Marta Gallo

Corentin Chesnais

Kerem Ege

Quentin Leclere

Nicolas Totaro

Renaud G Rinaldi

Spatial Patterning of the Viscoelastic Core Layer of a Hybrid Sandwich Composite Material to Trigger Its Vibro-Acoustic Performances

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Hybrid composite sandwiches, combining two external metallic layers and an inner constrained viscoelastic core are one of the possible answers to design light material solutions for the transportation industry. Indeed, these material solutions provide high bending stiffness and high damping [START_REF] Li | A review on vibration damping in sandwich composite structures[END_REF] that are required to, for the least, guaranty the necessary vibro-acoustic performances of the vibrating structure. Several studies investigated numerically and/or experimentally the influence of geometrical and/or material parameters, such as core and metal-skin thickness and composition, on the properties of the composite structure [START_REF] Irazu | The effect of the viscoelastic film and metallic skin on the dynamic properties of thin sandwich structures[END_REF][3][START_REF] Grewal | Vibration analysis and design optimization of sandwich beams with constrained viscoelastic core layer[END_REF]. Generally, the polymer layer analyzed in the aforementioned studies is considered to be homogeneous. However, as shown by Unruh [START_REF] Unruh | Influence of inhomogeneous damping distribution on sound radiation properties of complex vibration modes in rectangular plates[END_REF] with finite element simulations on plate systems, where the mechanical properties of the polymer layer vary with respect to the x,y position within the neutral plane of the plate, the vibro-acoustic behavior of a sandwich panel is strongly affected. Therefore, the local control of the polymer viscoelastic properties offers the opportunity to optimize the vibroacoustic behavior of the designed structure. Yet, no experimental study can be found on the testing of such architectured hybrid composite structures.

The patterning of stiffness can be achieved by locally altering either or both the local geometry and the local material properties. In this work, with the final objective to design flat panels, and to guaranty good adhesions between the layers, the effort is focused on controlling the local viscoelastic properties of the polymer core layer. For this purpose, we take advantage of a recently published ultraviolet (UV) irradiation selective technique [6]. In details, the UV irradiation of a bar-coated silicone mixture (in presence of an aromatic solvent) leads to the degradation of the catalyst, and ultimately a reduction of the silicone cross-linking rate when submitted to heat cure. Thus, the positioning of a mask between the UV source and the polymer mix can ascertain that the silicone will locally receive different amount of UV doses. By doing so, the cross-linking kinetics can be adjusted spatially. Ultimately, stopping the (heat-cured) reaction before its completion by cooling and/or end-capping the remaining reactive groups will lead to difference in final mechanical properties. Initially developed to modulate the elastic properties of Liquid Silicone Rubber (LSR) silicone membranes, the procedure is now adapted to control the viscoelastic behavior of Room Temperature Vulcanization (RTV) silicone. The crosslinked 3D network results from the similar reaction between vinyl and Si-H sites yet the viscosity is greatly diminished providing enhanced processability.

7/20/2015

In this work, with the aim of obtaining sandwich materials, the protocol is further modified to bond the architectured silicone membrane with aluminum thin sheets. Details of the adjusted protocol to design sandwich beams are given in the following section. Various beams (both homogeneous and heterogeneous) are then obtained and their vibro-acoustics responses are measured. For homogeneous systems, their frequency-dependent flexural behavior is compared with the analytical Guyader model showing good agreement. Finally CFAT method is used to spatially determine the behavior of an architectured sandwich system. All in all, the results evidence the effect of the architecturation of the polymer thin layer on the hybrid sandwich properties.

Materials and Methods

Materials

The rigid skin layers of the sandwich composite were made of 0.3 mm thick (tAl) aluminum sheets. One face was sand-blasted to increase the roughness and favor mechanical adhesion with the polymer thin layer. The sheets were cut down to the correct size (250 mm in length and 25 mm in width) and hot-pressed at 250°C for 1 hour to be flattened out. The viscoelastic core was made of silicone Bluesil TM RTV141 (Bluestar, France). Xylenes (ACS reagent, ≥98.5%, mixture of isomers) were purchased from Sigma-Aldrich and used as received.

The protocol followed to obtain UV-irradiated membrane and/or hybrid architectured sandwich composite consists in four consecutive steps that are depicted in Figure 1. It is worth noting that the aluminum sheets were omitted (and the mold thickness adjusted) to design silicone membranes alone. First, the two base components were mixed in a weight ratio of 9:1 and with the addition of 10 wt% xylenes. The mixture was molded in a layer less than 0.5 mm thick on top of one aluminum sheet (Figure 1a) and irradiated in a UV Crosslinker CL-1000 (UVP, USA) (Figure 1b). The irradiations were performed at a wavelength λ equal to 254 nm (UVc). The irradiation duration was tuned to control the dose prescribed, with the correspondence between UV durations and doses being verified using a UV radiometer Power Puck II EIT©. Following the irradiation of the silicone mix, the samples were degassed for one hour. Finally, silicone membranes or aluminumsiliconealuminum sandwiches (≈ 0.5 and 1 mm thick respectively) were obtained by curing the system (irradiated or not) in an oven (Memmert, Germany). The curing time and temperature varied depending on the system prepared. With this protocol, non-irradiated NIrr (no irradiation, no mask), irradiated Irr (no mask), and half irradiated NIrr-Irr (a mask blocking only half of the mold surface) systems were designed. Details on the irradiation and curing steps will be later provided.

Methods

Rheometry tests were performed on the uncured system in order to assess the influence of UV irradiation on the crosslinking kinetics of the RTV silicone. A Physica MCR301 rheometer (Anton Paar, USA) was used for testing with a plan-plan configuration at frequency and strain amplitude of oscillation of 1 Hz and 1% respectively, while applying a temperature dwell (different temperatures were tested, but the heating slope was always equal to 0.7 °C/s).

