publicly available sources, and contained additional detail about each exploit in the network. For each exploit, the cost of occurrence was described. These costs were expressed as one-time monetary costs, recurring monetary costs and their rate of charge, and one-time time-commitment costs, recurring time-commitment costs and their rate of charge. For each exploit, possible mitigation schemes were described. Each exploit could have zero or many mitigation options. Each mitigation option described one-time monetary costs, recurring monetary costs and their rate of charge, and one-time time-commitment costs, recurring time-commitment costs and their rate of charge for preventing the exploit. For this example, most exploits had two mitigations. This will be described further in Section \ref{sec:hipaa-obj}. + +\subsection{Objectives and Goals of the Network} \label{sec:hipaa-obj} +The primary objective of this example is to highlight the usefulness of the analysis methods for broadly applicable regulations. Though the input for this specific example was a network of urgent care clinics, the methods, procedure, and output would be largely similar to an input of a pharmacy, hospital, or biotechnology company. In addition, this example network has unique properties not seen in the other example networks. This network includes the addition and removal of employees, and attempts to mimic the behaviors of individuals. Though no claims of human behavior modeling is claimed, this work statically made events that were executed during the generation process as a way to represent human error (such as failing to complete a mandatory training). For the analysis of this work, this example showcases how a company could invest more time, rather than money, to maintain compliance. Most mitigatable exploits include at least two mitigations: one for contracting a correction, and one for utilizing the in-house staff. The contracting option requires minimal time cost, but has a greater monetary cost. The in-house implementation requires minimal monetary cost, but a greater time cost. This allows for the analysis to offer more robust correction schemes that can utilize both the monetary and time budgets to minimize and correct compliance violations. + +%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% + +\section{Oil and Gas} \label{sec:OSHA} +The oil and gas industry contributes roughly 8\% of the U.S. GDP, totaling to nearly \$1.7 trillion \cite{Census}. This industry supports over 10 million jobs \cite{Census, EnergyGov}, invests over \$30 billion in R\&D spending \cite{IEA}, and 72\% of companies had positive free cash flow in the last year, with 86\% reporting positive upstream earning \cite{EIA}. This work includes a compliance graph within this sector as a means to showcase its application and utility for analyzing cost-savings and methodologies for following compliance mandates. This subsector is globally applicable, and has a wide range of focal points and scale that include upstream, midstream, and downstream related services and processes. Specifically, this work examines the processing, transportation, and storage of oil and gas related products, byproducts, and intermediates as they relate to Occupational Safety and Health Administration (OSHA) regulations, and in particular, Standard 1910, Subpart H - Hazardous Materials \cite{OSHA}. In past years, the top 10 OSHA standard citations were from Standard 1910 \cite{oshonline}. From 2022 to 2023, specifically for Standard 1910 Subpart H, there were a total of 996 citations, 589 investigations, and a total imposed civil monetary fines of \$4,995,005 across relevant North American Industry Classification System (NAICS) sectors \cite{OSHAHist}. Due to the applicability of OSHA Standard 1910 Subpart H to all Hazardous Material related activities of the oil and gas industry and relevant subsectors, the quantity of noncompliance complaints, and the total monetary collection as a result of noncompliance, this work generates and analyzes an OSHA 1910H compliance graph. This Section discusses the generation process, graph properties, unique features, and incurred challenges with this example application. + +\subsection{Network