The proliferation of smart devices gives rise to a new world of Ambient Intelligence, a world of technologies embedded in the surrounding environments, such as the home environment. As the success of such systems often depends on the collection on personal data, privacy concerns threaten to hinder this new world from reaching its full potential. At the same time, accurately modelling the different types of contextual information proves to be of paramount importance in paving the way towards the maturity of Ambient Intelligence systems, with Semantic Web ontologies becoming a popular solution. This paper aims to explore the application of Semantic Web ontologies in modelling privacy-related information in the context of smart home environments. To this purpose, we have conducted a practical evaluation of three ontologies, in an attempt to determine their suitability within the stated domain. The paper concludes that the representation of privacy features within smart home environments is attainable through the use of ontologies; however, current models do not achieve sufficient coverage of the domain. Lastly, the paper provides insights into practical ways of enhancing future ontologies in order to reach the required capabilities.
Recent technological advances have enabled various devices with different capabilities
to become embedded in our surrounding environments [
Given the sheer variety of connected devices that constitute an AmI system, privacy has become of paramount importance. This paper will explore the topic of privacy in smart home environments, from an information management perspective. In the context of this paper, information management broadly refers to the control, processing and exchange of information within a system.
A promising approach to information management for representing AmI domains is
the use of Semantic Web ontologies [
The main objective of this study is to evaluate relevant Semantic Web ontologies in order to determine their degree of suitability for modelling privacy-related information in smart home environments. In order to meet the stated objective, the following research questions will be used to guide this study:
To address this question we have performed a task-based evaluation of three selected ontologies. The performance of the ontologies is assessed based on their ability to model real-life scenarios. The results of the evaluation are derived in two steps; first by determining the number of privacy features modelled; thereafter by validating against pre-determined evaluation criteria.
To answer this question, we identify the gaps and limitations of current solutions and point towards the requirements that future ontologies should meet and how current models can be extended to achieve these capabilities.
The rest of the paper is structured as follows: We first review the relevant literature to identify the main privacy challenges and privacy protection techniques in the context of smart home environments. The purpose of this exercise is to establish the key aspects of information that should be semantically represented in a system for smart home environments. In Section 3, we review current Semantic Web ontologies for Ambient Intelligence. In Section 4, we present the setup and the results of a task-based evaluation of such ontologies. Finally, in section 5, we discuss the main findings of the evaluation, identifying the main gaps and limitations of current approaches, and proposing guidelines and directions for addressing such limitations. 2.
Ambient Intelligence (AmI) refers to systems that are adaptive, sensitive, and
responsive to the presence of people [
uniquely identify a person [
Definition
Semantic Web ontologies meet the representation requirements of AmI set by many
studies in terms of type and level of formality, knowledge sharing, expressiveness,
flexibility and extensibility, generality, granularity, reasoning support and valid context
constraining [
Several ontologies have been specifically developed for AmI systems [
SOUPA (Standard Ontology for Ubiquitous and Pervasive Applications) is a widely
cited ontology, created specifically for AmI environments [
COSE (Casas Ontology for Smart Environments) is a relatively recent ontology,
which achieves an in-depth representation of context features in smart environments,
being highly domain-specific [
PROACT (PRivacy Ontology for ACTivity spheres) has been specifically designed
to reconcile privacy and AmI environments, being built upon concepts from general
ontologies from the two fields, including SOUPA and Rei [
The purpose of the evaluation is to draw conclusions regarding the suitability of the
ontologies for modelling privacy in smart home environments The evaluation was
conducted in three steps: We first analysed real-life scenarios, based on the privacy
themes previously revealed by the literature review. We then attempted to model the
scenarios using the selected ontologies. And finally, we assessed the capabilities of the
ontologies to model the scenarios using appropriate evaluation criteria.
