Ste ´phane Thobois
email: stephane.thobois@chu-lyon.fr

Be ´ne ´dicte Ballanger

Jing Xie-Brustolin

Philippe Damier

Franck Durif

Jean-Philippe Azulay

Philippe Derost

Tatiana Witjas

Sylvie Raoul

Didier Le Bars

Emmanuel Broussolle

Dr S Thobois

Ho ˆpital Neurologique

Pierre Wertheimer

Globus pallidus stimulation reduces frontal hyperactivity in tardive dystonia

Keywords: GPi stimulation, H 2 15 O, PET, tardive dystonia

Tardive dystonia (TD) is a disabling disorder induced by neuroleptics. Internal globus pallidus (GPi) stimulation can dramatically improve TD. The present positron emission tomography and H 2 15 O study aimed to characterize the abnormalities of brain activation of TD and the impact of GPi stimulation on these abnormalities in five TD patients treated with GPi stimulation and eight controls. Changes of regional cerebral blood flow (rCBF) were determined: (i) at rest; (ii) when moving a joystick with the right hand in three freely chosen directions in on and off bilateral GPi stimulation. A significant increase of rCBF was found in TD patients in off-stimulation condition compared to controls: (1) during motor execution in the prefrontal, premotor lateral, and anterior cingulate cortex; (2) at rest, in the prefrontal and anterior cingulate cortex and the cerebellum. Internal globus pallidus stimulation led to a reduction of rCBF (1) during motor execution, in the primary motor and prefrontal cortex and the cerebellum; (2) at rest, in the primary motor and anterior cingulate cortex and supplementary motor area. The results are as follows: (1) TD is related to an excess of brain activity notably in the prefrontal and premotor areas; (2) GPi stimulation reduces the activation of motor, premotor, and prefrontal cortex as well as cerebellum.

Introduction

Dystonia is characterized by sustained muscle contractions leading to abnormal postures and movements [START_REF] Geyer | The diagnosis of dystonia[END_REF]. From an aetiological point of view, dystonias have been divided into primary dystonias, in which dystonia is the sole clinical manifestation, and secondary dystonias, which are due to degenerative disorders or acquired lesions of the basal ganglia [START_REF] Geyer | The diagnosis of dystonia[END_REF]. Tardive dystonia (TD) belongs to the secondary dystonias and is related to neurolep-tic intake for at least 3 months. Tardive dystonia belongs to the so-called tardive dyskinesia, which were reported for the first time 50 years ago [START_REF] Najib | Tardive dyskinesia: a review and current treatment options[END_REF]. Tardive dyskinesia is a heterogeneous entity that comprises dystonic and choreic abnormal movements. Usually, clinical symptoms predominantly affect the orofacial and axial muscles [START_REF] Najib | Tardive dyskinesia: a review and current treatment options[END_REF]. Mild cases most often consist in orofacial dyskinesias, but more severe cases present generalized abnormal movements with a predominance of axial dystonia. This is the case in patients reported in this study explaining why we prefer to write about TD instead of tardive dyskinesia, which is less precise. The prevalence of tardive dyskinesia is between 15% and 20% among patients treated with neuroleptics, and despite withdrawal of dopamine blockers, more than 50% of cases are irreversible [START_REF] Najib | Tardive dyskinesia: a review and current treatment options[END_REF]. Furthermore, severe disability is observed in approximately 2% of cases of tardive dyskinesia [START_REF] Pourcher | Neuroleptic associated tardive dyskinesia in young people with psychoses[END_REF]. Medical treatments for tardive dyskinesia are usually of weak or short-lasting efficacy [START_REF] Soares | The treatment of tardive dyskinesia-a systematic review and meta-analysis[END_REF]. For these intractable cases, deep brain stimulation (DBS) of the internal globus pallidus (GPi) has been proposed, which leads to a dramatic improvement of the motor symptoms, as recently demonstrated by several case reports and in a controlled study from our group [START_REF] Schrader | Unilateral deep brain stimulation of the internal globus pallidus alleviates tardive dyskinesia[END_REF][START_REF] Eltahawy | Bilateral globus pallidus internus deep brain stimulation in tardive dyskinesia: a casereport[END_REF][START_REF] Talairach | Treatment of severe tardive dystonia with pallidal deep brain stimulation[END_REF][START_REF] Franzini | high-frequency bilateral pallidal stimulation for neuroleptic-induced tardive dystonia. Report of two cases[END_REF]Damier et al, 2007). The improvement in tardive dyskinesia with DBS of the GPi is comparable to the one observed in primary generalized dystonia [START_REF] Delmaire | Disorganized somatotopy in the putamen of patients with focal hand dystonia[END_REF]. The pathophysiology of dystonia is complex and not fully understood. Electrophysiological and functional imaging studies have shown an excess of brain activation, a loss of corticocortical inhibition, and a lack of the selectivity of brain activation [START_REF] Hallett | Dystonia: abnormal movements result from loss of inhibition[END_REF]. In primary generalized dystonia, functional imaging studies have shown that during the execution of a simple hand motor task there is widespread overactivation of the brain, notably in the prefrontal, premotor, parietal cortex as well as in the supplementary motor area (SMA), cerebellum, and striatum (Ceballos-Baumann et al, 1995a;[START_REF] Playford | Increased activation of frontal areas during arm movement in idiopathic torsion dystonia[END_REF][START_REF] Kumar | Globus pallidus deep brain stimulation for generalized dystonia: clinical and PET investigation[END_REF][START_REF] Detante | Globus pallidus internus stimulation in primary generalized dystonia: a H 2 15 O PET study[END_REF]. In secondary dystonia caused by lesions of the basal ganglia, additional overactivation of the primary motor cortex was observed (Ceballos-Baumann et al, 1995b). Other studies of writer's cramp and Meige's syndrome have demonstrated an altered somatotopic representation, which contributes to the loss of functional selectivity of muscle activity [START_REF] Delmaire | Disorganized somatotopy in the putamen of patients with focal hand dystonia[END_REF]. In addition, dysfunction of the cortical sensory system with an enhanced response of the basal ganglia to sensory inputs has been shown [START_REF] Butterworth | Abnormal cortical sensory activation in dystonia: an fMRI study[END_REF]. Interestingly, these abnormalities of the pattern of cerebral activation in primary dystonia can be reversed by efficient pallidal stimulation [START_REF] Kumar | Globus pallidus deep brain stimulation for generalized dystonia: clinical and PET investigation[END_REF][START_REF] Detante | Globus pallidus internus stimulation in primary generalized dystonia: a H 2 15 O PET study[END_REF].

The pathophysiology of TD remains debated, but the main hypothesis is that dopamine-blocking agents induce a hypersensitivity of dopaminergic receptors, leading to a dysfunction of both direct and indirect striatopallidal pathways [START_REF] Silvestri | Increased dopamine D2 receptor binding after long-term treatment with antipsychotics in humans: a clinical PET study[END_REF][START_REF] Van Kampen | Dopamine D(1A) receptor function in a rodent model of tardive dyskinesia[END_REF]. This dysfunction would inhibit the GPi, thereby releasing the inputs from the thalamus to the cortex and leading to an excess of brain activation observed in TD. Furthermore, abnormal patterns of neuronal activity in GPi have been shown in dystonia (Vitek et al, 1999). Thus, GPi stimulation may act through the replacement of this abnormal firing pattern of GPi neurons by a more regular one.

Few functional imaging data are available in TD. Most of the positron emission tomography (PET) and single-photon emission computed tomography studies have looked at the modifications of the postsynaptic dopaminergic system. In patients studied after long-term neuroleptic treatment withdrawal, an upregulation of dopaminergic D2 receptors has been observed using PET and [ 11 C]raclopride, a D2 receptor ligand. Notably, these studies concerned patients with severe TD, which is in agreement with the suspected role of dopamine receptor trafficking in the occurrence of TD [START_REF] Silvestri | Increased dopamine D2 receptor binding after long-term treatment with antipsychotics in humans: a clinical PET study[END_REF]. In contrast, other studies showed normal dopamine D2 receptor density and affinity in TD [START_REF] Blin | Striatal dopamine D2 receptors in tardive dyskinesia: PET study[END_REF][START_REF] Andersson | Striatal binding of 11C-NMSP studied with positron emission tomography in patients with persistent tardive dyskinesia: no evidence for altered dopamine D2 receptor binding[END_REF][START_REF] Adler | Amphetamine-induced dopamine release and postsynaptic specific binding in patients with mild tardive dyskinesia[END_REF].

