Question: An investigation into data mining frameworks within the realm of cybersecurity.

Exploring Data Mining Techniques in Cyber Security: The Case of MINDS
This chapter delves into the intricacies of the Minnesota Intrusion Detection System (MINDS), a sophisticated framework that employs a suite of data mining algorithms to tackle various dimensions of cyber security. MINDS is composed of several key components, including the scan detector, anomaly detector, and profiling module, each designed to identify distinct forms of attacks and intrusions within computer networks. The scan detector is particularly adept at recognizing scans, which often serve as precursors to network assaults. Meanwhile, the anomaly detection algorithm excels in pinpointing deviations in network traffic patterns, indicative of potentially malicious activities such as denial-of-service (DoS) attacks, worm propagation, policy violations, and internal misuse. The profiling module provides network analysts with a comprehensive understanding of traffic characteristics, enabling the detection of deviations from the norm. Our findings reveal that the intrusions identified by MINDS complement those detected by conventional signature-based systems, such as SNORT, suggesting that a combination of these approaches can significantly enhance attack coverage. Notably, MINDS has proven its operational efficacy in identifying network intrusions through successful deployments at the University of Minnesota and as part of the Interrogator architecture at the US Army Research Lab's Center for Intrusion Monitoring and Protection (ARL-CIMP).

Process mining has gained traction over the past decade and an impressive body of research has resulted in the introduction of a variety of process mining approaches measuring process performance. Having this set of techniques available, organizations might find it difficult to identify which approach is best suited considering context, performance indicator, and data availability. In light of this challenge, this paper aims at introducing a framework for categorizing and selecting performance analysis approaches based on existing research. We start from a systematic literature review for identifying the existing works discussing how to measure process performance based on information retrieved from event logs. Then, the proposed framework is built starting from the information retrieved from these studies taking into consideration different aspects of performance analysis.

Traditionally, knowledge actionability has been investigated mainly by developing and improving technical interestingness. Recently, initial work on technical subjective interestingness and business-oriented profit mining presents general potential, while it is a long-term mission to bridge the gap between technical significance and business expectation. In this paper, we propose a two-way significance framework for measuring knowledge actionability, which highlights both technical interestingness and domain-specific expectations. We further develop a fuzzy interestingness aggregation mechanism to generate a ranked final pattern set balancing technical and business interests. Real-life data mining applications show the proposed knowledge actionability framework can complement technical interestingness while satisfy real user needs.

Enterprise decision making is continuously transforming in the wake of ever increasing amounts of data. Organizations are collecting massive amounts of data in their quest for knowledge nuggets in form of novel, interesting, understandable patterns that underlie these data. The search for knowledge is a multi-step process comprising of various phases including development of domain (business) understanding, data understanding, data preparation, modeling, evaluation and ultimately, the deployment of the discovered knowledge. These phases are represented in form of Knowledge Discovery and Data Mining (KDDM) Process Models that are meant to provide explicit support towards execution of the complex and iterative knowledge discovery process. Review of existing KDDM process models reveals that they have certain limitations (fragmented design, only a checklist-type description of tasks, lack of support towards execution of tasks, especially those of the business understanding phase etc) which are likely to affect the efficiency and effectiveness with which KDDM projects are currently carried out. This dissertation addresses the various identified limitations of existing KDDM process models through an improved model (named the Integrated Knowledge Discovery and Data Mining Process Model) which presents an integrated view of the KDDM process and provides explicit support towards execution of each one of the tasks outlined in the model. We also evaluate the effectiveness and efficiency offered by the IKDDM model against CRISP-DM, a leading KDDM process model, in aiding data mining users to execute various tasks of the KDDM process. Results of statistical tests

This paper presents a survey of basic concepts in the area of text data mining and some of the methods used in order to elicit useful knowledge from collections of textual data. Three different text data mining techniques (clustering/visualisation, association rules and classification models) are analysed and its exploitation possibilities within the Webocracy project are showed. Clustering and association rules discovery are well suited as supporting tools for ontology management. Classification models are used for automatic documents annotation.

Human behavior inside organizations is considered the main threat to organizations. Moreover, in information security the human element consider the most of weakest link in general. Therefore it is crucial to create an information security culture to protect the organization's assets from inside and to influence employees' security behavior. This paper focuses on identifying the definitions and frameworks for establishing and maintaining information security culture inside organizations. It presents work have been done to conduct a systematic literature review of papers published on information security culture from 2003 to 2016. The review identified 68 papers that focus on this area, 18 of which propose an information security culture framework. An analysis of these papers indicate there is a positive relationship between levels of knowledge and how employees behave. The level of knowledge significantly affects information security behavior and should be considered as a critical factor in the effectiveness of information security culture and in any further work that is carried out on information security culture. Therefore, there is a need for more studies to identity the security knowledge that needs to be incorporated into organizations and to find instances of best practice for building an information security culture within organizations.

Business intelligence systems combine operational data with analytical tools to present complex and competitive information to planners and decision makers. The objective is to improve the timeliness and quality of inputs to the decision process. Business Intelligence is used to understand the capabilities available in the firm; the state of the art, trends, and future directions in the markets, the technologies, and the regulatory environment in which the firm competes; and the actions of competitors and the implications of these actions. The emergence of the data warehouse as a repository, advances in data cleansing, increased capabilities of hardware and software, and the emergence of the web architecture all combine to create a richer business intelligence environment than was available previously. Although business intelligence systems are widely used in industry, research about them is limited. This paper, in addition to being a tutorial, proposes a BI framework and potential research topics. The framework highlights the importance of unstructured data and discusses the need to develop BI tools for its acquisition, integration, cleanup, search, analysis, and delivery. In addition, this paper explores a matrix for BI data types (structured vs. unstructured) and data sources (internal and external) to guide research.

The popularity of using Internet contains some risks of network attacks. Intrusion detection is one major research problem in network security, whose aim is to identify unusual access or attacks to secure internal networks. In literature, intrusion detection systems have been approached by various machine learning techniques. However, there is no a review paper to examine and understand the current status of using machine learning techniques to solve the intrusion detection problems. This chapter reviews 55 related studies in the period between 2000 and 2007 focusing on developing single, hybrid, and ensemble classifiers. Related studies are compared by their classifier design, datasets used, and other experimental setups. Current achievements and limitations in developing intrusion detection systems by machine learning are present and discussed. A number of future research directions are also provided. 2009 Elsevier Ltd. All rights reserved.

Data mining systems aim to discover patterns and extract useful information from facts recorded in databases. A widely adopted approach to this objective is to apply various machine learning algorithms to compute descriptive models of the available data. Here, we explore one of the main challenges in this research area, the development of techniques that scale up to large and possibly physically distributed databases. Meta-learning is a technique that seeks to compute higher-level classifiers (or classification models), called meta-classifiers, that integrate in some p rincipled fashion multiple classifiers computed separately over different databas es. This study, describes meta-learning and presents the JAM system (Java Ag ents for Meta-learning), an agent-based meta-learning system for large-scale data mining applications. Specifically, it identifies and addresses several impor tant desiderata for distributed data mining systems that stem from thei r additional complexity compared to centralized or host-based systems. Distributed systems may need to deal with heterogenous platforms, with multiple databases and (possibly) different schemas, with the design and imp lementation of scalable and effective protocols for communicating among the data sites, and the selective and efficient use of the information that is gat hered from other peer data sites. Other important problems, intrinsic wi thin ∗Supported in part by an IBM fellowship. data mining systems that must not be ignored, include, first, the abil ity to take advantage of newly acquired information that was not previously av ailable when models were computed and combine it with existing models, and second, the flexibility to incorporate new machine learning methods and d ta mining technologies. We explore these issues within the context of JAM and evaluate various proposed solutions through extensive empirical st udie .

The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. I dedicate this book to my grandchildren. Preface The intent of this book is to describe some recent data mining tools that have proven effective in dealing with data sets which often involve uncertain description or other complexities that cause difficulty for the conventional approaches of logistic regression, neural network models, and decision trees. Among these traditional algorithms, neural network models often have a relative advantage when data is complex. We will discuss methods with simple examples, review applications, and evaluate relative advantages of several contemporary methods. Our intent is to cover the fundamental concepts of data mining, to demonstrate the potential of gathering large sets of data, and analyzing these data sets to gain useful business understanding. We have organized the material into three parts. Part I introduces concepts. Part II contains chapters on a number of different techniques often used in data mining. Part III focuses on business applications of data mining. Not all of these chapters need to be covered, and their sequence could be varied at instructor design. The book will include short vignettes of how specific concepts have been applied in real practice. A series of representative data sets will be generated to demonstrate specific methods and concepts. References to data mining software and sites such as www.kdnuggets.com will be provided. Chapter 1 gives an overview of data mining, and provides a description of the data mining process. An overview of useful business applications is provided. Chapter 2 presents the data mining process in more detail. It demonstrates this process with a typical set of data. Visualization of data through data mining software is addressed. Chapter 3 presents memory-based reasoning methods of data mining. Major real applications are described. Algorithms are demonstrated with prototypical data based on real applications. Chapter 4 discusses association rule methods. Application in the form of market basket analysis is discussed. A real data set is described, and a simplified version used to demonstrate association rule methods. Chapter 5 presents fuzzy data mining approaches. Fuzzy decision tree approaches are described, as well as fuzzy association rule applications. Real data mining applications are described and demonstrated Chapter 6 presents Rough …

This paper proposes a collaborative data mining technique to provide multi-level analysis from clinical trials data. Clinical trials for clinical research and drug development generate large amount of data. Due to dispersed nature of clinical trial data, it remains a challenge to harness this data for analytics. In this paper, we propose a novel method using master data management (MDM) for analyzing clinical trial data, scattered across multiple databases, through collaborative data mining. Our aim is to validate findings by collaboratively utilizing multiple data mining techniques such as classification, clustering, and association rule mining. We complement our results with the help of interactive visualizations. The paper also demonstrates use of data stratification for identifying disparities between various subgroups of clinical trial participants. Overall, our approach aims at extracting useful knowledge from clinical trial data in order to improve design of clinical trials by gaining confidence in the outcomes using multi-level analysis. We provide experimental results in drug abuse clinical trial data.


Question: An investigation into data mining frameworks within the realm of cyber security.

An Overview of Data Mining Techniques in Cybersecurity
This document offers an extensive overview of data mining techniques specifically applied in the realm of cybersecurity. It delves into the foundational concepts of data mining, emphasizing their significance in identifying patterns and anomalies within large datasets, which is crucial for detecting and mitigating cyber threats. The discussion encompasses various data mining methods, such as classification, clustering, and association rule learning, and how they can be adapted to enhance cybersecurity measures. The document also highlights the importance of integrating data mining with machine learning algorithms to improve the accuracy of threat detection and response. Additionally, it explores the challenges associated with data privacy and the ethical considerations of using data mining in cybersecurity, ensuring a balanced perspective on its implementation. Examples from leading institutions and universities, including San Jose State University, the University of Florida, and the Pennsylvania State University, are cited to illustrate the practical applications and advancements in data mining for cybersecurity.

This open source computing framework unifies streaming, batch, and interactive big data workloads to unlock new applications.

OBJECTIVE
To describe the promise and potential of big data analytics in healthcare.

METHODS
The paper describes the nascent field of big data analytics in healthcare, discusses the benefits, outlines an architectural framework and methodology, describes examples reported in the literature, briefly discusses the challenges, and offers conclusions.

RESULTS
The paper provides a broad overview of big data analytics for healthcare researchers and practitioners.

CONCLUSIONS
Big data analytics in healthcare is evolving into a promising field for providing insight from very large data sets and improving outcomes while reducing costs. Its potential is great; however there remain challenges to overcome.

Data Mining and Knowledge Discovery in Databases (KDD) is a research field concerned with deriving higher-level insights from data. The tasks performed in that field are knowledge intensive and can often benefit from using additional knowledge from various sources. Therefore, many approaches have been proposed in this area that combine Semantic Web data with the data mining and knowledge discovery process. Semantic Web knowledge graphs are a backbone of many information systems that require access to structured knowledge. Such knowledge graphs contain factual knowledge about real word entities and the relations between them, which can be utilized in various natural language processing, information retrieval, and any data mining applications. Following the principles of the Semantic Web, Semantic Web knowledge graphs are publicly available as Linked Open Data. Linked Open Data is an open, interlinked collection of datasets in machine-interpretable form, covering most of the real world domains. In this thesis, we investigate the hypothesis if Semantic Web knowledge graphs can be exploited as background knowledge in different steps of the knowledge discovery process, and different data mining tasks. More precisely, we aim to show that Semantic Web knowledge graphs can be utilized for generating valuable data mining features that can be used in various data mining tasks. Identifying, collecting and integrating useful background knowledge for a given data mining application can be a tedious and time consuming task. Furthermore, most data mining tools require features in propositional form, i.e., binary, nominal or numerical features associated with an instance, while Linked Open Data sources are usually graphs by nature. Therefore, in Part I, we evaluate unsupervised feature generation strategies from types and relations in knowledge graphs, which are used in different data mining tasks, i.e., classification, regression, and outlier detection. As the number of generated features grows rapidly with the number of instances in the dataset, we provide a strategy for feature selection in hierarchical feature space, in order to select only the most informative and most representative features for a given dataset. Furthermore, we provide an end-to-end tool for mining the Web of Linked Data, which provides functionalities for each step of the knowledge discovery process, i.e., linking local data to a Semantic Web knowledge graph, integrating features from multiple knowledge graphs, feature generation and selection, and building machine learning models. However, we show that such feature generation strategies often lead to high dimensional feature vectors even after

We present a scalable system for high-throughput real-time analysis of heterogeneous data streams. Our architecture enables incremental development of models for predictive analytics and anomaly detection as data arrives into the system. In contrast with batch data-processing systems, such as Hadoop, that can have high latency, our architecture allows for ingest and analysis of data on the fly, thereby detecting and responding to anomalous behavior in near real time. This timeliness is important for applications such as insider threat, financial fraud, and network intrusions. We demonstrate an application of this system to the problem of detecting insider threats, namely, the misuse of an organization's resources by users of the system and present results of our experiments on a publicly available insider threat dataset.

Information system security risk, defined as the product of the monetary losses associated with security incidents and the probability that they occur, is a suitable decision criterion when considering different information system architectures. This paper describes how probabilistic relational models can be used to specify architecture metamodels so that security risk can be inferred from metamodel-instantiations. A probabilistic relational model contains classes, attributes, and class-relationships. It can be used to specify architectural metamodels similar to class diagrams in the Unified Modeling Language. In addition, a probabilistic relational model makes it possible to associate a probabilistic dependency model to the attributes of classes in the architectural metamodel. This paper proposes a set of abstract classes that can be used to create probabilistic relational models so that they enable inference of security risk from instantiated architecture models. If an architecture metamodel is created by specializing the abstract classes proposed in this paper, the instantiations of the metamodel will generate a probabilistic dependency model that can be used to calculate the security risk associated with these instantiations. The abstract classes make it possible to derive the dependency model and calculate security risk from an instance model that only specifies assets and their relationships to each other. Hence, the person instantiating the architecture metamodel is not required to assess complex security attributes to quantify security risk using the instance model. Paper A: A probabilistic relational model for security risk analysis

Despite the great developments in information technology, particularly the Internet, computer networks, global information exchange, and its positive impact in all areas of daily life, it has also contributed to the development of penetration and intrusion which forms a high risk to the security of information organizations, government agencies, and causes large economic losses. There are many techniques designed for protection such as firewall and intrusion detection systems (IDS). IDS is a set of software and/or hardware techniques used to detect hacker's activities in computer systems. Two types of anomalies are used in IDS to detect intrusive activities different from normal user behavior. Misuse relies on the knowledge base that contains all known attack techniques and intrusion is discovered through research in this knowledge base. Artificial intelligence techniques have been introduced to improve the performance of these systems. The importance of IDS is to identify unauthorized access attempting to compromise confidentiality, integrity or availability of the computer network. This paper investigates the Intrusion Detection (ID) problem using three machine learning algorithms namely, BayesNet algorithm, Multi-Layer Perceptron (MLP), and Support Vector Machine (SVM). The algorithms are applied on a real, Management Information Based (MIB) dataset that is collected from real life environment. To enhance the detection process accuracy, a set of feature selection approaches is used; Infogain (IG), ReleifF (RF), and Genetic Search (GS). Our experiments show that the three feature selection methods have enhanced the classification performance. GS with bayesNet, MLP and SVM give high accuracy rates, more specifically the BayesNet with the GS accuracy rate is 99.9%.

