extfieldsofstudy:
Engineering
Medicine
Computer Science

text:
Hybrid Radar Emitter Recognition Based on Rough k-Means Classifier and Relevance Vector Machine

Due to the increasing complexity of electromagnetic signals, there exists a significant challenge for recognizing radar emitter signals. In this paper, a hybrid recognition approach is presented that classifies radar emitter signals by exploiting the different separability of samples. The proposed approach comprises two steps, namely the primary signal recognition and the advanced signal recognition. In the former step, a novel rough k-means classifier, which comprises three regions, i.e., certain area, rough area and uncertain area, is proposed to cluster the samples of radar emitter signals. In the latter step, the samples within the rough boundary are used to train the relevance vector machine (RVM). Then RVM is used to recognize the samples in the uncertain area; therefore, the classification accuracy is improved. Simulation results show that, for recognizing radar emitter signals, the proposed hybrid recognition approach is more accurate, and presents lower computational complexity than traditional approaches.

Introduction
Radar emitter recognition is a critical function in radar electronic support systems for determining the type of radar emitter [1]. Emitter classification based on a collection of received radar signals is a subject of wide interest in both civil and military applications. For example, in battlefield surveillance applications, radar emitter classification provides an important means to detect targets employing radars, especially those from hostile forces. In civilian applications, the technology can be used to detect and identify navigation radars deployed on ships and cars used for criminal activities [2]. This technology can be also applied in navigation radars for detecting ships and estimating their sizes [3], focusing on future classification stages [4].
The recent proliferation and complexity of electromagnetic signals encountered in modern environments greatly complicates the recognition of radar emitter signals [1]. Traditional recognition methods are becoming inefficient against this emerging issue [5]. Many new radar emitter recognition methods were proposed, e.g., intra-pulse feature analysis [6], stochastic context-free grammar analysis [1], and artificial intelligence analysis [7][8][9][10][11]. In particular, the artificial intelligence analysis approach has attracted much attention. Artificial intelligence techniques have been also successfully applied when working with radars for other purposes, such as clutter reduction stages [12], in target detection stages [13,14] and in target tracking stages [15]. Among the artificial intelligence approaches, the neural network and the support vector machine (SVM) are widely used for radar emitter recognition. In [8], Zhang et al. proposed a method based on the rough sets theory and radial basis function (RBF) neural network. Yin et al. proposed a radar emitter recognition method using the single parameter dynamic search neural network [9]. However, the prediction accuracy of the neural network approaches is not high and the application of neural networks requires large training sets, which may be infeasible in practice. Compared to the neural network, the SVM yields higher prediction accuracy while requiring less training samples. Ren et al. [2] proposed a recognition method using fuzzy C-means clustering SVM. Lin et al. proposed to recognize radar emitter signals using the probabilistic SVM [10] and multiple SVM classifiers [11]. These proposed SVM approaches can improve the accuracy of recognition. Unfortunately, the computational complexity of SVM increases rapidly with the increasing number of training samples, so the development of classification methods with high accuracy and low computational complexity is becoming a focus of research. Recently, a general Bayesian framework for obtaining sparse solutions to regression and classification tasks named relevance vector machine (RVM) was proposed. RVM is attracting more and more attention in many fields, including radar signal analysis [16,17].
Classifiers can be categorized into linear classifiers and nonlinear classifiers. A linear classifier can classify linear separable samples, but cannot classify linearly inseparable samples efficiently. A nonlinear classifier can classify linearly inseparable samples; nevertheless it usually has a more complex structure than a linear classifier and the computational complexity of the nonlinear classifier will be increased when processing linearly separable samples. In practice, the radar emitter signals consist of both linearly separable samples and linearly inseparable samples, which makes classification challenging, so in an ideal case, linearly separable samples should are classified by linear classifiers, while only these linearly inseparable samples are classified by the nonlinear classifier. However in the traditional recognition approach, only one classifier is used; thus, it is difficult to classify all radar emitter signal samples.
In this paper, a hybrid recognition method based on the rough k-means theory and the RVM is proposed. To deal with the drawback of the traditional recognition approaches, we apply two classifiers to recognize linearly separable samples and linearly inseparable samples, respectively. Samples are firstly recognized by the rough k-means classifier, while linearly inseparable samples are picked up and further recognized by using RVM in the advanced recognition. This approach recognizes radar emitter signals accurately and has a lower computational complexity.
The rest of the paper is organized as follows. In Section 2, a novel radar emitter recognition model is proposed. In Section 3, the primary recognition is introduced. In Section 4, the advanced recognition is introduced. In Section 5, the computational complexity of this approach is analyzed. The performance of the proposed approach is analyzed in Section 6, and conclusions are given in Section 7.

Radar Emitter Recognition System
A combination of multiple classifiers is a powerful solution for difficult pattern recognition problems. Thinking about the structure, a combined classifier can be divided into serial and concurrent. A serial combined classifier usually has a simple structure and is easy to establish. In serial combined classifiers, the latter classifier makes the samples rejected by the former its training samples. Thus in designing it, the key is choosing the complementary classifiers and determining the rejected samples.
In this section, a hybrid radar emitter recognition approach that consists of a rough k-means classifier in the primary recognition and a RVM classifier in the advanced recognition is proposed. This approach is based on the fact that in the k-means clustering, the linearly inseparable samples are mostly at the margins of clusters, which makes it difficult to determine which cluster they belong to. To solve this problem, in our approach a linear classifier and a nonlinear classifier are applied to form a hybrid recognition method. In the proposed approach, the rough k-means classifier, which is linear, is applied as the primary recognition. It can classify linearly separable samples and pick up those linearly inseparable samples to be classified in the advanced recognition.
In the rough k-means algorithm, there are two areas in a cluster, i.e., certain area and rough area. But in the rough k-means classifier proposed in this paper, there exist three areas, i.e., certain area, rough area and uncertain area. For example, in two dimensions, a cluster is depicted in Figure 1.
Training samples are clustered first. At the edge of the cluster, there is an empty area between the borderline and the midcourt line of the two cluster centers. We name this area as the uncertain area. In clustering, there is no sample in the uncertain area. When the clustering is completed, these clusters will be used as the minimum distance classifier. When unknown samples are classified, samples are distributed into the nearest cluster. However linearly inseparable samples are usually far from cluster centers and out of the cluster probably, i.e., in the uncertain area. Thus after distributed into their nearest clusters, the unknown samples in the uncertain area will be recognized by the advanced recognition using a nonlinear classifier. For those unknown samples in the certain area and rough area, the primary recognition outputs final results. After sorting and feature extraction, radar emitter signals are described by pulses describing words. Radar emitter recognitions are based on these pulses describing words. The process of the hybrid radar emitter recognition approach is shown in Figure 2.
Based on the pulses describing words, we can obtain an information sheet of radar emitter signals. By using rough sets theory, the classification rules are extracted. These classification rules are the basis of the initial centers of the rough k-means classifier. More specifically, they determine the initial centers and the number of clusters. After that, the known radar emitter signal samples are clustered by the rough k-means while the rough k-means classifier in the primary recognition is built, as described in the next section. The samples in the margin of a cluster are affected easily by noises and even out of the cluster boundary, which will cause confusions in recognition of unknown samples. Thus, the samples in the margin of a cluster are picked up to be used as the training data for the RVM in the advanced recognition. In recognition, the unknown samples to be classified are recognized firstly by the rough k-means classifier. The uncertain sample set, which is rejected by the primary recognition, is classified by the RVM in the advanced recognition. In the advanced recognition, RVM will recognize these unknown samples based on the training samples, i.e., the samples in the rough areas. More specifically, the samples which are the rough samples affected by the noise, will be recognized. And other samples will be rejected by the advanced recognition.

