Igor Mishsky
email: igormishsky@gmail.com

Nurit Gal-Oz
email: galoz@sapir.ac.il

Ehud Gudes

A Topology based Flow Model for Computing Domain Reputation

The Domain Name System (DNS) is an essential component of the internet infrastructure that translates domain names into IP addresses. Recent incidents verify the enormous damage of malicious activities utilizing DNS such as bots that use DNS to locate their command & control servers. Detecting malicious domains using the DNS network is therefore a key challenge. We project the famous expression Tell me who your friends are and I will tell you who you are, motivating many social trust models, on the internet domains world. A domain that is related to malicious domains is more likely to be malicious as well. In this paper, our goal is to assign reputation values to domains and IPs indicating the extent to which we consider them malicious. We start with a list of domains known to be malicious or benign and assign them reputation scores accordingly. We then construct a DNS based graph in which nodes represent domains and IPs. Our new approach for computing domain reputation applies a flow algorithm on the DNS graph to obtain the reputation of domains and identify potentially malicious ones. The experimental evaluation of the flow algorithm demonstrates its success in predicting malicious domains.

Introduction

Malicious botnets and Advanced Persistent Threats (APT) have plagued the Internet in recent years. Advanced Persistent Threat, often implemented as a botnet, is advanced since it uses sophisticated techniques to exploit vulnerabilities in systems, and is persistent since it uses an external command and control (C&C) site which is continuously monitoring and extracting data of a specific target. APTs are generated by hackers but are operated from specific domains or IPs. The detection of these misbehaving domains (including zero day attacks) is difficult since there is no time to collect and analyze traffic data in real-time, thus their identification ahead of time is very important. We use the term domain reputation to express a measure of our belief that a domain is benign or malicious. The term reputation is adopted from the field of social networks and virtual communities, in which the reputation of a peer is derived from evidences regarding its past behavior but also from its relations to other peers [START_REF] Page | Pagerank citation ranking: Bringing order to the web[END_REF]. A domain reputation system can support the decision to block traffic or warn organizations about suspicious domains. Currently lists of domains which are considered legitimate are published by web information companies (e.g., Alexa [START_REF] Gudes | Websites Ranking[END_REF]) while black-lists of malware domains are published by web threat analysis services (e.g., VirusTotal [START_REF]VirusTotal: A free virus, malware and URL online scanning service[END_REF].) Unfortunately the number of domains appearing in both types of lists is relatively small, and a huge number of domains is left unlabeled. Therefore, the problem of assigning reputation to unlabeled domains is highly important.

The Domain Name Service (DNS) maps domain names to IP addresses and provides an essential service to applications on the internet. Many botnets use a DNS service to locate their next C&C site. For example, botnets tend to use short-lived domains to evasively move their C&C sites. Therefore, DNS logs have been used by several researchers to detect suspicious domains and filter their traffic if necessary. Choi and Lee [START_REF] Choi | Identifying botnets by capturing group activities in dns traffic[END_REF], analyzed DNS traffic to detect APTs. Such analysis requires large quantities of illegitimate DNS traffic data.

An alternative approach was proposed in the Notos system [START_REF] Antonakakis | Building a dynamic reputation model for dns[END_REF] which uses historical DNS information collected passively from multiple recursive DNS resolvers to build a model of how network resources are allocated and operated for legitimate Internet services. This model is mainly based on statistical features of domains and IPs that are used for building a classifier which assigns a reputation score to unlabeled domains. The main difference between the DNS data used for computing reputation and the data used for malware detection is that the first consists of mainly static properties of the domain and DNS topology data, while the latter requires behavioral and time-dependent data. While DNS behavior data may involve private information (e.g., the domains that an IP is trying to access), which ISPs may be reluctant to analyze or share, DNS topology data is much easier to collect. Our research also focuses on computing domain reputation using DNS topology data.

Various definitions of the terms trust and reputation have been proposed in the literature as the motivation for a computational metric. Trust is commonly defined following [START_REF] Mui | A computational model of trust and reputation for e-businesses[END_REF] as a subjective expectation an agent has about another's future behavior based on the history of their encounters. The history is usually learned from ratings that peers provide for each other. If such direct history is not available, one derives trust based on reputation. Reputation is defined [START_REF] Mui | A computational model of trust and reputation for e-businesses[END_REF] as the aggregated perception that an agent creates through past actions about its intentions and norms. , where this perception is based on information gathered from trusted peers. These definitions are widely used in state of the art research on trust and reputation as the logic behind trust based reputation computational models in web communities and social networks. However, computing reputation for domains raises several new difficulties:

-Rating information if exists, is sparse and usually binary, a domain is labeled either "white" or "black" -Static sources like blacklists and whitelists are often not up-to-date -There is no explicit concept of trust between domains which make it difficult to apply a flow or a transitive trust algorithm.

-Reputation of domains is dynamic and changes very fast These difficulties make the selection of an adequate computational model for computing domain reputation a challenging task. The focus of our paper and its main contribution is therefore a flow model and a flow algorithm for computing domain reputation which uses a topology-based network that maps connections of domains to IPs and other domains. Our model uses DNS IP-Domain mappings and statistical information but does not use DNS traffic data.

Our approach is based on a flow algorithm, commonly used for computing trust in social networks and virtual communities. We are mainly inspired by two models: the Eigentrust model [START_REF] Kamvar | The eigentrust algorithm for reputation management in p2p networks[END_REF] that computes trust and reputation by transitive iteration through chains of trusting users; and the model by Guha et al. [START_REF] Guha | Propagation of trust and distrus[END_REF] which combines the flow of trust and distrust. The motivation for using a flow algorithm is the hypothesis that IPs and domains which are neighbors of malware generating IPs and domains, are more likely to become malware generating as well. We construct a graph which reflects the topology of domains and IPs and their relationships and use a flow model to propagate the knowledge received in the form of black list, to label domains in the graph as suspected domains. Our preliminary experimental results support our proposed hypothesis that domains (or IPs) connected to malicious domains have a higher probability to become malicious as well.

The main contribution of this paper lies in the novelty of the algorithm and the strength of the supporting experimental study.

The experimental study supporting our results, uses a sizable DNS database (more than a one million IPs and domains) which proves the feasibility of our approach. The rest of this paper is organized as follows. Section 2 provides a more detailed background on DNS and IP characteristics and on the classical flow models, and then surveys the related work. Section 3 discusses the graph construction, the weight assignment problem and the flow algorithm. Section 4 presents the results of our experimental evaluation and Section 5 concludes the paper and outlines future research.

Background and Related Work

The domain name system (DNS) translates Internet domains and host names into IP addresses. It is implemented as an hierarchical and distributed database containing various types of data, including host names and domain names, and provides application level protocol between clients and servers. An often-used analogy to explain the Domain Name System is that it serves as the phone book for the Internet by translating human-friendly computer host names into IP addresses. Unlike a phone book, the DNS can be quickly updated, allowing a service's location on the network to change without affecting the end users, who continue to use the same host name. Users take advantage of this when they use meaningful Uniform Resource Locators (URLs). In order to get the IP of a domain, the host usually consults a local recursive DNS server (RDNS).The RDNS iteratively discovers which authoritative name server is responsible for each zone. The result of this process is the mapping from the requested domain to the IP requested.

