Alexandre Janot
email: alexandre.janot@onera.fr

Pierre-Olivier Olivier Vandanjon
email: pierre-olivier.vandanjon@ifsttar.fr

Maxime Gautier
email: maxime.gautier@irccyn.ec-nantes.fr

A Revised Durbin-Wu-Hausman Test for Industrial Robot Identification

Keywords: Robots identification, Rigid robot dynamics, Instrumental variable method, Heteroskedasticity, DWH-test, Wald-statistic

This paper addresses the topic of robot identification. The usual identification method makes use of the inverse dynamic model (IDM) and the least squares (LS) technique while robot is tracking exciting trajectories. Assuming an appropriate bandpass filtering, good results can be obtained. However, the users are in doubt whether the columns of the observation matrix (the regressors) are uncorrelated (exogenous) or correlated (endogenous) with the error terms. The exogeneity condition is rarely verified in a formal way whereas it is a fundamental condition to obtain unbiased LS estimates. In Econometrics, the Durbin-Wu-Hausman test (DWH-test) is a formal statistic for investigating whether the regressors are exogenous or endogenous. However, the DWHtest cannot be straightforwardly used for robot identification because it is assumed that the set of instruments is valid. In this paper, a Revised DWH-test suitable for robot identification is proposed. The Revised DWH-test validates/invalidates the instruments chosen by the user and validates the exogeneity assumption through the calculation of the QR factorization of the augmented observation matrix combined with a F-test if required. The experimental results obtained with a 6 degree-offreedom (DOF) industrial robot validate the proposed statistic.

Introduction

The usual robot identification method makes use of the continuous-time inverse dynamic model and the least squares (LS) technique while the robot is tracking some exciting trajectories. This explains why robot identification belongs to the closed-loop identification of continuous-time models from sampled data. This method, called as Inverse Dynamic Identification Model with Least Squares method (IDIM-LS), has been successfully applied to identify the inertial parameters of several prototypes and industrial robots, [START_REF] Olsen | Maximum Likelihood Identification of a Dynamic Robot Model: Implementation Issues[END_REF], [START_REF] Swevers | Dynamic model identification for industrial robots -Integrated experiment design and parameter estimation[END_REF], [START_REF] Hollerbach | Model Identification[END_REF], [START_REF] Calanca | MIMO Closed Loop Identification of an Industrial Robot[END_REF], [START_REF] Gautier | A New Closed-Loop Output Error Method for Parameter Identification of Robot Dynamics[END_REF] and (Janot et al. 2014, a) among others. Good results are obtained provided that an appropriate bandpass filtering of the joint positions is used to calculate the joint velocities and accelerations. However, because robots are identified in closed loop, the users can doubt whether the columns of the observation matrix (the regressors) are correlated with the error terms (endogenous) or not (exogenous) even with a data filtering, see e.g. [START_REF] Söderström | System Identification[END_REF], [START_REF] Garnier | Identification of Continuous-time Models from Sampled Data[END_REF], [START_REF] Young | Recursive Estimation and Time-Series Analysis: An Introduction for the Student and Practitioner[END_REF] and [START_REF] Gilson | Optimal instrumental variable method for closed-loop identification[END_REF].

Other identification methods were tried: the Total Least-Squares [START_REF] Xi | Effect of Non-Geometric Errors on Manipulator Inertial Calibration[END_REF], the Set Membership Uncertainty [START_REF] Ramdani | Robust Dynamic Experimental Identification of Robots with Set Membership Uncertainty[END_REF], an algorithm based on Linear Matrix Inequality (LMI) tools [START_REF] Indri | Optimized Dynamic Calibration of a SCARA Robot[END_REF], a maximum likelihood (ML) approach [START_REF] Olsen | Maximum Likelihood Identification of a Dynamic Robot Model: Implementation Issues[END_REF], the Closed-Loop Output-Error method [START_REF] Landau | An output error recursive algorithm for unbiased identification in closed loop[END_REF], [START_REF] Landau | Identification in closed loop: a powerful design tool (better design models, simpler controllers)[END_REF], (Östring et al 2003) and [START_REF] Gautier | A New Closed-Loop Output Error Method for Parameter Identification of Robot Dynamics[END_REF], an algorithm based on neural network [START_REF] Soewandito | Neuro-adaptive motion control with velocity observer in operational space formulation[END_REF], a Bayesian approach [START_REF] Ting | A Bayesian Approach to Nonlinear Parameter Identification for Rigid Body Dynamics[END_REF], the extended Kalman filter [START_REF] Gautier | Extended Kalman Filtering and Weighted Least-squares Dynamic Identification of Robot[END_REF] and [START_REF] Kostic | Modeling and Identification for High-Performance Robot Control: An RRR-Robotic Arm Case Study[END_REF]), a method which estimates the nonlinear effects in the frequency domain [START_REF] Wernholt | Estimation of Nonlinear Effects in Frequency Domain Identification of Industrial Robots[END_REF] and the Unscented Kalman Filter [START_REF] Dellon | Modeling and System Identification of a Life-Size Brake-Actuated Manipulator[END_REF]. Although all these techniques are of interest, they do not really improve the IDIM-LS method combined with an appropriate data filtering. Furthermore, the robustness against data filtering was not studied, some of these approaches were not validated on a 6 degrees-of-freedom (DOF) industrial robot and the condition that the regressors are not correlated with the error terms is not addressed whereas it is a critical condition to obtain unbiased estimates [START_REF] Hausman | Specification Tests in Econometrics[END_REF], [START_REF] Davidson | Estimation and Inference in Econometrics[END_REF] and [START_REF] Wooldridge | Introductory Econometrics: A Modern Approach[END_REF]. This condition is called as the exogeneity condition.

The Instrumental Variable method (IV) provides unbiased estimates while the regressors are endogenous [START_REF] Söderström | System Identification[END_REF], [START_REF] Garnier | Identification of Continuous-time Models from Sampled Data[END_REF] and [START_REF] Young | Recursive Estimation and Time-Series Analysis: An Introduction for the Student and Practitioner[END_REF]. A generic IV method for industrial robots identification is proposed in (Janot et al. 2014, a) and (Janot et al. 2014, b). This approach called as the IDIM-IV method was successfully validated on a 2 DOF prototype robot and on a 6 DOF industrial robot. However, the validity of the instruments was not addressed and using the IV method while the regressors are exogenous provides inefficient unbiased estimates i.e. their variances are not minimal [START_REF] Hausman | Specification Tests in Econometrics[END_REF], [START_REF] Davidson | Estimation and Inference in Econometrics[END_REF] and [START_REF] Wooldridge | Introductory Econometrics: A Modern Approach[END_REF].

In Econometrics, the Durbin-Wu-Hausman test (DWH-test) is a formal statistic for investigating whether the regressors are exogenous or endogenous [START_REF] Hausman | Specification Tests in Econometrics[END_REF]. The DWH-test makes use of the Two Stages Least Squares (2SLS) technique and an augmented LS regression. However, the DWHtest cannot be straightforwardly used for robot identification because it is implicitly assumed that the instrumental matrix is well correlated with the observation matrix and uncorrelated with the errors. Furthermore, the econometric models are empirical whereas the models used in mechanical engineering are based on physical laws (e.g. the Newton's laws).