4.1 Scenario Analysis
Scenarios were created since the very first publications on AmI, starting with Weiser’s
portrayal of “Sal’s World” [
Following the analysis of multiple scenarios, three were selected, as they contained
most privacy elements: “Sal’s World” [
Through this exercise, the ontologies were examined from three different angles: 1. The extent to which they are capable of modelling the privacy features 2. Their ability to accurately portray a smart home environment 3. Their performance against the pre-determined evaluation criteria
In general, only small changes were made to the ontologies, such as adding appropriate subclasses to existing classes. If the required classes or properties did not exist, we concluded that the ontology failed to model that respective element. A sample of the findings along with the scenario mapping is presented in Table 3.
Some important findings of this experiment regarding the capabilities of the ontologies to model privacy-related concepts are the following:
SOUPA supports the representation of user privacy, being influenced by the Rei
policy language [
COSE does not capture any privacy protection mechanisms, since no classes,
properties or individuals are explicitly related to privacy. Wemlinger and Holder [
Privacy concerns are at the core of the PROACT ontology, as it was developed
specifically to address this gap in modelling AmI systems [
The overall results of this evaluation are depicted in Table 4. 1 Key to Tables 3 and 4: ✓/Í = the ontology can/cannot model this feature ~ = the ontology can model this feature with minimum additions 4.3 Evaluation of Ambient Intelligence Features Previous studies on ontology evaluation suggest various possible evaluation criteria. In order to fully assess ontologies by their ability to represent facets of privacy, we carried out an analysis of general AmI features, since privacy is not a standalone concept within the smart home domain. Based on this analysis, we selected the evaluation criteria presented in Table 5.
Description
which the system-user interaction takes place [
AmI system [
Context Score: 3/5 The Location class is part of SOUPA, yet location data does not seem to be integrated well with smart devices. There were cases presented in the scenarios where a device collects location data, and this situation could not be modelled. There is only one Person class, and users are not differentiated from each other. The Time ontology contains numerous useful concepts such as instant events, events of longer duration and measurements of time.
Yet, the Activity ontology offers specific properties such as actor, target, instrument and time, enabling the formation of links between user activities and virtually any other part of the system.
Uncertainty Score: 5/5 SOUPA is the only of the three ontologies that is capable of modelling incomplete or uncertain information, with one of the core SOUPA ontologies being Belief Desire - Intention. Using this ontology, we could create statements such as “SmartHome believes IntruderStatement”, capturing a situation in Scenario C, where the system has information regarding an intruder in the home.
Knowledge is another key class for modelling uncertainty, having a reliabilityRating property, which can express the level of confidence regarding the validity of a particular piece of knowledge. Similarly, a piece of knowledge can conflict with, or be inconsistentWith another piece of knowledge.
HCI Score: 4/5 In SOUPA, HCI can be modelled through the use of the Action ontology, along with its specific properties (e.g. actor, target, recipient). HCI-specific means of communication are also captured, in particular, tools for messaging such as ChatID and IMProvider. These were employed for representing Scenario B, where Paolo and the intelligent system Archie were exchanging text messages. Yet the limited Device vocabulary restricts the richness with which HCI can be modelled. 4.3.2 COSE
Context Score: 5/5 COSE can model elements of surrounding space to a very high degree of accuracy. Location is captured through the Point class, having properties for representing coordinates (e.g. xCoordinateOfPoint). Space within a house is represented by the classes Bedroom, LivingRoom, and FurniturePiece. Moreover, COSE offers a Person class with the subclasses Resident and Occupant. Time is captured by the classes TemporalThing and UnitOfTime and through data properties such as timestamp. Activities are classified into IntelligentAgentActivity and HumanActivity, a separation that we found extremely useful. Likewise, human activities are further broken down, achieving a higher degree of accuracy.
In addition, COSE distinguishes between the notions of SmartEnvironment, ElectronicDevice and HouseholdAppliance. This approach facilitated the modelling of Scenario B, in which the intelligent agent Archie communicated with Paolo via an electronic device (i.e. phone) and scheduled the activities of household appliances (e.g. washing machine). Finally, COSE uses a highly precise hierarchy for representing sensors and actuators, an essential component of smart homes. The Sensor hierarchy is comprised of 14 subclasses including PressureSensor,
Uncertainty Score: 2/5 COSE cannot explicitly model uncertainty. The only element that points towards uncertainty is the data property activityHasError, which can represent the uncertain nature of human activities; however its precise use is unclear.