Figure 2.
Flow chart of the hybrid radar emitter recognition approach proposed in this paper. First of all, samples are recognized by the primary recognition, which can classify linearly separable samples and pick up those linearly inseparable samples to be classified in the advanced recognition using relevance vector machine.
Based on the process of the recognition approach described above, the accuracy of the hybrid recognition is a superposition of two parts, i.e., the accuracy of the primary recognition and the accuracy of the advanced recognition. The samples that the primary recognition rejects are classified by the advanced recognition. So the estimate of recognition accuracy can be given by: (1) where A total , A primary , A advanced , and R primary denote the accuracy of the hybrid recognition, the accuracy of the primary recognition, the accuracy of the advanced recognition, and the reject rate of the primary classifier, respectively. total primary primary advanced

Primary Recognition Based on Improved Rough k-means
As mentioned above, a classifier based on the rough k-means is proposed as the primary recognition. Rough k-means is a generation of k-means algorithm, which is one of the most popular iterative descent clustering algorithms [18]. The basic idea of k-means algorithm is to make the samples have high similarity in a class, and low similarity among classes. However k-means clustering algorithm has the following problems: 1. The number of clusters in the algorithm must be given before clustering.
2. The k-means algorithm is very sensitive to the initial center selection and can easily end up with a local minimum solution.
3. The k -means algorithm is also sensitive to isolated points.
To overcome the problem of isolated points, Pawan and West proposed the rough k-means algorithm [19]. The rough k-means can solve the problems of nondeterminacy in clustering and reduce the effect of isolated samples efficiently, but it still requires initial centers and the number of clusters as priors. In this paper, we propose to determine the number and initial centers of clusters based on rough sets theory.
In rough sets theory, an information system can be expressed by a four-parameters group [20]: S = {U, R, V, f}. U is a finite and non-empty set of objects called the universe, and R = C∪D is a finite set of attributes, where C denotes the condition attributes and D denotes the decision attributes. V = ∪v r , (r ∈ R) is the domain of the attributes, where v r denotes a set of values that the attribute r may take. f :U × R → V is an information function. The equivalence relation R partitions the universe U into subsets. Such a partition of the universe is denoted by U/R = E 1 , E 2 ,..., E n , where E i is an equivalence class of R. If two elements u, v ∈ U belong to the same equivalence class , Since it is not possible to differentiate the elements within the same equivalence class, one may not obtain a precise representation for a set . The set X, which can be expressed by combining sets of some R basis categories, is called set defined, and the others are rough sets. Rough sets can be defined by upper approximation and lower approximation. The elements in the lower bound of X definitely belong to X, and elements in the upper bound of X belong to X possibly. The upper approximation and lower approximation of the rough set R can be defined as follows [20]: where represents the set that can be merged into X positively, and represents the set that is merged into X possibly.
In the radar emitter recognition, suppose Q is the condition attribute, namely, the pulse describing words for classification, P is the decision attribute, namely, the type of radar emitter, and the U is the set of radar emitter samples. The information systems decided by them are and . If for any : then P is dependent on Q completely, that is to say when disquisitive radar emitter sample is some characteristic of Q, it must be some characteristic of P. P and Q are of definite relationship. Otherwise, P and Q are of uncertain relationship. The dependent extent of knowledge P to knowledge Q is defined by: where and . The value of γ Q reflects the dependent degree of P to Q.
γ Q = 1 shows P is dependent on Q completely; γ Q close to 1 shows P is dependent on Q highly; γ Q = 0 shows P is independent of Q and the condition attribute Q is redundancy for classification. Due to the limitation of length, rough sets theory is introduced briefly here. And the details of rough sets are introduced in reference [20]. After discretization and attribute reduction, the classification rules are extracted. Using this approach, the initial centers are computed based on the classification rules of rough sets. The process can be described as follows: 1. Classification rules are obtained based on the rough sets theory.
2. The mean value of every class is obtained.
3. The clustering number equals to the number of rules and define the mean values as the initial clustering centers: (6) where X p denotes the set of samples in the classification rule p of the rough sets theory.
In rough k-means algorithm upper approximation and lower approximation are introduced. The improved cluster center is given by [19]: where the parameters ω lower and ω upper are lower and upper subject degrees of x relative to the clustering center. For each object vector v, d(x, t i ) denotes the distance between the center of cluster t i and the sample. The lower and upper subject degrees of x relative to its cluster is based on the value of , where . If the value of , the sample x is subject to the lower approximation of its cluster, where λ denotes the threshold for determining upper and lower approximation. Otherwise, x will be subject to the upper approximation.
The comparative degree can be determined by the number of elements in the lower approximation set and the upper approximation set, as follows: In Equation (7), the parameter λ determines the lower and upper subject degree of X k relative to some clustering. If the threshold λ is too large, the low approximation set will be empty, while if the threshold λ is too small, the boundary area will be powerless. The threshold λ can be determined by: 1. Compute the Euler distance of every object to K class clustering centers and distance matrix D(i, j) 2. Compute the minimum value d min (i) in every row of matrix D(i, j) 3. Compute distance between every object and other class center d i and d t (i, j)=d(i)-d min (i) 4. Obtain the minimum value d s (i) (except zero) in every row 5. λ is obtained from the minimum value d s (i) In the training process of the rough k-mean classifier, we need calculate the cluster center; rough boundary R ro and uncertain boundary R un in every cluster. After clustering, the center of a cluster and the farthest sample from the center of the cluster are determined. The area between rough boundary and uncertain boundary (R ro <d x < R un ) is defined as rough area, where d x denotes the distance from a sample to the center. In the training, if a training sample is in the rough area, it will be used to train the RVM in the advanced recognition. The uncertain boundary threshold R un is defined by: where max(d x ) is the distance from the farthest sample to the center. The rough radius can be defined by: (11) and the scale factor generally. In this paper, . In a cluster, the area beyond uncertain boundary (d x > R un ) is the uncertain area. When unknown samples are recognized, they will be distributed into the nearest cluster. If d x > R un , these samples will be further recognized by the advanced recognition. For other unknown samples, the result of the primary recognition will be final.
In addition, the accuracy of primary recognition is relevant with the radii of clusters. Rough k-means clustering can lessen the radii of clusters effectively. Comparison of radii of the rough k-means cluster and the k-means cluster is shown in Figure 3.
As shown in Figure 3, the radius of the k-means cluster is the distance from the cluster center to the farthest isolated sample. In the rough k-means, the cluster center is the average of the lower approximation center and the upper approximation center. The upper approximation center is near to the farthest sample, so the cluster radius of rough k-means R r is less than the k-means radius R, obviously. As the radius is shortened, when unknown samples are recognized, the probability that an uncertain sample is recognized as a certain sample is reduced. Therefore, the accuracy of the primary recognition is increased. Figure 3. The radius of a cluster in rough k-means is shorter than that in k-means.