In this paper, it is proposed to bridge the gap between Econometrics theory and Control engineering practice by presenting a Revised DWH-test suitable for identification of robots. This revisited statistic validates/invalidates the model chosen by the user and the exogeneity condition is validated by the QR factorization of the augmented observation matrix combined with the F-test.

A condensed version of this work has been presented in [START_REF] Vandanjon | A Durbin-Wu-Hausman Test for Industrial Robots Identification[END_REF]. This paper contains detailed proofs to enlighten the theoretical understanding of the Revised DWH-test, heteroskedasticity is taken into account and additional experimental results are provided.

The rest of the paper is organized as follows. Section 2 recalls the IDIM-LS method and reviews the theory of Econometrics. Section 3 introduces the Revised DWH-test while Section 4 is devoted to experimental results. Finally, Section 5 concludes the paper.

Theoretical Background: Modelling, identification of robots and

Introduction of the DWH-test

Modelling and identification of robots

The inverse dynamic model (IDM) of robot with n moving links calculates the ( )

1 n × joint torques
vector idm τ as a function of generalized coordinates and their derivatives [START_REF] Khalil | Modeling, identification and control of robots[END_REF], ( ) ( )

, idm = + τ M q q N q q ɺɺ ɺ , (1)
where q , q ɺ and q ɺɺ are respectively the ( )

1
n × vectors of generalized joint positions, velocities and accelerations; ( ) M q is the ( )

n n × inertia matrix; ( )
, N q q ɺ is the ( )

1 n × vector of centrifugal, Coriolis,
gravitational and friction torques.

The modified Denavit and Hartenberg (MDH) notation allows to obtain an IDM which is linear in relation to a set of base parameters β ( )

, , idm = τ IDM q q q β ɺ ɺɺ , (2) where ( )
, , IDM q q q ɺ ɺɺ is the ( )

n b ×
matrix of basis functions of bodies dynamics and β is the ( )

1 b ×
vector of base parameters.

The base parameters are the minimum number of dynamic parameters from which the IDM can be calculated. They are obtained from the standard dynamic parameters by regrouping some of them with linear relations [START_REF] Mayeda | Base parameters of manipulator dynamic models[END_REF]). The standard parameters of a link j are The direct dynamic model (DDM) of robots is given by ( ) ( ) , idm = -M q q τ N q q ɺɺ ɺ .

(3)

Proportional-Derivative (PD) and Proportional-Integral-Derivative (PID) controls are often implemented to identify the dynamic parameters. The joint j signal control j v τ is given by ( ) ( )

j j j j r mes v C s q q τ = - , (4)
where ( ) j C s is the transfer function of the joint j controller, j r q is the joint j position reference, j mes q is the measurement of j q the joint j position, s is the time derivative operator i.e.

/ s d dt =

.

The data available from robots controllers are mes q the ( )

1
n × vector of measurements of q and τ v , the ( )

τ τ = τ G v , (5)
where τ G is the ( )

n n ×
diagonal matrix of drive gains. The diagonal components of τ G have a priori values given by manufacturers.

In (2), q is estimated with q obtained by filtering mes q through a lowpass Butterworth filter in both the forward and reverse directions. ( )

ˆ, q q
ɺ ɺɺ are calculated with a central differentiation algorithm of q . τ being perturbed by high-frequency disturbances, a parallel decimation procedure is used to eliminate torque ripples (see [START_REF] Gautier | A New Closed-Loop Output Error Method for Parameter Identification of Robot Dynamics[END_REF] for the details).

Because of uncertainties, the ( )

1
n × vector of the actual joint torques τ differs from idm τ by an error e . The model ( 2) is sampled while the robot is tracking trajectories (see [START_REF] Gautier | A New Closed-Loop Output Error Method for Parameter Identification of Robot Dynamics[END_REF] for the details). After data acquisition and data filtering, the following overdetermined linear system is obtained

( ) ( ) ˆ, , = + y τ X q q q β ε ɺ ɺɺ , (6)
where ( ) y τ is the ( ) 1 r × measurements vector built from the actual torques τ ; ( ) ˆ, , X q q q ɺ ɺɺ is the ( )

r b ×
observation matrix built from the sampling of ( ) ˆ, , IDM q q q ɺ ɺɺ ; ε is the ( ) 1 r × sampled vector of e ; e r n n = ⋅ is the number of rows in ( 6), e n being the number of rows in a subsystem j .

Relation (6) is the Inverse Dynamic Identification Model (IDIM). The columns of ( ) ˆ, , X q q q ɺ ɺɺ are the regressors. ε is assumed to have zero mean, to be serially uncorrelated with a covariance matrix Ω partitioned so that is estimated through the Ordinary Least Squares (OLS) solution of a subsystem j (see [START_REF] Gautier | A New Closed-Loop Output Error Method for Parameter Identification of Robot Dynamics[END_REF] for the details). The IDIM-LS estimates and their covariance matrix are given by ( )

1 1 1 ˆT T LS - - - = β X Ω X X Ω y , (
)

1 1 ˆT LS - - = Σ X Ω X . ( 7
)
The IDIM-LS estimates are unbiased if ( )

T E = X ε 0 , (8)
where ( )

.

E is the expectation operator [START_REF] Davidson | Estimation and Inference in Econometrics[END_REF].

Because robots are identified in closed loop, the users can doubt whether ( ) ˆ, , X q q q ɺ ɺɺ is correlated with ε or not. To overcome the problem of a correlation between X and ε , the Two-Stage-Least-Squares (2SLS) technique is an appropriate method.

Review of theory of Econometrics

The 2SLS method estimates β with two LS regressions. Researchers in Econometrics consider the model ( 6) as the reduced form of the general model defined by

= +   = +  y Xβ ε X ZΠ V , ( 9
)
where Z is the ( )

r z × instrumental matrix with z b ≥ ; Π is the ( ) z b ×
matrix of coefficients to be identified and V is a ( )

r b
× matrix of error terms.

The columns of Z are called instruments. If the following assumptions hold ( )

rank b = Z , ( ) T E = Z ε 0 , ( ) T E = Z V 0 and ( ) E = V 0 , Z is said valid.
The first stage calculates Π , the LS estimate of Π , given by ( )

1 ˆT T - = Π
Z Z Z X . X , the projected of X onto the space spanned by the columns of Z , is given by ( )

1 ˆˆT T Z - = = = X ZΠ Z Z Z Z X P X , (10)
where ( )

1 T T Z - = P Z Z Z Z is the idempotent ( ) r r × projection matrix of Z .
The second stage calculates the 2SLS estimates. Assuming that

ˆT T Z = X P X X X is nonsingular i.e.
( )

rank b = X
, the 2SLS estimates and their associated covariance matrix are given by [START_REF] Wooldridge | Introductory Econometrics: A Modern Approach[END_REF] ( )

1 1 1 2 ˆˆˆT T SLS - - - = β X Ω X X Ω y , (
)

1 1 2 ˆˆT SLS - - = Σ X Ω X . ( 11
)
If z b = the 2SLS estimates collapse to the IV estimates given by ( )