The viscoelastic properties of the silicone specimens (50 x 10 x 0.5 mm 3 ) were assessed by Dynamic Mechanical Analyses (DMA) performed on an Eplexor®500N equipment (GABO Qualimeter, 7/20/2015 Germany) in tensile mode by applying a tensile strain ε of 1±0.5% for varying temperatures and loading frequencies (1 and 10 Hz).

The high frequency response was evaluated by using the experimental fixture depicted in Figure 2. The beam was fixed onto a rigid frame with an elastic link and excited by a non-contact sensor (MM02). The displacement field was measured with a Polytec PSV-400 scanning laser vibrometer positioned at 2.7 m from the beam. The measurements were performed on a grid of 83 points along the length of the beams and 5 points along the width with a spacing of Δx = Δy = 3mm. The velocity field of the beam was measured on the frequency band [200:1000] Hz in the domain of validity of the applied method.

Results and Discussion

Effect of UV dose on the viscoelastic properties of RTV silicone membranes

Figure 3 reports the evolution, as a function of time, of the silicone mix shear modulus (G') when heated at a constant temperature of 80°C. The data were measured by rheometry on two samples submitted to different UV irradiations. Throughout the experiment, the silicone mix reacts, i.e. solidifies. As expected, the moduli increase with time until reaching a plateau value when the material is fully cured, as clearly evidenced for the non-irradiated silicone, with a plateau value of about 0.8 MPa. Also, the irradiation appears to slow down the reaction kinetics and thus the modulus increase, as already demonstrated by Stricher et. al. for the case of LSR silicone [6]. When considering the two curves at a specific time-point carefully chosen (e.g., 3000 s in the figure), both materials can be solid and the elastic property difference controlled.

It is worth noting that for hyperelastic entropic materials, the storage modulus is known to be related to the crosslinking density (𝑛) as follow :

G ′ ∝ n k T (1)
With k the Boltzmann constant and T the absolute temperature. A lower unsaturated modulus confirms that the network is not fully crosslinked, suggesting that the macromolecular network contains pending and/or free chains with greater mobility, potentially leading to enhanced energy dissipation mechanisms. The effect of UV irradiation on the viscoelastic properties of the RTV silicone is investigated using Dynamic Mechanical Analysis in tensile mode. The forced oscillatory deformation is imposed to the sample and the measurement of the associated loading gives access to the complex modulus 𝐸 * :

E * = E ′ + jE " = E ′ (1 + jη) (2)
where 𝐸 ′ is the storage modulus (also depicted as the Young's modulus) and 𝐸 " the loss modulus. 𝜂 = tan𝛿 = 𝐸 " 𝐸 ′ ⁄ corresponds to the loss factor and quantifies the amount of energy dissipated by the sample. Figure 4 displays the temperature and frequency dependent response of the non-irradiated fully cured RTV silicone (corresponding to the pristine sample in Figure 3). The silicone was cured for 2h at 150°C as recommended by the technical data sheet [7]. The storage modulus is seen to linearly increase with increasing temperature as suggested by Equation 1. For a given temperature, both the storage modulus and loss factor increase with increasing frequency. Yet, the loss factor remains below 5% within the experimental conditions covered and the modulus exhibits a very small variation (few percents) confirming that the fully cured RTV silicone is mostly hyperelastic. It is worth noting that the magnitude of the storage modulus E' is consistent with the plateau value of the shear modulus G' reported in Figure 3. Indeed, isotropic hyperelastic materials are known to deform with no volume change (the Poisson ratio   0.5), so that the tensile Young's modulus is about three times greater than the shear modulus

(E ′ = G ′ 2(1 + ν) ≈ 3G ′ ) [8].
7/20/2015 Now focusing on the effect of UV irradiation, DMA were performed at room temperature and two frequencies (1 and 10 Hz) on silicone coupons that were cured for 30 minutes at 80°C after being irradiated. The curing conditions were chosen accordingly to the aforementioned rheometry results (see Figure 3) so that significant difference in the viscoelastic properties can be seen as a function of the irradiation dose. The results are presented in Figure 5 where the storage modulus E' and the loss factor tan𝛿 are displayed as a function of the UV dose. The storage modulus decreases and the dissipation increases, both mostly linearly, with increasing the irradiation dose. More precisely, after receiving a UV dose of 2.6 J/cm² the modulus is divided by 3 and the loss factor multiplied by 5. Whatever the dose, the moduli remain below the modulus reported in Figure 3, confirming that the silicones are not fully cured. Yet, since the greater the UV irradiation the slower the crosslinking kinetics, irradiated silicones exhibit enhanced dissipative viscoelastic behavior. This is further evidenced by the frequency dependence of E' and tan which both increase with increasing UV irradiation.

Apparent Young's modulus and damping of homogeneous three-layered plates

Knowing the variability of the silicone viscoelastic properties when submitted to UV irradiations prior to thermal curing, the prediction of the large frequency response of homogenenous aluminumsilicone -aluminum sandwiches is achieved using the analytical model by Guyader [START_REF] Guyader | Acoustic transmission through orthotropic multilayered plates, part I: plate vibration modes[END_REF][START_REF] Guyader | Viscoelastic properties of single layer plate material equivalent to multi-layer composite plate[END_REF]. This model together with two other formalisms (Ross-Kerwin-Ungar model and Lamb waves model) have been recently compared to experiments performed on steel-polymer-steel multilayer plates and very good agreement for the whole [40 Hz -20 kHz] frequency band was obtained [START_REF] Ege | Vibrational behavior of multilayer plates in broad-band frequency range: comparisons between experimental and theoretical estimations[END_REF][START_REF] Ege | Assessment of the apparent bending stiffness and damping of multilayer plates; modelling and experiment[END_REF]. In brief, the Guyader model allows for the determination of the equivalent (or "apparent") single layer plate complex bending stiffness (D 𝑒𝑞 * ) as a function of the loading frequency (f):

D eq * (f) = D eq (f)(1 + j η eq (f)) (3)
The calculation of D eq * is based on the Love-Kirchhoff thin plate theory and deduces the property of a single layer plate that replicates the transverse displacement of the multilayer (sandwich) plate. The analytical method applies the travelling wave approach to a simplified multilayer model (where membrane and shear effects are considered for each layer). Continuity conditions (displacement and shear stresses) at each layer interface are used to obtain the equation of motion of the multilayer plate field expressed as a function of the first layer field.

