Technical field

The present invention lies in the field of distributed systems. In particular, it concerns trusted distributed systems involving autonomous network nodes, which take autonomous decisions based on locally available input, to contribute to the achievement of a global goal and to justify the sufficient level of trust in the context with required features.

Background of the invention

Distributed computing systems, which rely on a set of individual and often at least partially autonomous network nodes, become a powerful tool for solving complex technical problems. For example, in vehicular networks, autonomously driving automotive vehicles may each individually solve specific problems such as maintaining a vehicle’s speed as a function of detected traffic or meteorological conditions, can provide accurate signalling to other traffic users, and so on. The overall problem of generating traffic that is both compliant with traffic regulations, and which keeps users of the autonomous vehicles safe, crucially depends on the ability of each individual network to take accurate decisions on a local level. This ability in turn depends on the technical features available to the automotive vehicle: if a camera is not working properly, detection of obstacles cannot be trusted; if the available network bandwidth for communicating with peer automotive vehicles is lacking, the availability of accurate data cannot be trusted, and so on.

Similar problems arise in other technical areas where distributed autonomous network nodes collaboratively tackle an overall technical problem. In distributed remote sensing, the technical features of each individual sensor node largely impact the trust that one may have in the ability of the overall system to produce accurate measurements.

In health care, autonomous sensors may for example monitor various vital parameters of a single patient, or of a patient population. The overall condition of the patient is only accurately available to a user if one can trust the ability of each individual autonomous sensor to perform its individual task accurately.

While not being limited to these examples, a common problem emerges in these distributed problemsolving approaches: how can a “smart” or “intelligent” distributed network of nodes, which collaborate to achieve a common global goal, be trusted and be relied on? With the growth of the distributed network, the growth of technical features potentially available at each node and the use of artificial intelligence techniques such as machine learning techniques, which rely on locally sensed input data, the importance of this problem is increased even further.

Technical problem to be solved It is an objective to present method and device, which overcome at least some of the disadvantages of the prior art.

Summary of the invention

In accordance with a first aspect of the invention, a method for improving the accomplishment of a common goal by a plurality of distributed autonomous network nodes in a data communication network is provided. Each autonomous network node completes at least one task using data sensed from its environment by associated sensing means, wherein said at least one task contributes to achieving said common goal.

The method comprises the steps of: i) collecting status data from a plurality of autonomous network nodes using at least one monitoring network node, wherein the status data comprises data which is indicative of the status of the sensing means associated with said autonomous network nodes; ii) based on the collected status data, determining at least one value for each of said autonomous network nodes using computing means of said at least one monitoring network node, wherein said at least one value is indicative of the current overall ability of an autonomous network node to complete its respective at least one task; iii) concluding, at the at least one monitoring network node, to the inability of an autonomous network node to complete its at least one task, if said at least one indicative does not satisfy a predetermined condition, and alerting at least the corresponding autonomous network node of the conclusion.

The predetermined condition may be that the value falls is greater than a predetermined threshold value, so that said inability is determined if the value falls below said predetermined threshold value

The value may preferably be an overall indicator value, wherein said overall indicator value reflects the current overall ability of an autonomous network node to complete its respective at least one task

Preferably initial values that are indicative of the ability of an autonomous network node to complete its respective at least one task are stored in a memory element. The determined values at step ii) are preferably used to update these initial values. Preferably, the updating comprises an averaging function that depends on the initial values.

Preferably the method may be performed iteratively.

The conclusion reached at step iii) may preferably comprise transmitting advisory data to the corresponding autonomous network node. The advisory data may preferably comprise an advice to used different sensing means, to use different input data, to gather data from another autonomous network node. The advisory data may comprise input data for use at the corresponding autonomous network node. The sensing means may preferably comprise an image sensor, a motion sensor, radio transmission means, an acceleration sensor, a gyroscope or other sensing means. The status data transmitted by the autonomous network node may preferably include at least part of the data used at autonomous network node to complete its task.

The monitoring network nodes may collaborate or cooperate among themselves.

A monitoring network node may be physically collocated on the same device as an autonomous network node. Alternatively, a monitoring node may be a distinct device. Preferably, the monitoring nodes form a monitoring layer.

Preferably, the overall ability of an autonomous network node to complete its respective at least one task may comprise a set of specific abilities, wherein a plurality of specific indicator values are determined for each of said autonomous network nodes based on the collected status data, each specific indicator value reflecting one specific ability, and wherein the overall indicator value comprises a combination of said plurality of specific indicator values.

The status data may further comprise input data used at an autonomous network node to complete the at least one task, or data indicative of any of the networking capabilities, processing power capabilities, energy efficiency and security protocols available at an autonomous network node.

Preferably, said specific abilities of an autonomous network node may comprise any of the abilities to compute accurate local decisions that contribute to the distributed accomplishment of the common goal, to provide network capacity, processing power, network scalability and communication security.

The status data may further preferably comprise data predicted from previously obtained status data using a machine learning model.

Said overall indicator value may preferably be determined based on at least one predetermined overall indicator value or at least one overall indicator value that has been determined during a previous iteration of the method in accordance with an aspect of the invention.

Preferably, any specific indicator value may preferably be determined based on at least one corresponding predetermined specific indicator value or at least one corresponding specific indicator value that has been determined during a previous iteration of the method in accordance with an aspect of the invention.

Said at least one overall indicator value or any specific indicator value may preferably be determined using a machine learning model. Preferably, alerting the corresponding autonomous network node may comprise the transmission, from a monitoring network node to an autonomous network node, of data comprising any of input data for said autonomous network node, user guidance data, instructions for using different sensing means, instructions for using different input data or for obtaining input data from another autonomous network node. The data transmitted during said alerting step is select so as to improve the ability of the corresponding autonomous network node to complete its at least one task.