1 ˆT T IV - = β Z X Z y .
If the 2SLS method is used while relation (8) holds, the estimates are unbiased but their variances are not minimal [START_REF] Hausman | Specification Tests in Econometrics[END_REF], [START_REF] Davidson | Estimation and Inference in Econometrics[END_REF] and [START_REF] Wooldridge | Introductory Econometrics: A Modern Approach[END_REF]. The Durbin-Wu-Hausman test (DWH-test) is a formal test which examines whether (8) holds or not. This paper focuses on the augmented DWH-test [START_REF] Hausman | Specification Tests in Econometrics[END_REF]. Assuming that Z is valid, the model ( 9) can be written as

= + +
y Xβ Vβ ε . Then, by referring to the coefficient corresponding to V as γ and rewriting (9) after adding and subtracting Vβ , one obtains

( ) ( ) = + + -+ = + + y X V β V γ β ε Xβ Vθ ε , with = - θ γ β being the ( ) 1 b × vector
of omitted parameters that explain the correlation between X and ε . The following relation called as "exogeneity condition" is obtained

( ) T E = ⇔ = X ε 0 θ 0 . ( 12
)
Because V is not known, its estimate is calculated with ˆ= -V X ZΠ and the following augmented regression is built

ˆ    = +       β y X V ε θ
. The LS estimates β and θ are then calculated and with an appropriate statistical test (e.g. F-test), it is checked that the null hypothesis 0 :

H = θ 0 holds. If the test accepts 0
H , the LS estimates are unbiased, otherwise they are biased [START_REF] Hausman | Specification Tests in Econometrics[END_REF]) and [START_REF] Wooldridge | Introductory Econometrics: A Modern Approach[END_REF].

Although the DWH-test is of great interest, it cannot be used as it is. First, the unbiasedness of the 2SLS estimates and the DWH-test are based on the fact that the Z is valid. In practice, how to validate/invalidate this assumption? Second, the DWH-test can detect a bias of the LS estimator but it cannot provide the origin of this bias. Third, the models used in Econometrics are empirical whereas the models used in Mechanical/Electrical Engineering are mostly based on physical laws. Fourth, the notion of closed-loop identification is not addressed in Econometrics. In the following section, a Revised DWH-test that validates/invalidates the construction of Z and determinates the origin of the bias of LS estimates is presented.

A Statistic to Validate/Invalidate the IDIM-LS Estimates

Preliminary definitions

Because of noisy measurements, the following definitions are introduced

j j j mes nf mes q q q δ = + , j j j nf j q τ τ δτ δτ = + + , ˆĵ j nf j q q q δ = +
, ˆĵ j nf j q q q δ = + ɺ ɺ ɺ and ˆĵ j nf j q q q δ = + ɺɺ ɺɺ ɺɺ .

, , j j j nf nf nf q q q ɺ ɺɺ are the joint j noisefree position, velocity and acceleration respectively,

j nf
τ is the joint j noise-free torque given by ( ) ( )

j j j j nf r nf g C s q q τ τ = - , j mes q δ
is the measurement error, ˆj q δ , ˆj q δ ɺ and ˆj q δ ɺɺ are the errors in ˆj q , ˆj q ɺ and ˆj q ɺɺ respectively. At last ( )

j j j q mes g C s q τ δτ δ =
is the error in j τ due to the feedback and j δτ is the error in j τ due to the measurement noise.

Let

1 T n τ δτ δτ   =   e ⋯
be the ( )

1 n × vector of measurements noises in τ , 1 mes n T q q q δτ δτ   =   e ⋯
be the ( )

1 n × vector of measurements noises in τ due to 1 n T mes mes mes q q δ δ δ   =   q ⋯
the ( )

1 n ×
vector of measurements noises in mes q . Let δ q , δ q ɺ and δ q ɺɺ be the ( )

1
n × vector of noises in q , q ɺ and q ɺɺ respectively with [ ]

1 ˆˆˆT n q q δ δ δ = q ⋯ , 1 ˆˆˆT n q q δ δ δ   =   q ɺ ɺ ɺ ⋯ and 1 ˆˆˆT n q q δ δ δ   =   q ɺɺ ɺɺ ɺɺ ⋯ . Let , , nf nf nf
q q q ɺ ɺɺ be the ( )

1 n ×
vector of noise-free positions, velocities and accelerations respectively. Since q is obtained through the filtering of mes q and since ( ) ˆ, q q ɺ ɺɺ are calculated from the differentiation of q , the errors mes δq and δ q , δ q ɺ , δ q ɺɺ are correlated.

Exogeneity condition for robot identification

For robot identification, the true model is assumed to be

nf q nf τ  = + +   = +   y X β ε ε X X V , ( 13
)
where nf X is the ( )

r b ×
noise-free observation matrix built from the sampling of ( )

, , nf nf nf IDM q q q ɺ ɺɺ , τ ε is the ( ) 1 × r sampled vector of τ e ; q ε is the ( ) 1 × r sampled vector of mes q e ; V is the ( ) r b × matrix
of error terms that depends on the sampling of δ q , δ q ɺ , δ q ɺɺ .

With ( ) ( )

q E E τ = = ε ε 0 , ( ) E =
V 0 and τ ε being uncorrelated with q ε , one obtains ( )

T E τ V ε = ( ) ( ) T E E τ = V ε 0 and ( ) T q E τ ε ε = ( ) ( ) 0 T q E E τ = ε ε
. Because mes δ q and δ q , δ q ɺ , δ q ɺɺ are correlated, q ε and V are also correlated. As usually done in Statistics, we introduce q ′ = ε Vγ where ′ γ is the ( )

1 b ×
vector of parameters that explain the correlation between V and q ε . With nf = - X X V and by

introducing ′ = - θ γ β the ( ) 1 b × vector of omitted variables, it yields τ = + ε ε Vθ . After calculations, one obtains ( ) ( ) T T E E = X ε V V θ . ( ) T E = X ε 0 implies two exogeneity conditions = θ 0 , (14) or
= V 0 . ( 15
)
′ γ being the vector of parameters that have no real physical meaning, ′ γ and β are not of the same nature in the case of robot identification and relation ( 14) is quite implausible. Furthermore, by calculating q through the filtering of mes q and by calculating ( ) ˆ, q q ɺ ɺɺ from the differentiation of q , the relations δ ≈ q 0 , δ ≈ q 0 ɺ , δ ≈ q 0 ɺɺ are expected. V being built from the sampling of δ q , δ q ɺ , δ q ɺɺ , relation ( 15) is the expected relation.

Another way of looking at (15) is the design of the right inputs (also called 'optimal trajectories' in robotics) that allow to obtain the best estimates. This is the experiment design (Aguero and Goodwin 2006) and (Aguero and Goodwin 2007). The works presented in these references cannot be straightforwardly applied for robot identification because robots are nonlinear Multi-Input-Multi-Output (MIMO) systems whereas the works presented in these references are focussed on linear Single-Input-Single-Output (SISO) systems. At last, the basis functions contain nonlinear functions. Those reasons explain why the authors suggest to run the proposed approach.

According to [START_REF] Gautier | Numerical calculation of the base inertial parameters[END_REF], ( 15) is equivalent to state that θ has no influence on robot dynamics.