In recent years, privacy preserving data mining has become an important problem because of the large amount of personal data which is tracked by many business applications. In many cases, users are unwilling to provide personal information unless the privacy of sensitive information is guaranteed. In this paper, we propose a new framework for privacy preserving data mining of multi-dimensional data. Previous work for privacy preserving data mining uses a perturbation approach which reconstructs data distributions in order to perform the mining. Such an approach treats each dimension independently and therefore ignores the correlations between the different dimensions. In addition, it requires the development of a new distribution based algorithm for each data mining problem, since it does not use the multi-dimensional records, but uses aggregate distributions of the data as input. This leads to a fundamental re-design of data mining algorithms. In this paper, we will develop a new and flexible approach for privacy preserving data mining which does not require new problem-specific algorithms, since it maps the original data set into a new anonymized data set. This anonymized data closely matches the characteristics of the original data including the correlations among the different dimensions. We present empirical results illustrating the effectiveness of the method.

Intrusion detection is a process of identifying the Attacks. The main aim of IDS is to identify the Normal and Intrusive activities. In recent years, many researchers are using data mining techniques for building IDS. Here we propose a new approach using data mining technique such as SVM and Particle swarm optimization for attaining higher detection rate. The propose technique has major steps: Preprocessing, Training using PSO, clustering using K-means to generate different training subsets. Then based on the subsequent training subsets a vector for SVM classification is formed and in the end, classification using PSO is performed to detect Intrusion has happened or not. This paper contains summarization study and identification of the drawbacks of formerly surveyed works. Keywords-Intrusion detection system; Neuro-fuzzy; Support Vector Machine (SVM); PSO; K-means

With the explosion of social media sites and proliferation of digital computing devices and Internet access, massive amounts of public data is being generated on a daily basis. Efficient techniques/ algorithms to analyze this massive amount of data can provide near real-time information about emerging trends and provide early warning in case of an imminent emergency (such as the outbreak of a viral disease). In addition, careful mining of these data can reveal many useful indicators of socioeconomic and political events, which can help in establishing effective public policies. The focus of this study is to review the application of big data analytics for the purpose of human development. The emerging ability to use big data techniques for development (BD4D) promises to revolutionalize healthcare, education, and agriculture; facilitate the alleviation of poverty; and help to deal with humanitarian crises and violent conflicts. Besides all the benefits, the large-scale deployment of BD4D is beset with several challenges due to the massive size, fast-changing and diverse nature of big data. The most pressing concerns relate to efficient data acquisition and sharing, establishing of context (e.g., geolocation and time) and veracity of a dataset, and ensuring appropriate privacy. In this study, we provide a review of existing BD4D work to study the impact of big data on the development of society. In addition to reviewing the important works, we also highlight important challenges and open issues.

Various educational oriented problems are resolved through Educational Data Mining, which is the most prevalent applications of data mining. One of the crucial goals of this paper is to study the most recent works carried out on EDM and analyze their merits and drawbacks. This paper also highlights the cumulative results of the various data mining practices and techniques applied in the surveyed articles, and thereby suggesting the researchers on the future directions on EDM. In addition, an experiment was also conducted to evaluate, certain classification and clustering algorithms to observe the most reliable algorithms for future researches.


Question: An investigation into data mining frameworks within the realm of cyber security.

This paper explores the challenge of identifying significant patterns from the vast array of association rules generated through data mining techniques, a critical issue in the realm of cyber security. Association rules, first conceptualized by Agrawal, Imielinski, and Swami, are formulated as "in 90% of the database records, if the record exhibits a value of 1 in the attributes designated by set W, it also displays a value of 1 in attribute B." While advanced algorithms have been devised to efficiently extract these rules from extensive datasets, the sheer volume of resulting rules can overwhelm analysts attempting to sift through them to find truly intriguing and actionable insights. We propose a straightforward yet powerful solution through the utilization of rule templates. These templates enable users to succinctly outline the criteria for rules that are deemed interesting, effectively narrowing down the search space. Moreover, we illustrate the utility of visualization techniques in conjunction with rule templates. Visual representations not only aid in the comprehension of complex rule sets but also facilitate a more intuitive interaction with the data. Through our approach, analysts are empowered to efficiently navigate through large volumes of association rules, pinpointing those that hold the most relevance and potential for enhancing cyber security strategies.

Nowadays, all kinds of information systems store detailed information in logs. Process mining has emerged as a way to analyze these systems based on these detailed logs. Unlike classical data mining, the focus of process mining is on processes. First, process mining allows us to extract a process model from an event log. Second, it allows us to detect discrepancies between a modeled process (as it was envisioned to be) and an event log (as it actually is). Third, it can enrich an existing model with knowledge derived from an event log. This paper presents our tool ProM, which is the world-leading tool in the area of process mining.

Value of software log file analysis has been constantly increasing with the value of information to organizations. Log management tools still have a lot to deliver in order to empower their customers with the true strength of log information. In addition to the traditional uses such as testing software functional conformance, troubleshooting and performance benchmarking, log analysis has proven its capabilities in fields like intrusion detection and compliance evaluation. This is verified by the emphasis on log analysis in regulations like PCI DSS, FISMA, HIPAA and frameworks such as ISO 27001 and COBIT. In this paper we present an in depth analysis into current log analysis domains and common problems. A practical guide to the use of few popular log analysis tools is also included. Lack of proper support for structured analysis is identified as one major flaw in existing tools. After that, we describe a framework we developed for structured log analysis with the view of providing a solution to open problems in the domain. The core strength of the framework is its ability to handle many log file formats that are not well served by existing tools and providing sophisticated infrastructure for automating recurring log analysis procedures. We prove the usefulness of the framework with a simple experiment.

Cyber frauds are a major security threat to the banking industry worldwide. Malware is one of the manifestations of cyber frauds. Malware authors use Application Programming Interface (API) calls to perpetrate these crimes. In this paper, we propose a static analysis method to detect Malware based on API call sequences using text and data mining in tandem. We analyzed the dataset available at CSMINING group. First, we employed text mining to extract features from the dataset consisting a series of API calls. Further, mutual information is invoked for feature selection. Then, we resorted to over-sampling to balance the data set. Finally, we employed various data mining techniques such as Decision Tree (DT), Multi Layer Perceptron (MLP), Support Vector Machine (SVM), Probabilistic Neural Network (PNN) and Group Method for Data Handling (GMDH). We also applied One Class SVM (OCSVM). Throughout the paper, we used 10-fold cross validation technique for testing the techniques. We observed that SVM and OCSVM achieved 100% sensitivity after balancing the dataset.

Purpose – The purpose of this survey research is twofold. First, to study and report the process that is commonly used to create and maintain a competitive intelligence (CI) program in organizations. And second, to provide an analysis of several emergent text mining, web mining and visualization-based CI tools, which are specific to collection and analysis of intelligence. Design/methodology/approach – A range of recently published research literature on CI processes, applications, tools and technologies to collect and analyze competitive information within organizations is reviewed to explore their current state, issues and challenges learned from their practice. Findings – The paper provides executive decision makers and strategic managers a better understanding of what methods are available and appropriate to the decisions they must make and the steps involved in CI undertaking. Originality/value – The findings of this research provide the managers of CI programs a context for understanding which tools and techniques are better suited to their specific types of problems; and help them develop and evaluate a usable set of tools and best practices to apply to their industry.

Text mining is a new and exciting area of computer science that tries to solve the crisis of information overload by combining techniques from data mining, machine learning, natural language processing, information retrieval, and knowledge management. The Text Mining Handbook presents a comprehensive discussion of the latest techniques in text mining and link detection. In addition to providing an in-depth examination of core text mining and link detection algorithms and operations, the book examines advanced pre-processing techniques, knowledge representation considerations, and visualization approaches, ending with real-world applications.