Properties, Data, and Violation Specifications} +The OSHA 1910H example is centered an oil and gas company that processes, transports, and stores oil and gas related products, byproducts, and intermediates. This example models and analyzes their compliance standings to OSHA Standard 1910 Subpart H - Hazardous Materials over the course of 8 years. Since this is a federal regulation, specific guidelines and mandates are publicly accessible through the Occupational Safety and Health Administration. OSHA Standard 1910 Subpart H necessitates a range of requirements be met to ensure compliance, which include requirements for specific hazardous materials such as compressed gases, acetylene, flammable liquids, chemicals, and waste, among others. Compliance graph generator input files were created following the OSHA guidelines, and the properties for the generated OSHA compliance graph are listed below. + +\begin{itemize} + \item{Number of Nodes: 48,369} + \item{Number of Edges: 408,330} + \item{Number of Exploits: 32} + \item{Number of Qualities: 109} + \item{Number of Assets: 3} + \item{Average Degree: 8.442} +\end{itemize} + +Properties and assumptions of the oil and gas company are listed below. +\begin{itemize} + \item{The company has separate divisions for transportation, storage, and processing.} + \item{The organization has an in-house Safety staff (that is \textbf{not} modeled).} + \item{The company has an in-house fabrication/machining/manufacturing shop.} + \item{The company has ownership of the vehicle transportation fleet.} + \item{In addition to any imposed fines, failures or malfunctions can and/or will cause additional damages, such as:} + \begin{itemize} + \item{Leakage or spillage.} + \item{Gaseous emissions.} + \item{Contamination.} + \item{Physical damage to company and/or non-company assets.} + \item{Burst pipes.} + \item{Schedule delays.} + \item{Violations in contracts.} + \end{itemize} + \item{As part of, and in addition to, upholding OSHA 1910 Subpart H requirements, examples of other compliance standards include:} + \begin{itemize} + \item{ASTM A 53/A 53M-06a into § 173.5b} + \item{CGA Pamphlet G-2.2 into § 173.315} + \item{Dwg. 106-6 into § 178.337-8} + \item{ASTM A 20/A 20M-93a into §§ 178.337-2; 179.102-4; 179.102-1; 179.102-17} + \item{ASTM A 302/A 302M-93 into § 179.100-7; 179.200-7; 179.220-7} + \item{Among others.} + \end{itemize} + \item{Inspections include specific testing, such as:} + \begin{itemize} + \item{Plastic Film Impact Resistance Testing.} + \item{Chlorine Flow Valve Removable Baskets.} + \item{Water in Anhydrous Ammonia.} + \item{Anhydrous Ammonia Hose pressure and burst pressures.} + \end{itemize} + \item{Additional components modeled in this compliance graph include:} + \begin{itemize} + \item{Ventiliation and exhaust systems.} + \item{Coatings, castings, and materials.} + \item{Transportation staff.} + \item{Bleeder valves, backflow check valves, and bin discharge gates.} + \end{itemize} +\end{itemize} + +For this example, multiple assets are implemented to capture and model their relationships individually, as well as to other assets. These assets include transportation, ventilation, and vessel assets. Each asset had its own set of qualities, and their own quality for measuring the progression of time. In order to prevent unnecessary state space exploration on unfeasible states caused by a deviation in time progression, a synchronous firing feature \cite{10124989} in the generator tool was used. Various exploit locks and flags were also implemented to prevent diverting, duplicated branches of simultaneous exploit triggers. This was implemented through the use of precondition guarding, and was necessary since exploits could be fired through multiple conditions, but should only be fired once. Additionally, the problem space was able to be reduced through the use of combined events. Rather than having exploits or events contain single quality changes, events could be grouped to update multiple qualities simultaneously. This was implemented through inspection, assessment, or time-based events, which acted as a single point of action for all assessments, inspections, repairs, services, or any other event that would