PhD Natacha Fouquet
email: natacha.fouquet@univ-angers.fr

J Bodin

E Chazelle

A Descatha

Y Roquelaure

Use of multiple data sources for surveillance of work-related chronic low-back pain and disc-related sciatica in a French region

Keywords: epidemiological surveillance, prevention index, low back pain, disc-related sciatica, industry sector

Objective. To compare the data of the French workers' compensation system (WCS) and three surveillance networks, and to determine the possibility of identifying the industry sectors most in need of programs for prevention of low back pain (LBP).

Methods

. This study compared four databases and two types of indicators in a west central region of France: • surveillance of musculoskeletal symptoms in the working population (LBP and disc-related sciatica (DRS) indicators; Cosali study) • surveillance of uncompensated work-related diseases (LBP and DRS indicators) • surveillance of lumbar disc surgery (LDS) in the general population (DRS indicator) • French WCS (disc herniation with radiculopathy caused by vibration or handling of materials; DRS indicator) People aged 20-59 were studied. The prevention index (PI) was used to rank industry sectors according to the number of cases and the prevalence/incidence rate.

Results. Construction and manufacturing were the first sectors in terms of PI for men in all databases and indicators. Moreover, transport and agriculture were not consistently highlighted. For women, manufacturing was the leading sector (except for the LDS study: health sector), followed by the health sector. Specific epidemiologic surveillance networks (LDS and Cosali studies) provided ranking of the greatest number of sectors out of the 17 classified. For DRS indicators, the LDS study classified 13 sectors for both genders, and for LBP indicators, the Cosali study ranked 8 and 7 sectors in men and women, respectively.

Discussion. The results showed the complementarity of the four surveillance programs. A multi-component surveillance system allowed detection of industry sectors most in need of prevention programs.

Introduction

Low back pain (LBP) is the leading cause of musculoskeletal morbidity in the workplace (Inserm, 2000).

Almost 50% of European workers report suffering from back pain (Eurofound, 2012), and LBP is among the top six health problems in terms of costs for society [START_REF] Dagenais | A systematic review of low back pain cost of illness studies in the United States and internationally[END_REF] and one of the three most disabling types of pain in developed countries [START_REF] Lamb | Group cognitive behavioural treatment for low-back pain in primary care: a randomised controlled trial and costeffectiveness analysis[END_REF]. LBP causes considerable human and social costs in terms of pain and discomfort in the workplace and everyday life [START_REF] Punnett | Estimating the global burden of low back pain attributable to combined occupational exposures[END_REF][START_REF] Burton | Chapter 2. European guidelines for prevention in low back pain : November 2004[END_REF] and in terms of health related quality of life [START_REF] Yamada | Prevalence of low back pain as the primary pain site and factors associated with low health-related quality of life in a large Japanese population: a pain-associated cross-sectional epidemiological survey[END_REF]. In addition to the intensity of the pain, the severity of LBP is mainly due to the disability it causes [START_REF] Loisel | Cost-benefit and cost-effectiveness analysis of a disability prevention model for back pain management: a six year follow up study[END_REF]. It generates substantial direct costs associated with seeking medical and paramedical care and diagnostic procedures [START_REF] Walker | Low back pain in Australian adults: the economic burden[END_REF][START_REF] Ritzwoller | The association of comorbidities, utilization and costs for patients identified with low back pain[END_REF][START_REF] Becker | Low back pain in primary care: costs of care and prediction of future health care utilization[END_REF] and especially indirect costs (compensation, job loss, etc.) which are at least 5-6 times higher.

In France, chronic LBP with disc herniation with radiculopathy caused by vibration or manual handling of loads is the only work-related LBP in Tables of occupational diseases (OD) recognized by the workers' compensation system since 1999 [START_REF] Roquelaure | Déclarer une lombosciatique en maladie professionnelle : est-ce l'avantage bien compris du patient ?[END_REF]INRS, 2016). The restrictive recognition criteria in terms of diagnosis and occupational exposure have meant that the workers' compensation system is known to provide an underestimation of the extent of the phenomenon of LBP at work [START_REF] Rivière | Underreporting of musculoskeletal disorders in 10 regions in France in 2009[END_REF][START_REF] Stock | Underreporting work absences for nontraumatic work-related musculoskeletal disorders to workers' compensation: results of a 2007-2008 survey of the Québec working population[END_REF]. For several years, the only source of information available in France to describe the current increasing number of musculoskeletal disorders (MSDs) has been workers' compensation claims.

Santé publique France, the French national public health agency, therefore implemented a pilot, multicomponent epidemiological surveillance system for work-related MSDs in the Pays de la Loire region in 2002 [START_REF] Ha | The French Musculoskeletal Disorders Surveillance Program: Pays de la Loire network[END_REF][START_REF] Fouquet | Surveillance des lombalgies et de leurs facteurs de risque professionnels dans les entreprises des Pays de la Loire[END_REF][START_REF] Roquelaure | Epidemiological surveillance of lumbar disc surgery in the general population: a pilot study in a French region[END_REF]. This program combined three main components: 1) epidemiological surveillance of sentinel health events in the general population (discrelated sciatica (DRS) as the sentinel event for LBP) [START_REF] Roquelaure | Epidemiological surveillance of lumbar disc surgery in the general population: a pilot study in a French region[END_REF][START_REF] Fouquet | An epidemiological surveillance network of lumbar disc surgery to help prevention of and compensation for low back pain[END_REF]; 2) epidemiological surveillance of the main MSDs (including LBP) and their risk factors in the workplace [START_REF] Ha | The French Musculoskeletal Disorders Surveillance Program: Pays de la Loire network[END_REF][START_REF] Serazin | Employment and occupational outcomes of workers with musculoskeletal pain in a French region[END_REF]; and 3) registration of uncompensated work-related diseases (UWRD) related to LBP and DRS [START_REF] Rivière | Underreporting of musculoskeletal disorders in 10 regions in France in 2009[END_REF]. However, a such multi-component surveillance system is difficult to implement and to maintain in the long term and requires human and financial resources. It is therefore necessary to consider the contribution of the different components with the aim of detecting industry sectors most in need of programs for prevention of LBP.

A sentinel occupational health event was defined by Rutstein et al [START_REF] Rutstein | Sentinel Health Events (occupational): a basis for physician recognition and public health surveillance[END_REF] as "a disease, disability, or untimely death which is occupationally related and whose occurrence may: 1) provide the impetus for epidemiologic or industrial hygiene studies; or 2) serve as a warning signal that material substitution, engineering control, personal protection, or medical care may be required". The choice of indicator that may best represent the extent of LBP is complex because of its high prevalence in the general population, the high variability depending on the indicator used (reported pain, surgical data, compensation data, etc.) and the absence of a standardized clinical diagnosis.

The aim of this study was to compare the different results of the surveillance network components and the data of the French workers' compensation system and to determine the possibility of identifying the industry sectors most at risk of chronic LBP and DRS.

Materials and Methods

Databases; population sources and indicators

The pilot three-component surveillance program for MSDs was set up in the Pays de la Loire region (Loire valley area, west central France, 3,305,000 inhabitants and 1,247,839 salaried workers) in 2002 [START_REF] Ha | The French Musculoskeletal Disorders Surveillance Program: Pays de la Loire network[END_REF]. According to the French National Institute of Statistics and Economic Studies (INSEE) census of 1999, this region contained 5.5% of the French population and 5.6% of the French workforce. Its socioeconomic structure is diversified and close to that of France as a whole.

Two types of indicators were used in this study: one concerning chronic LBP and the second concerning DRS (included in the chronic LBP indicator). This article compares four data sources (Table I), i.e. the data of the three components of the pilot surveillance system for MSDs and the regional data of the French workers' compensation system:

1. Cosali study: This component was designed to assess the prevalence of musculoskeletal symptoms in the working population and their personal and occupational risk factors [START_REF] Serazin | Employment and occupational outcomes of workers with musculoskeletal pain in a French region[END_REF]. Between 2002 and2005, 83 occupational physicians (OPs) randomly selected workers from the overall population of salaried workers between the ages of 20 and 59 working in a private or public company in the Pays de la Loire region. A total of 3,710 workers, with or without MSD, for whom medical surveillance was provided by an OP participating in the network, were included in the study, regardless of their type of job contract.

All workers for whom an address was available received a self-administered follow-up questionnaire by mail between 2007 and 2009 (response rate=67.1% among contactable subjects, [START_REF] Serazin | Employment and occupational outcomes of workers with musculoskeletal pain in a French region[END_REF]. All workers aged between 20 and 59 at follow-up and who completed the follow-up questionnaire were then studied. Musculoskeletal symptoms (acute or chronic pain) were collected using the Nordic questionnaire [START_REF] Kuorinka | Standardised Nordic questionnaires for the analysis of musculoskeletal symptoms[END_REF]. Workers with chronic LBP were defined as those having experienced any aching, discomfort, pain or numbness for more than 30 days or permanently in the lower back during the preceding 12 months (Table II). Workers with DRS were defined as those suffering from chronic LBP with declared sciatic pain, with pain extending to the lower limb (whether below the knee or not).

2. UWRD surveillance: Epidemiological surveillance of uncompensated work-related diseases (UWRD) related to MSDs. The objectives of this second level of surveillance were to assess the prevalence of MSDs that could be recognized as an OD according to the OP, to identify emerging pathologies of the musculoskeletal system notified as work-related by the OP, and to evaluate the underreporting of MSDs in OD. Initially included in the network of the Pays de la Loire region, this program has since 2005 been extended to 15 out of the 22 French regions [START_REF] Valenty | Surveillance programme for uncompensated work-related diseases in France[END_REF].

Most workers in France undergo a regular mandatory health examination (every two years in [2008][2009][2010]. Each year a volunteer network of OPs record all UWRDs seen during twice-yearly 2-week periods selected as 'UWRD Fortnights'. The fortnight dates change annually and differ in each region. UWRDs are defined as every symptom or disease that the OP considers to be work-related, which are not receiving compensation from social security at the time of the OP's examination.

Occupational disease claims that have been filed but a decision has not yet been reached, those that have been rejected by social security and OD which characteristics don't fill requirements of OD recognition tables are deemed to be UWRDs. All workers with LBP and DRS among all the salaried workers seen by OPs during the 2-week period under consideration were counted as cases of LBP and DRS, respectively. Each OP also completed a form with the total number of workers seen during the period, to serve as the denominator for calculating UWRD prevalence rates. As for the Cosali study (see above), the UWRD-DRS indicator is a part of the UWRD-LBP indicator. The definition of UWRD-LBP and UWRD-DRS indicators is detailed in Table II and in the Appendix.