The density (ρ eq ) and Poisson ratio (ν eq ) of the equivalent homogeneous material are straightforwardly computed from the dimensions and properties of the constitutive layers:

ρ eq = ∑ h i ρ i i h (4)
ν eq = ∑ h i ν i i h (5)
Where h = ∑ h i i is the total thickness of the composite panel, and the subscripts ''eq'' and ''i'' refer to the parameters of the equivalent homogenized material and of the i th layer of the multilayer material, respectively.

Finally, the frequency-dependent equivalent homogeneous Young's modulus (E eq ) and loss factor (η eq ) are calculated from the value of the equivalent complex bending stiffness (D eq * ):

E eq (f) = ℜ (D eq * (f)) 12(1 -ν eq 2 )

h 3 (6)
η eq (f) = ℑ (D eq * (f))

ℜ (D eq * (f))

Figure 6 displays the wide frequency equivalent modulus and loss factor of two infinite sandwich structures. The two systems have prescribed thicknesses with varying silicone properties to mimic the effect of UV irradiation. Thus, Irr and NIrr refer to Irradiated and Non-Irradiated silicone membranes respectively and the material properties assigned are of the order of the experimental values reported in Figure 4 and5.

7/20/2015 Focusing on a given sample, the observed behavior is typical of constrained-layer damping sandwich plates:

-Equivalent Young's modulus (E eq ): a constant value (high rigidity) at low frequency decreasing gradually (on the transition zone governed by shearing of the constrained layer) to a lower asymptotic value at high frequencies.

-Equivalent loss factor (η eq ): limited damping at low and high frequencies (close to the loss factor value of the metallic skin), and high damping for a limited frequency range where the shearing of the highly-damped constrained core layer is maximum (optimum shearing zone).

Now focusing on the effect of the silicone properties caused by UV irradiation, it is worth noting that the low and high frequency responses are equivalent. In fact, at low frequency, the asymptotic value of the equivalent rigidity is equal to the flexural rigidity of a panel with rigidly interconnected structural skin components and thus does not depend on the material properties of the silicone core layer. Similarly the high frequency response is simply equal to the sum of the flexural rigidities of the structural components (as if they were not interconnected), meaning that the contribution of the compliant core layer is also negligible. Yet, the modulus decrease of the Irr (more compliant) sandwich occurs at lower frequency, almost a decade earlier compared to the NIrr system. Furthermore, the dissipation of the Irr (more viscoelastic with higher 𝜂 sil ) sandwich is increased in the "optimum shearing zone". Hence, the silicone layer viscoelastic properties result in a frequency shift of the optimal shearing zone of the sandwich structure (towards low frequency when the silicone stiffness decreases). Naturally, in this regime the dissipation is directly governed by the silicone dissipative properties and is thus more pronounced.

In the light of the aforementioned explanation, the high frequency equivalent modulus and the "optimum shearing" zone strongly depends on the sample's thickness. It is further demonstrated in Figure 7 where the silicone thickness of the Irr configuration is decreased from 0.4 to 0. 05 mm, while the thicknesses of the aluminum layers remain equal to 0.3 mm. With the decrease of the polymer thickness, and thus its volume fraction, the shearing zone is shifted towards higher frequency and its amplitude decreases, mostly because the diminished thickness leads to a major increase of the high frequency modulus. It is worth mentioning that the validity of the model of Guyader is limited to frequencies where no out-of-phase flexural motion of the skins exists. Focusing on the less favorable case composed of the thicker silicone layer (0.4mm), the first "breathing mode" occurs at about 6.2 kHz (see [START_REF] Ege | Vibrational behavior of multilayer plates in broad-band frequency range: comparisons between experimental and theoretical estimations[END_REF] for description of the analytical prediction of the breathing mode) which falls above the experimental [10Hz -2kHz] frequency domain of interest. Nevertheless, other models may be used for very thick laminated panels or highly damped laminate composites such as the General Laminate model [START_REF] Ghinet | Modeling thick composite laminate and sandwich structures with linear viscoelastic damping[END_REF]. The reader could also refer to the work of Carrera [START_REF] Carrera | An assessment of mixed and classical theories on global and local response of multilayered orthotropic plates[END_REF] where several models are compared.

Identification of frequency-dependent equivalent Young's modulus of a hybrid composite beam

Following the protocol depicted in Figure 2 and driven by the results presented in the previous paragraph, three hybrid composite beams were prepared:

7/20/2015 -NIrr: No irradiation was applied to the silicone and the beam was heat-cured for 2h at 150°C, -Irr: A UV dose of 2.6 J/cm² was applied to the sample prior to a curing step of 30 min at 80 °C, -NIrr-Irr: A UV dose of 2.6 J/cm² was applied to half of the beam sample prior to a curing step of 30 min at 80 °C,

The beams were about 1 mm thick (10%) so that the average thickness of the silicone layers ℎ sil was about 0.4 mm. When referring to the aforementioned experimental characterization, the expected (theoretical) material properties of the aluminum and silicone layers of the three beams are recalled in Table 1 below. The frequency-dependent equivalent Young's modulus E eq of the beam was then spatially resolved using the Corrected Force Analysis Technique. This method has been firstly introduced to identify the force distribution acting on a flat structure (beam or plate) [START_REF] Leclère | Vibration source identification using corrected finite difference schemes[END_REF]. It is based on the approximation of the equation of motion of the structure by a finite difference scheme. In the case of flexural beams, the equation of motion at the angular frequency 𝜔 writes:

EI ∂ 4 w ∂x 4 (x) -ρSω 2 w(x) = p(x) (7)
where E, I, ρ and S are respectively the Young's modulus, the flexural moment of inertia, the density and the surface of the cross section. w(x) is the displacement in meters and p(x) is the force distribution in N/m applied to the beam.