Data Mining and Knowledge Discovery in Databases (KDD) is a research field concerned with deriving higher-level insights from data. The tasks performed in that field are knowledge intensive and can often benefit from using additional knowledge from various sources. Therefore, many approaches have been proposed in this area that combine Semantic Web data with the data mining and knowledge discovery process. Semantic Web knowledge graphs are a backbone of many information systems that require access to structured knowledge. Such knowledge graphs contain factual knowledge about real word entities and the relations between them, which can be utilized in various natural language processing, information retrieval, and any data mining applications. Following the principles of the Semantic Web, Semantic Web knowledge graphs are publicly available as Linked Open Data. Linked Open Data is an open, interlinked collection of datasets in machine-interpretable form, covering most of the real world domains. In this thesis, we investigate the hypothesis if Semantic Web knowledge graphs can be exploited as background knowledge in different steps of the knowledge discovery process, and different data mining tasks. More precisely, we aim to show that Semantic Web knowledge graphs can be utilized for generating valuable data mining features that can be used in various data mining tasks. Identifying, collecting and integrating useful background knowledge for a given data mining application can be a tedious and time consuming task. Furthermore, most data mining tools require features in propositional form, i.e., binary, nominal or numerical features associated with an instance, while Linked Open Data sources are usually graphs by nature. Therefore, in Part I, we evaluate unsupervised feature generation strategies from types and relations in knowledge graphs, which are used in different data mining tasks, i.e., classification, regression, and outlier detection. As the number of generated features grows rapidly with the number of instances in the dataset, we provide a strategy for feature selection in hierarchical feature space, in order to select only the most informative and most representative features for a given dataset. Furthermore, we provide an end-to-end tool for mining the Web of Linked Data, which provides functionalities for each step of the knowledge discovery process, i.e., linking local data to a Semantic Web knowledge graph, integrating features from multiple knowledge graphs, feature generation and selection, and building machine learning models. However, we show that such feature generation strategies often lead to high dimensional feature vectors even after

The proposed security development lifecycle (SecDLC) model delivers a perpetual cycle of information security management and refinement. Using real-world examples, the authors show how SecDLC ensures the goals of preserving, monitoring, and improving security practices, policies, and standards in private and public sectors. The authors describe the four phases of SecDLC, comparing and contrasting them to existing security development models.

This paper proposes a collaborative data mining technique to provide multi-level analysis from clinical trials data. Clinical trials for clinical research and drug development generate large amount of data. Due to dispersed nature of clinical trial data, it remains a challenge to harness this data for analytics. In this paper, we propose a novel method using master data management (MDM) for analyzing clinical trial data, scattered across multiple databases, through collaborative data mining. Our aim is to validate findings by collaboratively utilizing multiple data mining techniques such as classification, clustering, and association rule mining. We complement our results with the help of interactive visualizations. The paper also demonstrates use of data stratification for identifying disparities between various subgroups of clinical trial participants. Overall, our approach aims at extracting useful knowledge from clinical trial data in order to improve design of clinical trials by gaining confidence in the outcomes using multi-level analysis. We provide experimental results in drug abuse clinical trial data.

Outlier Detection is a Data Mining Application. Outlier contains noisy data which is researched in various domains. The various techniques are already being researched that is more generic. We surveyed on various techniques and applications of outlier detection that provides a novel approach that is more useful for the beginners. The proposed approach helps to clean data at university level in less time with great accuracy. This survey includes the existing outlier techniques and applications where the noisy data exists. Our paper defines critical review on various techniques used in different applications of outlier detection that are to be researched further and they gives a particular type of knowledge based data i.e. more useful in research activities. So where the Anomalies is present it will be detected through outlier detection techniques and monitored accordingly especially in educational Data Mining.

Today web is the best medium of communication in modern business. Many companies are redefining their business strategies to improve the business output. Business over internet provides the opportunity to customers and partners where their products and specific business can be found. Nowadays online business breaks the barrier of time and space as compared to the physical office. Big companies around the world are realizing that e-commerce is not just buying and selling over Internet, rather it improves the efficiency to compete with other giants in the market. For this purpose data mining sometimes called as knowledge discovery is used. Web mining is data mining technique that is applied to the WWW. There are vast quantities of information available over the Internet.


Question: Developing an IT governance maturity self-assessment model by integrating EFQM and CobiT.

This study delves into the development of an Information Technology Governance (ITG) maturity model that integrates both the hard and soft dimensions of ITG. The hard aspect encompasses processes and structures, while the soft aspect involves social elements such as organizational culture and behavior. Our research methodology combines a thorough literature review with the Delphi technique, utilizing a Group Decision Support System to facilitate the process. The focus of our model is on specific areas of ITG, where maturity is assessed through a series of focus areas. The investigation has led to the identification of a single maturity model suitable for the hard elements of ITG. However, for the soft aspects, a single model was not deemed universally applicable. Instead, the soft dimension of governance requires the definition of distinct capabilities for each focus area. Drawing from expert insights and literature, we have selected models for each focus area. The informal organization aspect, however, necessitates additional research to explore three potential alternatives.
The goal is to create a comprehensive ITG maturity model that can guide organizations in their governance efforts, ensuring that both the procedural and cultural dimensions are adequately addressed. By combining the hard and soft elements of IT governance, this model aims to provide a holistic view that can help organizations to assess and improve their IT governance maturity effectively. The use of the Delphi method ensures that the perspectives of multiple experts are considered, leading to a more robust and widely accepted model. The inclusion of the informal organization as a focus area highlights the importance of understanding the non-structured aspects of IT governance, which can significantly influence the overall effectiveness of governance practices.

Queensland Health, a large Australian government agency, implemented a centralised IT service management model based on the ITIL framework. This paper presents an in-depth case study of the implementation. It sheds light on the challenges and breakthroughs, confirms a set of factors that contributed to the project’s success and offers a learning opportunity for other organisations. The study indicates that the commitment of senior management is crucial to the project’s success as is a project champion and the recognition of the need for an appropriate change management strategy to transform the organisational culture to a service-oriented focus. Maintaining close and forthright relationships with multiple vendors facilitates technology transfer to in-house staff while a benefits realisation plan is a valuable tool for tracking and communicating tangible and intangible project benefits to the project stakeholders. An effective project governance and execution process further contributes to the implementation success.

Complex IT outsourcing arrangements promise numerous benefits such as increased cost predictability and reduced costs, higher flexibility and scalability upon demand. Organizations trying to realize these benefits, however, face several security and compliance challenges. In this article, we investigate the pressure to take action with respect to such challenges and discuss avenues toward promising responses. We collected perceptions on security and compliance challenges from multiple stakeholders by means of a series of interviews and an online survey, first, to analyze the current and future relevance of the challenges as well as potential adverse effects on organizational performance and, second, to discuss the nature and scope of potential responses. The survey participants confirmed the current and future relevance of the six challenges auditing clouds, managing heterogeneity of services, coordinating involved parties, managing relationships between clients and vendors, localizing and migrating data and coping with lack of security awareness. Additionally, they perceived these challenges as affecting organizational performance adversely in case they are not properly addressed. Responses in form of organizational measures were considered more promising than technical ones concerning all challenges except localizing and migrating data, for which the opposite was true. Balancing relational and contractual governance as well as employing specific client and vendor capabilities is essential for the success of IT outsourcing arrangements, yet do not seem sufficient to overcome the investigated challenges. Innovations connecting the technical perspective of utility software with the business perspective of application software relevant for security and compliance management, however, nourish the hope that the benefits associated with complex IT outsourcing arrangements can be realized in the foreseeable future whilst addressing the security and compliance challenges. a 2013 Elsevier Ltd. All rights reserved. 61. .fraunhofer.de (D. Bachlechner), stefan.thalmann@uibk.ac.at (S. Thalmann), ronald.maier@ ier Ltd. All rights reserved. c om p u t e r s & s e c u r i t y 4 0 ( 2 0 1 4 ) 3 8e5 9 39

The Information Technology Infrastructure Library (ITIL) supports best practices, reengineering activities and IT service support processes. ITIL framework only provides recommendations, and companies need to utilize this framework to improve their IT service support processes and establish best practices. This study provides a methodology on how to apply the ITIL framework for evaluating the IT service support processes, its reengineering and alignment to best practices, and subsequent integration into a decision support system framework. A case study approach was used to identify a set of Key Performance Indicators (KPI) which were monitored by a decision support system (DSS) for triggering on-going reengineering of IT service support processes. This paper focuses on the implementation of the ITIL guidelines at the operational level, improvement of the service desk, and incident, problem, change, release, and configuration management. It also presents the implementation of the ITIL guidelines at the tactical level for the improvement of the service level, capacity, IT service continuity, service availability, and security management. We conclude by providing recommendations for future research.