HCI Score: 3/5
HCI modelling can be achieved only to a certain extent. COSE can model human
activities and people’s interactions with devices via the InteractWithInformation and
InteractWithPhysicalObject classes. Nevertheless, the aspects modelled are
incomplete; primarily due to the missing properties connecting the classes Person
and ElectronicDevice.
4.3.3 PROACT
We should note that PROACT was not available in its entirety and therefore it was
reconstructed by following the information available in [
Context Score: 2/5 Due to its focus on privacy and security, PROACT cannot model context sufficiently. The most noticeable omission is the lack of a representation for location. On the other hand, humans are well modelled by classes such as User, Client and ResourceOwner. In addition, PROACT allows the representation of groups of people as well as individuals, enabling the description of companies or other entities.
There is one class for Time and a property, hasDuration, but these only partially meet the time representation requirements of smart environments. In Scenario A, Sal was verifying the time markers of events in the surveillance system, elements which we could not model with PROACT. Finally, this ontology has no way of accounting for user activities, meaning all related aspects such as activity monitoring or surveillance, cannot be modelled.
Uncertainty Score: 2/5 PROACT does not have the ability to capture uncertain information. However, some level of uncertainty can be modelled as it relates to privacy and security. For example, user groups can collectively be assigned a “trust level”, therefore, the ontology enables reasoning about the trustworthiness of users.
HCI Score: 3/5 HCI is generally well accounted for in PROACT. There are properties that enable stating that a user owns a device, and also that a device recognises the user. Through the class Service, intelligent agents can provide services that are received by users. This can be thought of as a class synonymous to “Action”, yet only devices can execute these actions. Nonetheless, PROACT’s capabilities to represent more complex HCI features, such as the exchange of instant messages mentioned in Scenario B, are rather limited, as it can only capture the type of a service, but not how this service is actually used. 4.4 Evaluation of General Quality Aspects Aside from the specific AmI features, we also evaluated the ontologies using general ontology quality criteria selected from the literature, as outlined in Table 6. This evaluation was performed during the practical experiment by using the ontologies and deciding how well each ontology performed against the specified criteria.
respect to the ontology user [
The level of accuracy was given by the ability of an ontology to accurately model the concepts from the scenarios with appropriate classes and properties that associate those classes. An example of inaccurate class naming in PROACT is in the classes Mechanism and PolicyMechanism, which are not similar in function yet have similar names (Mechanism refers to an action such as transferring data, whereas PolicyMechanism could be authentication or authorisation).
Clarity was mainly derived from the presence or absence of clear naming, class hierarchies and labelling. For instance, COSE was evaluated as a generally unclear ontology, having unintuitive class names (e.g. SupposedToBeMicrotheory) and hierarchies (e.g. Person as a subclass of ThreeDimantionalGeometricThing).
Consistency was determined mainly based on whether there are any unsatisfiable classes or restrictions in the ontology.
The level of conciseness was given by the number of relevant and redundant classes. For example, COSE contains 145 classes, the majority of which have one subclass only; thus, they can be considered redundant.
An ontology was considered complete if during the scenario mapping, all needed elements could be found. For instance, SOUPA is more general-purpose and thus had no means of representing sensors, while PROACT lacked elements to represent contextual concepts such as location, time, space, and user activities.
Finally, operability was determined based on general conclusions about the ease of use of each ontology. The results of this evaluation are summarised in Table 7:
5.1 Results of Ontology Evaluation The initial evaluation of the three ontologies determined their suitability in semantically representing privacy-related features in smart home environments. This exercise concludes that both SOUPA and PROACT could model 62.5% of the features, while, COSE is significantly behind, being able to model only 27.5%. Some features, such as surveillance, location disclosure and unauthorised actions, were representable in all ontologies, while personal data matching could not be modelled by any of the three ontologies.