Preferably, data comprised in said alert transmitted to a first autonomous network node depends also on the ability of at least one second autonomous network node to complete its respective task. Preferably, said at least one second autonomous network node may be proximity of said first autonomous network node. The second autonomous network node may preferably be located within a predetermined distance of said first autonomous network node. The tasks of the first and the second autonomous network node may preferably require similar overall or specific abilities.

The sensing means may preferably comprise an image sensor, an audio signal sensor, an object detector, an image or audio analyser, or any combination of the above.

The at least one monitoring network node may preferably conclude to the inability of an autonomous network node to complete its at least one task, if the corresponding overall indicator value falls outside of a predetermined range of values.

The method may preferably comprise an additional step of changing, at the autonomous network node receiving said alert, the use of sensing means in accordance with instructions received from the monitoring network node in said alert, so as to improve on the overall ability to complete the at least one task.

Preferably, the autonomous network nodes may comprise autonomous or semi-autonomous automotive vehicles. The common goal may preferably comprise generating traffic that is compliant with applicable traffic regulations, and the at least one task of each autonomous network node may preferably comprise taking local decisions based on data sensed by the sensing means in order to contribute to the distributed accomplishment of said common goal.

In accordance with another aspect of the invention, a monitoring network node for use in a communication network comprising distributed autonomous network nodes is provided. Each autonomous network node is configured to complete at least one task using data sensed from its environment by associated sensing means. The completion of the at least one task contributes to accomplish said common goal. The monitoring network node comprises a memory element, data transmission and reception means and a data processor. The data processor is configured to carry out the method in accordance with an aspect of the invention. In accordance with yet another aspect of the invention, an autonomous network node for use in a communication network is provided. The autonomous network node comprises a memory element, data transmission and reception means, sensing means and a data processor. The data processor is configured to: complete at least one task using data sensed from its environment by the sensing means, wherein said at least one task contributes to the distributed achievement of a common goal together with other autonomous network nodes; transmit status data to a monitoring network node, to receive alerts from a monitoring network node, and to reconfigure the completion of said at least one task if required by the received alert.

In accordance with a further aspect of the invention, a data communication network is provided. The data communication network comprises at least one monitoring network node according to an aspect of the invention and a plurality of autonomous network nodes in accordance with an aspect of the invention.

In accordance with a different aspect of the invention, a computer program is provided. The computer program comprises computer readable code means, which, when run on a computer system, causes the computer system to carry out the method according to aspects of the invention.

In accordance with a final aspect of the invention, a computer program product comprising a computer readable medium is provided, on which the computer program according to an aspect of the invention is stored.

By using the present invention, it becomes possible to provide “smart” or “intelligent” distributed networks of nodes, which collaborate to achieve a common global goal, and which can be tmsted and be relied on. The method in accordance with the invention monitors the status of autonomous network node, preferably at various levels of granularity from an overall status to the status of distinct technical features of the autonomous network node. If the technical features work reliably and all required resources are available at the autonomous network node, the results achieved locally by that autonomous network node while executing a task - possible using machine learning models - can be sufficiently tmsted. If all nodes in a distributed network can be trusted, then the network of autonomous network nodes can be trusted. Therefore, the framework proposed in accordance with the invention may be dubbed “Trusted Distributed Artificial Intelligence”. Available resources are optimised by providing feedback if deficiencies are detected. For example, if a given technical feature at a given autonomous network node is detected to be not trustworthy due to a local deficiency of a sensor that provides input data, corresponding sensor data from a nearby trusted node may be provided to the autonomous network node to make up for the deficiency and to restore the trust in the node. A new interaction layer, provided by monitoring nodes in the network, is able to improve the overall performance of an existing distributed architecture of autonomous network node collaborating towards the accomplishment of a common goal or task.

Several embodiments of the present invention are illustrated by way of figures, which do not limit the scope of the invention, wherein: figure 1 provides a workflow showing the main steps of the method in accordance with a preferred embodiment of the invention; figure 2 provides a schematic illustration of a data communication network in accordance with a preferred embodiment of the invention; figure 3 provides an illustration detail explaining relationships between a goal, tasks, the overall ability of an autonomous network node and specific abilities of an autonomous network node to complete a task in accordance with an embodiment of the invention. figure 4 provide a schematic illustration of a data communication network in accordance with a preferred embodiment of the invention; figure 5 provides a schematic illustration of a trusted neuron in accordance with a preferred embodiment of the invention; figure 6 provides a schematic illustration of a single neuron network with error correction calculation in accordance with a preferred embodiment of the invention; figure 7 provide a schematic illustration of Trusted Agent Environment Interaction Flow in accordance with a preferred embodiment of the invention.

Detailed description of the invention

This section describes aspects of the invention in further detail based on preferred embodiments and on the figures. The figures do not limit the scope of the invention. Throughout the description, like numerals will be used to describe like concepts in different embodiments. For example, reference numerals 110 and 210 each denote an autonomous network node in accordance with the invention, but in two different embodiments thereof. Details that are described in the context of a particular embodiment are applicable to other embodiments, unless otherwise stated.

Throughout the description, the word “node” is used in the context of a communication system to describe a logical entity implementing a specific function in a distributed network. A node may be run on any computing device that is equipped with a wired or wireless networking interface. Examples of a device running a node include but are not limited to a Personal Computer, PC, a laptop computer, a smartphone, a tablet computer, and the like. A node runs an operating system and has access to an information storage system, such as a file system or a structured database. A node may further comprise at least one data processor operatively connected to a memory element, such as a Random-Access Memory, RAM, element, a hard disk drive and/or a Solid-State Drive, SSD, and to a structured data repository. Nodes are interconnected via wired or wireless data communication channels, often using multiple intermediary routing nodes. Different nodes, for example an autonomous network node and monitoring network node may be implemented and run on the same physical infrastructure, such as on the same computer, sharing the same or partly the same hardware resources.