As can be seen in Eq. ( 7), the right hand side member can be directly assessed from the experimental estimation of the left hand side member. The fourth derivative in Eq. ( 7) can be approximated by a centered finite difference scheme:

∂ 4 w ∂x 4 (x) ≈ δ ∆ 4x = w(x -2∆) -4w(x -∆) + 6w(x) -4w(x + ∆) + w(x + 2∆) ∆ 4 (8)
where ∆ is the spacing between two consecutive points of the experimental grid line defined along the length of the beam. The force distribution is then directly estimated from the displacement measured at 5 positions around the identification point as presented in Figure 8.

This approach, known as FAT, is local (information needed on the finite difference scheme only) and does not depend on boundary conditions of the structure. However, this approach is highly disturbed by measurement noise and a filtering step is mandatory. This filtering can be achieved easily by adjusting the step of the scheme at nx, so as to optimize its size as a function of the natural wavelength of the beam [START_REF] Leclère | Identification of loads of thin structures with the corrected Force Analysis technique: An alternative to spatial filtering regularization[END_REF]. However, in this case a corrected version of the FAT technique (CFAT) has to be implemented so as to reduce the bias error. The corrected FAT estimation of the force distribution is finally given by:

p CFAT (x) = EIμ 4 δ ∆ 4x -ρSω 2 w(x) (9) where μ
= k N ∆ √2 -2 cos(k N ∆) ( 10
)
𝑘 𝑁 is the flexural wavenumber of the beam,

k N = √ ρS EI ω 2 4 .
If the force distribution is null in the zone scanned by the finite difference scheme, Eq. ( 9) becomes [START_REF] Leclère | Identification of loads of thin structures with the corrected Force Analysis technique: An alternative to spatial filtering regularization[END_REF]:

EI ρS = ω 2 ∆ 4 [acos (1 - Δ² 2 √ δ ∆ 4x w(x) )] -4 (11)
If I, ρ and S are considered to be known, the Young's modulus can be estimated locally and at a particular angular frequency 𝜔. This approach can be then an experimental method to evaluate the spatial variation of the Young's modulus (by moving the finite difference scheme) as well as its frequency dependency.

However, one has to pay attention to the fact that the equation of motion (7) used in this method is only valid for a homogeneous isotropic material. In case of a beam made of a non-homogeneous and/or non-isotropic material (composite material, sandwich panels, polymer reinforced with short glass fibers for example), CFAT gives access to an equivalent homogeneous isotropic Young's modulus as a function of frequency [START_REF] Leclère | Practical implementation of the corrected force analysis technique to identify the structural parameter and load distributions[END_REF].

7/20/2015

First, to evaluate how CFAT method can be used to quantify the equivalent Young's modulus of a hybrid composite beam as a function of frequency, the method was applied on the two NIrr and Irr beams. Since these beams are spatially homogeneous, a spatial averaging was applied to obtain the results plotted in Figure 9. The identified equivalent Young's moduli are compared to the analytical model predictions plotted in Figure 6(b). Since the (high frequency) equivalent modulus strongly depends on the core thickness, predictions obtained with slightly modified silicone thickness ℎ sil = 0.35 mm were added to the plot. The CFAT measurements evidence the difference of equivalent modulus, between NIrr and Irr beams, the former being greater. More importantly, the measured profiles coincide with the analytical model. Nevertheless, and as already pointed out, it is worth noting that the thickness of the silicone layer is of great importance. Indeed, as shown in Figure 9, the discrepancies between experimental measurements and theoretical predictions are strongly diminished when the silicone layer thickness is decreased by as few as 50 microns, suggesting that the setup should be carefully set.

Furthermore, it should to be also pointed out that the equivalent Young's modulus of the Irr beam exhibits a slight increase with increasing frequency. This behavior is not captured by the analytical model, since the Young's modulus of the silicone layer is set to be constant. Yet, the results in Figure 5 suggest that the Young's modulus of the (irradiated but not only) silicone increases with increasing frequency, which ultimately would result in a slight increase of the equivalent Young's modulus of the sandwich composite. This point will be further studied as frequency dependent modulus of the silicone can be determined (and implemented) as a function of the UV irradiation dose (master curves construction).

Finally, the effect of spatial patterning has been evaluated on the equivalent Young's modulus identified by CFAT for the three beams, and successfully replicated using another data reduction methodology depicted in [START_REF] Wassereau | Experimental identification of flexural and shear complex moduli by inverting the Timoshenko beam problem[END_REF]. The results presented in Figure 10 are frequency averaged on the frequency band [150-950] Hz as highlighted in the upper Figure 9. The evolutions of the Young's moduli along the length of each beam show that the patterning (half of the beam not irradiated, half of the beam irradiated) is effective. The modulus of the Irr -NIrr architectured beam falls well within the values measured for the NIrr and Irr homogeneous beams. Let's point out that the equivalent modulus within the NIrr region should be lower than the one measured for the NIrr beam since the curing step of the architectured beam is such that the crosslinking is not completed (see Table 1). That being said, the heat transfer differs between the rheometer and the furnace, so that it is important to consider the values in Table 1 as theoretical. Also, the transition between the NIrr and Irr regions corresponding to the grey zone in Figure 10 is quite sudden (less than 2 cm), yet greater than the spatial resolution of the CFAT measurements. Thus, the CFAT is well adapted and evidence that the selective UV irradiation of the silicone layer is efficient to locally modify the mechanical property of sandwich composite. Again, the variation observed on the Young's modulus of the Nirr beam is most likely due to the spatial variations in the thickness of the silicone layer.