The Advanced Recognition Using RVM
The relevance vector machine (RVM), a sparse Bayesian modeling approach, is proposed by Tipping [21], which enables sparse classification by linearly-weighting a small number of fixed basis functions from a large dictionary of potential candidates. And a significant advantage to support vector machine is that the kernel function of RVM avoids satisfying Mercer's condition [22][23][24].
In classification, the output function y(x) is defined by: where σ(z) = 1/(1+e −z ) and ω denotes the weight matrix.
Suppose ω is to a Gauss conditional probability, with the 0 expectation and variance α i -1 . For two classes classification, the likelihood function is defined by: where denote the target value.
Seeking the maximum posterior probability estimation is equivalent to seeking the mode point of the Gaussian function, namely, μ MP .
the maximum posterior probability estimation according to ω is equivalent to maximize: (15) where y n = σ{y(x n ,ω)}, C denotes a constant. Similarly, the marginal likelihood function can be given by: Suppose , the approximation of the Gaussian posterior distribution, i.e., , with the variance . The logarithm of the approximate marginal likelihood function is given by: (17) where . A fast marginal likelihood maximisation for sparse Bayesian models is proposed in reference [21], which can reduce the learning time of RVM effectively. To simplify forthcoming expressions, it is defined that: It is showed that Equation (16) has a unique maximum with respect to α i : if q i 2 ≤s i The proposed marginal likelihood maximization algorithm is as follows: 1. Initialize with a single basis vector , setting, from Equation (20): .
2. Compute Σ and μ (which are scalars initially), along with initial values of sm and qm for all M bases Ф m .
3. Select a candidate basis vector from the set of all M.
9. If converged, terminate the iteration, otherwise go to 3.
The fast marginal likelihood maximisation for sparse Bayesian models is stated in details in [21,22].

Computational Complexity Analysis
The computational complexity of the approach proposed in this paper consists of two parts, namely the computational complexity of the primary recognition and the computational complexity of the advanced recognition.
In the training of the primary recognition, samples are clustered using rough k-means. The computational complexity of the rough k-means is O(dmt), where d, m and t denote the dimension of samples, the number of training samples and the iterations, respectively. In this paper, the optimal initial centers are determined by analyzing the knowledge rule of the training sample set based on rough set theory, instead of iteration. Thus, the computational complexity of the primary recognition is O(dm).
The RVM is used as the advanced recognition in our approach. The computational complexity of RVM has nothing with the dimension of samples, but is related with the number of samples. The computational complexity of RVM training is discussed with respect to the complexity of the quadratic programming. RVM training has a computational complexity less than O(m' 3 ), where m' denotes the number of training samples for RVM in the advanced recognition [22].
In conclusion, the computational complexity of our hybrid recognition is O(dm) + O(m' 3 ). In general, . Therefore, the computational complexity of the hybrid recognition training is regard as O(m' 3 ). In actual practice, m' is not larger than the training sample number, i.e., m [22]. m' will be lessened with the reduction of m. In the primary recognition, training samples are differentiated and only a part of samples, namely uncertain samples, are used for RVM training. Therefore, the proposed approach can present lower computational cost than RVM.

Results and Discussion
The validity and efficiency of the proposed approach is proved by simulations. In the first simulation, radar emitter signals are recognized. The pulse describing words of the radar emitter signal include a radio frequency (RF), a pulse repetition frequency (PRF), antenna rotation rate (ARR) and a pulse width (PW). The type of radar emitter is the recognition result. Two hundred and seventy groups of data are generated on above original radar information for training. And the recognition accurate is calculated averaged over 200 random generations of the data set.
Another simulation is adopted to test the generalization of the hybrid recognition with the Iris data set. The Iris data set contains 150 patterns belonging to three classes. There are 50 exemples for each class and each input is a four-dimensional real vector [25]. The recognition accuracy and computational complexity are compared with SVM and RVM. This simulation consists of two parts. In the first part, all 150 samples are used in training, while all of 150 samples are used to test the training accuracy. In the second part, 60 random samples are used to train classifiers and other 90 samples are used to test the generalization. Simulations are run on a personal computer, equipped with a Pentium (R) Dual 2.2 GHz processor and 2G RAM.

Results of Experiment 1: Classification of the Radar Emitter Signals
An information sheet of radar emitter signals is built, which is shown as Table 1. Nine known radar emitter signals are applied to test the proposed approach. 9,436 1,600 0. 15 3 Training and test samples are random generations of the data set shown in Table 1. Data in the information table should be changed into discrete values, because continuous values cannot be processed by the rough sets theory. There are many methods for data discretization and here the equivalent width method [20] is applied in this paper. In our paper, attributes are divided into three intervals. The attribute values in the same interval have the same discrete value. In discretization, samples with the same discrete condition attribute values are merged into a discrete sample in Table 2 (one row). A, B, C and d denote the attributes RF, PRF, PW and type, respectively.
After that, the dependent extent of radar type to each attribute is computed using Equation (3). The degrees of attribute importance can be calculated, i.e., σ D (A) = 1/2, σ D (B) = 3/8 and σ D (C) = 0. As the dependent extent of radar type to the attribute C (PW) is 0, the attribute C is unnecessary for classification and removed. After redundancy attributes and repeated samples are removed, the knowledge rules are obtained. Table 3 shows these rules, where -denotes the arbitrary value. Table 3. Classification rules are extracted based on rough sets theory. These rules are the basis of the choice of the initial centers in rough k-means cluster.

No.
A As shown in Table 3, six rules are extracted, which means that 270 samples from three types of radar emitter can be classified into six subclasses. Based on these knowledge rules, initial clustering centers are obtained using Equation (6). The known radar emitter samples are clustered by using the rough k-means on these initial cluster centers. The cluster centers, rough boundary and uncertain boundary of the primary recognition are computed. The information of clusters is shown in Table 4. The rough k-means classifier has been built and rough samples are picked up. RVM in the advanced recognition are trained using these rough samples.
In recognition of unknown samples, some important parameters are computed in the simulation. The accuracy, error and reject rate of the primary recognition are 86%, 2.5%, 11.5%, respectively. The accuracy of advanced recognition is 93.1%. Thus, the estimate of accuracy can be computed as: A total = 86% + 11.5% × 91.3% = 96.5%. The proposed method is compared with the RBF-SVM, the probabilistic SVM radar recognition approach studied by Lin at al. in [10] and RVM studied by Tipping [22]. The training accuracy, training time and recognition accuracy are shown in Table 5. As shown in Table 5, the four approaches achieve high training accuracies. The training accuracy of the approach proposed in this paper achieves 99.5%, which indicates this approach has good fitting capacity to the training samples. The accuracy of the hybrid recognition proposed in this paper is 96.5%, which is higher than existing methods, i.e., 94.0%, 93.5% and 94.0%. The accuracy of the hybrid recognition from simulation experiments accords with the theoretical value, i.e., 96.5%. Moreover, SVM approaches need less train time than RVM. The training time of the proposed hybrid recognition is least in these four approaches, i.e., 2.1 s. The hybrid recognition has a faster training because of lower computational complexity. And the training computational complexities of approaches will be analyzed behind.