correct any violation and return the organization to a state of compliance. To further prevent divergence, all pre-defined events were also described using locks and flags, so the event (e.g. challenges with design scope, or improperly fabricated parts) would happen a single time at a specific point in the generation. + +The data sourcing for the violation specifications and prior-knowledge network consisted of imposed civil monetary penalties for noncompliance, time closures for noncompliance, and implementation or mitigation costs to prevent a compliance violation. At the time of this release, the prior-knowledge network is undergoing additional formatting and feature work before its release. The prior-knowledge networks are intended to be added to the released dataset, and the initial work is described in this publication. The penalty structure as set by the Occupational Safety and Health Administration is defined as per Standard 1903.15 - Inspections, Citations, and Proposed Penalties \cite{OSHAPen}. These penalties are categorized by type of violation, which include willful violations, repeated violations, serious violations, other-than-serious violations, and posting requirement violation. Each of these categories has a defined maximum penalty, with some categories having minimum requirements, and with some categories including units of time (e.g. monetary penalties per day). The prior-knowledge network was constructed around all publicly available sources, and contained additional detail about each exploit in the network. Damages, as relevant, were estimated in terms of costs of repairs, repeated fabrications, or other fines as necessary. No estimations were made regarding environmental damage, damages to animal or wildlife populations, or any other type of damages. For each exploit, the cost of occurrence was described. These costs were expressed as one-time monetary costs, recurring monetary costs and their rate of charge, and one-time time-commitment costs, recurring time-commitment costs and their rate of charge. For each exploit, possible mitigation schemes were described. Each exploit could have zero or many mitigation options. Each mitigation option described one-time monetary costs, recurring monetary costs and their rate of charge, and one-time time-commitment costs, recurring time-commitment costs and their rate of charge for preventing the exploit. For this example, most exploits had two mitigations. This will be described further in Section \ref{sec:osha-obj}. + +\subsection{Objectives and Goals of the Network} \label{sec:osha-obj} +The primary objective of this example is to highlight the usefulness of the analysis methods for preventing or mitigating larger, more catastrophic events or penalties. Many events or exploits would lead to further, repeated or increased damages. This example highlights the effectiveness of how investing in better policies, procedures, materials, and quality of components has substantial cost-saving benefits over time. This example network has unique properties not seen in the other example networks. This network includes cascading or repeated costs. If one (or multiple) components fall into a state of noncompliance, the resulting fines and damage costs increase. For the analysis of this work, this example showcases how a company could invest earlier on in a company project to maintain compliance and avoid cascading costs. This example also includes the ability to invest more time, rather than monetary investments. Most mitigatable exploits include at least two mitigations: one for including longer timeframes for inspections, testing, and quality control, and another for investing in better quality material, machinery, and staff investment. The latter option requires minimal time cost, but has a greater monetary cost. The former requires minimal monetary cost, but a greater time cost. This allows for the analysis to offer more robust correction schemes that can utilize both the monetary and time budgets to minimize and correct compliance violations. + +\section{Future Works} +Due to the novelty of compliance graphs, there are multiple avenues available for future research investigations. This work provided