Julie Brun Bjørkheim

Kristoffer Berg

Frida Kvamme

Tiril Eid Barland

Annette Alstadsaeter
email: annette.alstadsater@nmbu.no

Andreas Økland
email: andreas.okland@nmbu.no

Kristo↵er Berg

Increasing Cross-Border Ownership of Real Estate: Evidence from Norway

Keywords: Globalisation, Real estate, Foreign Ownership, Tax Havens JEL Codes: R39, F21, H26

This paper is the first to estimate the full extent of foreign-owned commercial and residential real estate in a country, including both direct and indirect ownership. We utilise unique Norwegian administrative data with reliable market value estimates and country-level ownership information. Overall, 2 percent of Norwegian real estate assets were foreign-owned in 2017, while this share amounts to 10 percent for assets owned by Norwegian corporations. Foreign ownership has increased over the last decade, and ownership from tax havens even more rapidly. Ownership from neighbouring countries and Luxembourg is especially large.

Introduction

Globalisation has opened real estate markets to foreign investors, but little is known of the full magnitude or of the anatomy of foreign ownership in real estate markets. NGOs and news organisations have documented purchases of expensive real estate by foreign buyers. However, it is unclear whether these eye-catching stories are representative for the total foreign ownership. Recent research is just starting to shed light on the anatomy and country distribution of o↵shore real estate ownership, either through shell companies as documented in London (Bomare and Le Guern Herry 2022), of residential real estate as documented in France (Morel and Uri 2021), or in tax havens like Dubai (Alstadsaeter, Planterose, Zucman, and Økland 2022).

We provide the first comprehensive overview of the stock and development of foreignowned real estate in a country, utilising de-identified, administrative data on Norwegian real estate for the period of 2011-2017, both corporate-owned and individually owned. We combine tax administration's annual estimates of the market value of real estate, both residential and commercial, with detailed ownership information on both individual and firm level, and with country-level information on foreign ownership. We find that overall, 2 percent of the value of Norwegian privately held real estate are owned by foreigners at year-end 2017, while this share amounts to 10 percent when we zoom in at real estate owned by corporations. Further, we find that foreign share of corporate-owned real estate has been increasing over the last decade. [START_REF] Bomare | Automatic exchange of information and real estate investment[END_REF] Ownership from tax havens has increased even more rapidly.

Insight into the magnitude and structure of foreign ownership of real estate is of great importance to tax administrations, policymakers, and society. First, there are indications that inflow of foreign capital may increase prices in property markets (Sá and Wieladek (2015); Sá (2016)). Second, ownership transparency is obfuscated for both government authorities and local communities when the ownership chain involves a foreign corporation. This means that owners that are unknown to stakeholders, either because of distance or secrecy, might wield influence over important infrastructure and development of urban areas and rural communities without being held accountable, which is in a particular worry in times of political instability. The obfuscation also makes foreign ownership of real estate a red flag for those monitoring money laundering risk (OECD (2019); FATF (2007); European Parliamentary Research Service (2019)). Real estate is a well-known tool for tax fraud and money laundering (Collin, Hollenbach, and Szakonyi 2022). Lastly, increasing international automatic exchange of financial information between tax administrations has made it harder to hide true ownership of o↵shore financial assets over the last years. However, this information exchange does not include real estate, making real estate investments an even more attractive tool for obfuscating true ownership of wealth (Bomare and Le Guern Herry 2022).

The existence of a centralised property register and annual estimates of the market value of real estate for tax purposes2 makes Norway an ideal laboratory to get a more complete overview of foreign ownership of real estate in Western countries. More importantly, the tax administration collects detailed information on the owners of shares in Norwegian corporations, including their residence country. The shareholder register covers all shareholders of all corporations and enables us to look through domestic group structures and the invisibility cloak that the domestic shell companies usually represents. We are thus able to single out all real estate owned by either foreign corporations and individuals, and attribute most of the privately owned real estate to the first country of location after crossing the Norwegian border.3

In our analysis, we utilise the same precisely imputed market values as used by the tax administration for wealth tax assessments. This is complemented with the financial statements of listed corporate groups, which are not subject to report imputed market values for wealth tax purposes. We estimate the total value of privately owned real estate to USD 1,057 billion in 2017.

The data reveal sizeable foreign ownership. 2 percent (USD 24 billion) of the Norwegian real estate owned by corporations and individuals at year-end 2017 is traced to foreign owners. Foreign ownership is most prevalent in the real estate owned by corporations. The total value of real estate owned by foreigners through Norwegian corporations is more than three times larger than the total value of the real estate owned directly by foreigners -18.8 billion vs. 5.3 billion, even though most Norwegian real estate is owned directly by individuals and reported in the personal tax return. The foreign ownership share is thus 10.5 percent and 0.6 percent among corporations and individuals respectively. Although not all foreign ownership is problematic, our estimates illustrate the scope of the potential negative consequences of foreign ownership of real estate.

We zoom in on the sample owned by corporations and uncover two underlying trends: First, foreigners own an increasing share of the Norwegian real estate owned through corporations.

More than 10 percent of corporate owned real estate was foreign-owned in 2017, a marked increase from around 6-7 percent in the years from 2011 to 2014. Second, the share owned from tax havens is growing even more rapidly. In 2011, 31 percent of the foreign-owned real estate was owned through tax havens. This increased in the following years, to 38 percent in 2017. Luxembourg ownership accounts for 3/4 of this increase. Only Norway's neighbouring country Sweden was a larger owner than Luxembourg in 2017, when we look at all real estate ownership, both personal and through corporations.

The United Kingdom, Finland, and the United States then followed. Half of the top 20 jurisdictions are well-known tax havens. The ownership through tax havens becomes nationals. But we, along with domestic tax auditors, are not in the position to identify this. even more apparent when the real estate ownership is scaled by the GDP of the owners' home countries. The British Virgin Islands is the top jurisdiction by this measure, with ownership equal to more than 25 percent of GDP. The four jurisdictions Bermuda, Guernsey, Luxembourg, and Jersey are next, all with ownership equivalent to approximately 4 to 5 percent of GDP. Then follows Cyprus, with 2.5 percent of GDP. Remaining countries have ownership below 1 percent of GDP.

Our estimates can serve as a useful benchmark for future studies of foreign ownership in other comparable real estate markets, especially for those that only have imperfect information about property values. Norway is an open, medium-sized economy which ranks 19 out of 38 OECD countries in terms of GDP. There are no strong factors that points to either especially high (like a high number of tourists or many bordering countries) or especially low (like foreign ownership restrictions) foreign ownership shares in the property market. The foreign-owned real estate in Norway amounts to 7 percent of GDP, which for the European Union would mean foreign ownership of EUR 1,012 billion in 2021, with for instance EUR 250 billion in Germany and EUR 174 billion in France.

The remainder of this paper is organised as follows. The next section outlines the current literature on foreign owned real estate. Section three describes the data we use and how we use it to construct our estimates. Section four presents the estimates, while section five concludes.

Current literature

The true extent of foreign ownership of real estate has not yet been quantified for any country or major city, with a few notable exceptions. Morel and Uri (2021) find that 1.5 percent of French residential real estate -worth USD 140 billion -was owned by non-residents at the end of 2019. This is higher than our estimate for Norwegian housing, which is 0.5 percent.

Morel and Uri (2021) also note that almost no French residential real estate is owned by non-residents through corporations. This type of ownership is evidently more prevalent in the UK, where the government also publishes lists of properties owned by UK and foreign companies. Bomare and Le Guern Herry (2022) calculate that the value of real estate in England and Wales (both commercial and residential) owned directly by either foreign individuals or foreign companies was at least USD 359 billion in January 2018. To reach this number, they among other things use information from the Panama Papers and related leaks to impute the country background of the ultimate owners of property-owning corporations registered in tax haven. This e↵ort shows that 19.5 percent -USD 28 billion out of USD 144 billion -of the real estate owned by foreign companies was in the end owned by UK nationals.

The most significant progress in mapping of country-by country ownership of real estate located in tax havens is in a companion project (Alstadsaeter, Planterose, Zucman, and Økland 2022), where we estimate that USD 146 billion of foreign capital is invested in Dubai real estate. The estimates build on several leaks of detailed information on more than 800,000 Dubai properties, compiled and shared by the US-based Center for Advanced Defense Studies (C4ADS). The results show that more than 70 percent of the Dubai properties owned by Norwegian taxpayers were not duly reported to the Norwegian Tax Administration.