Two categories of models are related to our work. The first category deals with ways to compute domain reputation. The second deals with flow algorithms for the computation of trust and reputation in general. Domain reputation is a relatively new research area. The Notos model for assigning reputation to domains [START_REF] Antonakakis | Building a dynamic reputation model for dns[END_REF] was the first to use statistical features in the DNS topology data and to apply machine learning methods to construct a reputation prediction classifier. Notos uses historical DNS information collected passively from multiple DNS resolvers to build a model of how network resources are allocated and operated for professionally run Internet services. Specifically it constructs a set of clusters representing various types of popular domains statistics and computes features which represent the distance of a specific domain from these clusters. Notos also uses information about malicious domains obtained from sources such as spam-traps, honeynets, and malware analysis services to build a set of features representing how network resources are typically allocated by Internet miscreants. With the combination of these features, Notos constructs a classifier and assigns reputation scores to new, previously unseen domain names.(Note that Notos uses heavily, information about highly popular sites such as Acamai which is not publicly available and therefore make it difficult to compare to.) The Exposure system [START_REF] Leyla | Exposure finding malicious domains using passive dns analysis[END_REF] collects data from the DNS answers returned from authoritative DNS servers and uses a set of 15 features that are divided into four feature types: time-based features, DNS answer-based features, TTL valuebased features, and domain name-based features. The above features are used to construct a classifier based on the J48 decision tree algorithm [START_REF] Witten | Data Mining: Practical Machine Learning Tools and Techniquel[END_REF] in order to determine whether a domain name is malicious or not. Kopis [START_REF] Antonakakis | Detecting malware domains at the upper dns hierarchy[END_REF] is a system for monitoring the high levels of the DNS hierarchy in order to discover the anomaly in malicious DNS activities. Unlike other detection systems such as Notos [START_REF] Antonakakis | Building a dynamic reputation model for dns[END_REF] or Exposure [START_REF] Leyla | Exposure finding malicious domains using passive dns analysis[END_REF],Kopis takes advantage of the global visibility of DNS traffic at the upper levels of the DNS hierarchy to detect malicious domains. After the features are collected it uses the random forest technique as the machine learning algorithm to build the reputation prediction classifier.

In the category of flow algorithms for computation of trust in general, two models are of specific interest to our work. The first is Eigentrust [START_REF] Kamvar | The eigentrust algorithm for reputation management in p2p networks[END_REF], a reputation management algorithm for peer-to-peer network. The algorithm provides each peer in the network a unique global trust value based on the peer's history of uploads and thus aims to reduce the number of inauthentic files in a P2P network. The algorithm computes trust and reputation by transitive iteration through chains of trusting users. The page-rank algorithm [START_REF] Page | Pagerank citation ranking: Bringing order to the web[END_REF] uses a similar approach, however it contains special features related to URL referencing. Guha et al. [START_REF] Guha | Propagation of trust and distrus[END_REF] introduce algorithms for implementing a web-of-trust that allows people to express either trust or distrust in other people. Two matrices representing the trust and distrust between people are built using four types of trust relationships. They present several schemes for explicitly modeling and propagating trust and distrust and propose methods for combining the two, using weighted linear combination. The propagation of trust was also used by Coskun et al. [START_REF] Coskun | Friends of an enemy: identifying local members of peer-to-peer botnets using mutual contacts[END_REF] for detecting potential members of botnets in P2P networks. Their proposed technique is based on the observation that peers of a P2P botnet with an unstructured topology, communicate with other peers in order to receive commands and updates. Since there is a significant probability that a pair of bots within a network have a mutual contact, they construct a mutual contact graph. This graph is different than the DNS topology graph we rely on, the attributes and semantics underlying our approach are different and accordingly the algorithm we propose. Wu et al. [START_REF] Wu | Propagating trust and distrust to demote web spam[END_REF] use the distrust algorithm presented by Guha et al. [START_REF] Guha | Propagation of trust and distrus[END_REF] for detecting spam domains but use URL references rather than DNS data to derive the edges between domain nodes. They also discuss trust attenuation and the division of trust between a parent and its "children". Yadav et al. [START_REF] Yadav | Detecting algorithmically generated malicious domain names[END_REF] describe an approach to detect malicious domains based mainly on their names distribution and similarity. They claim that many botnets use the technique of DGA (domain generating algorithm) and they show that domains generated in this form have certain characteristics which help in their detection. The domain names usually have a part in common, e.g. the top level domain (TLD), or a similar distribution of alpha-numeric characters in their names. The success of using the above characteristics in [START_REF] Yadav | Detecting algorithmically generated malicious domain names[END_REF] motivates the construction of domain-domain edges in our graph as well.

There are quite a few papers which use DNS data logs to detect Botnets and malicious domains. However these papers use the DNS traffic behavior and not the mapping information used by Notos and in our work. Villarmin et al. [START_REF] Villamarin-Salomon | Bayesian bot detection based on dns traffic similarity[END_REF] provide C&C detection technique motivated by the fact that bots typically initiate contact with C&C servers to poll for instructions. As an example, for each domain, they aggregate the number of non-existent domains (NXDOMAIN) responses per hour and use it as one of the classification features. Another work of this category, presented by Choi and Lee [START_REF] Choi | Identifying botnets by capturing group activities in dns traffic[END_REF] monitor DNS traffic to detect botnets, which form a group activity in similar DNS queries simultaneously. They assume that infected hosts perform DNS queries at several occasions and using this data they construct a feature vector and apply a clustering technique to identify malicious domains. As discussed above, although DNS traffic data has significant features, it is difficult to obtain comparing to DNS topological data.

To summarize, although there are some previous works on domain reputation using DNS statistical features (e.g., Notos), and there exist flow algorithms in other trust and reputation domains, the combination of the two as used in this paper is new.

The Flow Model

The goal of the flow algorithm is to assign domains with reputation scores given an initial list of domains with known reputation (good or bad). The first step is the construction of the Domain-IP graph based on information obtained from a large set of successful DNS transactions represented as A-records. The A-records are used to construct the DNS topology graph, where vertices represent IPs and domains, and the weighted edges represent the strength of their connections. This is described next. In subsection 3.2 we present in detail the flow algorithm, and describe the method for combining good and bad reputation scores. Finally we discuss an optimization of the algorithm needed for large graphs.

Constructing the graph and assigning edge weights

The DNS topology graph consists of two types of vertices: domains and IPs, deriving four types of edges between them. To construct the graph we use Arecords, and also data available from public sources to estimate the strength of connections between any two vertices, IP or domain, by the amount of common data between them. The IP data for each IP consists of the following five characteristics available from sources such as e.g., WHOIS databae [15]:

-Autonomous System number (ASN): a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators that present a common, clearly defined routing policy to the Internet. The ASN number is the indexation of the collection. -Border Gateway Protocol (BGP) prefix: a standardized exterior gateway protocol designed to exchange routing and reachability information between autonomous systems (AS) on the Internet. The protocol defines the routing of of each ASN.BGP prefix as a range of IPs to which it routes. -Registrar: the name of the organization that registered the IP.

-Country: the country to which the IP belongs.

-Registration date: the date and time at which the IP was registered.

For Domain data the key concept is the parent of a domain. A k-Top Level Domain (kTLD) is the k suffix of the domain name [START_REF] Antonakakis | Building a dynamic reputation model for dns[END_REF]. For example: for domain finance.msn.com, the 3TLD is the same as the domain name: finance.msn.com, the 2TLD is .msn.com and the 1TLD is .com.

We use the following notation: Set IP is the set containing all the IPs. Set domain is the set containing all the domains. Set parent ⊆ Set domain is the set containing all the parents. Set commonAtt is the set of attributes vectors derived from IP data. Attribute appear in the following order: country, ASN, BGP prefix, registrar, registration date. Missing information is replaced with 'none'. For example (DE, none, none, ST RAT O.DE, none) ∈ Set CommonAtt is the vector element in which the only information available is the country and the registrar.