This paper examines the relationship between supply chain (SC) strategy and supply chain information systems (IS) strategy, and its impact on supply chain performance and firm performance. Theorizing from the supply chain and IS literatures within an overarching framework of the information processing theory (IPT), we develop hypotheses proposing a positive moderating effect of two supply chain IS strategies – IS for Efficiency and IS for Flexibility – on the respective relationships between two SC strategies – Lean and Agile, and supply chain performance. Based on confirmatory analysis and structural equation modeling of survey data from members of senior and executive management in the purchase/materials management/logistics/supply chain functions, from 205 firms, we validate these hypotheses and show that the IS for Efficiency (IS for Flexibility) IS strategy enhances the relationship between Lean (Agile) SC strategy and supply chain performance. We also show a positive association between supply chain performance and firm performance, and a full (partial) mediation effect of supply chain performance on the relation between Agile (Lean) SC strategy and firm performance. The paper contributes to the supply chain literature by providing theoretical understanding and empirical support of how SC strategies and IS strategies can work together to boost supply chain performance. In doing so, it identifies particular types of supply chain IS application portfolios that can enhance the benefits from specific SC strategies. The paper also develops and validates instruments for measuring two types of SC strategies and supply chain IS strategies. For practice, the paper offers guidance in making investment decisions for adopting and deploying IS appropriate to particular SC strategies and analyzing possible lack of alignment between applications that the firm deploys in its supply chain, and the information processing needs of its SC strategy. & 2012 Elsevier B.V. All rights reserved.

The development, implementation and ownership of information systems, especially large-scale systems such as enterprise resource planning (ERP), has become progressively longer in duration and more cost intensive. As a result, IS managers are being required to justify projects financially based on their return. Historically, information systems have been difficult to quantify in monetary terms because of the intangible nature of many of the derived benefits, e.g. improved customer service. Using the case study methodology, this paper examines an attempt by a large computer manufacturer to incorporate intangibles into traditional cost–benefit analysis in an ERP project. The paper reviews the importance of intangibles, lists intangible benefits that are important in ERP projects and demonstrates the use of a scheme through which they can be incorporated into traditional evaluation techniques.

An Enterprise Architecture Framework (EAF) maps all of the software development processes within the enterprise and how they relate and interact to fulfill the enterprise’s mission. It provides organizations with the ability to understand and analyze weaknesses or inconsistencies to be identified and addressed. There are a number of already established EAF in use today; some of these frameworks were developed for very specific areas, whereas others have broader functionality. This study provides a comparison of several frameworks that can then be used for guidance in the selection of an EAF that meets the needed criteria.

This study seeks to assess the business value of e-commerce capability and information technology (IT) infrastructure in the context of electronic business at the firm level. Grounded in the IT business-value literature and enhanced by the resource-based theory of the firm, we developed a research framework in which both the main effects and the interaction effects of e-commerce and IT on firm performance were tested. Within this theoretical framework, we formulated several hypotheses. We then developed a multidimensional e-commerce capability construct, and after establishing its validity and reliability, tested the hypotheses with empirical data from 114 companies in the retail industry. Controlling for variations of firm size and subindustry effects, our empirical analysis found a strong positive interaction effect between IT infrastructure and e-commerce capability. This suggests that their complementarity positively contributes to firm performance in terms of sales per employee, inventory turnover, and cost reduction. The results are consistent with the resource-based theory, and provide empirical evidence to the complementary synergy between front-end e-commerce capability and back-end IT infrastructure. Combined together, they become more effective in producing business value. Yet the value of this synergy has not been recognized in the IT payoff literature. The “productivity paradox” observed in various studies has been attributed to variation in methods and measures, yet we offer an additional explanation: ignoring complementarities in business value measurement implies that the impact of IT was seriously underestimated. Our results emphasized the integration of resources as a feasible path to e-commerce value—companies need to enhance the integration between front-end e-commerce capability and back-end IT infrastructure in order to reap the benefits of e-commerce investments.

Investment appraisal techniques are an integral part of many traditional capital budgeting processes. However, the adoption of Information Systems (IS) and the development of resulting infrastructures are being increasingly viewed on the basis of consumption. Consequently, decision-makers are now moving away from the confines of rigid capital budgeting processes, which have traditionally compared IS with non-ISrelated investments. With this in mind, the authors seek to dissect investment appraisal from the broader capital budgeting process to allow a deeper understanding of the mechanics involved with IS justification. This analysis presents conflicting perspectives surrounding the scope and sensitivity of traditional appraisal methods. In contributing to this debate, the authors present taxonomies of IS benefit types and associated natures, and discuss the resulting implications of using traditional appraisal techniques during the IS planning and decision-making process. A frame of reference that can be used to navigate through the variety of appraisal methods available to decision-makers is presented and discussed. Taxonomies of appraisal techniques that are classified by their respective characteristics are also presented. Perspectives surrounding the degree of involvement that financial appraisal should play during decision making and the limitations surrounding investment appraisal techniques are identified. European Journal of Information Systems (2002) 11, 74–82. DOI: 10.1057/palgrave/ejis/3000411

Context: Successful organizations need to manage and synchronize their strategic objectives with daily operations and activities. In general, achieving that requires a continuous process of organizational alignment. GQM + Strategies is an approach that helps software organizations with documenting and aligning organizational goals and strategies, and developing measurement programs. Objective: In this paper, the GQM + Strategies approach is further evolved and extended to include capabilities to evaluate the relationships of organizational goals and strategies through causal analysis. Method: We used an analytical paradigm to develop a formal causal model over the GQM + Strategies structure. In addition, an empirical pre-experimental study was designed to test practitioners’ abilities to provide necessary input for the formal causal model. Results: A developed formal causal model over the GQM + Strategies structure allows the use of causal reasoning for the purpose of analyzing dependencies among chosen sets of goals. We illustrate this by showing how to analyze the impact of risky goals on other goals in the grid. The results of the empirical study showed that the practitioners had no difficulties providing their predictions, i.e. inputs into the causal model. Conclusion: The proposed solution extends the existing GQM + Strategies knowledge base by further elaborating and clarifying the process of creating grids by introducing causality theory. The use of causality theory allows experts to quantify their knowledge and beliefs regarding the effectiveness of organizational strategies. As a part of future work, formal causal models and causal reasoning can be implemented as a supporting software tool for the GQM + Strategies approach. © 2017 Elsevier B.V. All rights reserved.

Existing models for describing a process such as a business process or a software development process tend to focus on the what or the how of the process For example a health insurance claim process would typically be described in terms of a number of steps for assessing and approving a claim In trying to improve or redesign a process however one also needs to have an understanding of the why for example why do physicians submit treatment plans to insurance companies before giving treatment and why do claims managers seek medical opinions when assessing treatment plans An understanding of the motivations and interests of process participants is often crucial to the successful redesign of processes This thesis proposes a modelling framework i pronounced i star consisting of two mod elling components The Strategic Dependency SD model describes a process in terms of in tentional dependency relationships among agents Agents depend on each other for goals to be achieved tasks to be performed and resources to be furnished Agents are intentional in that they have desires and wants and strategic in that they are concerned about opportunities and vulnerabilities The Strategic Rationale SR model describes the issues and concerns that agents have about existing processes and proposed alternatives and how they might be addressed in terms of a network of means ends relationships An agent s routines for carrying out a process can be analyzed for their ability workability viability and believability Means ends rules are used to suggest methods for addressing issues related issues to be raised and assumptions to be challenged The models are represented in the conceptual modelling language Telos The modelling concepts are axiomatically characterized The utility of the framework is illustrated in each of four application areas requirements engineering business process reengineering organizational impacts analysis and software pro cess modelling Advantages of i over existing modelling techniques in each of these areas are described


Question: Developing an IT governance maturity self-assessment model utilizing EFQM and CobiT.

This paper introduces a methodology for developing a maturity model tailored for Information Governance (IG), defined by Gartner as encompassing decision rights, accountability structures, and behaviors that promote the effective management of information's lifecycle. IG involves processes, roles, standards, and metrics designed to optimize information usage in pursuit of organizational objectives. We outline a systematic approach to creating an IG maturity model, drawing on established maturity model development techniques. These methodologies are grounded in Design Science Research, a rigorous scientific method. To illustrate the application of our proposed model, we conducted a self-assessment within the framework of the EC-funded E-ARK project, focusing on seven pilot organizations. Initial findings suggest substantial room for enhancement, with most pilots falling between maturity levels two and three. As part of our ongoing research, we aim to integrate additional references from diverse fields, such as records management, to enrich and refine the maturity model, making it a more comprehensive tool for organizations grappling with IG challenges.