To assess the influence of θ , ( 6) is first rewritten as

[ ] XTD XTD τ τ   = + = +     β y X V ε X β ε θ where [ ] XTD = X X V is the ( ) 2 r b × augmented observation matrix and T T T XTD   =   β β θ
is the ( )

2 1 b ×
augmented vector of parameters. Second, the QR decomposition of XTD X is considered. This gives

( ) 2 2 XTD XTD XTD r b b - × =         X X R X Q 0 , ( 16
)
where

XTD X Q is a ( ) r r × orthogonal matrix i.e. XTD XTD T r = X X Q Q I ,
and

XTD X R is a ( ) 2 2 b b × upper triangular matrix.
Third, let k r X (resp. k r V ) be the absolute value of the b first (resp. last) diagonal elements of

XTD X R i.e.
( )

, XTD k r R k k = X X for 1, , k b = … (resp.
( )

, XTD k r R k k = V X for 1, , 2 k b b = + …
). According to [START_REF] Gautier | Numerical calculation of the base inertial parameters[END_REF],

θ has no influence if all k r V 's are null 0 k r = V for 1, , k b = … . ( 17
)
In this case, (15) holds because XTD X is rank deficient and collapses to X .

Fourth, if all or some k r V 's are not null, then θ may significantly contribute to robot dynamics. To assess this contribution and to make a final decision, a F-test associated with the following hypothesis 0 : H = θ 0 is run. If the F-test accepts 0 H , then the LS estimates are unbiased; otherwise they are biased.

In this section, the exogeneity condition for robot identification has been given. However, it is assumed that a valid instrumental matrix Z exists. In the following section, it is explained how to construct Z and how to validate/invalidate this construction.

Construction and validation/invalidation of an instrumental matrix

In (Janot et al. 2014, a), it has been shown that a ( )

r b × valid instrumental matrix is ( ) , , nf nf nf nf = = Z X X q q q ɺ ɺɺ . ( 18
)
where ( ) , , nf nf nf X q q q ɺ ɺɺ is the ( )

r b × sampled matrix of ( ) , , nf nf nf
IDM q q q ɺ ɺɺ .

To build Z , the DDM given by ( 3) is simulated with the previous IV estimates denoted as

1 ˆit IV -
β and assuming the same references and the same control law structure for both the actual and the simulated robots. S q ɺɺ the vector of the simulated joint accelerations is given by ( ) ( )

1 1 ˆ, , , it it S IV S S S S IV - - = - M q β q τ N q q β ɺɺ ɺ
where ,

S S

q q ɺ are respectively the ( )

1
n × vectors of the simulated joint positions and velocities calculated by numerical integration of the DDM while S τ is the ( )

1 n ×
vector of simulated torques with j S τ , the j th element of S τ , is given by ( ) ( )

j j j j S j r S g C s q q τ τ = - . Let Ẑ defined by ( ) 1 , , , it S S S IV - = Z X q q q β ɺ ɺɺ , (19)
where ( )

1 , , , it S S S IV - X q q q β ɺ ɺɺ is the ( ) r b × sampled matrix of ( ) 1 , , , it S S S IV - IDM q q q β ɺ ɺɺ
.

At iteration it , the IV estimates are given by ( )

1 ˆˆî t T T IV - = β Z X Z y . ( 20
)
In order to ensure the expected value of the k th column of Π is defined as

( ) ˆ, , nf nf nf ≈ Z X q q q ɺ ɺɺ 1 ˆit IV - ∀β ,
( ) exp ˆ1 k i - = π for i k = and ( ) exp ˆ0 k i - = π for i k ≠ . ( 21
)
ˆk π the k th column of Π is calculated with ( )

1 ˆˆT T k k - = π Z Z Z x where k
x is the k th column of X . ˆk v the k th column of V is given by

ˆk k k = - v Zπ x . It is assumed that ( ) , k k N v v 0 Ω ∼
where ˆk v Ω is a diagonal matrix whose the diagonal elements are unknown to the users. In [START_REF] White | A heteroskedasticity-consistent covariance matrix estimator and a direct test for heteroskedasticity[END_REF], the author showed that the i th diagonal element of ˆk v Ω can be estimated with

( ) ( ) 2 ˆ, k k i i i = v Ω v , ( )
ˆk i v
being the i th element of ˆk v . The estimated covariance matrix of ˆjk π is then given by ( ) ( )

1 1 ˆˆˆˆˆk k k T T T - - = π π v Σ Z Z Z Ω Z Z Z . (22)
Then, the following Wald-statistic is calculated

2 1 ˆˆˆk k k k T η - = π π π π δ δ Σ δ , (23)

Algorithm of the Revised DWH-test for robot identification

The Revised DWH-test is run as follows (see Fig. 1):

1. Construct the instrumental variable matrix Z ˆ and validate/invalidate this construction with the algorithm described in Section 3.3.

2. If Z ˆ is valid, calculate Z X V - = .
3. Check with the QR decomposition of XTD

X

that θ has no influence on robot dynamics as explained in Section 3.2.

4. If the k r V 's are not null, assess the contribution of θ thanks to a F-test associated with 0 :

H = θ 0 . If the F-test accepts 0
H , then the LS estimates are considered as unbiased; otherwise, they are biased.

XTD   =   X X V 's null ? k r V

Yes

No LS estimates unbiased F-test with 0 :

H = θ 0 F-test accepts 0 : ? H = θ 0

Yes

No

LS estimates biased

Improvement of the design of exciting trajectories the bias by evaluating the validity of the instruments, can detect a model misspecification and combines the QR factorization with a F-test. Those remarks make the proposed statistic relevant for mechatronic system identification.

Experimental Identification Results

Obtained with the TX40

Model Reduction and Validation of the Statistical Hypotheses

Before presenting the experimental results obtained with the TX40 robot, the F-test used to eliminate the dynamic parameters having no effect on robot dynamics is first introduced. Then, the tests which validate/invalidate the statistical assumptions are presented.

F-test

Some dynamic parameters remain poorly identifiable because they are small. They can be cancelled to simplify the inverse and direct models. The most rigorous way consists in using the F-test [START_REF] Davidson | Estimation and Inference in Econometrics[END_REF] which is carried out with the weighted error

1/ 2 - = ε Ω ε . Because ( ) ( ) 1/ 2 1/ 2 1/ 2 1/ 2 T T r E E - - - - = = = εε Ω εε Ω Ω ΩΩ I , it is assumed that ( ) , r Ν ε 0 I ∼
and the samples of ε are independent. From b base parameters, bc parameters may define the set of essential parameters that is enough to describe the robot dynamics. The F-test is performed as follows:

1. First, one runs the 2SLS method with the b base parameters and one computes ε ; 2. Second, one runs the 2SLS method with the bc essential parameters and one computes c ε , the error norm obtained with the reduced model;

3. Third, one calculates

( ) ( ) ( ) 2 2 2 ˆc b bc F r b - - = - ε ε ε . ( 24
) If F is less than ( ) ( ) ( ) 1 , , b bc r b F α - -
-, the F-test accepts the model reduction; otherwise, it is rejected.

The F-test works if ( )

, r Ν ε 0 I ∼ holds and if the samples of ε are independent. These assumptions must be validated with the Kolmogorov-Smirnov test (KS-test) and the Durbin-Watson test (DW-test).