We define a weight function that assigns a weight to each edge in the graph. Let w be a weight function w : (u, v) → [0, 1] used to assign weight to the edge (u, v) where u, v ∈ Set IP ∪ Set domain , for each edge type we consider three alternative weight functions as follows:

1. IP to domain: For ip ∈ Set IP and the list of A-records, let D ip be all the domains mapped to ip. For each d ∈ D ip we define: w(ip, d) =

w(d 1 , d 2 ) = 1 |P d | ; 1 log |P d | ; 1.
The intuition behind the above definition of weights is that, the effect of a domain reputation on the IPs it is mapped to, increases, as the amount of mapped IPs decreases. We use three approaches for computing weight, which produce 81 different combinations from which a subset was tested. We represent our graph as an adjacency matrix M , in which the value of an entry (i, j) is the weight between vertex i and j computed according to the selected combination.

The Flow algorithm

The flow algorithm models the idea that IPs and domains affect the reputation of IPs and domains connected to them. This is done by propagating a node's reputation iteratively, so that the reputation in each iteration is added to the total reputation accumulated within a domain or IP node, using some attenuation factor. The attenuation factor is a means to reduce the amount of reputation accumulated by transitivity. The flow algorithm is executed separately to propagate good reputation and bad reputation. The algorithm is presented in two parts, the first is the Basic Flow, which describes the flow algorithm in general, and the second is the Combined Algorithm, which focuses on the way bad reputation and good reputation are combined.

Figure 1 outlines the preparation steps prior to the execution of the basic algorithm. The Basic Flow algorithm starts with an initial set of domains which are labeled either bad or good. The parameters of the algorithm are:

1. A matrix M , where each entry represents a weighted edge between the vertices (domains or IPs); M T denotes the transpose of the matrix M . 2. V initial -a vector representing the initial reputation value of each vertex, based on the initial set of labeled vertices. 3. n ∈ N -the number of iterations. 4. atten ∈ [0, 1] -the attenuation factor. 5. θ ∈ [0, 1] -a reputation threshold above which a vertex is considered bad. Algorithm 1 outlines the basic flow algorithm that propagates the reputation from a node to its neighbors and is carried out in three steps:

1. Calculate the matrix for the i th iteration: 2. Calculate the final Matrix after n iterations as the sum of all the matrices with attenuation:

M i = (M T • atten) i
M f inal = n i=0 (M T • atten) i 3. Calculate the final reputation vector: V f inal = M n • V initial , the reputation
scores of all vertices after the propagation.

Applying the algorithm separately to propagate bad and good reputation may result in a node that is labeled both as good and bad. The final labeling of such node depends on the relative importance given to each label as done in the combined algorithm.

Algorithm 1 Basic

procedure Basic(M, n, atten, V initial )

for i = 0 to n do Mi ← (atten • M T ) i M f inal ← n i=0 Mi V f inal ← M f inal • V initial return V f inal
The combined algorithm runs the basic flow algorithm twice with V initial = V good and V initial = V bad . Each flow is configured independently with the following parameters: factor, threshold, and number of iterations. We denote n good , n bad ∈ N as the number of iterations for the good and bad flow respectively; atten good , atten bad ∈ R, as the attenuation factor for the good and bad flow respectively; and w ∈ R the weight of the "good" reputation used when combining the results. Algorithm 2 uses of the basic flow algorithm to compute the good and bad reputation of each vertex and merge the results. Set M al is the result set of domains identified as bad.

Algorithm 2 Combined

1: V good ← basic(M, n good , atten good , V good ) 2: V bad ← basic(M, n bad , atten bad , V bad ) 3:

Set M al ← ∅ 4: for d ∈ Domains do 5: if V bad [d] + w • V good [d] > θ then Set M al ← Set M al ∪ {d} 6: return Set M al
The combined algorithms ignores the following observations which lead us to examine another approach:

-A reputation score is a value in the range of [0,1], therefore a vertex should not distribute a reputation score higher then 1 to it's neighbors. -Initial labels are facts and therefore domains that were initially labeled as good or bad should maintain this label throughout the propagation process. -A domain gaining a reputation value above a predefined threshold, bad or good, is labeled accordingly and maintain this label throughout the propagation process.

The extended algorithm shown as Algorithm 3 is proposed to address these observations. The main new procedure is the N ormalize procedure which normalizes the scores after each iteration. The threshold used is the average of the scores so far (good or bad according to the actual procedure).

Optimization for large graphs

As we deal with millions of domains and IPs we have to calculate the scores in an efficient way. The most computationally intensive step is the matrix multiplication (see Figure 1). To speed it up we use a special property of our graph which is the existence of Cliques. There are two kinds of cliques in the graph: cliques of IPs which share the same set of common attributes and cliques of domains which share the same parent or the same name server. Since a clique can contain thousands of nodes we calculate the flow within it separately and not as part of the matrix multiplication. A clique in a graph is a subset of its vertices such that every two vertices in the subset are connected by an edge. We define a Balanced Clique as a clique such that all vertices have the same attribute values. This necessarily leads to a clique with a single weight value on all of its edges.

Theorem 1. Let M be a matrix representing a weighted directed graph and V a vector representing vertices values, and let BC be the set of vertices that form a balanced clique, such that the weight on every edge in BC is const BC ∈ R; For Algorithm 3 Extended

1: for x ∈ Domains do 2: V bad [x] ← 0; V good [x] ← 0 3: if x ∈ Set bad then V bad [x] ← 1 4: if x ∈ Set good then V good [x] ← 1 5: for i = 1 to n do 6: V good ← V good + (M T ) • V good 7: V bad ← V bad + (M T ) • V bad 8:
N ormalize(Set good , V bad , V good ) 9:

N ormalize(Set bad , V good , V bad ) 10:

Set M al ← ∅ 11: for d ∈ Domains do 12: if V bad [d] + w • V good [d] > θ then Set M al ← Set M al ∪ {d} 13: return Set M al 14: procedure N ormalize(Set1, V1, V2) 15: avg2 ← 0 16: if d∈Set 1 V good [d] > 0 then avg2 ← d∈Set 1 V 2 [d] |{d∈Set 1 :V 2 [d]>0}|
17:

for x ∈ Domains do 18: if V1[x] > 1 then V1[x] ← 1 19: if x ∈ Set1 then V2[x] ← 0 20: if V1[x] > 1 -avg2 then V1[x] ← 1 a vertex v ∈ BC, connected only to vertices in BC ((M T ) * V )[v] = const BC • v =i∈BC V [i] (1)
Due to space limitation, the proof of this theorem is omitted.

Using the property of a balanced clique we devised the following algorithm for computing the scores. The reputation of every clique vertex is the sum of reputation scores of all other vertices of the clique, multiplied by the constant edge weight of the clique. This is shown in algorithm 4.

Algorithm 4 AssignBCScores

procedure AssignBCScores(BC, constBC , V ) Sum ← i∈BC V [i] for i ∈ BC do V result [i] = (Sum -V [i]) • constBC return V result [i]
The complexity of this algorithm is O(|BC|) which is a significant improvement to O(|BC| 2 ), the complexity of the matrix multiplication approach. In our graph, all edges between the same type of vertices (IPs or domains) belong to balanced cliques and therefore this optimization plays a major factor.

Experiment results

The evaluation of the algorithm uses real data collected from several sources. To understand the experiments and the results, we first describe the data obtained for constructing the graph, and the criteria used for evaluating the results.

Data sources

We used five sources of data to construct the graph.

-A-records: a database of successful mappings between IPs and domains, collected by Cyren [START_REF] Cyren | A provider of cloud-based security solutions[END_REF] from a large ISP over several months. This data consists of over one milion domains and IPs which are used to construct the nodes of the graph. -Feed-framework: a list of malicious domains collected and analyzed by Cyren over the same period of time as the collected A-records. This list is intersected with the domains that appeared in the A-records and serves as the initial known "bad" domains vector.