To our knowledge, no functional magnetic resonance imaging or PET activation study has investigated changes of brain activation patterns in TD. Therefore, the objectives of the present PET H 2 15 O study were (1) to determine whether an abnormal pattern of brain activation is associated with TD; in the light of what is known about primary and secondary dystonias, we hypothesized that TD would be related to increased activation of the motor, premotor, and prefrontal regions and (2) to investigate the changes of cerebral perfusion induced by bilateral GPi stimulation in patients operated for severe TD in the French multicentric STARDYS study (Damier et al, 2007). Ten patients participated in the STARDYS study, which demonstrated the great efficacy of GPi stimulation in severe TD. Among them, five were included in the present PET activation study. In the light of what was observed in primary dystonia, we hypothesized that GPi stimulation would at least partly reverse the abnormalities of brain activation in TD.

Methods

Subjects

Five right-handed patients suffering from severe TD were included in the study (4 females and 1 male; mean age 51.4 ± 11.4 years; see Table 1 for clinical characteristics and stimulation parameters). All these patients had received neuroleptics in the past for severe anxiety associated with depression but none presented with psychotic disorders. For all these patients, the clinical presentation consisted of severe predominantly axial dystonia affecting the face (n = 5), the trunk (n = 4), the arms (n = 3), or the legs (n = 1). One patient also had mild choreic movements affecting the fingers on both sides. All patients participated in the French multicentre collaborative STARDYS study and had been operated on for at least 6 months with chronic bilateral stimulation of the GPi (Damier et al, 2007). The surgical method has been detailed elsewhere (Damier et al, 2007). On the day of the PET scans, the patients had been withdrawn from their usual medication for at least 12 h. On the day preceding the PET scan, the severity of the patients' abnormal movements was assessed using the Extrapyramidal Symptoms Rating Scale (ESRS) score [START_REF] Chouinard | Manual for the Extrapyramidal Symptom Rating Scale (ESRS)[END_REF]. This assessment was completed during the on stimulation condition and then 1 h after the stimulators had been switched off; at the time of the assessment, the assessor was fully aware of whether the stimulators were

NPG_JCBFM_9600610 Q1 Q2 PET study in TD U N C O R R E C T E D P R O O F
on or off. For all patients, stimulation led to a clear improvement of the dystonia and chorea with a mean improvement of the ESRS score of 63% at the time of the PET study (P < 0.01). In addition, eight age-matched control subjects were recruited (3 females and 5 males; mean age±s.d.: 47.5±13 years). All controls were righthanded and had no history of neurologic disease.

The study was approved by the local research ethics committee. All subjects participated after the aims of the study and the nature of the procedures had been fully explained. They signed an informed consent form in line with the Declaration of Helsinki Principles.

Tasks

Subjects lay on the bed of the PET scanner with their eyes closed. Two conditions were considered: execution of the task with the right hand (T) and rest condition (R). The motor task consisted of moving a joystick in three freely chosen different directions (front, back, and left or right) with the right hand, without repeating the same motor sequence and as accurately as possible (i.e., with a good amplitude of movement). The joystick was restrained by strings to enable only left-right and front-back movements. The participants were instructed to go back to the centre between two consecutive movements. The movement was externally cued by an auditory stimulus (a high tone) that was displayed regularly every 8 secs. This externally cued motor task was repeated in the same manner during 120 secs leading to a total of 15 movements. In the rest condition, subjects held the joystick in their right hand and heard the auditory cue but did not move the hand. Each task was repeated three times for a total of six scans. The order of conditions was randomized.

Patients underwent two PET scan sessions on two consecutive days (six scans each), leading to a total number of 12 scans. Each PET session was performed after GPi stimulation had either been bilaterally switched on or off for at least 3 h. The order of stimulation (i.e., DBS on first or off first) was counterbalanced. We checked that the duration after having switched the stimulator on or off was sufficient for the motor signs to reccur or disappear. In all cases, this latency was short, and most of the dystonic postures came back or were suppressed with a delay of a few minutes.

For control subjects, one PET scan was performed for a total of six scans.

Behavioural Analysis

Movement duration (time needed to perform the three different movements with the joystick) and reaction time (interval from beep to the first movement) were computed for the motor task. A between (patients, control)-by-within (experimental condition) analysis of variance design was used to identify significant differences between the experimental groups and conditions. Data from all responses were incorporated into this analysis of variance. Duncan's multiple range test was used for post hoc comparisons of the means. The threshold for statistical significance was set at 0.05.

Positron Emission Tomography Data Acquisition

Positron emission tomography scanning was performed at the CERMEP-Imagerie du vivant (PET Imaging Centre, Lyon, France) on a CTI HR + Siemens tomograph (CTI/ Siemens, Knoxville, TN, USA). The head was maintained in a fixed position using a molded helmet. The head NPG_JCBFM_9600610

U N C O R R E C T E D P R O O F
position was checked before and after each scan using a laser alignment together with reference points on Reid's line.

A 10-min transmission scan was acquired using rotating rod sources filled with 68 Ge/ 68 Ga. For each emission scan, an intravenous injection of H 2 15 O (343 ± 77 MBq) through a forearm catheter placed into the brachial vein was realized. The integrated counts were collected for 90 secs, starting 30 secs after the injection. The interval between successive H 2 15 O administrations was 9 mins to allow for adequate radioactivity decay. Images were reconstructed by three-dimensional back-filtered projection (Hanning filter; cut-off frequency 0.5 cycles per pixel), giving a transaxial resolution of 6.5 mm full-width at half-maximum, and displayed in a 128 Â 128 pixel format with 63 planes creating 2 mm cubic voxels.

Positron Emission Tomography Data Analysis

Using CAPP software, the original emission scans in ECAT7 file format were converted into ANALYZE file format and then processed in MATLAB 6 (MathWorks, Natick, MA, USA) using the Statistical Parametric Mapping software (SPM 2; Wellcome Department of Cognitive Neurology, MRC Cyclotron Unit, London, UK). In the first stage of analysis, the 12 images from each subject were realigned to the first scan with an automated algorithm for head movement correction and then normalized into the standard stereotactic space provided in SPM 2. The normalized images were smoothed with an isotropic Gaussian filter of 12 mm to account for variation in gyral anatomy and individual variability in structure-function relationships and to improve the signal-to-noise ratio. Variations in global flow across subjects were removed by proportionally scaling each image to have an arbitrary level of 50 mL per 100 mL per min. Regional cerebral blood flow (rCBF) changes were statistically analysed for all voxels exceeding 80% of the mean value of the scan.

We first analysed the abnormalities of brain activation pattern observed in TD patients in the off-stimulation condition compared to controls. Increase of rCBF at rest in patients compared to controls was determined by the following contrast: (R patientOff -R controls ). In addition, we determined in each group the increase of rCBF when subjects executed the motor task (T) compared to the rest (R) condition by the following contrast: T-R. In patients, this was performed in the off-stimulation condition (T-R) patientOff . Then, between-group comparisons of rCBF were made. Increase of rCBF during the execution of the motor task in patients compared to controls was assessed by the following interaction contrast: (T-R) patientOff -(T-R) controls . Decrease of rCBF during the execution of the motor task in patients compared to controls was assessed by the following interaction contrast: (T-R) controls -(T-R) patientOff . We then analysed the modifications of rCBF induced by bilateral GPi stimulation. The increase of rCBF induced by GPi stimulation at rest was determined by the following contrast: R patientOn -R patientOff . The decrease of rCBF induced by GPi stimulation at rest was determined by the following contrast: R patientOff -R patientOn . The decrease of rCBF induced by GPi stimulation during the execution of the motor task was assessed by the following interaction contrast: (T-R) patientOff -(T-R) patientOn . The increase of rCBF induced by GPi stimulation during the execution of the motor task was assessed by the following interaction contrast: (T-R) patientOn -(T-R) patientOff . Finally, the covariation of rCBF, with the ESRS score used as a covariate, was analysed. In a covariate-only model, the positive covariation of rCBF with this score was determined.

Global differences in cerebral blood flow were covaried for all voxels within the mask, and comparisons across conditions were made using t-statistics with appropriate linear contrasts and then converted to Z-scores. The minimal cluster size comprised at least 10 voxels. Only voxels that exceeded a threshold of a false-positive error (FWE)-corrected Pp0.05 were considered as significant. For regions with a strong a priori hypothesis based on previous functional imaging studies performed in dystonia (i.e., prefrontal, lateral premotor, primary motor, parietal cortex, SMA, cerebellum, basal ganglia), small volume corrections were applied if the FWE-corrected P-value did not reach the Pp0.05 statistical threshold (here again, a corrected P-value after small volume correction p0.05 is considered as significant). All coordinates reported were based on the Talairach atlas and were derived from procedures developed by M Brett (http://www.mrc-cbu.cam.ac.uk/Imaging; [START_REF] Talairach | Treatment of severe tardive dystonia with pallidal deep brain stimulation[END_REF].