Figure 1 illustrates the main steps i) to iii) of a method in accordance with a preferred embodiment of the invention as provided by claim 1. The various steps will be explained with reference to figure 2, showing an embodiment of a data communication network 101 in which a preferred embodiment of the method in accordance with the invention is run.

A plurality of distributed autonomous network nodes 110, 110’, 110” of which only four are illustrated for the sake of clarity, each individually perform tasks 113, 113’, 113” toward the accomplishment of a common goal 120. A task is completed using data sensed from the environment 100 in which the autonomous network nodes are distributed or evolve. The data is obtained by each node using sensing respective sensing means 114, 114’, 114”. Each task may be the same within the view of the environment sensed by each individual autonomous network node, or task may be different, without departing from the scope of the present invention.

By way of a non-limiting example, the environment 100 may be the road infrastructure of a city, while the autonomous network nodes 110, 110’, 110” may each correspond to a complex device such as central computing unit of an autonomous automotive vehicle. The common goal 120 may be the generation of regulation and safety compliant traffic using autonomous automotive vehicles on the city’s road infrastructure. Each autonomous network node senses a part of the environment through local sensing means 114, 114’, 114” and using a history of previously obtained data: on-board cameras, gyroscopes, internal sensors monitoring a user’s behaviour, proximity sensors, object detection means, radio signal reception means and so on. Based on the input data and possibly using a trained machine learning model, each autonomous network node solves a local task 114, 114’, 114”: it computes how to operate the vehicle given the sensed input data.

Each autonomous network node transmits, preferably periodically, status data 115, 115’, 115” which indicates the status of the available sensing means 114, 114’, 114” to a monitoring node 130, which may be part of a collection of monitoring nodes collaborating to implement the same function. The status data may for example comprise input data sensed by the autonomous network node and based on which it took a previous local decision. The status data may further comprise an indication of the current availability of networking capabilities, processing power capabilities, energy or security protocols available at the corresponding autonomous network node.

By way of a non-limiting example, the common goal may 120 be to satisfy a low emission driving constraint. To do so, the method has to take care of the following elements, and find countermeasures, when necessary (e.g. with optimization), so that overall trust value of each node controlled and correlated to risk alerts in (near) real time. The status data 115 provides information allowing the monitoring node to evaluate the specific abilities required to achieve this common goal. This status data may for example include:

The behaviour of the driver, which directly impacts the emission level. It can be measured by inferring the acceleration of the car, which obviously depends on the way the user accelerates or decelerates. With this value it is possible to deduce how much a driver is aggressive, slow, etc. This acceleration profile can be computed with GPS, RPM (Revolution Per Minute) or the smartphone’s accelerometer for instance depending on the position of the device in the car. The driver him/herself is also important, since the age, driving habits and experience are all factors that obviously influence the behaviour.

The vehicle itself, and most specifically its maintenance and type (e.g., age, engine, etc.) - A old vehicle for instance usually generates more emissions that a recent.

Environmental conditions: weather, road traffic, etc. can affect the emissions generated by tires, brakes and exhaust emissions.

The profiling and recommendations systems that are embedded in the app and that are only using local routines, so only a limited information knowledge that can easily be influenced negatively - thus biasing the recommendations.

The connectivity part used to transmit the data - if false data is sent, then the models will not be accurate. Furthermore, other metrics from data sensors e.g. data collected through the OBD dongle includes Gas pedal position ( %), RPM, Gear position, Fuel consumption, Mass Air Flow (MAF), NOx sensor, Vehicle speed, Engine Coolant Temperature, Steering wheel angle, Catalyst Temperature Banks & sensors, Air pressure, Engine out NOx emission.

Once received, the collected status data 115, 115’, 115” is used to determine, using a data processor 132 of the monitoring network node 130, an overall indicator value 111, 111’, 111 ” for each of the autonomous network nodes 110, 110’, 110”. The overall indicator value reflects the overall ability A(110), A(l lO’), A(110”) of the corresponding autonomous network node to accurately complete their respective task or tasks 113, 113’, 113”. It may for example be computed using a mathematical prediction model based on previously obtained overall indicator values, or using a trained machine learning model.

The overall indicator value reflects the trust level that one may have in the local decisions that are made at the corresponding autonomous network node. As such the overall indicator value may for example be normalized or quantified to an integer value between 1 and 5, wherein Iwould be the lowest level of trust (indicating that something is technically askew at the node) and wherein 5 would be the highest possible level of trust. The overall indicator value may further be obtained by computing a weighted combination of a plurality of specific indicator values reflecting specific abilities Sl(110), S2(110) as shown in Figure 3. To achieve the common goal 120, task 113 requires the overall ability A(110) of autonomous network node 110, this ability being composed by a combination of specific abilities S 1(110), S2(110). The specific abilities may for example comprise a specific ability to compute accurate local decision, to provide sufficient network capacity, processing power, network scalability and communication security for the task 113 at hand. Similarly, task 113 ’ in the provided example requires the overall ability A(110’), which may be at a different level than A( 110), of autonomous network node 110 ’. In the provided example, this ability is composed by a combination of specific abilities S 1(110’), S2(110’), S3(l 10”) required for the task 113’ at hand.

While the overall indicator value 111, 111’ quantifies the overall ability A(110’), A(110”) (or the trust one may have therein) of the corresponding autonomous network nodes, the specific indicator values quantify the specific abilities S 1(110), S2(110), S 1(110’), S2(110’), S3(l 10’) (or the trust one may have therein) respectively, each specific ability being quantifiable from the status data 115, 115’ and providing further insight into the trustworthiness of the corresponding autonomous network nodes.