Context: Successful organizations need to manage and synchronize their strategic objectives with daily operations and activities. In general, achieving that requires a continuous process of organizational alignment. GQM + Strategies is an approach that helps software organizations with documenting and aligning organizational goals and strategies, and developing measurement programs. Objective: In this paper, the GQM + Strategies approach is further evolved and extended to include capabilities to evaluate the relationships of organizational goals and strategies through causal analysis. Method: We used an analytical paradigm to develop a formal causal model over the GQM + Strategies structure. In addition, an empirical pre-experimental study was designed to test practitioners’ abilities to provide necessary input for the formal causal model. Results: A developed formal causal model over the GQM + Strategies structure allows the use of causal reasoning for the purpose of analyzing dependencies among chosen sets of goals. We illustrate this by showing how to analyze the impact of risky goals on other goals in the grid. The results of the empirical study showed that the practitioners had no difficulties providing their predictions, i.e. inputs into the causal model. Conclusion: The proposed solution extends the existing GQM + Strategies knowledge base by further elaborating and clarifying the process of creating grids by introducing causality theory. The use of causality theory allows experts to quantify their knowledge and beliefs regarding the effectiveness of organizational strategies. As a part of future work, formal causal models and causal reasoning can be implemented as a supporting software tool for the GQM + Strategies approach. © 2017 Elsevier B.V. All rights reserved.

Manuscript Type: Empirical Research Questions/Issue: This paper seeks to explore the interrelationships between corporate governance (CG) and corporate social responsibility (CSR): first, theoretically, by reviewing the literature and surveying various postulations on offer; second, empirically, by investigating the conception and interpretation of this relationship in the context of a sample of firms operating in Lebanon. Accordingly, the paper seeks to highlight the increasing cross-connects or interfaces between CG and CSR, capitalizing on fresh insights from a developing country perspective. Research Findings/Results: A qualitative interpretive research methodology was adopted, drawing on in-depth interviews with the top managers of eight corporations operating in Lebanon, with the findings suggesting that the majority of managers conceive of CG as a necessary pillar for sustainable CSR. These findings are significant and interesting, implying that recent preoccupation with CG in developing countries is starting to be counterbalanced by some interest/attention to CSR, with growing appreciation of their interdependencies and the need to move beyond CG conformance toward voluntary CSR performance. Theoretical Implications: This study makes two important contributions. First, it suggests that there is a salient two-way relationship and increasing overlap between CG and CSR. While much previous literature has researched CG and CSR independently, this paper makes the case for considering them jointly and systematically. Second, the paper outlines a number of theoretical propositions that can serve as the basis for future research on the topic, particularly in developing countries, given that the data and theoretical propositions are both derived from and tailored to developing country contexts. Practical Implications: This study can potentially alert managers to the increasing overlap between the CG and CSR agendas and the need to exert diligent systematic efforts on both fronts. CG and CSR share more in common than previously assumed, and this needs to be accounted for by practitioners. The research can also alert policy makers in developing countries to the need to increase the vigilance and capacity of the regulatory and judicial systems in the context of CG reform and to increase institutional pressures, particularly of the coercive and normative variety to enhance CSR adoption.

Measuring and improving data quality in an organization or in a group of interacting organizations is a complex task. Several methodologies have been developed in the past providing a basis for the definition of a complete data quality program applying assessment and improvement techniques in order to guarantee high data quality levels. Since the main limitation of existing approaches is their specialization on specific issues or contexts, this paper presents the comprehensive data quality (CDQ) methodology that aims at integrating and enhancing the phases, techniques and tools proposed by previous approaches. CDQ methodology is conceived to be at the same time complete, flexible and simple to apply. Completeness is achieved by considering existing techniques and tools and integrating them in a framework that can work in both intra and inter organizational contexts, and can be applied to all types of data. The methodology is flexible since it supports the user in the selection of the most suitable techniques and tools within each phase and in any context. Finally, CDQ is simple since it is organized in phases and each phase is characterized by a specific goal and techniques to apply. The methodology is explained by means of a running example.

0 7 4 0 7 4 5 9 / 0 3 / $ 1 9 . 0 0 © 2 0 0 3 I E E E All the methodologies that have been proposed recently for choosing software packages compare user requirements with the packages’ capabilities.3–5 There are different types of requirements, such as managerial, political, and, of course, quality requirements. Quality requirements are often difficult to check. This is partly due to their nature, but there is another reason that can be mitigated, namely the lack of structured and widespread descriptions of package domains (that is, categories of software packages such as ERP systems, graphical or data structure libraries, and so on). This absence hampers the accurate description of software packages and the precise statement of quality requirements, and consequently overall package selection and confidence in the result of the process. Our methodology for building structured quality models helps solve this drawback. (See the “Related Work” sidebar for information about other approaches.) A structured quality model for a given package domain provides a taxonomy of software quality features, and metrics for computing their value. Our approach relies on the International Organization for Standardization and International Electrotechnical Commission 9126-1 quality standard,6 which we selected for the following reasons:

GRC is an umbrella acronym covering the three disciplines of governance, risk management and compliance. In this context, IT GRC is the subset of GRC dealing with IT aspects of GRC. The main challenge of GRC is to have an approach as integrated as possible of the three domains. The objective of our paper is to study one facet of IT GRC: the links and integration between IT governance and risk management that we consider today as the least integrated. To do so, the method followed in this paper is a systematic literature review, in order to identify the existing research works in this field. The resulting contribution of the paper is a set of recommendations established for practitioners and for researchers on how better deal with the integration between IT governance and risk management.

According to Enterprise Architecture (EA) approaches, organizations have motivational concepts that are used to model the motivations that underlie its design or change, which represent the organization’s Business Motivation Model (BMM). Likewise, this BMM is also present in the organizations who provide IT services. ITIL has become a reference for IT service providers, but is commonly modeled as a process-oriented approach to IT Service Management, often disregarding the remaining EA domains or its motivational elements. Conversely, we believe that like EA, ITIL has an important motivation model that should be formally represented.

Many of the instruments to measure information and system quality were developed in the context of mainframe and PC-based technologies of yesteryears. With the proliferation of the Internet and World Wide Web applications, users are increasingly interfacing and interacting with web-based applications. It is, therefore, important to develop new instruments and scales, which are directly targeted to these new interfaces and applications. In this article, we report on the development of an instrument that captures key characteristics of web site quality from the userâ€TMs perspective. The 25item instrument measures four dimensions of web quality: specific content, content quality, appearance and technical adequacy. While improvements are possible, the instrument exhibits excellent psychometric properties. The instrument would be useful to organizations and web designers as it provides an aggregate measure of web quality, and to researchers in related web research. a 1, b Purchase Export Previous article Next article Check if you have access through your login credentials or your institution.

Enterprise Resource Planning (ERP) systems are among the largest information systems (IS) investments made by firms, and the use of such systems is spreading globally. Many researchers have discussed their adoption and implementation, few have investigated the impact of external contextual factors on the success of such technologies in adopting firms. This study aims to fill this gap in research by examining the effects of three external contextual factors, i.e., industry type, industry climate, and national economic climate on ERP success assessment. We obtained data from Estonia and Finland and our analysis shows that industry and national economic climates have significant relationships with ERP success.

This paper describes experiences from two organizations that have used the Riskit method for risk management in their software projects. This paper presents the Riskit method, the organizations involved, case study designs, and findings from case studies. We focus on the experiences and insights gained through the application of the method in industrial context and propose some general conclusions based on the case studies.

This study aims to understand the fundamental factors influencing the citizen’s continuance intention to use eGovernment websites by using the Technology Acceptance Model (TAM) as a based theoretical model. Computer selfefficacy is adopted as an additional factor that influences the citizen’s continuance intention to use e-Government websites. To empirically test the proposed research model, the web-based survey was employed. The participants consisted of 614 country-wide citizens with at least a bachelor’s degree and an experience with e-Government websites. Regression analysis was conducted to test the model. The results revealed that perceived usefulness and perceived ease of use of e-Government websites and citizen’s computer self-efficacy directly enhanced citizen’s continuance intention to use e-Government websites. In addition, perceived ease of use of e-Government websites indirectly enhanced citizen’s continuance intention through perceived usefulness.


Question: Developing an IT governance maturity self-assessment model utilizing EFQM and CobiT.