All UWRDs notified for workers aged between 20 and 59 and working in the Pays de la Loire region in 2008-2010 were studied. In the Pays de la Loire region in 2008-2010, between 21% and 37% of the regional OP's participated in the fortnight on a voluntary basis [START_REF] Sérazin | Surveillance des maladies à caractère professionnel (MCP) en région Pays de la Loire[END_REF]. In 2008-2009, the representativeness of the industry sectors monitored by these OP's throughout the year was proportionate for agriculture and industry [START_REF] Sérazin | Surveillance des maladies à caractère professionnel (MCP) en région Pays de la Loire[END_REF]. However, in 2010, three sectors were over-represented: agriculture, forestry and fishing; mining, manufacturing and other industries; and wholesale and retail trade [START_REF] Sérazin | Surveillance des maladies à caractère professionnel (MCP) en région Pays de la Loire[END_REF]. On the other hand, the sectors of public administration, education, and human health and social action were under-represented.

3. LDS study: This component was designed to estimate the incidence of lumbar disc surgery (LDS), chosen as the sentinel event for DRS and generally for LBP, in the general population, and to assess the proportion of LDS attributable to occupational activity. Epidemiological surveillance of LDS in the general population was set up at centers for spinal surgery in the Pays de la Loire region, using seven codes for surgical acts selected in collaboration with spinal surgeons [START_REF] Roquelaure | Epidemiological surveillance of lumbar disc surgery in the general population: a pilot study in a French region[END_REF][START_REF] Fouquet | An epidemiological surveillance network of lumbar disc surgery to help prevention of and compensation for low back pain[END_REF]. The hospital admissions of subjects who had undergone surgery for DRS during the study period were extracted from the French public and private hospital database. Patients were included if they were aged between 20 and 64 years, lived in the region and had undergone their first lumbar disc surgery between 2007 and 2008 in the participating centers.

A self-administered questionnaire was sent to collect medical and surgical history and employment history. The centers' databases identified a sample comprising 3,150 patients, of whom 1,670 were included in the study [START_REF] Fouquet | An epidemiological surveillance network of lumbar disc surgery to help prevention of and compensation for low back pain[END_REF]. All inpatients aged between 20 and 59 were therefore studied to compare other data sources. This study provides only a DRS indicator (more details in Table II).

OD-DRS:

This fourth system was used to analyze the workers' compensation (WC) for OD.

Analysis of these data allowed the incidence of compensated MSDs to be calculated. In France, the WC system for OD is based on a series of Tables, themselves based on presumption of causality, which define the required criteria for compensation by social insurance funds. A disease is recognized as occupational and compensated if all the criteria in the corresponding Table are met: i.e. diagnostic criteria, time since the most recent exposure and conditions of the exposure. The diseases detailed in these Tables are all compensable OD; about 100 are listed in the general national health insurance system and about 50 in the agricultural health insurance system (INRS, 2016). Only chronic LBP associated to disc herniation with radiculopathy (M511, code according to the 10 th revision of the International Classification of Diseases) caused by vibration or manual handling of loads are included as back pain in Tables of the WC system. This study provides only a DRS indicator (more details in Table II). Only workers compensated for OD-DRS living in the Pays de la Loire study were included.

Statistical analysis

Concerning the Cosali study and the UWRD surveillance, the prevalence rate was calculated using the number of cases of chronic LBP and DRS as numerator and the whole salaried staff included in each system as denominator (Table I). For the LDS study and the OD-DRS, the incidence rate was computed using the number of DRS cases in each system as numerator and the number of employed people according to INSEE census of 2007 as denominator.

The prevention index (PI) combines two types of ranking information: the frequency and the rate of incidence or prevalence [START_REF] Silverstein | Use of a prevention index to identify industries at high risk for work-related musculoskeletal disorders of the neck, back, and upper extremity in Washington state, 1990-1998[END_REF]. Ranking was determined according to the industry sector with the highest rate of incidence or prevalence (ranked 1) down to the sector with the lowest rate of incidence or prevalence (last ranking equal to the number of sectors considered). The ranking of the absolute frequencies of OD (i.e. ranking of the number of cases) observed was applied in the same way. Using the information on the frequencies and the rate of incidence or prevalence, the PI can be calculated as the mean of two ranks (see formula below):

𝑃𝑃𝑃𝑃 =

Incidence/prevalence rate ranking + Frequency ranking 2

A crude rate ratio of incidence or prevalence was calculated, dividing the rate of incidence or prevalence for each sector studied by the rate of incidence or prevalence computed for all people for which the sector was notified [START_REF] Silverstein | Use of a prevention index to identify industries at high risk for work-related musculoskeletal disorders of the neck, back, and upper extremity in Washington state, 1990-1998[END_REF]. Where two PI rankings were equal, the higher rate ratio was used to define the first PI ranking. The highest PI (PI rank=1) allowed detection of the industry sectors with both the greatest burden and the greatest risk of LBP or DRS and which should be prioritized in targeting research and prevention.

For statistical reasons, only sectors with more than five cases are presented in the analysis.

Statistical analyses were performed using SAS 9.4 and Microsoft Excel 2010.

Ethics approval was provided by the French National Committee for Data Protection (CNIL).

Results

In the 17 sector divisions, construction, manufacturing, transportation and agriculture had the highest PIs for men (Table III). Construction was the main sector for the two indicators (chronic LBP and DRS) in terms of PI for all sources, except for the Cosali study. Construction also presented a rate ratio higher than 1 for all studies and indicators (varying between 1.17 and 2.86). The manufacturing industry also appeared to be a priority sector for both indicators, except according to the LDS study (PI ranking=4 and Rate ratio<1 For women, the manufacturing industry was the leading sector in terms of PI for both indicators (Table IV), except for the LDS study (PI ranking=6 and Rate ratio<1). The human health and social work activities sector presented high PI for all studies for both indicators. The rate ratio was higher than 1 (between 1.16 and 1.63) for all indicators, except for chronic LBP in the Cosali study. The next sector for all indicators in terms of PI was wholesale and retail trade according to the UWRD surveillance and OD-DRS, whereas it was public administration according to the Cosali study, and transportation and communication sector and accommodation, and food service activities according to the LDS study.

MSDs specific epidemiologic studies were the data sources which allowed ranking of the greatest number of sectors. The LDS study allowed to classify 13 of 17 industry sectors for DRS indicators for both sexes and the Cosali study allowed to rank 8 and 7 sectors for LBP indicators for men and women, respectively.

OD-DRS allowed ranking of a smaller number of sectors (7 for men and 5 for women) than other data sources. However, it did not require specific data collection and its results were comparable with other data sources.

Discussion and conclusions

Using four independent population-based data sources on the frequency of work-related chronic LBP and disc-related sciatica, this study detected sectors most in need of prevention, i.e. construction, manufacturing, transportation and agriculture sectors for men and manufacturing, human health and social work activities, wholesale and retail trade and public administration sectors for women.

This study showed complementarity between all data sources. The independence, the quality and the contemporary nature of the four data sources used for the comparison of the burden of chronic LBP and DRS between activity sectors are the key strengths of this study. Nevertheless, certain limitations need to be taken into consideration when interpreting the results (Table I). Indeed, some differences could be explained by the differences in studied populations of the data sources. A key point for discussion is the choice of the indicator to be used for the epidemiological surveillance of work-related LBP. Whereas Rutstein et al. defined clearly what an occupational sentinel health event is [START_REF] Rutstein | Sentinel Health Events (occupational): a basis for physician recognition and public health surveillance[END_REF], the choice of the indicator that may best represent the extent of LBP is complex because of its high prevalence in the general population, the high variability depending on the indicator used (reported pain, surgical data, compensation data, etc.) and the absence of a standardized clinical diagnosis. Two types of indicator were therefore used in this study, i.e. chronic LBP (more than 30 days of pain within the last 12 months) and DRS. In addition to the indicator used for chronic LBP, we chose the most restrictive indicator (DRS) for two main reasons. First, hospital discharges following lumbar disc surgery performed in specialist spine centers appeared to be the best available sentinel event for the surveillance of DRS, and more generally of LBP, because its incidence is lower than LBP and its estimation is facilitated by the use of using hospital discharge databases [START_REF] Roquelaure | Epidemiological surveillance of lumbar disc surgery in the general population: a pilot study in a French region[END_REF]. However, the health care-seeking behavior for LBP of patients may be influenced by their own beliefs and/or those of the healthcare practitioners [START_REF] Main | How important are back pain beliefs and expectations for satisfactory recovery from back pain? Best[END_REF][START_REF] Mannion | Association Between Beliefs and Care-Seeking Behavior for Low Back Pain[END_REF]. Undergoing surgery for disc herniation may not only be explained by medical reasons. Thus, a regional study has shown a link between the use of surgery and geographic, socio-economic or related health care system factors [START_REF] Fouquet | Quel indicateur pertinent pour la surveillance épidémiologique et la prévention des troubles musculo-squelettiques en lien avec le travail ? Application à la lombalgie[END_REF], in line with what has been observed previously in the United States [START_REF] Andersen | Societal and Individual Determinants of Medical Care Utilization in the United States[END_REF]. In addition, it is important to emphasize that back surgery rates are known to vary between countries and even regions [START_REF] Rasmussen | Rates of lumbar disc surgery before and after implementation of multidisciplinary nonsurgical spine clinics[END_REF], possibly due to lack of scientific evidence, financial incentives or disincentives for surgical interventions, differences in clinical training, professional opinion and patients' preferences [START_REF] Leino-Arjas | Inpatient hospital care for lumbar intervertebral disc disorders in Finland in relation to education, occupational class, income, and employment[END_REF]. It is also possible that manual workers encountered more difficulties in coping with LBP at work, and this may have led to increased use of healthcare and surgical treatment [START_REF] Leino-Arjas | Inpatient hospital care for lumbar intervertebral disc disorders in Finland in relation to education, occupational class, income, and employment[END_REF][START_REF] Kaila-Kangas | How consistently distributed are the socioeconomic differences in severe back morbidity by age and gender? A population based study of hospitalisation among Finnish employees[END_REF]. Moreover, changes in medical practice have a significant influence on this type of indicators [START_REF] Joines | A spatial analysis of county-level variation in hospitalization rates for low back problems in North Carolina[END_REF][START_REF] Fouquet | An epidemiological surveillance network of lumbar disc surgery to help prevention of and compensation for low back pain[END_REF]. Several studies in recent years have shown a similar prognosis in patients who underwent surgery and those who had conservative treatment (cognitive intervention, exercises, etc.) [START_REF] Peul | Prolonged conservative care versus early surgery in patients with sciatica caused by lumbar disc herniation: two year results of a randomised controlled trial[END_REF][START_REF] Brox | Four-year follow-up of surgical versus non-surgical therapy for chronic low back pain[END_REF]. Likewise, medical practice evolves, and surgery is now recommended only in patients with high disability and the most severe cases.