Results of Experiment 2: Classification of the Iris Data Set
In the first part, all 150 of the samples are used for training and testing. In this simulation, the training accuracy of the hybrid recognition is tested. In addition, the accuracy of recognition and computational complexity of the hybrid recognition is compared with those of SVM and RVM. The results are as shown in Table 6. From Table 6, we can know the proposed approach has a higher training accuracy than SVM and RVM. In the first part of this experiment, all 150 samples are used to train and test these methods. The hybrid recognition proposed in this paper has a high training accuracy, i.e., 99.33%, which is higher than those of other approaches, i.e., 98.00% and 98.67%. In the second part, 60 random samples from Iris are used to train classifiers and other 90 samples are used for test to test the generalization. The accuracy of recognition and computational complexity of the hybrid recognition is compared with those of SVM and RVM. The results are as shown in Table 7.
The recognition accuracy of the proposed approach is 96.67%, which is higher than those of other approaches. It is indicated that the hybrid recognition has not only a high training accuracy but also a good generalization.
In . From the comparison above, we can know that the computational complexity of the hybrid recognition is obviously lower than those of RVM and SVM.
Theoretically, lower computational complexity leads to less computational time. The actual calculation time for each algorithm is tested and the result is shown in Table 7. The training calculation time of the proposed hybrid recognition is obviously less than SVM and RVM. Compared with SVM, a distinct advantage of RVM is the sparse structure. Although the computational complexity of RVM training is close to the SVM's, the discrimination process of RVM is more succinct and rapid than the SVM's. The proposed hybrid recognition approach inherits this superiority from RVM. The recognition time of the proposed approach is close to RVM and less than SVM.

Conclusions
In this paper, a hybrid recognition method has been proposed to recognize radar emitter signals. The hybrid classifier consists of a rough k-means classifier (linear classifier) and a RVM (nonlinear classifier). Based on the linear separability of the classifying sample, the sample is classified by the suitable classifier. Thus for the radar emitter sample set containing both linearly separable samples and linearly inseparable samples, the approach can achieve a higher accuracy.
A linear classifier based on the rough set and the rough k-means has been proposed, i.e., the rough k-means classifier. The rough k-means clustering can reduce the radius of the clusters and increase the accuracy of the primary recognition. The initial centers for the rough k-means are computed based on the rough set, which can reduce the computational complexity of the rough k-means clustering. The rough k-means classifier can classify linear separable samples efficiently and pick up linearly inseparable samples. These linear inseparable samples are processed by the RVM in the advanced recognition. Therefore, the training samples for the RVM in the advanced recognition are reduced. Simulation results have shown that the proposed approach can achieve a higher accuracy, a lower computational complexity and less computation time, when compared with existing approaches.
The hybrid recognition approach in this paper is suitable for the classification of the radar emitter signal containing both linearly separable and linearly inseparable samples. However, for the situations where only linearly separable or linearly inseparable samples are included, the effectiveness of the hybrid approach will be not significant. We admit that our hybrid recognition approach is based on the fact that these linearly inseparable samples which reduce the accuracy of clustering are mostly at the edges of clusters. From Equation (1), we know that if the linearly inseparable sample appears frequently in the center region instead of the edge, the accuracy of recognition will be reduced. How to solve these problems is the focus of our future work.


Survey of the DASH7 Alliance Protocol for 433MHz Wireless Sensor Communication

433 MHz is getting more attention for Machine-to-Machine communication. This paper presents the DASH7 Alliance Protocol, an active RFID alliance standard for 433 MHz wireless sensor communication based on the ISO/IEC 18000-7. First, the major differences of 433 MHz communication compared to more frequently used frequencies, such as 2.4 GHz and 868/920 MHz are explained. Subsequently, the general concepts of DASH7 Alliance Protocol are described, such as the BLAST networking topology and the different OSI layer implementations, in a top-down method. Basic DASH7 features such as the advertising protocol, ad-hoc synchronization and query based addressing are used to explain the different layers. Finally, the paper introduces a software stack implementation named OSS-7, which is an open source implementation of the DASH7 alliance protocol used for testing, rapid prototyping, and demonstrations.

Introduction
Machine-to-Machine (M2M) communication can be organized using a wide area network (WAN), such as a mobile network, or a personal or local area network (PAN/LAN). Sensor communication is typically done using a PAN with a backbone connection using a wired or wireless WAN [1]. According to Beale and Morioka [1], the most frequently used technologies for wireless PAN are Wi-Fi (IEEE 802.11), Zigbee (which is based on IEEE 802.15.4), Z-Wave, and KNX-RF. The frequencies used by these technologies are 2.4 GHz, 868, and 915 MHz. Fadlullah et al. [2] also identify Bluetooth, Ultra Wide Band (UWB) and 6LoWPAN as prominent technologies suitable for M2M communication.
Besides the aforementioned frequencies, 433 MHz is also gaining relevance in the area of M2M communication, as stated by Tuset-Peiro et al. [3].
Niyato et al. [4] also identify an neighborhood area network (NAN) which typically connects different homes using a so called concentrator to a base station of the WAN. They focus on home energy management. Such application consolidate the search for other low-power RF technologies which have a longer range than typical PAN technologies. This paper will introduce such a technology: the Dash7 Alliance protocol.
The DASH7 Alliance protocol (D7A) [5] is an active RFID alliance standard for 433 MHz wireless sensor communication based on the ISO/IEC 18000-7 standard maintained by the DASH7 Alliance. ISO/IEC 18000-7 defines parameters of the active air interface communication at 433 Mhz. D7A is built on top of an asynchronous Wireless Sensor Network (WSN) Media Access Control (MAC). In contrast to typical WSN standards such as ZigBee (built on top of IEEE 802. 15.4), the DASH7 specification defines a full functional RFID tag. This means it does include high level functionality optimized for RFID applications. However, it can also be extended for non-RFID applications. In contradiction to legacy RFID systems [6], D7A supports tag-to-tag communication.
DASH7 uses a BLAST network technology. BLAST is an acronym for Bursty, Light, Asynchronous, Stealth, Transitive. Bursty means abrupt data transfer unlike streaming content such as video or audio. Light refers to a limited packet size (256 bytes). Multiple consecutive packets are however supported. Asynchronous is one of the key concepts of DASH7. Communication is command-response based without any periodic synchronization. Stealth refers to the fact that DASH7 does not need any periodic address broadcasting, which means nodes can choose to communicate only in trusted environments. Transitive refers to the mobile transitional behavior of devices and/or tags. This paper will first explain the major differences of 433 MHz communication compared to more frequently used frequencies in Section 2. Subsequently, it will describe the general concepts of the D7A specification in Section 3. Finally, it will introduce a software stack implementation OSS-7 in Section 4.

433 MHz Based Sensor Communication
As stated before, 433 MHz is not the most widely used frequency for M2M communication, although it has some serious advantages. First of all, it is an unlicensed band which is almost worldwide applicable; however, it is not harmonized. The band spans from 433.05 to 434.79 MHz. Second, due to its frequency, it has better propagation characteristics opposed to higher frequencies. This is discussed later in this section. However, there are also some disadvantages. The wavelength at the center frequency 433.92 MHz is 69.14 cm. This means an /4 antenna has a length of 17.28 cm. Moreover, the bandwidth of the band is only 1.84 MHz. This limits the data rate of the communication at this frequency. Making 433 MHz ideal for low-power low data rate communication.
Some research has already been done in comparing the propagation aspects of 433 MHz towards other frequencies.
Tuset-Peiro et al. [3] compare the propagation performance of 433 MHz and 2.4 GHz and show that 433 MHz has a better communication range despite the effects of having a larger Fresnel zone. They also show that channel hopping will not solve multipath propagation effects since the channel coherence bandwidth is larger than the whole 433 MHz band.
Isnin [7] compares path propagation in multifloored building for 433, 868 and 1249 MHz. The 868 MHz band has a higher bandwidth then the 433 MHz band which enables a higher data rate. They show that in a waveguided corridor environment with line-of-sight, higher frequencies have an advantage. However, 433 MHz has a better penetration capability. This leads to a lower path loss-level for multi-floor propagation with the number of floor obstruction greater then two. Zhang et al. [8] state that it is very complex to model small scale indoor propagation.
As already stated, the regulations of 433 MHz transmissions are not harmonized.
In Europe, ETSI states for short-range devices (SRD) that the band from 433.05 till 434.790 MHz can be used for nonspecific SRD with 10 mW Effective Radiated Power (ERP) when the duty cycle is less than 10% or when then channel spacing is smaller than 25 kHz or with 1 mW ERP without duty cycle limitations [9].
In USA, FCC states that the field strength can only be 10995 V/m at 3 meter for periodic applications and 4398 V/m at 3 meter otherwise [10,11]. This corresponds with an ERP of −14.4 dBm for periodic control applications and −22.36 dBm otherwise.