-Whois [15]: a query and response protocol that is widely used for querying databases that store the registered users or assigners of an Internet resource, such as a domain name, an IP address block, or an autonomous system. We use WHOIS to get the IP data, which consists of the five characteristics of IP (ASN, BGP prefix, registrar, country, registration date).

-VirusTotal [START_REF]VirusTotal: A free virus, malware and URL online scanning service[END_REF] -a website that provides scanning of domains for viruses and other malware. It uses information from 52 different antivirus products and provides the time a malware domain was detected by one of them. -Alexa: Alexa database ranks websites based on a combined measure of page views and distinct site users. Alexa lists the "top websites" based on this data averaged over a three-months period. We use the set of top domains as our initial benign domains, intersecting it with the domains in the Arecords. This set is filtered to remove domains which appeared as malicious in VirusTotal.

We conducted two sets of experiments Tuning-test and Time-test . In the Tuningtest experiment, the DNS graph is built from the entire set of A-records, but the domains obtained by the Feed-Framework are divided into two subsets: an Initial set and a Test set. The Initial set is used as the initial vector of "bad" domains for the flow algorithm. The test set is left out to be identified as bad by the algorithm. Obviously, not all bad domains of the test set can be identified, mainly because the division of domains was done randomly and some of the domains in the test set are not connected to the initial set. Yet, this experiment was very useful to determine the best parameters of the algorithm which were used later in the Time-Test experiment. The time-test experiment, is carried out in two steps corresponding to two consecutive time periods. In the first step, we construct the graph from the data sources described above. We use the feedframework data to set the initial vector of bad domains in the first time period and the Alexa data to set the initial vector of good domains. We execute the flow algorithm (combined or extended) and assign the final score for each node of the graph.

To validate the results of the Time-test, we check the domains detected as malicious by the algorithm against data from VirusTotal for the period following the time period used in the first step. We sort the domains by descending bad reputation score and use the score of the domain on the k-th position as the threshold. As the evaluation criteria for this test, we define a Prediction Factor (PF) which evaluate the ability of our algorithm to detect bad domains identified later by VirusTotal. We compute this factor as the ratio of domains labeled as bad that were tagged by VirusTotal and a random set of domains of the same size, that were tagged by VirusTotal.

A domain tested with VirusTotal, is considered as tagged only if it was tagged by at least one anti-virus program. A P F i factor considers a domain as tagged by VirusTotal if at least i anti viruses tagged the domain.

To compute the prediction factor we extract the set of domains with the khighest bad reputation scores HSet k found by the algorithm and select randomly a set of k domains RSet k :

P F i = |HSet k ∩ Set i tagged | |RSet k ∩ Set i tagged | (2)
where set i tagged is the set of all domains tagged by at least i anti viruses. A value of P F i indicates the extent to which our algorithm identifies correctly bad domains, compared to the performance of randomly selected domains. A similar approach was used by Cohen et al. [START_REF] Cohen | Early detection of outgoing spammers in large-scale service provider networks[END_REF] that compared the precision of a list of suspicious accounts returned by a spam detector against a randomly generated list. Next we describe the results of the two experiments.

The Tuning test

There are two main objectives to the Tuning test. The first is to verify that domains with higher bad reputation values are more likely to be detected as bad domains. The second objective is to understand the impact of the different parameters on the final results and configure the evaluation experiment accordingly. We tested the different weight functions discussed in section 3.1. The following combination was found best and was selected to compute the weights on the graph edges:

-IP to domain -for ip ∈ Set The tuning test also examines the attenuation of the flow, the number of iterations, and the relative importance of the good domains used to calculate the final score. The tuning test repeats the following steps:

1. Construct the graph from the entire A-records database. 2. Divide the set of 2580 tagged malicious domains from the feed-framework into two sets: an initial set of 2080 domains and a test set consisting of 500 domains. 3. Apply the flow algorithm (combined or extended) using the Initial set to initiate the vector of bad domains and the data from Alexa to initiate the vector of good (as described above). We repeat these steps with different combinations of parameters (see Figure 2). We then compute the reputation scores of all domains, sort the domains by these scores and divide them into 10 bins of equal size. For each bin S i , i = 1..10 we measure the presence of domains that belong to the test set S test (known malicious domains), as |Si∩Stest| |Stest| . In Figure 2 we can see that the 10% of domains with the highest 'bad' reputation score contain the highest amount of malicious domains. Moreover, in all five type of experiments, the bin of domains with the highest scores consists of 20-25 percents of all known malicious domains of S test .

The tests we conducted demonstrate the following three claims:

1. Domains with high 'bad' scores have a higher probability to be malicious.

2. The combinations of the "good" and "bad" reputation scores improve the results. 3. After a relatively small number of iterations the results converge.

Time-test

The time test experiment uses the best parameters as determined by the Tuning test. The first step of the experiment uses data collected during three months: September-November 2014 while the second step uses data collected during the following two months (i.e., December 2014-January 2015). After the first step in which we apply the flow algorithm (either the combined or the extended), and assign bad reputation scores to domains, we validate the domains with the highest 'bad' reputation scores that did not appear in the initial set of malicious domains against the information provided by VirusTotal.

The data we used for the time test consists of 2, 385, 432 Domains and 933, 001 IPs constructing the nodes of the graph, from which 956 are tagged as maliciouse and 1, 322 are tagged as benign (Alexa). The resulting edges are 2, 814, 963 Ip to Domain edges, 13, 052, 917, 356 Domain to Domain edges and 289, 097, 046 IP to IP edges. The very large numbers of edges between IP to IP and Domain to Domain, emphasize the importance of the optimized algorithm 4 in Section 3.3. For the validation test we selected the 1000-highest bad reputation domains and calculated the prediction factor P F i for i ∈ {1, 2} (see equation 2).

Out of 1000 random domains checked against VirusTotal, only 2.775% were tagged by at least one anti virus product and 0.875% of the random domains were tagged by at least two anti virus product. Table 1 presents the results of the experiment using the Combined and Extended algorithms. We used only 5 iterations since the Tuning test results indicates that this number is sufficient. For the combined algorithm the weight of good reputation score was set to w = -1 and the bad attenuation was set to 1 and 0.8 in tests 1 and 2 respectively. We can see from the table that with the parameters of P2, that from the 1000 domains with the highest score, 323 were tagged by at least one of the anti viruses in VirusTotal (tagged by one), and 203 were tagged by at least two anti viruses (tagged by two) which derive the prediction factor of P F 1 = 11.61 and P F 2 = 23.2, respectively.

Due to space limitations we do not present all the results, however the best results were achieved in the second test. For example, out of 200 domains with the highest scores in test 2, 107 domains were tagged which reflect 53.5% of all known malicious domains. Figure 3 demonstrates the ability of our algorithms to predict malicious domains, using the prediction factor (eq. 2). The figure shows that if we consider smaller size of domains with the highest score the prediction rate is better but the overall predicted malicious domains are less. If we consider a larger size we end up with a larger number of domains that we suspect as malicious by mistake( i.e., false positives).

Conclusions

This paper discusses the problem of detecting unknown malicious domains by estimating their reputation score. It applies a classical flow algorithms for propagating trust, on a DNS topology graph database, for computing reputation of domains and thus discovering new suspicious domains. Our work faces two major challenges: the first is building a DNS graph to represent connections between IPs and domains based on the network topology only and not on the dynamic behavior. The second challenge was the design and implementation of a flow algorithm similar to those used for computing trust and distrust between people. We presented an algorithm that can be deployed easily by an ISP using non private DNS records. The algorithm was evaluated to demonstrate its effectiveness in real-life situations. The results presented in this paper are quite encouraging. In future work we intend to further improve the results by taking more data features into consideration and by conducting further tests with more parameters.