Conclusions

A protocol is developed to design lightweight aluminumsiliconealuminum sandwich structures with spatial control of the viscoelastic properties of the polymeric core. The tuning is obtained by selective UV irradiation of the silicone layer. The UV irradiation is applied onto the silicone mix prior to thermal curing and the irradiation is seen to decrease the crosslinking kinetics of the silicone material. Consequently, under controlled thermal curing conditions, the irradiated silicone exhibits lower modulus and greater damping properties compared to non-irradiated one. Following this protocol, sandwich beams were designed and their spatial and frequency dependent properties (equivalent Young's modulus) successfully characterized using CFAT.

Homogeneous beams were prepared with varying silicone properties using UV irradiation. The measured properties fall well within the analytical predictions using the analytical Guyader model, yet further confirming the validity of using CFAT to determine the structure's equivalent properties. As a consequence to UV irradiation, the 7/20/2015 equivalent modulus drop corresponding to the optimum shearing zone is seen to shift towards lower frequency and be more dissipative.

CFAT is also applied onto a heterogeneous beam in which only one half has been irradiated. The feasibility of spatial patterning using UV irradiation on silicone layer is demonstrated as spatial evolution of the equivalent modulus is clearly evidenced.

Finally, The UV dose can be used to tune the property of the silicone layer in order to adjust the vibro-acoustic performances of a flat sandwich beam or panel. Considering the analytical predictions and the associated frequency shift of the "maximum shearing zone" of a homogeneous sandwich composite in which the polymer contribution to the overall composite response is maximum, the explored material solutions could be dedicated from low to very low frequency ranges where meta-material-based solutions are often inefficient. Further studies now focus on the effect of the viscoelastic patterning on the "optimum shearing zone" (position and width) and aim at considering the intrinsic frequency-dependent properties of the silicone material.

Figure 1 :

 1 Figure 1: Protocol for obtaining aluminum -architectured silicone -aluminum sandwich. N.B. Homogeneous UV-irradiated silicone membranes are obtained by not using the aluminum sheets and the mask.

Figure 2 :

 2 Figure 2: Experimental setup for identifying the equivalent Young's modulus of a beam by CFAT. The beam is fixed onto a rigid frame with an elastic link and is excited by a non-contact sensor (MM02). The velocity field along the length of the beam is measured by a vibrometer with scanning head.

Figure 3 :

 3 Figure 3: Evolution of the silicone shear modulus as a function of curing time (at 80°C) priory submitted to different UV irradiation conditions. The inset highlights the opportunity to control the difference in the silicone property on a single architectured sandwich composite.

Figure 4 :

 4 Figure 4: Viscoelastic properties of the pristine silicone membrane as a function of temperature and loading frequency.

Figure 5 :

 5 Figure 5: Room temperature viscoelastic properties of silicone membranes as a function of UV irradiation and loading frequency.

Figure 6 :

 6 Figure 6: Analytical prediction of the large-frequency band properties of an aluminumsiliconealuminum sandwich structure. (a) Input parameters. Frequency dependence of (b) the Equivalent Young's modulus and (c) the loss factor.

Figure 7 :

 7 Figure 7 : Effect of the silicone layer thickness on the large-frequency band properties of an aluminumsiliconealuminum sandwich structure (a) Input parameters, (b) Equivalent Young's modulus and (c) loss factor as a function of frequency.

Figure 8 :

 8 Figure 8: Illustration of the 5 points of the finite difference scheme with in FAT. The scheme is moved along the length of the beam to identify the spatial variations of force distribution.

Figure 9 :

 9 Figure 9: Equivalent Young's modulus of the NIrr (blue) and Irr (orange) beams as a function of frequency using CFAT (thick lines) and analytical predictions from the Guyader model (thin lines). Two silicone thicknesses ℎ sil = 0.4 and ℎ sil = 0.35 mm are employed to evidence the importance of controlling the polymer core thickness.

Figure 10 :

 10 Figure 10: Equivalent Young's modulus of the hybrid sandwich beams as a function of the position along the beam using CFAT. For the heterogeneous NIrr-Irr beam, the graded region is highlighted and coincide with the vicinity of the mask's edge.

Table 1 :

 1 Expected mechanical properties of the aluminum and silicone layers used in the three hybrid composite beams.

		Beam NIrr	Beam Irr	Beam NIrr-Irr NIrr Irr	Al
	Density 𝜌 sil (kg/m 3 )		1000		2700
	Young's modulus 𝐸 sil (MPa)	2.5	0.25	0.7	0.25	69000
	Loss factor 𝜂 sil (-)	0.05	0.3	0.1	0.3	0.001
	Poisson ratio 𝜈 sil (-)		0.5			0.3

Acknowledgments

This work has been funded by the French Carnot Institute network "Ingénierie@Lyon" (Mhyriam Project). This work was performed within the framework of the Labex CeLyA of Université de Lyon, operated by the French National Research Center Agency (ANR-10-LABX-0060/ ANR-11-IDEX-0007)


Laure Berti-Equille

Yury Zhauniarovich
email: yzhauniarovich@qf.org.qa

Profiling DRDoS Attacks with Data Analytics Pipeline

Keywords: CCS CONCEPTS, Information systems → Clustering, Data analytics, • Networks → Denial-of-service attacks, • Theory of computation → Unsupervised learning and clustering, • Computing methodologies → Ensemble methods

A large amount of Distributed Reflective Denial-of-Service (DRDoS) attacks are launched every day, and our understanding of the modus operandi of their perpetrators is yet very limited as we are submerged with so Big Data to analyze and do not have reliable and complete ways to validate our findings. In this paper, we propose a first analytic pipeline that enables us to cluster and characterize attack campaigns into several main profiles that exhibit similarities. These similarities are due to common technical properties of the underlying infrastructures used to launch these attacks. Although we do not have access to the ground truth and we do not know how many perpetrators are acting behind the scene, we can group their attacks based on relevant commonalities with cluster ensembling to estimate their number and capture their profiles over time. Specifically, our results show that we can repeatably identify and group together common profiles of attacks while considering domain expert's constraint in the cluster ensembles. From the obtained consensus clusters, we can generate comprehensive rules that characterize past campaigns and that can be used for classifying the next ones despite the evolving nature of the attacks. Such rules can be further used to filter out garbage traffic in Internet Service Provider networks.