Results

Behavioural Results

In the patient group, no significant difference in movement duration between on-and off-stimulation conditions (3,931±972 ms on stimulation versus 3,535±1,135 ms off stimulation; P = 0.6) or between patients with off-stimulation condition and control subjects (3,535±1,135 ms for patients versus 2,823±681 ms for controls; P = 0.18) was observed.

Similarly, no difference in reaction time was observed when comparing on-and off-stimulation conditions (697 ± 152 ms on stimulation versus 692 ± 167 ms off stimulation; P = 0.9). In addition, there was a nonsignificant trend for patients in both on-and off-stimulation conditions to be slower than controls (558 ± 101 ms for controls versus 697 ± 152 ms for patients in on-stimulation condition; P = 0.055 and 558 ms for controls versus 692±167 ms for patients in off-stimulation condition; P = 0.065).

Positron Emission Tomography Results

Patterns of brain activation in tardive dystonia

In control subjects, a significant increase of rCBF was observed during the execution of the motor task with the right hand versus rest (T-R) in the left primary

At rest

Bilateral GPi stimulation reduced rCBF in the left primary motor cortex (BA 4) and bilaterally in the anterior cingulate cortex (BA 24 and 32) and SMA. An increase of rCBF was induced by GPi stimulation in the right occipital cortex (BA 19), in both cerebellar hemispheres and in the left superior parietal lobe (BA 7).

During motor execution

In patients with on stimulation, the increases in rCBF during the execution of the motor task with the right hand versus rest were more restricted than with off stimulation and concerned the left anterior cingulate cortex (BA 24), primary motor cortex (BA 4), superior parietal lobe (BA 7), cerebellum, and the right medial frontal gyrus (BA 10) and bilaterally in the SMA and the lateral premotor cortex (BA 6) (Figure 1B). These results are summarized in Table 3 and illustrated in Figure 3.

NPG_JCBFM_9600610

Covariation of rCBF with Severity of Dystonia

A positive covariation was observed between the ESRS score and the activation of the left anterior cingulate cortex (BA 24) and the superior frontal gyrus (BA 10) and bilaterally in the primary motor cortex (BA 4), superior parietal lobe (BA 7), SMA, and cerebellar hemispheres. These results indicate that the more severe the dystonia, the greater the rCBF in these areas. The location, coordinates, and peak Z-scores of the activated areas are detailed in Table 4.

Discussion

This study provides, for the first time, evidence of abnormal patterns of brain activation in TD. These abnormalities mostly consist in excess of activation of the prefrontal, premotor, and anterior cingulate cortex. Furthermore, this study shows that the clinical improvement induced by GPi stimulation is mediated by a reduction of activation in the primary motor and prefrontal cortex and in the cerebellum.

Study Limitations

The rest condition was not a true rest, as an auditory cue was present and subjects had to refrain from moving the hand. This could have led to an activation of the prefrontal cortex to inhibit the movement. However, this probably did not affect our results, as this condition was similar for both groups and in on-and off-stimulation conditions.

We have to acknowledge the lack of significant differences in reaction time and movement duration between the on-and off-stimulation conditions despite the clear global improvement of the abnormal movements as assessed by the ESRS scale. The predominance of axial dystonia and the mild severity of hand dystonia made it difficult to disclose important differences in hand motor condition and thus significant differences in both reaction time and movement duration. Finally, NPG_JCBFM_9600610

U N C O R R E C T E D P R O O F
owing to the rarity of such operated patients, the sample size in this study was small; a larger population would certainly disclose differences between DBS on and off in the basic parameters of movement, which may correlate with patterns of brain activation. Nevertheless, despite few subjects, the PET results were statistically significant. In addition, this lack of kinematic differences has the great advantage of not inducing a confounding factor related to the motor activity itself.

Abnormalities of Patterns of Brain Activation in Tardive Dystonia

A 'qualitative' (i.e., without statistical analysis) comparison of the pattern of brain activation during the execution of our motor task in controls and patients without stimulation reveals that these patterns are similar but are more widespread in patients. For example, patients bilaterally recruit the primary motor cortex, the inferior parietal lobe, and the cerebellar hemispheres, whereas these areas are unilaterally activated in controls. Furthermore, patients recruit the left DLPFC and the right putamen, both regions that are not activated in controls. However, interaction analysis shows that the differences in the profile of brain activation are more restricted and consist of an increase in rCBF in TD patients in the left prefrontal cortex (BA 8 and 11), the anterior cingulate, and the right lateral premotor cortex. Interestingly, at rest, we also observed increases of rCBF bilaterally in the prefrontal cortex and the cerebellum as well as in the anterior cingulate cortex. These results are consistent with those reported in primary dystonia in which over-NPG_JCBFM_9600610 et al, 1998;[START_REF] Kumar | Globus pallidus deep brain stimulation for generalized dystonia: clinical and PET investigation[END_REF][START_REF] Detante | Globus pallidus internus stimulation in primary generalized dystonia: a H 2 15 O PET study[END_REF]). On the one hand, in primary dystonia (generalized or focal), a decrease of rCBF is usually seen in the primary motor cortex, although this decrease is not constant (Ceballos-Baumann et al, 1995a;[START_REF] Playford | Increased activation of frontal areas during arm movement in idiopathic torsion dystonia[END_REF][START_REF] Odergren | Cerebral and cerebellar activation in correlation to the actioninduced dystonia in writer's cramp[END_REF][START_REF] Kumar | Globus pallidus deep brain stimulation for generalized dystonia: clinical and PET investigation[END_REF][START_REF] Ibanez | Deficient activation of the motor cortical network in patients with writer's cramp[END_REF][START_REF] Feiwell | Diminished regional cerebral blood flow response to vibration in patients with blepharospasm[END_REF][START_REF] Hutchinson | The metabolic topography of essential blepharospasm: a focal dystonia with general implications[END_REF][START_REF] Pujol | Brain cortical activation during guitarinduced hand dystonia studied by functional MRI[END_REF][START_REF] Preibisch | Cerebral activation patterns in patients with writer's cramp: a functional magnetic resonance imaging study[END_REF][START_REF] Oga | Abnormal cortical mechanisms of voluntary muscle relaxation in patients with writer's cramp: an fMRI study[END_REF][START_REF] Detante | Globus pallidus internus stimulation in primary generalized dystonia: a H 2 15 O PET study[END_REF]. However, in secondary dystonia, rCBF is often increased in the primary motor cortex (Ceballos-Baumann et al, 1995b; [START_REF] Lehericy | Motor execution and imagination networks in post-stroke dystonia[END_REF]. In this study, no decrease or increase of rCBF is observed in the primary motor cortex.

In addition, it is interesting to note that the activation of the anterior cingulate, primary motor cortex, cerebellum, and superior parietal lobe correlated with the severity of the dystonia, which means that these regions are directly involved in the genesis of the dystonia and do not reflect the underlying psychiatric disease (i.e., depression in all our cases).

Overall, this study shows that, irrespective of the cause of the dystonia and despite some differences between primary and secondary dystonias, the execution of a simple motor task is associated with an excess of brain activation in TD. This finding is in line with the suspected pathophysiological model of dystonia. Indeed, dystonia, as shown by electrophysiological experiments, would result from an excess of excitatory output from the thalamus to the cortical areas, a deficit of reciprocal inhibitory mechanisms at several levels of the central nervous system, and a loss of selectivity of brain activation with a lack of the somatotopy [START_REF] Hallett | Dystonia: abnormal movements result from loss of inhibition[END_REF]. Furthermore, several lines of evidence suggest that surround inhibition (i.e., the inhibition of unwanted movements to perform the desired one) is impaired in dystonia [START_REF] Hallett | Dystonia: abnormal movements result from loss of inhibition[END_REF]. This symptom could be mediated by the reduced influence of the indirect pathway as suggested by the reduction of dopaminergic D2 receptor density observed by PET in primary dystonia (Perlmutter et al, 1997). However, the pathophysiology is probably more complex because microrecordings performed during lead implantation in dystonic patients indicate a decrease in mean discharge rates in both the external globus pallidus (GPe) and the GPi, suggesting a hyperactivity of both the direct and indirect striatopallidal pathways (Vitek et al, 1999). The reduction of GPi activity would, in turn, lead to a reduction of thalamus inhibition and release thalamocortical output. This theory, however, has to be considered with caution, as the reduction of mean GPi discharge rate could in fact be explained by the anaesthetic drugs [START_REF] Hutchison | Pallidal neuronal activity: implications for models of dystonia[END_REF]. Furthermore, it appears that dystonia is related not only to changes in the mean rate of discharges in GPi/GPe, but also to an irregular pattern of pallidal activity that disrupts cortical neuronal activity (Vitek et al, 1999). The role of dopaminergic blocking drugs is crucial in TD. Animal models of TD have shown a hypersensitivity of D1 dopaminergic receptors that could increase the activity of the direct striatopallidal pathway and inhibit the GPi [START_REF] Van Kampen | Dopamine D(1A) receptor function in a rodent model of tardive dyskinesia[END_REF]. However, the blockade by neuroleptics of D2 dopaminergic receptors induces a dysfunction of the indirect pathway that contributes to the hypoactivity of the GPi [START_REF] Casey | Pathophysiology of antipsychotic druginduced movement disorders[END_REF]. Although simplistic, this finding could explain how the longterm intake of antidopaminergic drugs would lead to an increase in cortical neuronal activity and to the occurrence of dystonic movements. However, it must be acknowledged that functional imaging studies of the dopaminergic system have shown an increase or a normal density/affinity of the D2 dopaminergic receptors when dopaminergic drugs had been withdrawn [START_REF] Blin | Striatal dopamine D2 receptors in tardive dyskinesia: PET study[END_REF][START_REF] Andersson | Striatal binding of 11C-NMSP studied with positron emission tomography in patients with persistent tardive dyskinesia: no evidence for altered dopamine D2 receptor binding[END_REF][START_REF] Silvestri | Increased dopamine D2 receptor binding after long-term treatment with antipsychotics in humans: a clinical PET study[END_REF][START_REF] Adler | Amphetamine-induced dopamine release and postsynaptic specific binding in patients with mild tardive dyskinesia[END_REF].