Kolmogorov-Smirnov test (KS-test)

The KS-test is a nonparametric test for equality of continuous one dimensional probability distribution that can be used to compare a sample with a reference probability distribution. The KStest quantifies a distance between the empirical distribution function (EDF) of the sample and the cumulative distribution function (CDF) of the reference distribution. In our case, the null hypothesis is ( )

0 :
, r H Ν ε 0 I ∼ . The EDF of ε is compared with the CDF of the reference distribution via a KS-test with a 0.05 level of significance.

DW-test

Assuming ( ) , r Ν ε 0 I ∼ , the DW-statistic is given by ( ) ( ) ( ) ( ) ( ) 2 2 1 2 1 1 2 1 r r i i dw i i i ε ε ε ρ = = = - - ≈ - ∑ ∑ , (25)
where 1 ρ is the sample autocorrelation and ( )

i ε is the i th sample of ε .
The value of dw lies between 0 and 4. Similarly, if dw is greater than 2, successive error terms are much different in value from one another (negatively correlated).

For robot identification, as a rough rule of thumb, if dw varies between 1.8 and 2.2, ε can be considered as serially uncorrelated. Otherwise, a suspicion of a serial correlation is legitimate.

KS-test, Wald-test and F-test with MATLAB

In order to perform the KS-test, the kstest MATLAB function is used. The level of significance α is 5%.

It is recommended to calculate the p-value in order to make a good interpretation of the result.

To perform the Wald-test, ( 23) is first calculated and the chi2cdf MATLAB function is used. For instance, with ( 23), the following instruction is used

( ) 2 1 2 , p chi cdf b η = - δ
where p is the p-value. It is checked that p α ≥ to validate the set of instruments.

For the F-test, the fcdf MATALAB function is used. F given by ( 24) is first calculated and the following instruction is used

( ) 1 , , p fcdf F b bc r b = - - -
and if p α ≥ , the model reduction is validated.

Brief introduction of the TX40 Robot

The TX40 robot has a serial structure with six rotational joints and is characterized by a coupling between the joints 5 and 6. This coupling adds two additional parameters:

6 m fv the viscous friction coefficient of motor 6 and 6 m fc the dry friction coefficient of motor 6. The TX40 robot has 60 base dynamic parameters. Its complete modelling is given in (Janot et al. 2014, a).

The robot is PD-controlled and j τ is given by ( ) ( )

j j j j j j j p r mes v mes g k q q k q τ τ = - -ɺ . ( 26
)
where is the velocity calculated from the differentiation of j mes q .

The bandwidth of the first (resp. last) three position closed-loops is 10Hz (resp. 20 Hz). The results obtained with a PID controller sticking to those given in this paper, the use of a PD controller is enough and this is consistent with the results presented in [START_REF] Gautier | A New Closed-Loop Output Error Method for Parameter Identification of Robot Dynamics[END_REF].

The reference trajectories ( ) , , r r r q q q ɺ ɺɺ are designed so that r q ɺɺ are trapezoidal. Since ( )

( )

ˆ, , 200 cond = X q q q ɺ ɺɺ , ( ) , , r r r q q q ɺ ɺɺ excite well the base parameters [START_REF] Gautier | Exciting trajectories for the identification of the inertial parameters of robots[END_REF] and [START_REF] Pressé | New criteria of exciting trajectories for robot identification[END_REF]. To evaluate the three identification methods, data are stored with a measurement frequency

5 m f kHz = .
To validate the estimates, cross-validations are performed. They are carried out with 3 fifth-order polynomials passing through points different from those defined to build the trajectories used to run the 3 identification methods. For cross-test validations, data are stored with a measurement frequency

1 cv m f kHz =
and the relative errors are calculated with the LS or 2SLS estimates and with these trajectories (see (Janot et al. 2014, a) for the details).

IDIM-LS method, 2SLS method and regressed DWH-test combined with an appropriate bandpass filtering

The IDIM-LS method is carried out with a filtered position q calculated with a 40 Hz fourth-order Butterworth filter. For the three methods, the parallel decimation is carried out with a 10 Hz Tchebyshef filter.

Before calculating the LS and the 2SLS estimates, the construction of Ẑ is validated with the procedure described in the subsection 3.3. The results are given in Table 1 where j b is the number of identifiable parameters of a joint j . Because one has ( )

2 2 ˆb η χ ≤ δ
with a p-value greater than 0.05, Ẑ is valid and the 2SLS estimates are thus unbiased. For the columns associated with joint accelerations, the ˆk r V 's are not null although very small (i.e. less than 1e-3) whereas for the columns associated with joint positions and/or velocities only, the ˆk r V 's are null (smaller than 1e-20). A F-test is therefore required to make a final decision. . The distribution of ε obtained with the IDIM-LS method and its estimated Gaussian are plotted in Fig. 3 (similar results are obtained with the two others methods). The KS-test accepts ( )

, r Ν ε 0 I ∼ and the distribution of ε matches a Gaussian distribution with the three methods. Furthermore, dw calculated with (25) and given in Table 2 is close to 2.0 with the three methods. ε is thus serially independent with ( )

, r Ν ε 0 I ∼ .
The IDIM-LS and the 2SLS estimates are in Table 2 as well the estimates θ calculated with the augmented DWH-test (NS stands for "Not Significant"). The F-test accepts to cancel the base parameters such that ( )

% LS i σ β (resp. ( ) 2 % SLS i σ β
) is greater than 30%. Actually, one obtains with a p-value greater than 0.05. From 60 base parameters, only 28 define a set of essential dynamic parameters. Since the F-test accepts 0 :

H = θ 0 , relation (15) holds, XTD X collapses to X and ( ) ( ) ˆ, , , , nf nf nf
≈ X q q q X q q q ɺ ɺɺ ɺ ɺɺ . However, the 2SLS estimates are slightly less efficient than the IDIM-LS estimates because one has 2), the matching is therefore good. Cross-test validations have been performed. In Fig. 2, the torque reconstructed with the IDIM-LS estimates and with the second trajectory matches the measured one while the norm of the relative error calculated with each validation trajectory and with the IDIM-LS and the 2SLS estimates given in Table 3 stick to those calculated with the direct comparisons. The estimates can be considered as unbiased.

IDIM-LS method, 2SLS method and the regressed DWH-test combined with an inappropriate data filtering

In this section, the robustness of the methods against an inappropriate data filtering is studied. The IDIM-LS and 2SLS methods are carried out with the position q filtered with a 200 Hz fourth-order Butterworth filter and with velocities q ɺ and accelerations q ɺɺ , calculated with a central difference algorithm of q . The parallel decimation is carried out with a lowpass Tchebyshef filter with a cutoff frequency of 100 Hz.