DASH7 Alliance Protocol
This section will describe the basic concepts of the DASH7 Alliance protocol (D7A). D7A defines four different device classes as shown in Table 1. A device can switch between classes. A blinker device only transmits data and does not use a receiver. For this, a blinker, for example, cannot perform carrier sensing. A second class is an endpoint. This is a typical low power device which can transmit and receive data. An endpoint also supports wake-up events. This enables the device to receive requests and typically transmit a response. A gateway device is in most cases the device which connects the D7A network to another network. A gateway is obliged to support all D7A features and is never offline. It always listens unless it is transmitting. A subcontroller is a full featured device as well, but it is not always active. It uses wake on scan cycles, just like the endpoint devices. This will activate the device for short channel scanning.
D7A describes a full functional RFID tag. Every device supports one or more of the aforementioned+ device classes. For this a correctly configured tag is fully functional without the need for specific application code. Although, in most cases specific application code will be added.
DASH7 supports two communication models: pull and push. As in most RFID systems, dialogs between tags and interrogators are query response based (the pull model), as shown in Figure 1(a). This request response mechanism is described by the D7A Query Protocol (D7AQP). Data transfer initiated from the tags to the gateway on the other hand is based on the push model. This is shown in Figure 1(b). This approach can, for instance, be implemented as an automated message or beacon which is sent on specific time intervals. In D7A, this system is called Beacon Transmit Series.
DASH7 defines two types of frames: a foreground frame and a background frame. The foreground frames are regular messages which contain data or data requests. Background frames on the other hand are very short broadcast messages. Background frames are for instance used by the D7A Advertising Protocol (D7AAdvP) for rapid ad-hoc group synchronization. This D7AAdvP enables a low power wakeup of those tags which are interrogated in the pull model.
The D7A specification involves all 7 OSI layers [12] and describes the protocol in each of those layers. However, some of the features are still under revision or reserved for future extensions. Figure 2 gives an overview. The remainder of this section describes the D7A implementation of the application layer and how its features are supported by the underlying layers.
The D7A Query Protocol, the Advertising Protocol and the beaconing concept will be used as an example to clarify the different layers.
3.1. D7A Application Layer. The application layer typically describes the interaction between the application software and the communication stack. The application layer enables the software application, which is used by the user, to be able to access communication resources, identify communication partners, and activate certain communication concepts.
In D7A, this layer describes the so called Application Layer Protocol (ALP), the file access protocol, the cryptographic authentication protocol, and access to the sensor subprotocol. The ALP makes it possible to send specific data, structured by the application. This is in contrast to D7A specific data protocols which are described in other layers. The cryptographic authentication description is at the time of writing still under revision, but the underlying layers already support the necessary data fields. The sensor subprotocol is based on ISO 24151-7 [13] and specifies the representation of specific sensor data. The file system protocol describes the access methods (read, write, and execute) to the file system which is described in the presentation layer.  Accessing a file is based on the File Data Access Template, shown in Table 2. The File ID refers to a specific file (see Section 3.2: presentation layer). The other two values define the location in the file to be read from or written to. The data field is the actual data to be written.
A beacon transmit series uses an automated process in the Data Link Layer. This process is enabled, disabled and configured by a configuration file described in the presentation layer.

D7A Presentation Layer.
Every D7A device needs to support a number of data elements. D7A has three types of data elements: Indexed Short File Series Blocks (ISFSB), Indexed Short File Blocks (ISFB), and Generic file Blocks (GFB). All of these blocks have their own permission code. This code defines the read, write an execute rights of the root user, current user and guests. An ISFSB is a collection of ISFB files. ISFB Files are stored as structured, mixed-data strings. ISFB IDs specify different files. For example, 0x00 specifies the network configuration, 0x01 specifies device capabilities and supported features, and 0x06 specifies a time controlled sequence for beaconing,. . .. The beaconing will be further explained in Section 3.6.
The data defined by the presentation layer for beaconing is shown in Table 3. The Channel ID is the physical layer Channel ID, defined in Section 3.7. The Command Parameters are bitfield parameters that map to data link layer and D7AQP parameters. The D7AQP Call Template defines the file or file series template which will be used as data. The Next Beacon is the number of ticks between the beacons. A tick is 2 −10 seconds (0.9765625 ms) and is the basic time unit used by the D7A Protocol.
The network configuration settings (ISFB file with ID 0x00), determines the active device class (gateway, subcontroller, endpoint or blinker). It will also define if the device is capable of using Forward Error Correction (FEC), hi-rate channels, and other features which are used by the data link and physical layer.  power to find an optimum between power consumption and a stable wireless connection. In a standard situation the subcontrollers and endpoints operate after a wake-on event. The wake-on events defined by D7A are automated channel scanning, automated beacon transmit series (both described in the data link layer), and any application layer relevant events (e.g., sensor event or a passive scanning).

D7A Session
The session layer creates a random session number for any new initiated session. This random number is used in the D7AQP as a dialog ID. The session layer also keeps track of a device's network state. The possible states are associated, scheduled, promiscuous, and unassociated.
A host supporting the D7A Advertising protocol in the network layer also has to implement a session stack to enable session scheduling. This session stack keeps track of the different initiated sessions. Ad-hoc sessions have a higher priority than scheduled sessions (such as beaconing) and are always added on the top of the stack.
3.4. D7A Transport Layer. Generally, the transport layer provides end-to-end communication services. In D7A, this is covered by the D7A Query Protocol Transport Layer (D7AQP). It is responsible for communication structuring, flow-and congestion control, and addressing beyond the subnet filtering. In this section, first the communication dialogs of D7AQP will be described. Afterwards the command structuring and finally collision avoidance.

D7AQP Dialogs.
The transport layer supports two types of dialogs: Nonarbitrated Two-Party Dialog (NA2P) and Arbitrated Two-Party Dialog (A2P). The NA2P is a one-time dialog between a requester and a responder or responders. The requester is a single host which sends a single request. The responders can be any host addressed in the request. Besides the query itself, the requester sends an addressing method, a list of channel IDs which can be used for the responses and two time parameters ( , ). The Response Completion Timeout , defines within which time frame the responders must complete their responses. The Response Guard Time is a parameter used by the Carrier Sensing Multiple Access (CSMA) process of the data link layer, as explained in Section 3.6. An example of such a dialog is shown in Figure 3.
In contrast to a NA2P dialog, the A2P dialog is a persistent dialog between requester and responders. A2P enables the global and local addressing, which is an important feature of D7A. An example is shown in Figure 4. The first request includes global and local addressing. The global addressing notifies a large group of potential responders to stay alert for a query. The local addressing queries a subgroup of these potential responders. All responders have to respond within , after the next query with local addressing will be sent. When no new request is sent after the dialog terminates. This method enables a D7A interrogator to query a large group of tags in a well-structured way. As discussed, in the upper layers an interrogator can send a query with a file read or write command. This method is also used to send an acknowledgment group query. For this, the response of all responders can be acknowledged using one method instead of sending individual acknowledgments.