The number of surgical lumbar disc interventions has therefore decreased over time and the same trend has not been observed for DRS. Secondly, only DRS is retained to compensate for work-related LBP in France [START_REF] Roquelaure | Déclarer une lombosciatique en maladie professionnelle : est-ce l'avantage bien compris du patient ?[END_REF]. LBP and DRS are the leading causes of work incapacity and disability before 45 years of age in France (Inserm, 2000). In view of this social and economic context, two compensation Tables were created by social insurance funds in 1999 in the WC system for OD although they are restricted to chronic LBP associated with DRS for herniated discs caused by vibrations transmitted to the whole body or by manual handling of heavy loads (INRS, 2016). Although not perfect and not covering isolated LBP, these tables have ranked compensated DRS as the third most common OD in France since 2000, after MSDs of the lower and upper limbs and occupational cancers [START_REF] Roquelaure | Déclarer une lombosciatique en maladie professionnelle : est-ce l'avantage bien compris du patient ?[END_REF]. However, the current compensation arrangements fall well short of full compensation. This demonstrates the failure of primary prevention of LBP and the importance of multidisciplinary programs for job retention with LBP, including ergonomic intervention to improve working conditions. At the same time, LBP prevention should be carried out as early as possible in the evolution of LBP [START_REF] Petit | French good practice guidelines for medical and occupational surveillance of the low back pain risk among workers exposed to manual handling of loads[END_REF]. Therefore, it is necessary to implement a surveillance system to describe all stages of LBP (acute, subacute and chronic), such as the Cosali study (which used the Nordic questionnaire).

In this study, we compared PI rankings, the PI calculation of which requires two types of ranking information, the frequency rank and the incidence/prevalence rate rank. Interpreting the results becomes complicated if classification rankings differ. It is therefore essential to consider the results according to the objectives of the prevention program. If the goal is to reduce the absolute number of cases of LBP, then it would be more appropriate to use the frequency ranking. On the other hand, if the aim is to reduce the risk of LBP, it would be more sensible to use the incidence/prevalence rate ranking. However, from a public health perspective, it is difficult to leave aside one or the other of these two goals in prevention practice and that is why we chose to compare our data using the PI, whose strength is combining frequency and incidence/prevalence rate. In addition, previous studies have shown that PI ranking is more robust than frequency ranking or incidence/prevalence rate ranking [START_REF] Thiede | Gender specific analysis of occupational diseases of the low back caused by carrying, lifting or extreme trunk flexion--use of a prevention index to identify occupations with high prevention needs[END_REF]. Nevertheless, according the same weighting to the frequency ranking and the incidence/prevalence rate ranking (which may appear empirical) might be questioned. It might be possible to assign different weighting to the frequency ranking and the incidence/prevalence rate ranking in the PI calculation according to the aim of prevention campaigns. If the main aim is to reduce the number of cases of LBP, it would therefore be more interesting to give greater weighting in the PI calculation. In this article, we studied large databases, but only with cross-sectional data and the use of the PI was therefore particularly suitable. Indeed, according to Thiede et al., the strength of the PI is that it can be applied to surveillance data with broad coverage of the working population where there is poor or no information on the healthy working population [START_REF] Thiede | Gender specific analysis of occupational diseases of the low back caused by carrying, lifting or extreme trunk flexion--use of a prevention index to identify occupations with high prevention needs[END_REF].

Finally, as pointed out by Bonauto et al, one of the weaknesses of the PI is that it is calculated from rankings [START_REF] Bonauto | Prioritizing industries for occupational injury and illness prevention and research[END_REF]. Converting frequency or incidence/prevalence rate to ranking leads to loss of information. For example, whether the difference between the first and second industry sector be great or small, the difference between the rankings will always be 1. We therefore chose to present rate ratios to allow us to relate sectors to each other. Another weakness of the PI ranking is linked to the number of industry sectors ranked. For example, for the DRS indicator for women, the LDS study allowed ranking of 13 industry sectors whereas only three sectors were ranked by the UWRD surveillance (four by the Cosali study and five by OD-DRS). Thus, although manufacturing was the first sector for three of four studies, this sector was among the firsts in the 13 sectors ranked by the LDS study.

The analyses were performed by stratifying by gender because it is known that risk factors for LBP are different in men and in women [START_REF] Messing | Should studies of risk factors for musculoskeletal disorders be stratified by gender? Lessons from the 1998 Québec Health and Social Survey[END_REF]. In our study, sectors with highest PI ranks were different for men and women. This can be explained by the differences in workplace exposure, personal factors and MSDs according to gender [START_REF] Messing | Should studies of risk factors for musculoskeletal disorders be stratified by gender? Lessons from the 1998 Québec Health and Social Survey[END_REF]. In contrast to the literature, we chose to present the results according to industry sectors and not according to occupations. Work-based prevention campaigns are indeed usually implemented by industry sector in France. The aim here was to provide the most operational figures to assist the implementation of an effective prevention campaign. This study highlighted sectors with high PI: manufacturing for both sexes; construction, transportation and agriculture for men; and the human health and social work sector and wholesale and retail trade for women. These sectors are often reported in the literature although the analyses are rarely stratified by gender [START_REF] Murphy | Low back pain disability: relative costs by antecedent and industry group[END_REF]Eurofound, 2012;[START_REF] Miedema | Incidence of low back pain related occupational diseases in the Netherlands[END_REF]. However, many other risk factors for LBP (e.g., specific occupational, psycho-social and organizational factors, individual factors, etc) exist that could not be studied in this study. Indeed, these risk factors were not reported within the considered surveillance systems. Only the Cosali study was able to capture these [START_REF] Ramond-Roquin | Biomechanical constraints remain major risk factors for low back pain. Results from a prospective cohort study in French male employees[END_REF].

Although it has been shown that individual and occupational determinants of LBP vary according to the definition of LBP [START_REF] Ozguler | Individual and occupational determinants of low back pain according to various definitions of low back pain[END_REF], our results were similar for all considered data sources and the indicators (LBP or DRS) used. Nevertheless, the results are not fully comparable and a multi-component surveillance system would therefore appear valuable. Moreover, administrative data on compensated OD underestimated the incidence of work-related LBP in our study, as it is commonly observed in other industrialized countries for all work-related MSDs [START_REF] Stock | Underreporting work absences for nontraumatic work-related musculoskeletal disorders to workers' compensation: results of a 2007-2008 survey of the Québec working population[END_REF]. The rate of underreporting of LBP was estimated at 63% (range 50-76%) in France by comparing compensated cases and cases identified by the UWRD program [START_REF] Rivière | Underreporting of musculoskeletal disorders in 10 regions in France in 2009[END_REF]. Similarly, almost 20% of workers in the LDS study considered their DRS to be an OD with compensation systems and DRS was recognized as an OD for more than 10% of workers (data not shown). This small proportion can be explained by the very restrictive criteria of the Table . Therefore, OD surveillance alone is not enough. Because of the limitations of tables in the WC system (in terms of diagnostic criteria and occupational exposure), only a small proportion of DRS is recognized as OD, which limits the statistical analyses. Moreover, this data source is not exhaustive (75% of the working population). Indeed, for example, self-employed workers and permanent personnel of the public administration and defense systems are not included in this database. This could explain differences between our data sources. The workers' compensation system is therefore not sufficient to describe the frequency of LBP in the working population accurately. On the other hand, OD data do not require specific collection, which encourages us to continue to explore this data source. The UWRD surveillance program, for which the results were comparable to those of the OD surveillance in this study, has been of value in the past [START_REF] Rivière | Underreporting of musculoskeletal disorders in 10 regions in France in 2009[END_REF][START_REF] Valenty | Surveillance programme for uncompensated work-related diseases in France[END_REF]. In addition to demonstrating the under-reporting of LBP, this information has helped to describe time tendencies and to identify sectors in which workers rarely meet the restrictive criteria of the compensation Tables and to monitor disorders or diseases not included in compensation Tables, such as LBP. Finally, findings such as those originating from the Cosali study and the LDS study document the phenomenon more accurately, because of the large numbers of cases. A surveillance network in the general population seems to be appropriate to describe work-related LBP and sciatica according to categories and sectors more accurately, especially for those which are not covered by the occupational health system (for example farmers, self-employed workers, etc.).These studies are costly in time and money. Fortunately, in France, new epidemiological tools will assist in epidemiological surveillance of LBP in the short-term such as large cohorts, namely "Constances" for the National Health Insurance fund administered by the "Caisse nationale d'assurance maladie des travailleurs salariés" [START_REF] Zins | The French CONSTANCES population-based cohort: design, inclusion and follow-up[END_REF], "Coset-MSA" for the Agricultural Insurance fund administered by the "Mutualité Sociale

Agricole" and "Coset-RSI" for the Self-employed Workers Insurance fund administered by the "Régime social des indépendants" [START_REF] Santin | In an occupational health surveillance study, auxiliary data from administrative health and occupational databases effectively corrected for nonresponse[END_REF]. These cohorts collect the same data as the Cosali study, i.e.

on musculoskeletal pain (acute or chronic), using the Nordic questionnaire, on the main risk factors (personal and occupational) and the entire employment history. Data from the medico-administrative databases are also available. It will therefore be possible at the national level to replace the Cosali study and the LDS study by studies within these cohorts. There are several benefits from these new opportunities.

First, the cost of the data collection will be less in terms of time and money. Second, the collected data will be national and therefore representative of the French population. It will originate from the three main social security funds in France (which cover 95% of the working and non-working population [START_REF] Santin | In an occupational health surveillance study, auxiliary data from administrative health and occupational databases effectively corrected for nonresponse[END_REF]). To detect the industry sectors most in need of prevention programs at the national level, it should therefore be possible, in the near future, to implement a surveillance program for chronic LBP and DRS based on compensated OD-DRS and previously described in large cohorts. Nevertheless, at a regional level, which is also a level of implementation of health policy in France, it would be necessary to complement this surveillance program with a regional surveillance program for lumbar disc surgery in the general population, because large cohorts will not allow an accurate description of the phenomenon in regions.

To conclude, this study shows the value of a multi-component surveillance system to monitor work-related LBP and thus to detect the industry sectors the most in need of prevention programs.