Because one has ( )

2 2 ˆb η χ ≤ δ
with a p-value greater than 0.05, Ẑ is valid and the 2SLS estimates are thus unbiased. In that case, the ˆk r V 's associated with joint accelerations are of the same magnitude as those of the k r X 's. With the IDIM-LS method, the 2SLS method and the regressed DWH-test, the KS-test accepts the hypothesis ( )

, r Ν ε 0 I ∼ with a level of significance 0.05 α =
while dw is close to 2.0 (see Table 4). Finally, it comes out that ε is serially independent with ( )

, r Ν ε 0 I ∼ .
The estimates of the IDIM-LS, the 2SLS methods and the regressed DWH-test are given in Table 4 (only the significant parameters are given). At first glance, the IDIM-LS estimates seem acceptable because they are not aberrant, the relative error %rel y is not critical and the histogram of IDIM-LS error plotted in Fig. 4 matches a Gaussian distribution. Unfortunately, they are biased since they do not stick to the 2SLS estimates while the observed differences are not spanned by the LS variances and θ contributes to the dynamics, the F-test rejecting 0 : H = θ 0 . The 2SLS estimates obtained with an inappropriate data filtering are less efficient than those obtained with an appropriate data filtering, their relative deviations being four/five times greater. This result highlights the behaviour of IV estimators: they are able to provide unbiased estimates with very large deviations. This result is consistent with the theory of Statistics [START_REF] Wooldridge | Introductory Econometrics: A Modern Approach[END_REF].

All the components of θ corresponding to inertia parameters (ZZ 1R , XX 2R , XZ 2R , ZZ 2R , XX 3R , ZZ 3R , Ia 3 , Ia 4 , Ia 5 , Ia 6 ) and to some gravity parameters (MY 3R , MX 4 , MY 5R ) are identifiable and have a significant contribution because the F-test rejects 0 : H = θ 0 . This is due to the fact that their associated columns contain noisy joint accelerations. The augmented DWH-test supports the results of the Revised DWH-test (the estimates of the regressed DWH-test are not given because they stick to 2

ˆSLS β

).

Cross-test validations have been performed and the results obtained with the second trajectory and the IDIM-LS estimates are plotted in Fig. 5. Despite the fact that the errors are not negligible, the reconstruction of torques is quite acceptable and the IDIM-LS estimates are acceptable for a nonexpert in system identification. This result shows that the cross-validations may be not enough to make a final decision. In Table 5, the norms of relative errors calculated with the set of trajectories and with the IDIM-LS (resp. the 2SLS) estimates are given. With the 2SLS estimates, these relative errors match those calculated with the direct comparisons whereas there are some differences with the IDIM-LS estimates although these differences are not as critical as expected. Without running the Revised DWH-test, there are no undisputable evidences to conclude that the IDIM-LS estimates are biased.

Conclusion

In this paper, a Revised DWH-test suitable for identification of robots was introduced and experimentally validated on a 6 degrees-of-freedom industrial robot. The main contributions of the work presented in this paper are the following:

• The Revised DWH-test can validate/invalidate the instruments chosen by the user and is based on general statistical assumptions, • The Revised is able to detect model misspecifications,

• The algorithm makes use of the QR factorization of an augmented matrix and is combined with a F-test if required, • The Revised DWH-test is able to validate/invalidate IDIM-LS estimates.

The results provided by the revised statistic were cross-validated and compared with those provided by the augmented DWH-test widely used in Econometrics. Since all the results are close to each others, this shows that the results provided by the Revised DWH-test are reliable. Future works will address the application of the Revised DWH-test on flexible robots and electrical motors. The calculation of the optimal prefilters for robot identification and the application of the experiment design are worth of investigation and will be addressed.

  components of the inertia matrix of link j at the origin of frame j ; of the first moment of link j ; j M the mass of link j ; j Ia a total inertia moment for rotor and gears of actuator j ; j Fv and j Fc the viscous and Coulomb friction parameters of joint j .

  the gains of the simulated controller of the simulated robot are updated according to ˆit IV β . The updating procedure is completely described in (Janot et al. 2014, a) and (Janot et al. 2014, b). According to the results presented in (Janot et al. 2014, a), this IV approach can be considered as a one-step IV algorithm. Consequently, a one-step 2SLS algorithm is considered for experiments. It is now shown how to validate/invalidate the construction of Ẑ . With nf =

  Ẑ validated. Otherwise, this construction is invalidated. Relation (23) indicates if the distance between ˆk π and exp ˆkπ is compatible the variances calculated.If the Wald-test accepts 0 that proves that the statistical assumption made on V hold. Indeed, if (23) holds, ˆk π bounded and according to the results exposed in[START_REF] White | A heteroskedasticity-consistent covariance matrix estimator and a direct test for heteroskedasticity[END_REF], it follows that ˆk v is a consistent estimate of k v . Since ( )

Fig. 1 .

 1 Fig. 1. Scheme of the Revised DWH-test suitable for robot identification

2

  dw = indicates no autocorrelation i.e. 1 0 ρ = and if the DWstatistic is substantially less than 2, there is evidence of positive serial correlation. Small values of dw indicate that successive error terms are close in value to one another (or positively correlated).

  each estimate. This result is consistent with the theory of Statistics[START_REF] Wooldridge | Introductory Econometrics: A Modern Approach[END_REF]).Direct comparisons have been performed with the following relative errors: -test. With relative errors close to 6% (see Table

Fig. 2 .

 2 Fig.2. Cross-validations, joints 1, 2, 3, 4, 5 and 6 with 2SLS estimates and with the first trajectory. Blue: measurement; red: estimation; black: error. Appropriate data filtering. The constructed torques stick to the measured ones. Similar results are obtained with the IDIM-LS method.

Fig. 3 .

 3 Fig. 3. Histogram of IDIM-LS error and its estimated Gaussian -Appropriate data filtering. The distribution matches a Gaussian distribution. A similar result is obtained with the 2SLS method.

Fig. 4 .

 4 Fig. 4. Histogram of IDIM-LS error with its estimated Gaussian -Inappropriate data filtering. The error distribution matches a Gaussian distribution.

  Aguero and Goodwin (2006), "On the Optimality of Open and Closed Loop Experiments in System Identification," In: Proceedings of the 45th IEEE Conference on Decision and Control Conference, 2006, Page(s): 163 -168 Aguero and Goodwin (2007), "Choosing between open-and closed-loop experiments in linear system identification," IEEE Transactions on Automatic Control, Vol. 52(8), August 2007, pp. 1475-14780 -LS error and Estimated Gaussian

TABLE 1 :

 1 RESULTS OF THE WALD-TEST (23) FOR EACH JOINT J

	Joint j	b	j	χ	2	( ) j b	( ) 2 max η δ	p-value
	1	34	48.5	18.5	0.98
	2	37	52.3	12.4	0.99
	3	31	45.0	18.1	0.97
	4	24	36.5	5.4	0.99
	5	20	31.3	11.7	0.93
	6	11	19.7	9.1	0.61

TABLE 2 :

 2 IDIM-LS AND 2SLS ESTIMATES, REGRESSED DWH-TEST ESTIMATES -APPROPRIATE DATA FILTERING

		β	LS	( ) % LS σ β	( ˆ% SLS σ β 2 ) 2 SLS β	θ
	ZZ 1R	1.26 (1.2%)	1.25 (1.3%)	NS
	Fv 1	8.1 (0.7%)	8.20 (0.7%)	NI
	Fc 1	6.60 (2.3%)	6.54 (2.6%)	NI
	XX 2R	-0.48 (2.5%)	-0.48 (2.9%)	NS
	XZ 2R	-0.16 (4.4%)	-0.16 (4.8%)	NS
	ZZ 2R	1.09 (1.1%)	1.09 (1.2%)	NS
	MX 2R	2.20 (2.5%)	2.21 (2.9%)	NI
	Fv 2	5.68 (1.1%)	5.68 (1.2%)	NI
	Fc 2	7.76 (1.8%)	7.77 (2.1%)	NI
	XX 3R	0.13 (9.5%)	0.13 (10.2%)	NS
	ZZ 3R	0.12 (7.6%)	0.12 (8.8%)	NS
	MY 3R	-0.59 (2.2%)	-0.59 (2.3%)	NI