Based on the determined overall indicator values 111, 111’, 111”, the monitoring network node 130 concludes whether the corresponding autonomous network nodes are able, or can be tmsted, to complete their respective task 113, 113’, 113”. A negative conclusion is obtained if the indicator value does not satisfy a predetermined condition, such as for example falling within a predetermined normalized range of acceptable trust values (e.g., 4-5). In the event of a negative conclusion 117, 117’, 117” is transmitted to the corresponding autonomous network node 110, 110’, 110’. The alert preferably comprises either data that helps the autonomous network node to improve its capabilities, or user guidance for reconfiguring the node appropriately, without being limited to these examples.

By way of example, the monitoring means may determine that a camera sensor of a first autonomous network node 110 has become partly dysfunctional. This conclusion may be reached by comparing images or views 115 taken by the autonomous network node 110 at various previous time instance, and detecting, using appropriate image analysis algorithms, that image noise has increased. Alternatively, images 115” taken by a second autonomous network node 110’ evolving in physical proximity of the first node 110 may be used for comparison, if similar features of the environment 100 are captured by both sensing means 114 and 114” respectively. If the task 113 of the first autonomous network node 110 heavily relies on the image sensor, e.g. the task is pedestrian detection, then the disability of the sensing means 114 is critical and the ability A(110) of the autonomous network node 110 is determined to be low. The alert 117 transmitted to the corresponding node 110 may comprise an indication to rely on secondary imaging means (if available at the node) or to provide image data available at the neighbouring node 110’. By using this adapted input 117, the node 110 may find itself again in a position to take accurate decisions with a view to resolving its task 113, which in turn help accomplishing the common goal 120.

If should be noted that the current invention is not limited to this example of vehicular networks. Any distributed system relying on local decision made autonomously, mostly using artificial intelligence tools such as machine learning models, may benefit from the proposed approach. Tmst in the various participating nodes to achieve the common goal is not only regularly evaluated and quantified, but it is actively increased throughout the distributed infrastructure by optimizing the use of the overall available resources.

A further preferred embodiment of the invention is shown in figure 4. The infrastructure is generally similar to that shown in figure 3. Autonomous network nodes 210, 210’, 210” perform tasks 213, 213’, 213” in a communication network 202. The tasks contribute to achieving a common goal 220 and rely on data sensed using sensors 214, 214’, 214” from the environment 200. Here, several monitoring network nodes 230, 230’, 230” are depicted, wherein each monitoring network node receives status data 215, 215”, 215” from various autonomous network nodes and concludes, using corresponding processors 232, 232’, 232” to their respective overall abilities A(210), A(210’), A(210”) to complete their respective tasks. All features described in the context of figure 3 remain applicable, but it becomes clear that the monitoring nodes may conceptually form an interaction layer 240 with the distributed architecture. As yet another nonillustrated alternative, a monitoring node may also be physically collocated on the same device with an autonomous network node, and received status data from other autonomous network nodes, without departing from the scope of the present invention.

Another embodiment of the invention is now outlined in further detail in what follows, including specific examples.

Intelligent systems are becoming more complex and diverse as the amount of data exponentially increase. Since, the system nodes and components are diverse and complexity exponentially grows, which is not feasible to ensure trusted scalability of the system and algorithms running in real time.

Fortunately, widely accepted learning representation approaches with the data such as back propagation can help to formally state the environment and interaction within that. In order to be able to track sequences and state transitions, end-to-end pipeline modelling and differentiation approaches can be implemented. However, to be able to keep the critical systems constraints and trusted scalability of the algorithms between the cooperating components, robust distributed check-point mechanisms and computationally scalable mathematical/system models are required.

On the other hand, holistic abstraction paradigms can help to extend ACID (atomicity, consistency, isolation, durability) features of database systems to higher system level by extending data locality to the edges in trusted scalable manner. Cooperation and task data sharing between the components can be accelerated with SDN (software defined networking) features of the components.

However, as the system functions virtualizes, and number of transactions increases, behavioural integrity of the system is also becoming controversial due to exponential growth in error rates in task sharing. In order to maximize the performance of task cooperation and minimize the error rates, trust assurance methodologies can help to ensure the behavioural integrity of the system with TEE (trusted execution environment) utilization such as open-TEE.

Furthermore, holistic views are required as critical constraints for dynamic package transmission and task sharing between these units. In order to tackle the challenge, the invention proposes a methodology called Trusted Distributed Al (TDAI) to ensure end-to-end trust and build a software driven trusted execution environment to maximize performance of task cooperation and minimize error rates. So that, behavioural integrity of a growing intelligent system can be assured with maximum performance and dynamic feedback structures, which are utilized via the trusted holistic views.

Section. II defines tmsted distributed Al methodology (TDAI), Section. Ill defines distributed Al system architectures and explains the need for distributed architectures and increasing interest to TDAI in literature. Furthermore, gives details about the security, privacy, trust metrics, and regulative constraints considered in this study by articulating the methodology and contributions of TDAI in detail. Furthermore, compares the behaviour monitoring application in CCAM (Connected Cooperative Autonomous Mobility) domain to comparatively analyse TDAI with other SOTA methodologies; such as, centralized, decentralized ones, nontrusted approaches etc. Section. IV evaluates the contributions of this study and discusses about the future potentials. Section. V concludes.

I. METHODOLOGY

A. Methodology Overview

A preferred embodiment of the invention introduces a novel operational methodology that offers explicit means to justify tmst in distributed intelligent systems (TDAI-OM). In fact, as the number of required critical justified features increases to ensure tmsted interactivity, trust cost also increases to be able to justify the trust in dynamic context in (near) real time. TDAI-OM framework helps finding the optimal trust zone based on the balance that any systems operation can leverage in the targeted distributed nodes design and deployment. This way, depending on the context of use case, the reachable tmst level can be managed based on the cost available/desired. Next sub-sections will explain the tmst levels and introduce TDAI formulation.