Command Structuring.
The transport layer also defines the structure of the command-response protocol (the command structure). The command structure is based on templates. It contains the addressing method, the command code and command extension.
In a request, the addressing method can be broadcast, unicast, multicast or anycast. In case of broadcast and unicast, the command contains a command extension and command data. In case of anycast, the command also includes a global query. A global query is a query using global addressing, as described in the previous subsection. In case of multicast, the command contains a global query and local query or a local query with an acknowledgment template. A response is always unicast and can contain command data or an error.
The command code contains a command type. It defines if the command is a response, an error response, a Nonarbitrated Two-Party Dialog, or an Arbitrated Two-Party Dialog. In the latter case, it defines whether it is an initial request, a intermediate request or a final request. These dialogs are explained in the previous subsection.
The command code also contains an opcode. It specifies if the command wants to announce a file or do an inventory or collection. An inventory means it will request a list of files. A collection means it will request the content of some file. The command can also define a so called application shell which means it encapsulates an application's specific data.
And finally, the command extension defines if CSMA is used for responses and which type of collision avoidance is used. This is explained in the next subsection.

Collision Avoidance.
A third important component of the transport layer is collision avoidance (CA). In case a message is sent from the transport or higher layer, the transport layer is responsible for collision avoidance and flow control. The data link layer is responsible for the CSMA process as is explained in Section 3.6. The CSMA-CA process uses the value from a response or from upper layers and calculates the Collision Avoidance Timeout Period CA :  AIND and RAIND use a fixed slot length which is approximate the duration of the transmission. In AIND, the CSMA process starts in the beginning of a slot. In RAIND, the CSMA process only starts after a random delay which is smaller than CA . In RGID the slot duration decreases following CA0 /2 +1 and CSMA only starts, as in RAIND, after a random delay.

D7A Network Layer.
The network layer defines the Background Network Protocol which is used for the D7A Advertising Protocol (D7AAdvP) and the Foreground Network Protocol which is used for queries, responses and beacons.

Background Network Protocols.
Background network protocols contain very short background frames (BF). Background frames are described in Section 3.6. Currently, only the D7A Advertising Protocol is defined as a background network protocol. D7AAdvP is used exclusively for rapid, ad-hoc group synchronization. It is a transmission only, broadcast protocol. D7AAdvP is used to notify hosts about a request which will be send in the future. The requester floods the channel with background frames which contains a time span until when the request will be sent. The responder hosts receive the background frame while listening for a background frame during background scanning (as described in Section 3.6), and can go to a sleep state until the request is planned to be received. The responder only has to receive one background frame to know this timing. This leads to a very low power consumption optimized method of adhoc synchronization. Figure 5 shows an example of such a synchronization train.

Foreground Network Protocols.
Two foreground network protocols are defined by D7A: the D7A Network Protocol (D7ANP) and the D7A Datastream Protocol (D7ADP). The D7ANP is an addressable, routable protocol which is used for the D7A Query Protocol in the transport layer. The  D7ADP is a generic data encapsulation protocol, which contains no routing or addressing information. It allows for maximum flexibility towards the upper layers. The D7ADP is, for example, used by the Application Layer Protocol. The D7ANP supports network layer security and standard two hop routing. It implements unicast, broadcast, multicast and anycast addressing to support the D7AQP Dialogs.
3.6. D7A Data Link Layer. The data link layer (DLL) of D7A, specifies the data link filtering, addressing, the dialog models, MAC processing, frame construction and the field definitions.
3.6.1. Data Link Filtering. Incoming frames are filtered by three processes. The first one is a Cyclic Redundancy Check (CRC) validation with a 16 bit CRC16 field. The calculation uses the CCITT CRC16 polynomial. If the CRC16 validations passes, subnet matching or link quality assessment can be performed in an arbitrary order. The subnet is constructed with a 4 bit specifier and a 4 bit mask. If link quality assessments is enabled, the link budget should be higher than a predefined link quality threshold. This makes further frame processing possible.

Data Link
Addressing. Related to addressing, the data link layer of the D7A protocol specifies an ISO 15963 [14] compliant Device ID manifesting in a fixed Unique ID (UID) and a dynamic network-unique Virtual ID (VID).
The UID is a EUI-64 (Extended Unique Identifier) compliant ID [15]. It contains a 24 or 36 bits Organizationally Unique Identifier (OUI) assigned by the IEEE Registration Authority based on a 40 or 28 bits serial number. The VID is a 16 bit ID which is supplied by the network administrator and should be unique within the network.
The data link layer only supports unicasting and broadcasting. If a target Device ID is present in the frame, it will be processed as a unicast message. The Device ID of the frame will be matched with the destination devices ID. The frame will only be processed by the upper layers when a match exists.
3.6.3. Frame Structure. As already mentioned in the network layer, the data link layer has background frames and foreground frames. A background frame is a fixed length 6 byte frame, proceeded by a sync word of class 0 (defined in Section 3.7). The structure of a background frame is shown in Table 4. A foreground frame has a variable length, up to 255 bytes, proceeded by a sync word of class 1. The structure is shown in Table 5. The length byte is the total number of bytes, including the length byte and the 2 byte CRC.
The headers contain information related to optional data link layer security, address control (source and optional destination id), the subnet, and the estimated radiated power of the transmission (TX EIRP). This value can be used by the receiving node to estimate the link budget.

Data Link Dialog Models.
Following the same concept of foreground and background frames, two related dialog models are defined.
A Background Dialog (not really a dialog) starts when a background frame starts transmitting and ends as soon as it finishes transmitting.
A Foreground Dialog is a dialog between devices and is used to support the D7A Foreground Network Protocols. An overview is shown in Figure 6. The response contention period defines the time frame in which responses can transmit. The listen period defines the time period after in which the requester can send another request.
3.6.5. MAC Processing. The data link layer supports an automated scanning method. Using this scan scheduler the data link layer can scan for background or foreground frames.
In a background scan, the D7A device first checks the energy level. Only if the level is sufficient does it try to detect the correct sync word (class 0 for background scanning). In foreground scanning the device first searches for a sync word of class 1.
Using the automated Channel Scan Series, the data link layer can follow a predefined sequence of background or foreground scans. The series is defined by a list of channel IDs (explained in Section 3.7), scan types (background or foreground), a "Scan Detection Timeout" SD , and a "Time until next scan event" NSE . The SD is the duration the scan on a specified channel ID and type will be executed. The NSE is the time when the next scan event in the list will be executed.
The Beacon Transmit Series is another automated data link layer process. This process sends predefined beacons at specified time intervals and channel IDs.
The data link layer is also responsible for MAC channel guarding. A Nonguarded Channel (NGC) is a channel which does not require CSMA. A Guarded Channel (GC), however is a channel which does require CSMA. CSMA is also implemented by the data link layer. In this case CSMA-CA   Table 6. The spectrum ID specifies which channels and channel classes are used. The Channel ID is the Spectrum ID which is logically OR' ed with the encoding option. The value is 0x80 in the case Forward Error Correction (FEC) is used, otherwise the value is 0x00. The base and normal class have a bit rate of 55.555 kbs. The hi-rate and blink class have a bit rate of 200 kbs. The normal class has a channel bandwidth of 216 kHz. The hi-rate and base class have a channel bandwidth of 432 kHz. The blink class has a channel bandwidth of 648 kHz. Gaussian frequency shift keying is used as modulation technique.