The distribution of modelled features was homogenous; there were few features that could not be represented by any of the ontologies. It can, therefore, be concluded that it is possible to semantically represent all of the evaluated features, and the lower scores account for the missing capabilities of each ontology.
Nevertheless, it can be argued that an ontology which accurately represents privacy protection mechanisms is superior to one that can only represent privacy challenges. Consequently, the results were further analysed by considering the two facets of privacy independently, as shown in Table 8. This analysis differs from the previous one in the sense that privacy challenges and protection techniques are given equal weights. Previously, the challenges weighted more due to being more numerous (14) compared to the protection techniques (6). 3 4 4 4 2 4 Therefore, PROACT is superior in modelling privacy protection techniques.
After the implementation of the ontologies in Protégé, conclusions could be drawn regarding their ability to model the principal AmI features. The results of the second evaluation are summarised in Table 9.
Consequently, SOUPA performed exceedingly well in this evaluation with an average score of 4 out of 5, followed by COSE and lastly, PROACT. COSE was better in modelling context elements, yet SOUPA was the only one that could accurately represent uncertain and incomplete information.
Lastly, we assessed the general quality aspects of ontologies. In this assessment, PROACT scored the highest, followed by SOUPA and COSE. It is worth noting that these quality criteria are not fully independent to each other; for instance, an ontology that scored low in clarity, is unlikely to perform very well in operability.
For some criteria, accuracy and completeness in particular, neither of the ontologies scored more than 3 out of 5, meaning that their ability to describe context accurately is limited.
To conclude, based on the results of the three evaluation exercises, SOUPA and PROACT seem equally well equipped to model privacy in smart home environments, both having strengths and weaknesses alike. COSE has been deemed not fully suitable for this domain, requiring considerable enhancements.
Nevertheless, by observing the performance of the selected ontologies, broader themes emerge for the field of semantic web ontologies for privacy in smart home environments. The final section discusses these themes and offers an insight into what the future improvements in the field might be.
3
5
4
4
5.2 Conclusion on Ontology Evaluation
It is important to situate the findings within the wider context of how the ontologies
themselves were developed. COSE is an ontology for smart environments, as
Wemlinger and Holder argue in favour of developing domain ontologies [
PROACT is targeted at privacy and security, introducing highly valuable techniques
for representing privacy protection. Yet, it disregards other context elements which, in
turn, contribute to modelling privacy. The lesson learned from evaluating PROACT is
that privacy must be considered holistically, accounting not just for privacy protection,
but also acknowledging the privacy issues that arise from the very nature of smart
environments. The most surprising finding is the failure of PROACT to outperform
SOUPA. Not only is PROACT more recent than SOUPA, but also PROACT was built
on top of SOUPA [
In spite of small shortcomings, SOUPA performed best overall, having no considerable gaps in modelling the domain. The justification could be that it is by design a general-purpose ontology, implying a careful consideration of the domain at large. The conclusion from this evaluation is that the most promising approach takes a holistic stance and regards privacy as an integral part of smart home environments.
Lastly, an interesting observation arises from the study of the relevant literature from
different periods. The most recently developed ontology, COSE, as well as Denti’s
scenario [
Thereafter, the ontology could be developed progressively starting from the core context elements: Location, Person, Time, and Activity. Building on top of these, the future ontology could integrate the COSE hierarchies for sensors and buildings, devices and household appliances.
Privacy protection measures should be added following the example from PROACT, by constructing classes for policy mechanisms such as authentication and authorisation, and the data-related actions that the policies will be applied upon (e.g. data access, data disclosure). In addition, we would recommend an extension that enables the permission as well as the prohibition of actions, so that the users can grant permissions both explicitly and implicitly.
Finally, the Belief-Desire-Intention construct from SOUPA has been deemed highly appropriate for modelling uncertainty. With regard to the properties, they should be structured in a hierarchical manner, grouped by common domain and range restrictions, as SOUPA proved this practice to be useful.
Nevertheless, future research should also bear in mind the limitations of ontology
engineering, since automatically integrating ontologies is still an open research
question [