A Comparison of Hooking with Snatch Method for an Error 
Detection on Multimedia Collaboration Environment

Eung-Nam Ko
Department of Information & Communication
Cheonan University
110 Anseo-Dong, Cheonan, ChungNam, Korea, 330-704
Korea

Abstract: - This paper proposes a merit of hooking through comparison of hooking with snatch method for an error detection on multimedia collaboration environment. A snatch is a method which intercepts all GDI(Graphic Device Interface) event. GDI snatching method is an event communication of hardware oriented between application program and graphic device driver. A hooking is a method which intercepts a communication message between window processes. This paper explains a performance analysis of an error detection system running on multimedia collaboration environment using the rule-based DEVS(Discrete Event System Specification) modeling and simulation technique. DEVS formalism introduced by Zeigler(1976). In DEVS, a system has a time base, inputs, states, outputs, and functions. A merit of hooking method is described for error detection in an interval time.
 
Key-Words: - hooking method, snatch method, GDI, error detection, multimedia collaboration environment, DEVS.

1   Introduction
Networked computer systems designed to support collaboration allow multiple users to exchange information, share data, interact with ideas, and cooperate on common goals across geographical and time boundaries. The development of communication and data networks enables collaborative systems to support diverse activities such as crisis management , cross-continental conferencing, and distributed learning. Moreover, multimedia is deployed in collaboration to enhance usability and productivity. For example, in addition to the text and graphics information in text-chat and whiteboard, stream-based media such as audio and video are widely used[1-5]. 
These components are not always guaranteed to support enough reliability and availability for the applications. It is critical to discuss how to make and keep the systems so reliable and available that even fault-tolerant applications could be computed in the systems[6]. One of conventional methods detects an error by intercepting all GDI event. This paper proposes a method of detection to find an error by hooking only the process. In this paper, we would like to discuss a new method of performance analysis of error detection system running on multimedia collaboration environment using the rule-based SES and DEVS modeling and simulation technique. In DEVS, a system has a time base, inputs, states, outputs, and functions. The purpose of this paper is to compare and analyze a performance of proposed method with conventional method by using DEVS formalism for a fault detection system running on multimedia collaboration environment. 
 The rest of this paper is organized as follows.  In section 2, Discrete event modeling, DEVS(Discrete Event System Specification) formalism ,and SES(System Entity Structure) are reviewed.  In section 3, we show hooking technique of EDA running on multimedia collaboration environment. In section 4, we propose a modeling for an error detection and performance analysis of proposed method with conventional method by using DEVS formalism. Finally, in section 5, we summarize our paper. 

2   Related Works
The DEVS-Scheme environment is based on two formalism:discrete event-system specification(DEVS) [7,8].  In this section, DEVS are reviewed.    

2.1	Discrete Event Simulation
Differential equations employed to describe continuous systems have a long history of development whose mathematical formalization came well before the advent of the computer. In contrast, discrete event simulations were made possible by, and evolved with, the growing computational power of computers. Since the early 70’s work has been proceeding on a mathematical formalism for modeling discrete event systems. One approach, inspired by the systems theory concepts of Zadeh and Dosoer(1963), Wymore(1967), Mesarovic and Takahara(1975), and Arbib and Padulo(1974), attempted to cast both continuous and discrete event models within a common systems modeling framework. This approach was elaborated in a number of publications primarily summarized in the books(Zeigler, 1976) and (Zeigler, 1984a), and is reviewed in (Zeigler, 1984b). Systems modeling concepts were an important facet in a movement to develop a methodology under which simulation could be performed in a more principled and secure manner. The recent advent of high performance artificial intelligence software and hardware has facilitated the transfer of this simulation methodology from research to practice(Elzas et al., 1986)[8,11]. 

2.2	DEVS formalism
The DEVS formalism introduced by Zeigler provides a means of specifying a mathematical object called  a system. The DEVS formalism is a theoretical, well grounded means of expressing hierarchical , modular discrete event models.  Basically, a system has a time base, inputs, states, and outputs, and functions for determining next states and outputs given current states and inputs. In the DEVS formalism are defined by the structure[9-12]. 

M = < X, S, Y, int, ext, , ta >  
       where  X: a set of input events,
                 S: a set of sequential states,
                 Y: a set of output events,                       
                 Int:S->S: internal transition function,                        
                    ext: Q x X -> S : external transition function
                                   :  S -> Y: output function
                       ta  :  time advance function.

Basic models may be coupled in the DEVS formalism to form a multi-component model which is defined by the structure[9-12].
DN = < D, {Mi}, {Ii}, {Zij}, select >
       where DN: Diagraph Network,    
                D :  a set of component names,
               {Mi}: a component basic model 
               {Ii}: a set, the influences of I and for each j in Ii, 
               {Zij}: a function, the I-to-j output transition, 
             select: a function , the tie-breaking selector.

