domain: info stat

text:
Helena Canever
email: helena.canever@talan.com

Xihui Wang
email: xihui.wang@talan.com

Network traffic classification using Unsupervised Learning: a comparative analysis of clustering algorithms

Keywords: Network traffic classification, Clustering, Unsupervised learning, Machine learning 1

Network traffic classification plays a crucial role in various network management tasks, such as resource allocation, intrusion detection, and Quality Of Service (QOS) optimization. With the increasing complexity and volume of network traffic, the need for efficient and accurate classification algorithms has become paramount. Traffic classification plays a vital role in achieving QoS, but the task has become increasingly difficult due to evolving applications and growing network traffic. This article focuses on leveraging machine learning techniques, particularly unsupervised learning, for network traffic classification. The objective is to replicate the work of Aouedi et al. and compare the performance of various clustering algorithms: k-means, DBSCAN, bisecting k-means, and k-modes. A more refined experimental procedure is proposed, including data preparation, feature selection, hyperparameter analysis, and cluster analysis. This study contributes to the understanding of different clustering algorithms' performance for network traffic classification.

Introduction

The digitalization of businesses, public administrations, and individuals has rapidly increased in recent years, fueled by growing trust in cloud infrastructures and 5G networks. This trend was further accelerated by the Covid-19 pandemic, which forced many employees to work remotely. However, this digital transformation has also introduced new challenges for network managers, particularly with regards to security and supervision. In this context, ensuring Quality of Service (QoS) in resource allocation has become a critical issue, especially given the increased heterogeneity of connections and software services.

Achieving QoS in a network necessitates the prioritization of certain traffic types over others. This objective can be accomplished by judicious allocation of bandwidth and other network resources, based on the distinct needs of various applications and services. For instance, real-time applications like video conferencing and online gaming demand low latency and high bandwidth, while file downloads or software updates can accommodate higher latency and may not necessitate as much bandwidth. Traffic classification plays a pivotal role in realizing QoS in a network. It involves the process of identifying the diverse traffic types coursing through the network, such as web traffic, email traffic, or video streaming traffic.

However, the task of manually identifying and classifying network traffic has become increasingly difficult. This is due to both the constantly evolving nature of applications and the continual increase in the volume of network traffic. In response to this challenge, there has been a growing interest in leveraging machine learning techniques to address the problem of network traffic classification. In particular, unsupervised learning methods have garnered attention considering their ability to perform statistical analysis on attributes without a priori labeling [START_REF] Ayoubi | Machine learning for cognitive network management[END_REF].

Unsupervised learning is a powerful technique that allows for the discovery of relationships between inputs without any prior knowledge of the outputs [START_REF] Barlow | Unsupervised learning[END_REF]. Its main objective is to process data for knowledge discovery, which can be used for reasoning and decision making. Clustering algorithms are one of the most commonly used methods of unsupervised learning, which group input data into distinct clusters based on similarities in the feature values. In particular, the work of Aouedi et al. [START_REF] Aouedi | Network traffic analysis using machine learning: an unsupervised approach to understand and slice your network[END_REF] proposed the implementation of k-means for network traffic classification given its ease of implementation. To further test the efficacy of their method, the authors recommend comparing the performance of k-means with other clustering algorithms. The objective of this article is thus to replicate the work of Aouedi et al. [START_REF] Aouedi | Network traffic analysis using machine learning: an unsupervised approach to understand and slice your network[END_REF] and compare the performance of various clustering algorithms for network traffic classification.

The rest of the paper is organized as follows: Section 2 focus on related work in network traffic classification; the Clustering algorithms selected and the dataset used for this study are described in Section 3 and 4; the experimental results and their analysis are provided in Section 5, and finally the paper concludes with Section 6.

Related Work

Network traffic, also referred to as data traffic or network data, represents the amount of data traversing a computer network at a given moment and is used for overall communication and information exchange between interconnected devices within the network. The transmission of network data heavily relies on the encapsulation process, where information is organized into network packets, serving as the fundamental units of network load. These packets consist of a payload, representing the raw data being transmitted, and a header that contains essential metadata such as the source and destination IP addresses.

Network traffic can be classified based on different criteria, including the source and destination of the traffic, the protocols used, the content or payload of the data, and the timing or behavior of the traffic. A well known classic approach is to use port numbers for traffic classification. However, to avoid detection by this method, P2P applications use dynamic port numbers and disguise themselves by using the port numbers for common protocols such as HTTP and FTP, thus rendering this approach obsolete [START_REF] Karagiannis | Transport layer identification of p2p traffic[END_REF]. An alternative approach is the payload-based technique [START_REF] Moore | Toward the accurate identification of network applications[END_REF], which inspects packet payloads for characteristic signatures of known applications, is more accurate than the port-based technique. Nevertheless, it has limitations including privacy and legal concerns with user data and the need to keep extensive knowledge of application protocol semantics up to date, which impose significant complexity and processing load on the traffic identification device.

Newer approaches to application identification rely on traffic's statistical characteristics, such as flow duration, packet inter-arrival time, and packet lengths as unique properties for certain classes of applications, which has led to the development of new classification techniques based on traffic flow statistical properties, and the introduction of machine learning techniques to deal with large datasets and multi-dimensional spaces of flow and packet attributes [START_REF] Nguyen | A survey of techniques for internet traffic classification using machine learning[END_REF]. Most ML techniques used for traffic classification focus on the use of supervised and unsupervised learning. There are various supervised learning classification algorithms that have been applied to traffic classification, which differ in the construction of classification models and the optimization algorithm used to search for an effective model, such as Bayesian neural networks [START_REF] Auld | Bayesian neural networks for internet traffic classification[END_REF] and support vector machines [START_REF] Este | Support vector machines for tcp traffic classification[END_REF]. However, the accuracy of supervised learning depends entirely on the dataset being labelled. The reality is that it is very difficult to manually label the data and there are always new arrivals of traffics that may not belong to any of the predefined labels. Since the unsupervised clustering approach does not have this limitation, it has attracted more attention in recent years. Although it is not as rich as supervised learning algorithms, it shows its applicability in constructing high-performance [START_REF] Azab | Network traffic classification: Techniques, datasets, and challenges[END_REF].

A series of works have exploited clustering algorithms on traffic data to improve the classification of network data. Among all the clustering algorithms, K-means [START_REF] Jain | Algorithms for Clustering Data[END_REF], which aims to divide the data into K clusters, is the most popular thanks to its simplicity. Many works [START_REF] Wang | A novel semi-supervised approach for network traffic clustering[END_REF] [START_REF] Du | Design of a method for encrypted p2p traffic identification using k-means algorithm[END_REF] have verified the effectiveness of K-means for classifying network traffic. However, the number of clusters K has been the focus of debate, which not only seriously affects the classification effectiveness performance of the algorithm, but also affects the algorithm' complexity. Other different clustering algorithms have been used to compare with K-means. For exemple, Erman et al. [START_REF] Erman | Traffic classification using clustering algorithms[END_REF] compared the performances of the k-means to DBSCAN [START_REF] Ester | A density-based algorithm for discovering clusters in large spatial databases with noise[END_REF] algorithms and AutoClass algorithm [START_REF] Cheeseman | Bayesian classification (autoclass): theory and results[END_REF]. In their experiments, for each different protocol (HTTP, P2P, etc.), the same number of samples are used to avoid clustering bias. This preprocessing method does not allow the identification of flows based on volume and necessary resources and is therefore less effective for practical applications. Singh [START_REF] Singh | Performance analysis of unsupervised machine learning techniques for network traffic classification[END_REF] compared the accuracy of K-means and Expectation Maximization (EM) [START_REF] Moon | The expectation-maximization algorithm[END_REF] clustering algorithms in identifying network traffic based on extracting relevant features. Unfortunately, their experimental processes such as feature processing, extraction, etc. were not described in detail, which makes it difficult to replicate their experiments for comparison.