Fig. 1 :

 1 Fig. 1: The process for computing reputation scores: (1) Create the topology graph, assign weights and represent as a matrix; (2) Create the initial vector used for propagation; (3) Use the vector and the matrix as input to the flow algorithm; (4) output final reputation scores.

  IP and d ∈ D ip , w(ip, d) = 1 |Dip| . -Domain to IP -for d ∈ Set domain and ip∈ I d , w(d, ip) = 1 |I d | . -IP to IP -for ip 1 , ip 2 ∈ Set commonAtt , s.t. ip 2 = ip 1 , w(ip 1 , ip 2 ) = 1 |Set commonAtt | .-Domain to Domain -for d 1 , d 2 ∈ Set domain , parents P d ⊂ Set parent , andd 1 , d2 ∈ P d , s.t. d 1 = d 2 , w(d 1 , d 2 ) = 1 |P d | .The most effective combination of features for IP data turned to be (none, ASN, BGP-Prefix, Registrar, none), which derives cliques of IPs with the same ASN, BGP-Prefix and Registrar.

Fig. 2 :

 2 Fig. 2: The percentage of malicious domains by reputation score

Fig. 3 :

 3 Fig. 3: Prediction factor with respect to the number of highest bad domains

  Domain to IP: For d ∈ Set domain and a list of A-records, let I d be all the IPs that were mapped to d. For each ip ∈ I d we define: w(d, ip) = 1 |I d | ; 1 log |I d | ; 1. 3. IP to IP: Let commonAtt be a combination of the five attributes of IP data. Let Set commonAtt be the set of all IPs with the attribute combination Common A tt. For each ip 1 , ip 2 ∈ Set commonAtt s.t. ip 1 = ip 2 we define: w(ip 1 , ip 2 ) = Domain to Domain: Let P d be the set of all domains with the same parent domain d. For each d1, d2 ∈ P d s.t. d1 = d2 we define:

	2. 1 |Set commonAtt | ;	1 log |Set commonAtt | ; 1.
	4.
		1 |Dip| ;	1 log |Dip| ; 1.

Table 1 :

 1 Results for time test experiment

		Atten bad Atten good Algorithm Tagged by one Tagged by two
	1	0.8	1	combined	334	212
	2	1	1	combined	323	203
	3	none	none	extended	247	136

Acknowledgement This research was supported by a grant from the Israeli Ministry of Economics, The Israeli Ministry of Science , Technology and Space and the Computer Science Frankel center.


Sophie Trijau

Vincent Pradel

Hervé Servy

Pierre Lafforgue

Thao Pham
email: thao.pham@ap-hm.

Patient e-health platform for Rheumatoid Arthritis: accuracy and adherence factors

Keywords: personal health records, rheumatoid arthritis, accuracy factors, adherence

Background: Personal health records (PHRs) are patient-controlled repositories, capturing health data entered by individuals and providing information related their care. These tools improve treatment adherence but data are scarce concerning tool adherence. The accuracy of the self-recorded data remains controversial. We assessed how support measures improve PHR adoption determined the factors that influence the accuracy of self-recorded data and tool adherence of RA patients.

Methods:

A controlled randomized study with a PHR tool with integrated electronic health records developed by SANOIA. RA patients with ACR/EULAR 2010 criteria with web access randomized into 3 groups: Group 1 patients were given written information to create and manage a PHR; Group 2 patients received written information and a web technician hotline 48 hours after inclusion; Group 3 patients began their PHR with their rheumatologist during the consultation.

Results: 56 RA patients were included (female: 73%, mean age: 57.1, mean DAS28: 3.04, mean RAPID-3: 2.93). Self-reported data accuracy was significantly higher in Groups 2 (73.7%) and 3 (82.4%) than in Group 1 (45.0%), (P = 0.04). Patient adherence was higher in Group 2 (78.9%) compared with Groups 1 (55.0%) and 3 (58.8%) (P = 0.45). Accuracy was correlated to adhesion (P <0.0001). Gender, age, disease duration and activity, treatments, and patient level of interest were not correlated to data accuracy or patient adherence.

Conclusion:

Information accuracy collected with PHR was relevant and better when patients were initially assisted either by their physician or by non-medical phone support. We also observed better adherence when patients were initially assisted.

Background

Personal health records (PHRs) are tools enabling patients to collect patient-reported outcomes (PROs) and to report their medical conditions. The aim of such patientcontrolled services is to help individuals play a more active role and to contribute to shared decisions in chronic diseases such as rheumatoid arthritis (RA). These tools have shown their ability to improve treatment adherence [START_REF] Chrischilles | Personal health records: a randomized trial of effects on elder medication safety[END_REF][START_REF] Vrijens | Electronically monitored dosing histories can be used to develop a medication-taking habit and manage patient adherence[END_REF][START_REF] Hogan | Accuracy of data in computer-based patient records[END_REF] but data are scarce concerning adherence to the tool itself. For instance, 153 patients with rheumatic disease consecutively interviewed reported that although they appreciated having access to their online electronic health records, they expressed low confidence rates in the Internet [START_REF] Richter | Changing attitudes towards online electronic health records and online patient documentation in rheumatology outpatients[END_REF]. This lack of confidence may impact patient adhesion. The accuracy of self-recorded data related to medical condition in e-health platforms also remains controversial.

Our goal was to assess how support measures, technical or medical, could improve electronic personal health record system (PHR) adoption and to determine the accuracy of self-recorded data and RA patient tool adherence modifying factors.

Materials and methods

Electronic personal health records tool

Sanoia has developed a web tool integrated with electronic personal health records which offers full privacy protection using an innovative anonymity technique [START_REF] Chiche | Evaluation of a prototype electronic personal health record for patients with idiopathic thrombocytopenic purpura[END_REF]. The tool already included numerous factors related to chronic disease such as vaccination records and history. It can also be designed for a specific disease, in our case RA, and proposes an adapted PROs evaluation, such as the Routine Assessment of Patient Index Data (RAPID-3) [START_REF] Pincus | An index of the three core data set patient questionnaire measures distinguishes efficacy of active treatment from that of placebo as effectively as the American College of Rheumatology 20% response criteria (ACR20) or the Disease Activity Score (DAS) in a rheumatoid arthritis clinical trial[END_REF].

Patients

Inclusion criteria : outpatients fulfilling the ACR/EULAR 2010 criteria for rheumatoid arthritis [START_REF] Aletaha | Rheumatoid arthritis classification criteria: an American College of Rheumatology/European League Against Rheumatism collaborative initiative[END_REF]. As our aim was to assess factors associated with PHR adhesion and data accuracy, we focused only on patients able to use the e-PHR, so patients without web access were not invited to participate in the study.

Study Design

We conducted a prospective controlled randomized study. From February to March 2011, the five participating rheumatologists proposed to their consecutive RA patients to use an e-health platform and aimed at collecting patient-related outcomes (PROs) and medical conditions. Each rheumatologist had a randomization list Patients were randomized into 3 groups: Group 1 patients were given simple written information about how to create and manage their file on the Sanoia platform;

Group 2 patients received written information and support to manage their files on the platform via a web-technician hotline 48 hours after inclusion; and Group 3 patients started their Sanoia platform files with their rheumatologist during the consultation.

Patients were randomized individually by each rheumatologist. Each patient fulfilling inclusion criteria and accepting to participate in the study was assigned sequentially to a group according to his order of inclusion by his/her rheumatologist. This method was preferred to bloc randomization in order to maximize the balance of group effectives even if some rheumatologists include few patients in a context of competitive recruitment.