This article introduces the concept of method engineering, which focuses on the creation and refinement of information systems development methodologies and associated tools. Several key research areas within method engineering are outlined. A significant area of investigation is the development of situational methods, which involve customizing a project methodology to suit the specific requirements and context of the project in question. The paper delves into a language and support tool designed to facilitate the engineering of situational methods, enhancing their adaptability and effectiveness. By tailoring methodologies to fit individual project needs, method engineering aims to improve the efficiency and success rates of information systems development projects.

IT infrastructure flexibility is now being viewed as an organizational core competency that is necessary for organizations to survive and prosper in rapidly-changing, competitive, business environments. Using data from 200 U.S. and Canadian companies, this study examines the impact of the four components of IT infrastructure flexibility (compatibility, connectivity, modularity, and IT personnel) on strategic IT-business alignment and the extent to which various applications are implemented within an organization. The “extent” of implementation refers to the the organization’s experience with the particular application and the degree to which the application is implemented and used throughout the organization. The findings from analysis of a structural model provide evidence that connectivity, modularity, and IT personnel (among other considerations that we discuss in the paper) make significant, positive impacts on strategic alignment and that all four components result in significant, positive impacts on the applications implementation. The study reinforces the importance of IT infrastructure flexibility to organizations as one source for sustainable competitive advantage.

Received: 13 December 2001 Revised: 27 March 2002 : 26 July 2002 Accepted:15 October 2002 Abstract The business model concept is becoming increasingly popular within IS, management and strategy literature. It is used within many fields of research, including both traditional strategy theory and in the emergent body of literature on e-business. However, the concept is often used independently from theory, meaning model components and their interrelations are relatively obscure. Nonetheless, we believe that the business model concept is useful in explaining the relation between IS and strategy. This paper offers an outline for a conceptual business model, and proposes that it should include customers and competitors, the offering, activities and organisation, resources and factor market interactions. The causal inter-relations and the longitudinal processes by which business models evolve should also be included. The model criticises yet draws on traditional strategy theory and on the literature that addresses business models directly. The business model is illustrated by an ERP implementation in a European multi-national company. European Journal of Information Systems (2003) 12, 49–59. doi:10.1057/ palgrave.ejis.3000446

Alessandro Cimatti 1, Edmund Clarke2, Enrico Giunchiglia3, Fausto Giunchiglia 4, Marco Pistore1, Marco Roveri 1, Roberto Sebastiani 4, and Armando Tacchella 3 1 ITC-IRST, Via Sommarive 18, 38050 Trento, Italy fcimatti,pistore,roverig@irst.itc.it 2 Carnegie Mellon University, 5000 Forbes Avenue, Pittsburgh (PA), USA emc@cs.cmu.edu 3 DIST – Università di Genova, Viale Causa 13, 16145 Genova, Italy fenrico,tacg@mrg.dist.unige.it 4 Università di Trento, Via Sommarive 14, 38050 Trento, Italy ffausto,rsebag@science.unitn.it

With the rapid change of business competitive environment, enterprise resource integration and innovative issues of business operation have gradually become the most important issues for businesses. Furthermore, many enterprises have implemented novel information technology and developing the innovative e-business applications systems such as enterprise resource planning (ERP), customer relationship management (CRM), knowledge management (KM) and supply chain management (SCM) to enhance their competitive advantages. CRM systems can help organizations to gain the potential new customers, promote the existing customers’ purchase, maintain good relationship with customers as well as to enhance the customer value, thus can improve the enterprise images. Moreover, the development and applications of CRM systems have also been considered as important issues for researchers and practitioners in recent years. For Taiwan’s industry, it has been gradually transferred from manufacturing-oriented to a service-oriented. Thus, the service industry has higher percentage in the GDP and in which the distribution service industry is the biggest one and be a core industry in the whole of service industry. The main purpose of this study is to explore the factors affecting the acceptance and use of CRM systems. Furthermore, the proposed research model was built on the basis of unified theory of acceptance and use of technology (UTAUT) and task-technology fit (TTF) framework as well as technological and managerial theories. The implications of findings for practice will be discussed. 2010 Elsevier Ltd. All rights reserved.

So far, there is little research on accounting information system risk assessment in our country. In order to provide the basis to meet the security needs of the accounting information system and reduce the risk of accounting information system security, reduce financial loses and improve the work efficiency, a model of enterprise accounting information system risk assessment method based on Analytic Hierarchy Process is proposed. The analytic hierarchy process model is applied to one corporate accounting information system for risk assessment. It can be concluded that the proposed method get better result of risk assessment, and have strong operability and effectiveness of risk assessment in the accounting information system for enterprise.

The actual problem of information security (infosec) risk assessment is determining the value of information property or asset. This is particularly manifested through the use of quantitative methodology in which it is necessary to state the information value in quantitative sizes. The aim of this paper is to describe the evaluation possibilities of business information values, and the criteria needed for determining importance of information. For this purpose, the dimensions of information values will be determined and the ways used to present the importance of information contents will be studied. There are two basic approaches that can be used in evaluation: qualitative and quantitative. Often they are combined to determine forms of information content. The proposed criterion is the three-dimension model, which combines the existing experiences (i.e. possible solutions for information value assessment) with our own criteria. An attempt for structuring information value in a business environment will be made as well.

Building on an analysis of the Sarbanes-Oxley Act, literature, as well as private and public interviews, this paper hopes to shed light on the potential impact of Sarbanes-Oxley for IT governance, IT budgets, and relationships with vendors and outsourcers. Findings have implications for research as well as practical lessons-learned for American firms, and for IT vendors or other companies doing business with American companies.

Recent trust research in the information systems (IS) field has described trust as a primary predictor of technology usage and a fundamental construct for understanding user perceptions of technology. Initial trust formation is particularly relevant in an IS context, as users must overcome perceptions of risk and uncertainty before using a novel technology. With initial trust in a more complex, organizational information system, there are a number of external determinants, trusting bases, that may explain trust formation and provide organizations with the needed levers to form or change individuals’ initial trust in technology. In this study, a research model of initial trust formation is developed and includes trusting bases, trusting beliefs, trusting attitude and subjective norm, and trusting intentions. Eight trusting base factors are assessed including personality, cognitive, calculative, and both technology and organizational factors of the institutional base. The model is empirically tested with 443 subjects in the context of initial trust in a national identity system (NID). The proposed model was supported and the results indicate that subjective norm and the cognitive–reputation, calculative, and organizational situational normality base factors significantly influence initial trusting beliefs and other downstream trust constructs. Factors from some of the more commonly investigated bases, personality and technology institutional, did not significantly affect trusting beliefs. The findings have strategic implications for agencies implementing e-government systems and organizational information systems in general. Published by Elsevier B.V.

An Enterprise Architecture Framework (EAF) maps all of the software development processes within the enterprise and how they relate and interact to fulfill the enterprise’s mission. It provides organizations with the ability to understand and analyze weaknesses or inconsistencies to be identified and addressed. There are a number of already established EAF in use today; some of these frameworks were developed for very specific areas, whereas others have broader functionality. This study provides a comparison of several frameworks that can then be used for guidance in the selection of an EAF that meets the needed criteria.

The Information Technology Infrastructure Library (ITIL) supports best practices, reengineering activities and IT service support processes. ITIL framework only provides recommendations, and companies need to utilize this framework to improve their IT service support processes and establish best practices. This study provides a methodology on how to apply the ITIL framework for evaluating the IT service support processes, its reengineering and alignment to best practices, and subsequent integration into a decision support system framework. A case study approach was used to identify a set of Key Performance Indicators (KPI) which were monitored by a decision support system (DSS) for triggering on-going reengineering of IT service support processes. This paper focuses on the implementation of the ITIL guidelines at the operational level, improvement of the service desk, and incident, problem, change, release, and configuration management. It also presents the implementation of the ITIL guidelines at the tactical level for the improvement of the service level, capacity, IT service continuity, service availability, and security management. We conclude by providing recommendations for future research.


Question: Developing an IT governance maturity self-assessment model integrating EFQM and CobiT.