Expanding on prior research, Aouedi et al. [START_REF] Aouedi | Network traffic analysis using machine learning: an unsupervised approach to understand and slice your network[END_REF] proposed a more refined experimental procedure that includes the following two mains steps:

1. Data Preparation, involving data preprocessing and feature selection; 2. Experimental analysis, involving the analysis of hyperparameter values and elucidation of the behavior of distinct clusters.

Regrettably, only a detailed description of the selection of parameters of the kmeans algorithm and the analysis of its clusters has been presented by Aouedi et al. Therefore, the thrust of this paper is to extend their work by comparing four different clustering algorithms(k-means, DBSCAN, bisecting k-means and k-modes) and analyzing in detail the different clusters. Over and above, we contend to provide a more rigorous approach to data preprocessing of the first step and performed an internal validation of the clusters on the reprocessed data to evaluate the optimal number of clusters.

Clustering algorithms

We have selected four clustering algorithms for comparative analysis, namely, DBSCAN, k-means, and two variations of k-means, namely bisecting k-means and k-modes.

DBSCAN

DBSCAN (Density-Based Spatial Clustering of Applications with Noise) is a clustering algorithm that groups data points into density-based clusters. It does this by first identifying points in the dataset that are dense and form a cluster, then expanding the cluster to include nearby points that are also dense. Points that are not part of a dense cluster are considered noise and are not included in the clusters.

k-means

K-means is a clustering algorithm that divides a group of data points into a specified number of clusters (k) based on the means of the data in each cluster.

To do this, it first initializes k centroids, which are points representing the center of each cluster. It then assigns each data point to the cluster whose centroid is closest, based on some similarity metric. Once all points have been assigned to a cluster, the centroids are updated to be the average of the points in each cluster, and the process is repeated until the centroids converge and the point assignments to clusters do not change.

Bisecting k-means

The k-means bisecting algorithm, as the name suggests, is based on the kmeans algorithm. The difference is that the k-means bisecting algorithm first treats the entire data set as a single cluster. It then iteratively divides this cluster into two sub-clusters using the k-means algorithm. This process is repeated on each subcluster until a specified number of clusters (k) is reached. This results in a hierarchical cluster structure, with each cluster being divided into two sub-clusters at each iteration.

k-modes

k-modes is a clustering algorithm similar to k-means, but instead of using means to define clusters, it uses modes, which are the most frequent values in each cluster. This makes k-modes well suited to clustering categorical, rather than numerical, data. Like k-means, k-modes starts by initializing k centroids, then assigns each data point to the cluster whose centroid is closest. The centroids are then updated to be the mode of the points in each cluster, and the process is repeated until the centroids converge and the assignments of points to clusters do not change.

Data Preparation

In our research, we employed the identical dataset utilized in the analysis conducted by Aouedi et al. [START_REF] Aouedi | Network traffic analysis using machine learning: an unsupervised approach to understand and slice your network[END_REF] to compare the four clustering algorithms selected. Specifically, the dataset was derived from the 'IP Network Traffic Flows, Labeled with 75 Apps' dataset, which is publicly available on Kaggle. This dataset was meticulously curated by collecting network data from the Universidad Del Cauca, Popayàn, Colombia, and consists of a substantial 3,577,296 instances.

Data preprocessing

We begin the data preprocessing by removing data duplicates in the dataset in order to avoid a bias towards said duplicates. Next, we review the dataset's features. The vast majority of the features are numerical and as such do not require preprocessing other than normalization. However, we identify five features that are not numeric and require additional processing: Timestamp, Source.IP, Destination.IP, Source.Port, Destination.Port. Timestamp instances can be converted to integers. IP addresses and ports are features that are represented numerically but are not numeric. For example, port 80 is assigned to HTTP protocols, port 110 is assigned to POP3 protocols, and port 443 is assigned to HTTPS protocols, but ports 80 and 110 are no closer to each other than port 443. In other words, the numerical nomenclature does not correspond to a correlation between ports. We have therefore opted for an arbitrary grouping of ports into five categories: "3128", "443", "80", "0" and "other". In the case of IP addresses, the dot-decimal notation, for example 192.0.2.1, represents a 32-bit notation, so we adopt the following conversion formula 16777216 × 4 th decimal + 65536 × 3 rd decimal + 256 × 2 nd decimal + 1 × 1 st decimal.

Features Selection

The dataset consists of 87 features. Such a number of features imposes the issue of high dimensionality. The issue relates to the fact that with a high number of features comes the risk of encountering redundancy between features or features that do not provide information useful to the clustering, leading to an overall reduction in the performance of the algorithm. 5 Experimentation Analysis

Hyperparameter Analysis

The number of clusters is a hyperparameter of the k-means, bisecting k-means, and k-modes clustering algorithms. It must thus be chosen a priori. Different metrics allow to evaluate the ideal number of clusters, whereby ideal we refer to the best separation and definition of clusters with little overlap between clusters and low dispersion within each cluster.

In this work, we decided to adopt the following methods:

• Elbow method: this method evaluates the intra-cluster variance. In other words, the distance between data points within a cluster. The name of the method refers to the search for the inflection point in the decrease of the variance with the number of clusters. This finds the number of clusters at which the rate of decrease in variance decreases. • Silhouette score: measures the distance between clusters (and thus their significance). The higher the silhouette score, the more distinct the clusters are.

• Davies-Bouldin score: the score is defined as the average similarity measure of each cluster with its most similar cluster, where similarity is the ratio of intra-cluster distances to inter-cluster distances. Thus, more distant and less dispersed clusters will get a better score. The lower the score, the better.

We have applied these methods to clusters generated by the k-means and bisecting k-means algorithms. In executing the k-means algorithm the best Silhouette and Davies-Bouldin scores are obtained for a number of clusters of 6 (Figures 1 and2 ), whereas for the bisecting k-means algorithms the best scores are obtained generating 5 clusters. We therefore decided to set the number of clusters to 6. The Elbow method did not identify a very clear inflection point and was therefore not taken into account when determining the ideal number of clusters (See Appendix).

Selection of DBSCAN hyperparameters

The DBSCAN algorithm, because of the way it defines clusters, does not allow the number of clusters to be defined a priori. Instead, the algorithm creates clusters based on density and requires the parameters min_samples and eps to be declared. min_samples defines the minimum number of neighbors for a data point to be considered a central data point and eps defines the distance between these neighbors and the central data point. The central points and their neighbors constitute a cluster.

We chose to obtain the same number of clusters as for the other algorithms. To do so, we performed a grid search of the parameters min_samples and eps. With the number of clusters, we calculated the silhouette score and the Davies Bouldin score for each iteration (see Table 1).

Based on the results of the grid search, we selected the DBSCAN hyperparameters min_samples = 5000 and eps = 1. This algorithm produces 6 clusters plus outliers (number of clusters = 7).

Clustering analysis

In analysing the clusters generated by the unsupervised machine learning algorithms that we selected, we opted to generally reproduce the analysis of Aouedi et al. [START_REF] Aouedi | Network traffic analysis using machine learning: an unsupervised approach to understand and slice your network[END_REF] to ensure comparability of results. In the following section we outline the most meaningful results for each algorithm and our analysis and interpretation of their performance. The complete analysis of the results is available as an annex.

DBSCAN

We begin the analysis from the clusters generated by the DBSCAN algorithm. The algorithm produced six clusters which, in total, correspond to 40.2% of the data points. The remaining 59.8% are classified as outliers.

The distribution of clusters across port numbers reveals that clusters 2 and 3 represent flows to port 3128, clusters 0 and 4 represent flows to port 443 and clusters 1 and 5 represent flows to other ports. In other words, the destination port number determines membership to one cluster or another, with no cluster overlapping with more than one port type. The flows destined to ports 80 and 0 are classified as outliers.

Because of the two different clusters representing flows to ports 3128, 443, and "other", we looked for other characteristics to distinguish membership to one cluster or another. It is immediately obvious that the second characteristic determining cluster membership is the date and time of the flow. For example, among the clusters representing flows to port 3128, cluster 2 contains flows dated April 28 and earlier and cluster 3 contains flows after this date. A similar distinction separates clusters 0 and 4, and 1 and 5. We can therefore conclude that the algorithm focused only on the Destination.Port and Timestamp features to classify the data points, completely ignoring all other features. This is evidenced by the distribution of data points across all other features: the clusters are similarly distributed across all values of the remaining features.

k-modes

The k-modes algorithm divides the data points into 6 clusters representing 32.7%, 18.7%, 16.3%, 16.2%, 10.1%, and 6.01% of the total sample respectively.

The k-modes algorithm is better suited for handling one-hot encoded categorical variables. Therefore, we first analyzed how cluster membership was distributed between destination and source ports, which constitute the categorical variables of the dataset.

Flows to port 3128 appear to belong exclusively to clusters 0 and 5. Flows to port 443 belong primarily to clusters 4 and 1, with a small percentage (1.5% of flows to port 443) belonging to cluster 0. Flows to port 80 are assigned to clusters 0, 1, and 4. Finally, the flows to the other ports belong to clusters 2 and 3 and, in a small part to cluster 0 and 5 (0.7% and 0.2% of flows to other ports 443).

Flows from ports 443 and 80 belong mostly to cluster 2 (99.9% and 98.3%). Cluster 3 constains flows from port 3128 and consists of the vast majority of flows from this port (97%). Finally, flows to other ports belong mostly to clusters 0, 1, 4 and 5 (99.7%).

Therefore the algorithm identifies a group of flows from port 3128 to other ports (cluster 3), another group of flows from port 443 and 80 to other ports (cluster 2), two clusters destined to port 3128 (clusters 0 and 5), and two other going to port 443 (clusters 1 and4).

An analysis of the partition of the clusters across applications confirms that datapoints of cluster 3 represent the majority of HTTP and HTTP Proxy applications. Cluster 2 mostly represents Google and HTTP applications, but

k-means

The k-means algorithm divides the data points into seven clusters representing respectively 43.3%, 26.6%, 21.8%, 6.26%, 3.54%, and 0.0064% of the total sample.

We analyzed each cluster individually in order to better understand the clustering trends by k-means.

Clusters 2 and 4 together represent 66.5% of the flows and share similar characteristics. They both represent short and medium flows sending short and medium packets. Packets in the forward direction are small. The backwards packets are short and medium. These characteristics are compatible with browser applications like Google, Amazon, etc. We expect browsing traffic to constitute a large portion of the flows in the sample.

Clusters 1 and 3 constitute 9.5% of flows. They are both characterized by long and medium flows with high maximum inter-packet arrival time (IAT) and large packets in the forward direction. This traffic could correspond to dataintensive applications such as file transfers, backups, or large data downloads.

Cluster 0 (21.8% of flows) contains the majority of the long flows and exclusively flows with a large maximum IAT. The length of packets in both backwards and forwards directions is short and medium. The fact that the cluster contains the majority of flows to applications like Dropbox suggests that this type of cluster contains at least some download traffic. This type of traffic is also typical of streaming applications Cluster 5 is a very small cluster (0.0064% of flows) that contains medium and long forward flows. This cluster is also characterized by a large maximum IAT and large forward packet lengths. Like for clusters 1 and 3 this type of flow may correspond to data-intensive applications.

We can conclude that this clustering algorithm did not rely too heavily on categorical features such as port class and was successful in capturing the differences in flow type in the sample.

Bisecting k-means

The bisecting k-means algorithm divides the data points into six clusters representing respectively 28.5%, 25.3%, 21.6%, 20.2%, 2.54%, and 1.88% of the total sample. Cluster 0, the largest cluster with 28.5% of flows, represents flows mostly destined to port 3128. The flows are short and medium in duration with no other distinctive pattern in maximum IAT, packet length and bytes sent in the initial window. It represents a large portion of HTTP and Google traffic and it can be assumed to represent browsing traffic. Clusters 1 and 2 (45.5% of flows) contain similar flows: in both, flows are short and medium in duration and are directed to ports in class 443, 80 and "other". These flows are classified as SSL, HTTP and Google applications suggesting mostly browsing activity like for cluster 0. The feature distinguishing flows in the two clusters is the timestamp: cluster 1 contains flows dating 09/05 and after, while cluster contains flows dating before such date. Therefore, the algorithm has used this feature to bisect flows in the two clusters.

Cluster 5 (21.6% of flows) contains Google and HTTP Proxy flows destined to all ports. These flows have a long duration and a high maximum IAT sending short and medium packets. This cluster is similar to cluster 0 generated by k-means and may contain streaming applications flows.

Clusters 3 and 4 together represent a small portion of the sample (4.42%). Both clusters contain long flows with a high maximum IAT. Flows in cluster 3 are mostly destined to ports classified as "other" while flows in cluster 4 are destined mostly to ports 3128, 443, and 80. The two clusters also differ in packet length, both forward and backward: cluster 3 contains smaller backward and longer forward packets while cluster 4 shows the opposite trend. Both clusters don't display belonging to a particular type of applications but are likely to characterize data transfer flows.

Discussion

In this work we compared the performance of four clustering algorithms on network flows data to establish which algorithm is best suited for network splicing. We found that the four algorithms can classify the same network flow data with very different results. Two clustering algorithms, DBSCAN and k-mode, give more importance to categorical data to separate the flows into clusters. The k-mode clustering algorithm focuses solely on port classes to group data. This algorithm, which is designed to handle "one-hot encoded" categorical data, appears to prioritize this type of data over numerical data in mixed type datasets. We therefore conclude that the algorithm is not suitable for clustering network data. The DBSCAN algorithm, on the other hand, focused on port number classes and flow timestamps to separate the data into clusters, while the rest of the data variance is still represented by the outliers in the dataset (about 60% of the total sample). In general, the DBSCAN algorithm can be challenging to optimize and, of all the algorithms applied in this work, it is the most computationally intensive. We do not entirely reject the use of this algorithm, but we advise using it with some caveats. For example, we suggest excluding or penalizing categorical data. Also, temporal data should be excluded or preprocessed to capture the daily and weekly periodicity of some network flow events. The k-means and bisecting k-means algorithms perform best in our comparison. The two algorithms are closely related and we detected similarities between the clusters generated by the two algorithms. We tried to interpret their clustering results to detect application patterns (like browsing and data transfers). The goal is not to understand the nature of the clustering in detail, but to be able to conclude whether the patterns detected by the algorithms are similar to actual patterns of network usage. These two algorithms not only produced more meaningful clusters, but they are also the least computationally intensive and can more easily scale to datasets containing millions of streams. Finally, both algorithms allow the number of clusters to be defined a priori. This is advantageous when the number of slices in a network needs to be predefined or the number of available slices is less than the optimal number defined by the Silhouette score or other metrics. One difference between the two is that the bisecting k-means algorithm seems to place more importance on the timestamp information in the dataset than k-means and splits otherwise similar streams on their timestamp only. As in the use of the DBSCAN algorithm, a better way to handle timestamp information would be to extract the day of the week or time of day rather than directly converting timestamps into a numeric variable. Because of this last observation, we conclude that the k-means algorithm is the best clustering algorithm for network data.

(a) (b) (c) (d) (e) (f) (g) (h)

Conclusion

The aim of this work was to establish a comparison between clustering algorithms for network slicing applications. We were able to confirm that the k-means algorithm is the better suited among the ones we tested for clustering network flow data. In the process, we were also able to improve the preprocessing of the data compared to previous work and we identified good practices that can be applied in future works. Among these is the careful preprocessing of temporal information as it can heavily bias clustering without contributing to a meaningful clustering of flows. For future work, our observations should be tested against different data originating from different networks. Our working dataset captured the activity in a university network, whose usage patterns may not be reflected in different networks such as public networks or private company networks. A comparison between the clustering performances of the k-means algorithm in the presence and absence of categorical features, like the port number, should be conducted to assess the utility of this information and to evaluate alternative preprocessing practices for this type of features. Finally, network slicing based on unsupervised machine learning techniques should be implemented to validate the efficacy of this approach. Supplementary information. Supplementary information is available as an appendix.

A Appendix

Fig. 1

 1 Fig. 1 Silhouette scores for clusters by number of clusters generated by the k-means algorithm.

Fig. 2

 2 Fig. 2 Davies-Bouldin scores for clusters by number of clusters generated by the k-means algorithm.

Fig. 3

 3 Fig. 3 Silhouette scores for clusters by number of clusters generated by the bisecting kmeans algorithm.

Fig. 4

 4 Fig. 4 Davies-Bouldin for clusters by number of clusters generated by the bisecting kmeans algorithm.

Fig.

  Fig. Distribution of the datapoints across the clusters generated by DBSCAN.

Fig.

  Fig. Distribution of DBSCAN generated clusters across destination ports.

Fig.

  Fig. Distribution of DBSCAN generated clusters across timepoints.

Fig. 8

 8 Fig. 8 Distribution of the datapoints across the clusters generated by k-modes.

Fig. 9

 9 Fig. 9 Distribution of k-modes generated clusters across destination ports.

Fig. 10

 10 Fig. 10 Distribution of k-modes generated clusters across source ports.

Fig. 11

 11 Fig. 11 Distribution of k-modes generated clusters across applications.

Fig. 12

 12 Fig. 12 Distribution of the datapoints across the clusters generated by k-means.

Fig. 13 (

 13 Fig. 13 (a) Distribution of k-means generated clusters across applications. (b) Distribution of k-means generated clusters across destination ports. (c) Distribution of k-means generated clusters across flow durations. (d) Distribution of k-means generated clusters as a function of maximum inter-arrival time (IAT) duration. (e) Distribution of k-means generated clusters as a function of the maximum backwards packet length. (f) Distribution of k-means generated clusters as a function of the maximum forward packet length. (g) Distribution of k-means generated clusters as a function of the total number of bytes sent in initial window in the backwards direction. (h) Distribution of k-means generated clusters as a function of the total number of bytes sent in initial window in the forward direction.

Fig. 14

 14 Fig. 14 Distribution of the datapoints across the clusters generated by bisecting k-means.

Fig. 15

 15 Fig. 15 Distribution of bisecting k-means generated clusters across timepoints.

Fig. 16 (

 16 Fig. 16 (a) Distribution of bisecting k-means generated clusters across applications. (b) Distribution of bisecting k-means generated clusters across destination ports. (c) Distribution of bisecting k-means generated clusters across flow duration. (d) Distribution of bisecting k-means generated clusters as a function of maximum inter-arrival time (IAT) duration. (e) Distribution of bisecting k-means generated clusters as a function of the maximum backwards packet length. (f) Distribution of bisecting k-means generated clusters as a function of the maximum forward packet length. (g) Distribution of bisecting k-means generated clusters as a function of the total number of bytes sent in initial window in the backwards direction. (h) Distribution of bisecting k-means generated clusters as a function of the total number of bytes sent in initial window in the forward direction.

Fig. A. 1

 1 Fig. A.1 Inertia scores by number of clusters generated by the k-means algorithm.

Fig. A. 2 Fig. A. 3 Fig. A. 4

 234 Fig. A.2 Inertia scores by number of clusters generated by the bisecting k-means algorithm.

Fig. A. 5

 5 Fig. A.5 (a) Distribution of the datapoints across the clusters generated by k-means. (b) Distribution of k-means generated clusters across applications. (c) Distribution of k-means generated clusters across destination ports. (d) Distribution of k-means generated clusters across timepoints. (e) Distribution of k-means generated clusters across flow duration. (f) Distribution of k-means generated clusters as a function of maximum inter-arrival time (IAT) duration. (g) Distribution of k-means generated clusters as a function of the maximum backwards packet length. (h) Distribution of k-means generated clusters as a function of the maximum forward packet length. (i) Distribution of k-means generated clusters as a function of the total number of bytes sent in initial window in the backwards direction. (j) Distribution of k-means generated clusters as a function of the total number of bytes sent in initial window in the forward direction.

Fig. A. 6

 6 Fig. A.6 (a) Distribution of the datapoints across the clusters generated by bisecting k-means. (b) Distribution of bisecting k-means generated clusters across applications. (c) Distribution of bisecting k-means generated clusters across destination ports. (d) Distribution of bisecting k-means generated clusters across timepoints. (e) Distribution of bisecting k-means generated clusters across flow duration. (f) Distribution of bisecting k-means generated clusters as a function of maximum inter-arrival time (IAT) duration. (g) Distribution of bisecting k-means generated clusters as a function of the maximum backwards packet length. (h) Distribution of bisecting k-means generated clusters as a function of the maximum forward packet length. (i) Distribution of bisecting k-means generated clusters as a function of the total number of bytes sent in initial window in the backwards direction. (j) Distribution of bisecting k-means generated clusters as a function of the total number of bytes sent in initial window in the forward direction.

Table 1

 1 Grid search of DBSCAN hyperparameters and the resulting Davies-Bouldin and Silhouette scores

	min_samples	eps	Davies-Bouldin score Silhouette score Number of clusters
	1000	0.75	1.43	0.09	16
	1000	1	1.53	0.11	17
	1000	1.5	2.16	0.11	16
	2500	1	1.38	-0.03	16
	2500	0.75	1.46	0.02	10
	2500	1	1.58	0.11	11
	2500	1.5	2.16	0.14	4
	4000	1	1.53	0.07	11
	4500	1	1.52	0.06	10
	4750	1	1.51	0.07	9
	4850	1	1.51	0.07	9
	4900	1	1.51	0.07	9
	4950	1	1.54	0.06	8
	5000	0.5	1.32	-0.12	7
	5000	0.75	1.42	-0.01	7
	5000	1	1.54	0.05	7
	5000	1.5	2.33	0.18	3


Daniel Perez
email: daniel.perez@ens.fr

On the persistent homology of almost surely C 0 ([0, t], R) stochastic processes

This paper investigates the propreties of the persistence diagrams stemming from almost surely continuous random processes on [0, t]. We focus our study on two variables which together characterize the barcode : the number of points of the persistence diagram inside ,x+ε and the number of bars of length ≥ ε, N ε . For processes with the strong Markov property, we show both of these variables admit a moment generating function and in particular moments of every order. Switching our attention to semimartingales, we show the asymptotic behaviour of N ε and N x,x+ε as ε → 0 and of N ε as ε → ∞. Finally, we study the repercussions of the classical stability theorem of barcodes and illustrate our results with some examples, most notably Brownian motion and empirical functions converging to the Brownian bridge.

State of the art

One of the questions of interest in the theory of persistent homology is the following: given a random function on some topological space X, what can we say about the barcode B(X) of this process? The study of the topology of (super)level-sets of random functions has been a subject of interest in probability theory for a long time [START_REF] Adler | Random Fields and Geometry[END_REF][START_REF] Azaïs | Level Sets and Extrema of Random Processes and Fields[END_REF][START_REF] Kahane | Some random series of functions[END_REF][START_REF] Gall | Brownian Motion, Martingales, and Stochastic Calculus[END_REF][START_REF] Mörters | Brownian Motion[END_REF][START_REF] Rice | Mathematical analysis of random noise[END_REF]. Most prominently for this paper, by Le Gall and Duquesne, who gave a construction of a tree from any continuous function f : [0, 1] → R [START_REF] Duquesne | Random trees, Lévy processes and spatial branching processes[END_REF], and who interpreted different properties of these trees to give fine results about Lévy processes [START_REF] Duquesne | Probabilistic and fractal aspects of Lévy trees[END_REF]. Picard later linked the upper-box dimension of these trees to the regularity of the function f [START_REF] Picard | A tree approach to p-variation and to integration[END_REF]. In essence, these trees have proved to be a fruitful and natural setting from which many results regarding the topology of the superlevel sets of the function f stem [START_REF] Curien | The Brownian cactus I. Scaling limits of discrete cactuses[END_REF][START_REF] Curry | The fiber of the persistence map for functions on the interval[END_REF][START_REF] Evans | Probability and Real Trees[END_REF][START_REF] Neveu | Renewal property of the extrema and tree property of the excursion of a one-dimensional Brownian motion[END_REF][START_REF] Perez | On C 0 -persistent homology and trees[END_REF].

A natural question is whether, or indeed how, these results are applicable to the persistent homology of stochastic processes. The answer turns out to be total: the study of barcodes and trees are completely equivalent in degree 0 of homology. This has been established in [START_REF] Perez | On C 0 -persistent homology and trees[END_REF], in which a dictionary between H 0 -barcodes and the trees of Le Gall and Duquesne was constructed.

In this paper, we focus mainly on two barcode-related quantities, namely the number of bars in the barcode of f of length ≥ ε, which we will denote N ε f and the number of bars in the barcode of f containing the interval [x, x + ε], which we will denote N x,x+ε f . Whenever the function is implicit from the context, we may omit the subscript f .

With the dictionary established in [START_REF] Perez | On C 0 -persistent homology and trees[END_REF], it is possible to interpret the results previously obtained by Picard in the context of trees. Most notably, Picard showed that the regularity of functions is closely related to their small-bar asymptotics.

Theorem 1.1 (Picard, §3 [START_REF] Picard | A tree approach to p-variation and to integration[END_REF]). Given a continuous function f : [0, 1] → R,

V(f ) = dim T f = lim sup ε→0 log N ε f log(1/ε) ∨ 1 (1.1)
where dim denotes the upper-box dimension, a ∨ b = max{a, b}, T f denotes the tree constructed from f (cf. equation 2. [START_REF] Mörters | Brownian Motion[END_REF]) and

V(f ) := inf{p ≥ 1 | f p-var < ∞} , (1.2)
where • p-var denotes the (true) p-variation defined in definition 2.13.

Moreover, for processes which are self-similar in distribution, Picard [START_REF] Picard | A tree approach to p-variation and to integration[END_REF] shows the almost sure small-bar asymptotics is closely related to this self-similarity (the results are shown for trees, but are immediately interpretable in terms of barcodes by the results of [START_REF] Perez | On C 0 -persistent homology and trees[END_REF]). Throughout this paper we will adhere to the following convention regarding asymptotic relations. Definition 1.2. Let f and g be any two functions. We define ∼ to be the following equivalence relation

f (x) ∼ g(x) as x → a ⇐⇒ lim x→a f (x) g(x) = 1 . (1.3) Theorem 1.3 (Picard, §3 [24]
). Let X : [0, 1] → R be Brownian motion, a Lévy α-stable process or fractional Brownian motion, then, almost surely, there exists a constant C H such that

N ε X ∼ C H ε 1/H as ε → 0 , (1.4)
where H is the self-similary index, i.e. the H for which X satisfies X λt = λ H X t for every λ > 0 and t ≥ 0 in distribution.

Parallel to these developments, some results regarding the persistent homology of Brownian motion have also been provided by the topological data analysis (TDA) community. In particular, for Brownian motion B Chazal and Divol gave a formula for the distribution of the number of points N x,y B lying inside a given rectangle ]-∞, x] × [y, ∞[ in the persistence diagram of Brownian motion, Dgm(B) [START_REF] Chazal | The density of expected persistence diagrams and its kernel based estimation[END_REF].

Proposition 1.4 (Chazal, Divol, [START_REF] Chazal | The density of expected persistence diagrams and its kernel based estimation[END_REF]). For 0 < x < y, the distribution of N x,y B is

P(N x,y B ≥ k) = Σ 2k-1 ψ(x, t 1 )ψ(y -x, s 1 )ψ(y -x, t 2 ) • • • ψ(y -x, t k ) k-1 i=1 dt i k-2 j=1 ds j , (1.5)
where Σ 2k-1 denotes the domain bounded by the (2k -1)-simplex and we note a vector in R 2k-1 by (t

1 , s 1 , • • • , s k-2 , t k-1 ) and ψ(x, t) := x √ 2πt 3 e -x 2 2t . (1.6)
Using this result Chazal and Divol established that E[N x,y ] was C 1 in x and y. In the context of our own results, we will show that this expectation is in fact an analytic function of x and y and give an explicit expression for N x,x+ε for x > 0 and ε > 0.

Other results regarding E[N x,y ] were obtained by Baryshnikov [3], who computed exactly E N x,y B µ for the Brownian motion with a strictly positive linear drift B µ t := µt + B t for µ > 0 over the whole ray [0, ∞[. Proposition 1.5 (Baryshnikov,[START_REF] Baryshnikov | Time series, persistent homology and chirality[END_REF]). The expected value of N x,x+ε B µ for x > 0 and µ > 0 over the whole ray [0, ∞[ is given by

E N x,x+ε B µ = 1 e 2µε -1 . (1.7)
In particular, as ε → 0, the following asymptotic relation holds

E N x,x+ε B µ ∼ 1 2µε - 1 2 + 1 6 µε + O(µ 3 ε 3 ) as ε → 0 . (1.8)
In this paper, we will be concerned with almost surely C 0 processes, but it is noteworthy that the study of smooth random fields (and their topology) is currently an open field of research in probability theory. A good introduction to the smooth setting is provided by the celebrated books of Adler and Taylor [START_REF] Adler | Random Fields and Geometry[END_REF], and that of Azaïs and Wschebor [START_REF] Azaïs | Level Sets and Extrema of Random Processes and Fields[END_REF].

Whenever possible and necessary, we give the definitions and most important results necessary to make the proofs in this paper self-contained. However, for the sake of brevity, we do not introduce all the probabilistic concepts necessary for this paper (most notably, we do not define Brownian motion or stochastic processes, filtrated probability spaces, nor stopping times and the strong Markov property). We kindly refer the reader unfamiliar with these concepts to Le Gall's [START_REF] Gall | Brownian Motion, Martingales, and Stochastic Calculus[END_REF] and Revuz and Yor's [START_REF] Revuz | Continuous Martingales and Brownian Motion[END_REF] books on stochastic calculus for a comprehensive introduction to the subject.

Our contribution

Our contribution can be summarized along the following points.

Theorem 1. Let X be a non-constant stochastic process on [0, t] defined on the filtered probability space (Ω, F, P) allowing an almost surely continuous modification and satisfying the strong Markov property. If we denote

R t := sup [0,t] X -inf [0,t] X , (1.9)
then, 1) .

P(N ε X ≥ k) ≤ P(R t ≥ ε) 2(k-
(1.10) Denote ε * the infimal value such that for all ε > ε * , P(R t ≥ ε) < 1. Then, for every ε > ε * and every x ∈ R, all the moments of the random variables N ε and N x,x+ε X are finite and their moment generating functions M (λ) converge uniformly and absolutely for every λ ∈ C such that Re(λ) < -2 log(P(R t ≥ ε)).

This theorem answers the question of the existence of moments (and their quantification) for the quantities N ε and N x,x+ε X in the context of almost surely continuous Markov processes. It also allows us to show the behaviour of large bars of the barcode of such a process in expectation.

Corollary 1. Under the same assumptions,

E[N ε X ] ∼ P(R t ≥ ε) as ε → ∞ . (1.11)
Having partially answered the question of large bars in this very general context, we switch our attention to the behaviour of small bars. Indeed, as the following result shows, the latter is very regular and closely related to the nature of the noise at hand. Theorem 2. Let X = M + A be a continuous semimartingale on [0, t] and suppose that for s ≥ 1

E [M ] s/2 t + t 0 |dA| τ s < ∞ , (1.12)
where [M ] t denotes the quadratic variation of M (cf. definition 3.2) and t 0 |dA| τ the total variation of A. Then, in L s (Ω),

N x,x+ε X ∼ L x X (t) 2ε + O(1) as ε → 0 N ε X ∼ [X] t 2ε 2 + O(ε -3/2 ) as ε → 0 ,
where L x X (t) denotes the local time of X on [0, t] at x.

Remark 1.6. The condition expressed in equation 1.12 is a technical one and is often employed in the theory of stochastic integration (cf. [START_REF] Revuz | Continuous Martingales and Brownian Motion[END_REF]). It is noteworthy that this condition is satisfied for a very wide range of processes. In fact, the space S s of continuous semimartingales X = M + A for which the quantity

X S s := [M ] 1/2 t + t 0 |dA| τ L s (Ω) < ∞ (1.13)
is a vector space that we may equip with the seminorm • S s . When s > 1, the quotient of S s by processes indistinguishable from zero is a Banach space which contains the space of continuous martingales such that E X s L ∞ ([0,t]) < ∞. For particular instances of local martingales, we have a full description of the barcode of these processes, which depends on their quadratic variation. Theorem 3. For any continuous local martingale M on [0, t] having deterministic and strictly increasing quadratic variation

[M ] t such that [M ] ∞ = ∞, E[N ε M ] = 4 k≥1 (2k -1) erfc (2k -1)ε 2[M ] t -k erfc 2kε 2[M ] t = [M ] t 2ε 2 + 2 3 + 2 k≥1 (2(-1) k -1) e -π 2 k 2 [M ]t/2ε 2 [M ] t ε 2 1 + ε 2 π 2 k 2 [M ] t .
Moreover on [0, t] and for x > 0,

E N x,x+ε M = ∞ k=1 erfc x + (2k -1)ε 2[M ] t ∼ 1 2ε [M ]t 0 ϕ(x, s) ds + k≥0 4(-2) k 2 2k+1 -1 ζ(2k + 2) π 2k+2 ∂ k ∂s k s=[M ]t ϕ(x, s) ε 2k+1 as ε → 0 ,
where ϕ(x, t) is the density of a centered Gaussian random variable of variance t and ζ denotes the Riemann zeta function.

Remark 1.7. Both expressions for E[N ε M ] in the above theorem converge (this can be easily shown by recalling that erfc(x) ∼ e -x 2

x √ π as x → ∞ and applying the ratio test). The first expression converges very fast for large ε (this is easily seen given the decay properties of the complementary error function erfc) and the second one yields extremely fast convergence for small ε. Similarly, the first expression for E N x,x+ε M converges quickly for large ε. On the other hand, the second expression can only be considered as an asymptotic expansion for small ε.

This theorem allows us to explain exactly the experimental observations we made through simulation regarding the barcode of Brownian motion (cf. figures 1 and 2). We use the classical stability theorem of barcodes [START_REF] Chazal | The Structure and Stability of Persistence Modules[END_REF] and complete our description of random processes by examining sequences converging to the processes above, which constitute universal limits for many random processes (most notably, random walks and empirical processes). Theorem 4. Let (M, d) be a compact Polish metric space and let X be an almost surely continuous stochastic process on M , defined on a probability space (Ω, F, P). Let (X n ) n∈N be any sequence of continuous stochastic processes defined on the same probability space and suppose there exists a 1 ≤ p ≤ ∞ such that

δ n := X -X n L p (Ω,L ∞ (M,R)) ---→ n→∞ 0 . (1.14)
Then, for every ε ≥ 2aδ n ,

N ε Xn -N ε X ≤ N ε-2aδn X -N ε+2aδn X , (1.15
)

with probability ≥ 1 -1 a p . Suppose further that E[N ε X ] is continuous in ε. Then, E N ε Xn -N ε X X -X n L ∞ (M,R) ≤ aδ n ≤ ω ε (2aδ n ) . (1.16)
where

ω ε (δ) := E N ε-δ X -N ε+δ X . Moreover, P N ε Xn -N ε X ≥ k ≤ ω ε (2aδ n ) k + 1 a p and P N ε Xn -N ε X ≥ k , X -X n L ∞ (M,R) ≤ aδ n ≤ ω ε (2aδ n ) k .
(1.17)

If p = ∞ and still assuming E[N ε X ] < ∞ and is continuous, for any ε ≥ 2δ n , N ε Xn L 1 ---→ n→∞ N ε X and E N ε X -N ε Xn ≤ ω ε (2δ n ) .
With analogous hypotheses, the same statement holds for N x,x+ε X .

Remark 1.8. The condition that E[N ε ] is often satisfied. By virtue of theorem 1 and the dominated convergence theorem, this continuity condition is satisfied if for all ε > ε * N ε X almost surely does not have a discontinuity at ε. That is, if the process ε → N ε is continuous in probability. More concretely, the condition also holds as soon as the distributions of the stopping times constructed in definition 2.11 are themselves continuous in ε. Some immediate examples of processes where the continuity condition is satisfied are continuous local martingale M with deterministic and strictly increasing quadratic variation with [M ] t < ∞, as implied by theorem 3.

Finally, we use the previous results to give statements about well-known processes, such as Brownian motion, Itô processes and some limiting processes (most notably the Fourier decomposition of Brownian motion and the convergence of empirical processes to the Brownian bridge), cf. section 5.

2 Some generalities about H 0 homology and trees Let us briefly recall the construction of a tree from a continuous function f : M → R detailed in [START_REF] Perez | On C 0 -persistent homology and trees[END_REF]. Definition 2.1. Let M denote a connected, locally path-connected, compact topological space, f : M → R be a continuous function and let x, y ∈ X, then the function

d f (x, y) := f (x) + f (y) -2 sup γ:x →y min s∈[0,t] f (γ(s)) , (2.18)
where the supremum runs over all paths γ : [0, 1] → M is a pseudo-distance on M and the quotient metric space

T f := M/{x ∼ y ⇐⇒ d f (x, y) = 0} (2.19)
equipped with the distance d f is a rooted R-tree, whose root coincides with the image in T f of the point in [0, 1] at which f achieves its infimum.

Definition 2.2. Let M denote a connected, locally path-connected, compact topological space and f : M → R be a continuous function. We denote π f : M → T f the canonical projection.

The tree T f has the particularity that its branches correspond to connected components of the superlevel sets of f , as illustrated by figure 3. To define N ε on this tree, it is first necessary to introduce the so-called ε-simplified or ε-trimmed tree of T ε f . This object is obtained by "giving a haircut" of length ε to T f . More precisely, if we define a function h : T f → R which to a point τ ∈ T f associates the distance from τ to the highest leaf above τ with respect to the filtration on T f induced by f , then

Definition 2.3. Let ε ≥ 0. An ε-trimming or ε-simplification of T f is the metric subspace of T f defined by T ε f := {τ ∈ T f | h(τ ) ≥ ε} (2.20)
With this definition, we can interpret N ε geometrically as being equal to the number of leaves of T ε f . The reason for this is explicited in [START_REF] Perez | On C 0 -persistent homology and trees[END_REF]. The idea is that, starting from T f , we can look at the longest branch (starting from the root) of T f . This branch corresponds to the longest bar of B(f ), since branches of T f correspond to connected components of the superlevel sets of f . Next, we erase this longest branch and, on the remaning (rooted) forest, look for the next longest branch. This will be the second longest bar of the barcode. Proceeding iteratively in this way, we retrieve B(f ). An illustration of this can be found in figure 4. Figure 3: A function f : [0, 1] → R and its associated tree T f in dashed lines. Visually, T f can be obtained by imagining that we put glue everywhere along the bottom of the curve, and then collapse the curve along the t-axis of the drawing above. Key quantities we have introduced such as a typical node of the tree τ , the value of its height function h(τ ) and the projection π : [0, 1] → T f are depicted, as well as the root of the tree O. Finally, some quantities relating to the preimages of nodes τ ∈ T f from definition 2.7 are also shown. Figure 4: A depiction of the first steps of the algorithm which assigns a barcode B(f ) to a tree T f . We start by picking the longest branch in the tree, starting from the root. Its endpoints give us the endpoint values of the longest interval in the barcode (since this is the first bar and the interval is connected, we may extend this bar to -∞). Next, we erase the branch on the tree, so that we are left with a forest F and pick the largest branch in the remaining forest. We retain its endpoints, yielding the second bar, and erase the corresponding branch. We repeat this procedure for all subsequent branches until we have erased the entire tree.

Proposition 2.4. The number of bars containing x persisting through x + ε (i.e. the bars containing the interval [x,

x + ε]), N x,x+ε f := rank(H 0 ({f ≥ x + ε} → {f ≥ x})) = #{τ ∈ T f | f (τ ) = x and h(τ ) ≥ ε} . (2.21)
Proof. By the results of [START_REF] Perez | On C 0 -persistent homology and trees[END_REF], there is a correspondence between T f and the barcode B(f ). Every element of the set

{τ ∈ T f | f (τ ) = x and h(τ ) ≥ ε} , (2.22)
has a corresponding image in one and only one bar of the barcode which contains the interval [x, x + ε]. Conversely, for every bar in the barcode containing the interval [x, x + ε], there is a unique image on the tree at height x, τ , and, since the bar persists a length ≥ ε after x, h(τ ) ≥ ε.

Remark 2.5 (Link with traditional persistence diagrams and sublevel set filtrations). In the tree formalism, it is typical to consider superlevel filtrations as opposed to sublevel ones, as is typically done in traditional persistence theory. Considering one or the other poses no problem for us, as one can pass from one filtration to the other by switching f into -f . Diagrams (in the sense of collections of points (b, d) of moments of birth b and death d of bars of the barcode) of a filtration by superlevel sets lie below the diagonal, as the moment of birth occurs higher than the moment of death. Given the diagram of -f as computed with the superlevel filtration (using for instance the tree), we can retrieve the diagram associated to sublevels of f by sending each point in the diagram (of the superlevel filtration of -f )

(b, d) → (-d, -b) . (2.23)
For most results, this subtlety makes little to no difference, as most of the examples considered (typically Brownian motion B) are processes which are symmetric, i.e. B t = -B t in distribution for all t. This is notably the case for the results obtained by Chazal and Divol [START_REF] Chazal | The density of expected persistence diagrams and its kernel based estimation[END_REF]. However, when considering asymetric processes and for results where specific formulae are given (such as in theorem 3), it is necessary to keep in mind the transformation above to correct the formulae accordingly wherever necessary if one is considering sublevel sets. Finally, with respect to the superlevel (resp. sublevel) set filtration, we will henceforth always consider that the infinite bars of the barcode are capped at inf(f ) (resp. sup(f )). Equivalently, in terms of barcodes we will always consider for any bar

b = b ∩ [inf f, sup f ] . (2.24)
On a tree T f , we can define a notion of integration by defining the unique atomless Borel measure λ which is characterized by the property that every geodesic segment on T f has measure equal to its length. Formally, we can express λ in two ways [START_REF] Picard | A tree approach to p-variation and to integration[END_REF]

λ = R dx τ ∈T f f (τ )=x δ τ and λ = ∞ 0 dε τ ∈T f h(τ )=ε δ τ .
(2.25)

Proposition 2.6.

λ(T ε f ) = ∞ ε N a f da = R N x,x+ε f dx (2.26)
Proof. By using the second identity for λ,

λ(T ε f ) = ∞ ε N a f da , (2.27)
since every sum in the second expression is finite for all ε > 0 and has N ε terms. Writing it using the first identity, we must restrict the sum in the identity to

τ ∈T f f (τ )=x h(τ )≥ε δ τ , (2.28)
which is finite for all ε > 0. There are exactly N x,x+ε f terms in this sum, therefore

λ(T ε f ) = R N x,x+ε f dx .
(2.29)

2.1 Persistent homology of processes on [0, t]

Consider now f : [0, t] → R. Given the total order on R, the preimages of T f by π f : [0, t] → T f inherit a natural order structure. This allows us to define Definition 2.7. The right

(resp. left) preimage of τ ∈ T f by π f is - → τ := sup π -1 f (τ ) (resp. ← -τ := inf π -1 f (τ )) .
(2.30)

See figure 3 for a depiction of these preimages.