Cosali Study

To evaluate the prevalence of:

• the musculoskeletal symptoms in the working population

• their personal and occupational risk factors Use of the French version of the Nordic questionnaire [START_REF] Ha | The French Musculoskeletal Disorders Surveillance Program: Pays de la Loire network[END_REF] Representativeness of the baseline sample [START_REF] Serazin | Employment and occupational outcomes of workers with musculoskeletal pain in a French region[END_REF] Absence of a standardized clinical procedure by occupational practitioners [START_REF] Ha | The French Musculoskeletal Disorders Surveillance Program: Pays de la Loire network[END_REF] Attrition bias at follow-up (response rate=67.1% among the contactable subjects) with lowest rates among young workers and workers in temporary employment at baseline, particularly exposed to the risk of LBP and DRS Possible underestimation of the prevalence of LBP and DRS, especially those leading to long periods of sickness absence, as in the case of people suffering from chronic LBP

UWRD surveillance

To assess the prevalence of MSDs that could be recognized as an OD, according to the OP No observation of all UWRD, especially those leading to long periods of sickness absence, as in the case of people suffering from chronic LBP [START_REF] Valenty | Surveillance programme for uncompensated work-related diseases in France[END_REF] Slight differences between workers followed in the UWRD surveillance program and the national census partly reflect the organization of occupational medicine in France because of differing intervals between health examinations according to occupational risks. [START_REF] Rivière | Underreporting of musculoskeletal disorders in 10 regions in France in 2009[END_REF])

LDS study

To

LDS study

Using codes for surgical acts selected from hospital discharge database (see Appendix 2)

DRS

Seven codes for lumbar disc surgery were selected with spinal surgeons: LHPH907 LFFA002 LFFA003 LFFC002 LFFA011 LFFA010 LHKA900 Incidence (‰)

• Men: 0.5 • Women: 0.5

OD-DRS DRS

Recognized OD (Tables 97 and98)

Incidence (‰)

• Men: 0.5 Concerning the Cosali study and the UWRD surveillance, the prevalence rate was calculated using the number of cases of chronic LBP and DRS as numerator and the whole salaried staff included in each system as denominator (Table I). For the LDS study and the OD-DRS, the incidence rate was computed using the number of DRS cases in each system as numerator and the number of employed people according to INSEE census of 2007; c 95% confidence interval; d Prevention index; In bold, the first three sectors in terms of PI for each study and indicator.

For

  each data source, each industry sector was coded using the 17 sections of the French version of the statistical classification of economic activities in the European Community (Nomenclature d'Activités Française [NAF] codes of 2003).

  Salaried workers provided the population for two data sources (Cosali study and UWRD surveillance) because these studies needed the participation of OPs. Almost all salaried workers in France (including temporary and part-time workers) undergo a regularly-scheduled mandatory health examination (every two years in 2008-2010), whether they have health problems or not. All salaried workers and farmers were included in the OD surveillance population. The LDS study population was the largest used in this article since all employed individuals(salaried and self-employed people) and unemployed individuals were included in this study. Moreover, the number of cases allowed us to compute PI only for aggregated sectors, which is a limitation for targeting sectors requiring prevention programs. Implementing a multi-component epidemiological surveillance system can thus fill in the gaps left by each of the four individual systems.

  ). Transportation was also associated with high PI according to the Cosali and the LDS studies (rate ratio between 1.38 and 1.44) and agriculture according to UWRD surveillance and OD-DRS (rate ratio between 1.95 and 2.48). Public administration and defense was associated with high PI in the LDS study, and real estate, renting and business services in the Cosali study (for DRS indicator only).

Table I . Description of studies included in this analysis in the Pays de la Loire region

 I

			Number of
	Studies	Aims	people aged 20-59	Years	Study populations	Reference populations	Strengths	Limitations
			years a

Table III . Description of indicators among studies included in this analysis in the Pays de la Loire region

 III

	Studies	Indicators	Incidence / prevalence
		Statement of worker	Prevalence (‰)
		Chronic LBP	Chronic LBP
		• LBP during last 12 months:	• Men: 220.3
		 Over 30 days	• Women: 212.5
	Cosali Study	 Permanently
		DRS (included in chronic LBP)	DRS
		• Among chronic LBP: sciatic pain (reaching the knee or not)	• Men: 71.4
			• Women: 72.7
		Using of CIM-10 codes (see Appendix 1)	Prevalence (‰)
		Chronic LBP	Chronic LBP
		• LBP without radiation: M5197, M545 (excluding lumbago and acute and	• Men: 6.2
		subacute LBP), M5490 (only multiple sites with LBP), M5495	• Women: 4.0
	UWRD surveillance	• LBP with radiation: M511, M5116, M5117, M512, M5126, M5127,
		M543
		DRS (included in chronic LBP)	DRS
		• Chronic LBP with radiation only	• Men: 2.4
			• Women: 1.3

Table III . Prevention index rank and rate ratio of chronic low back pain (LBP) and disc-related sciatica (DRS) according to industry sectors for men a. Chronic low back pain indicator Industry sectors a

 III Industry sectors coded using the 17 sections of the French version of the statistical classification of economic activities in the European Community (Nomenclature d'Activités Française [NAF] codes of 2003). Results are presented and rate are calculated when there are at least five cases for at least one study (Fishing, aquaculture and related service, Electricity, gas and water conditioning supply, Education and Collective, social and personal services are not presented in table a; Mining and quarrying, Activities of households as employers and Activities of extraterritorial organizations and bodies are not presented in tables a and b); b

			Cosali study			UWRD surveillance
		n	Rate b (‰) [95% CI] c	Rate ratio	PI d ranking	n	Rate b (‰) [95% CI] c	Rate ratio	PI d ranking
	Agriculture. hunting and forestry	2				13 13.6 [6.2-20.9] 1.94	2
	Manufacturing	97 234.9 [194.0-275.8]	1.02	2	62	8.3 [6.2-10.3]	1.19	3
	Construction	22 268.3 [172.4-364.2]	1.17	3	34	11.3 [7.5-15]	1.62	1
	Wholesale and retail trade; repair of motor vehicles and household goods	22 215.7 [135.9-295.5]	0.94	6	27	6.9 [4.3-9.5]	0.99	4
	Accommodation and food service activities	1				5	8.9 [1.1-16.7]	1.28	5
	Transportation and communication	25	316.5 [213.9-419]	1.38	1	11	5.5 [2.2-8.7]	0.78	7
	Financial activities	6	115.4 [28.5-202.2]	0.50	8	1
	Real estate. renting and business services	21 250.0 [157.4-342.6]	1.09	4	12	2.9 [1.3-4.6]	0.42	8
	Public administration and defense; compulsory social security	23 217.0 [138.5-295.5]	0.95	5	6	5.8 [1.2-10.5]	0.83	6
	Human health and social work activities	10 222.2 [100.8-343.7]	0.97	7	0
	All non-missing sectors	236 229.3 [203.7-255.0]			180	7.0 [6.0-8.0]
	b. Disc-related sciatica indicator
			Cosali study			UWRD surveillance			LDS study			OD-DRS
	Industry sectors a	n	Rate b (‰) [95% CI] c	Rate ratio	PI d ranking	n	Rate b (‰) [95% CI] c	Rate ratio	PI d ranking	n	Rate b (‰) [95% CI] c	Rate ratio	PI d ranking	n	Rate b (‰) [95% CI] c	Rate ratio	PI d ranking
	Agriculture. hunting and forestry	0				6	6.3 [1.3-11.2]	2.38	3	38 0.4 [0.3-0.5] 0.94	9	38	0.4 [0.3-0.5] 1.95	3
	Fishing. aquaculture and related service					0				5	1.4 [0.2-2.6] 3.18	8
	Manufacturing	36	90.0 [62.0-118.0]	1.14	3	21	2.8 [1.6-4.0]	1.06	2	127 0.4 [0.3-0.4] 0.82	4	71	0.2 [0.2-0.3] 1.03	2
	Electricity. gas and water conditioning supply	0				0				3
	Construction	8	101.3 [34.7-167.8]	1.28	4	14	4.6 [2.2-7.1]	1.76	1	115 0.7 [0.5-0.8] 1.53	1	100 0.6 [0.5-0.7] 2.86	1
	Wholesale and retail trade; repair of motor vehicles and household goods	7	71.4 [20.4-122.4]	0.90	5	9	2.3 [0.8-3.8]	0.87	4	67 0.3 [0.3-0.4] 0.82	7	27	0.1 [0.1-0.2] 0.70	4
	Accommodation and food service activities	0				1				13 0.4 [0.2-0.5] 0.82	11
	Transportation and communication	9	113.9 [43.9-184.0]	1.44	1	5	2.5 [0.3-4.7]	0.94	5	64 0.6 [0.5-0.8] 1.41	2	21	0.2 [0.1-0.3] 1.03	5
	Financial activities	0				0				21 0.6 [0.4-0.9] 1.53	5	2
	Real estate. renting and business services	8	103.9 [35.7-172.0]	1.32	2	5	1.2 [0.2-2.3]	0.46	6	35 0.2 [0.1-0.3] 0.47	12	17	0.1 [0.1-0.1] 0.47	6
	Public administration and defense; compulsory social security	6	57.1 [12.7-101.5]	0.72	6	4				62 0.6 [0.5-0.7] 1.41	3	2
	Education	0				0				33 0.5 [0.3-0.7] 1.18	10
	Human health and social work activities	4				0				38 0.5 [0.4-0.7] 1.18	6	4
	Collective. social and personal services	1				0				11 0.2 [0.1-0.4] 0.59	13	8	0.2 [0.1-0.3] 0.89	7
	All non-missing sectors	79	79.0 [62.3-95.7]			68	2.6 [2.0-3.3]			635 0.4 [0.4-0.5]			232 0.2 [0.1-0.2]

a

Acknowledgements:

The authors wish to thank Véronique Daubas-Letourneux (EHESP School of Public Health, Rennes, France and INSERM, U1085, IRSET, ESTER Team, University of Angers, Angers, France), Julien Brière, Juliette Chatelot and Stéphanie Rivière (Santé publique France, French national public health agency, Direction of Occupational Health, Saint-Maurice, France) for their valuable comments on the manuscript, the workers' compensation systems that participated in this study (Régime Général de la Sécurité Sociale and the Mutualité Sociale Agricole) and the occupational physicians who took part in the UWRD surveillance program.

Funding: This study was supported by Santé publique France, French Public Health Agency, Saint-Maurice, France (Grant 9/25/2002-5 "Réseau expérimental de surveillance des troubles musculosquelettiques") and the French National Research Agency (ANR-Grant SEST-06-36). The authors declare no conflict of interest relating to the material presented in this article. Its contents, including any opinions and/or conclusions expressed, are solely those of the authors.