The literature on foreign real estate investments is larger than the literature on real estate ownership, as the flows are easier to observe than stocks. Devaney, Scofield, and Zhang (2019) find foreign buyers in 4.1 percent of the transactions (representing 13.4 percent of the value) in a sample of high-value transactions in large US cities, with Canada, UK, Germany, and China as the major buyer countries. Cvijanović and Spaenjers (2021), in a paper that investigate foreign buyers in the Paris property market, observe that 4.6 percent of buyers were resident foreigners, while 2.8 percent were non-resident foreigners. Most foreign purchases were made by nationals of Italy, Great Britain, the United States, Portugal, and China.

Data and methodology

This section first outlines how tax returns let us construct the Norwegian real estate stock, complete with market values and covering real estate owned by both individuals and corporations. It then outlines how the shareholder register let us assign this stock to owners and countries. At last we discuss how sensitive our estimates are to adjusting the definition of ownership.

Real estate wealth from tax returns

Our data lets us analyse the ownership of the complete, private-owned Norwegian real estate stock. 4 The data cover the full universe of de-identified Norwegian tax returns for persons and corporations for the years 2011 to 2017, provided by Statistics Norway. Foreigners that own Norwegian real estate directly and foreign corporations (both if those that are incorporated or are fully owned from abroad) are also subject to submitting these tax returns. The data return data consists of three separate data sources, all made available to us by Statistics Norway and the Norwegian Tax Administration:

• Individuals' tax returns. The tax returns for individuals include the aggregate market value of real estate owned directly by individuals, disaggregated by type.

• Corporations' tax returns. The Tax return for corporations and other non-personal taxpayers (RF-1028) include the aggregate market value of real estate owned directly by the submitting corporation, disaggregated by type (housing, commercial, other).

• Income statement 2. This is an attachment to the corporate tax returns, and includes the balance sheet of the submitting corporation. We use this to impute the real estate wealth of corporate groups listed on the stock exchange (see more in subsection 3.3).5

The imputed real estate wealth is aggregated on the tax record-level in our data. This means that the unit of observation for the real estate wealth are not the value of each property, but the total value of properties owned directly by each corporation or individual, observed at the corporation-or individual-level. For instance, if a corporation is registered in the public land registry as the sole owner of a car park worth USD 3 million and as one of two equal owners of an o ce building worth USD 50 million, we observe a real estate holding of USD 28 million for this corporation. The real estate wealth are in most instances reported after tax rebates. We scale up the taxable real estate wealth in the tax returns to correct for the tax rebates, which is something we can do as the real estate wealth is reported by type. 6 This data is available because the estimates of real estate wealth are, directly or indirectly, a part of the wealth tax base. The annual monitoring of wealth makes Norway one out of a few international exceptions. Assets either owned by Norwegians or located in Norway are reported to the tax administration in order to assess each individual's payable wealth tax. The Norwegian wealth tax is levied on all types of wealth, including real estate, shares in listed and non-listed corporations, bank deposits, etc., although with di↵erent tax rebates and valuation rules applied to the di↵erent asset classes. (See Alstadsaeter, Bjørneby, Kopczuk, Markussen, and Røed (2022) for more.)

The wealth tax is a personal tax, paid by individuals that are tax-resident in Norway and non-residents that own real estate directly in Norway. The real estate wealth owned directly by individuals are reported in the individuals' tax returns. 7 In addition, all corporations not subject to report their real estate wealth. It is evident in our data that some of the publicly listed corporations report real estate wealth despite this. For those that do not, we impute the real estate assets reported in the financial statements (see subsection 3.3).

6 The rebates that applied to the wealth in the individuals' tax returns in 2017 (the only year we use the individual tax returns) were: Primary housing: 75 %; Secondary housing: 10 %; Leisure homes: 70 %; Commercial real estate: 20 %; Other: 10 %. The only type of real estate that is reported after rebate in the corporate tax returns is housing. The rebates for secondary housing were: 2011 and 2012: 60 %; 2013: 50 %; 2014: 40 %; 2015: 30 %; 2016: 20 %; 2017: 10 %.

7 Real estate owned by corporations are reported as an underlying value component of the shares owned by the person submitting the tax return. This means that it should not be reported as real estate in the individual's tax return.

have to report the estimated market value of their real estate holdings annually. The reason is that the taxable value of shares are set proportional to the value of the assets in the underlying corporation. 8

The real estate values in the tax returns are estimated market values. This has clear benefits. They are calculated annually by the tax administration, which applies standardised and objective valuation methods. This process means that corporations are not able to manipulate the reported values of their real estate by choosing a specific assessment agency or assessment technique or by the use of base erosion and profit shifting techniques. The methods used are outlined below:

Valuation of commercial real estate. The Tax Administration's valuation method for commercial real estate has three main components: The reported rental income from the property, a discount rate which is updated yearly, and a fixed discount of 10 percent for depreciation. 9 This gives a relatively precise and objective estimate of real estate wealth. 10 An imputed rental income based on municipality, type of property (hotel, industrial plant, storage facility, store etc.), and size of the property is calculated and used if the real estate is not rented out.

Valuation of housing. Market values of housing properties are calculated by the Tax

Administration in cooperation with Statistics Norway. They use maintain a hedonic model that uses information on type of house (detached house, rowhouse or flat), the size of the property, the geographical region, and age of the house. It is based on up to date transaction data that cover most of the Norwegian property market. 8 The exception is shares in listed corporations. The taxable value of listed shares is set equal to the market value of the shares at the end of the year. Listed corporations should not report their real estate holding for this reasons, although some do.

9 To illustrate: A building with an annual rental income of USD 1 million would be valued at USD 13.6 million in 2017, when the discount rate was 6.6 percent, following from this calculation: 1,000,000•0.9 0.066 = 13, 636, 364.

10 See Dahl and Fougner (2019) for discussion of geographical bias in discount rates and more background on valuation methods

Assigning real estate wealth to owners and countries

The Norwegian shareholder register contains information on all Norwegian and foreign shareholders of Norwegian corporations. We utilise the full universe of de-identified Norwegian shareholder statements for individuals and corporations for the years 2011 to 2017 with two purposes in mind.11 First, we use it to attribute ownership of real estate owned by corporations to the di↵erent direct and indirect owners of the corporations. The full coverage of shareholders in Norwegian corporations makes it possible to map ownership by ownership share and to see through group structures and chains of holding and shell companies. This is a common obstacle, as corporate ownership often goes through several layers of corporations. The methodology to impute ownership through group structures has previously been described and utilised by Alstadsaeter, Jacob, Kopczuk, and Telle (2021).

Then, we use the shareholder register to attribute the correct country background to each owner. The attribution of the owner-country for real estate wealth reported in the personal tax return is straight-forward. The tax return submitter is the ultimate beneficial owner of the real estate. These submitters have unique identifiers in the data, which makes it possible to connect them to their reported country of residence if they appear in the shareholder register (which depends on them owning shares in a Norwegian corporation).

We complement this with information from the National Population Register if the owner does not appear in the shareholder register. This register classifies the tax return submitters as either "resident" or "emigrated" for the year in question. If the tax return submitter is registered as "resident", we assign the owner Norwegian residency. If the tax return submitter is registered as "emigrated", we assign the country that the owner emigrated to from Norway. 12 The attribution of the correct country background to each owner is more complicated for corporations. The shareholder register only includes the residence countries of the immediate owners of Norwegian corporations. This limits our information about the ultimate beneficial owner in the case where the ownership chain involve a foreign corporation. To illustrate, take the case of a Swedish investor that owns shares in a Norwegian real estate corporation through a holding corporation in Luxembourg. The shareholder in the Norwegian corporation will be registered as from Luxembourg in our data, even though the ultimate owner is Swedish.

We only observe the immediate foreign owner, who is not necessarily the ultimate owner of the cross-border chain of corporations. This means that that the analysis does not show the real country distribution of the ultimate owners. 13 Instead, we show the country distribution of ownership that is visible to Norwegian authorities and to the general public. In the case an owner of a foreign corporation is ultimately a Norwegian resident, most of the negative consequences associated with foreign ownership, like potential tax evasion, secrecy and money laundering, remain relevant.