the compliance graph input and output files for the RAGE Attack Graph Engine. Future works could include the output compliance graphs when using these input files for alternative generator tools. The output compliance graphs could undergo a comparison to identify or uncover information that could assist in future analysis works. The compliance graph analysis space would also benefit both from a broader range of compliance graphs, and compliance graphs with finer detail. Though this work implemented a compliance graph for OSHA 1910H, the various standards and guidelines that fit under this regulation (such as various ASTM standards) possess more detail and information than was incorporated in this example. Including full, in-depth input files that describe all details of a regulation would provide researchers the tools to conduct a thorough investigation into compliance graph analysis. +Future works are likely to include additional input files that describe potential mitigation or solution opportunities for known states of noncompliance. These input files would not be included as part of the generation process, but could be used to further describe the known nodes and edges of a given compliance graph. These files could indicate transitional probabilities or weights of edges, the fines or penalties when states of noncompliance are identified, or the costs of repair or replacement of components. + +\section{Conclusion} +This work presented the generation process of three distinct compliance graphs across three unique industries. The generation of each of these example graphs was described in each respective Section along with the data sourcing techniques. The output files of these graphs have been publicly released, along with their input data files. This work aims to provide a starting foundation for compliance graph analysis through example cases that can be explored and improved upon. The automobile maintenance network provides a compliance graph that describes the state of a personal vehicle over a period of time as it relates to the recommended maintenance schedule provided by the vehicle manufacturer. The healthcare network provides a compliance graph that describes the state of an urgent care clinic as it strives to maintain compliance to HIPAA. The oil and gas network provides a compliance graph that describes the state of an oil and gas company as it transports, stores, and processes hazardous material and works to maintain compliance to OSHA 1910H. Each of these example networks contains unique properties that highlights edge cases and insightful information about each industry and various compliance and noncompliance information. + +\addcontentsline{toc}{section}{Bibliography} +\bibliography{Bibliography} +\bibliographystyle{ieeetr} +\end{document} \ No newline at end of file diff --git a/ACM-JRC/acm-jdslogo.png b/ACM-JRC/acm-jdslogo.png new file mode 100644 index 0000000..9772aed Binary files /dev/null and b/ACM-JRC/acm-jdslogo.png differ diff --git a/ACM-JRC/acmart-primary/.gitignore b/ACM-JRC/acmart-primary/.gitignore new file mode 100644 index 0000000..a39596f --- /dev/null +++ b/ACM-JRC/acmart-primary/.gitignore @@ -0,0 +1,34 @@ +acmart.cls +acmart.pdf +acmguide.pdf +samples/sample-*.pdf +*.log +*.aux +*.cfg +*.glo +*.idx +*.toc +*.ilg +*.ind +*.out +*.lof +*.lot +*.bbl +*.blg +*.gls +*.cut +*.hd +*.dvi +*.ps +*.thm +*.tgz +*.zip +*.rpi +*~ +*.bcf +*.run.xml +samples/ACM-Reference-Format.bst +samples/*.tex +samples/*.bbx +samples/*.cbx +samples/*.dbx \ No newline at end of file diff --git a/ACM-JRC/acmart-primary/ACM-Reference-Format.bst b/ACM-JRC/acmart-primary/ACM-Reference-Format.bst new file mode 100644 index 0000000..c47cb4c --- /dev/null +++ b/ACM-JRC/acmart-primary/ACM-Reference-Format.bst @@ -0,0 +1,3081 @@ +%%% -*-BibTeX-*- +%%% ==================================================================== +%%% @BibTeX-style-file{ +%%% author = "Nelson H. F. Beebe, Boris Veytsman and Gerald Murray", +%%% version = "2.1", +%%% acmart-version = "1.90", +%%% date = "Mar 26 2023", +%%% filename = "ACM-Reference-Format.bst", +%%% email = "borisv@lk.net, boris@varphi.com", +%%% codetable = "ISO/ASCII", +%%% keywords = "ACM Transactions bibliography