Institution and Ethics approval and informed consent: Ethics approval was provided by the French

Commission on Individual Freedom and Data Storage (CNIL). Concerning the Cosali study and the UWRD surveillance, the prevalence rate was calculated using the number of cases of chronic LBP and DRS as numerator and the whole salaried staff included in each system as denominator (Table I). For the LDS study and the OD-DRS, the incidence rate was computed using the number of DRS cases in each system as numerator and the number of employed people according to INSEE census of 2007; c 95% confidence interval; d Prevention index; In bold, the first three sectors in terms of PI for each study and indicator.

Disclaimer: None


Clémence Baudin
email: clemence.baudin@ifsttar.fr

Marie Lefevre
email: bmarie.lefevre@ifsttar.fr

Anne-Sophie Sophie Evrard
email: anne-sophie.evrard@ifsttar.fr

Patricia Champelovier
email: dpatricia.champelovier@ifsttar.fre

Jacques Lambert
email: jamylambert@gmail.comfbernard.laumon@ifsttar.fr

Bernard Laumon

Marie Lefèvre

The effects of annoyance due to aircraft noise

INTRODUCTION

Many studies have evidenced adverse effects of aircraft noise exposure on health, such as annoyance, cardiovascular diseases, sleep disorders or altered cognitive performance [START_REF] Babisch | Annoyance due to aircraft noise has increased over the years--results of the HYENA study[END_REF][START_REF] Evrard | Does aircraft noise exposure increase the risk of hypertension in the population living near airports in France?[END_REF][START_REF] Haines | The West London Schools Study: the effects of chronic aircraft noise exposure on child health[END_REF][START_REF] Hansell | Aircraft noise and cardiovascular disease near Heathrow airport in London: small area study[END_REF][START_REF] Kim | Exposure-Response Relationship Between Aircraft Noise and Sleep Quality: A Community-based Cross-sectional Study[END_REF][START_REF] Stansfeld | Aircraft and road traffic noise and children's cognition and health: a cross-national study[END_REF] . Some studies have investigated low birth weight, obesity or diabetes [START_REF] Pyko | Exposure to traffic noise and markers of obesity[END_REF][START_REF] Matsui | Association between the rates of low birth-weight and/or preterm infants and aircraft noise exposure[END_REF] , but these effects remain discussed in the literature because of divergent results.

It's also the case for psychological distress: some studies showed a significant association between aircraft noise exposure and psychological disorders [START_REF] Miyakita | Population-based questionnaire survey on health effects of aircraft noise on residents living around U.S. airfields in the Ryukyus-part I: an analysis of 12 scale scores[END_REF][START_REF] Rocha | Perception of environmental problems and common mental disorders (CMD)[END_REF][START_REF] Van Den Berg | The Relation between Self-Reported Worry and Annoyance from Air and Road Traffic[END_REF] , and some other did not [START_REF] Reijneveld | The impact of the Amsterdam aircraft disaster on reported annoyance by aircraft noise and on psychiatric disorders[END_REF][START_REF] Van Kamp | Environmental noise and mental health: evidence from the Schiphol monitoring program[END_REF][START_REF] Sygna | Road traffic noise, sleep and mental health[END_REF] . However, the hypothesis that noise annoyance could be considered as a mediator in the causal chain between aircraft noise exposure and health disorders has been proposed [START_REF] Babisch | The noise/stress concept, risk assessment and research needs[END_REF] .

The association between annoyance due to noise and psychological distress has not been largely investigated [START_REF] Van Den Berg | The Relation between Self-Reported Worry and Annoyance from Air and Road Traffic[END_REF][START_REF] Van Kamp | Environmental noise and mental health: evidence from the Schiphol monitoring program[END_REF][START_REF] Beutel | Noise Annoyance Is Associated with Depression and Anxiety in the General Population-The Contribution of Aircraft Noise[END_REF][START_REF] Persson | Trait anxiety and modeled exposure as determinants of self-reported annoyance to sound, air pollution and other environmental factors in the home[END_REF] , and no study has been carried out in France. DEBATS (Discussion on the health effects of aircraft noise) is the first research program in France to investigate the health effects of aircraft noise exposure. One of the specific objectives of the study was to evaluate the effects of annoyance due to aircraft noise on psychological distress in people living near airports in France.

METHODS

Study population

DEBATS randomly included 1,244 individuals older than 18 and living near three major French airports (Paris-Charles de Gaulle, Lyon-Saint-Exupéry and Toulouse-Blagnac) in 2013. The study population was stratified on aircraft noise contours produced with the "Integrated Noise Model" (INM) by the DGAC (French Civil Aviation Authority). These contours are based on the day-evening-night equivalent noise level (L den ) and define four categories: <50, 50-54, 55-59 and ≥60 dB(A). All the participants responded to a questionnaire administered by an interviewer at their place of residence. The questionnaire collected in particular demographic and socio-economic information, lifestyle factors such as smoking and alcohol consumption, and personal medical history.

Annoyance due to aircraft noise

Annoyance due to aircraft noise was assessed with the following question: "Thinking about the last 12 months, when you are at home, how much does aircraft noise annoy you?" The 5-point verbal scale proposed by the International Commission on the Biological Effects of Noise (Icben) was used: extremely, very, moderately, slightly or not at all.

Psychological distress

Psychological distress was evaluated during the face-to-face interview with the 12item version of General Heath Questionnaire (GHQ-12) [START_REF] Golderberg | A User's Guide to the General Health Questionnaire[END_REF] . The GHQ-12 is a self-report instrument for the detection of mental disorders within community. A GHQ-score was then calculated and treated as a dichotomous variable, with a 2/3 threshold: participants with a GHQ-score ≥3 were considered to have psychological distress.

Confounders

Several factors known in the literature to affect psychological distress were obtained from the questionnaire: age (six categories: 18-34; 35-44; 45-54; 55-64; 65-75; >75 years old), country of birth (France-born; foreign-born), gender, occupational activity (yes; no), marital status (single; married; widowed; divorced), alcohol consumption (no; light; moderate; heavy), smoking (non-smoker; ex-smoker; occasional smoker; daily smoker), sleep duration (≤5h; 6h; 7h; 8h; ≥9h), number of stressful life events (0; 1; ≥2), education (< French high-school certificate; French high-school certificate; >French high-school certificate), household monthly income (<2,600$/month ; 2,600 to 4,500$/month ; ≥4,500$/month), and antidepressant use (yes; no).

Statistical analysis

A logistic regression model (M1 model) with the dichotomized GHQ-score as the outcome variable and annoyance due to aircraft noise and confounders as covariates was used to assess the associations between annoyance due to aircraft noise and psychological distress.

As it has been suggested that noise sensitivity could influence the effects of noise on physical and psychological distress, noise sensitivity was also included in two categories (less sensitive than or as sensitive as/more sensitive than people around you) in a second logistic regression model (M2 model).

RESULTS

About 22% of the participants were considered to have psychological distress according to the GHQ-12.

Table 1 shows the odds-ratios (OR) and their 95% confidence intervals (CI) for the dichotomized GHQ-score in relation to annoyance due to aircraft noise and confounders included simultaneously in the logistic regression model. A significant association was found between annoyance due to aircraft noise and psychological distress: ORs ranged from 1.49 (95% CI 0.94-2.39) to 3.64 (95% CI 1.70-7.78), with gradual ORs across the different categories of annoyance. OR reached the maximum estimate for people reporting to be extremely annoyed compared to those who were not at all annoyed.

The results remained similar when noise sensitivity was included in the model. People reporting to be more sensitive than people around them had a higher risk of psychological distress (OR=1.70, 95% CI 1.25-2.31).

DISCUSSION

The DEBATS study is the first to investigate in France the relationship between annoyance due to aircraft noise and psychological distress in the population living near airports.

The results of the present study highlighted a significant association between annoyance due to aircraft noise and psychological distress. A dose-effect relationship was evidenced, showing an increased risk of psychological distress related to an increased severity of annoyance due to aircraft noise. These findings confirm those obtained in a previous study by van Kamp et al. [START_REF] Van Kamp | Environmental noise and mental health: evidence from the Schiphol monitoring program[END_REF] The authors also found a significant association between aircraft noise annoyance and psychological distress assessed by the GHQ-12.

The association between annoyance due to aircraft noise and psychological distress remained unchanged when noise sensitivity was included in the model. Moreover, people reporting to be more sensitive than people around them had a higher risk of psychological distress. This result confirms the one found in another study by Stansfeld et al. [START_REF] Stansfeld | Noise sensitivity and future risk of illness and mortality[END_REF] The authors observed that high sensitivity was associated with psychological distress: noise sensitivity has been identified as a predictor of mental ill-health.

In the present study, both associations, between annoyance and psychological distress on one hand, and between noise sensitivity and psychological distress on the other hand were still significant, underlining the independent effects of both factors.

The GHQ-12 is a reliable screening questionnaire, particularly recommended for identifying minor psychological disorders within community settings. Since the GHQ-12 is brief, simple, and easy to complete, and since its application in research settings as a screening tool is well documented, the GHQ-12 is widely used in large-scale studies as a general indicator of psychological distress. However, it is not a tool for indicating a clinical diagnosis.

Noise annoyance was assessed with the 5-point verbal scale recommended by ICBEN. This scale has been largely used within studies dealing with annoyance due to aircraft noise. This assessment method was part of the recommendations stated during the ICBEN conference in 2001 for standardized general-purpose noise reaction questions for community noise surveys [START_REF] Fields | Standardized general-purpose noise reaction questions for community noise surveys: research and a recommendation[END_REF] . Moreover, this scale has been introduced in the ISO standard ISO/TS 15666:2003 adopted in 2003 [START_REF]Acoustics -Assessment of noise annoyance by means of social and socio-acoustic surveys[END_REF] .

Selection and confounding biases were minimized in the present study, thus leading to reliable results. However, the direction of the association observed between annoyance due to aircraft noise and psychological distress could be questioned. Extremely annoyed people might be more at risk to have psychological disorders, but it is also possible that people with psychological disorders might be more at risk to be annoyed. The present study did not allow addressing this issue.

CONCLUSIONS

The present study found a significant association between annoyance due to aircraft noise and psychological distress assessed by the GHQ-12, showing gradual ORs across the different categories of noise annoyance. This result is consistent with the findings of the few studies performed to address that issue. However the direction of the association could be questioned. Therefore, further research is necessary to better understand this relationship.