Collected data

Adherence Assessments

Patients were considered as tool adherent if they connected at least twice and as nonadherent if they connected once or never between baseline (M0) and the 3-month evaluation (M3). Adherence was also assessed at 6 months (M6).

Accuracy Assessment

We collected the following data: demographics, disease activity data including the disease activity score (DAS-28) and the RAPID-3 [START_REF] Pincus | An index of the three core data set patient questionnaire measures distinguishes efficacy of active treatment from that of placebo as effectively as the American College of Rheumatology 20% response criteria (ACR20) or the Disease Activity Score (DAS) in a rheumatoid arthritis clinical trial[END_REF][START_REF] Prevoo | Modified disease activity scores that include twenty-eight-joint counts. Development and validation in a prospective longitudinal study of patients with rheumatoid arthritis[END_REF], the amount and accuracy of selfrecorded data, ongoing treatment at baseline and 3 months after. For the latter, we focused on medical history, current treatment, consultations, underlying events reporting and other points of interest such as the vaccine situation, smoking status, contraception, imaging. Information accuracy was compared with rheumatologist medical records considered as the gold standard. All the records were assessed by the same reviewer (ST) and scored as following: medical history (0-4 points), current treatment (0-4 points), vaccine status (0-1 point) and known allergies (0-1 point), for a maximum score of 10. A good accuracy score was defined as>9/10.

Main outcomes

The 2 primary outcomes were the adherence at M3, defined as the proportion of patients who connected at least 2 times between baseline and 3 months, and the accuracy of the patient self-declared data, defined as the proportion of patients with a good accuracy score.

Statistical Analysis

We compared reporting accuracy and adherence among the groups. Accuracy was assessed as a dichotomous variable. Patients with a good accuracy score, i.e.>9/10, were scored 1. Patients with an accuracy score ≤9/10 or with missing data were scored 0.

We also assessed the impact of the following variables on accuracy and adherence: age (age as a continuous variable and age> 60 years yes/no), gender, disease duration, co-morbidities, baseline disease activity (DAS28, RAPID-3), treatments including biologics and corticosteroids and the patient's level of interest in the e-PHR tool. The patient's interest was assessed on a 0-10 numerical scale.

Continuous data were described by means (SD) and categorical variables were expressed as frequencies and percentages. To compare groups, we used Chi-square (Fisher when Chi-square application conditions were not met), Mann-Whitney and Krusakl-Wallis tests (depending on categorical/continuous variables and the number of modalities of the categorical variables). SPSS 17.0 version was used for management and statistical analysis.

Results

We included 56 RA patients, with 20, 19 and 17 patients in Groups 1, 2 and 3 respectively. Their main baseline characteristics were the following: female: 73%, mean age: 57.1 years, mean DAS28: 3.04 and mean RAPID-3: 2.93. Detailed characteristics are reported in Table 1.

The proportion of patients who did not use the PHR tool was 35.0%, 21.1% and 19.6% in Groups 1, 2 and 3 respectively. Self-reported data accuracy was significantly higher in Groups 2 (73.7%) and 3 (82.4%) than in Group 1 (45.0%), (p < 0.04) (Figure 1). Moreover, two patients reported medical events that were not in their physician medical records: a history of tuberculosis in a Group 3 patient and a costal chondroma in a Group 2 patient.

Patient adherence was higher in Group 2 (78.95%) compared with those of Groups 1 (55.0%) and 3 (58.8%) (P = 0.45) at 3 months. Mean ITT frequency connections are presented in Table 2. Among the patients who connected at least once (N = 13 for Group 1, 16 for Group 2 and 17 for Group 3), the mean number of connections between baseline and M3 was 10.3, 19.3 and 12.2 in Groups 1, 2 and 3 respectively. Adherence remained stable in Group 2 at 6 months (78.9%), whereas it decreased in Groups 1 and 3 (respectively 15.0% and 47.1%). Connection frequencies are presented in Table 2.

Accuracy was correlated to adherence (P <0.0001). Gender, age, disease duration, activity of disease (DAS28, RAPID-3), treatments including biologics and corticosteroids, and patient level of interest were not correlated to data accuracy (Table 3). These variables were also not correlated to patient adherence.

Discussion

This is the first study showing how support measures can influence adoption, adherence to PHR and the accuracy of recorded information. The quality of the information collected with PHR was meaningful and better when patients were initially assisted either by their physician or by non-medical phone support. Agreement between self-report information on PHR and medical records have been assessed with various results with regards to the disease [START_REF] Simpson | Agreement between self-report of disease diagnoses and medical record validation in disabled older women: factors that modify agreement[END_REF][START_REF] Bergmann | Validity of self-reported diagnoses leading to hospitalization: a comparison of self-reports with hospital records in a prospective study of American adults[END_REF][START_REF] Van Gelder | Using Web-Based Questionnaires and Obstetric Records to Assess General Health Characteristics Among Pregnant Women: A Validation Study[END_REF][START_REF] Haapanen | Agreement between questionnaire data and medical records of chronic diseases in middle-aged and elderly Finnish men and women[END_REF][START_REF] De-Loyde | Which information source is best? Concordance between patient report, clinician report and medical records of patient co-morbidity and adjuvant therapy health information[END_REF][START_REF] Van Den Akker | Disease or no disease? Disagreement on diagnoses between self-reports and medical records of adult patients[END_REF]. Comparisons have shown good agreement for diabetes, hypertension, pulmonary disease, cerebrovascular disease and myocardial infarction while other comparisons found low agreement for heart failure, chronic bronchitis, chronic obstructive pulmonary disease, hypertension, osteoporosis, osteoarthritis and RA [START_REF] Simpson | Agreement between self-report of disease diagnoses and medical record validation in disabled older women: factors that modify agreement[END_REF][START_REF] Van Den Akker | Disease or no disease? Disagreement on diagnoses between self-reports and medical records of adult patients[END_REF][START_REF] Okura | Agreement between self-report questionnaires and medical record data was substantial for diabetes, hypertension, myocardial infarction and stroke but not for heart failure[END_REF][START_REF] Engstad | Validity of self-reported stroke : The Tromso Study[END_REF][START_REF] Klungel | Cardiovascular diseases and risk factors in a population-based study in The Netherlands: agreement between questionnaire information and medical records[END_REF][START_REF] Goldman | Evaluating the quality of self-reports of hypertension and diabetes[END_REF][START_REF] Malik | Patient perception versus medical record entry of health-related conditions among patients with heart failure[END_REF][START_REF] Merkin | Agreement of self-reported comorbid conditions with medical and physician reports varied by disease among end-stage renal disease patients[END_REF][START_REF] Skinner | Concordance between respondent self-reports and medical records for chronic conditions: experience from the Veterans Health Study[END_REF][START_REF] Hansen | Agreement between self-reported and general practitioner-reported chronic conditions among multimorbid patients in primary care -results of the MultiCare Cohort Study[END_REF]. In a large community-based cohort, low agreement was found between the 2,893 participating patients and their GP, especially for RA (kappa: 0.17 [0.23-0.11] [START_REF] Van Den Akker | Disease or no disease? Disagreement on diagnoses between self-reports and medical records of adult patients[END_REF]. In RA patients, over-reporting was associated with the male gender, a higher number of diseases and a lower physical and mental quality of life. A higher number of diseases was also associated with underreporting. We did not collect a quality of life variable, but in our RA sample, gender and comorbidities were not correlated with record accuracy. The study sample size was small and possibly not powerful enough to demonstrate a correlation with the potential factors, such as biologic and corticosteroid treatment.