Consequences of Internal Globus Pallidus Stimulation

The second aspect of this study concerns the impact of GPi stimulation on the aforementioned abnormalities of the profile of cerebral activation in TD. Before discussing the PET data, it is important to note that GPi stimulation offers a dramatic improvement of the motor symptoms for all patients. When simply looking at the changes in rCBF, it is very clear that GPi stimulation induces a dramatic and global reduction of cerebral perfusion during motor execution. In particular, the primary motor cortex and the cerebellum activation are transformed from bilateral to unilateral with DBS on, and the DLPFC and inferior parietal lobe activations disappear. Interaction analysis shows more precisely that the positive effect of GPi stimulation on TD is mediated by a reduction of rCBF in the primary motor cortex and DLPFC contralateral to the movement and bilaterally in the cerebellum. This finding indicates that the lateral corticospinal tract and the projection of the cerebellum to the contralateral primary motor cortex as well as the hyperactivation of the prefrontal cortex are directly involved in the pathophysiology of TD, which is also supported by the existence of a positive correlation between the severity of the dystonia and the activation of these areas. It is noteworthy to see that GPi stimulation did not induce any increase of rCBF during motor execution, which is clearly consistent with the suspected pathophysiology of the dystonias (see above). It is also of great interest to note that GPi stimulation did not directly act through a reduction of rCBF in the prefrontal, lateral premotor, and anterior cingulated cortex, all regions that were shown to be hyperactive during motor execution in TD patients, but rather reduced primary motor cortex, DLPFC, and cerebellar activation. This could

NPG_JCBFM_9600610 Q4 Q5 PET study in TD U N C O R R E C T E D P R O O F
suggest that the overactivation of the primary motor cortex, DLPFC, and cerebellum are directly responsible for the occurrence of dystonia, whereas other regions such as the prefrontal, anterior cingulate, and lateral premotor cortex could correspond to compensatory mechanisms playing an inhibitory action on the previously mentioned overactive areas. Such a reduction of brain activation has also been observed when GPi stimulation was applied to primary dystonia [START_REF] Kumar | Globus pallidus deep brain stimulation for generalized dystonia: clinical and PET investigation[END_REF][START_REF] Detante | Globus pallidus internus stimulation in primary generalized dystonia: a H 2 15 O PET study[END_REF]. However, in the study by [START_REF] Detante | Globus pallidus internus stimulation in primary generalized dystonia: a H 2 15 O PET study[END_REF], the reduction mostly involved the prefrontal cortex, whereas in [START_REF] Kumar | Globus pallidus deep brain stimulation for generalized dystonia: clinical and PET investigation[END_REF], the reduction concerned the primary motor, premotor, prefrontal cortex, and anterior cingulate. Differences in the subtype and aetiology of the dystonias may account for these discrepancies in the findings. Taken together, all these studies show that in dystonia, GPi stimulation acts through a massive reduction of excessive brain activation.

In addition, at rest, GPi stimulation produces both a reduction of rCBF in the left primary motor cortex, comparable to that seen during the motor task, and a reduction of rCBF in the SMA and anterior cingulate cortex. This is in line with the existence of abnormalities of brain activation pattern at rest, with an overactivation of the prefrontal and anterior cingulate cortex and cerebellum compared to controls. In addition, this result shows that GPi stimulation induces a global reduction of brain activation restricted not only to motor execution areas. It also suggests (as previously noted in other studies of Parkinson's disease) that the effects of DBS, whatever the target (subthalamic nucleus or GPi), are clearly task-dependent and different (sometimes opposite) at rest and during motor execution [START_REF] Detante | Globus pallidus internus stimulation in primary generalized dystonia: a H 2 15 O PET study[END_REF][START_REF] Limousin | Changes in cerebral activity pattern due tosubthalamic nucleus or internal pallidum stimulation in Parkinson's disease[END_REF][START_REF] Payoux | Decreased [18F]spiperone binding in putamen in idiopathic focal dystonia[END_REF]. This finding has been particularly well illustrated in a study of primary dystonia [START_REF] Detante | Globus pallidus internus stimulation in primary generalized dystonia: a H 2 15 O PET study[END_REF]. Indeed, these authors showed that GPi stimulation increased the rCBF at rest in the DLPFC and thalamus, but reduced the rCBF in the same regions during motor execution. In this study, such a discrepancy was not present, but we did find an opposite action of GPi stimulation on the cerebellum at rest and during motor execution.

To account for these complex (and sometimes opposite) effects, it has been proposed that the changes of brain perfusion induced by DBS are taskspecific and depend on the particular networks engaged in specific tasks. This theory is consistent with the results of animal studies suggesting that striatal-frontal connectivity as well as functional connectivity between different nuclei of the basal ganglia depend on brain state, such as whether the animal is at rest or active [START_REF] Magill | Brain statedependency of coherent oscillatory activity in the cerebral cortex and basal ganglia of the rat[END_REF]. Moreover, on the basis of a review of the evidence from a variety of sources, it has been hypothesized that the mechanism of DBS action is not simply inhibitory or excitatory but depends on more complex modifications of activity in a pathologic network [START_REF] Mcintyre | Uncovering the mechanism(s) of action of deep brain stimulation: activation, inhibition, or both[END_REF]. In dystonia, several studies suggest that GPi stimulation could replace the abnormal and irregular electrophysiological pattern of GPi neuron discharges by a much more regular one that would, in turn, reduce the excess of cortical activation.

To conclude, this study represents one of the first conclusive attempts at a better understanding of TD pathophysiology. Consistent with other forms of dystonia, the occurrence of abnormal movements is explained by an excess of the profile of brain activation, reflecting a loss of selectivity during motor execution. Furthermore, the improvement of TD by GPi stimulation is explained by a major reduction of this brain overflow.

Figure 1 Figure 2

 12 Figure 1 (A) Pattern of activation during motor execution versus rest in TD patients in the off GPi stimulation condition (FWEcorrected P-value p0.05). These areas are displayed on sagittal, lateral, and coronal views of a 'glass' brain. (B) Pattern of activation during motor execution versus rest in TD patients in the on GPi stimulation condition (FWE-corrected P-value p0.05). These areas are displayed on sagittal, lateral, and coronal views of a 'glass' brain.

  group interaction analysis ((T-R) patientOff -(T-R) patientOn )) revealed that bilateral GPi stimulation reduced rCBF during the execution of the motor task in the left primary motor cortex (BA 4) and DLPFC (BA 9) and bilaterally in the cerebellar hemispheres. No significant increase of rCBF was induced by GPi stimulation as assessed by the following contrast: (T-R) patientOn -(T-R) patientOff ).

Figure 3

 3 Figure3Areas of significant decrease of rCBF induced by GPi stimulation during motor execution in TD patients (FWE-corrected Pvalue p0.05). These areas mostly concern the left primary motor cortex and DLPFC and bilaterally in the cerebellum (right-sided cerebellar activation is shown). These areas have been superimposed on axial slices of a single subject brain MRI extracted from SPM 2.

Table 1

 1 Characteristics of the patients

	Patient	Reason for	Disease	ESRS off	ESRS on	Contact	Voltage	Pulse	Frequency	Treatment
	no./sex/age	treatment	duration	stimulation	stimulation		(V)	width	(Hz)
	(years)	with	(years)					(msecs)
		neuroleptics
	1/F/36	Depression	8	78	21	1-/L	2.7	210	130	Amitriptyline
						5-/R	3	210	130	Tetrabenazine
	2/F/59	Depression	7	66	28	1-/L	3.9	150	130	Bromazepam
						5-/R	3.9	150	130
	3/M/56	Depression	4	35	10	1-/L	4.5	90	130	Lorazepam
						5-/R	4.5	90	130	Sertraline
										Valpromide
										Lormetazepam
	4/F/63	Depression	12	72	26	1-/L	3.5	90	130	Clonazepam
						5-/R	3.5	90	130	Amitriptyline
	5/F/43	Depression	6	35	22	1-/L	3.9	90	130	Clonazepam
						4-5-/R	2.9	90	130	Mianserine
										Alprazolam
	Mean ± s.d.:		7.4 (3)	57.2 (21)	21.4 (7)		3.6 (0.6) 126 (51)	130
	51.4 (11.4)
	ESRS, Extrapyramidal Symptom Rating Scale.

Table 2

 2 Brain activation pattern in TD patients without GPi stimulation and control subjects during motor execution

		Areas	Left/right		Stereotactic coordinates
				x	y	z	Z-score	P-value
								corrected
								voxel
	Within-group analysis
	Control subjects	Primary motor cortex (BA 4)	L	À36 À24	68	7.60	0.0001
		Superior parietal lobe (BA 7)	L	À10 À70	58	6.95	0.0001
		Lateral premotor cortex (BA 6)	R	64	8	24	5.81	0.0001
		Anterior cingulate cortex (BA 24)	R	18	0	50	5.25	0.005
		SMA (BA 6)	L	À1	À5	60	5.10	0.01
		Cerebellum (hemisphere)	R	32 À50 À28	6.80	0.0001
	TD patients	Primary motor cortex (BA 4)	L	À41 À19	57	4.85	0.01
			R	2 4 À13	64	4.57	0.05
		Superior parietal lobe (BA 7)	L	À25 À50	50	5.26	0.003
		DLPFC (BA 9)	L	À31	34	30	3.67	0.03 (SVC)
		SMA (BA 6)	L	À1	À3	61	3.52	0.04 (SVC)
		Lateral premotor cortex (BA 6)	R	26	4	53	3.88	0.025 (SVC)
		Inferior parietal lobe (BA 40)	L	À38 À36	49	5.05	0.008
			R	5 9 À32	30	4.50	0.08
		Anterior cingulate cortex (BA 24)	R	12	1	38	4.20	0.02 (SVC)
		Putamen	R	31	12	4	3.38	0.05 (SVC)
		Cerebellum (hemisphere)	L	À34 À65 À32	4.75	0.03
			R	3 4 À54 À28	4.91	0.015
		Cerebellum (vermis)		À3 À71 À23	5.42	0.001
	Between-group analysis
	Control subjects >	None
	TD patients off at rest
	TD patients off >	DLPFC (BA 9)	L	À32	2	38	7.26	< 0.0001
	control subjects at rest
		Medial frontal gyrus (BA 10)	L	À32	50	22	6.07	< 0.0001
		Superior frontal gyrus (BA 10)	L	À20	70	À6	5.13	0.003
		Anterior cingulate cortex (BA 24)	L	À2	À6	44	4.95	0.007
		Inferior frontal gyrus (BA 44)	R	48	10	30	6.25	< 0.0001
		Dorsal frontal gyrus (BA 10)	R	8	48	22	6.07	< 0.0001
		Anterior cingulate cortex (BA 32)	R	10	22	30	5.57	< 0.0001
		Cerebellum	L	À40 À46 À34	7.05	< 0.0001
			R	3 4 À14 À48	6.47	< 0.0001
	Control subjects >	None
	TD patients Off during motor execution
	TD patients Off >	Medial frontal gyrus (BA 11)	L	À22	34 À16	4.17	0.02 (SVC)
	control subjects during motor execution
		Superior frontal gyrus (BA 8)	L	À25	8	51	3.29	0.05 (SVC)
		Anterior cingulate cortex (BA 24)	R	12	À5	29	3.67	0.03 (SVC)
		Lateral premotor cortex (BA 6)	R	24	16	55	3.47	0.04 (SVC)
	BA, Brodmann area; DLPFC, dorsolateral prefrontal cortex; GPi, internal globus pallidus; L, left; R, right; SMA, supplementary motor area; SVC, small volume
	correction; TD, tardive dystonia.

Table 3

 3 Changes of brain activation induced by bilateral GPi stimulation in TD patients

	Condition	Areas	Left/right			Stereotactic coordinates
				x	y	z	Z-score P-value correction voxel
	Rest
	Increased activation	Occipital cortex (BA 19)	R	28 À78	28	4.59	0.05
	induced by GPi stimulation Superior parietal lobe (BA 7)	L	À28 À50	56	3.68	0.05 (SVC)
		Cerebellum (hemisphere)	R	18 À72 À30	3.89	0.04 (SVC)
			L	À38 À36 À18	4.05	0.03 (SVC)
	Decreased activation	Primary motor cortex (BA 4)	L	À58	À4	42	4.24	0.001 (SVC)
	induced by GPi stimulation Anterior cingulate cortex (BA 24,32)	L	À4 À12	34	5.38	0.002
		SMA (BA 6)	R	2	32	22	4.41	0.001 (SVC)
			L	À8 À12	80	5.56	0.001
			R	1 0	À4	78	4.58	0.05
	Motor execution
	Activation profile in	Primary motor cortex (BA 4)	L	À18 À32	54	3.51	0.05 (SVC)
	on-stimulation condition	Superior parietal lobe (BA 7)	L	À31 À65	51	4.07	0.01 (SVC)
		Medial frontal gyrus (BA 10)	R	38	55	À6	3.58	0.035 (SVC)
		SMA (BA 6)	L	À10 À13	71	4.46	0.001 (SVC)
			R	3	4	69	3.36	0.03 (SVC)
		Lateral premotor cortex (BA 6)	R	13	À1	68	4.71	0.036
			L	À17 À13	69	3.88	0.02 (SVC)
		Anterior cingulate cortex (BA 24)	L	À4	1	40	3.78	0.025 (SVC)
		Cerebellum (hemisphere)	L	À39 À48 À36	3.35	0.05 (SVC)
	Off > on	Primary motor cortex (BA 4)	L	À36 À32	49	3.57	0.035 (SVC)
		DLPFC (BA 9)	L	À31	34	31	3.20	0.05 (SVC)
		Cerebellum (hemisphere)	L	À17 À50 À40	3.52	0.035 (SVC)
			R	2 4 À54 À28	3.47	0.04 (SVC)
	On > off	None

BA, Brodmann area; DLPFC, dorsolateral prefrontal cortex; GPi, internal globus pallidus; L, left; R, right; SMA, supplementary motor area; SVC, small volume correction; TD, tardive dystonia.

Table 4

 4 Positive covariation of rCBF with the severity of the dystonia activations were found in the DLPFC, premotor cortex, anterior cingulate cortex, cerebellum, and putamen(Ceballos-Baumann et al, 1995a; Playford

	Areas	Left/right			Stereotactic coordinates
			x	y	z	Z -score	P-value corrected voxel
	Anterior cingulate (BA 24)	L	À1	30	24	5.84	0.0001
	Superior parietal lobe (BA 7)	L	À10	À52	48	4.92	0.013
		R	3 6	À76	54	4.75	0.028
	Primary motor cortex (BA 4)	L	À52	À10	34	4.74	0.029
		R	2 4	À22	65	3.79	0.05 (SVC)
	SMA	L	À8	À4	65	4.51	0.03 (SVC)
		R	8	À8	65	4.51	0.03 (SVC)
	Superior frontal gyrus (BA 10)	L	À16	70	8	4.38	0.04 (SVC)
	Cerebellum	R	40	À94	À20	3.55	0.05 (SVC)
		L	À48	À82	À20	4.46	0.05 (SVC)
	BA, Brodmann area; L, left; R, right; rCBF, regional cerebral blood flow; SMA, supplementary motor area; SVC, small volume correction.

& 2008 ISCBFM All rights reserved 0271-678X/08 $30.00 www.jcbfm.com

Journal of CerebralBlood Flow & Metabolism (2008) 00, 1-12

Acknowledgements

We thank Dr Leonora Wilkinson for English corrections. Group information: Members of the French Stimulation for Tardive dystonia (STARDYS) Study Group include Nantes: P Damier, MD, PhD, P

This study has been supported by a grant from the Programme Hospitalier de Recherche Clinique Re ´gional 2004.

Disclosure

The authors state no conflict of interest.


Théobald De Riberolles
email: theobald.deriberolles@activus-group.fr

Jiefu Song
email: jiefu.song@activus-group.fr

Yunkai Zou
email: yunkai.zou@enac.fr

Guthemberg Silvestre
email: silvestre@enac.fr

Nicolas Larrieu
email: nicolas.larrieu@enac.fr

Characterizing Radar Network Traffic: a first step towards spoofing attack detection

Abstract-An Air Traffic Management (ATM) Surveillance System is used to provide services to perform Air Traffic Control (ATC) (e.g., horizontal separation between aircraft). This sytem carries messages containing aircraft's position from a collection of radars of an Air Navigation Service Provider (ANSP) through its network. Then Radar traffic is one of the most important sources of information for this system. The format of the radar messages is defined by a specific application-layer protocol entitled ASTERIX. The evolution of the security policy and technologies used makes existing radar systems, once considered safe, now potentially open to attack. Both safety and security of ATM system could be impacted by any kind of attack into the network traffic, who could maliciously modified information about aicrafts, in particular thanks to Spoofing Attack. To counter this risk, there is need to detect intrusion and then to have anomaly detection modules for this safety-critical network traffic, that can be deployed in a security appliance.

In order to design this module, we did a statistical analysis to have an overview of the traffic to better know what we need to protect. Specifically, we studied radar network traffic in order to extract high level statistic characteristics of normal radar traffic. This allowed us to identify a trend in the evolution of this traffic. We were then able to inject a spoofing attack (when a malicious party impersonates another device or network user for the purpose of altering the data) into this traffic to modify the nominal traffic. Thereafter, we were able to detect this attack using our method, which consists of the use of a machine learning detection method, using a Long-Short Term Memory (LSTM) mechanism. This is the subject of our paper, an overview of radar traffic and a method to detect spoofing attack in this traffic. This would help to develop an ATM IDS especially as this type of attack could remain invisible for air traffic controller.

INTRODUCTION

Surveillance information is the key data of the air navigation service providers, which has the goal to assure the safety of the air passengers and the functioning of Air Traffic Control (ATC). Consequently, in the ATM Surveillance System, the Radar System is one of the most important components. For doing that, an air traffic controller relies on an Air Traffic Control system which relies on radar. Airborne Control Radars are remote-sensing sensors used to locate, track and guide aircraft in the flight space around an aerodrome or in larger areas. They collect information about aircraft including its position, its speed, its identifier, the type of aircraft and everything that can be useful to a controller. When an aircraft enters a given area, it is detected by a sensor, the radar. The radar sends this information over a private network. On this network several SIRs (Server of Radar Information) send these packets to different navigation centers. In this center the track of the aircraft is rebuilt, and is displayed on a screen facing the controller to guide the planes. All these elements form the ATC system which is described in Figure 1.

By processing and correlating the information from multiple radars and flight plans in calculators in navigation centers the system provides more precise real-time positions of each aircraft and allows an air traffic controller to ensure the safety of passengers by avoiding possible collisions, and guaranteeing horizontal separation.

To transmit radar data, ATC systems use an open-source protocol to transport the radar informations, ASTERIX [START_REF] Eurocontrol | EUROCONTROL Specification for Surveillance Data Exchange -Part 1[END_REF]. The informations about aircraft measurement are encapsulated in an Asterix message which is sent from the radar to the operations center. It was designed as an Application protocol of the TCP/IP model for communication media with limited bandwidth. This is why it is able to transmit all the information needed, with the smallest overhead possible. ASTERIX messages are commonly transported into either IP packets or Ethernet frames. Figure 2 depicts an overview of an Asterix message format. ASTERIX is an extensible format with different data categories. Each of them carries one type of information, such as target reports from radars, aircraft tracks, and various system status messages.

Despite the widespread use of ASTERIX messages to transport safety-critical ATM information [START_REF] Dzunda | Accuracy of the passive tracking systems[END_REF], this protocol does not specify any security mechanism, which exposes the entire system to vulnerabilities. In fact, this lack of security has already been exploited by Casanovas et al. [START_REF] Casanovas | Vulnerability of radar protocol and proposed mitigation[END_REF] who developed a tool that makes a Man In The Middle attack to manipulate ASTERIX messages. Moreover, the dependence of the global civil aviation on computer systems on a daily basis is growing as more and more modern airport and aircraft are commissioned and stakeholders are seeking to meet the growing demand for digital and computer service [START_REF] Lim | Emerging threats from cyber security in aviation-challenges and mitigations[END_REF]. On the one hand, digitalization technology tools and systems enhance interoperability, but on the other hand their uses can pose serious risks to aviation cyber security. Therefore, it is necessary to maintain a high level of attention to the possible future developments of cyber-threat in this area [START_REF] De Zan | The defence of civilian air traffic systems from cyber threats[END_REF]. This situation shows us that cyber-attacks are eventually possible to maliciously change the information about aircraft, especially with spoofing attacks [START_REF] Casanovas | Vulnerability of radar protocol and proposed mitigation[END_REF]. The modification of information from a spoofing attack can be fine enough to be invisible by a human. Therefore, there is an increasing need to provide additional security mechanisms for radar data, by detecting anomalies in the system.

Despite being a open-source ASTERIX protocol,ASTERIX messages transporting ATM information are unknown by the off-the-shelf Intrusion Detection System (IDS), they are handled as conventional traffic. It is therefore necessary to learn more about these kind of messages to detect anomalies. However, to our knowledge, the literature has not yet addressed the issue. It is therefore essential to study the radar network traffic itself to have characterization of radar traffic useful for an IDS.

The paper aims to highlight characteristics from radar traffic data and to show that detecting a spoofing attack in this traffic is possible. We work with real radar traces collected inside the operational network of the French ANSP (DSNA -Direction des Services de la Navigation Aérienne).

The paper is organized as follows: a State of the art related to ATM/radar system is presented in Section 2, specificities of the radar operation are described in Section 3. In Section 4, an overview of radar traffic with the description of the dataset and a coarse-grained analysis of radar information is presented. In Section 5 an example of a spoofing attack and a method of detection is shown. Final remarks, and a word about future work conclude this paper.

STATE OF THE ART

In the literature, we find little work on radar data and the AS-TERIX protocol itself. Standards developed by Eurocontrol can be found on its website2 . The control authority presents there the protocol itself and its specification.

In the ATM field, the major research has been focused on air traffic delay or trajectory by using radar data, but less on radar network itself, as it is investigated by Bosson et al. in their paper "Supervised Learning Applied to Air Traffic Trajectory Classification" [START_REF] Bosson | Supervised Learning Applied to Air Traffic Trajectory Classification[END_REF]. Moreover, according to Bosson et al. [START_REF] Bosson | Supervised Learning Applied to Air Traffic Trajectory Classification[END_REF], other works focused on the anomaly detection are focused on aircraft behavior more than on the network traffic, thanks to methods based on machine learning. Bosson et al. [START_REF] Bosson | Supervised Learning Applied to Air Traffic Trajectory Classification[END_REF] show that Gariel et al. [START_REF] Gariel | Trajectory clustering and an application to airspace monitoring[END_REF] applied trajectory clustering techniques to GPS radar tracks in order to identify operational aircraft behaviors and their variability. Conde et al. [START_REF] Rocha Murca | Trajectory clustering and classification for characterization of air traffic flows[END_REF] developed a data mining framework for air traffic flow characterization to identify aircraft trajectories and ensemble-based methods to detect flight non-conforming behaviors. Evans et al. [START_REF] Evans | Predicting the Operational Acceptability of Route Advisories[END_REF] applied various data mining techniques to flight plan amendment data to train a predictor of operational acceptability for airborne reroute advisories.

Regarding air traffic data itself, there is little work about anomaly detection. In his thesis, Nanduri [START_REF] Nanduri | Anomaly Detection in Aircraft Performance Data[END_REF] deals with this type of anomaly detection, as detecting atypical flights and anomalies based on statistical signatures or detecting anomalies in the data in the vector space. In their document Üsing ÄSTERIX in accident investigation [START_REF] Farrell | Using ASTERIX in accident investigation[END_REF] Farrel and Schuurman explain that radar data are often used for investigation of air accidents, and discuss ASTERIX data for safety use. Nevertheless, Casanovas et al. [START_REF] Casanovas | Vulnerability of radar protocol and proposed mitigation[END_REF] present a proof of concept about the vulnerability of the ASTERIX protocol. They were able to do Man In the Middle attack dedicated to this traffic in order to delete, modify or add aircraft in traffic. This study highlights the fact that there is a need to have additional level of security against of an attack from inside the network.

To the best of our knowledge, ours is the first study of a characterization of radar network traffic focusing on protocol itself in order to identify characteristics of traffic radar data in order to develop a security module dedicated to ASTERIX.