Table 1 :

 1 Odds-ratio for the relationship between annoyance due to aircraft noise and psychological distress evaluated with the GHQ-12

	N	OR	M1 model (95% CI)	OR	M2 model (95% CI)


Wei Wang
email: wei.wang@irisa.fr

Sylvain Gombault
email: sylvain.gombault@telecom-bretagne.eu

Thomas Guyet
email: thomas.guyet@irisa.fr

Towards fast detecting intrusions: using key attributes of network traffic

Keywords: Intrusion detection, DDoS attack detection, attribute selection, Bayesian networks, C4.5, information gain I

Extracting attributes from network traffic is the first step of network intrusion detection. However, the question of which or what attributes are most effective for the detection still remains. In this paper, we employed information gain, wrapper with Bayesian Networks (BN) and Decision trees (C4.5) respectively to select key subsets of attributes for network intrusion detection based on KDD Cup 1999 data. We then used the selected 10 attributes to detect DDoS attacks in the real environments. The empirical results based on DDoS attack data collected in the real world as well as KDD Cup 1999 data show that only using the 10 attributes, the detection accuracy almost remains the same or even becomes better compared with using all the 41 attributes with both BN and C4.5 classifiers. Using a small subset of attributes also improves the efficiency in terms of attribute forming, models training as well as intrusion detection.

INTRODUCTION

Network-borne attacks are currently major threats to information security. As an important technique in the defense-in-depth network security framework, intrusion detection has become a widely studied topic in computer networks in recent years [START_REF] Lee | Information-theoretic measures for anomaly detection[END_REF]. In general, the techniques for intrusion detection fall into two major categories: signaturebased detection and anomaly detection. Signature-based detection (e.g., Snort [START_REF]Snort 2.1 Intrusion Detection (Second Edition)[END_REF] and IDIOT [START_REF] Kumar | A Software architecture to support misuse intrusion detection[END_REF]) identifies malicious behavior by matching it against pre-defined description of attacks. Anomaly detection [START_REF] Denning | An intrusion-detection model[END_REF], on the other hand, defines a profile of a subject's normal activities and attempts to identify any unacceptable deviation as possibly the result of an attack.

Intrusion Detection Systems (IDS) can also be categorized as host-based IDSs and network-based IDSs according to the target environment for detection. Host-based IDSs usually monitor the host system behavior by examining the information of the system, such as CPU time, system calls and command sequences. Examples are [START_REF] Forrest | A sense of self for Unix processes[END_REF][START_REF] Warrender | Detecting intrusions using system calls: alternative data models[END_REF][START_REF] Wang | Distance measures for anomaly intrusion detection[END_REF][START_REF] Wang | Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data[END_REF]. Network-based IDSs, on the other hand, monitor network behavior usually by examining the content (e.g., payload) as well as some statistical attributes of network traffic. In 1999, Lee et al. [START_REF] Lee | A Data Mining Framework for Building Intrusion Detection Models[END_REF][START_REF] Lee | A framework for constructing features and models for intrusion detection systems[END_REF] constructed 41 attributes from raw traffic data (i.e., tcpdump files) to build classification models for network based intrusion detection. The raw traffic data was collected at MIT Lincoln Laboratory for the 1998 DARPA Intrusion Detection Evaluation program [START_REF]DARPA Intrusion Detection Evaluation[END_REF]. The 41 attributes have been shown effective for network intrusion detection [START_REF] Lee | A Data Mining Framework for Building Intrusion Detection Models[END_REF][START_REF] Lee | A framework for constructing features and models for intrusion detection systems[END_REF] and the attribute sets of the network traffic have also been used as KDD Cup 1999 data (The 1999 Knowledge Discovery and Data Mining Tools Competition) [START_REF]KDD Cup 1999 data (Computer network intrusion detection[END_REF]. Lee et al. [START_REF] Lee | A Data Mining Framework for Building Intrusion Detection Models[END_REF][START_REF] Lee | A framework for constructing features and models for intrusion detection systems[END_REF] used Ripper to mine some detection rules from the attribute sets and to build misuse detection models. Eskin et al. [START_REF] Eskin | A Geometric framework for unsupervised anomaly detection[END_REF] used unsupervised methods, namely, cluster based estimation, k-Nearest Neighbor (kNN) and one class Support Vector Machines (SVM) for network intrusion detection. Jin et al. [START_REF] Jin | Network intrusion detection in covariance feature space[END_REF] utilized the covariance matrices of sequential samples to detect multiple network attacks. Katos [START_REF] Katos | Network intrusion detection: Evaluating cluster, discriminant, and logit analysis[END_REF] evaluated cluster, discriminant and logit analysis on the same KDD Cup 1999 data for network intrusion detection. Shyu et al. [START_REF] Shyu | Principal Componentbased Anomaly Detection Scheme[END_REF] proposed a Principal Component Classifier (PCC) for network intrusion detection. They measured the Mahalanobis distance of each observation from the center of the data for anomaly detection. S. Mukkamala et al. [START_REF] Mukkamala | Intrusion detection using an ensemble of intelligent paradigms[END_REF] evaluated performance of Artificial Neural Networks (ANNs), SVM and Multivariate Adaptive Regression Splines (MARS) on KDD Cup 1999 data for network intrusion detection. In our previous work [START_REF] Wang | Processing of Massive Audit Data Streams for Real-Time Anomaly Intrusion Detection[END_REF][START_REF] Wang | Building multiple behavioral models for network intrusion identification[END_REF][START_REF] Wang | Identifying Intrusions in Computer Networks with Principal Component Analysis[END_REF], we used Principal Component Analysis (PCA) and kNN for network intrusion detection and identification. Bouzida et al. [START_REF] Bouzida | Neural networks vs. decision trees for intrusion detection[END_REF][START_REF] Bouzida | Efficient intrusion detection using principal component analysis[END_REF] also employed PCA, neural networks and enhanced decision trees for network anomaly intrusion detection based on the same KDD Cup 1999 data set.

Data involved in current computer networks increases very fast and is naturally massive. In experiments carried out by MIT Lincoln Lab for the 1998 DARPA evaluation [START_REF]DARPA Intrusion Detection Evaluation[END_REF], for example, network traffic over 7 weeks contains four gigabytes of compressed binary tcpdump data that were processed into about five million connection records. A practical IDS, therefore, should have the capacity of fast processing large amounts of network data so that actions for response can be taken as soon as possible before substantial damage is done. Most existing network intrusion detection methods [START_REF] Lee | A Data Mining Framework for Building Intrusion Detection Models[END_REF][START_REF] Lee | A framework for constructing features and models for intrusion detection systems[END_REF][START_REF] Eskin | A Geometric framework for unsupervised anomaly detection[END_REF][START_REF] Jin | Network intrusion detection in covariance feature space[END_REF][START_REF] Katos | Network intrusion detection: Evaluating cluster, discriminant, and logit analysis[END_REF][START_REF] Shyu | Principal Componentbased Anomaly Detection Scheme[END_REF][START_REF] Mukkamala | Intrusion detection using an ensemble of intelligent paradigms[END_REF][START_REF] Wang | Processing of Massive Audit Data Streams for Real-Time Anomaly Intrusion Detection[END_REF][START_REF] Wang | Building multiple behavioral models for network intrusion identification[END_REF][START_REF] Wang | Identifying Intrusions in Computer Networks with Principal Component Analysis[END_REF][START_REF] Bouzida | Neural networks vs. decision trees for intrusion detection[END_REF][START_REF] Bouzida | Efficient intrusion detection using principal component analysis[END_REF] detect intrusions by using all the 41 attributes constructed from network traffic data. However, some of the attributes may be redundant or even noise and therefore decrease the detection system's performance, e.g., decrease the detection accuracy while increase system's overload. Empirical evidence from the attribute selection literature also shows that redundant information as well as irrelevant attributes should be eliminated for efficient classification tasks [START_REF] Yu | Feature Selection for High-Dimensional Data: A Fast Correlation-Based Filter Solution[END_REF]. Sung and Mukkamala [START_REF] Sung | Identifying Important Features for Intrusion Detection Using Support Vector Machines and Neural Networks[END_REF] used ANN and SVM to find some important attributes based on the performance comparison. For example, an attribute is identified as important if the detection accuracy decreases and/or computation time increases after the attribute is deleted from the training set. In this paper, we used different criteria to select key attributes. Filter (e.g., Information Gain) and Wrapper (with Bayesian Networks and decision trees algorithms) based attribute selection methods are used to select some key subsets from the 41 attributes. The subsets of attributes are then used for fast intrusion detection. This largely simplifies the detection problem because only a smaller set of attributes is required to extract from raw network traffic and to process in detection step. The empirical results based on KDD Cup 1999 data show that only using 10 attributes, the detection accuracy almost remains the same or even becomes better compared with using all the 41 attributes with both Bayesian Networks (BN) and decision trees (C4.5) classifiers.

Distributed Denial-of-Service (DDoS) attack is one of the major threats in current computer networks. However, DDoS attacks are difficult to quickly detect due to complex attack behaviors and a very large amount of data involved during the attacks. In the real network environment, we collected various DDoS attack tools to implement attacks and collect a large set of attack data. A normal data set is also collected during normal usage in the same network. Instead of using all the 41 attributes, we made programs to extract from raw network traffic only 10 key attributes that were identified for DoS attacks based on KDD Cup 1999 data. Based on the 10 attributes we extracted, we employ BN and C4.5 to build the detection model and perform intrusion detection. Experimental results based on the real DDoS attack data show that using a small subset of attributes improves the efficiency in terms of attribute forming, models training as well as intrusion detection. The detection models are also very effective to detect DDoS attacks.

The remainder of this paper is organized as follows. Section II describes the attributes selection schemes as well as intrusion detection methods. The experiments based on KDD Cup 1999 data are given in detail in Section III. We describe the detection of DDoS attacks in real computing environments in Section IV. Concluding remarks follow in Section V.