B. TDAI Taxonomy

1) TDAI-OM Trust Levels:

TDAI-OM is designed in a way that it can be used in most cases compared to similar complex methodologies that exist in the literature like Common Criteria standard. The TDAI-OM embodiment is actually based on 5 trust levels that can be accessible.

The aim of the proposed method TDAI-OM is to improve the accomplishment of a common goal by estimating the trust value of each autonomous network node based on metrics/parameters listed in Table I. As explained in the context of previous embodiments, a monitoring network node or monitoring layer estimates quantifies the ability of the autonomous network nodes to complete their respective task, which translates in a trust that one may have in the node’s capabilities. So that, each node will be included in available category or overall indicator value, while there are 5 main levels associated to the TDAI taxonomy based on the following:

TL 1 - Trust Level 1 (0): System nodes not trusted

TL 2 - Trust Level 2 (0.25): System nodes insufficiently trusted

TL3 - Trust Level 3 (0.50): System nodes sufficiently trusted

TL 4 - Trust Level 4 (0-75): System nodes partially trusted

TL 5 - Trust Level 5 (1.0): System nodes fully trusted

Trust levels are the overall indicator values referend in previously described embodiments. In order to be able to identify a system or it’s node as trusted, it has to be justified by technical means. However, there is trust cost for each justification feature. As the number of justification features increases, the tmst cost, i.e. the cost associated to quantify the trust in the feature, also increases exponentially. Furthermore, to be able to ensure the required minimum throughput of a system, the tmst cost worth to pay but can be kept at optimal level with right dynamic strategy mechanisms. Dynamic strategy plans can be updated in real time by ensuring interactivity of the all components of a system within the observed context. For an optimal level of trust in the context critical nodes ilf are monitored in (near) real time by ensuring interactivity of trusted agents attached to the nodes. Next chapter explains the weight update and error minimization strategies of TDAI methodology.

2) TDAI Classes

Table I represents a summary of the defined TLs. The columns represent an ordinal set of TLs, while the rows represent the trust classes and families of criteria we use in order to express the requirements for the various tmst levels with respect to the trust level taxonomy defined above. Each number in the resulting matrix identifies a specific trust component where higher numbers imply increased requirements. Relating to the embodiment of figure 1, the ability A(110) of node 110 to complete its task 113 may be composed of the specific abilities S 1(110), S2(l 10) which are listed in Table 1. Each ability may be measured through specific status data 115 and quantified to a specific indicator value / Trust Level as shown hereunder.

Table 1. TDAI Classes a) Class PERF: Performance b) Class RT: RunTime c) Class SEC: Security d) Class RT: Test

C. TDAI Formulation

1) TDAI Taxonomy and System Modelling (Trusted Neuron and Trust Measurement Method):

Generic systems are represented by a dynamic model as illustrated in Figure l.b, where nodes are connected to neighbors for cooperation purposes. The aim of the TDAI OM is to justify channels for tmsted interactions among the connected nodes. Each node can be considered as an agent or so-called tmsted neuron N _t {} (see Figure 5.).

2) Trusted Value Formulation:

Stage 1: Trusted Neuron Formulation:

As formalized in equation (1), a neuron and a trusted neuron, which have input function N _b gives the weighted sum of the unit’s input values, that is, the sum of the input activations multiplied by their weights ^w i

^N i = y. ^w ij ^a j

= 0..N w

Stage 2: Function:

In the second stage, the activation function, g, takes the input from the first stage as argument and generates the output, or activation level, a _b

Stage 3: Neurons ’ Trust Value:

Trust value t _a (0,1) of output a i _b

Transaction flow repeats continuously with holistic feedback controller mechanism, which assures continuous growth of an intelligent system. Learning systems of neural networks are iteratively updated. The frequency of updates improves the total performance of the system, but limited with available resources. By that means, growth flow in dynamic context is observed and updated dynamically. Next chapter introduces weight update strategy and error minimization methodology.

3) Weight Update Strategy and Error Minimization:

For a given set of representative input and output pairs, ((x- , t •)) • = _t , consider a network with just one neuron N directly connected to the inputs. The inputs x- can be thought of as a vector with k components.

Let xj be the i component in the J training input. Random weights are assigned for each input to initiate training. Output and total errors are computed based on these inputs. Single neuron n gives output n (x _; ) i with the training data Xj that has ideal output Oj. Error e, on a single input j is usually defined as

Gradient descent training moves the weights in the direction that they have greatest impact on the error. The weights are then moved in the direction that the error reduces most. Equation.4 below formulates changing the weights in round r+1. de

W _i r + l) = W _i r) - e— (4).

If the function g is differentiable, chain-rule can be applied for derivation. The chain rule application can enable to compute the rate of change of the error function with respect to the weights from the rate of change of the error with respect to the output. For an input x _; -, the derivative of the error with respect to the output is below equation.5;

Chain rule can be used to get the derivative of the error with respect to any weight. de de din dW _t ~ din dWi (6.3). de dN din

⁼ dN d n dWi

Equation.4 can be plugged to equation.6 to get a rule to calculate how the weights should be updated. Figure 6 illustrates the single neuron network error calculation strategy. Chain-rule can be applied to multi-layer neural networks as well to train the network. Backpropagation method (Rinehart et al. 1986) is proposed for the error derivative with respect to the weight from layer i to layer i + 1. Derivatives of the errors used with respect to the inputs in layer i + 1. The approach is emerging point for automatic differentiation methods in machine learning (Baydin et al. 2018). The methods enable end-to-end training of differentiable pipelines across machine learning frameworks (Milutinovic et al. 2017).