Real estate wealth owned by listed corporations

Corporations listed on the Oslo Stock Exchange and their underlying corporations are exempted from reporting their real estate wealth in their tax returns. 14 We use a threestep procedure to impute the real estate wealth of these corporate groups.

registered. In the few instances where the tax return submitter is not registered in the population register, and does not appear with a residence country in the shareholder register, we assign the owner country "Unknown, other foreign".

13 The ultimate ownership of real estate by foreign residents may thus be lower than estimates of foreign ownership presented in this paper. Bomare and Le Guern Herry (2022) show that 19.5 percent of the real estate in England and Wales owned by foreign shell companies was ultimately owned by UK nationals. We can use this to illustrate the potential magnitude of this in the Norwegian setting. If 19.5 percent of the corporate-owned real estate owned from tax havens was really owned by Norwegians, that would amount to USD 1.4 billion in 2017. Accounting for this would reduce the foreign share in the total real estate stock from 2.2 to 2.1 percent, and reduce the foreign share of corporate owned real estate from 10.5 percent to 9.7 percent.

14 Although it is evident in our data that some of the listed corporations report real estate wealth in spite of this. For those, we use the wealth reported for tax purposes. This means that if one of the corporations in a corporate group reports real estate wealth in the corporate tax returns, we do not values from the financial statement for the group.

First, we use the identifier of listed corporations in the corporate tax returns to find and select the listed corporations. We then run the algorithm to impute ownership through group structures to find all corporations that are solely owned by one of these listed corporations.

Second, we us financial statement data from the Income statement 2, an attachment to the corporate tax returns, where the corporations are obliged to report their balance sheets. For the listed corporate groups, these balance sheets are reported in accordance with the IFRS framework. We aggregate the real estate reported in the balance sheets for each corporate group. Lastly, we assign the real estate wealth in these balance sheets to the registered shareholders of the listed corporation.

The Norwegian real estate wealth owned by corporate groups listed on the Oslo Stock Exchange accumulate to approximately 10 percent of the real estate wealth owned by nonlisted corporations.

Sensitivity

The implementation of the ownership imputation through layers of corporations, as detailed in subsection 3.2, excludes ownership that is smaller than 0.001 percent in one of the links in the ownership chain (we assign this real estate wealth to Norway). This cut-o↵ is only due to computational constraints and has a very small e↵ect on the estimates. This means that the ownership is proportionally apportioned to the di↵erent owners and their background country based on ownership share in the cases where the corporations owning the real estate have more than one owner. And that there is almost no lower bound for how small these ownership stakes may be. A study with a di↵erent objective could choose a narrower definition of foreign ownership, for instance one that only includes corporations that are fully or majority owned from abroad. This implies that the results presented in this paper are not driven by a large number of small, foreign owners, but a smaller number of foreign investors with the purpose of buying Norwegian real estate or corporations with sizeable real estate positions in Norway. It also confirms that the foreign owners wield considerable control over the real estate they own in Norway.

4 The Norwegian real estate market in numbers 4.1 The real estate stock Table 1 summarises the total value of the stock of privately owned Norwegian real estate in 2017. It shows that the foreign ownership of Norwegian real estate is concentrated in the corporate sector. USD 18.8 billion (10.5 percent) of the USD 179 billion reported in the tax returns of corporations is owned from outside of Norway, while only USD 5.3 billion (0.6 percent) of the 879 billion booked in individuals' tax returns are owned by non-residents. In total, 2.3 percent, USD 24.1 billion of the USD 1,057 billion, of real estate wealth is traced to foreign owners. This corresponds to 7 percent of GDP, as Norwegian mainland GDP was USD 337.9 billion in 2017. 15 15 It is not surprising that the foreign ownership is concentrated in corporations. Ownership of real estate through companies is more advantageous in most cases where the owner is not living permanently at the property. Corporate ownership does for instance give an exemption from stamp duty when property is sold, and incorporation is relatively cheap in Norway. Thus, it has become widespread to own large real estate projects through special purpose companies.

The table also shows how real estate in Norway, like in most countries, is primarily housing. But the foreign ownership is primarily in commercial real estate, in the same manner as it is also concentrated in the corporate sector. USD 15.9 billion out of USD 151.6 billon (10.5 percent) of commercial real estate is foreign-owned. Only USD 5.2 billion out of USD 841 billion (0.5 percent) of housing real estate is foreign-owned.16 3.0 out of 64.5 billion (4.6 percent) of other real estate (leisure home etc.) is foreign-owned.

Development over time

We proceed by analysing how the foreign ownership has developed over time. We limit the scope of this analysis to real estate owned by corporations, as this is where most of the foreign ownership is. The total value of the real estate owned by corporations has increased during the period from 2011 to 2017. The total corporate owned real estate wealth was valued at USD 68.2 billion in 2011, a number that increased steadily to USD 190 billion in 2016, before it fell to USD 179 billion in 2017. The foreign ownership of this real estate increased over this period, with a marked increase starting in 2015. Panel (a) of figure 2 shows how the foreign share varied around 6-7 percent in the years 2011 to 2014, before it increased to 9.2 percent in 2015, 9.7 percent in 2016 and 10.5 percent in 2017.

The foreign share in panel (a) is broken down into ownership from Luxembourg, other tax havens and non-havens in panel (b). In total, 37.7 percent of foreign-owned real estate was owned from tax havens in 2017. This share increased by 6.9 percentage points from 2011 to 2017, an increase which was mainly driven by ownership from Luxembourg. Luxembourg ownership was 10.3 percent in 2011, while ownership from other tax havens was 20.5 percent.

In 2017, ownership from Luxembourg had risen to 15.6 percent, while the ownership share from other tax havens had increased to 22.1 percent. Ownership from Luxembourg as share of foreign ownership peaked in 2016 at 18.2 percent.

Country-by-country ownership

The foreign ownership in 2017 is broken down on individual countries in figure 3. This includes all privately owned real estate, also real estate owned directly by individuals. Panel The ownership from tax havens becomes even more visible when real estate ownership is ranked by share of GDP, as it is in panel (b) of figure 3. This places the British Virgin Islands as the top country, with ownership equal to more than 25 percent of GDP. The four countries Bermuda, Guernsey, Jersey, and Luxembourg are all in the range 4 to 5 percent of GDP. Cyprus then follows with ownership equivalent to 2.5 percent of GDP. The remaining countries has ownership below 1 percent of GDP.

Conclusion

The last decade has brought us a lot closer to grasping the size of the fortunes that are hidden in o↵shore bank accounts. But non-financial asset classes are a gap in our understanding of the size and distribution of o↵shore wealth. We contribute with the first comprehensive overview of the stock and development of foreign-owned commercial and residential real estate in a country, including both direct and indirect ownership. We combine the real estate wealth reported by individuals and corporations for the purpose of serving the Norwegian wealth tax with the comprehensive shareholder register, which lists the shareholders of Norwegian corporations. This makes it possible to assign the real estate wealth to the ultimate Norwegian owner or the immediate foreign owner.

We find that 2 percent of Norwegian real estate is owned from abroad at the end of 2017.

The share increases to 10 percent when we only look at real estate owned by corporations.

The foreign-owned real estate amounts to 7 percent of GDP, which for the European Union Tables Table 1: 8 billion is assigned to the category "Unknown, emigrated", owners that have lived in Norway, but emigrated, and is not registered with a residence country in the shareholder register. USD 0.6 billion is assigned to the category "Unknown, other foreign", owners that are not registered in the demographic registry, and does not appear with a residence country in the shareholder registry. Panel (b) shows the total values for each country, scaled to the GDP of the home country.