3 An Error Hooking Technique
This paper is described a performance analysis of an error detection system running on multimedia collaboration environment using the rule-based DEVS modeling and simulation technique. 

3.1	Multimedia Collaboration Environment
DOORAE(Distributed Object Oriented  collaboRAtion  Environment) is a  framework technology for computer collaborative work. It has been running since April 1996 at SKKU(Sung Kyun Kwan Univ.) in Korea. It has primitive service functions. Service functions in DOORAE are implemented with object oriented concept. We call agent layer. As shown in figure 1, the organization of DOORAE includes 4 layers. The four layers consist of a communication layer, a system layer, a DOORAE agent layer, and a multimedia application layer. 

<Application Layer>

      <DOORAE
           Layer>

<System Layer>

<Communication
                                                     Layer>

Application

ATM, Ethernet, PSDN

Windows 98/NT/2000/XP

EDA/
ERA

GSM

Service
agents

LSM1

LSM2

LSM3

Fig. 1 The organization of DOORAE layer

3.2 Hooking Technique for EDA  
EDRA consists of EDA(Error Detection Agent) and ERA(Error Recovery Agent). EDA consists of  ED(Error Detector), EC(Error Classifier) and EL(Error  Learner). EDA is an agent which plays a role in detecting, and classifying errors. ED is an agent which plays a role as an interface to interact among an application, EC and EL. As shown in figure 2, ED has functions which detect an error by using hooking technique. 
EDA detects an error by using a hooking method in MS-Windows API(Application Program Interface). When an error occurs, A hook is a point in the Microsoft Windows message-handling mechanism where an application can install a subroutine to monitor the message traffic in the system and process certain types of messages before they reach the target window procedure. Windows contains many different types of hook. The roles of error and application program sharing are divided into two main parts; Abstraction and sharing of view generation. Error and application program sharing must take different from each other according to number of replicated application program and an event command. This proposed structure is distributed architecture but for error and application program sharing, centralization architecture is used. As shown in Fig.2, error and application program sharing windows perform process communication of message form. In the middle of this process, there are couple ways of snatching message by error and application sharing agent.

<<E

Network       view /event                  view/event  

application

<EDA>

<EDA>
hook table

Event
Distri-
buter

Filter
function

<EDA>

<EDA>

Virtual app.

Virtual  app.

Filter func.

Filter func.

Fig.2 Error and Application Sharing Process

ED informs EC of the results of detected errors. ED inspects applications by using a hooking technique to find an error. EC and EL deal with learning in reactive multi-agent systems. Generally, learning rules may be classified as supervised or unsupervised. KB has a registration information of creation of service handle and session manager handle by Daemon and GSM. EC can decide whether it is hardware error or software error based on learning rules by EL. In case of hardware error, it cannot be recoverable. In case of software error, it can be recoverable.  This approach is based on the idea of comparing the expected error type which is generated by an EL with the actual error occurred from sites. 

4	Performance Analysis by DEVS
To evaluate the performance of the proposed system, an error detection method was used to compare the performance of the proposed model against the conventional model by using DEVS formalism. 

(Simulation 1)
  In the first simulation, we have considered composition component as shown in Table 1. The atomic models are EF, RA1, and ED1. The combination of atomic models makes a new coupled model. First, it receives input event, i.e., polling interval. The value is an input value in RA1. An output value is determined by the time related simulation process RA1. The output value can be an input value in ED1. An output value is determined by the time related simulation process ED1. We can observe the result value through transducer.

Table 1  Atomic Model and State Variable
Component	State
Variable	Contents	
EF(genr)	Poll_int	Polling interval	
RA1	Ra_re_time
App_cnt

Ra_re_t_a	Response time
The number of     application program
Accumulated response 
     time	
ED1	Tat_t_a	RAaccumulated response time 	
 
(Simulation 2)
In the second simulation, we have considered composition component as shown in Table 2. The atomic models are EF, RA2, and ED2. The combination of atomic models makes a new coupled model. First, it receives input event, i.e., polling interval. The value is an input value in RA2. An output value is determined by the time related simulation process RA2. The output value can be an input value in ED2. An output value is determined by the time related simulation process ED2. We can observe the result value through transducer.
Table 2  Atomic Model and State Variable
Component	State
Variable	Contents	
EF
(genr)	Poll_int	polling interval	
RA2	Ra_re_time
App_cnt

Ra_re_t_a	Response time
The number of 
    application program
Accumulated response 
     time	
ED2	Tat_t_a	RAaccumulated response 
     time 	