II. ATTRIBUTES SELECTION AND INTRUSION DETECTION SCHEMES

A. Attributes selection schemes

One of the central problems in intrusion detection is identifying a representative set of attributes from which to construct a classification model. Attribute selection algorithms fall into two broad categories: the filter model or the wrapper model [START_REF] Yu | Feature Selection for High-Dimensional Data: A Fast Correlation-Based Filter Solution[END_REF][START_REF] Das | Filters, wrappers and a boosting-based hybrid for feature selection[END_REF]. The filter model relies on general characteristics of the training data to select some attributes without involving any learning algorithm. The wrapper model, on the other hand, requires one predetermined learning algorithm in attribute selection and uses its performance to evaluate and determine which attributes are selected. As for each new subset of features, the wrapper model needs to learn a classifier. It tends to find attributes best suited to the predetermined learning algorithm resulting in superior learning performance, but it also tends to be more computationally expensive than the filter model [START_REF] Yu | Feature Selection for High-Dimensional Data: A Fast Correlation-Based Filter Solution[END_REF][START_REF] Das | Filters, wrappers and a boosting-based hybrid for feature selection[END_REF]. To facilitate comparison, in this paper, we use both kinds of attribute selection scheme, namely, information gain based filter model and wrapper based model. The attribute selection schemes are shown in Fig. 1.

i i i H Y P y P y ! " # (1)
where ( ) i P y is the prior probabilities for all values of Y. The uncertainty about the value of Y after observing values of X is given by the conditional entropy of Y given X defined as

2 ( | ) ( ) ( | ) log ( ( | )) j i j i j j i H Y X P x P y x P y x ! " # # (2)
where ( | ) i i P y x is the posterior probabilities of Y given the values of X. The information gain is thus defined as

( | ) ( ) ( | ) IG Y X H Y H Y X ! " (3) According to this measure, an attribute X is regarded more correlated to class Y than attribute Z, if ( | ) ( | ) IG Y X IG Y Z $
. By calculating information gain, we can rank the correlations of each attribute to the class and select key attributes based on this ranking.

2) Wrapper based attribute selection

For wrapper based attribute selection, we use Bayesian networks and decision trees (C4.5) as classifiers that will be described in next subsections. The classifiers used for the wrapper based attribute selection, in fact, are usually employed as intrusion detection schemes in detection step because the classifiers used during attribute selection step always best suit for classification.

B. Intrusion detection schemes 1) Bayesian networks based intrusion detection

A Bayesian network is used to model a domain containing uncertainty in some manner [START_REF] Heckerman | A Tutorial on Learning With Bayesian Networks[END_REF][START_REF] Duda | Pattern Classification[END_REF]. It is a probabilistic graphical model that represents a set of variables and their probabilistic independencies. In intrusion detection, for example, a Bayesian network could represent the probabilistic relationships between attribute sets and types of intrusions. Given an attribute vector of an instance, the Bayesian network can also be used to compute its probabilities of the presence of various classes (normal or individual type of intrusions).

Formally, Bayesian networks are Directed Acyclic Graphs (DAG) whose nodes represent variables, and whose arcs encode conditional dependencies between the variables. Each node contains the states of the random variable that it represents and a Conditional Probability Table (CPT). The CPT of a node contains probabilities of the node being in a specific state given the states of its parents. The parent-child relationship between nodes in a Bayesian network indicates the direction of causality between the corresponding variables. That is, the variable represented by the child node is causally dependent on the ones represented by its parents. There are some efficient algorithms that can be used to perform inference and learning in Bayesian networks [START_REF] Heckerman | A Tutorial on Learning With Bayesian Networks[END_REF][START_REF] Duda | Pattern Classification[END_REF].

Suppose there is an arc from node A to another node B, A is called a parent of B, and thus B is a child of A. The set of parent nodes of a node i X is denoted by ( ) i parents X . A directed acyclic graph is a Bayesian Network relative to a set of variables if the joint distribution of the node values can be written as the product of the local distributions of each node and its parents:

1 1 ( , , ) ( | ( )) n n i i i P X X P X parents X ! ! % ! (4)
Given a training set S, learning a Bayesian network is to find a network that best matches S. The learned network represents an approximation to the probability distribution governing the training set. For classification, given a test data vector represented with attributes, we use this network to compute its probability based on which for classification.

2) Decision tree based intrusion detection

The decision tree models are found to be very useful in the domain of data mining since they obtain reasonable accuracy and they are relatively inexpensive to compute. Decision tree classifiers are based on the "divide and conquer" strategy to construct an appropriate tree from a given learning set S containing a set of labeled instances. As a well known and widely used algorithm, C4.5 algorithm developed by Quinlan [START_REF] Quinlan | C4.5: Programs for Machine Learning[END_REF] generates accurate decision trees that can be used for effective classification.

C4.5 builds decision trees from a set of training data also with the concept of information entropy. It uses the fact that each attribute of the data can be used to make a decision that splits the data into smaller subsets. C4.5 examines the information gain ratio (can be regarded as normalized Information Gain) that results from choosing an attribute for splitting the data. The attribute with the highest information gain ratio is the one used to make the decision. Given a learning set S and a non class attribute X, the Gain Ratio is defined as:

2 ( | ) ( | ) | | | | log | | | | i i i IG S X IGR S X S S S S ! " # (5)
where i S is the subset of S for which attribute X have a value and | S | is the number of instances in S.

The decision trees are constructed as a set of rules during learning phase. It is then used to predict the classes of new instances based on the rules.

III. EXPERIMENTS ON KDD CUP 1999 DATA

In order to validate the proposed methods, firstly we used KDD Cup 1999 data for selection of key attributes as it is considered as a benchmark data set and has been widely used by many other methods. We then used the selected attributes for detection of DDoS attacks in real environments in our department.

A. Data sets

The original data contains traffic in a simulated military network that consists of hundreds of hosts. The data includes 7 weeks of training set and 2 weeks of test set that were not from the same probability distribution as the training set. Since the probability distribution is not the same, in our experiments, we only use the training set and sample one part of the data for training and another different part of the data for testing. The raw training set of the data contains about 4 gigabytes of compressed binary tcpdump data of network traffic and it was pre-processed into about 5 million connection records by Lee et al. [START_REF] Lee | A Data Mining Framework for Building Intrusion Detection Models[END_REF][START_REF] Lee | A framework for constructing features and models for intrusion detection systems[END_REF] as KDD Cup 1999 data [START_REF]KDD Cup 1999 data (Computer network intrusion detection[END_REF]. A connection is a sequence of TCP packets starting and ending at some well defined times, between which data flows from a source IP address to a target IP address under some well defined protocol [START_REF]KDD Cup 1999 data (Computer network intrusion detection[END_REF]. In the data set, each network connection is labeled as either normal, or as an exactly one specific kind of attack.

In KDD Cup 1999 data, each network connection is represented by 41 attributes [START_REF]KDD Cup 1999 data (Computer network intrusion detection[END_REF]. These attributes are divided into three groups: basic attributes of individual TCP connections, traffic attributes and content attributes within a connection suggested by domain knowledge. The attributes are listed in Table I and meaning of each attribute can be found in [START_REF]KDD Cup 1999 data (Computer network intrusion detection[END_REF]. There are 494,021 connection records in the training set in which 97,278 are normal and 396,744 are attacks. There are 22 types of attacks in total in the data set and these attacks fall into one of 4 categories: DoS: denial-ofservice (e.g., teardrop); PROBE: surveillance and other probing (e.g., port scanning); R2L: unauthorized access from a remote machine (e.g., password guessing) and U2R: unauthorized access to local superuser (root) privileges by a local unprivileged user (e.g., buffer overflow attacks).

B. Attributes selection results

As different categories of attacks may have different key subsets of attribute, we conduct four experiments to investigate which subset of attribute is more suitable for detecting individual category of attacks. The distribution of individual attack data is not balanceable, for example, smurf attack (DoS) has 280,790 instances while spy attack (R2L) has only 2 examples. In the experiments, we then assign the training and test sets based on the distribution of the attack instances. The data used for training and testing is shown in Table II (the attack data in bold font only has few instances). We performed information gain based and wrapper based attribute selection methods on each training sets. For wrapper based methods, the search method is chosen as best first. The selected attributes with different methods are listed in Table III. The attributes that at least two methods simultaneously select are in bold font. From table III, it is seen that some key features remains the same whatever the attack categories are. For example, attribute 5 (number of data bytes from source to destination) always ranks as very important for detection of all categories of attack. Generally, the basic attributes (attribute 1-6) are important for detection of all attack categories. For different attack categories, some key attributes are not the same. This is easily understood because different types of attack have their own patterns. For example, attribute 1 (duration: number of seconds of the connection) is an important pattern for R2L and U2R attacks while it is irrelevant for DoS and Probe attacks. Usually it requires a long time for R2L and U2R attacks to login to the system to guess the passwords or compromise some system's vulnerabilities to have the root privilege in a connection. DoS and Probe attacks, however, attack a system usually by sending a large mount of packets in a short time and thus the duration is very short. For each attack category, some attributes are always shown important whatever the attribute selection methods used. For example, attribute 23 (count: number of connections to the same host as the current connection in the past two seconds) is an important pattern for DoS attacks. This is because DoS attacks are to make a computer resource unavailable usually by flooding a network or other means with a very large mount of connections to the same host in a very short time.

For Information gain based attribute selection, the attributes selected have a ranking. For example, in table III for DoS attack detection, attribute 5 is more important than attribute 23 which is also more important than attribute 3, and so on. Based on the results in Table III, we use the most 10 common attributes that different methods simultaneously selected to form the key set of attributes shown in Table IV To evaluate the effectiveness of the selected attributes, we compare the detection results using the selected 10 attributes with the results using all the 41 attributes based on the same test data. In the experiments, we use Detection Rates (DR), calculated as the percentage of intrusions detected, and False Positive Rates (FPR), calculated as the percentage of normal connections falsely classified as intrusions, as criteria for evaluation. Bayesian networks and C4.5 are employed for detection based on the test sets of individual category of attacks and the contrastive results are shown in Table V. In general, the detection results are ideal when the detection rates are very high while the false positive rates are very low. From Table V, it is seen that the models detect high percentage of the DoS, Probe and R2L attacks but not as effective for U2R attacks. This is consistent with the results of many other papers because the behavior of U2R attacks is very similar with that of normal operations. From Table V, we can also see that the detection results only using the 10 attributes almost remain the same or even become better than those using all the 41 attributes. This shows that many of the 41 attributes are irrelevant and only a smaller set of attributes is required to extract from raw network traffic for detection of individual attacks. In next section, we thus only extract 10 attributes from network data for DDoS attack detection in actual computer networks.

IV. DETECTING DDOS ATTACKS IN REAL ENVIRONMENTS

BASED ON THE SELECTED 10 ATTRIBUTES Distributed Denial-of-Service (DDoS) attack is one of the major threats in current computer networks. It is an attempt to make a computer resource unavailable to the intended users. The means to, motives for, and targets of a DoS attack may vary, but it generally consists of the concerted, malevolent efforts of a person or persons to prevent an internet site or service from functioning efficiently. DoS and DDoS attacks are difficult to detect with high accuracy due to the sheer number of ways in which they can be executed, the increasingly sophisticated attack methods, the growing range of systems targeted and the increasing data involved. As DDoS attacks are very harmful to the networks, an effective DDoS attack detection system should be capable of detecting the attacks very fast for quick reaction. Instead of using a lot of attributes that may decrease the efficiency of detection process, we only use 10 key attributes described in above Section for DDoS attack detection in real environments.