This paper outlines a comprehensive approach to developing maturity models specifically tailored for IT management. Unlike generic models, this framework integrates elements from the European Foundation for Quality Management (EFQM) and the Control Objectives for Information and Related Technologies (COBIT) to create a specialized tool for assessing and enhancing IT governance. The proposed model emphasizes the importance of aligning IT strategies with overall business objectives, ensuring effective resource management, and promoting continuous improvement. By incorporating EFQM's excellence model and COBIT's best practices for IT governance, the maturity model offers a structured pathway for organizations to evaluate their current IT management practices and identify areas for enhancement. This integrated approach not only aids in the self-assessment of IT governance maturity but also supports the development of strategies for achieving higher levels of maturity and efficiency in IT operations. Through a systematic analysis of IT processes, controls, and performance metrics, the model facilitates a holistic view of IT management capabilities and enables organizations to make informed decisions about resource allocation and improvement initiatives.

The work described in this paper is an investigation of COTS-based software development within a particular NASA environment, with an emphasis on the processes used. Fifteen projects using a COTS-based approach were studied and their actual process was documented. This process is evaluated to identify essential differences in comparison to traditional software development. The main differences, and the activities for which projects require more guidance, are requirements definition and COTS selection, high level design, integration and testing. Starting from these empirical observations, a new process and set of guidelines for COTS-based development are developed and briefly presented.

The purpose of this paper is to present and test a modeling procedure because researchers have struggled for decades to develop stages-of-growth models that are both theoretically founded and empirically validated. This article presents the concept and hypothesis of stages, the history of stage models, and a procedure that may serve as a useful tool in modeling stages of growth. Based on previous research and lessons learned from case study experience of the government sector in Norway, a procedure for the stages of growth modeling process is suggested and demonstrated. The procedure is used for developing a stage model for e-government interoperability. This article provides new insight into issues and challenges faced when engaging in stages of growth research. The paper proposes a new approach to stages of growth modeling. The utility of the suggested procedure is to improve theory building and empirical validation. The contribution to academia is the modeling process that can be applied in future developments of stages of growth. The contribution to practice lies in the stage hypothesis of organizational development over time.

The protection of information technology (IT) has become and is predicted to remain a key economic challenge for organizations. While research on IT security investment is fast growing, it lacks a theoretical basis for structuring research, explaining economictechnological phenomena and guide future research. We address this shortcoming by suggesting a new theoretical model emerging from a multi-theoretical perspective adopting the Resource-Based View and the Organizational Learning Theory. The joint application of these theories allows to conceptualize in one theoretical model the organizational learning effects that occur when the protection of organizational resources through IT security countermeasures develops over time. We use this model of IT security investments to synthesize findings of a large body of literature and to derive research gaps. We also discuss managerial implications of (closing) these gaps by providing practical examples.

With the rapid change of business competitive environment, enterprise resource integration and innovative issues of business operation have gradually become the most important issues for businesses. Furthermore, many enterprises have implemented novel information technology and developing the innovative e-business applications systems such as enterprise resource planning (ERP), customer relationship management (CRM), knowledge management (KM) and supply chain management (SCM) to enhance their competitive advantages. CRM systems can help organizations to gain the potential new customers, promote the existing customers’ purchase, maintain good relationship with customers as well as to enhance the customer value, thus can improve the enterprise images. Moreover, the development and applications of CRM systems have also been considered as important issues for researchers and practitioners in recent years. For Taiwan’s industry, it has been gradually transferred from manufacturing-oriented to a service-oriented. Thus, the service industry has higher percentage in the GDP and in which the distribution service industry is the biggest one and be a core industry in the whole of service industry. The main purpose of this study is to explore the factors affecting the acceptance and use of CRM systems. Furthermore, the proposed research model was built on the basis of unified theory of acceptance and use of technology (UTAUT) and task-technology fit (TTF) framework as well as technological and managerial theories. The implications of findings for practice will be discussed. 2010 Elsevier Ltd. All rights reserved.

The growth of e-commerce and mobile services has been creating business opportunities. Among these, mobile marketing is predicted to be a new trend of marketing. As mobile devices are personal tools such that the services ought to be unique, in the last few years, researches have been conducted studies related to the user acceptance of mobile services and produced results. This research aims to develop a model of mobile e-commerce mobile marketing system, in the form of computer-based information system (CBIS) that addresses the recommendations or criteria formulated by researchers. In this paper, the criteria formulated by researches are presented then each of the criteria is resolved and translated into mobile services. A model of CBIS, which is an integration of a website and a mobile application, is designed to materialize the mobile services. The model is presented in the form of business model, system procedures, network topology, software model of the website and mobile application, and database models.

This paper presents a conceptual framework aiming to better research, understand and develop Green IT within organizations. Based on a literature review on Green IT, regarding the concepts of responsibility and sustainability, we propose an initial framework with five dimensions: ethical, technological, economical, social and environmental. These dimensions compose Green IT strategies and practices. Additionally, the framework considers that environmental changing requirements, strategic requirements and dynamic capabilities are the forces which move organizations toward green practices and foster innovation. This framework is part of a five-year horizon project that began in 2009 and aims to contribute to the theory in the field, having as initial goal to identify the constructs associated with Green IT.

Background: In 2004 the concept of evidence-based software engineering (EBSE) was introduced at the ICSE04 conference. Aims: This study assesses the impact of systematic literature reviews (SLRs) which are the recommended EBSE method for aggregating evidence. Method: We used the standard systematic literature review method employing a manual search of 10 journals and 4 conference proceedings. Results: Of 20 relevant studies, eight addressed research trends rather than technique evaluation. Seven SLRs addressed cost estimation. The quality of SLRs was fair with only three scoring less than 2 out of 4. Conclusions: Currently, the topic areas covered by SLRs are limited. European researchers, particularly those at the Simula Laboratory appear to be the leading exponents of systematic literature reviews. The series of cost estimation SLRs demonstrate the potential value of EBSE for synthesising evidence and making it available to practitioners. ! 2008 Elsevier B.V. All rights reserved.

6 The subject of Building Information Modelling (BIM) has become a central topic to the improvement of the AECOO 7 (Architecture, Engineering, Construction, Owner and Operator) industry around the world, to the point where the 8 concept is being expanded into domains it was not originally conceived to address. Transitioning BIM into the 9 domain of infrastructure projects has provided challenges and emphasized the constructor perspective of BIM. 10 Therefore, this study aims to collect the relevant literature regarding BIM within the Infrastructure domain and its 11 use from the constructor perspective to review and analyse the current industry positioning and research state of 12 the art, with regards to the set criteria. The review highlighted a developing base of BIM for infrastructure. From 13 the analysis, the related research gaps were identified regarding information integration, alignment of BIM 14 processes to constructor business processes & the effective governance and value of information. From this a 15 unique research strategy utilising a framework for information governance coupled with a graph based distributed 16 data environment is outlined to further progress the integration and efficiency of AECOO Infrastructure projects. 17

1474-0346/$ see front matter 2010 Elsevier Ltd. A doi:10.1016/j.aei.2010.06.003 * Tel.: +386 1 4768 521; fax: +386 1 4250 681. E-mail address: tomo.cerovsek@fgg.uni-lj.si This study provides a review of important issues for ‘Building Information Modelling’ (BIM) tools and standards and comprehensive recommendations for their advancement and development that may improve BIM technologies and provide a basis for inter-operability, integration, model-based communication, and collaboration in building projects. Based on a critical review of Building Product Modelling, including the development of standards for exchange and the features of over 150 AEC/O (Architecture, Engineering, Construction, and Operation) tools and digital models, a methodological framework is proposed for improvements to both BIM tools and schemata. The features relevant to the framework were studied using a conceptual process model and a ‘BIM System-of-Systems’ (BIM-SoS) model. The development, implementation, and use of the BIM Schema are analysed from the standpoint of standardisation. The results embrace the requirements for a BIM research methodology, with an example of methods and procedures, an R&D review with critique, and a multi-standpoint framework for developments with concrete recommendations, supported by BIM metrics, upon which the progress of tools, models, and standards may be measured, evaluated, streamlined, and judged. It is also proposed that any BIM Schema will never be ‘completed’ but should be developed as evolutionary ontology by ‘segmented standpoint models’ to better account for evolving tools and AEC/O practices. 2010 Elsevier Ltd. All rights reserved.

An Enterprise Architecture Framework (EAF) maps all of the software development processes within the enterprise and how they relate and interact to fulfill the enterprise’s mission. It provides organizations with the ability to understand and analyze weaknesses or inconsistencies to be identified and addressed. There are a number of already established EAF in use today; some of these frameworks were developed for very specific areas, whereas others have broader functionality. This study provides a comparison of several frameworks that can then be used for guidance in the selection of an EAF that meets the needed criteria.