INTRODUCTION

Over the last few years, we are witnessing the massive recrudescence of DDoS (Distributed Denial of Service) attacks affecting every online service: SSH, email, Web, gaming, etc. [START_REF] Büscher | Tracking ddos attacks: Insights into the business of disrupting the web[END_REF][START_REF] Specht | Distributed denial of service: taxonomies of attacks, tools and countermeasures[END_REF] with system outages that can have tremendous repercussions on the business and Internet users' everyday-life 1 . Amongst the various types of DDoS nuisances [START_REF] Karami | Understanding the emerging threat of ddos-as-a-service[END_REF], UDP-based Distributed Reflective Denial of Service (DRDoS) attacks are among the most impactful due to their unique properties. First, they preserve the attacker's anonymity through IP address spoofing. Therefore, it is tough to identify the attackers and block their services. Second, these attacks abuse some UDP-based network protocols that send considerably larger response comparing to the size of the request. Several studies have shown that bandwidth amplification of UDPbased DRDoS attacks can multiply the traffic up to a factor of 500 [START_REF] Czyz | Taming the 800 Pound Gorilla: The Rise and Decline of NTP DDoS Attacks[END_REF][START_REF] Rossow | Amplification Hell: Revisiting Network Protocols for DDoS Abuse[END_REF]. The combination of these two properties allows attackers to launch massive attacks while preserving the anonymity of the attacking infrastructure [START_REF] Kührer | Going Wild: Large-Scale Classification of Open DNS Resolvers[END_REF]. Such properties provoke interest in DRDoS attacks from researchers and analysts for finding answers to many questions raised by these attacks: Are there patterns in the attacks, and commonalities in the attacks' characteristics that can be discovered? What are the softwares that are used to generate the spoofed packets? How many machines are there in the attacker net? To fight effectively these types of DDoS attacks, we need to collect evidences from the data left behind by the attackers and identify their profiles as it is done for any other criminal activities. In line with recent studies [START_REF] Aupetit | Visualization of Actionable Knowledge to Mitigate DRDoS Attacks[END_REF][START_REF] Krämer | AmpPot: Monitoring and defending against amplification DDos attacks[END_REF][START_REF] Noroozian | Who Gets the Boot? Analyzing Victimization by DDoS-as-a-Service[END_REF] at improving our understanding of the DRDoS threat, this paper precisely attempts to answer some of the aforementioned questions by analyzing traffic data collected from an instance of the amplification honeypot we have adapted and deployed.

Our main contributions in this paper are the following: (i) we developed an amplifier honeypot to collect fine-grained data about hundreds-of-millions-packets scale attacks happening every day; (ii) we cluster the attacks with clustering ensemble, explore, and discover patterns and commonalities of the attack campaigns; and (iii) we built an analytic pipeline for exploration and clustering of attack profiles. Our aim is to reveal common technical characteristics of the infrastructures responsible for typical attacks. We believe that an in-depth understanding of the patterns of DRDoS attacks can help to characterize the attackers' modus operandi providing the tools and knowledge to combat with this type of DDoS attacks.

DATA COLLECTION

In order to analyze UDP-based DRDoS attack hyperplane, Kramer et al. [START_REF] Krämer | AmpPot: Monitoring and defending against amplification DDos attacks[END_REF] developed a honeypot, called AmpPot. This type of honeypot pretends to run services known to be vulnerable to amplification attacks, such as DNS or NTP, so that when they are scanned and exploited by real attackers, researchers can collect useful information to better understand the intrinsic characteristics of amplification attacks and the targets of the attackers. Unlike traditional honeypots, amplification honeypots can only be used to analyze data related to the victims, not the attackers.

To collect the data for our analysis, we deployed a modified version of AmpPot on a cloud provider, labeled as a Honeypot in Figure 1. We modified the honeypot in several aspects. The original implementation had several traffic limiting strategies to reduce the amount of incoming data. So, we first disabled all limitation mechanisms such that all packets coming to the honeypot could be recorded. Second, we added to our implementation the code that extracts additional information from the incoming packets. In particular, for every incoming packet, we extract ''Do not Fragment'' (DF) flag. We compute the UDP checksum value, and compare it with the data from the UDP header. If the value does not coincide (and the UDP header value is not equal to 0), we report the packet as corrupted. Third, our modification enables the storage of all data characterizing all incoming packets, avoiding throttling used in the original implementation. Similar to the original AmpPot, we split the data on a daily basis resetting the initial state of the honeypot every day. At the time of dataset collection for this paper, our honeypot has been active since May 2016.

FEATURE DESCRIPTION

For every raw incoming packet, we extract primary data features. Then, we group the packets related to the same attack originating from one machine together (according to our understanding). Further, for every such group, we also extract a set of group-level features described hereafter.

Primary Data Features. Primary data features describe an attack from a fine-grained raw packet perspective. These are the features extracted from every packet such as the victim IP address, source and destination ports, TTL (timeto-live), UDP checksum, ID number of IP header, DF flag, and a timestamp (with microsecond precision), when the packet is received by our AmpPot.

Group-level Features. Group-level features are aggregated values that are computed from packets that are grouped together when they belong to the same attack originating from one single attacking machine. These groups have the same values for the following fields: Source IP Address, Destination Port Number, Internet Header Length, UDP Length, Don't Fragment (DF) flag, Time-To-Live (TTL), and Corrupted. Such grouping allows us to reduce the amount of data as input of our analytical pipeline from hundreds of millions of packets downto thousands of groups. Then, for every group we extract relevant group-level features, such as, for example, the attack durations (in ms), the frequency of changes in the source port numbers, the entropy of the port number usage, etc. These features contain the traces that may shed some light on how the infrastructure for launching attacks is used. Other distributional characteristics such as skewness, kurtosis, min, and max values of each feature have been computed to better characterize the data distribution in each group.

Data Reduction and Normalization. Furthermore, we used data normalization for group-level features and applied feature and record selection to avoid multi-collinearity between features (i.e., when one or more features are strongly correlated and can introduce bias in the analysis). In particular, for each pair of features exhibiting strong linear correlation (above .75), we selected the most meaningful feature from the experts' point-of-view. Additionally, we filtered out the groups containing less than 10 packets as we do not consider them as potential attacks but rather scanning attempts.

ANALYTIC PIPELINE

After these crucial steps of data collection, feature selection, and feature engineering, we developed a unique analytic pipeline that combines constraint-based clustering ensemble and rule discovery for profiling DRDoS attacks and discovering interesting patterns in the attack campaigns. First, we give an overview of the pipeline as it is illustrated in Figure 1 (from left to right). As described earlier, DRDoS attack data are collected by our deployed AmpPot instance, stored and queried in Elasticsearch. Our analysis has been applied at various levels of time granularity considering all packets received either every 5mn interval, every hour, or every day. In Stage 1 of the pipeline, for each time granularity level, primary features and group-level features are analyzed. Interestingly, the number of groups with common values of a subset of primary features can give us a bound of the maximum number of attacks with similar modus operandi for a given time window. We observed that this bound was fairly stable between 2 to 5 thousands similar attack profiles per day over the period of our study. In Stage 2 of the pipeline, we apply various clustering techniques to the group-level data for capturing complementary aspects and data clustering properties with diverse density-based and distance-based clustering techniques. We tested various methods:

-kMeans [START_REF] Kanungo | An efficient k-means clustering algorithm: Analysis and implementation[END_REF] that requires the specification of 𝑘, the number of clusters; -HDBSCAN [START_REF] Campello | Density-Based Clustering Based on Hierarchical Density Estimates[END_REF] that requires the specification of the minimal cluster size; -Self-Organizing Map (SOM) [START_REF] Kohonen | Self-Organizing Maps[END_REF] that requires the specification of the size of the grid for data reduction and transfer to a neural network; -Hierarchical clustering (HCLUST) [START_REF] Hartigan | Clustering Algorithms[END_REF] that captures the clusters' embedding structure, such as hierarchies of clusters; -EM (expectation maximisation)-based clustering that assigns a probability distribution to each packet which indicates the probability of it belonging to each of the clusters. EM can decide how many clusters to create by cross validation.

Since no single clustering algorithm is optimal, we selected five representative clustering approaches, tuned their parameters with multiple hypothesis testing, and compared their results under three dimensions: (1) traditional clustering quality metrics (e.g., silhouette coefficient, SSE -Sum of Squared Error, and cluster entropy); (2) overlapping between the clusters returned by the different methods; and (3) lineage over time to check whether the characteristics of particular clusters of a given day are repeatedly preserved in the clusters of the next days (using confusion matrices and Jaccard index). The pipeline is modular and can seamlessly integrate other clustering or ensembling techniques that can be selected with respect to a set of labeled data when available. In Stage 3, clustering ensembles are built using two ensembling techniques: [START_REF] Aupetit | Visualization of Actionable Knowledge to Mitigate DRDoS Attacks[END_REF] in the first ensembling technique, co-association matrices are computed based on multiple data partitions obtained from Stage 2, then a similarity-based clustering algorithm based on single-link and normalized cut is applied to the co-association matrices in order to obtain the final partition of the data; (2) in the second ensembling technique, the Hungarian method is applied to solve the assignment problem of the multiple cluster labels in order to re-label the data. Finally, a voting process is applied to select the final consensus cluster for the labeling. In both techniques, instance-based constraints from the experts are used to guide the ensembling process in the form of "mustlink" and "cannot-link" instances of the consensus clustering results and they encode the domain-specific knowledge of DRDoS attacks similar to previous work of [START_REF] Chahdi | On the use of ontology as a priori knowledge into constrained clustering[END_REF]. Finally, in Stage 4, M5 and decision tree-based rules are discovered from each consensus cluster. These rules are submitted to the domain experts and the most relevant rules can be included as new constraints for Stage 3.

Density-based

The main objective of this pipeline was twofold: first, to check whether the results obtained from various clustering techniques were consistent to characterize attack profiles for a given time window and over time; and second, whether these results could be corroborated, combined and further explored, for instance, with rules discovered from the consensual clusters as typical profiles of the attacks. From the technical challenge point-of-view, the evaluation of the effectiveness of the method that combines constraint-based clustering ensemble and rule discovery for DRDOS attack profiling is very challenging due to the lack of ground truth and the difficulty to set up a small scaled controlled experiment to show how well this method performs on labeled data. Although we could pay for launching our own DRDOS attacks, there is no guarantee that they will be fully captured by our honeypot and the lack of coverage and traceability will impair the evaluation anyway.