Figure 1

 1 Figure 1 illustrates how sensitive the foreign ownership and ownership share are to a narrower definitions of foreign ownership. Panel (a) shows that the real estate wealth (in corporations) that is traced to foreign owners falls when the cut-o↵ is tightened. Still, almost

  (a) shows that the top six countries are Sweden (USD 4.6 billion), Luxembourg (USD 3.0 billion), the United Kingdom (USD 2.6 billion), Finland (USD 1.8 billion), the United States (USD 1.4 billion) and the Netherlands (USD 1.3 billion). Sweden and Finland, and to some extent the United Kingdom, are Norway's neighbouring countries. The last close neighbour, Denmark (USD 0.8 billion), is ranked eighth among the countries. Luxembourg and the Netherlands are well-known tax havens. But they are not the only tax havens among the top ownership countries. Half of the top 20 countries are well-known tax havens. United Kingdom and Switzerland (7th, USD 0.8 billion) are also popular destinations for rich, Norwegian emigrants. 17 Luxembourg is, based on anecdotal evidence, a popular tax haven among Norwegians, especially those holding real estate. 18 It is also popular among global real estate funds and investors (for instance, Norges Bank Investment Management, the Norwegian sovereign wealth fund, established their European real estate investment arm in Luxembourg).

  would mean foreign ownership of EUR 1,012 billion in 2021, with EUR 250 billion in Germany and EUR 174 billion in France. There has been a noticeable increase in the foreign ownership share among corporations between 2011 and 2017. The tax haven ownership as share of the foreign ownership among corporations increased from 31 to 38 percent between 2011 and 2017, driven by more ownership from Luxembourg. Both trends seem to have been induced or amplified around the same time as Norway and 43 other countries in 2014 committed to introduce the automatic exchange of financial information under the Common Reporting Standard, which made real estate increasingly attractive for those who seek to obfuscate their true wealth. The sizeable ownership from major secrecy suppliers highlights the need for more comprehensive ownership registries and the extension of automatic exchange of information agreements to cover real estate. The consequences of such deficiencies in ownership mapping became visible in the aftermath of the Russian invasion of Ukraine in February 2022. Economic sanctions were put in place for a long list of individuals across Western economies. But enforcement Financial Action Task Force Note. Menkho↵, L. and J. Miethe (2019). Tax evasion in new disguise? examining tax havens' international bank deposits. Journal of Public Economics 176, 53-78. Morel, R. and J. Uri (2021). L'augmentation des investissements immobiliers des nonrésidents est tirée par les expatriés. Technical report, Banque de France Bulletin No. 237: Article 6. OECD (2019). Money laundering and terrorist financing awareness handbook for tax examiners and tax auditors. OECD. Sá, F. (2016). The e↵ect of foreign investors on local housing markets: Evidence from the UK. CEPR Discussion Paper DP11658. Sá, F. and T. Wieladek (2015). Capital inflows and the us housing boom. Journal of Money, Credit and Banking 47 (S1), 221-256.

Figures

  Figures

Figure 1 :

 1 Figure 1: Sensitivity to cut-o↵s of ownership share

Figure 2 :

 2 Figure 2: Corporate owned real estate (2011-2017) (a) Foreign share of total

Figure 3 :

 3 Figure 3: Top foreign countries, real estate wealth (2017)

  Top real estate owning sectors, share of foreign/domestic owned real estate (2017) Billions of USD. This table shows the total value of privately owned Norwegian real estate at the end of 2017, how this is distributed among Norwegian and foreign owners, and how it is distributed between di↵erent types of ownership and types of real estate. Other real estate include leisure homes, land, etc. The list of tax havens is reported in appendix A. Average USDNOK conversion rate for 2017 (8.2630) used.

		Individual Corporate Housing Commercial Other	Total
	Total real estate	878.8	178.5	841.3	151.6	64.5 1,057.3
	Foreign owned	5.3	18.8	5.2	15.9	3.0	24.1
	Tax haven	0.5	7.1	0.5	6.4	0.7	7.5
	Foreign owned share	0.6 %	10.5 %	0.6 %	10.5 % 4.7 %	2.3 %
	Tax haven share	0.1 %	4.0 %	0.1 %	4.2 % 1.0 %	0.7 %

Notes:

Table 2 :

 2 Top real estate owning sectors, share of foreign/domestic owned real estate This table shows the share of total real estate wealth, either foreign or domestic, held by each corporate sector. These are the top 10 corporate sectors, ranked by real estate ownership. The total value of real estate in each sector is reported in the memo column.

	Domestically Owned from Memo:

Notes:

We restrict the analysis across time to corporate-owned real estate, as the estimates of corporate-owned and personally owned real estate are retrieved from di↵erent sources. 78 percent of foreign-owned real estate in

was corporate-owned.

The Norwegian wealth tax covers a broad range of assets, including all real estate located in Norway (even real estate owned by non-residents). This requires annual value estimates of properties to calculate the tax base, which is reported in the tax returns of individuals and corporations not listed on the stock exchange (henceforth non-listed corporations). These self-reported data by the non-listed corporations are audited by the Norwegian Tax Administration, which disposes vast third-party reported information. This includes central registers that strive to record all owners of properties.

However, our insights in ownership structures stops in the first foreign country. This means that if the ultimate owner of for instance a Luxembourg company that holds Norwegian property is a Norwegian, we would then over-estimate foreign ownership. Our analysis documents a substantial share of real estate ownership from well-known tax havens, highlighting how this type of ownership obfuscates the identity and the country of origin of the true owners of Norwegian real estate.[START_REF] Bomare | Automatic exchange of information and real estate investment[END_REF] find that 19.5 percent of real estate in England and Wales owned by foreign corporations are really owned by UK

This includes all real estate that is not fully owned by the public sector (state, regions or municipalities).

Corporations listed at the Oslo Stock Exchange (including corporations fully owned by these), are

This is the is underlying material for the Norwegian Shareholder register. Every Norwegian corporation is obliged to submit the yearly Shareholder register statement (RF-1086) to the tax administration. This is the foundation for the Shareholder's tax report(RF-1088). This report presents a summary of individuals' and organisations' shares in Norwegian limited companies. The population of the shareholder register is thus nearly the same as for the tax returns. Still, there will be a non-response rate, especially when the owner is a foreign corporation that does not have a tax incentive to report ownership.

We assign the collective term "Unknown, emigrated" if the country the owner emigrated to is not

This may be explained by the high homeownership rate and small rental property market in Norway. It may also be partly explained by measurement error, if some corporations report rental housing as commercial real estate. Given the relative high concentration of foreign ownership through corporations, this would lead to an underestimation of foreign ownership in the Norwegian housing sector, and an overestimation of foreign ownership in commercial real estate.

See for instance: https://kapital.no/reportasjer/naeringsliv/2021/10/09/7746183/eksilmilliardaerene

See for instance: https://www.dn.no/magasinet/eiendom/luxembourg/skatteparadiser/endrerosjo/1350-norske-eiendommer-eies-fra-luxembourg-skjulte-eiere-bak-milliardverdier/2-1-1150470

and the Norwegian Tax Administration for comments and input. We are grateful for financial support from the Research Council of Norway, grant number 325720. Økland gratefully acknowledges support from NMBU to finance a research stay at EU Tax Observatory during Spring 2022, project number 1211130114. Any errors are our own.

The views expressed here are those of the author(s) and not those of the EU Tax Observatory. EU Observatory, and the Norwegian Tax Administration for comments and input. We are grateful for financial support from the Research Council of Norway, grant number 325720. Økland gratefully acknowledges support from NMBU to finance a research stay at EU Tax Observatory during Spring 2022, project number 1211130114.

soon proved challenging, as complex corporate structures and the use of trusts and tax havens hid true beneficial ownership of assets, enabling assets to be hidden in plain sight.

Appendix A Tax haven list

We base our list of tax havens on Menkho↵ and Miethe (2019), with the following modification: We include the Netherlands and the United Arab Emirates. There are no observations in our data for Antigua & Barbuda, Dominica, Grenada, Saint Lucia, Saint Vincent & The Grenadines, San Marino, Maldives, Cook Islands, Samoa, Anguilla, Aruba, Curacao, Montserrat, Nauru, Niue, Tonga, Sint Maarten. Thus, we do not consider these.