Backpropagation algorithm is a special case of automatic differentiation (Griewank 2000). The method computes a program P' for the derivative of a function f of a function f given a program P for a function f. Univariate Taylor series with suitable degree is proposed for the problem of evaluating all pure and mixed partial derivatives of some vector function defined by an evaluation procedure. Possibility of derivatives calculation only in some directions instead of the full derivative tensor is explained. Estimates for the corresponding computational complexities are given.

Computational differentiation is useful for gradient error calculation and single/multi-layer neural network training. However, computing the rate of change is restricted with computational scalability limitations. Furthermore, it inflates the memory resources and require larger memory resources. Algorithm 799 (Griewank et.al. 2000) implements a checkpointing for the reverse or adjoint mode of computational differentiation. The authors develop a check-point schedule as an explicit “controller” to reduce the storage requirements and to run a time-dependent applications program. However, differential sequences require (near) real time dynamic holistic views to be able to ensure the validity of the control mechanisms. Thereby, scalability of a system can be considered with the dynamics feedback structures as critical performance metrics.

Scalability modelling metrics and parameters are key performance indicator for any system performance evaluation process. Many aspects can be observed to indicate desired outputs. Main bottleneck for the emerging systems and neural networks is computational scalability constraints. Amdahl law (Amdahl 1967) considers sequential and parallelizable portions of the programs. General theory of computational scalability (Gunther 2008) extends Amdhal law with queuing theory approach. The theory proves that computational capacity is equivalent to the synchronous throughput bound for a machine-repairman with state-dependent service rate. On the other hand, decentral and distributed architectures are preferred for emerging systems. Scheduling and control approach can be improved with MEMCA (Memory Centric Analytics) holistic abstraction and distributed check-pointing/control mechanism. Check-point locations are optimized with a hierarchical structure, which have Tl-Cloud, TII-Gateway, TIII-Fog, TIV-Edge layers. It can be applied to end-to-end AI/ML pipelines to monitor transaction flows also.

State-of-the-art design and holistic abstraction extend data locality to the edges in trusted scalable manner, it can maximize neural network training total performance with a holistic view to the system. The holistic abstraction provides end-to-end trust justification features for decision mechanism with lineage graph recording of transaction-flows. Trust indicators defined in different system layers can maximize the targeted throughput and minimize crosstalk and latency penalties in hybrid designed architectures. Figure.3 illustrates the correlation of trust factor coefficient with respect to growth of a system.

The study shows that, if a system is trusted, same value of throughput can be obtained with less or same

Table II. Monitoring metrics/status data of an autonomous network node. number of nodes in an intelligent mechanism. That is, we can say that in order to maximize throughput of a context, making it tmsted is more efficient approach rather than the increasing number of nodes. The holistic abstraction can help to define the features sets of a tmsted agent as a system node abstract component, which interacts dynamically with the environments, as formally defined in detail in next chapter. Feature sets are fetched dynamically as inputs to the train sets of data models and structures with a feedback controller mechanism. Thereby, checkpoints can be defined as trusted execution environment (TEE) for critical package context extract/embed in set of flowing network packets p<>. Next section explains the trusted agent and interaction with the environment.

D. TDAI Work-flow: Trusted Agent Interaction with Environment

# Environment E {"Scenario: Risk Detection, Time: DD:MM:YYYY,HH:MM:SS", Nodesf*], FeatureVectors v <*>};

Input: Environment E {Nodes[*]};

Output: Environment E {Nodes[*][ ‘Alerts’]} ;

BEGIN

While ( E{ } has active nodes )

Maximize V(f,E,U)

Update U ( “Feedback Controllers ⁴⁴ )

}

END

Behaviour of an agent or autonomous network node can be described as system node abstract component in the environment E (from a class E of environments), and which produces a sequence of states or snapshots of that environment. A performance measure U () evaluates this sequence. Let V f,E,U') denote the expected utility according to U () of the agent function f () operating on E { }.

Each Node X(N); Defined as Trusted Agent = { If and with activation function a _t }

Trusted Agent as N _t and activation function a _t

Each Environment E has set of nodes; N _E {N N ₂ , N ₃ , ..., N _n }. Each environment can be monitored with set of trusted agents or nodes. Each node can be defined as a trusted agent or agents can be defined as system nodes depending on the context.

Let V (f,E,U) denote the expected utility according to U of the agent function f operating on E. We identify rational agent with an agent function: fopt = argmax V(f ,E,U) (8). Throughput of each Node X(N); monitored via trusted Agent A{ } and nodes N{ }

Trusted Agent A{ } =

{IN _t and with activation function a _t }

The goal for the set of agents A{} and nodes N{} are to maximize the expected utility V() of the set of environments E{ } by monitoring behaviours with f _opt Q function via trusted channels. Set of dynamics packets p<> are observed in distributed checkpoints within the trusted execution environments (TEE). Thereby, learning goals can be accelerated with dynamic feature vectors as feedbacks to assure continuous growth of the agents and the environments.

In accordance with the present embodiment, the TDAI algorithm runs as follows:

Behavior of the trusted agent A{ } is monitored within set of nodes N{ } in the Environment E e E {} with four steps below;

Step 1: Tmsted Agent A{} produces a sequence of states or snapshots of that environment.

Step 2: Performance measure U () evaluates this sequence

Step 3: Let V(f.E.U) denote the expected utility according to U of the agent function f _opt Q operating on E{}.

Step 4: Monitors System/User Behavior with the Performance Indicators a. Quantifies and measures trust in system within set of nodes Ny} b. Maximizes expected utility V() f _op t = argmax V(f,E,U)

Trusted Agent iN _t in an environment interaction workflow 1-4 is illustrated in Figure 7 . Rationality of agents can enable to interact with the environment in dynamic context via trusted channels. Transaction flow 1 to 4 repeats for continuous growth of intelligent-system. (1) Trusted Channel Builder starts transaction-flow (2) Sensors of the autonomous node interact with environment, (3) Actuators monitors/detects from environment, (4) Performance element implemented in monitoring node update s/trains the agents/autonomous network node. Throughput values of each node X(N) is monitored dynamically with expected average threshold limits.