TABLE 3 :

 3 RELATIVE ERRORS OBTAINED WITH CROSS-VALIDATION, THE IDIM-LS AND THE 2SLS ESTIMATES

		f	cv m	%rel y (LS)	%rel y (2SLS)
	Trajectory 1	1 kHz	6.5%	6.5%
	Trajectory 2	1 kHz	6.5%	6.5%
	Trajectory 3	1 kHz	7.0%	7.0%

TABLE 4 :

 4 IDIM-LS AND 2SLS ESTIMATES, REGRESSED DWH-TEST RESULTS -INAPPROPRIATE DATA FILTERING

					WLS error and estimated Gaussian
		1600
		1400
		1200
	Population	600 800 1000
		400
		200
		-5 0	-4	-3	-2	-1	0	1	2	3	4	5
							Nm
					β	LS	( ) % LS σ β			( ˆ% SLS σ β 2 ) 2 SLS β	θ	( ) %σ θ
				ZZ 1R	1.11 (0.8%)		1.24 (4.1%)	-1.22 (3%)
				Fv 1	8.23 (0.5%)		8.25 (2.4%)	NS
				Fc 1	6.42 (1.7%)		6.38 (9.1%)	NS
				XX 2R	-0.38 (1.9%)		-0.48 (10.6%)	0.46 (9%)
				XZ 2R	-0.16 (3.0%)		-0.16 (15.9%)	0.14 (16%)
				ZZ 2R	0.88 (0.8%)		1.08 (3.8%)	-1.0 (3%)
				MX 2R	2.42 (1.7%)		2.22 (9.9%)	NS
				Fv 2	5.63 (0.8%)		5.75 (4.4%)	NS
				Fc 2	7.88 (1.3%)		7.55 (6.4%)	NS
				XX 3R	0.19 (5.7%)		0.13 (29.3%)	-0.11 (20%)
				ZZ 3R	0.07 (6.2%)		0.11 (28.8%)	-0.12 (10%)
				MY 3R	-0.71 (1.0%)		-0.60 (6.6%)	0.5 (6%)
				Ia 3	0.15 (2.6%)		0.09 (24.5%)	-0.07 (20%)
				Fv 3	2.03 (1.0%)		2.01 (4.5%)	NS
				Fc 3	5.96 (1.1%)		5.83 (5.1%)	NS
				MX 4	-0.01 (20.1%)		-0.02 (27.5%)	0.01 (50%)
				Ia 4	0.022 (3.9%)		0.028 (25.5%)	NS
				Fv 4	1.14 (0.6%)		1.17 (3.2%)	NS
				Fc 4	2.35 (1.0%)		2.23 (6.3%)	NS
				MY 5R	-0.02 (5.7%)		-0.03 (28.3%)	0.03 (9%)
				Ia 5	0.02 (3.2%)		0.04 (25.2%)	-0.03 (12%)
				Fv 5	1.84 (0.7%)		1.94 (4.0%)	NS
				Fc 5	3.01 (1.1%)		2.72 (7.3%)	NS
				Ia 6	0.007 (3.3%)		0.01 (24.5%)	-0.008 (10%)
				Fv 6	0.67 (0.6%)		0.69 (3.8%)	NS
				Fc 6	2.11 (1.0%)		1.97 (6.2%)	NS
				fv m6	0.63 (0.6%)		0.64 (3.8%)	NS
				fc m6	1.80 (1.4%)		1.74 (8.1%)	NS

TABLE 7 :

 7 IDIM-LS ESTIMATES AND 2SLS ESTIMATES -MISSPECIFIED MODEL AND APPROPRIATE DATA FILTERING Fig. 6. Histogram of IDIM-LS error and its estimated Gaussian -Appropriate data filtering -Misspecified dynamic model

		β	LS	( ) % LS σ β	( ˆ% SLS σ β 2 ) 2 SLS β
	ZZ 1R	1.10 (3.0%)	1.08 (3.5%)
	Fv 1	8.16 (3.0%)	8.17 (3.6%)
	Fc 1	6.50 (10.6%)	6.48 (11.0%)
	ZZ 2R	1.37 (2.3%)	1.20 (2.0%)
	Fv 2	5.80 (5.2%)	5.83 (5.8%)
	Fc 2	6.80 (10.3%)	6.80 (11.0%)
	ZZ 3R	0.31 (7.8%)	0.27 (6.7%)
	Ia 3	0.05 (36.0%)	0.07 (40.0%)
	Fv 3	2.21 (7.2%)	2.22 (7.6%)
	Fc 3	5.55 (9.3%)	5.53 (9.5%)
	Ia 4	0.04 (26.2%)	0.05 (31.1%)
	Fv 4	1.18 (5.0%)	1.20 (5.8%)
	Fc 4	2.20 (9.6%)	2.17 (10.0%)
	Ia 5	0.06 (28.2%)	0.05 (29.3%)
	Fv 5	1.90 (7.1%)	1.89 (7.3%)
	Fc 5	2.75 (12.5%)	2.75 (12.6%)
	Ia 6	0.01 (31.0%)	0.01 (33.0%)
	Fv 6	0.69 (5.1%)	0.69 (5.4%)
	Fc 6	2.0 (8.9%)	2.0 (9.3%)
	fv m6	0.64 (5.6%)	0.64 (5.9%)
	fc m6	1.70 (15.2%)	1.70 (16.0%)
	%rel y	17.0%	21.0%
	dw	1.8		1.8

Robustness against a misspecified model

The robustness of the Revised DWH-test against a misspecified model is now studied. Because the gear ratios are greater than 25, it is legitimate to assume that the parameters of gravity and the offdiagonal elements of inertia matrices do not contribute significantly to the dynamics. These parameters and their associated columns are removed from the IDM. The data are filtered as explained in Section 4.3.

For the inertia parameters of joints 1, 2, 3 and 4, the Wald-test rejects the hypothesis that Ẑ is valid because the minimum of 2 ηδ given in Table 6 is greater than ( )

while the p-value is almost null.

Interestingly, the set of instruments of joint 5 and 6 is valid. This is mainly due to the fact that the gravity parameters and the off-diagonal elements of inertia matrices are practically null. Because Ẑ is not valid, the 2SLS estimates are biased.

The IDIM-LS and 2SLS estimates given in Table 7 differ from those given in Table 2. They are therefore biased. The KS-test rejects the hypothesis ( )

, r Ν ε 0 I ∼ for both methods. The IDIM-LS error and its estimated Gaussian are plotted in Fig. 6 and the distribution does not match a Gaussian distribution (a similar result is obtained with the 2SLS method). This experiment shows that the Revised DWH-test is able to detect a model misspecification.


Clément Elbaz
email: clement.elbaz@inria.fr

Louis Rilling
email: louis.rilling@irisa.fr

Christine Morin
email: christine.morin@inria.fr

Reactive and Adaptive Security Monitoring in Cloud Computing

Keywords: Security, Cloud, SLA, IDS

I. MOTIVATION

Cloud computing enabled service-level agreements (SLAs) to gain widespread use among information systems stakeholders. It is now normal for performance and availability of such systems to be carefully measured and evaluated. Contracts that include financial penalties in case of breach are now common.

