Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 277

continue by inspecting the user control over private information through describ-
ing the model's ability to provide identity, content, location, and time privacy.
Finally, we discuss the UPM scalability through its support for XML as a com-
mon communication platform and distributed decision making processes.
3.1 Measuring the Models Unobtrusiveness of Privacy Mechanisms
The unobtrusiveness of privacy policies is the percentage of time the user con-
sumes on dealing with the privacy subsystem to make decision. The designed
experiment to measure the model unobtrusiveness includes the following steps:
1. Categorizing all system situations based on the number of privacy alarms
into groups of scenarios. The model consists of the three groups of scenarios
with zero, one or two privacy alarms.
2. Design cases in a way that each has one scenario with zero, one scenario
with one, and one scenario with two privacy alarms. Each case should have
at least one scenario that none of the other cases had before and all the
model scenarios should be covered.
3. Each experiment participant does one case to measure the whole time of
work and the amount of time that a user consumes on dealing with the
privacy alarms in each scenario. The unobtrusiveness of each case computes
as follow:
Each case unobtrusiveness = (Sum of all times that user consumes on dealing
with privacy alarms during that case / Total time of experimenting the case)*
100. (1)
4. The model average unobtrusiveness computes as follow:
Average Model Unobtrusiveness= (Sum of all cases unobtrusiveness / num-
ber of cases). (2)
To measure the total time of experiment, the implemented software writes an
entry into the windows event viewer at two specific times, starting work and
finishing work. Whenever the user receives a privacy alarm, an entry would be
written into the event viewer and when the user makes a decision for that alarm,
another entry would be registered in the event viewer. The sum of all times that
user spends to make decision is used in formula (2).
We use C#.Net 2005 (.Net2.00) mobile web applications to implement the
model. We implemented three different tasks namely Buying Ticket, Reserv-
ing Appointment Time with University Lecturers, and Using University Smart
Board and then based on the case design we measure the model unobtrusiveness.
Table 1 show results of the experiment (all times are measured in seconds).
The Total Time of Work (TTW) column shows the amount of time from the
user authentication phase until the user finishes using the service and saves data,
Joining Context Interruption Time (JCIT), Service Registration Interruption
Time (SRIT), and Login Page Interruption Time (LPIT) columns show the
amount of time the user consumes on dealing with each privacy alarm in that
phase. The other columns are calculated as follow: