Rémi Cogranne
email: remi.cogranne@utt.fr

A Sequential Method for Online Steganalysis

Keywords: Hypothesis testing theory, Sequential detection, optimal detection, Pool steganalysis, Steganography

This paper studies online detection of hidden information in digital images. By online, it is meant that we inspect a flow of images that are transmitted sequentially. This has crucial consequences on the detection of hidden data. By contrast to the usual detection settings, the delay before detection has to be considered in the definition of the correct detection probability, or power function. Similarly, the false alarm probability is considered with respect to a number of inspected cover images. In this paper a new sequential detection method is proposed with the goal to maximize the detection accuracy for a prescribed detection delay. The study of proposed sequential test allows the establishing of detection power as a function of detection delay and also permits us to bound the probability of false alarm for a given number of cover images. Numerical results on real image using both the well-known WS type of detector and the recent ensemble classifier show the relevance of the proposed approach and the accuracy of the theoretical findings.

I. INTRODUCTION

S TEGANOGRAPHY is often referred to as the science of covert communication. On the one hand, the goal of steganography is to hide secret data within a digital objet to create an innocuous-like stego-object. On the other hand, the goal of steganalysis is to inspect digital object in order to detect the presence of hidden data. Steganography is much more mature with digital images as cover files, this paper thus focuses on digital images though the proposed methodology is general and can be applied for a wide range of steganalysis.

Steganography has been evolving at a fast rate since two decades. Modern steganographic methods are content adaptive, that is, the embedding changes are concentrated in areas of the cover image where they are expected to be the most difficult to detect. On the other hand, steganalysis methods have also been remarkably developed to detect with better and better accuracy modern steganographic schemes. Four approaches have mainly been used in steganalysis:

1) Historically, first detectors belong to the class of structural detectors that focus on the detection of Least Significant Bit (LSB) replacement using pixels' correlation, see [START_REF] Ker | A general framework for structural steganalysis of LSB replacement[END_REF] for an overview. 2) Then, the well-known Weighted-Stego image (WS) algorithms has been introduced in [START_REF] Fridrich | On estimation of secret message length in LSB steganography in spatial domain[END_REF] and deeply studied in [START_REF] Ker | Revisiting weighted stego-image steganalysis[END_REF]. While it originally aims at estimating the payload, or hidden message length, it has been shown in [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF], [START_REF] Zitzmann | Statistical decision methods in hidden information detection[END_REF] that the WS detector is closely related to the optimal Likelihood Ratio Test (LRT) under the assumption that pixels' noise is Gaussian. 3) This re-opened the field of optimal detectors, as referred to in [START_REF] Ker | Moving steganography and steganalysis from the laboratory into the real world[END_REF], that uses a statistical model of cover and steganographic images and exploit hypothesis testing theory to design a test that is optimal for a given criterion. The first detectors from this category used simplistic image model [START_REF] Dabeer | Detection of hiding in the least significant bit[END_REF] and were latter improved and enlarge for LSB matching detection [START_REF] Cogranne | An asymptotically uniformly most powerful test for lsb matching detection[END_REF] and JPEG images [START_REF] Zitzmann | Hidden information detection based on quantized Laplacian distribution[END_REF], [START_REF] Thai | Statistical model of quantized DCT coefficients : Application in the steganalysis of JSteg algorithm[END_REF]. 4) Last, most of the modern steganalysis methods are built by extracting a set of features that reveal the presence of hidden data and on supervised learning to train a classifier to distinguish between cover and stego images. The firsts feature-based steganalysis methods used the Fisher Linear Discriminant (FLD) analysis and dozens of features. Soon, more accurate learning algorithms have been used such as the popular Support Vector Machine (SVM) and the number of extracted features grew to more than 30 000 for recent rich models [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF]. This improvement of feature dimension has been enabled with the ensemble classifier [START_REF] Kodovskỳ | Ensemble classifiers for steganalysis of digital media[END_REF] as an efficient alternative learning methods for such high dimensionality.

While the "optimal detectors" can not achieve the detection accuracy of feature-based approaches, they have the indisputable advantage to provide a statistical test with analytic expression of its statistical properties. On the opposite, the statistical properties of features-based steganalysis methods are only known empirically. Note that, it has recently been proposed to formulate the ensemble classifier within the framework of hypothesis testing [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF], [START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF]. This prior work models the projection of ensemble base learners as a multivariate Gaussian which allows the replacing of majority vote decision rule by an optimal LRT and to theoretically study the performance of the ensemble classifier. In this paper, the advantage of steganalysis methods with known statistical properties is used to study their application in a sequential context, when images are transmitted and inspected sequentially, one after the other.

A. Contribution and Organization of this Paper

As noted in [START_REF] Ker | Moving steganography and steganalysis from the laboratory into the real world[END_REF], the moving of steganalysis "from laboratories to the real life" implies several challenging problems among which the problem of pooled steganalysis received little attention. One of few notable prior work that studies a similar problem [START_REF] Ker | The steganographer is the outlier: realistic large-scale steganalysis[END_REF] proposed to gather images from different users and to identify those who transmit steganographic image, without prior reference, or cover dataset. By contrast, in this paper, it is proposed to study the problem of online steganalysis, when users are sending images sequentially, one after the other, and when a cover dataset reference is possibly available. The problem is cast within the framework of optimal detection, that is by using hypothesis testing methods, we propose a sequential statistical test for which the probability of false alarm and the detection accuracy are known. It is important to note that, the definition of false alarm and correct detection has to be reformulated to match the problem of sequential steganalysis of several images.

The main contributions of this paper are the following: 1) First the problem of sequential steganalysis for inspection of a flow of images is stated. A general framework is proposed regardless of the strategy used for spreading the hidden data within several images. 2) Then a sequential detection method is proposed and its statistical performance is analytical established. While usual sequential methods focus on mean detection and mean time to false alarm, the proposed approach focuses on maximizing the probability of correct detection under the constraint of a maximal detection delay. 3) Last, and not least, numerical results on real images show the sharpness of the theoretical results. The present paper is organized as follows. Section II cast the problem of sequential analysis from a flow of transmitted images within the framework of hypothesis testing theory. This first section also presents the definition of detection accuracy used in sequential analysis and recalls the usual methods for sequential detection. Then Section III presents the proposed sequential test and studies its statistical properties, that is false alarm probability for a fixed analysis run length and detection power as a function of detection delay. Section IV presents numerical results that show the relevance of the proposed methodology for different type of steganalysis method and for both spatial and JPEG domain steganographic methods. Finally, Section V summarizes the present work and concludes the paper.

II. ONLINE STEGANALYSIS: PROBLEM STATEMENT

In this paper we do not make any assumption on the steganalysis method used by the warden, as well on the strategy used by steganographer for spreading hidden information over several images. The general framework for representing the warden considers that each image, after have been analyzed, is reduced to a scalar x i . Let us suppose that the warden has observed N images, then has a sequence {x n } N n=1 . In the present paper, the sequential detection problem is modeled as follows: after having sent an unknown number ν -1 of cover images, the steganographer starts embedding hidden message within the following images, with, by Kerckhoff's principle, a known embedding algorithm. Hence the sequence x 1 , . . . , x N can be modeled as:

x n ∼ P 0 , ∀n < ν, x n ∼ P θn , ∀n ≥ ν , θ n ≥ 0. (1)
Here, in Equation ( 1), it is assumed that before the ν-th image, the steganalysis results x n are i.i.d (independent and identically distributed) with distribution P 0 . On the opposite, the embedding of hidden information, that starts at image number ν changes the distribution of warden analysis results'

x n ∼ P θn where θ n represents a parameter of the distribution that, without loss of generality, is increased by the use of steganography. Note that it is possible that the steganographer does not use all the images after ν; without loss of generality, it is assumed that ∀n ≥ ν , θ n ≥ 0 with the inequality being an equality if no data is hidden within an image. Finally, it should be emphasized that the present paper focus on the case in which the statistical distribution of x n is established, before and after embedding starts. However, the proposed can be extended when x n is a decision result that, for instance, takes value in {0; 1}. In such a case x n would be drawn from a Bernouilli trial with a, possibly unknown, probability p that x n is 1. In fact in both cases, the problem of the warden can be modeled as a sequential detection of a change of the distribution parameter θ n .

A. Criterion of Optimality

When dealing with sequential detection, as presented in Equation ( 1), the goal is to detect the image number at which embedding starts ν as quickly as possible. This problem is known in the literature as the quickest changepoint detection. Formally, a sequential test is a mapping δ N : R N → {0; 1} which, based on the observations x 1 , . . . , x N decide between the two following hypotheses:

H 0 : x n ∼ P 0 , ∀n ∈ {1, . . . , N }, (2)
H n : x n ∼ P 0 , ∀n < ν, P θn , ∀n ≥ ν , θ n ≥ 0 . (3)
The stopping time T of a sequential changepoint detection is the smallest image index n for which

δ n (x 1 , . . . , x n ) = 1.
When embedding is detected this can be erroneous if T < ν in which case a false alarm is raised. On the opposite, a flow of steganographic images is correctly detected made when T ≥ ν. With the quickest detection of change in mind, it is naturally desirable to minimize the detection delay T -ν which is referred to as the detection delay. Since the detection is made sequentially, it does not make any sense to measure the probability of false alarm for each sequence x 1 , . . . , x n . Instead, the most usual criterion in changepoint detection is the average run length (ARL) to false alarm, that is, the expected number of cover images tested and leading to the false-alarm (erroneous decision that embedding starts):

ARL = E [T |T < ν] . (4)
Because the ARL does not provide any guarantee on false alarm probability, another criterion that may be used is the the probability of false alarm over a run length, or a number of inspected cover images L, denoted α (L) 0

and defines for the i.i.d case by: α

(L) 0 = P [T ≤ L|L < ν] (5)
Similarly, the power of a test, defined as the probability of correctly detecting the use of a steganographic algorithm for a "snapshot" test, has very few meaning in sequential detection. Instead it is usually considered that the average detection delay (ADD) should be considered:

ADD = E[T -ν|T ≥ ν]. (6)
The ADD represents the number of images, after the embedding startpoint, that would be required in average to correctly detect steganography. However, similar to the ARL, the average number does not provide any guarantee on the detection accuracy. Hence, when it is preferable to reliably detect the use of steganography with a fixed detection delay, that is with at most M images after embedding start, the probability of detection before M images has to be used:

β (M ) = P [ν ≤ T ≤ ν + M ] . (7)
The notions of detection delay and run length are illustrated in Figure 1.

B. Changepoint detection: Brief Review

In the literature of sequential analysis, two approaches which are briefly presented below are generally used, see [START_REF] Tartakovsky | Sequential Analysis: Hypothesis Testing and Changepoint Detection[END_REF] for a detailed review. First, when the changepoint is ν = 0 and it is desired to decide between two hypotheses with as few samples a possible, the Sequential Probability Ratio Test (SPRT) is generally used because it has been shown to be optimal with respect to minimizing average time to detection and error probabilities. The SPRT is associated with the following decision rule:

δ sprt N = 0 if λ N = Σ N n=1 Λ(x n ) < τ 0 , 1 if λ N = Σ N n=1 Λ(x n ) > τ 1 , (8)
with

Λ(x n ) = f 0 (x n ) f θ (x n ) . (9)
Here f 0 and f θ are the probability distribution functions associated with distributions P 0 and P θn and Λ is the Likelihood Ratio (LR) between the two distributions. Note that for the sake of clarity it is assumed here that θ is fixed and known after embedding starts. The two thresholds τ 0 and τ 1 are set to respect constraints on error probabilities. When the SPRT cannot decide between the two hypotheses, this means that the inspection should continue with one more image.

For the problem of changepoint detection, with unknown ν, the most widely used method is the cumulative sum (CUSUM) initially proposed in [START_REF] Page | Continuous inspection schemes[END_REF]. The CUSUM method is based on the following decision rule:

δ cusum N = 0 if S N = max {0; S N -1 + Λ(x N )} ≤ τ, 1 if S N = max {0; S N -1 + Λ(x N )} > τ, (10)
with initialization S 0 = 0. The CUSUM is thus essentially a cumulative sum of LR, as the SPRT, which is reset to 0 when its value is negative. This can be explained by the fact that the LR has a negative expectation under H 0 that inspected images are cover and hence will decrease in average. Resetting the CUSUM to 0 avoid the negative drift of the SPRT and hence allows a much quicker detection.

The popularity of the CUSUM may be explained by the fact that its optimality, with respect to minimizing worst case average run length to false-alarm and detection delay, has been proved in several cases (see [START_REF] Tartakovsky | Sequential Analysis: Hypothesis Testing and Changepoint Detection[END_REF] for a details). However, the criterion of minimizing false-alarm probability for a given run length has seldom been studied and the changepoint detection method is rarely provided with established statistical properties in term of probability of errors. Such a study has only recently been proposed in the context of transient change detection [START_REF] Guépié | Sequential detection of transient changes: application to water distribution network monitoring in french[END_REF], [START_REF] Guépié | Sequential detection of transient changes[END_REF] and it has motivated the present study.

An illustrative example of results from the SPRT and the CUSUM are given in Figures 2.Obviously the SPRT is slowly decreasing before the embedding starts, because it aims at detecting if from the beginning the inspected flow of images is made of only cover or of only stego images. On the opposite the CUSUM, that aims at reacting as quickly as possible after the embedding start, remains around zero until changepoint.

III. PROPOSED CHANGEPOINT DETECTION METHOD FOR ONLINE STEGANALYSIS

The present paper lies within the field of optimal detection and, hence, focuses on guaranteeing a false-alarm probability for a given run-length, or number N of inspected cover images and aims at designing a statistical changepoint detection methods for which the corresponding power function for a Let us also recall that the proposed method is used in this paper with the WS-type statistical test [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF] and with the ensemble classifier with LRT decision rule [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF], [START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF], though it can be extended to wider range of steganalysis methods. The two steganalysis methods on which the proposed sequential method relies share a common model for the detection statistics. In fact, in both case, when inspecting a cover image their results has been shown to follow a Gaussian distribution with zero mean and unit variance. On the opposite, when inspecting steganographic images, their results follow a Gaussian distribution still with unit variance while the mean θ > 0 is increased. However, a fundamental difference, that is discussed in numerical results, is that the mean θ depends, for the WS, on the payload R but also on pixels' variance. On the opposite, because ensemble classifier is trained on a whole dataset of cover and stego images, the test [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF], [START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF] is designed such that all stego image share the same expectation. We also note that because both tests used are optimal whatever the payload, or more precisely Uniformly Most Powerful, the payload has small influence. Hence, each steganalysis result x n can be modeled as:

x n ∼ N (0, 1) if inspected image is a cover , N (θ n , 1) if inspected image is a stego . ( 11
)
And the goal is to detect as quickly as possible the embedding starting image ν at which the expectation change from 0 to θ n > 0. In this paper it is proposed to target a fixed maximal detection delay M , after which the detection is considered as "too late". Hence, the proposed sequential method has a fixed window length (FWL) M that coincide with the maximal detection delay. The proposed FWL-SPRT test is based on the following decision rule:

δ fwl N = 0 if W N,M = Σ N n=N -M +1 x n ≤ τ, 1 if W N,M = Σ N n=N -M +1 x n > τ. ( 12
)
We note that here for used steganalysis methods [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF] and [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF], [START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF], the x n 's correspond to values of likelihood ratios. This allows a transparent comparison with the CUSUM and the SPRT. First, the proposed methodology essentially consists in a SPRT which is only applied on the M lasts steganalysis results, as opposed to the SPRT which is computed using all results. More precisely, from Equations ( 12) and ( 8) it is obvious that W N,M = λ N -λ N -M . For this reason the proposed method is referred to as a "Fixed Window Length SPRT" (FWL-SPRT). This process, similar to the reset to 0 for the CUSUM, naturally avoids the drift of the SPRT when the flow of inspected images begins with covers. Besides, the CUSUM may also be re-written as S N = λ N -min 1≤n≤N (λ n ), see details in [START_REF] Tartakovsky | Sequential Analysis: Hypothesis Testing and Changepoint Detection[END_REF]Chap.8.2], that is it uses an adaptive threshold based on the minimal SPRT value instead of M lasts.

A. Statistical Properties of the Proposed Method

Let us start by noting that the FWL-SPRT W ν+M -1,M , which is last one for which the steganalysis detection is possible under maximal delay M constraint, is given by:

W ν+M -1,M = Σ ν+M -1 n=ν x n
where, from Equation [START_REF] Thai | Statistical model of quantized DCT coefficients : Application in the steganalysis of JSteg algorithm[END_REF] x n ∼ N (θ n , 1). Hence, from the independence of images, it is immediate that:

W ν+M -1,M ∼ N ( θ ν 1 , M ), (13)
with

θ ν 1 = ν+M -1 n=ν |θ n | = ν+M -1 n=ν θ n ,
the last equality being due to the fact that θ n ≥ 0 for all n ∈ {0, . . . , T }.

It should be noted that the distribution of W ν+M -1,M as given in Equation ( 13) is made without any assumption on the strategy used to spread the payload within several images. Hence, it especially includes two specific cases which are embedding with constant payload after embedding start ν and the case in which the embedding is made in only a selected subset of images, and cover images are still sent, for instance in order to try avoiding detection. In this later case, the θ n will be 0 for cover images. The distribution of W N,M for cover images is more difficult to establish. In fact, the main difficulty is that W N,M and W N +1,M , for instances, are computed using M -1 same images. Hence the correlation between W N,M and W N +1,M will be important. Because of this, it is hardly possible to establish the false-alarm probability over a run length of size L. To avoid the difficulty it is proposed to bound the probability α (L) 0 . Without loss of generality let us assume that L = M with ∈ N. It is proposed in this paper to bound α (L) 0 by above by noting that ∀n ∈ {1, . . . , N -M + 1}:

P[max{W n,M , . . . , W n+M -1,M } > τ ] ≥ P[W N,M > τ ].
On the opposite, since the correlation between FWL-SPRT values W N,M , . . . , W N +M -1,M is positive is follows that ∀t ∈ {1, . . . , T } [START_REF] Guépié | Sequential detection of transient changes: application to water distribution network monitoring in french[END_REF]:

P[max{W n,M , . . . , W n+M -1,M } > τ ] ≤ n+M -1 t=n P[W N,M > τ ].
Those observations allow us to bound both the power for a maximal detection delay β (M ) and the probability α (L) 0 of false alarm for a run of fixed length L. Proposition 1. For any decision threshold τ ∈ R the false alarm probability over L = M inspected cover image is bounded by:

1 -Φ τ √ M ≤ α (L) 0 ≤ 1 -Φ τ √ M L , (14)
with Φ and Φ -1 the standard normal cumulative distribution function and its inverse.

For any decision threshold τ , the power of the proposed FWL-SPRT is bounded:

β (M ) ≥ 1 -Φ τ -θ 1 √ M (15)
Since the study of sequential detection method is very difficult, the previous Proposition 1 only offer bounds on the statistical performances of the proposed FWL-SPRT. However, this allows to set a threshold for guaranteeing a false alarm probability for L cover images and to guarantee a minimal detection accuracy.

IV. NUMERICAL RESULTS

The numerical results presented in this paper has been obtained from BOSS database version 1.01 [START_REF] Bas | Break our steganographic system -the ins and outs of organizing boss[END_REF], made of 10, 000 grayscale images of size. The proposed method relies on steganalysis detector for which the statistical distribution of the results is known. Hence, the WS-type statistical test proposed in [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF] from "optimal detectors" has been used at first.To enlarge the application of the proposed detection method to feature-based approaches, the recently proposed approach for establishing the statistical properties of the wellknown ensemble classifier has been used. In this paper we only present, for spatial domain, results obtained using the (5) β (M ) (15): theory Empirical β (M ) [START_REF] Ker | Moving steganography and steganalysis from the laboratory into the real world[END_REF] Fig. 3: Comparison between empirical and theoretical probability of false alarm for run length L = 100 and power for M = 5 with the WS-like statistical test [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF] for LSB replacement embedding at payload R = 0.025. improved version of the Spatial Rich Model (SRM) [START_REF] Fridrich | Rich models for steganalysis of digital images[END_REF], called maxSRMd2 [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF], that takes into account the selection channel. The embedding method used is the recent embedding scheme [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized gaussian cover model[END_REF], [START_REF] Sedighi | Content-Adaptive Steganography by Minimizing Statistical Detectability[END_REF], that is based on statistical detectability of LSB matching under a multivariate Gaussian model, with payload 0.2 bit per pixel (bpp). For the JPEG domain, the presented results were obtained using the recent Phase aware projection model (PHARM) feature set [START_REF] Holub | Phase-aware projection model for steganalysis of JPEG images[END_REF] and Uniform Embedding Distortion (UED) [START_REF] Guo | An efficient jpeg steganographic scheme using uniform embedding[END_REF] steganographic algorithm at payload 0.2 bit per non zero-coefficients. It should be noted that several other embedding schemes and feature sets have been tested, for both spatial and JPEG domain, and similar trends has been observed.

First, because the main goal of this paper is to design a changepoint detection method for steganalysis with known statistical properties, Figure 3 show a comparison between empirical and theoretical results for WS-type test [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF]. This figure shows the false-alarm probability over a run length, α (L) 0 [START_REF] Cogranne | A cover image model for reliable steganalysis[END_REF], with L = 100 and the power for a maximal detection delay β (M ) [START_REF] Ker | Moving steganography and steganalysis from the laboratory into the real world[END_REF], with M = 5. The empirical results obtained for LSB replacement and WS-type algorithm show the relevance of the theoretical bounds. However, we note that this type of algorithm is applied for each image independently, hence the statistical properties of individual results is reliable. On the opposite, Figure 4 show a comparison between empirical and theoretical bounds on false-alarm probability over a run length L = 5 and L = 100 for the ensemble classifier with LRT decision rule and spatial domain embedding [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized gaussian cover model[END_REF], [START_REF] Sedighi | Content-Adaptive Steganography by Minimizing Statistical Detectability[END_REF] with maxSRMd2 feature set [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF]. While the bounds are rather tight, it should be noted that for large L = 100 and large threshold value τ its accuracy becomes doubtful. In fact, since this type of steganalysis is trained on a wide range of images, the statistical properties of individual results are not as much reliable; training is based on properties of the whole training set. Hence, it is more likely to find images that are outliers with respect to the average image from training set.

For the JPEG domain steganalysis, Figure 5 presents a comparison between the theoretical power for a maximal for the ensemble classifier with LRT decision rule [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF], [START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF]. The feature set used in maxSRMd2 [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF] and the embedding scheme is [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized gaussian cover model[END_REF], [START_REF] Sedighi | Content-Adaptive Steganography by Minimizing Statistical Detectability[END_REF]. Fig. 5: Comparison between empirical and theoretical power for a maximal detection delay β (M ) , with M = 5, as a function of the detection threshold. The ensemble classifier with LRT decision rule [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF], [START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF] is used with with PHARM feature set [START_REF] Holub | Phase-aware projection model for steganalysis of JPEG images[END_REF] and UED embedding scheme is [START_REF] Guo | An efficient jpeg steganographic scheme using uniform embedding[END_REF].

detection delay β (M ) as function of decision threshold τ . For this figure, PHARM feature set [START_REF] Holub | Phase-aware projection model for steganalysis of JPEG images[END_REF] and UED embedding scheme [START_REF] Guo | An efficient jpeg steganographic scheme using uniform embedding[END_REF] are used. It should be noted that, in this case, the model for spreading the payload over different images is that after embedding start at image ν, 3 randomly selected images are used in the 10 next images (hence 7 are left as cover). Roughly speaking this strategy correspond to case in which the steganographer keep sending cover images in order to prevent detection. This Figure show the accuracy of the theoretical bound of the power for a maximal detection delay β (M ) , with M = 5. We also note here that the empirical results does not match perfectly the theoretical bound for large threshold because feature based steganalysis is trained for the whole dataset and hence can hardly deal with outliers images. Finally, it is worth comparing the performance of the proposed FWL-SPRT methodology with the CUSUM algorithm. We recall here that the proposed approach rely on minimizing [START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF], [START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF] using maxSRMd2 feature set [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF] and embedding scheme [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized gaussian cover model[END_REF], [START_REF] Sedighi | Content-Adaptive Steganography by Minimizing Statistical Detectability[END_REF]. probability of false alarm for a given run length while the CUSUM is optimal to minimize the average run length to false-alarm. However, it is proposed in Figure 6 to compare the CUMSUM and the proposed FWL-SPRT through the average detection delay as a function of average run length to falsealarm. While the CUMSUM has been shown to be optimal for such criterion in several case, we note that the proposed method only performs slightly worse. The results presented in Figure 6 are also obtained with the ensemble classifier with LRT decision rule using spatial domain embedding [START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized gaussian cover model[END_REF], [START_REF] Sedighi | Content-Adaptive Steganography by Minimizing Statistical Detectability[END_REF] and maxSRMd2 features set [START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF].

V. CONCLUSION

This paper studies the problem of sequential steganalysis, when a flow of images has to be inspected, within the framework of "optimal detectors" relying on hypothesis testing. To the best of our knowledge, the problem of inspecting several images one by one with a goal to detect steganographic embedding startpoint as quickly as possible has never been studied. This paper presents the performance criterion that has to be considered for sequential steganalysis and briefly review usual sequential methods. Then a methodology is proposed with the aims of detecting when steganographic embedding start with a maximal detection delay. Bound are provided for the performance of the proposed method and their sharpness is verified on digital images using WS-type statistical test and ensemble classifier as an example of feature based steganalysis method. Future works will study the application of the proposed method with steganalysis detector that output a binary results and study the optimal strategy to spread the payload with respect to the proposed test.

Fig. 1 :

 1 Fig. 1: Illustrative example of a changepoint detection criteria of accuracy with simulated data.

  A typical signal with change in mean, shown in gray solid line, at time ν = 110, dashed green line. Test (SPRT) λ N (b) Example of SPRT methods results for the same signal. W t,L , L = 5 FWL-SPRT W t,L , L = 25 (d) Example of sliding / Window limited SPRT methods results for the same signal.

Fig. 2 :

 2 Fig. 2: Comparison between the proposed LR test and the majority vote decision rule for spatial domain steganalysis.

Fig. 4 :

 4 Fig.4: Comparison between empirical and theoretical probability of false alarm for run length L = 5 and L = 100 for the ensemble classifier with LRT decision rule[START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF],[START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF]. The feature set used in maxSRMd2[START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF] and the embedding scheme is[START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized gaussian cover model[END_REF],[START_REF] Sedighi | Content-Adaptive Steganography by Minimizing Statistical Detectability[END_REF].

  )[START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF]: theory Empirical β (M )[START_REF] Ker | Moving steganography and steganalysis from the laboratory into the real world[END_REF]

Fig. 6 :

 6 Fig.6: Comparison between the proposed FWL-SPRT and the CUMSUM algorithm in term of average detection delay as function of average run length to false-alarm. Results obtained with ensemble classifier with LRT decision rule[START_REF] Cogranne | Theoretical model of the FLD ensemble classifier based on hypothesis testing theory[END_REF],[START_REF] Cogranne | Modeling and extending the ensemble classifier for steganalysis of digital images using hypothesis testing theory[END_REF] using maxSRMd2 feature set[START_REF] Denemark | Selection-channel-aware rich model for steganalysis of digital images[END_REF] and embedding scheme[START_REF] Sedighi | Content-adaptive pentary steganography using the multivariate generalized gaussian cover model[END_REF],[START_REF] Sedighi | Content-Adaptive Steganography by Minimizing Statistical Detectability[END_REF].

ACKNOWLEDGEMENTS

The work of Rémi Cogranne was funded in part by the STEG-DETECT program for scholar mobility and by IDENT research grant both from Conseil Régional de Champagne-Ardenne.


H Abdo

J-M F Flaus

Masse. G-Scop

A fuzzy safety/cybersecurity risk analysis approach for more safe/secure industrial systems Une approche floue d'analyse des risques de sûreté/cybersécurité pour des systèmes industriels plus sûrs et sécurisés

L'introduction de la technologie numérique dans les industries crée de nouvelles menaces de cybersécurité qui affecte la sûreté des systèmes industriels. De plus, nombreux experts du risque soulignent que la sûreté et la sécurité ne doivent pas être analysées séparément. Dans des études antérieures, les auteurs ont proposé une méthode d'analyse des risques qui considère la sûreté et la sécurité ensemble au cours de l'analyse des risques industriels. Le cyber-noeud proposé utilise une méthodologie qualitative d'analyse de la probabilité pour définir le niveau de risque. Cependant, cette approche peut sous-estimer les risques en raison de l'incertitude des données. Pour cette raison, cette recherche vise à remplacer la méthodologie qualitative par une approche semi-quantitative floue pour traiter cette incertitude.

Introduction

The introduction of connected systems and digital technology in process industries creates new cybersecurity vulnerabilities that can be exploited by sophisticated threats and lead to undesirable safety accidents. For this reason, concerns about approaches for industrial risk analysis that consider and analyze safety and security together become a primary need (Masse et al, 2017). Quantifying and analyzing these major risks contributes to better decision making and ensures that risks are managed according to defined acceptance criteria [START_REF] Abdo | Uncertainty quantification in dynamic system risk assessment: a new approach with randomness and fuzzy theory[END_REF].

However, analyzing safety and security risks together is not simple. Safety and security risks are of different nature. In general, safety is associated with accidental risks caused by component failures, human errors or any non-deliberate source of hazard, and considered to be rare events with low frequency. While security is related to deliberate risks originating from malicious attacks and are classified as common events with high probability. In previous studies, the authors have proposed a new method called cyber bow-tie analysis to model the safety and cybersecurity related causes and consequences of an undesirable dangerous event ( [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] and (Abdo et al., 2017a)). In the same study, we also developed a qualitative likelihood analysis methodology based on the proposed cyber bow-tie for evaluating the risk level based on two-term likelihood parts, one for safety and one for security.

Likelihood analysis is a very important step in risk analysis. Qualitative or quantitative likelihood analysis can be performed depending on the type of data available. This data is derived from different sources: historical accident data or expert judgments in terms of numerical values (quantitative such as 10 -3 per year) or linguistic variables (qualitative such as low, high, etc.), respectively. Quantitative information for a quantitative analysis is expensive and not always provided. Qualitative analysis is subjective and may lead to loss of quantitative information if it exists. In addition, the accuracy of the analysis based on these two approaches still a major issue since uncertainty is not taken into consideration. However, qualitative and quantitative likelihood analysis approaches have drawbacks that can be eliminated by the use of a semi-quantitative one (please see [START_REF] Abdo | Fuzzy semiquantitative approach for probability evaluation using bowtie analysis[END_REF] for more details about the drawbacks). That is why this study proposes a fuzzy-semi quantitative approach to overcome the drawbacks presented in the qualitative and quantitative approach. This approach relies on the available information from historical data or experts if the former is not available. It should be noted that here we deal with the uncertainty related to the likelihood of risk scenarios regarding the available data.

In order to present the possibilities offered by this study, the paper is structured as follows: Section 2 presents the cyber bow-tie analysis developed in [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF]. In Section 3, we present the proposed methodology for likelihood analysis based on the cyber bow-tie. In Section 4, we present a case study where the proposed methodology is applied for a hazard scenario in a chemical facility. Finally, Section 5 draws a number of conclusions.

Cyber-BowTie analysis

In this section, we will present the Cyber bow-tie methodology proposed in [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] for a combined safety/security industrial risk analysis. This approach is located in the risk analysis part regarding the ISO 27001 and ISO 22301 standards.

The cyber bow-tie combines the bow-tie (BT) for safety analysis and the attack tree (AT) for security analysis in order to provide a complete modeling of a risk scenario. A risk scenario will be a combination of all expected security and safety events that can result in the undesirable event being studied. e Congrès de Maîtrise des Risques et Sûreté de Fonctionnement λµ21 Reims 16-18 octobre 2018 BT analysis presents a combination between fault tree analysis (FTA) and event tree analysis (ETA). FTA and ETA respectively describe the relationships between the undesirable event, its causes and its consequences for a systematic representation of hazard [START_REF] Ferdous | Handling and updating uncertain information in bow-tie analysis[END_REF].

The AT describes the sequence of steps to perform an attack. It represents an attack against a system in a tree structure ( [START_REF] Schneier | Modeling security threats[END_REF], [START_REF] Fovino | Through the description of attacks: A multidimensional view[END_REF]). The root (main event) of the tree is the goal of an attack. This root is connected to intermediate and starting (leaf nodes) events in order to represent the different ways to achieve the attack. In the cyber BT, a new version of attack tree as proposed. This new version of AT covers the limits presented in traditional ATs. Traditional ATs do not present all the information needed to evaluate the likelihood of a successful attack on the target system. However the AT presented by [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] allows the consideration of this information such as the target system vulnerabilities to suit the security risk analysis perspective. The AT's leaf nodes (security input events) are represented by a combination of attack events and vulnerabilities.

The relationships between trees' nodes in the ATBT are represented using the logical AND/OR gates. Figure 1 presents a schematic diagram of the cyber bowtie analysis, the definition of each event in the AT and BT are detailed in Table 1 and 2, respectively. In Figure 1, the event E1 can occur due to safety events (BE-1 or BE-2) or due to a cyber-attack as modelled by the AT.

Please refer to [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] for more information about constructing the ATBT.

Proposed approach: Fuzzy likelihood analysis for safety/security risk scenarios

In this section, we will outline the proposed fuzzy approach for likelihood analysis of combined safety/security industrial risk scenarios. The idea is to use the ATBT and provide a more precise likelihood analysis approach to evaluate risks by using the fuzzy semi-quantitative approach introduced in [START_REF] Abdo | Fuzzy semiquantitative approach for probability evaluation using bowtie analysis[END_REF]. The likelihood .Here this approach will be adjusted to suit the ATBT perspectives.

This likelihood analysis using the ATBT is made up of three main steps as presented in [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF]:

1. Determining the minimal cut sets to identify the system weaknesses 2. Characterizing likelihoods of input events Table 1. Description of events used for representing an attack scenario.

Figure 1. Structure of the cyber bow-tie diagram as proposed by [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] 3. Quantify the likelihood of each MC to prioritize the system's weaknesses However, no changes have been made to step 1 as presented by [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF]. The main contribution of this paper is presented in steps 2 and 3 as presented in Section 3.2 and 3.3, respectively.

Determining minimal cut sets

A minimal cut (MC) is the smallest combination of input events which causes the occurrence of the undesirable event being studied [START_REF] Yuanhui | Safety system engineering[END_REF].

In the ATBT, we can separate between three types of MCs:

• Purely related to security: all events of the MC are due to deliberate attacks; • Purely related to safety: the MC does not contain any security related event. The event causes of the MC are non-deliberate and due to components failures or human errors ; • Related to a mixture of both security and safety: accidental and deliberate causes exist in the MC. The importance of this differentiation between types of MCs is to discover the system's weaknesses where a pure security MC represents a weak point due to the high likelihood of occurrence of security causes.

Characterizing likelihood analysis of input events

Likelihood analysis can be qualitative, quantitative or semiquantitative. Qualitative and quantitative likelihood analysis have several disadvantages due to uncertainty of input data (please see (Abdo et al., 2015) for more information). To overcome the disadvantages of qualitative and quantitative likelihood analyses, a semi-quantitative approach can be used [START_REF] Ineris | Aggregation semi-quantitative des probabilités dans les études de dangers des installations classées -Omega Probabilités[END_REF]. In this study, a fuzzy semi-quantitative approach is developed to quantify the likelihood of safety/cybersecurity risk scenarios using the ATBT.

In safety, the likelihood of occurrence is the probability (expected frequency) or possibility of something happening. But when we talk about security, the likelihood of occurrence is the probability that a given threat is capable of exploiting a vulnerability (or set of vulnerabilities). In addition, there are different concepts to define likelihood related to safety and security. Due to the deviation in the likelihood translation, [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] have proposed two different scales Ls: security and Lf: safety of respectively five and six levels to separately represent the likelihood of safety and security related events. The first level of each scale represents an undefined value (likelihood equals zero) in order to specify if an event is purely related to safety or security. Thus, each event is characterized by couples (Ls, Lf).

Based on this likelihood representation in terms of couples, we can differ between three different types of events in the ATBT:

• Events that are purely related to safety with likelihood (N/A, Lf) for each event. Characterizing the likelihood of this type of events using the fuzzy semi-quantitative approach is detailed in Section 5.2;

• Events that are purely related to cyber-security with likelihood (Ls, N/A) for each event. The representation of this type of events is detailed in Section 5.3; • Events related to both safety and security with likelihood (Ls, Lf) for each event (see Section 5.3).

Preliminary

Before going in detailing the proposed approach, it is important to introduce the concept of fuzzy numbers used for characterizing input data. The concept of fuzzy numbers was introduced by the pioneer Zadeh in 1965 as a tool to characterize imprecise variables as well as to represent experts' knowledge in a mathematical tool [START_REF] Zadeh | Fuzzy sets[END_REF].

Fuzzy variable is associated with a possibility distribution or membership function in the same manner as random variable is associated with a probability distribution. A fuzzy number is the generalization of a regular, real number in the sense that it does not refer to one single value but rather to a connected set of possible values, where each possible value has its own weight between 0 and 1 [START_REF] Dubois | Applied fuzzy arithmetic: An introduction with engineering applications[END_REF].

Consider a fuzzy subset 𝐹𝐹 of the universal set X, thus the membership function is 𝜇𝜇 𝐹𝐹 : 𝑋𝑋 → [0, 1]. Where, for a given 𝑥𝑥 ∈ 𝑋𝑋 , the weight or membership degree 𝜇𝜇 𝐹𝐹,𝑋𝑋 (𝑥𝑥) represents the degree of compatibility of the value 𝑥𝑥 with the concept expressed by F. Different fuzzy number shapes are used to represent uncertain data, triangular and trapezoidal fuzzy numbers are the most popular, and can be expressed as [a, b, c] and [a, b, c, d], respectively, see [START_REF] Abdo | Uncertainty quantification in dynamic system risk assessment: a new approach with randomness and fuzzy theory[END_REF] for more details. In this study triangular, trapezoidal and a new shape of fuzzy number (proposed by the authors in [START_REF] Abdo | Fuzzy semiquantitative approach for probability evaluation using bowtie analysis[END_REF] to fit the semi-quantitative approach) are used. A detailed description on the expression and membership functions of the used fuzzy numbers is presented in the next sections

Characterizing likelihood for safety risk events

Likelihood characterization here aims to determine the likelihood of occurrences of safety input events according to a specific scale. The same scale proposed in [START_REF] Abdo | Fuzzy semiquantitative approach for probability evaluation using bowtie analysis[END_REF] linguistically elicited from experts since they prefer linguistic judgments rather than precise value. This interval scale is presented in Table 3. However, in [START_REF] Abdo | Fuzzy semiquantitative approach for probability evaluation using bowtie analysis[END_REF], the authors have replaced the interval scale by a fuzzy scale to overcome the disadvantages presented in the interval scale. This fuzzy scale is used to characterize the frequency of occurrence of safety basic events as presented in Figure 2. In term of example, an event E with a frequency of occurrence equals 10 -3 is of classes F2 and F3 with possibility degrees equal to 0.5 for the two classes.

After calculating the frequency of the BT, this frequency is translated to probability levels defined by the French ministerial order of 29/09/2005 as presented in Table 4. Please refer to [START_REF] Abdo | Fuzzy semiquantitative approach for probability evaluation using bowtie analysis[END_REF] for more information about the definition of each probability level where E is the lowest and A is the highest. The same article details performing likelihood analysis using BT based on the fuzzy semi-quantitative approach.

In the next section, the same fuzzy approach will be used to characterize the likelihood of security input events. Since safety and security events are of different nature, new fuzzy scales based on triangular and trapezoidal fuzzy numbers will be proposed to represent the likelihood of security related events.

Characterizing likelihood for security risk events

As presented in [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF], in the context of a security risk analysis, the likelihood of occurrence depends on the capability that a given threat (or set of threats) exploiting a potential vulnerability (or set of vulnerabilities). In other words, the likelihood is a function of the difficulty of performing a needed attack to exploit a vulnerability, and the level of exploitability of a given vulnerability depending on the existing counter measures. In this section, two different fuzzy scales are constructed to determine the likelihood of a security initial event presented as follow:

• Vulnerability level: given to a vulnerability in the ATBT to represent how easy or hard exploiting this vulnerability depending on the existing countermeasures. Table 5 and Figure 3 show the three different fuzzy levels proposed to evaluate this criterion with the associated fuzzy numbers.

The qualitative terms proposed in [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] are expressed in terms of fuzzy numbers as presented in the table and figure. Levels range from easy (E) to hard (H) depending on how difficult the vulnerability is to exploit. In case of uncertainty about the level, for example, an expert can suggest that a vulnerability is almost easy to exploit and give it a level 1 (E) with a possibility degree equals 0.6 and a level 2 (M) with a possibility degree equals 0.4. Thus, the vulnerability will be belong to two levels with two different membership degrees;

• Technical difficulty of conducting an attack: given to an attack event to show the needed level of expertise to conduct the attack. Table 6 and Figure 4 present the fuzzy levels of difficulty of an attack. Four levels T, M, D, VD are used and represented in terms of triangular and trapezoidal fuzzy numbers to describe the difficulty of executing an attack. The level (T) is the easiest while the level (VD) is the hardest. As discussed earlier, different levels with different membership degrees can be given to characterize an attack difficulty if uncertainty about the difficulty level is presented. These two criteria are then combined in order to provide a likelihood characterization for the security initial (or basic) events. The difficulty of the attack is combined with the vulnerability levels as presented in Table 7. Four different security likelihood levels in addition to the N/A level are proposed to represent the combination. Please refer to [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] for the definition of each security likelihood level in Table 5. Calculating this likelihood level in the case of uncertainty based on Table 7 Table 6. Fuzzy scale to characterize the difficulty of conducting an attack Table 5. Fuzzy scale to characterize the vulnerability level

Calculating the likelihoods of MCs

This step aims to prioritize the system weaknesses by calculating the likelihood of each MC. Calculating the likelihood of an MC only needs the AND gate to be solved. AND gate signifies that the output event occurs if all its input events have occurred. Based on the fuzzy semiquantitative scales proposed for safety and security likelihood characterization, the min rule is used to solve the AND gate and calculate the likelihood levels of the top event with their associated membership degrees. Suppose an AND gate with n input events EVi, i=1, ..., n, the output likelihood is calculated as presented in Eq. 1. The membership degree of the output event is calculated based on Eq. 2. Finally, for each MC, the two determined likelihoods for safety and security are taken together to provide an overall likelihood to be used for prioritizing MCs as presented in Table 8 [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF]. This overall scale defines five different expressions from low (L) to very high (VH). This overall-likelihood can not replace the double part likelihoods (Lsecurity, Lsafety) which is important for decision-making and in choosing the right countermeasure.

Figure 5 presents an example on how to calculate the fuzzy likelihood of an MC. The MC in Figure 5 presents four basic events, two are related to safety (BE-1 and BE2) and the other two are security related (SBE-1 and SBE-2). Based on the proposed fuzzy approach, experts are asked to characterize the likelihood of safety basic events, and (i) difficulty of attacks and (ii) exploitability of vulnerabilities for security basic events. From (i) and (ii), the fuzzy likelihood levels security basic events are determined. For example, SBE-1 is of levels 4 and 3 with membership degrees equal to 0.6 and 0.4, respectively. This is because the vulnerability level is almost easy (E:0.6 and M:0.4) and the needed attacker skills are uncertain and elicited to be T:0.6 and M:0.4). The output likelihood of SBE-1 is calculated using the Cartesian product as shown in Figure 6. The output level and membership degree of each case in the Cartesian table is respectively determined based on Table 7 and Eq 2 as presented in Figure 6. Level 4 appears several times in the Cartesian table of Figure 6. In this case, the highest membership degree is taken (0.6). The dashed rectangle beside each event in the figure presents its likelihood. These likelihood are then propagated through the MC. The likelihood of events E-1 and E-2 and their membership degrees are calculated using the Cartesian product as in Figure 8 and based on Eqs 1 and 2, respectively. L(E-1) = min(L(BE-1), L(BE-2)) = (min(Lsecurity(BE-1), Lsecurity(BE-2)], min[Lsafety(BE-1), Lsafety(BE-2)]) = (N/A | F1:0.3, F2:0.7), where L(E-2) = min (L(SBE-1), L(SBE-2)) = (4:0.6, 3:0.4 | N/A). The likelihood of the top event is equal to min (L(E-1), L(E-2)) = (3:0.6, 2:0.4 | F1: 0.3, F2: 0.7) =(3:0.6, 2:0.4 | A: 0.3, B: 0.7) which is of level Moderate (M:0.4) and High (H:0.6) based on Table 8. From this example we can conclude that there is a high possibility that the risk is high. This approach will be illustrated in the next section and applied to an overheating scenario in a chemical reactor.

Case study

The same case study presented by [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] is presented in this section for comparison purposes. The case study concerns an industrial site of a propylene oxide polymerization reactor (Flaus, 2013). The reactor runs a high exothermic chemical reaction at high pressure. Risks Table 7. Combining attack difficulty levels with the vulnerability levels to determine the likelihood of security input events [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] Table 8. Analysis scale -overall likelihood [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] Figure 6. Determining the likelihood of security basic event based on the fuzzy scale In a systematic representation of the reactor, a production system, a cooling system and a power supply are interacting in order to perform the operation under normal conditions (regulated temperature and pressure). Components of these systems (valves, pumps, etc.) are controlled by PLCs and supervised by a SCADA system. The information collected by the SCADA system is accessible by all the site managers from their offices using wireless remote control. The manager of the utility can control the facility using its tablet or smart phone via the Internet. Controlling the process via Internet would allow the manager to handle the situation from where he/she is before it is too late, rather than waking up at midnight racing to the plant to handle the situation. Figure 10 shows the architecture of the system under study. The architecture of the system is taken from (Flaus 2013).

In this case study, the most likely undesirable scenario with the highest consequences due to overheating/overpressure is considered for risk analysis. This scenario can be generated after the occurrence of deliberate attacks or accidental errors. Overheating occurs if the temperature and pressure exceed the threshold. The two first steps for risk analysis (risk identification and likelihood evaluation) using the proposed methodology are applied on the overheating scenario as presented in the rest of this section.

Step-1: constructing the ATBT for safety/security analysis. This step contains two sub-steps: Figure 7 presents the BT for the undesirable event under study, which is the overheating inside the reactor. Nine safety related basic events are investigated as causes of the overheating in the reactor. However, two events in the BT of Figure 7 can occur due to security breaches. The first event is the failure of the automated safety valve due to an attack on the hardware. The second is by sabotaging the cooling system after gaining unauthorized access to the SCADA system. SCADA system can be exploited by attacking the computer software or the communication network as shown in Figure 8. Please refer to [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] for more information about how we constructed the ATBT for this case study and details on each event.

Step-2: Likelihood evaluation:

The three steps explained in Section 4 for fuzzy likelihood analysis are conducted. The cyber bow-tie yields to 21 MCs as presented in Table 9. These MCs are divided into 7 that are purely related to security, 7 that are purely related to safety and 7 that are related to mixture safety/security. It should be noted that the same MCs obtained by [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] are obtained here. For likelihood characterization, experts in the field are asked to characterize likelihoods of safety and security basic events. Uncertainty in the experts' elicitations are represented using the fuzzy scale as discussed in Section 4. The characterized likelihoods in terms of fuzzy couple (Lsecurity, Lsafety) are drawn beside the basic events in the ATBT (see figures 7 and 8). Then, the likelihood of each MC was calculated as shown in Table 9 (likelihood and level columns). However, if we compare the output likelihoods of MCs between the fuzzy approach and the qualitative approach of [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF], we notice that the qualitative approach may underestimate the risk. For example, MC number 2 in Table 6 is of level M (Moderate) based on the qualitative approach [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF]. While, we can see that there is a high possibility to be of level H (high) based on the fuzzy semi-quantitative approach. This is because important non-qualitative information if existed can be ignored by using the qualitative approach. An almost easy elicitation from an expert is considered to be of level 1 using the qualitative approach, while it is of levels 1 and 2 with different membership degrees using the fuzzy approach.

Discussion and improvement

As shown in Table 9, the MCs ranked high (H) and (VH) are purely due to cybersecurity. The same improvement proposed by [START_REF] Abdo | A safety/security risk analysis approach of Industrial Control Systems: A cyber bowtie-combining new version of attack tree with bowtie analysis[END_REF] for the same case study is added here. The idea behind this improvement is to show the importance of analyzing safety and security together even under uncertainty. The improvement represents a burst disk that represents a mechanical component (no security breaches are related), see figure 7. The redetermination of MCs (see Table 10) shows that there is no MC that is related to pure security. The introduced improvement diminishes the likelihoods into the lowest level even with the presence of input data uncertainty. Finally, in spite of all the uncertainties presented in the input data, we succeed to maintain the risk at the lowest level thanks to a combined safety/security risk analysis, and the only remaining risk is linked to the failure of the added improvement.

Conclusion

Analyzing safety and security together is an urgent need for complete and effective risk analysis. In previous studies, the authors propose an approach called cyber BT that integrates ATs with BT analysis for a combined safety and security industrial risk analysis. However the qualitative likelihood analysis methodology developed for the cyber BT presents concerns due to data uncertainty. This is why this paper proposes a new likelihood analysis methodology that uses fuzzy theory to represent uncertainty.

The proposed methodology is applied to an undesirable safety/security risk scenario in a chemical facility. The most likely undesirable scenario with the highest consequences due to overheating/overpressure is considered for risk analysis. This scenario can be generated after the occurrence of deliberate attacks or accidental errors. The outputs of the approach show important results in terms of representation of risk scenarios as well as in likelihood quantification. The results show that the proposed fuzzy methodology provides more accuracy in the quantification, in addition to the consideration of uncertainty.

In the future, this work will be extended by using multiple sources of data in likelihood analysis. Different data bases or experts may provide different likelihood regarding the same event. Thus, rating and aggregating the data from different sources will lead to a more robust probability quantification approach using the cyber bow-tie analysis.

  which is based on the INERIS approach (INERIS 2015) is used in this study and as detailed in the rest of this section. The semi-quantitative method developed by the INERIS (INERIS 2015) characterizes the probabilities of safety basic events in terms of frequency classes. Each class is considered to cover a broad range (interval) of occurrence frequencies. Giving a frequency class to an input event is based on the process of asking experts, or by translating the quantitative data into a class. A class is

Figure 2 .

 2 Figure 2. Mapping event frequencies on fuzzy scale

Figure 3 .

 3 Figure 3. Membership functions of the proposed fuzzy scale to represent the vulnerability level

  𝐿𝐿(𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴) = 𝑚𝑚𝑚𝑚𝑚𝑚[𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚)] = (𝑚𝑚𝑚𝑚𝑚𝑚[𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿𝑚𝑚𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚)], 𝑚𝑚𝑚𝑚𝑚𝑚[𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚)]) = (𝑚𝑚𝑚𝑚𝑚𝑚[𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿𝑚𝑚𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸1), . . . , 𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿𝑚𝑚𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚)], 𝑚𝑚𝑚𝑚𝑚𝑚[𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸1), . . . , 𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚)]) {1} 𝐴𝐴𝐿𝐿𝐷𝐷𝐿𝐿𝐿𝐿𝐿𝐿(𝐿𝐿(𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴𝐴)) = 𝑚𝑚𝑚𝑚𝑚𝑚[𝐴𝐴𝐿𝐿𝐷𝐷𝐿𝐿𝐿𝐿𝐿𝐿(𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚))] = (𝑚𝑚𝑚𝑚𝑚𝑚[𝐴𝐴𝐿𝐿𝐷𝐷𝐿𝐿𝐿𝐿𝐿𝐿(𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿𝑚𝑚𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚))], 𝑚𝑚𝑚𝑚𝑚𝑚[𝐴𝐴𝐿𝐿𝐷𝐷𝐿𝐿𝐿𝐿𝐿𝐿(𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚))]) = (𝑚𝑚𝑚𝑚𝑚𝑚[𝐴𝐴𝐿𝐿𝐷𝐷𝐿𝐿𝐿𝐿𝐿𝐿(𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿𝑚𝑚𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸1), . . . , 𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿𝑚𝑚𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚))], 𝑚𝑚𝑚𝑚𝑚𝑚[𝐴𝐴𝐿𝐿𝐷𝐷𝐿𝐿𝐿𝐿𝐿𝐿(𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸1), . . . , 𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐿𝐴𝐴𝐿𝐿(𝐸𝐸𝐸𝐸𝑚𝑚))] {2}

Figure 5 .

 5 Figure 5. Example of how calculating the likelihood of an MC

Figure 7 .

 7 Figure 7. Combined ATBT of the scenario under study

Table 2 .

 2 Abbreviations, significations and definitions of elements listed in the bowtie diagram. e Congrès de Maîtrise des Risques et Sûreté de Fonctionnement λµ21 Reims 16-18 octobre 2018

Table 9 .

 9 The identified MCs for the scenario under study

Table 10 .

 10 The re-identified MCs after the added improvement

	Communication 7A /3

Communication 7A /3 page 1/9

Communication 7A /3 page 2/9

Communication 7A /3 page 3/9

Acknowledgments

This work is based on research supported and funded by the French National Institute for Industrial Environment and Risks (INERIS).