The mode of questionnaire administration can affect data quality. Survey responses are different with regards to the type of mode (e.g. self-administered versus interview modes, mail versus telephone interviews, telephone versus face-to-face interviews) [START_REF] Bowling | Mode of questionnaire administration can have serious effects on data quality[END_REF][START_REF] Feveile | A randomized trial of mailed questionnaires versus telephone interviews: response patterns in a survey[END_REF][START_REF] Christensen | Effect of survey mode on response patterns: comparison of face-to-face and self-administered modes in health surveys[END_REF]. As expected, our results confirm that patients that have been supported in the process, either with a technician without medical knowledge or with an MD, have better data collection accuracy. It may appear to be the support itself and not its quality because we found no difference between the methods of support, but the sample size of our study was insufficient to determine differences between the 2

Figure 1 :

 1 Figure 1: Proportion of patients with reported data of good accuracy on the e-PHR tool

Table and Figure Legends Table 1 :

 andLegends1 Baseline characteristics Table 2: PHR tool adherence in the 3 groups at M3 and M6 (ITT)

Table 3 :

 3 Accuracy factors

Acknowledgements

We gratefully thank C. Foutrier-Morello, J. Fulpin, E. Senbel, S. Steib, S. Trijau for their help in recruiting patients for the study, and the study patients for their contribution.

This study was supported by an unrestricted educational grant from UCB Pharma

The authors are grateful to Peter Tucker for his careful reading of the manuscript.

support groups. Technical or medical support also improved adoption of and adherence to the PHR tool.

In conclusion, our results suggest good or very good agreement between selfreported data with a PHR tool and medical records for RA patients. This agreement is improved with a technical or medical process support that also improves adoption and adherence to the tool. Our results confirm that a patient with the right level of support could be a source of reliable data collection, opening new paths that should be confirmed over a longer time period and from an economic point of view.


A Krakovinsky
email: alexis.krakovinsky@cea.fr

M Bocquet

R Wacquez

J Coignus

D Deleruyelle

C Djaou

G Reimbold

J-M Portal

Impact of a Laser Pulse On HfO 2 -based RRAM Cells Reliability and Integrity

Keywords: OxRRAM, Laser, Security, Integrity, HfO 2, Simulation, Thermal Attacks, Optical Attacks

. Moreover these solutions propose lower switching energy and faster operations compared to the state of the art for Flash, and thus, are seen as an opportunity for the rise of the IoT market. But one of the main concerns regarding IoT is the protection of the data. Contrary to Flash, security of the data in emerging NVM is yet to be evaluated. In order to verify capability of the technology in terms of data integrity, we propose to investigate reliability and integrity of HfO 2 -based Resistive RAM (OxRRAM). This paper details the experimental protocol defined for laser-based attacks, shows that a laser pulse can affect the information stored in a single OxRRAM bit. The occurring phenomenon is then explained by mean of thermal and electrical simulations.

I. Introduction

Innovative technologies are emerging as solutions for the future of Non Volatile Memories (NVM). One can cite Magnetoresistive Random Access Memories (MRAM), Phase Change RAM (PCRAM) or Resistive RAM (RRAM) as the main technologies of interest. A HfO 2based RRAM solution is considered in this work. Due to its low cost of fabrication and its inherent lower switching energy, RRAM is of high interest for the IoT market.

In the following years, billions of smart objects will be interacting between each other. Power consumption is of course an essential issue. But if we consider the amount and nature of the processed data, the security aspect must not be neglected. In other words, emerging NVM must fulfill three essential criteria that are data integrity, data confidentiality and data accessibility. However, most studies still focus on the reliability of these technologies. Therefore none of them have been confronted to attacks such as UV lamp with masking [START_REF] Fournier | Memory Address Scrambling Revealed Using Fault Attacks, Fault Diagnosis and Tolerance in Cryptography (FDTC)[END_REF] or focused laser [START_REF] Skorobogatov | Local Heating Attacks on Flash Memory Devices Hardware-Oriented Security and Trust[END_REF] attacks that have been already shown as sucessful on Flash technology.

The first security criterion to be studied for NVM (especifically RRAM) is material integrity. This work proposes to evaluate the impact of external physical constraints on the material. Laser has been aleready proven able to disturb the behaviour of a circuit as well as old Flash technology [START_REF] Skorobogatov | Optical Fault Masking Attacks Fault Diagnosis and Tolerance in Cryptography (FDTC)[END_REF] through fault attacks. As a follow up of these works, it is interesting to attack RRAM in the same way.

Section 2 describes the experimental setup whose results are presented in section 3 and 4. Section 5 is focused on the simulation of a laser pulse on a RRAM structure and of RRAM set operation.

II. Experimental Setup

A. RRAM Principle and Characteristics Parameters

A RRAM cell is made of two metal electrodes with a transition metal oxide (TMO) in-between. In our case (see Fig. 1), these are made of a 5nm-thick HfO 2 layer, located between a 10nm-thick Ti top electrode and a 10nm-thick TiN bottom electrode, as described in [START_REF] Vianello | Resistive Memories for Ultra-Low-Power embedded computing design[END_REF]. This technology relies on resistance switching, that is to say, in this case, migrating oxygen ions (as pictured in Fig. 1.) from the oxide to the electrode where a voltage is applied [START_REF] Nardi | Resistive Switching by Voltage-Driven Ion Migration in Bipolar RRAMPart I: Experimental Study[END_REF]. This process creates or dissolves a conductive filament (CF) of oxygen vacancies in the oxide, which is tuning its resistance.

The way set and reset (i.e programming and erasing) operations are performed is presented on Fig. 2. V stopreset and the set compliance current I c are parameters which are set experimentally. For each experiment shown in this paper, V stopreset = -1V and I c = 1 mA.

B. Instrumentation and Experimental Protocol

We use a laser bench with a Nd:YAG source. Three wavelenghths are available : 355 nm (Ultraviolet/UV), 533 nm (Green) and 1064 nm (Infrared/IR). It has a circular 50µm-diameter spot size (as seen in Fig. 3.) that allows shooting the whole cell -whose size is 3 µm up to a 400 µJ energy during a 10 ns pulse.

In the first place, to see the influence of laser pulses on the memory cells, their electrical characteristics were evaluated. These were conducted in quasi-static conditions (i.e without considerating temporal aspects) and consisted in 10 cycles of reset/set operations. The resistance value has been measured thanks to a read operation performed after each operation.

These preliminary measurements allow verifying that the cells have a regular behavor, in conformity with what has been published. These data will be then used as reference data for the following experiments (See Fig. 4.). The average set and reset voltages are respectively V Set = 0.6 V and V Reset = -0.54 V. Moreover, the average LRS and HRS resistance values are about R LRSmean = 550Ω and R HRSmean =35 kΩ.

The experimental protocol of the next step is summed up in Fig. 5. For the need of the experiment, 50% of all devices are left in HRS, and 50% in LRS. A single pulse in either UV or IR has been performed in order to check the potential impact of each wavelength. In the end, a

III. Influence on Resistance Values

A. Cells state variation and wavelength influence

Regarding LRS cells after laser pulse, the first remarkable result is that the LRS remains unaffected. Fig. 6 shows that the cumulative distributions of the resistance values of the cells left initially in the LRS before and right after the pulse are similar. Moreover, both UV and IR data are overlaying.

However, contrary to LRS cells (as noticed on Fig. 7), a gap from about a decade in terms of resistance distribution can be seen between HRS cells before (R mean b ef ore = 34 kΩ) and after (R meanaf ter = 3400Ω) they were shot . Besides, half of these cells have switched to the LRS after the pulse.

Finally, as far as wavelength is concerned, UV and IR pulses have the same effect on HRS cells. Which means the laser impact on OxRRAM cells is independant from the wavelength used. Therefore, all the following data will not refer to the wavelength used during the experiment. The energy used will rather be taken into account as the most essential parameter.