However security is lagging behind this trend; it is as important to stakeholders as performance and availability, but is generally not included in the scope of service-level agreements between stakeholders, and handled instead on a best-effort basis, without any transparency nor SLA with their clients.

One reason for this is the difficulty of objectively measuring security. Indeed, the actual security level of a system is dependent on a wide range of factors, some intrinsic to the system -such as a design or implementation mistake resulting in a vulnerability -and some extrinsic to it. For instance, an external event such as the publication of a vulnerability in an open-source software dependency or a change of political context in a country can widely impact the risks faced by an information system even if no actual change were made to the system.

These factors are even more numerous in multi-tenant cloud infrastructures because of the sheer number of actors involved -and their sometimes conflicting incentives -and opportunities for both attack and defense at scale.

Security monitoring aims to detect and react to attacks in real time; Reactive security monitoring intends to take external events into account while doing so. Improving the accuracy of a system's overall security assessment can help transitioning security to a SLA paradigm and enable better transparency for all stakeholders.

II. OBJECTIVES

We present an intermediate stage research project whose goal is threefold. First we aim to better define the various threats looming over information systems in the cloud, more specifically the way these threats evolve with time. We are particularly interested in the software vulnerability life cycle and how newly found vulnerabilities affect the security of cloud tenants. Similarly, we want to study how cloud providers can use intrusion detection systems (IDS) -which detect the use of a vulnerability through network analysis -and corrective patches -which fix the actual vulnerability through a software upgrade -to mitigate the threat induced by these vulnerabilities to tenant information systems; and provide this mitigation in a controlled time frame.

Second we want to provide new types of high level security SLAs allowing cloud providers to make these adaptive changes to their infrastructure in a transparent and observable way for their clients.

Third we are interested in the economic incentives of stakeholders regarding reactive security. We want to get a better understanding of the ways cloud customers and providers spend (or don't spend) their resources on security. We are also interested in studying how various business models can encourage (or discourage) adoption of responsible security practices among cloud stakeholders.

III. METHODOLOGY

In order to accomplish the goals described in Section II, we need to overcome two challenges.

First, there is a lack of consensus on the best way to evaluate the actual security of an information system [START_REF] Bernsmed | Security SLAs for Federated Cloud Services[END_REF] [2], and more specifically evaluating the efficiency of IDSs [START_REF] Bhuyan | Network Anomaly Detection: Methods, Systems and Tools[END_REF]. Indeed, evaluation datasets such as the DARPA dataset [START_REF]DARPA Intrusion Detection Data Sets[END_REF], NSL-KDD [START_REF]NSL-KDD dataset[END_REF] and UNIBS datasets [6] are questioned on their realism as well as their currentness. Meanwhile evaluations based on actual network traffic have trouble separating normal and malicious activities and are difficult to replicate after the fact.

A second challenge is the difficulty of working with new threats: reactive security monitoring must deal with ill-defined situations and makes decisions while most of the information is not yet available.

Our answer to these challenges is to consider reactive security as an incomplete information game exhibiting some uncertainty.

Therefore we aim to approach reactive security through game theory and economic modeling. By acknowledging the uncertainty in our models, we expect to get a more accurate picture of the expected value of a security situation as well as a better understanding of why (and if) we should be confident about our analysis.

Security viewed through the prism of game theory and economics has already received attention [START_REF] Barth | A Learning-Based Approach to Reactive Security[END_REF] [8] and we plan to build our work upon these publications. Likewise, the existing work related to the software vulnerability lifecycle [START_REF] Frei | Large-scale Vulnerability Analysis[END_REF] [10] [11] [12] is also a foundation of our own.

IV. RESEARCH PLAN

Our first work focused on a specific aspect of reactive security: studying the way an IaaS cloud service provider (CSP) can react to newly published vulnerabilities. More specifically we studied the possibility for a CSP to engage in a contract with its clients supported by a new type of SLA. This SLA covers the ability for the CSP to provide countermeasures for any new vulnerability affecting the client, and do so in a contractual time frame. The contract includes a periodic (monthly for instance) payment from the client to the CSP, and a financial penalty from the CSP to the client in case of a breach of SLA.

We focused on two types of counter-measures: corrective patches deployed in a software repository (such as the debiansecurity repository from the Debian Linux distribution [13]) and IDS signatures rules (such as the official Snort rules written by Talos [START_REF]Talos -Author of the Official Snort Rule Sets[END_REF]).

This led us to carry out a new vulnerability life cycle study, the first of its kind encompassing IDS signatures rules as well as correctives patches. For this study we oversaw the lifecycle of 34 000 vulnerabilities published between June 2014 and October 2017.

Then we used the data from this study to analyze the business model of this contract.

This study led to promising results: we showed that for a wide range of plausible scenarios, it was possible for a CSP to make a profit from charging its clients to enforce a SLA on counter measure deployment. Those results were published in July 2018 [START_REF] Elbaz | Mesurer et prévenir l'évolution de la menace dans un cloud d'infrastructure[END_REF].

However this study also showed the lack of suitability of rule-based IDSs for reactive security. Indeed, rule-based IDSs use static, human authored signatures to detect attacks. In our study we noticed that most of these rules were published long after the associated corrective patches. This led us to conclude that signature-based IDSs are generally inadequate when dealing with very recent threats.

Therefore we chose anomaly-based IDSs as our next research topic. Anomaly-based IDSs are machine-learning based systems attempting to separate normal and abnormal network activity. Unlike signature-based IDSs they require a training period to learn what the normal state of the system is supposed to be. Our hypothesis is that anomaly-based IDSs might be better suited than signature-based IDSs when dealing with new vulnerabilities, as they don't require manual rule authorship. We plan to spend most of 2018 evaluating them theoretically and experimentally to assess their suitability to reactive security. As mentioned in Section III, one challenge is the lack of a consensus on the best way to evaluate IDSs. Another challenge more specific to anomaly-based IDSs is the lack of open source software widely used in production: most of anomaly-based IDSs are prototypes created for specific research projects, making their real world evaluation difficult. This situation stems in part from the high false positive rate of current anomaly-based IDS designs. Nevertheless we plan on experimenting with Hogzilla [START_REF]Hogzilla IDS[END_REF] and possibly our own prototype.

Another topic we plan to work on is to provide a new high level security SLA that can be translated into evolving low level SLAs. In particular, we view SLAs as a bridge between the technical and organizational aspects of security. A high level SLA can define contractual obligations for both the CSP and the client, as well as defining high level technical objectives that can be translated into context-dependent low level requirements. We plan to study the state of the art on this topic and possibly propose new paradigms.

In 2019 we plan to gather what we learned in 2017 and 2018 to design and implement a prototype of a solution capable of making reactive decisions to external threats. This prototype will combine the use of both corrective patches and signature and anomaly-based IDSs to exploit the strength of both approaches. We will experimentally evaluate this prototype on the Grid5000 platform [START_REF] Balouek | Adding Virtualization Capabilities to the Grid'5000 Testbed[END_REF] for both performance and security aspects.