Set of Trusted Agent N _t in an environment gets the feature sets dynamically as input and produces set of targeted outputs; such as, risk alerts for the environment dynamically. The pseudo-code and TEE based interaction in set of environments E{} is provided as follows:

# Environment E {"Scenario: Risk Detection, Time: DD:MM:YYYY,HH:MM:SS", Nodesf*], FeatureVectors v <*>}; Input: Environment E {Nodes}*]};

Output: Environment E {Nodes[*][ ‘Alerts’]} ;

BEGIN

Maximize V(ta.f (true),E{},U[])

{ for ( i from 0 to N: number of trusted agents) while (data sensors fetch new data)

{

Decode Package p <*>;

Extract Package p <*>;

Extract Feature Metrics v <*>;

Update Trust Values of Nodes [*];

Embed Feature Metrics v <*>;

Embed Package p <v>;

Encode Package p <*>;

Update Environment E { Nodes[p<*>][ ‘Alerts’]} ;

}

}

END

The loop enables continuous growth of the system with feedback controller and holistic view to the context with an end-to-end TEE (Trusted Execution Environment). In order to be able to interact with each node, system level design perspectives are required, since the interactions with set of nodes N _E {Nj , N ₂ , N ₃ , ... , N _n } in a context are also dynamic and it is not only data dependent but also other dependencies arises up to context features. However, data is the key component to track transaction states and required knowledgebases to assure the integrity and growth of the mechanism.

Each Environment E{ } has set of snapshots for selected time spans of the observed context. Set of nodes N[] in a context are observed dynamically with set of Trusted Agents A{ } or monitoring nodes, which are embedded to OBU (On Board Units/Computers) of each node. The basic components of the OBU nodes and interaction with the dynamic context with (1) Central (2) Decentral (3) Distributed/Hybrid system architectural design perspectives. Thereby, we can say that the generic and dynamic holistic abstraction can be applied to obtain dynamic holistic view of the context with trust factor coefficient-based throughput maximization approach. Performance measure U() function is dynamically merged from the dynamic context with an expected utility maximization function V(f.E.U). Furthermore, within the well-defined parameters of the Environment E{}, optimization function f _opt Q is also defined dynamically to improve the knowledge base built with feature vector functions v<*>. So that, the agent function f Trusted Agent{AQ] E( [ * ]}) can be operated dynamically in set of environments within end-to-end Trusted Execution Environment (TEE) to maximize the dynamically defined improvement parameters with a dynamic optimizer f _opt = argmax V(f,E,U).

In the next chapter introduces the TDAI nodes and the components, which has a dynamic growth-flow mechanism.

II. TRUSTED DISTRIBUTED Al SYSTEM ARCHITECTURES AND COMPONENTS

In this section, (1) Central (2) Decentral (3) Distributed/Hybrid design perspectives and hypothesis and theorems regarding the methodology are introduced. (1) Enables a fully connected context but it has connectivity and bandwidth limitations. (2) Enables to design fully decentralized autonomous nodes but capacities are limited with edge node feature sets. (3) can maximize connectivity and interactivity with distributed nodes and hybrid system design paradigms.

A. System nodes and components

Trusted agent structure and interaction flow with the environment is formally stated in previous section. This section introduces TDAI system node main components and architectural perspective differences. Throughput values of the nodes X(N) are monitored dynamically via interaction units called OBU (On Board Units). The node can be any kind of edge device/computers; such as, mobile/smart phones/watches, servers, storages, networking/communications gateways etc.

Basic components of an OBU device are trusted agent, connection ports, processor, and memory. Interaction intra-nodes and the environment can be iterated with (1) central (2) decentral (Autonomous/ Embedded/Local), (3) distributed/hybrid mechanisms. Rest of the section introduces basics of these design paradigms and hypothesis proposed in this study regarding these methodologies. Each node in different context interacts with set of Environment E{ } via TDAI methodology and embeds the critical metrics and parameters dynamically to the packages p<> as stated in equation.9. The packages are dynamically monitored in critical checkpoints and detection/react mechanisms are triggered depending on the threshold values of the alerts. The metrics listed in Table.II is transmitted from each node as a packet;

P =< ^id’^st’^e’^l’^id’^k’^T’^chsum’^c’^p’^d > ’ ( ⁹ )

B. Centralized (Fully connected)

Centralizing interactions of the nodes in a system has advantages; such as, integrity of the design, accessibility of resources, assuring trusted connectivity of components. However, increasing diversity of the components and decentralization of data/memory resources require system level design reconsideration. Since computational scalability of algorithms and control structures are not feasible to centralize the resources. The basic components, are a central cloud, mobile nodes, and fog layer-based networking/communication components .

As the number of the node N _E {N _b N ₂ , N ₃ , ..., N _n } in the context increases, throughput of the system decreases. Fortunately, making the system trusted can help maximize the total throughput of the system with less number of nodes. Thereby, we can assume that in order to be able to make the system tmsted and scalable, the nodes have to cooperate and share the tasks to be able to ensure the integrity. Next chapter briefs about decentralized design basics as another approach, which enables to maximize capacities of each node.

C. Decentral (Autonomous/ Embedded/Local)

Decentralized design enables each node to have memory/storage and networking/communication components independently. As the Moores’s law disappears with emergence of 3D-Stack memory and storage components, data capacities can be maximized within the autonomous nodes as decentralized mechanism. By that means, the interactions into set of nodes N _E: {N _b N ₂ , N ₃ , ... , N _n } can be minimized and networking and communication bottlenecks are minimized. However, data intensive nature of emerging intelligent systems generates peta-scale data and require real-time massive analytics. Therefore, distributed design is required to be able to assure required throughput of each node and minimize crosstalk and contention bottleneck in total system. Next chapter introduces basics of the distributed and hybrid design approach and compeares advantages and disadvantages of each approach.