B. Laser Low Resistive State Analysis

By confronting the resistance values of LRS cells to HRS cells that switched to the LRS cells after a laser pulse, it can be seen on Fig. 8 that the electrical LRS seems slightly different from the LRS obtained with laser. Indeed, the values of the switching cells (R LRSmean1 = 880Ω) are quite higher than those of the LRS cells (R LRSmean2 = 550Ω). In a nutshell, this analysis showed that a laser pulse can disturb the behaviour of only HRS cells. Nevertheless, the nature of the resistive state obtained after exposition is yet to be confirmed.

IV. Impact on Electrical Characteristics

A. Cells left in the LRS

Even though the resistance values of LRS cells are showing the non-effectiveness of a laser beam on their state, V Set and V Reset measured after the attack may vary from those obtained before. But as expected, laser has not disturbed the cells since V Set and V Reset are matching the reference data (see Fig. 9).

B. Cells left in the HRS

Concerning the cells left in the HRS state, it has to be figured out whether or not cycling can be performed normally and if the laser set operation can be considered as equivalent to an electrical set operation. The cells that were submitted to a reset operation in a first place were hardly set to the HRS, since more than 80% of our devices first V Reset are above the average voltage reset according to the reference data (as pictured in Fig. 10). This means laser set and electrical set are not equivalent, which is confirmed by the data coming from cells whose first post-laser operation was a set operation. Indeed, their first reset voltage is corresponding to the reference data.

Explaining the phenomena responsible for laser switching will require a model of the laser impact on the structure. As well as a model of an electrical set operation so we can compare them.

V. Simulations

There are two possibilities to explain a change in the oxide structure by the use of a laser beam. The first one is an optical effect provided by the photon injection and the second one is a temperature effect. Indeed, experiments have shown [START_REF] Cabout | Temperature impact (up to 200 C) on performance and reliability of HfO2-based RRAMs, Memory Workshop[END_REF] that high temperature operations tend to

Where k is the imaginary part of the refractive index of the material, l the material thickness and λ the wavelength of the laser beam. For the metallization layer only (shown on Fig. 12), c ≈ 1,7 . 10 -15 for λ = 1064 nm and c ≈ 4,3 . 10 -24 for λ = 355 nm. In other words, photons are not able to go through the metallization layer and therefore reach the oxide. Which also means that instead of being caused by an optical effect, the laser switching shall be a consequence of temperature, the main focus of our modeling.

A. Laser Modeling

The geometry used for this model is presented on Fig. 11. For more accuracy, 1 nm of titanium dioxide has been considered on the top of our structure. The reason is since Regarding the laser impact, the model was designed by using [START_REF] Sands | Pulsed Laser Heating and Melting, Heat Transfer -Engineering applications[END_REF]. Therefore, the transmitted part of the laser energy to the surface of the structure and the heat emitted by each layer are respectively defined as follows :

I T = I 0 (1 -R)g(x) (2)
S(z) = α × I T L × e -αz (3)
Where I 0 is the laser surface power, R the reflectivity of the surface material, g(x) the gaussian profile (whose standard deviation is a third of the laser spot radius) value for the x coordinate, α the optical penetration depth which equals 4πk λ (with k and λ defined as in (1)), z the depth in the layer and I T L the intensity transmitted to the layer top interface.

The simulation results show that the maximum temperature in the oxide is 610 K and that it is reached 0.8 ns after the end of the pulse (see also Fig. 12 and13). This temperature is the result of the thermal diffusion coming from the titanium dioxide surface (whose maximum temperature is reached 0.8 ns before the end of the pulse). We might expect higher temperatures provided that the estimated silicon dioxide temperature is about 3000 K after the end of the pulse (beyond SiO 2 melting point which is not taken into consideration in this model). However the duration needed for thermal diffusion from the SiO 2 surface to the HfO 2 layer is about 1 µs since silicon dioxide has a low thermal conductivity ( k = 1.4 W.m -1 .K -1 [START_REF]CRC Handbook of Chemistry and Physics[END_REF]) and the corresponding temperature much lower (about 500 K).

The objective of the following electrical set modeling is to verify if the temperature reached during laser exposition is relevant for an electrical set operation.

B. Electrical Set Simulation

For the electrical set simulation, the model described in [START_REF] Russo | Self-Accelerated Thermal Dissolution Model for Reset Programming in Unipolar Resistive-Switching Memory (RRAM) Devices[END_REF] has been applied to the cell structure. The main objective is to compare the temperature reached during an electrical set operation to the value obtained from thermal modeling. V Set , I c as well as both thermal (k) and electrical (σ) conductivities of the CF are the parameters of interest. By choosing the CF conductivities, we aim to get temperature according to its state after the set operation. In our case, the laser pulses were not able to really set the cells, which means the CF has a structure not far from HfO 2 , whose conductivities are lower than Hf.

We then simulated different conductivities values for each couple (V Set ) , I c ) which gave us maps of the temperature reached in the CF in function of k and σ at constant set voltage and compliance current. The values chosen for V Set and I c are respectively 0.5 V/ 0.6 V/ 1.2 V and 1 µA/ 10 µA/ 0.1 mA / 1 mA . Regarding the values of the conductivities, we decided to choose 10 values decreasing linearly (for k) and logarithmically (for σ) from the values given in [START_REF]Properties of Solids; Thermal and Physical Properties of Pure Metals / Thermal Conductivity of Crystalline Dielectrics / Thermal Conductivity of Metals and Semiconductors as a Function of Temperature[END_REF] and [START_REF]CRC Handbook of Chemistry and Physics[END_REF] for Hf. The results presented on Fig. 14 were obtained for V Set = 0.5 V and I c = 10 µA.

The temperature calculated with laser modeling (610 K) is reached for k ≈ 4 W.m -1 .K -1 and σ ≈ 5 10 5 S.m -1 . These low conductivities mean that the set hasn't been totally completed since the CF structure is closer to hafnium dioxide than hafnium, explaining the experimental results obtained by laser pulse.

VI. Conclusion

For the first time, RRAM cells have been disturbed by laser exposition, independently from the wavelength used. It is possible to perform a bitflip only from the HRS to the LRS. Simulations allowed us to explain that this phenomenon is due to the temperature brought by laser heating.

Fig. 1 .

 1 Fig. 1. Cell layer structure and ion migration description

Fig. 2 .Fig. 3 .

 23 Fig. 2. Standard I-V characteristic of the 1R cells to be studied. For the set operation, a progressive voltage sweep is applied from '1'. Then the cell switch to the LRS in '2' before its current reaches Ic in '3'. For the reset operation, a voltage sweep is applied from 'A'. The cell switches from the LRS to the HRS in 'B' . The sweep is stopped at Vstopreset in 'C'

Fig. 4 .

 4 Fig. 4. Boxplot of 1500 LRS/HRS reference values (a) and Set/Reset voltages (b) obtained during preliminary characterisations of the studied cells. The box extends from the lower to upper quartile values of the data, with a line at the median.

Fig. 5 .

 5 Fig. 5. Experimental Protocol Diagram

Fig. 6 .Fig. 9 .

 69 Fig. 6. Cumulative distributions of the resistance values of 84 LRS cells before and after a single laser pulse, sorted by wavelength used

Fig. 10 .

 10 Fig. 10. Cumulative distribution of set and reset voltages of HRS cells after 1 Reset/Set cycle sorted by first operation performed . These results were compared to reference data

Fig. 12 .

 12 Fig. 12. Temperature repartition 0.8 ns after the 10 ns laser pulse on the whole structure

Fig. 13 .

 13 Fig. 13. Temperature repartition 0.8 ns after the laser pulse in the area around the hafnium dioxide layer

Acknowledgements :

This work was performed with the support of the CATRENE CA208 Mobitrust project.