A. Data sets and intrusion detection

As important work on our DDoS attack analysis and detection project in Institute Telecom, we collected some major DDoS attack tools and experienced them in our laboratory to collect a set of DDoS attack network traffic. The attack tools are Trinoo, TFN, Stacheldraht, TFN2K, and Mstream. Using these tools, we implement DDoS attacks with ICMP flood, SYN flood, UDP flood, Steam (TCP-ACK flood) and Smurf style attacks. A large set of normal as well as DDoS attack network traffic are then collected for analysis 1 .

One of the difficulties for detecting DDoS attack is to extract and select the most important attributes that represent attack behaviors to clearly distinguish them from normal activities. Since the programs for forming attributes from raw network traffic are not available, we have written the different programs (in C++) that transform tcpdump traffic into connection records with only 10 key attributes for detecting DDoS attacks as well as with all the 41 attributes for results comparison. In the experiments we used for Bayesian networks and C4.5 to build the models and detect DDoS attacks. The detection step is described in Fig. 2.

In the experiments, we randomly selected 30,000 normal connections and 36,380 DDoS attack connections to form the training set. For test set, we randomly selected 30000 different normal connections and different 33,900 DDoS attack connections. The training and test set were selected also according to the distributions of different kinds of DDoS attacks.

B. Results comparison

Using all the 41 attributes and only using 10 attributes respectively, we compare the experiment results in the following three aspects based on the order of intrusion detection steps. First, we compare CPU time used for extracting attributes from raw network traffic. Second, we compare the CPU time used for training and detection. Third, we compare the detection results. The experiments are performed in a system with 2.66 G Hz dual core CPU and 3.5G RAM memory. The CPU time used for extracting attributes is shown in Attribute extraction is the first step for intrusion detection. From Table VI we find that using a smaller set of attributes saves a lot of computation in the attribute forming step. Only using the 10 attributes required less time for both training and detection based on the results shown in Table VII. From Table VIII, it is seen that the detection results based on the real networks are consistent with those based on the KDD Cup 1999 data for DDoS detection. The detection results using only 10 attributes remain the same or even become better than the results using all the 41 attributes. All these are towards fast network intrusion detection for quick response against various DDoS attacks.

V. CONCLUDING REMARKS Data for intrusion detection has become increasingly larger in both number of instances and number of attributes. Selection of a key subset of attributes is thus very essential in reducing dimensionality, removing irrelevant data, reducing low use of resources and increasing detection accuracy for quick and effective response against attacks. In this paper, instead of using all the 41 attributes that most related papers used before, we select a key subset of attributes for intrusion detection based on several attribute selection schemes, namely, information gain and wrapper with Bayesian networks and with decision trees (C4.5) methods. Based on KDD Cup 1999 data, we selected subsets of key attributes for each attack category, DoS, Probe, R2L and U2R. The detection accuracy remains the same or even has some improvement based on only 10 attributes comparing to using all the 41 attributes. Using fewer attributes, therefore, cannot only enhance detection accuracy, but also improve detection efficiency as smaller data is required to process.

Distributed Denial of Service (DDoS) attacks are a major threat to the stability of the Internet. However, DDoS attacks are difficult to quickly detect as the data involved is usually very large and the attack behaviors frequently vary. In order to analyze and detect DDoS attacks in real computing environments, we collected a large data set of network traffic by implementing various DDoS attacks. We made some programs to extract only 10 attributes from the raw network traffic for representing each network connection. Bayesian networks and decision trees are then used for detecting intrusions. Experimental results show that with only 10 attributes, the detection rates almost remain the same or are even better than using all the 41 attributes. The detection rates achieve as high as 99.9% with false positive rate as 0.34%. The experimental results also show that using a smaller set of attributes largely reduce the time required for attribute forming, models training and intrusion detection. The small set of attributes thus can be regarded as a useful reference for further analysis and detection of DDoS attacks.

For our future work, we are developing an online selfadaptive intrusion detection model that includes two modules. The first module is to extract several key attributes from raw network traffic for fast attack detection. We plan to use some attributes that can be formed before a connection is finished for real-time intrusion detection. The other module is to upgrade the detection model dynamically and automatically for addressing the concept drift problem.

Fig. 1 :

 1 Fig.1: Attribute selcetion schemes

Fig. 2 .

 2 Fig. 2. Attributes selection and detection of DDoS attacks

TABLE I .

 I THE MAPS BETWEEN THE ATTRIBUTES AND THE NUMBER USED IN THE PAPER

	No.	Network attributes	No.	Network attributes	No.	Network attributes	No.	Network attributes
	1	duration	12	logged_in	23	count	34	dst_host_same_srv_rate
	2	protocol_type	13	num_compromised	24	srv_count	35	dst_host_diff_srv_rate
	3	service	14	root_shell	25	serror_rate	36	dst_host_same_src_port_rate
	4	flag	15	su_attempted	26	srv_serror_rate	37	dst_host_srv_diff_host_rate
	5	src_bytes	16	num_root	27	rerror_rate	38	dst_host_serror_rate
	6	dst_bytes	17	num_file_creations	28	srv_rerror_rate	39	dst_host_srv_serror_rate
	7	land	18	num_shells	29	same_srv_rate	40	dst_host_rerror_rate
	8	wrong_fragment	19	num_access_files	30	diff_srv_rate	41	dst_host_srv_rerror_rate
	9	urgent	20	num_outbound_cmds	31	srv_diff_host_rate
	10	hot	21	is_host_login	32	dst_host_count
	11	num_failed_logins	22	is_guest_login	33	dst_host_srv_count
	TABLE II. DATA USED FOR TRAINING AND TESTING IN THE EXPERIMENTS
	Category	Training set (randomly	Test set (randomly selected
		selected)		from the rest of the data)
	DoS	Normal 40,000, smurf 10,000,	normal 40,000, smurf
	(391,458)	neptune 5000, back 1000, land	10,000, neptune 5000, back
		10, pod 100, teardrop 400	1203, land 11, pod 164,
				teardrop 579
	Probe	Nomal 40,000, satan 800,	normal 40,000, satan 789,
	(4107)	portsweep 500, nmap 110,	portsweep 540, nmap 121,
		ipsweep 600		ipsweep 647
	R2L	Normal 40,000, ftp_write 4,	Normal 40,000, ftp_write
	(1126)	guess_passwd 23, imap 7,	4, guess_passwd 30, imap
		multihop 3, warezclient 520,	5, multihop 4, warezclient
		warezmaster 10, phf 4, spy 2	500, warezmaster 10
	U2R	Normal 40,000,		Normal 40,000,
	(52)	buffer_overflow 15, rootkit 4,	buffer_overflow 15, rootkit
		loadmodule 4		6, loadmodule 5, perl 3

  for detection of different categories of attacks.

TABLE III .

 III SELECTED ATTRIBUTES FOR DETECTION OF INDIVIDUAL ATTACK

		CATEGORY WITH DIFFERENT METHODS
	Attacks Methods	Attributes selected
		IG	5, 23, 3, 24, 6, 2, 36 (ranking)
	DoS	Wrapper (BN)	4, 5, 8, 10, 13, 23, 37
		Wrapper (C4.5)	3, 5, 6, 13, 23
		IG	5, 3, 6, 35, 33, 34, 4, 27, 23 (ranking)
	Probe	Wrapper (BN)	3, 4, 5, 29, 32, 35
		Wrapper (C4.5)	5, 29, 30, 35, 39, 40
		IG	5, 3, 6, 33, 36, 10, 37, 24, 1
	R2L	Wrapper (BN)	1, 5, 6, 22, 23, 32
		Wrapper (C4.5)	1, 3, 5, 6, 12, 31
		IG	3, 33, 13, 14, 1, 10, 5, 17, 32, 36 (ranking)
	U2R	Wrapper (BN)	1, 2, 5, 14, 36
		Wrapper (C4.5)	1, 13, 14, 32

TABLE IV .

 IV SELECTED ATTRIBUTES FOR INDIVIDUAL ATTACK CATEGORY

	Attacks	Attributes selected
	DoS	3, 4, 5, 6, 8, 10, 13, 23, 24, 37
	Probe	3, 4, 5, 6, 29, 30, 32, 35, 39, 40
	R2L	1, 3, 5, 6, 12, 22, 23, 31, 32, 33
	U2R	1, 2, 3, 5, 10, 13, 14, 32, 33, 36

TABLE V .

 V RESULTS COMPARISON USING 41 ATTRIBUTES AND 10 ATTRIBUTES

	Attacks Methods	Using 41 attributes	Using 10 attributes
			DR (%)	FPR(%) DR (%)	FPR (%)
	DoS	BN	98.73	0.08	99.88	0
		C4.5	99.96	0.15	99.87	0.14
	Probe	BN	92.89	6.08	82.93	3.06
		C4.5	82.59	0.04	82.88	0.05
	R2L	BN	92.22	0.33	89.33	0.32
		C4.5	80.29	0.02	87.34	0.01
	U2R	BN	75.86	0.29	65.5	0.12
		C4.5	24.14	0	24.14	0

  Table VI and the time used for training the models and detecting intrusions is given in Table VII. Table VIII summarizes the testing results with Bayesian Networks and C4.5 based on only 10 attributes as well as on all the 41 attributes.

TABLE VI .

 VI TIME USED DURING ATTRIBUTES FORMING

	No.	of		Time used (s)
	connections	41 attributes	10 attributes
	30,000			2043	289
	TABLE VII. TIME USED DURING TRAINING AND DETECTION
	Methods	41 attributes	10 attributes
	Training(s)	Detection(s)	Training(s)	Detection (s)
	BN	4.42		0.9	0.7	0.2
	C4.5	15.27		0.9	1.03	0.2
	TABLE VIII. DETECTION RESULTS USING 41 ATTRIBUTES AND 10 ATTRIBUTES
	Methods		41 attributes	10 attributes
		DR (%)	FPR (%)	DR (%)	FPR (%)
	BN	99.03	1.53	99.49	1.92
	C4.5	99.80	0.26	99.90	0.34

The data is available upon request to the third author.

ACKNOWLEDGMENTS

For IRISA/INRIA part, the research in this paper was supported by SéSur (Sécurité et Surveillance dans les Flots de Données) project. For TELECOM Bretagne, the research in this paper was supported by French Ministry of Research (CNRS ACI-SI), Dependable Anomaly Detection with Diagnosis (DADDi) project and by Institute TELECOM, DDOS Detection and passivation project. The authors thank Dr. René Quiniou and Prof. Marie-Odile Cordier for the valuable discussions and comments.