D. Distributed (Edge/Hybrid)

Previous two approaches (1) centralized (2) Decentralized and enable to build a joint knowledge base, is enough for mist cases. However, as the growth of the emerging intelligent systems increases exponentially, (3) distributed design becomes de facto paradigm for throughput level for each node and the total system. Since the diversity of the components and number of interacted nodes increases exponentially, behavioral integrity of total system and transactions have to be assured in real-time to be able to keep the critical system constraints. Each node has an on-board unit, has an embedded trusted agent to interact with the environment. Trusted channels ensure and maximizes connectivity of the components.

Trust factor coefficient-based throughput maximization methodology can enable to build end-to-end tmsted scalable channel within the components and total system. Throughput value of each node each node X(N) is observed dynamically and the agent function f _opt = argmax PC/,/?,!/) operates continuously to assure coherency and continuous growth of a system. E. TEE based networking for trusted channels via SDN (Software Defined Networks)

Increasing diversity of the components and data intensive nature of the systems require critical updates in networking paradigms also. Data-flow processes are improved with virtualized network functionalities, which have software-controller based switch and router design approaches, which called software defined networking (SDN). As the virtualized components increase in the systems, abstraction paradigms are also rethought such as holistic views. The innovations enable to design end-to-end Trusted Execution Environment (TEE) to interact with environment more coherently.

The proposed approach can enable to ensure network scalability and throughput maximization of emerging software defined networking-based systems. Furthermore, it can be applied to monitor systems and user behavior to minimize misbehaviors with a holistic view to the system; such as, emission generated by cars and EMF generated by emerging computational/memory units of intelligent-systems. Next chapter introduces security, privacy, trust metrics and package transmission approach of feature vector structure with TDAI and introduces theorems and hypothesis of TDAI with distributed design paradigms.

F. Security, Privacy and Trust Metrics

As the diversity of the components increase, security paradigms are also reconsidered from scratch with many perspectives. Security by design principles enable to design more robust and secure intelligent mechanisms. However, security constraints still cause dependency to a custom hardware design and limits software driven dynamic reconfiguration for adaptive systems. Fortunately, emerging TEE mechanisms like Open-TEE can help to make the system software driven trusted applications with dynamic compiling structures to any platform. Thereby, we can obtain measurable dynamic trust metrics as feature vectors within the transaction flow and package transmission processes; such as, checksum values of packages, trust factor of the nodes in the system, latency values of the transactions. See Table.II for the selected metrics of TDAI for a package p<>.

Virtualized functionalities of software driven TEE ecosystems, can help to overcome limitations of hardware isolated TEE mechanism in state-of-the-art designs. Dynamic compiling and testing approaches, which are (1) black box (2) gray box (3) white boxes are widely implemented for cryptography and testing features. However, emerging paradigms triggers architectural improvement need concerns also. For instance, decentralization of resources requires updates in many system layers in real time, which is only possible distributed and hybrid design approaches. Thereby, TDAI can enable dynamic testing as user and developer with risk prediction and minimization via monitored set of network packages p<>, which have embedded feature to be compressed/decompressed in available check-points.

Distributed check-point mechanisms are dynamically correlated with throughput values of each node X(N), with respect to the regulative constraints. So that, we can state the hypothesis and theorems with TDAI with a comparative analysis on growth acceleration of the mechanisms, which have (1) central (2) decentral (3) distributed/hybrid architectural perspectives. Furthermore, dynamic optimizer function f _opt = arg max F(/,£,l/)maximizes expected utilities of each node via tmsted agents f Trusted Agen

However, interactivity of these agents is strongly dependent of embedded feature transmission via set of network packages p<>. Fortunately, these features can be compressed/decompressed within reasonable latency thresholds of the emerging OBU mechanisms as feature vectors V<>.

Theorem-.

So that, we can claim that it is possible to ensure the growth-flow of a dynamic environment with set of nodes E[N[ * ]} with (1) centralized (2) decentralized/autonomous (3) distributed/hybrid-design perspectives of TDAI methodology. The claim can be formalized as below in Equation 10. Growth-flow of (1) Decentralized (2) Centralized (3) Distributed design can be arranged as below equation 10. Since, distributed design can enable to maximize total throughput of each node X(N) and total system. Next chapter evaluates the methodology and introduces validation for the proposed theorem after a short proof of the statement below.

The proof for TDAI methodology can be correlated with the alerts in the monitored context. It is observed that TDAI can enable to minimize the alerts in a dynamic context, for which the results are briefly introduced in next chapter and will be discussed in details within the related future works.

As formulated in above equation 11, we can say that number of alerts are minimized via TDAI, which have distributed/hybrid design, it outperforms other centralized and decentralized/autonomous design perspectives. Minimized risk alerts of dynamic context, is illustrated above Equation 11, proves that interactivity of the nodes and growth-flow of the context can be maximized with a distributed design rather than central and autonomous ones. Next chapter introduces initial experimental validation results with trust factor coefficient based total system throughput maximization theorem.

It should be noted that features described for a specific embodiment described herein may be combined with the features of other embodiments unless the contrary is explicitly mentioned. Based on the description and on the figures that have been provided, a person with ordinary skills in the art will be enabled to develop a computer program for implementing the described methods without undue burden and without requiring additional inventive skill. It should be understood that the detailed description of specific preferred embodiments is given by way of illustration only, since various changes and modifications within the scope of the invention will be apparent to the person skilled in the art. The scope of protection is defined by the following set of claims.