The final list we use: Bahamas, Barbados, British Virgin Islands, Cayman Islands, Saint Kitts And Nevis, Turks And Caicos Islands, Belize, Costa Rica, Panama, Hong Kong, Macao, Singapore, Andorra, Guernsey, Jersey, Cyprus, Gibraltar, Isle Of Man, Liechtenstein, Luxembourg, Malta, Monaco, Switzerland, Mauritius, Seychelles, Bahrain, Bermuda, Vanuatu, Liberia, Malaysia, Chile, Trinidad & Tobago, Uruguay, Marshall Islands, Netherland Antilles, Virgin Islands (US), Lebanon, Jordan, the Netherlands, Austria, Belgium, Ireland

B Sectoral breakdown

Table 2 shows how the real estate wealth owned by corporations is distributed among the di↵erent corporate sectors, and how this sectoral breakdown looks for the foreign-owned real estate or of domestically-owned real estate separately. It shows that the real estate activities sector is by far the largest real estate owner, followed by the construction sector, the oil and gas sector, the retail trade sector and the food products sector in terms of total value. The chemicals sector and the oil and gas sector notably have a sizeable foreign ownership presence, while they have a smaller share of the real estate owned by Norwegians. The sectors real estate activities and construction of buildings holds a larger share of the domestically-owned real estate than of the foreign-owned.


1. We gather 10-minute SCADA data before and after the installation of the retrofit(s)

to evaluate the impact on wind turbine performance, aiming for a timeframe of 12months or more before and 6-months or more after the installation for accuracy.

2. Using only the 10-minute dataset, we automatically filter out periods of abnormal turbine operation, using state detection algorithms to ensure strict filtering and optimal data quality without the need for event logs.

3. To enhance the dataset, we couple the filtered 10-minute dataset with external environmental data from a weather API provider. Depending on the location of the turbine, this allows us to obtain new variables such as pressure, temperature, humidity, rainfall, and snow events. These additional variables enable us to perform air density correction and further filtering.

4. We match 10-minute data points from "before" and "after" periods, based on all environmental variables to allow accurate comparison and evaluation of turbine performance, ensuring both datasets cover the same ranges of conditions and events, and eliminating environmental variation that may affect the results.

Properly matching each environmental variable in both the "before" and "after" datasets is crucial for reliable results. Finally, the statistical distribution of each environment variable should be identical in both datasets.

Wind turbine operators and owners are presented a range of performance enhancing retrofit options by OEMs and third parties. Such offerings are accompanied by specific details of the expected performance improvements in terms of AEP (Annual Energy Production).

These claims can be very difficult to verify independently. The current best practice for AEP gain verification, as dictated by the IEC, would involve a PCV (power curve verification) campaign before and after the retrofit is performed on the turbine. These campaigns require the use of additional and independent wind measurement device(s).

Unfortunately, the cost of carrying out such verification campaigns is sometimes higher than the retrofit itself, and therefore can only be performed on selected candidate turbines of a wind farm. This results in relatively high levels of uncertainty surrounding the overall gain that can be achieved at a wind farm or fleet level.

In this study we investigated the use of SCADA 10-minute data as a pragmatic means of quickly and efficiently assessing potential AEP gains.

Abstract

Results

Method

Regarding uncertainties

Core assumption & limitation

When using SCADA data for portfolio-level analysis, it is almost impossible to obtain calibration reports and mounting information for each sensor of each turbine. In many cases, sensors such as nacelle anemometers and temperature sensors do not even undergo any traceable calibration. Due to these limitations, it is not possible to perform a full propagation of uncertainties (Type A+B) in a SCADA-based analysis.

Therefore, in the current implementation, we have restricted our analysis to provide only Type A uncertainties, i.e. statistical uncertainties.

Assessing wind turbine performance upgrades using only 10-minute SCADA data

Julien TISSOT, Christopher GRAY i4SEE TECH GmbH, Austria PO.005

Visit our homepage at i4see.com

This comparison analysis is highly dependent on the Ceteris Paribus assumption, which assumes that all relevant variables are held constant, except the one being studied. In our case, we assume that the sensor measuring the environmental variables remain unchanged throughout the periods, while the power output has the potential to change due to the retrofit.

However, the longer the analysis period, the greater the likelihood that this assumption may be false. For example, changes or defects in the nacelle anemometry or controller updates can occur, potentially affecting the accuracy of the analysis.

To mitigate this risk, we have developed several pre-processing steps as well as a set of best-practice guidelines that should be followed. Nevertheless, the key to ensuring data quality is a clear and strict planning of the retrofit campaign.

The graph presented above illustrates the similarity between the windrose plots generated from the processed datasets before (left), and after (right) the upgrade.

5. Finally, we perform a standard PCV analysis on both datasets, similar to the IEC process, and calculate the AEP using the wind distribution from the entire dataset.

Conclusions

• 10-minute SCADA data can be used for assessing wind turbine upgrades with a careful pre-processing of the dataset and a clear campaign planning.

• Trend analysis over a large wind farm campaign can provide valuable insights on the quality of wind turbine retrofits, often surpassing those obtained from a standard adhoc PCV campaigns.

• This method offers a pragmatic and cost-effective approach for wind farm operators and owners who wish to assess the effectiveness of retrofits.

Once the AEP is calculated for both the "before" and "after" periods, the influence of the upgrade on AEP, or the "DELTA AEP" can be computed. Through our experience, we found that aggregating these deltas at the wind farm level and studying the general trend in results provides insights into the actual gains of retrofit installations, particularly when the wind farm includes control turbines that did not receive upgrades.

Once all pre-processing steps have been applied to the dataset, the data analyst should obtain two datasets where the wind turbine was in normal operation and the environmental conditions were precisely identical. This filtered and pre-processed dataset can then be used for the assessment of the upgrade.

Ceteris Paribus, a comparison is now possible.

Example of filtered and processed datasets before (left), and after (right) the upgrade.

In grey, the raw dataset, in blue the final processed dataset, ready for PCV analysis.


Joséphine Delas
email: josephine.delas@polymtl.ca

Christopher Neal

Frédéric Cuppens

Nora Boulahia-Cuppens

Evading Deep Reinforcement Learning-based Network Intrusion Detection with Adversarial Attacks

Keywords: Intrusion/anomaly detection and malware mitigation;, Computing methodologies → Machine learning adversarial machine learning, adversarial examples, intrusion detection, reinforcement learning, evasion attacks

An Intrusion Detection System (IDS) aims to detect attacks conducted over computer networks by analyzing traffic data. Deep Reinforcement Learning (Deep-RL) is a promising lead in IDS research, due to its lightness and adaptability. However, the neural networks on which Deep-RL is based can be vulnerable to adversarial attacks. By applying a well-computed modification to malicious traffic, adversarial examples can evade detection. In this paper, we test the performance of a state-of-the-art Deep-RL IDS agent against the Fast Gradient Sign Method (FGSM) and Basic Iterative Method (BIM) adversarial attacks. We demonstrate that the performance of the Deep-RL detection agent is compromised in the face of adversarial examples and highlight the need for future Deep-RL IDS work to consider mechanisms for coping with adversarial examples.

CCS CONCEPTS

• Security and privacy →

INTRODUCTION

Concern about security attacks on modern connected systems such as internet-connected devices or critical data servers has been growing for the past two decades. Intrusion Detection Systems (IDSs) are thus widely used as an automatic way of detecting potential threats within network connections, and their performances are constantly challenged to cope with the development of increasingly sophisticated cyberattacks.

Supervised Learning (SL) has introduced a whole new set of capabilities into IDS technology, leading to spectacular progress in intrusion detection tasks [START_REF] Buczak | A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection[END_REF]. Still, a particularly difficult task for an IDS remains the detection of previously unseen anomalies (i.e. zero-day attacks). Reinforcement learning (RL) is a promising lead in IDS research, as it constitutes an adaptive and responsive environment suitable for online training, resulting in simple and fast prediction agents [START_REF] Hu | Reinforcement Learning for Adaptive Cyber Defense Against Zero-Day Attacks[END_REF][START_REF] Lopez-Martin | Application of deep reinforcement learning to intrusion detection for supervised problems[END_REF]. However, the most efficient RL-based IDS implementations use Deep Neural Networks (DNNs) at their core, which have been shown to be vulnerable to adversarial examples [START_REF] Huang | Adversarial attacks on neural network policies[END_REF][START_REF] Lin | Tactics of Adversarial Attack on Deep Reinforcement Learning Agents[END_REF]. These attacks involve slightly modifying data samples in order to mislead a classification model. Previous work has evaluated the effects of adversarial examples on DNN-based IDSs [START_REF] Amine Merzouk | A Deeper Analysis of Adversarial Examples in Intrusion Detection[END_REF], yet little is known about the vulnerability of RL-based detection methods to adversarial examples.

In this paper, we investigate the performance of a state-of-the-art Deep-RL intrusion detection agent when exposed to adversarial attacks. Caminero et al. [START_REF] Caminero | Adversarial environment reinforcement learning algorithm for intrusion detection[END_REF] present a novel approach that has been shown to outperform other RL and SL-based detection models. They trained a Deep-RL agent in an adversarial environment using the NSL-KDD dataset [START_REF] Tavallaee | A detailed analysis of the KDD CUP 99 data set[END_REF]. In this paper, we show how adversarial examples generated using two methods [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF][START_REF] Kurakin | Adversarial examples in the physical world[END_REF] can evade the detection of the agent. In keeping the consistency with initial studies in this domain, we consider white-box individual attacks where the intruder has access to the parameters of the model [START_REF] Lin | Tactics of Adversarial Attack on Deep Reinforcement Learning Agents[END_REF][START_REF] Papernot | The Limitations of Deep Learning in Adversarial Settings[END_REF].

The remainder of the paper is organized as follows. Section 2 provides an overview of influential works applying RL to IDSs and a review of adversarial example generation methods for Deep-RL agents. The methodology for this paper is provided in Section 3, where we describe the dataset, the RL detection agent, and the adversarial attacks used in our experiments. In Section 4, we present the results achieved by adversarial examples on the performance of the agent. A discussion of the immediate practicality of these attacks and an outline for future work is provided in Section 5. Lastly, Section 6 provides some concluding remarks.

RELATED WORK

RL techniques have an extensive range of applications in cybersecurity due to their adaptive nature and the rapidity of their predictive models. The first works concerning RL and intrusion detection were published in the early 2000s and present mostly innovative works using tabular methods. Servin et al. [START_REF] Servin | Multi-agent Reinforcement Learning for Intrusion Detection[END_REF] use a Q-learning algorithm based on a look-up table to detect network intrusions, whereas Xu et al. [START_REF] Xu | A Reinforcement Learning Approach for Host-Based Intrusion Detection Using Sequences of System Calls[END_REF] introduce Temporal Difference (TD) learning algorithms for live detection.

More recently, the development of Deep-RL algorithms has further improved the performances of IDS models [START_REF] Lopez-Martin | Application of deep reinforcement learning to intrusion detection for supervised problems[END_REF]. In particular, Caminero et al. [START_REF] Caminero | Adversarial environment reinforcement learning algorithm for intrusion detection[END_REF] present an innovative multi-agent deep reinforcement learning model that outperforms previous tabular methods, as well as several other DNN models. Their algorithm is based on the concurrency of two different agents to improve the predictions.

Despite the remarkable performance shown by RL agents in intrusion detection, there is a concern about their reliability in the presence of adversarial attacks. Since Deep-RL agents rely on DNNs, they could be vulnerable to malicious inputs, chiefly adversarial examples. Behzadan et al. [START_REF] Behzadan | Vulnerability of Deep Reinforcement Learning to Policy Induction Attacks[END_REF] first explored the effect of adversarial examples on Deep Q-Networks (DQNs). The authors use two well-known attacks, namely, Fast Gradient Sign Method (FGSM) [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF] and Jacobian-based Saliency Map Attack (JSMA) [START_REF] Papernot | The Limitations of Deep Learning in Adversarial Settings[END_REF], to perturb the training of a game-learning agent. They also demonstrate the transferability of adversarial examples between agents. Huang et al. [START_REF] Huang | Adversarial attacks on neural network policies[END_REF] show how an adversary could interfere with the operations of a trained RL agent. The authors use FGSM to generate adversarial examples in both white-box and black-box settings by utilizing the transferability property [START_REF] Papernot | Practical Black-Box Attacks against Machine Learning[END_REF]. In their study, Kos et al. [START_REF] Kos | Delving into adversarial attacks on deep policies[END_REF] compare the effectiveness of adversarial examples with random noise. They show how the value function can indicate opportune moments to inject perturbations and how adversarial re-training can enhance the resilience of RL agents [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF]. Lin et al. [START_REF] Lin | Tactics of Adversarial Attack on Deep Reinforcement Learning Agents[END_REF] introduce two novel methods to attack Deep-RL agents using adversarial examples. These are referred to as the strategically-timed attack, which aims to introduce perturbations at critical moments, and the enchanting attack, which aims to lure an agent to a certain state maliciously. Using these methods, the authors demonstrate they are able to significantly decrease the accumulated rewards collected by a DQN and an Asynchronous Advantage Actor-Critic (A3C) agent on five different Atari games.

These previous studies demonstrate that Deep-RL agents are vulnerable to well-crafted adversarial examples. They propose different methods for attacking Deep-RL agents before and after training, as well as, in white-box and black-box settings. It has even been suggested to remediate the effect of adversarial examples against Deep-RL agents using adversarial re-training [START_REF] Kos | Delving into adversarial attacks on deep policies[END_REF]. While there is a rich body of work studying how adversarial examples can degrade the performance of Deep-RL models, these previous works investigate attacks against agents used in control problems, particularly the playing of Atari video games. Such models are significantly different from the agent presented in this paper, as we will develop later in Section 3.2, since the successive states are independent of the action taken in the previous step, thus affecting the learning process. In addition, evading an intrusion detection model involves targeting a specific class (labeling malicious connections as normal behavior); while working most of the time with imbalanced datasets [START_REF] Yilmaz | Addressing Imbalanced Data Problem with Generative Adversarial Network For Intrusion Detection[END_REF]. For these reasons, we notice a gap in the literature concerning the understanding of adversarial attacks against Deep-RL-based intrusion detection agents and present this work as an initial building block toward filling this gap.

METHODOLOGY

First, we present the dataset that we use for the training and the validation of the the detection agent. Then, we describe the Deep-RL detection agent used in our experiments, as proposed by Caminero et al. [START_REF] Caminero | Adversarial environment reinforcement learning algorithm for intrusion detection[END_REF]. Finally, we outline the adversarial attacks we use against the agent.

Dataset

For comparative studies of our results, we opt for the commonly used NSL-KDD dataset [START_REF] Tavallaee | A detailed analysis of the KDD CUP 99 data set[END_REF]. This dataset is widely used in similar research papers, and particularly in Caminero et al. [START_REF] Caminero | Adversarial environment reinforcement learning algorithm for intrusion detection[END_REF] to validate the agent.

Each record is composed of 41 network features: 38 continuous (such as the duration of the connection) and 3 categorical. A record is labeled as either normal or an attack. There are 22 different attack types in the training set (therefore, 23 different label outcomes) but 38 in the testing set: an efficient detection model will have to detect anomalies it has not encountered during training. From this basis, a few preprocessing steps were applied: categorical features were one-hot encoded, and non-binary features were normalized (i.e. zero mean, standard deviation equal to one).

Finally, in this work, we aim to mislead the model into classifying an attack record as a normal one (i.e. a false negative classification). Therefore, we do not need to be able to differentiate the 23 anomaly type. Instead, we group them into 4 classes of attacks. The approximately 120,000 samples are thus distributed into the following classes: Normal (53.46%), Denial-of-Service (DoS) (36.46%), Probing (PROBE) (9.25%), Remote-to-Local (R2L) (0.79%), and User-to-Root (U2R) (0.04%).

Detection Model

We work with a state-of-the-art Deep-RL intrusion detection agent that has been shown to outperform other DNN and Deep-RL methods on the KDD-NSL dataset [START_REF] Caminero | Adversarial environment reinforcement learning algorithm for intrusion detection[END_REF]. The agent is referred to as Adversarial Environment using Reinforcement Learning (AE-RL); since it enhances its learning phase by using an adversarial environment to select training samples. It is composed of two concurrent agents: the first agent is the classifier that predicts the labels for each sample, whereas the second agent is a selector that acts as a simulated environment and feeds sample records to the classifier. Therefore, the second agent is only used during training to obtain a more robust model and is not involved in the attack detection.

The classifier is a Deep Q-Network (DQN) agent [START_REF] Mnih | Human-level control through deep reinforcement learning[END_REF], described in Figure 1. With the states (record features) as input, its goal is to choose the best action according to its Q-function [START_REF] Richard | Reinforcement learning: An introduction[END_REF]. The Qfunction is simulated by a fully-connected, 3-layer neural network with 100 units per layer, that is trained to approximate the optimal

Q * (S t , A t ) = R t +1 + γ max a (Q(S t +1 , a)), (1)
where Q * is the optimal Q-function, S, A, and R are the states, actions, and rewards, γ is the discount factor, and t and t + 1 are the timesteps.

During training, the error between the target and the predicted Q-value is back-propagated through the model's parameters. It is calculated with Huber loss, which is quadratic if the absolute difference falls below 1 and linear otherwise. This loss function provides smoothness near zero while being less sensitive to outliers than the squared error loss. After predicting the state's Q-value, the agent chooses the action according to an ϵ-greedy policy [START_REF] Richard | Reinforcement learning: An introduction[END_REF]: randomly with a probability of ϵ, else the one that maximizes the Q-value. The ϵ value is high at the beginning and reduces over the course of the training process. When the training is done, ϵ is set to zero in order to optimize the prediction.

In this setup, the states are data records issued from the dataset and the actions are the different possible label outputs. The reward is set to 1 if the classifier is correct and 0 otherwise. Finally, the discount factor γ is set to a value close to zero, since the states do not influence one another and each state is independent of the precedent.

When transitioning from one step to the next, selecting random samples from the dataset is not the most efficient solution due to the unbalanced nature of the dataset. The selector agent instead chooses which anomaly category to pull the next state and attempts to find the most difficult records for the classifier. The selector's algorithm is DQN with Huber loss and epsilon-greedy policy, similar to the first agent, but the rewards are opposite. That is, -1 if the classifier chooses correctly and 0 otherwise. The two agents are considered concurrent because of this method for providing rewards.

Once the training is complete, the prediction phase only consists of passing a record through a small fully-connected neural network and choosing the maximum output. This simple architecture allows for efficient classification, which is critical in intrusion detection tasks.

Adversarial Attacks

When the training is complete, we use adversarial examples to mislead the agent on test data. A perturbation is computed using the following generation methods and added to the original test data. This perturbation will corrupt the prediction of the Q-values and influence the decision of the agent. These attacks were implemented using the Adversarial Robustness Toolbox (ART) library [START_REF] Nicolae | Adversarial Robustness Toolbox[END_REF].

Fast Gradient Sign Method.

The first attack we use is the Fast Gradient Sign Method (FGSM) introduced by Goodfellow et al. [START_REF] Goodfellow | Explaining and harnessing adversarial examples[END_REF]. This method exploits the gradient of the loss function, which usually serves to update the parameters of the model. Instead, the gradient is propagated back to the inputs and its sign guides the perturbation. An adversarial example x ′ is formed by adding the perturbation amplitude ϵ with the sign of the gradient to an original example x. Equation 2 describes this perturbation, where ∇ is the gradient function, J θ is the loss function with regards to the parameters θ , and l is the true label of the example.

x ′ = x + ϵ • siдn(∇J θ (x, l)) (2)
3.3.2 Targeted Fast Gradient Sign Method. FGSM is an untargeted attack by definition, as it does not aim to misclassify the adversarial example towards a specific class. However, it would not be in the interest of attackers to misclassify an attack as another type of attack since evading detection implies classifying the attacks as normal traffic. To targeted a specific class using FGSM, we perform the update in Equation 3 where l ′ is the target class.

x ′ = x -ϵ • siдn(∇J θ (x, l ′ )) (3)
3.3.3 Basic Iterative Method. Kurakin et al. [START_REF] Kurakin | Adversarial examples in the physical world[END_REF] introduce the Basic Iterative Method (BIM) as an extension of FGSM. The idea is to apply small perturbations over several steps to create more precise adversarial examples. Additionally, a clipping method is used at each step to prevent features from exceeding valid intervals. Generally, increasing the number of iterations will produce finer perturbations and can lead to more subtle adversarial examples. However, there is a trade-off, as computing these small steps is typically slower to produce adversarial examples than non-iterative methods.

Targeted Basic Iterative Method.

Applying BIM involves using FGSM, as outlined in Equation 2, to generate an adversarial example for some unspecified class and may not necessarily serve the goal of the attacker. Using the BIM process with targeted FGSM, as outlined in Equation 3, produces an adversarial example for a particular class.

RESULTS

In this section, we present the results of our experiments. We evaluate the performance of the trained agent using the test set, of approximately 30,000 samples, with and without adversarial perturbation. In all adversarial attacks, we set the maximum amount of perturbation to ϵ = 0.1.

Two-class Attack Detection Facing Adversarial Examples

This section involves experiments using two-class detection, where the detection agent assigns a label of Normal or Anomaly to each sample. We only consider the generic FGSM and BIM attacks; since the attacker intends to make anomalous packets appear legitimate.

The performance of the detection agent is shown in Figure 2, the accuracy and F1-scores are shown in Table 1, and the confusion matrices of the detection agent for the label decisions are shown in Figure 3. No Attack. In this case, the training set is balanced (i.e. 53% normal and 47% anomalies), which allows the agent to learn the two classes accurately. In Figure 3, we can see that 79% of the anomalies are detected by this model, with 84.81% accuracy and 84.09% F1score. These results correspond to state-of-the-art performance on NSL-KDD, even though Figure 2 shows that about 2800 anomalies are classified as normal traffic.

No

Fast Gradient Sign Method. We observe, in Figure 3, a significant drop in the number of true positives from both classes, but what is particularly interesting is the false positive rate from the Normal class. Indeed, it rose from 0.21 in the baseline model to 0.28 with the FGSM examples, which means that this attack increased the number of suspicious connections undetected by the model. Basic Iterative Method. BIM is supposed to generate more precise perturbations, finding new paths to escape the prediction. In Table 1, we notice a drop in the performance of the model compared to the baseline; the accuracy drops from 84.81% to 75.84%, and the F1-score also drops from 84.09% to 66.71% for the anomaly class. However, we notice in Figure 2 that most of the misclassified items were initially labeled as Normal, and the model was lured into labeling them as Anomaly. A targeted attack, in a multi-class context, can improve the deception by aiming toward the Normal class for all examples.

Multi-class Attack Detection Facing Adversarial Examples

This section involves multi-class detection, where the agent must choose a label of Normal or one of the attack categories of DoS, PROBE, R2L, and U2R. The performance of the detection agent is shown in Figure 4, the accuracy and F1-scores are shown in Table 2, and the confusion matrices of the detection agent are shown in Figure 5.

No Attack. Without the presence of adversarial examples, we see that the agent has an overall good performance with an accuracy of 83.70%. The F1-scores for the Normal and DoS categories are 83.33% and 91.32% respectively. However, the agent shows weak performance on R2L and U2R attacks, where the F1-score is below 40%. This is common in many classifiers because these attack types are hard to detect and are underrepresented in the dataset. Figure 5 shows a noticeable intensity on the diagonal, especially for the Normal, DoS, and Probe categories. The R2L examples are often classified as Normal while the U2R are spread across different categories.

Untargeted Fast Gradient Sign Method. Applying adversarial perturbations using FGSM shows an important drop in the performance of the agent. We see a large number of misclassifications for all classes in Figure 4. The accuracy of the agent drops to 75.58%, while the F1-Score of all classes is substantially lower. The false positive rate of the class Normal shows that most of the examples are misclassified in this category. The same results are shown in Figure 5, as the diagonal is less intense and the Normal column (corresponding to the examples classified as Normal) is more intense.

Targeted Fast Gradient Sign Method. With targeted FGSM, adversarial examples are pushed toward the Normal target class. We see a noticeable impact in Figure 4 with an even higher number of false positives in the Normal class. The accuracy and F1-score for the Normal label drop to 56.37% and 65.89% respectively. The confusion matrix in Figure 5 shows a very intense concentration in the Normal column. This indicates that targeted attacks can be more interesting for attackers who want to evade an RL-based IDS.

Untargeted Basic Iterative Method. By applying the untargeted BIM method, we find no real change to the performance of the detection agent compared to when no attack is present. This can be explained by the perturbation steps limit (set to 100). With no target class for this attack, the perturbations do not go far enough in a particular direction to modify the class of the sample from the viewpoint of the detection agent. Without any computation limitations, we would expect this method to cause a more severe impact on the detection performance.