style; BibTeX", +%%% license = "public domain", +%%% supported = "yes", +%%% abstract = "", +%%% } +%%% ==================================================================== + +%%% Revision history: see source in git + +ENTRY + { address + advisor + archiveprefix + author + booktitle + chapter + city + date + edition + editor + eprint + eprinttype + eprintclass + howpublished + institution + journal + key + location + month + note + number + organization + pages + primaryclass + publisher + school + series + title + type + volume + year + % New keys recognized + issue % UTAH: used in, e.g., ACM SIGSAM Bulletin and ACM Communications in Computer Algebra + articleno + eid + day % UTAH: needed for newspapers, weeklies, bi-weeklies + doi % UTAH + url % UTAH + bookpages % UTAH + numpages + lastaccessed % UTAH: used only for @Misc{...} + coden % UTAH + isbn % UTAH + isbn-13 % UTAH + issn % UTAH + lccn % UTAH + distinctURL % whether to print url if doi is present + } + {} + { label.year extra.label sort.year sort.label basic.label.year} + +INTEGERS { output.state before.all mid.sentence after.sentence after.block } + +INTEGERS { show-isbn-10-and-13 } % initialized below in begin.bib + +INTEGERS { nameptr namesleft numnames } + +INTEGERS { multiresult } + +INTEGERS { len } + +INTEGERS { last.extra.num } + +STRINGS { s t t.org u } + +STRINGS { last.label next.extra } + +STRINGS { p1 p2 p3 page.count } + + +FUNCTION { not } +{ + { #0 } + { #1 } + if$ +} + +FUNCTION { and } +{ + 'skip$ + { pop$ #0 } + if$ +} + +FUNCTION { or } +{ + { pop$ #1 } + 'skip$ + if$ +} + + +FUNCTION { dump.stack.1 } +{ + duplicate$ "STACK[top] = [" swap$ * "]" * warning$ +} + +FUNCTION { dump.stack.2 } +{ + duplicate$ "STACK[top ] = [" swap$ * "]" * warning$ + swap$ + duplicate$ "STACK[top-1] = [" swap$ * "]" * warning$ + swap$ +} + +FUNCTION { empty.or.unknown } +{ + %% Examine the top stack entry, and push 1 if it is empty, or + %% consists only of whitespace, or is a string beginning with two + %% queries (??), and otherwise, push 0. + %% + %% This function provides a replacement for empty$, with the + %% convenient feature that unknown values marked by two leading + %% queries are treated the same as missing values, and thus, do not + %% appear in the output .bbl file, and yet, their presence in .bib + %% file(s) serves to mark values which are temporarily missing, but + %% are expected to be filled in eventually once more data is + %% obtained. The TeX User Group and BibNet bibliography archives + %% make extensive use of this practice. + %% + %% An empty string cannot serve the same purpose, because just as in + %% statistics data processing, an unknown value is not the same as an + %% empty value. + %% + %% At entry: stack = ... top:[string] + %% At exit: stack = ... top:[0 or 1] + + duplicate$ empty$ + { pop$ #1 } + { #1 #2 substring$ "??" = } + if$ +} + +FUNCTION { empty.or.zero } +{ + %% Examine the top entry and push 1 if it is empty, or is zero + duplicate$ empty$ + { pop$ #1 } + { "0" = } + if$ +} + + +FUNCTION { writeln } +{ + %% In BibTeX style files, the sequences + %% + %% ... "one" "two" output + %% ... "one" "two" output.xxx + %% + %% ship "one" to the output file, possibly following by punctuation, + %% leaving the stack with + %% + %% ... "two" + %% + %% There is thus a one-string lag in output processing that must be + %% carefully handled to avoid duplicating a string in the output + %% file. Unless otherwise noted, all output.xxx functions leave + %% just one new string on the stack, and that model should be born + %% in mind when reading or writing function code. + %% + %% BibTeX's asynchronous buffering of output from strings from the + %% stack is confusing because newline$ bypasses the buffer. It + %% would have been so much easier for newline to be a character + %% rather than a state of the output-in-progress. + %% + %% The documentation in btxhak.dvi is WRONG: it says + %% + %% newline$ Writes onto the bbl file what's accumulated in the + %% output buffer. It writes a blank line if and only + %% if the output buffer is empty. Since write$ does + %% reasonable line breaking, you should use this + %% function only when you want a blank line or an + %% explicit