In this paper, we focus on a spoofing attack. A spoofing attack, is a type of Man In The Middle attack which is a type of attack in which the attacker manages to get between the transmitter and the receiver. Thereby he has the ability to read, insert and modify the messages that are being sent between the two hosts without them knowing that the link has been violated. Once the attacker is in the middle of the link, he has the capacity of sniffing and intercepting the messages that are exchanged between the victims. When he uses this position to impersonate another device or user on a network, by sending a packet in their place, by modifying or not the information, it is called a spoofing attack. There are several different types of spoofing attacks that malicious parties can use to accomplish this. Some of the most common methods include IP address spoofing attacks, ARP spoofing attacks and DNS server spoofing attacks.

ATC NETWORK OPERATION

Figure 1 shows schematically the operation of an ATC network. The information about aircraft is retrieved by two types of radar :

• Primary Radar: The signals are the echoes due to the reflection on the aircraft. There is no more information than the presence of the aircraft, or other physical target, on the controller's Plan View Display (PVD)

• Secondary Radar : The signals are obtained from the transponder carried on the aircraft. The radar emits several impulsions and the transponder answers to this interrogation. Depending on the mode, the transponder will give information as the position, the time, the id or other about the aircraft. Then, the radar will emit two types of messages in the network : detection messages, the information (horizontal/vertical location, time, id ...) given by the aircraft and service messages specific to its operation.

The radar encapsulates this information in an ASTERIX Packet and sends it in the operational network. From this network, the ACC retrieves radar packets about their sectors. Thanks to a calculator, they concatenate the information of the different radars visualizing the aircraft, and they obtain an accurate measurement of the aircraft. This accurate measure is sent to control working positions where they are displayed on the radar screen of the controller. Using data from flight plans, it allows the controller to do control en-route. To do control in approach, the tracks are sent from ACC to the airport, where the control is done after a passage in a new computer that compiles different data, which allows for more accurate information.

As we explain in the Introduction, an Asterix message is composed of one or more blocks of data, it is the base of ASTERIX messages. Each message contains the type of information transmitted, and the detail of the information sent by the radar.

The type of data transmitted by the protocol is standardized and classified into ASTERIX categories. The CAT identifier defines what category is used and allows us to know what kind of information is transmitted. For our case of ATC use, only two types of categories are used: the detection categories and the service categories.

• The detection categories, are for tracked plots that represent the traces of an airplane. The information transmitted in the block with these types of categories are recordings about aircraft to define a map of the sky.

• The message of service categories transmit information about the radar itself. They send information for each end of a sector (it is the coding of the antenna rotation).

With the use of Primary Surveillance Radar (PSR) and Secondary Surveillance Radar (SSR), only four categories are used:

• Two for detection: category 01 for PSR and 48 for SSR ).

• Two for messages of service: category 02 for PSR and 34 for SSR).

The specifications for the ASTERIX data categories (CAT) form part of the ASTERIX Standard Document (available through the EUROCONTROL website 3 ). With the ASTERIX protocol, the identifiers of the radars are represented by destination addresses, and source addresses are the last SIR (Server of Radar Information identifier), so we used Ethernet destination address to distinguish the different radars of our collection.

Measurement methodology

The traffic was captured with a TCPDump tool and saved in PCAP format. We used these raw files for our analysis.

We used the libpcap library to read the raw files and the ASTERIX python module developed by Damir Salantic for Croatia Control Ltd. to parse EUROCONTROL ASTERIX protocol data.

Coarse-grained analysis of radar information

This analysis is a coarse-grained level of analysis of our network traces. The goal of this study is to highlight the idea that there exists a recognizable trend away from our network traces which will help us to define rules/signatures about normal radar traffic.

In the radar data that we are studying, we know that there are categories of services that will regularly send messages on the operation of the radar (02 for PSR and 34 for SSR) and detection categories that will allow providing information about aircraft (01 for PSR and 48 for SSR). In our dataset, we have both PSR and SSR. When we look at the distribution of service categories and detection categories, as shown in Figure 3, we can see that the detection category is in majority. The ratios are of the order of 55% detection for 45% of services for PSR radar and of 75% detection against 25% of services for SSR radar.

Since the detection messages represent aircraft information and service messages, operating messages on the radar, we expect the proportion of the detection categories to be higher than that of the service categories, and that the data radar will contain more messages on the aircraft than on their operation. The results of Figure 3 thus confirms this hypothesis that the detection data represent a majority of the radar traffic.

For the rest of the paper, we will focus mainly on the study of SSR radars because they represent a majority share in the French ATM. We will therefore be dealing with category 48 as detection data and category 34 for services data.

We have seen that the detection data were majority in our data. Nevertheless, we are interested in the impact that these data can have on evolution of the traffic. We have differentiated the evolution over time of detection data and services data for one day. The results are shown in Figure 4.

In red is represented the evolution in time of services data and in green the detection. We can see that for the services data, we have a continuous evolution whereas for detection data we have variation in time. This is because service messages are sent regularly. Indeed, a radar zone is divided into thirtytwo sectors and each time the radar finished a zone, it sends a service message to say in which zone it observes. For our case, the radars have a rotation time of 4 sec. So, every 4 sec., we observe 32 messages of services data. If it is not the case, there is an anomaly somewhere.

With this observation for the rest of the section, we will focus on the evolution of the detection data in times which have variations.

Since network radar data represent the airspace network image at a specific point in time, we had the idea that the radar data traffic flow will follow the trend of air traffic. It has been seen in numerous papers [START_REF] Schultz | Weather Impact on Airport Performance[END_REF], [START_REF] Barnhart | Demand and capacity management in air transportation[END_REF], [START_REF] Mannstein | Groundbased observations for the validation of contrails and cirrus detection in satellite imagery[END_REF] that in a normal day, the air traffic sees a peak of activities at the beginning of the day, at the end of the morning, at the beginning of the afternoon and in the evening, then it has a lull during the night to then resume the same trend. Thus, for radar data network flows, we expect to observe a trend that will be repeated over the days and the different radars that we can observe. To try to observe this trend, we were interested the evolution of the number of packet radars during a day.

We observed the evolution of detection packet for the first 15 days of May for a given radar. The result is given in Figure 5.

We can visually observe that the radar traffic seems to follow the same trend as the air traffic flow, with a drop in activity during the night, a peak high at 2 am, a rather stable variation during the day with peaks of activity and a drop in activities in the evening. This result is due to the fact that the radar data correlates with the aerial activity. Thus, if the air traffic follows a trend, we must find the same trend in the flow of radar packets.

The visualization of this trend is clearer in Figure 6, where we traced simultaneously over a period of 24 hours the evolution of detection packets in time for the first fifteen days of May.

Figure 6 reinforces the idea that indeed, we have a trend that seems to follow the same trend as air traffic with a drop in activity during the night and peaks during the day, and that, moreover, this trend will be similar in time since we find similarities through time.

Visually, we observe a trend that seems to be similar depending on the day. Figure 7 compares the evolution of the number of packets for a duration of one day for two days to one week apart, after normalization of the data. It confirms that the two curves overlap and have similar peaks. The cosine similarity for these two data is 0.97, which confirms to us that the two evolutions are very close. This reinforces our hypothesis of a trend that would be repeated every day.

Thus, the evolution in time for a radar will be similar through the days, because the state of the sky will be similar every day for this radar. However, we wondered if this was the case for all the radars for which we have data and if this model will be similar between the different radars.

To answer this question, we used Min and Max measurements as well as Mean. We measured the min and max of the number of detection data for each day over a period of two months, and we also averaged for each radar. This gives us, for a given radar, three different curves: a curve of the Min, a curve of the Max and a curve of the Mean. We have compared these twenty-three data among them, for the twenty-three SSR radars for which we have data, and we have measured the cosine similarity of the averages. The results are given in Figure 8 and we can see that the value of the cosine similarity is close to 1 each time, which means that the averages are similar to each other for the different radars.

Therefore, the trend that we observe from the beginning is a trend that will be repeated over time and that we will be able to find for the different radars. It is characterized by the average of this evolution through time that we were able to draw with a tolerance threshold which is defined by the Min and Max that we could observe.

With the help of these average values, we are able to define a trend that we will be able to find every day on all radars and that will allow us detect anomalies. In building this trend over a large time value and from a dataset that has been characterized without any anomaly, we can say that from the moment we move away from this trend, more or less the values of threshold of MIN and MAX, we can consider that there is potentially an anomaly.

SPOOFING ATTACK DETECTION

In this section, we will consider the spoofing attacks, that is, artificially modify data in the dataset.