Due to space limitation, details describing how we select the optimal parameter settings for each clustering method are omitted. For illustrating the results, Table 1 only presents the results for each clustering method and their ensembles for 5 representative days. Figure 2 is a SOM-like representation of the consensus clustering result obtained for one day, Dec. the 10th, 2016 where the weight vectors across the map are representative of the distribution of the packets and variables listed in the legend. Figure 3 gives an example of the decision rule we can obtained from the consensus cluster# 6 that is satisfied for 73.475% of the groups that belong to this cluster. The rule indicates that for a particular range of the attack duration in ms and a certain bound on the maximal usage time of the source ports (all being normalized), 143 groups have the same attack profile in cluster 6. The next step for domain experts is to filter and link the information provided by such rules to technical characteristics of the attackers' machines. In summary for the whole period, the average number of packets is 182, 376, 195.4 ± 27, 499, 207.4 with 4, 168.8 ± 1399.7 groups and 54.2 ± 17.4 M5 rules generated per day.

RELATED WORK

Our work focuses on data analytics applied to one of the prevalent threats of cybercrime commoditization, namely the amplified DDoS attacks where low-cost DDoS services (aka booters) can be purchased by anyone to launch Gbps-scale attacks to exhaust the bandwidth of a victim whose IP address has been spoofed. With a modest subscription fee, abusive users are empowered to harass, block, extort, and intimidate their competitors (e.g., in business or online gaming). To meet the increasing demand for DDoS attacks, such services have scaled up their infrastructure as demonstrated by recent studies exposing various technical and business aspects of DDoS-as-a-service market such as their attack infrastructure, payment ecosystem [START_REF] Karami | Stress Testing the Booters: Understanding and Undermining the Business of DDoS Services[END_REF][START_REF] Santanna | Booters -an analysis of ddos-as-a-service attacks[END_REF], or characterization of their victims [START_REF] Noroozian | Who Gets the Boot? Analyzing Victimization by DDoS-as-a-Service[END_REF]. DDoS botnets and their attack monitoring have been an extensively studied topic [START_REF] Büscher | Tracking ddos attacks: Insights into the business of disrupting the web[END_REF][START_REF] Welzel | On Measuring the Impact of DDoS Botnets[END_REF], followed by amplification attacks [START_REF] Rossow | Amplification Hell: Revisiting Network Protocols for DDoS Abuse[END_REF]. The use of honeypots as "baits" mimicking services that are vulnerable to amplification DDoS attacks has been recently advocated by [START_REF] Krämer | AmpPot: Monitoring and defending against amplification DDos attacks[END_REF] to be a very useful mean for gaining attack intelligence regardless of the particular protocols vulnerable to amplification and/or the specifics of a booter service used for launching the attacks. Close to this work, we take advantage of the deployment of honeypots and we extensively analyze the data collected from amplification attacks and extract typical profiles and fine-grained characteristics. This level of detail in our data analysis reveals interesting patterns for fingerprinting the attacks, which have not been investigated earlier. Clustering ensemble methods have been designed for combining partitional and hierarchical clustering methods, but they generally do not take advantage of the domain-related constraints. Constraining the clustering ensembles is an innovative aspect of our work where multiple clustering techniques are combined and domain expert's constraints are used to optimize the clustering results, advancing the state-of-the art on this topic [START_REF] Vega-Pons | A survey of clustering ensemble algorithms[END_REF].

CONCLUSIONS

In this paper, we presented the results of our analysis of DDoS amplification honeypot data from actual network traffic with hundreds of millions packets that have disrupted more than ten thousands of IP addresses every day within the last 6 months. In particular, the following contributions. First, we deployed a modified instance of AmpPot to collect and analyze fine-grained data in order to characterize the profiles of the attacks received by our honeypot. Second, we present an analytic pipeline to group, cluster, and characterize the attacks combining multiple clustering techniques. Third, from the consensus clusters we have obtained, we can discover a posteriori M5 and decision tree-based rules explaining attack clusters' characteristics that we will further enable the domain experts to infer technical characteristics of the attackers' infrastructure. Future work will include the development of near real-time detection and profiling.

Figure 2 :

 2 Figure 2: Consensus Clusters (k=13).

Figure 3 :

 3 Figure 3: Example of decision rule from Cluster# 6.

Analytic Pipeline Stage 1: Feature Engineering Stage 2: Constrained Ensembling Stage3: Finding Cluster Consensus Voting Stage 4: Validation by experts M5 Rules Decision Rules HDBSCAN SOM HCLUST

  Figure 1: Analytic Pipeline for Profiling DRDOS Data from Amplifier Honeypot.

					Grouping		Clustering	Cluster Cross-	Rule
					Identical Attacks	Ensemble	Validation	Discovery
			Honeypot
					Identical Values				Quality metrics	Rule: 24
										IF src_port_max_norm > 0.593
									Expert's	AND attack_duration_norm <= 119.2
			ElasticSearch						constraints	AND dst_port_norm <= 0.018 THEN Cluster# = 10
					Primary Features				Co-association matrix
					Group
					Features
			Data							Attack profiles
	Date		Total Nb of distinct			Nb of		Nb of Clusters (single method)		Nb of Clusters (Ensemble)
		Packets	Victims	TTLs	Src. Ports	Groups	kMeans	HDBSCAN	SOM	HCLUST	EM	Co-Assoc.	Voting	Consensus
	10/12/2016	180,161,186	2,199	188	12		5035	15	912	13	15	10	10	34	13
	11/12/2016	136,137,749	2,065	183	12		5302	15	941	13	14	10	10	41	12
	12/12/2016	195,212,682	1,764	186	11		5223	15	969	12	14	10	10	37	13
	13/12/2016	198,782,496	1,013	185	12		2763	15	493	10	13	9	9	26	11
	14/12/2016	151,586,854	1,046	183	12		2521	15	455	10	12	8	8	25	11

Table 1 :

 1

5-Days Sample of AmpPot dataset with clustering results.

://www.akamai.com/us/