We can observe the following. The error detected time interval is as follows.  
Conventional method: 
2*Poll_int* App_ cnt
Proposed method:
             1*Poll_int
Therefore, proposed method is more efficient than conventional method in error detected method  because of App_cnt >= 1. We have compared the performance of the proposed method with conventional method. 
  The problem of rapid increase in communication load due to one transmission even with presence of many users, using simultaneous broadcasting. Application program sharing windows perform process communication of message form. In the middle of this process, there are couple ways of snatching message by application sharing agent, windows hooking method and GDI snatching method.
For example, we have compared the performance of  hooking with snatch method during some interval time by using MS-Word and MS-Powerpoint as shown table 3. Therefore, proposed method is more efficient than conventional method in error detected method  because of  function number.

Table 3.  Comparison of Hooking with Snatch Method  during Some Interval
	MS-Word	MS-Powerpoint	
	Event
Hooking	GDI
snatch	Event
Hooking	GDI
snatch	
Function
Call		133,256		43,830	
Keyboard	411		892		
Mouse	597		340		
Function
Number	1,008	133,256	1,232	43,830	

5	Conclusion
The main idea is to detect an error by a hooking method. Also it is to classify the type of errors by using learning rules. The merit of this system is to use the same method to recovery it as it creates a session. EDA is a system that is able of detecting software an error based on multimedia collaboration environment. Conventional method detects an error by snatching it. This paper explained a performance analysis of an error detection system running on multimedia collaboration environment using the rule-based DEVS modeling and simulation technique. The weak point of this system is limited to DOORAE. 
Our future work is to extend to autonomous agents for detecting and recovering error and to generalize it to adjust any other system. The focus of situation-aware ubiquitous computing has increased lately. An example of situation-aware applications is a multimedia education system. The development of multimedia computers and communication techniques has made it possible for a mind to be transmitted from a teacher to a student in distance environment. This paper proposes an Adaptive Fault Tolerance (AFT) algorithm in situation-aware middleware framework and presents its simulation model of AFT-based agents. 

References:
[1]S. Shervin, J.C. Oliveria, and N.D. Georganas, “Applet-based multimedia telecollaboration: a network-centric approach”, IEEE Multimedia, Spring/Summer 1998.
[2]A. Chabert, E. Grossman, L.Jackson, S. Pietrowicz, and C.Seguin, “Java object-sharing in Habanero”, Communications of the ACM, 41(6): 69-76, 1998.
[3]I. Marsic, “DISCIPLE: A framework for multimodal collaboration in heterogeneous environments”, ACM Computing Survey, 1999.
[4]M. Roseman and S. Greenberg, “Building real-time groupware with GroupKit, a groupware toolkit”, ACM Transactions on Computer-Human Interaction, 3(1): 66-106,1996.
[5]Liang Cheng and Ivan Marsic, “Multi-Level Reliability In Multimedia Collaboration Over Heterogeneous Networks”, 2000 IEEE International Conference on Multimedia and Expo ICME2000, July 30 – August 2 2000, New York, USA, pp.501-504. 
[6]Hiroaki Higaki, Kenji Shima, Takaynki Tachikawa, Makoto Takizawa, Checkpoint and Rollback in        Asynchronous Distributed Systems, IEEE Infocom’97 Proceedings Volume 3, April 7-12, 1997, 1000-1007.
[7]Bernard P.Zeigler, Tae H. Cho, and Jerzy W. Rozenblit, A Knowledge-Based Simulation Environment for Hierarchical Flexible Manufacturing, IEEE Transaction  on Systems, Man, and Cybernetics-Part A: System and  Humans, Vol. 26, No. 1, January 1996, 81-90.
[8] Tae H. Cho, Bernard P.Zeigler, Simulation of Intelligent Hierarchical Flexible Manufacturing: Batch Job Routing in Operation Overlapping, , IEEE Transaction on Systems, Man, and Cybernetics-Part A: System and      Humans, Vol. 27, No. 1, January 1997, 116-126.
[9]Bernard P.Zeigler, Object-Oriented Simulation with hierarchical, Modular Models, Academic Press,1990.
[10]Bernard P.Zeigler, Multifacetted Modeling and Discrete Event Simulation, Orlando, FL: Academic,      1984.
[11]Bernard P.Zeigler, Theory of Modeling and Simulation, John Wiley, NY, USA, 1976, reissued by Krieger, Malabar, FL, USA, 1985.
[12]A.I. Conception and B.P. Zeigler, The DEVS formalism: Hierarchical model development, IEEE Trans. Software Eng., vol. 14, no.2, 1988, 228-241.