Symbol
Encoding. As a last stage before transmission, a data whitening [16] technique based on a 9-bit psuedorandom generator (PN9 encoding [17]) is used to avoid a DC offset in the transmitted data. For this, a PN9 decoding stage will be the first decoding step at the receiver.
Before the data whitening step, an optional forward error correction (FEC) can be executed [18]. For FEC, D7 uses convolution encoding with constraint length 4, followed by a 32 bit interleaving executed on 2 bit symbols. The interleave/deinterleave process lowers the impact of bursty errors since it separates adjacent symbols.

Packet Structure.
On the physical layer, the frame structure of the data link layer is preceded by a preamble and a sync word. A preamble of typically 32 bits on the base and normal channels and 48 bits on the hi-rate and blink channels of alternating 0 and 1's is used to enable the receiver to calibrate the data rate circuit. The preamble is followed by a sync word. The sync word can be of class 0 or class 1 and depends on the use of FEC. After the sync word, comes the packet payload, which is defined by the upper layers. In all cases D7A uses the big endian format (most significant byte first).

OSS-7
OSS-7 [19] is an ongoing software stack implementation of the DASH7 Alliance Protocol mainly developed by the CoSys-Lab of the University of Antwerp. OSS-7 is being developed with its main goal to provide a reference implementation of the D7A specification. This means that code clarity and structure is more important than performance. OSS-7 is implemented in ANSI C to be as compatible as possible with Texas Instruments (TI) Code Composer Studio (CCS), gcc and mspgcc.
The OSI layers, as shown in Figure 2, are used as structure for the implementation. All the layers are implemented as pluggable layers, which makes it easier to benchmark other implementations of a specific layer (e.g., a new proposal for a MAC implementation).
Besides the OSI layers, there are two additional layers: Hardware Abstraction Layer (HAL) and the "Framework" layer. Both layers implement an API which can be called from any other layer. The HAL makes an abstraction of hardware aspects such as I/O, buttons, LEDs, CRC software or hardware implementations, UART, timers, and the Real Time Clock (RTC). Currently a HAL implementation is provided for TI MSP430, TI Stellaris (ARM Cortex-M4) and posix hardware. Support for ARM Cortex-M3 is planned for the near future. The framework API provides hardware independent functionality like logging and queueing which is used within the stack but can also be used by the application.
The PHY layer consists mostly of an abstract interface. This Radio Abstraction Layer (RAL) is required to be implemented by radio chip specific code. This plugin system effectively allows us to support multiple radio chips. One can switch between them at compile time. Currently TI's CC430 (which is system-on-chip composed of a TI MSP430 and an TI CC1101 sub 1 Ghz transceiver) and an external CC1101 (with communication through SPI) are supported. Support for STMicroelectronics SPIRIT1 RF chip will be implemented in the near future. Figure 7 gives an overview of the file structure of OSS-7. The different OSI layers are visible. RAL and HAL can be extended to different hardware.
Besides the software stack itself, the OSS-7 project will also provide additional PC-based tooling for diagnostics, testing, and configuring tags running the stack. Figure 8 shows the devices which are used to implement and test OSS-7. Device (1) is a CoSys-Lab designed 3 × 3 cm CC430 based tag with PCB antenna. This device is typically used as an endpoint or blinker powered with a CR2032 battery for indoor sensor communication. Device (2) show a small extension board which is used to interface with the JTAG programmer and a serial connection. Device (3) is a WizziMote and WizziBoard from WizziLab powered by 2 AA batteries. Device (4) is the Texas Instrument EZ430-Chronos-433 which typically acts as endpoint or blinker. Device (5) consists of the nodes which are used in device (1) and device (3) but altered to be used as a subcontroller. Device (6)   (1)

Implementation.
(3) (5) (6) board and device (1) is altered to be used with an external antenna. This device is used as a gateway in our test settings.
As an example, devices (1) and (5) are used by Stevens et al. [20] to test robot localization using DASH7.

Summary
This paper gave an high-level overview of the DASH7 Alliance Specification and introduced OSS-7, a stack implementation for this specification. D7A is built for low-power sensor communication with integrated concepts such as global and local querying, automated beacon transmits series and automated channel scanning. D7A describes a full functional RFID device. OSS-7 is embedded stack implementation for D7A which currently supports CC430, CC1011, and ARM Cortex-M4. It is build using a modular structure following the D7A's ISO layering and a separate hardware and radio abstraction layer. OSS-7 focuses on transparency and code clarity to be used as a tool to explain the specifications and test new protocol adaptations.


Cyber Security: Rule of Use Internet Safely

Cyber security plays on important role to guarantee and protect people who use internet in their daily life. Some cases take place around the world that people get inconvenience condition when they access and use internet. Misuse of internet becomes a current issue which some cases take place including a university. Advantages of using internet in the university of course assist the student to get some information in internet. However, they have to be protected in order to feel convenience when use internet. This also is because get and access some information is right of people as governed by International Covenant on Civil and Political Rights.

Introduction
Internet is becoming an important thing in people daily life and has grown at an explosive rate (Pratap Singh and Bagdi, 2010). According to International Telecommunication Union (ITU) (2013), internet users (population) around the world are over 2.7 billion, which corresponds to almost 40% of the world's population. In the developing countries, people who use internet is around 31% of the population, compared with 77% in the developed countries (ITU, 2013). Basically, internet was used to military, defense contractors, and a university research purpose. However, in recent years, it has been developed to multi-purposes including information, communication, leisure, shopping, education, e-social activities, financial, job seek, homepage, file share service, and download (Kisa, 2011). Those internet usage purposes bring both advantages and disadvantages for people and their community. In terms of disadvantages of internet use such as illegal contents, online fraud, identity theft, espionage, sabotage, cyber terrorism, and cyberstalking (Boateng, 2011), (Department of Economic and Social affairs, 2012), (Greitzer and Frincke, 2010), (M. Arif Mansur and Gultom, 2005), (Suhariyanto, 2012), cyber security is therefore needed to guarantee people who use internet to be safe. Theoretically, cyber security has to fulfill 3 (three) critical points: measure to protect information technology; the degree of protection resulting from application of those measures; and the associated field of professional endeavor (Fisher, 2009). The three critical aspects of cyber security play an important role to protect a personal data of every person, government, and businesses. Those data are pivotal because they can be misused or manipulated by other person for criminal purposes. Internet misuse and manipulation are mostly committed by young and adult people especially people who in level senior high school and university students. In South Sulawesi for example, some Hasanuddin University students in 2011 committed financial fraud (Indonesia Hackers, 2011). The crime usually intended to the personal information stored on personal data forms in computer, such as credit card number and ATM PIN numbers. They were then arrested by the police and should face suing for their committed crime.