Methodology of attack

We used a python module: pygame which, coupled with an ASTERIX parser, allowed us to visualize the radar traffic. To manipulate radar data, we used an internal Scapy (a packet manipulation tool for computer networks) module. To operate the attack, we replayed a radar dataset from our dataset, with the TCP replay tool. Then, we visualized this dataset with our tool. We placed ourselves between the transmission and the visualization as an attacker (as an attack Man In the Middle). We received all the data from the transmitter and we re-transmitted it as is to the receiver. So we had at first a normal visualization of the dataset, with the representation of the planes in the sky, as shown in Figure 9. At some point, we decided to change the trajectory of an aircraft, for this example it is the one with the TPN (Track Plot Number) 121 to divert it to the West (offset by about 45 degrees). So we launched a scapy script that will modify in real time the position (Rho and Theta coordinates) of the aircraft, and sent this new data to the receiver. The result is a visual deviation, on the screen, of the aircraft identified with the TPN 121 to West, as shown in Figure 10.

Our goal is to detect such spoofing attacks. The idea of our system of detection is to predict the time series and compare the predicted value with the received value.

Method of detection

Because the Recurrent Neural Network (RNN) has a certain short-term memory advantage, it is often used as the preferred neural network for training time series. However, when the length of the sequence data exceeds a certain range, the data trained by the RNN will have a serious problem of gradient disappearance, which will lead to the training stop. That is It is difficult for RNN to effectively use this long history information because of its long length. This, RNN cannot learn the characteristics of long-term dependence. To solve this problem, Hochreiter and Schmidhuber first introduced the Long-Short Term Memory (LSTM) mechanism in [START_REF] Hochreiter | Long short-term memory[END_REF].

Since then, researchers have also proposed a number of variants of LSTM, the most popular of which is described by Graves and Schmidhuber [START_REF] Graves | Framewise phoneme classification with bidirectional LSTM and other neural network architectures[END_REF] in 2005.

The LSTM architecture consists of memory cells used to learn long-term modes, each cell containing its current state and three non-linear gates: the forget gate, the input gate, and the output gate. The forget gate is responsible for determining how much memory information to forget. It is determined by a nonlinear function that outputs a number between 0 and 1, where 0 means forgetting all information in memory, and 1 means retaining all information in memory. The input gate is responsible for deciding how to update the old cell state, ie, the new information is selectively recorded in the cell state. The output gate is responsible for deciding how much memorable information to pass to the next cell. The structure of the LSTM unit is shown in Figure 11.

Detection

In this paper, we use the LSTM neural network to predict the radar time series. After the model is trained, the correct data set is used to obtain the residual of the predicted value and the true value, and then calculate the statistical characteristics of the residual (the mean is denoted as µ and the variance is denoted as σ). The abnormal score is defined as the difference between the test dataset residual and µ, and the abnormal threshold is defined as 3σ. During the test phase, if the input time series contains an abnormal sequence, the abnormal score may exceed the threshold, thereby achieving the effect of anomaly detection.

We use the form of sliding window to predict the radar sequence. Specifically, we choose a window with a length of 10, and the training input and output forms are shown in Table 1. Use the first 10 data to predict the 11th data, 2 to 11 to predict the 12th data, and so on. The input time series is a window composed of 4-dimensional vectors, each of which contains the TPN, TIME, RHO, and THETA (RHO and THETA are measured positions of an aircraft in local polar coordinates) information of the aircraft.

We have taken the case of 10 different aircraft and injected them with abnormal data. In particular, we modified the position information of these aircraft at [100, 105], 45 degrees for THETA and 25 nautical miles for RHO respectively. As can be seen from the Figure, the method can effectively detect abnormal sequences, and the visualization effect is remarkable.

• • • • • • [n,n+9] [n+10]

CONCLUSION AND FUTURE WORK

The work that we conducted allowed us to highlight characteristics of radar network traffic that we will be able to find over time after the radar, which is a normal data signature basis. From these characteristic signatures, we will be able to set thresholds, based on statistical measures. As a result, we are taking a first step towards the development of a detection system dedicated to radar data. In addition, these characteristics allow us to better know the radar traffic, which will allow us, thereafter, to have an anomaly injection tool that will take into account these characteristics. Nevertheless, with our tool, we are already able to inject anomalies by making a spoofing attack, which will modify the measurements of an aircraft. Thus, we have developed a machine learning method that is able to detect this attack in a radar traffic. This is a first step to move towards the development of a dedicated detection module for ATM networks.

Several difficulties have arisen to develop our tools. Especially for the injection tool, because there are no data manipulation tools in ASTERIX, we had to develop our own, the same for the visualization tools, as we do not have on-site screen radar control, we had to develop our own visualization tool. Moreover, since the ASTERIX traffic was not studied in itself, it was necessary to find what elements could be characteristic of this traffic and which elements it would be relevant to modify. Finally, as we rely on real traces, we had to take into account all the errors that we can encounter in the traces.

For future work, we intend to develop other dedicated attacks to test our methods. The idea is to make the finest possible attacks and develop them with the controller partnership, in order to be closer to an operational context and expectations on the ground. To do this, we will work closely with ATM professionals and we will test our tools of injection and detection on networks and machines close to an operational context in a real-time context. This will enable us to better characterize the actual traffic and to be able to test the reaction of the tools already in place on the operational network, as well as to test the controllers' response to an unknown attack. This will allow us to refine our rules for the development of the dedicated detection system.

Guthemberg Silvestre is assistant professor in the TELECOM research team of ENAC (French Civil Aviation University). He has a PhD in computer science from UPMC Sorbonne Universités. He is broadly interested in the areas of distributed systems and computer networks. In the recent years, he has conducted research on distributed algorithms, replication and consistency models in dynamic networks.

1 .

 1 INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2. STATE OF THE ART . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 3. ATC NETWORK OPERATION . . . . . . . . . . . . . . . . . . . . . . . . 3 4. OVERVIEW OF RADAR NETWORK TRAFFIC . . . . . . . . 3 5. SPOOFING ATTACK DETECTION . . . . . . . . . . . . . . . . . . . . . 5 6. CONCLUSION AND FUTURE WORK . . . . . . . . . . . . . . . . . . 6 7. ACKNOWLEDGMENT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 BIOGRAPHY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Figure 1 .

 1 Figure 1. Schema of the ATC system.

Figure 2 .

 2 Figure 2. An overview of ASTERIX message format.

3

  https://www.eurocontrol.int/services/asterix

Figure 3 .

 3 Figure 3. Distribution of Service (red) and Detection (green) data in our dataset.

Figure 4 .

 4 Figure 4. Evolution of services and detection data in a day.

Figure 5 .

 5 Figure 5. Evolution of detection data during the first 15 days of May.

Figure 6 .

 6 Figure 6. Evolution of detection data during one day the first 15 days of May simultaneously.

Figure 7 .

 7 Figure 7. Comparaison of two days.

Figure 8 .

 8 Figure 8. Heatmap of cosine similarity score between the mean of the trend for the 23 radars.

Figure 9 .

 9 Figure 9. Visualization of a normal traffic.

Figure 10 .

 10 Figure 10. Visualization of a spoofed traffic.

Figure 11 .

 11 Figure 11. The repeating module in an LSTM contains four interacting layers

Figure 12 .

 12 Figure 12. Example of an aircraft after injecting a spoofing attack.

Figure 12

 12 Figure 12 represents the abnormal score of an aircraft (the situation of the remaining aircraft is similar) after injecting the attack. Modified sequences are marked in red.

Nicolas

  Larrieu is full professor in the TELECOM research team of ENAC (French Civil Aviation University). He has a PhD in computer science from University of Toulouse. Dr. Larrieu works on secure communication architectures. He is also interested in Intrusion Detection System for environment with strong constraints. His field of expertise is related to civil aviation networks and embedded systems such as aircraft or UAV. Yunkai ZOU is a graduate student in the Sino-European Institute of Aviation Engineering at Civil Aviation University of China. He is currently conducting a PFE internship in TELECOM research team of ENAC (French Civil Aviation University). His research interests include security of avionic systems and machine learning.

TABLE OF CONTENTS

 OF

Table 1 .

 1 Example of sliding window

	Input data number Forecast data number
	[1,10]	[11]
	[2,11]	[12]

https://www.eurocontrol.int/services/asterix

ACKNOWLEDGMENT

We would like to thank DGAC DTI -the French innovation department of the navigation operator -for providing operational traces of their network to create our data set. The work for this paper is carried out as a part of a thesis funded by Activus-Group, a French company and ANRT, a French national association whose goal is to develop research in the private sectors.

BIOGRAPHY[

Théobald de Riberolles is a PHD student in the the company Activus-Group and in TELECOM research team of ENAC (French Civil Aviation University). He has a Master's degree in Telecommunications and Networks form University of Toulouse. Théobald is working on a thesis related to network security, machine learning and Air Traffic Management.

Jiefu Song is currently chief R& D officer in Activus Group (France) and associated researcher at the IRIT research center (CNRS UMR 5505). He received a PhD degree in computer science from the University of Toulouse (2017). His research interests cover many aspects of the next generation of data management systems, with a focus on conceptual modeling and exploitation of knowledge graph. His publications appear in major national and international journals and conference proceedings.