line break. + %% + %% write$ Pops the top (string) literal and writes it on the + %% output buffer (which will result in stuff being + %% written onto the bbl file when the buffer fills + %% up). + %% + %% Examination of the BibTeX source code shows that write$ does + %% indeed behave as claimed, but newline$ sends a newline character + %% directly to the output file, leaving the stack unchanged. The + %% first line "Writes onto ... buffer." is therefore wrong. + %% + %% The original BibTeX style files almost always use "write$ newline$" + %% in that order, so it makes sense to hide that pair in a private + %% function like this one, named after a statement in Pascal, + %% the programming language embedded in the BibTeX Web program. + + write$ % output top-of-stack string + newline$ % immediate write of newline (not via stack) +} + +FUNCTION { init.state.consts } +{ + #0 'before.all := + #1 'mid.sentence := + #2 'after.sentence := + #3 'after.block := +} + +FUNCTION { output.nonnull } +{ % Stack in: ... R S T Stack out: ... R T File out: S + 's := + output.state mid.sentence = + { + ", " * write$ + } + { + output.state after.block = + { + add.period$ writeln + "\newblock " write$ + } + { + output.state before.all = + { + write$ + } + { + add.period$ " " * write$ + } + if$ + } + if$ + mid.sentence 'output.state := + } + if$ + s +} + +FUNCTION { output.nonnull.dot.space } +{ % Stack in: ... R S T Stack out: ... R T File out: S + 's := + output.state mid.sentence = % { ". " * write$ } + { + ". " * write$ + } + { + output.state after.block = + { + add.period$ writeln "\newblock " write$ + } + { + output.state before.all = + { + write$ + } + { + add.period$ " " * write$ + } + if$ + } + if$ + mid.sentence 'output.state := + } + if$ + s +} + +FUNCTION { output.nonnull.remove } +{ % Stack in: ... R S T Stack out: ... R T File out: S + 's := + output.state mid.sentence = + { + " " * write$ + } + { + output.state after.block = + { + add.period$ writeln "\newblock " write$ + } + { + output.state before.all = + { + write$ + } + { + add.period$ " " * write$ + } + if$ + } + if$ + mid.sentence 'output.state := + } + if$ + s +} + +FUNCTION { output.nonnull.removenospace } +{ % Stack in: ... R S T Stack out: ... R T File out: S + 's := + output.state mid.sentence = + { + "" * write$ + } + { + output.state after.block = + { + add.period$ writeln "\newblock " write$ + } + { + output.state before.all = + { + write$ + } + { + add.period$ " " * write$ + } + if$ + } + if$ + mid.sentence 'output.state := + } + if$ + s +} + +FUNCTION { output } +{ % discard top token if empty, else like output.nonnull + duplicate$ empty.or.unknown + 'pop$ + 'output.nonnull + if$ +} + +FUNCTION { output.dot.space } +{ % discard top token if empty, else like output.nonnull.dot.space + duplicate$ empty.or.unknown + 'pop$ + 'output.nonnull.dot.space + if$ +} + +FUNCTION { output.removenospace } +{ % discard top token if empty, else like output.nonnull.removenospace + duplicate$ empty.or.unknown + 'pop$ + 'output.nonnull.removenospace + if$ +} + +FUNCTION { output.check } +{ % like output, but warn if key name on top-of-stack is not set + 't := + duplicate$ empty.or.unknown + { pop$ "empty " t * " in " * cite$ * warning$ } + 'output.nonnull + if$ +} + +FUNCTION { bibinfo.output.check } +{ % like output.check, adding bibinfo field + 't := + duplicate$ empty.or.unknown + { pop$ "empty " t * " in " * cite$ * warning$ } + { "\bibinfo{" t "}{" * * swap$ * "}" * + output.nonnull } + if$ +} + +FUNCTION { output.check.dot.space } +{ % like output.dot.space, but warn if key name on top-of-stack is not set + 't := + duplicate$ empty.or.unknown + { pop$ "empty " t * " in " * cite$ * warning$ } + 'output.nonnull.dot.space + if$ +} + +FUNCTION { fin.block } +{ % functionally, but not logically, identical to fin.entry + add.period$ + writeln +} + +FUNCTION { fin.entry } +{ + add.period$ + writeln +} + +FUNCTION { new.sentence } +{ % update sentence state, with neither output nor stack change + output.state after.block = + 'skip$ + { + output.state before.all = + 'skip$ + { after.sentence 'output.state := } + if$ + } + if$ +} + +FUNCTION { fin.sentence } +{ + add.period$ + write$ + new.sentence + "" +} + +FUNCTION { new.block } +{ + output.state before.all = + 'skip$ + { after.block 'output.state := } + if$ +} + +FUNCTION { output.coden } % UTAH +{ % output non-empty CODEN as one-line sentence (stack untouched) + coden empty.or.unknown + { } + { "\showCODEN{" coden * "}" * writeln } + if$ +} + +% +% Sometimes articleno starts with the word 'Article' or 'Paper. +% (this is a bug of acmdl, sigh) +% We strip them. We assume eid or articleno is already on stack +% + +FUNCTION { strip.articleno.or.eid } +{ + 't := + t #1 #7 substring$ "Article" = + {t #8 t text.length$ substring$ 't :=} + { } + if$ + t #1 #7 substring$ "article" = + {t #8 t text.length$ substring$ 't :=} + { } + if$ + t #1 #5 substring$ "Paper" = + {t #6 t text.length$ substring$ 't :=} + { } + if$ + t #1 #5 substring$ "paper" = + {t #6 t text.length$ substring$ 't :=} + { } + if$ + % Strip any left trailing space or ~ + t #1 #1 substring$ " " = + {t #2 t text.length$ substring$ 't :=} + { } + if$ + t #1 #1 substring$ "~" = + {t #2 t text.length$ substring$ 't :=} + { } + if$ + t +} + + +FUNCTION { format.articleno } +{ + articleno empty.or.unknown not eid empty.or.unknown not and + { "Both articleno and eid are defined for " cite$ * warning$ } + 'skip$ + if$ + articleno empty.or.unknown eid empty.or.unknown and + { "" } + { + numpages empty.or.unknown + { "articleno or eid field, but no numpages field, in " + cite$ * warning$ } + { } + if$ + eid empty.or.unknown + { "Article \bibinfo{articleno}{" articleno strip.articleno.or.eid * "}" * } + { "Article \bibinfo{articleno}{" eid strip.articleno.or.eid * "}" * } + if$ + } + if$ +} + +FUNCTION { format.year } +{ % push year string or "[n.\,d.]" onto output stack + %% Because year is a mandatory field, we always force SOMETHING + %% to be output + "\bibinfo{year}{" + year empty.or.unknown + { "[n.\,d.]" } + { year } + if$ + * "}" * +} + +FUNCTION { format.day.month } +{ % push "day month " or "month " or "" onto output stack + day empty.or.unknown + { + month empty.or.unknown + { "" } + { "\bibinfo{date}{" month * "} " *} + if$ + } + { + month empty.or.unknown + { "" } + { "\bibinfo{date}{" day * " " * month * "} " *} + if$ + } + if$ +} + +FUNCTION { format.day.month.year } % UTAH +{ % if month is empty, push "" else push "(MON.)" or "(DD MON.)" + % Needed for frequent periodicals: 2008. ... New York Times C-1, C-2, C-17 (23 Oct.) + % acm-*.bst addition: prefix parenthesized date string with + % ", Article nnn " + articleno empty.or.unknown eid empty.or.unknown and + { "" } + { output.state after.block = + {", " format.articleno * } + { format.articleno } + if$ + } + if$ + " (" * format.day.month * format.year * ")" * +} + +FUNCTION { output.day.month.year } % UTAH +{ % if month is empty value, do nothing; else output stack top and + % leave with new top string "(MON.)" or "(DD MON.)" + % Needed for frequent periodicals: 2008. ... New York Times C-1, C-2, C-17 (23 Oct.) + format.day.month.year + output.nonnull.remove +} + +FUNCTION { strip.doi } % UTAH +{ % Strip any Web address prefix to recover the bare DOI, leaving the + % result on the output stack, as recommended by CrossRef DOI + % documentation. + % For example, reduce "http://doi.acm.org/10.1145/1534530.1534545" to + % "10.1145/1534530.1534545". A suitable URL is later typeset and + % displayed as the LAST item in the reference list entry. Publisher Web + % sites wrap this with a suitable link to a real URL to resolve the DOI, + % and the master https://doi.org/ address is preferred, since publisher- + % specific URLs can disappear in response to economic events. All + % journals are encouraged by the DOI authorities to use that typeset + % format and link procedures for uniformity across all publications that + % include DOIs in reference lists. + % The numeric prefix is guaranteed to start with "10.", so we use + % that as a test. + % 2017-02-04 Added stripping of https:// (Boris) + doi #1 #3 substring$ "10." = + { doi } + { + doi 't := % get modifiable copy of DOI + + % Change https:// to http:// to strip both prefixes (BV) + + t #1 #8 substring$ "https://" = + { "http://" t #9 t text.length$ #8 - substring$ * 't := } + { } + if$ + + t #1 #7 substring$ "http://" = + { + t #8 t text.length$ #7 - substring$ 't := + + "INTERNAL STYLE-FILE ERROR" 's := + + % search for next "/" and assign its suffix to s + + { t text.length$ } + { + t #1 #1 substring$ "/" = + { + % save rest of string as true DOI (should be 10.xxxx/yyyy) + t #2 t text.length$ #1 - substring$ 's := + "" 't := % empty string t terminates the loop + } + { + % discard first character and continue loop: t <= substring(t,2,last) + t #2 t text.length$ #1 - substring$ 't := + } + if$ + } + while$ + + % check for valid DOI (should be 10.xxxx/yyyy) + s #1 #3 substring$ "10." = + { } + { "unrecognized DOI substring " s * " in DOI value [" * doi * "]" * warning$ } + if$ + + s % push the stripped DOI on the output stack + + } + { + "unrecognized DOI value [" doi * "]" * warning$ + doi % push the unrecognized original DOI on the output stack + } + if$ + } + if$ +} + +% +% Change by BV: added standard prefix to URL +% +FUNCTION { output.doi } % UTAH +{ % output non-empty DOI as one-line sentence (stack untouched) + doi empty.or.unknown + { } + { + %% Use \urldef here for the same reason it is used in output.url, + %% see output.url for further discussion. + "\urldef\tempurl%" writeln + "\url{https://doi.org/" strip.doi * "}" * writeln + "\showDOI{\tempurl}" writeln + } + if$ +} + +FUNCTION { output.isbn } % UTAH +{ % output non-empty ISBN-10 and/or ISBN-13 as one-line sentences (stack untouched) + show-isbn-10-and-13 + { + %% show both 10- and 13-digit ISBNs + isbn empty.or.unknown + { } + { + "\showISBNx{" isbn * "}" * writeln + } + if$ + isbn-13 empty.or.unknown + { } + { + "\showISBNxiii{" isbn-13 * "}" * writeln + } + if$ + } + { + %% show 10-digit ISBNs only if 13-digit ISBNs not available + isbn-13 empty.or.unknown + { + isbn empty.or.unknown + { } + { + "\showISBNx{" isbn * "}" * writeln + } + if$ + } + { + "\showISBNxiii{" isbn-13 * "}" * writeln + } + if$ + } + if$ +} + +FUNCTION { output.issn } % UTAH +{ % output non-empty ISSN as one-line sentence (stack untouched) + issn empty.or.unknown + { } + { "\showISSN{" issn * "}" * writeln } + if$ +} + +FUNCTION { output.issue } +{ % output non-empty issue number as a one-line sentence (stack untouched) + issue empty.or.unknown + { } + { "Issue " issue * "." * writeln } + if$ +} + +FUNCTION { output.lccn } % UTAH +{ % return with stack untouched + lccn empty.or.unknown + { } + { "\showLCCN{" lccn * "}" * writeln } + if$ +} + +FUNCTION { output.note } % UTAH +{ % return with stack empty + note empty.or.unknown + { } + { "\shownote{" note * "}" add.period$ * writeln } + if$ +} + +FUNCTION { output.note.check } % UTAH +{ % return with stack empty + note empty.or.unknown + { "empty note in " cite$ * warning$ } + { "\shownote{" note * "}" add.period$ * writeln } + if$ +} + +FUNCTION { output.eprint } % +{ % return with stack empty + eprint empty.or.unknown + { } + { "\showeprint" + archiveprefix empty.or.unknown + { eprinttype empty.or.unknown + { } + { "[" eprinttype "]" * * * } + if$ + } + { "[" archiveprefix "l" change.case$ "]" * * * } + if$ + "{" eprint "}" * * * + primaryclass empty.or.unknown + { eprintclass empty.or.unknown + { } + { "~[" eprintclass "]" * * * } + if$ + } + { "~[" primaryclass "]" * * * } + if$ + writeln + } + if$ +} + + +% +% Changes by BV 2011/04/15. Do not output +% url if doi is defined +% +% +% Changes by BV 2021/11/26. Output url even if doi is defined +% if distinctURL is not zero. +% +FUNCTION { output.url } % UTAH +{ % return with stack untouched + % output URL and associated lastaccessed fields + doi empty.or.unknown distinctURL empty.or.zero not or + { + url empty.or.unknown + { } + { + %% Use \urldef, outside \showURL, so that %nn, #, etc in URLs work + %% correctly. Put the actual URL on its own line to reduce the + %% likelihood of BibTeX's nasty line wrapping after column 79. + %% \url{} can undo this, but if that doesn't work for some reason + %% the .bbl file would have to be repaired manually. + "\urldef\tempurl%" writeln + "\url{" url * "}" * writeln + + "\showURL{%" writeln + lastaccessed empty.or.unknown + { "" } + { "Retrieved " lastaccessed * " from " * } + if$ + "\tempurl}" * writeln + } + if$ + } + { } + if$ +} + +FUNCTION { output.year.check } +{ % warn if year empty, output top string and leave " YEAR