Cyber Security: Rule of Use Internet
Internet user is growing dramatically in variety generation and the purpose of using internet then is done in various ways as explained above. The number of internet users in Indonesia for example is increasing every year. According to Internet World Stats (2010), commercial internet services commenced in Indonesia in 1995 and coming into 2008, Indonesia had an estimated 25 million Internet users. It is predicted that in the beginning of 2013, the number of internet user in Indonesia is becoming bigger than in 2008. Guharoy and Morgan (the Jakarta Post, 2012) furthermore states that internet users in Indonesia is climbing dramatically in the last two years, "20 percent of Indonesians 14 years of age and older now access the Internet every month. That's over 30 million people, and growing steadily each month. But we need to remember two important facts that characterize the usage. First, roughly 10 of the 30 million users access the Internet via their mobile phones. Second, roughly 70 percent of those 30 million users visit Facebook and twitter each month, making it the most popular address in the country". This fact actually is not surprising because computer and its function including internet as introduction have been introduced since the young people in elementary school. It means that the Indonesian young people especially university students have skill to access internet but they are also potentially to misuse or to be misused by the internet. Presence of internet for students in university actually helps them to get a lot of information related to their tasks. The information is provided in forms of book online and journals. Both books and journals give an easy task for the students to finish their tasks particular when they conduct their final paper to be graduated. However, a lot of cases of misuse the internet function also conducted by university students. Plagiarism is one of the most internet misuse conducted by the students. They tend to copy some materials to their tasks but they do not mention the author's name. Other internet misuse can be found such as illegal contents, online fraud, and identity theft. According to National Research Council (2003), there are 3 (three) classes of attack that addressed to internet, as following: 1. Service disruption; it causes a loss of service and can result from disabling of networks through a variety of attacks such as denial of service (DoS) and destruction of information. 2. Theft of assets; it misuses critical information on a large enough scale to have major impact. 3. Capture and control; it involves taking control of cyberspace and using them as a weapon. Those classes of attacks are then classified as cybercrime and also have been modified in various modus. Those modus in fact threaten all human beings activities including infrastructure. To handle and to prevent those crimes, cyber security plays important role to guarantee people to use internet safely. As we known, cyberspace compiles a huge range of related elements of cyberspace activities and it is therefore cyberspace activities are potentially at risk. To eliminate or dismiss the risk, protection of cyberspace infrastructure is needed in order to stop hackers to commit their crimes. The protection of the infrastructure must cover internet hardware, telecommunications infrastructure, computing devices as control system and computing devices as desktop computer (Fisher, 2019). Andress (2011) furthermore stipulates that to eliminate the risk is not only protection to the infrastructure (hardware) but also must protect the software. Protection of software is intended to help everybody to use computer/internet safely. It is because so many computers are used in homes and businesses. The computer operating systems and email programs are two aspects of computer/internet that is vulnerable to be attacked and exploited. Case of computer worms that attacked Microsoft Windows operating system in 2003 was a proof to see that the protection of software is needed to protect the internet user (Scheiner); or other sample of a worm (spionage) took place in 2010, when a worm called stuxnet was launched to attack the Iranian nuclear program (Farewell and Rohozinski, 2010). Both protection of hardware and software are the main point of cyber security. They are able to guarantee people to use internet safely. People will use internet to support their activities without any worry to negative impacts of internet. However, both protections must be implemented and embedded in national and international strategy (regulation) to reach its goals. In United States, for example, it can be found National Strategy for Homeland Security. The purposes of this strategy are to prevent cyber attacks against critical infrastructure; to reduce national vulnerabilities to cyber attack; and, to minimize the damage and recovery time from cyber attacks that do occur (Anonymous, 2003); or another example in Canada, its national strategy is placed on three pillars: securing government systems; partnering with the private sector; and helping Canadians to be secure online through awareness raising (Deibert, 2012). In terms of Association of Southeast Asian Nations (ASEAN) in which Indonesia one of its members, its regional strategy is put in the area of economic and security cooperative comprised of 10 member nations from Southeast Asia. According to its Roadmap for an ASEAN Community 2009-2015, it has effort to combat transnational cybercrime by fostering cooperation among member-nations' law enforcement agencies and promoting the adoption of cybercrime legislation. In addition, the road map calls for activities to develop information infrastructure and expand computer emergency response teams (CERT) and associated drills to all ASEAN partners (United States Government Accountability Office, 2010). To develop information infrastructure as one of the ASEAN' roadmap, Indonesia continues to complete Indonesian Law Number 11/2008 Concerning Information and Electronic Transaction. One of its efforts is enacting some Government Decree such as the Government Decree No. 82/2012 Concerning Maintenance System and Electronic Transactions. Those regulation strategies as implemented in domestic law each country essentially show huge effort of them to create convenience and comfortable environment to internet user to feel safely. Those regulations also must be completed every time to respond some changes related to using internet. So, cyber security goals can be reached and are able to eliminate and dismiss negative side of internet usage as discussed above.

Cyber Security and Access to Get Information/Freedom of Expression
Access to get information or freedom of expression basically is one of role of cyber security. As mentioned by Fisher (2009) that cyber security focuses on protection hardware and software, including the information they may contain and communicate. Indeed, information in this term plays important role for people to express those information for some purposes. However, it becomes a critical point when the idea of cyber security (information) has to be correlated with right people to get information or right people to express the idea.. 1. Everyone shall have the right to hold opinions without interference. 2. Everyone shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of his choice.
3. The exercise of the rights provided for in paragraph 2 of this article carries with it special duties and responsibilities. It may therefore be subject to certain restrictions, but these shall only be such as are provided by law and are necessary: (a) For respect of the rights or reputations of others; (b) For the protection of national security or of public order (order public), or of public health or morals. The article 19 ICCPR actually is accordance with the idea of cyber security. There is no disagreement between both of them. People are able to express their idea into internet. They are allowed to post, seek, receive and impart information and ideas of all kinds, as long as the law does not prohibit. Related to right to access information and right freedom of expression, an internet is one of media for people to access information and expresses the people's idea. People today live in the era which they are bombarded with internet news and events either in positive or negative sides (Andress, 2011). In positive sides, internet news and events cannot create debate, but in negative side, it will be debatable. The debate of it is resulted from the reason of right people to access information and right freedom of expression and the security perspective. Question arises from this view is: could people have their right to access and express their idea without consider to other people right to secure? As a right, they are right people to get it as governed by ICCPR. However, they are also not allowed to use it by against the law. As we know, the use of internet is growing fast in a decade and possibility to misuse it is open. Therefore, as computer or internet users, they need to watch out the latest phishing attack trying to steal the identity information, new zero day attack against smart phones, Facebook privacy compromised, someone took down Twitter, and something very scary -called cyber war (Andress, 2011). Those of internet misuse are a fact that people are able to post some information to the internet that is harm for other people rights. It also can threaten other people interest and national interest. So that is way, article 19 ICCPR point 3 stipulate the exceptional condition for those people rights. They can have their right fully but in some condition those rights are limited for respect of the rights or reputations of others and for the protection of national security or of public order (order public), or of public health or morals. In the area of this restriction, cyber security can be applied to keep and maintenance not only other people rights but also national security. Therefore, as a forum for free expression, the internet contents and information shall be governed carefully including to be to censorship and discrimination at a variety of chokepoints (Nunciato, 2009).

Conclusion
Internet has become a global phenomenon; numerous advantages and disadvantages (crimes) are being gotten and committed through the internet. To cope with both advantages and disadvantages, cyber security is needed to guarantee people to use internet safely, particular to young people including university students. Cyber security covers hardware and software infrastructure that is supported by national and international strategy and regulations. Terms of cyber security is also accordance with the right people to access information and freedom to express as mentioned in article 19 ICCPR. The article has shown the rights people to access and express their idea with some restriction such as respect of the rights or reputations of others and the protection of national security or of public order (order public), or of public health or morals .