Targeted Basic Iterative Method. With targeted BIM, we see the most drastic degradation in the performance of the detection agent. This method can perturb more precisely anomalous samples to the Normal class. The accuracy on Normal samples drops to 28.47% and the F1-score for all labels drops below 20%. The substantial amount of misclassifications of anomalous packets as Normal is demonstrated in Figures 4 and5 Recently study [START_REF] Amine Merzouk | Investigating the practicality of adversarial evasion attacks on network intrusion detection[END_REF] has identified several invalidation properties in adversarial examples generated on 3 intrusion detection datasets that prevent their implementation. These properties include out-ofrange values, corrupt binary values, multiple categories belonging, and corrupt semantic relations. For the purpose of this work, we demonstrate that current adversarial attacks can bypass Deep-RL detection agents at the data level, but we do not solve the practicality issues at the network level. An avenue for future work is to investigate the impact of other adversarial attacks on Deep-RL IDSs, including in the more realistic black-box setting. The detection agents should also be trained on recent datasets that are more representative of modern network traffic and attacks. The practicality concerns should be addressed by applying clipping functions and penalties to restrict the perturbation. Semantic relations should be extracted from the data and integrated into the generation methods to produce consistent adversarial examples.

CONCLUSION

Recent research in cybersecurity has used Deep-RL in multiple functions, especially intrusion detection. This approach is promising as it allows more adaptability and faster processing. However, using Deep-RL detection methods opens the door to the threat of adversarial attacks.

In this work, we study the vulnerability of a Deep-RL IDS detection agent when faced with adversarial examples. We train a stateof-the-art Deep-RL detection agent using the NSL-KDD dataset and evaluate its performance with several adversarial attack methods. We demonstrate a substantial deterioration in detection performance when adversarial attacks are used to perturb malicious packets towards being classified as benign. Finally, we discuss the practicality of these adversarial examples and suggest research directions to implement adversarial attacks on real networks.

Figure 1 :

 1 Figure 1: Details of the classifier DQN agent for the training phase

  .

5Figure 2 :Figure 3 :

 23 Figure 2: Performance of AE-RL two-class detection model facing adversarial attacks

Figure 4 :Figure 5 :

 45 Figure 4: Performance of AE-RL multi-class detection model facing adversarial attacks

Table 1 :

 1 Accuracy and F1-score of AE-RL two-class detection model facing adversarial attacks

		Attack	FGSM	BIM
	Label	Acc.	F1	Acc.	F1	Acc.	F1
	Normal	84.81 84.09 66.87 61.16 75.84 66.71
	Anomaly 84.81 85.47 66.87 71.12 75.84 81.04

Table 2 :

 2 DoS 94.44 91.32 65.73 120.04 76.36 46.23 93.76 90.71 24.81 6.38 PROBE 95.40 77.36 72.09 119.68 89.93 21.83 95.41 78.27 79.62 13.87 R2L 90.25 37.47 84.68 111.25 88.16 12.17 89.91 39.03 84.19 18.93 U2R 98.10 15.44 98.55 112.83 98.52 15.73 97.76 13.99 97.09 8.13 Accuracy and F1-score of AE-RL mutli-class detection model facing adversarial attacks

		No Attack	FGSM	Targ. FGSM	BIM	Targ. BIM
	Label Acc. F1	Acc. F1	Acc. F1	Acc. F1	Acc. F1
	Normal	83.70 83.33 75.58 76.40 56.37 65.89 84.90 83.71 28.47 2.52


Julien Tissot

Christopher Gray

Automated rotor imbalance monitoring using high-frequency SCADA data

When imbalanced, the rotor will vibrate at a frequency directly proportional to its speed of rotation, the new metric will therefore rely on a standard spectral analysis:

1. We measure the 1p component in the rotor speed using Fast Fourier Transform (FFT), which corresponds to oscillations occurring once per full rotation of the rotor. The higher the amplitude, the higher the imbalance.

2. Order tracking is used to handle varying rotor speed, providing a robust estimation of the 1p amplitude. If the rotor speed is not available, the generator speed can be converted to an equivalent rotor speed.

3. The amplitude is derived using Signal-to-Noise Ratio, SNR, concepts.

4. The 1p amplitude is computed every 10 minutes which ensures backward compatibility with existing historical 10-minute SCADA data and facilitates comparative analysis among turbines.

The spectral analysis of high-frequency rotor speed signals is a well-established method for revealing information on the state of imbalance in a wind turbine [1,2] . This may be caused by mass imbalance on the rotor blade structure (e.g., an uneven mass distribution during manufacturing or due to gradual water ingress) or aerodynamic imbalance caused by a pitch offsets leading to an uneven torque intake on the blades.

Wind turbines generate a large volume of operational data. In the industry, the standard practice for collecting and analyzing SCADA has been to aggregate data at 10-minute intervals. While manufacturers typically collect data at a higher frequency, this level of detail has not always been made available to the end users, such as wind farm owners and asset managers.

In the past the 10-minute data aggregation interval provided good a balance between data volume and detail, but with the increasing focus on data-driven decision making and the availability of new technologies and tools for data analysis and storage, there is a growing demand for access to higher frequency datasets. With access to data analytics using higher frequencies, wind turbine owners and asset managers will gain deeper insights into turbine performance, identify potential issues more quickly, and ultimately optimize operations.

In this study, we investigate the harmonic analysis of the high-frequency rotor speed signal to detect rotor imbalance, with a focus on ensuring that the final metric is both usable and compatible with current asset management practices. We also present real-life examples, where the new metric provided valuable insights for asset managers on a day-to-day basis. PO.006

Abstract

Visit our homepage at i4see.com

The Nyquist-Shannon sampling theorem dictates that at least 2 points per revolution are needed to avoid aliasing, but ideally, a sampling frequency should provide twice that amount, 4 points per full rotor rotation. Given the range of RPM of a turbine, we only compute the metric when 1hz data are available.

Spectrogram illustrating the presence of harmonics in the high-frequency rotor speed signal. Rotor Speed was overlayed to visualize the direct proportionality. (1 turbine -12hours)

Conclusions

▪ Detection of global rotor imbalance is possible using high frequency SCADA given a minimum sampling rate of 1Hz.

▪ Aggregating the imbalance metric at a 10-minute level ensures compatibility with historical SCADA data, facilitating further comparative analysis.

▪ Monthly distribution analysis of the metric provides insight on a wind farm or portfolio level, allowing for prioritized inspections and maintenance operations.

▪ Individual timeseries analysis of the metric enables the assessment of the impact of maintenance or environmental events on wind turbines.

After computing the imbalance metric every 10 minutes, we analyze its statistical distribution on a monthly basis per turbine. This enables comparison of similar turbines, provided they have a similar high-frequency rotor speed sampling rate:

Imbalance metric monthly distribution comparison for 2 turbines (left) and for the whole wind farm (right). In both cases, we see turbine A has a higher relative imbalance than turbine L.

Left graph: At 14.75 RPM, 1 Hz and 0.5 Hz sampling rate are acceptable but the peak at 1P is more pronounced at 1Hz. Right graph: Summary of sampling frequency requirement for the metric.

A L A B C D E F G H I J K L
Monitoring the trend of this analysis at a portfolio level can provide valuable insights. It can help identify wind turbines that may be experiencing deteriorating health and prioritize their inspection and maintenance operations accordingly. By monitoring the metric monthly timeseries for one or multiple turbines, it is possible to correlate the amplitude of the imbalance with on-site events:

By identifying anomalies in imbalance, asset managers can make informed decisions on the effectiveness of interventions or retrofits.

The left graph illustrates an improvement in rotor imbalance after the OEM performed the annual maintenance. The right graph depicts an episodic and global degradation in rotor imbalance across the entire wind farm, which we found to be correlated with a severe icing event that occurred on this high-altitude wind farm.

Results

Frequency

  , Peter; Giebhardt, Jochen (2005). Rotor Condition Monitoring for Improved Operational Safety of Offshore Wind Energy Converters. Journal of Solar Energy Engineering, 127(2), pp. 253 2. M. R. Shahriar, P. Borghesani and A. C. C. Tan, "Speed-based diagnostics of aerodynamic and mass imbalance in large wind turbines," 2015 IEEE International Conference on Advanced Intelligent Mechatronics (AIM), Busan, Korea (South), 2015, pp. 796 References