Remark 2.8. One can have ←τ = -→ τ .

Whenever f : [0, t] → R, we can compute N ε f is by counting the number of times we go up by at least ε from a local minimum and down by at least ε from a local maximum. This idea can be formalized by the following sequence, originally introduced by Neveu et al. [START_REF] Neveu | Renewal property of the extrema and tree property of the excursion of a one-dimensional Brownian motion[END_REF]. Definition 2.9. Setting S ε 0 = T ε 0 = 0, we define a sequence of times by induction

T ε i+1 := inf s ≥ S ε i sup [S ε i ,s] f -f (s) > ε S ε i+1 := inf s ≥ T ε i+1 f (s) -inf [T ε i+1 ,s] f > ε Lemma 2.10. If k ≥ 2, and f : [0, t] → R is continuous, N ε f ≥ k ⇐⇒ S ε k-1 ≤ t . (2.31) Proof. (N ε ≥ k =⇒ S ε k-1 ≤ t):
We start by selecting all bars of length ≥ ε, they are of the form [b i , a i ]. For each bar, pick the point a i -ε and look at its corresponding node τ ∈ T f (this is equivalent to considering the set of nodes τ i on the tree such that h(τ i ) = ε). Next, let us order the bars by the value of their left preimages of the τ i by virtue of the total order on R. By construction, since the τ i all stem from different connected components of the superlevel set the ( ←τ i , -→ τ i ) satisfy -→ τ i ≤ -→ τ j for i < j .

(2.32)

Since N ε ≥ k, there are at least (k -1) right preimages and left preimages by π f of leaves of T ε f stemming from the first (k -1) bars, which we denote {( ← -

τ i , - → τ i )} 1≤i≤k-1 satisfying - → τ 1 = T ε 1 ≤ S ε 1 ≤ - → τ 2 = T ε 2 ≤ • • • ≤ - → τ k-1 = T ε k-1 .
(2.33)

Note that -→ τ 1 > 0 as soon as k ≥ 2 and ε > 0. Since N ε ≥ k, there at least an extra bar unaccounted for. Consider taking the left preimages of the nodes in T f corresponding to the bottom and top of this bar and note these preimages t b and t t respectively. Note that t ≥ t b ≥ T ε k-1 , as otherwise we would have t b < -→ τ i for some i ≤ k -1, entailing that π f (t b ) belongs to the connected subtree π f ([0, -→ τ i [), which contradicts that π f (t b ) belongs to the kth bar, as this bar is by construction disjoint from

π f ([0, - → τ i [). Similarly t ≥ t t ≥ T ε k-1 . Moreover, d f (t t , t b ) > ε, which shows that S ε k-1 ∈ [t b , t t ] and in particular that S ε k-1 ≤ t. (N ε ≥ k ⇐= S ε k-1 ≤ t): Since S ε k-1 > T ε k-1 = - → τ k-1
, there are at least (k -1) distinct bars.

We easily check that, by definition,

d f (S ε k-1 , T ε k-1 ) > 0, implying that π f (S ε k-1
) and π f (T ε k-1 ) lie on different branches of T f , and therefore S ε k-1 is a preimage of a distinct bar of length ≥ ε, implying N ε ≥ k. Definition 2.11. Let f : [0, t] → R be a continuous function. Setting U S x,ε 0 = U T x,ε 0 = 0, we define a sequence of times recursively

U T x,ε i+1 := inf s ≥ U S x,ε i f (s) ≤ x U S x,ε i+1 := inf s ≥ U T x,ε i+1 f (s) ≥ x + ε .
The maximum i for which U S x,ε i ≤ t is called the number of upcrossings by f from x to x + ε and we denote it U x,x+ε f . Similarly, setting DS x,ε 0 = DT x,ε 0 = 0 and defining

DT x,ε i+1 := inf s ≥ DS x,ε i+1 f (s) ≤ x DS x,ε i+1 := inf s ≥ DT x,ε i f (s) ≥ x + ε ,
we can define the number of downcrossings by f from x to x + ε and denote it D x,x+ε f as the maximum i for which DT x,ε i ≤ t. Proposition 2.12. Let f : [0, t] → R be a continuous function. Then, With the above, we are now ready to prove theorem 1.

N x,x+ε f = U x,x+ε f ∨ D x,x+ε f ≤ D x,x+ε f + 1 . ( 2
Proof of theorem 1. For simplicity and without loss of generality, let us set t = 1. The probability P(N ε ≥ k) can be written in terms of the stopping times T ε i and S ε i and their increments by the (strong) Markov property of X. By lemma 2.10, P(N ε ≥ k) = P(S ε k-1 ≤ 1) for k ≥ 2, so

P(N ε ≥ k) = Σ 2k-2 P(T ε 1 = t 1 )P(S 1 = s 1 | T 1 = t 1 ) • • • P(S k-1 = s k-1 | T k-1 = t k-1 ) k-1 i=1 ds i dt i .
(2.35) where, abusing the notation, the P(S i = s i | T i = t i ) and P(T i = t i | S i = s i ) denote the corresponding conditional densities and where Σ 2k-2 denotes the simplex

Σ 2k-2 := (t 1 , s 1 , • • • , s k-1 ) ∈ R 2k-1 0 ≤ t 1 ≤ s 2 ≤ • • • ≤ s k-1 ≤ 1 .
(2.36)

By the definition of these stopping times we know that

P(s ≤ T ε i ≤ t|S ε i-1 = s) = P sup τ ∈[s,t] sup [s,τ ] X -X τ ≥ ε P(t ≤ S ε i ≤ s|T ε i = t) = P sup τ ∈[t,s] X τ -inf [t,τ ] X ≥ ε
Both of these expressions are dominated by P(R 1 ≥ ε). Indeed,

P sup τ ∈[s,s ] sup [s,τ ] X -X τ ≥ ε ≤ P sup s∈[0,1] sup [0,s] X -X s ≥ ε (2.37)
and the supremum on the right hand side is dominated by R 1 . Thus,

P sup τ ∈[s,s ] sup [s,τ ] X -X τ ≥ ε ≤ P(R 1 ≥ ε) . (2.38)
Integrating the expression as a nested integral of P(N ε ≥ k), the variable s k-1 between t k-1 and 1

P(N ε ≥ k) = Σ 2k-3 P(T ε 1 = t 1 )P(S ε 1 = s 1 | T ε 1 = t 1 ) • • • P(t k-1 ≤ S ε k-1 ≤ 1 | T ε k-1 = t k-1 ) dt k-1 k-2 i=1 ds i dt i ≤ P(R ≥ ε) Σ 2k-3 P(T ε 1 = t 1 )P(S ε 1 = s 1 | T ε 1 = t 1 ) • • • P(T ε k-1 = t k-1 | S ε k-2 = s k-2 )dt k-1 k-2 i=1 ds i dt i
Carrying out the subsequent 2k -3 integrations and by repeated use of the inequality given in equation 2.38, we obtain the result

P(N ε ≥ k) ≤ P(R 1 ≥ ε) 2k-2 .
(2.39)

By the hypothesis of the theorem, for all ε ≥ ε * , P(R 1 ≥ ε) < 1 so the above condition guarantees the summability (and absolute and uniform convergence) of the series E e λN ε on the half plane Re(λ) < -2 log(P(R 1 ≥ ε)). Moreover the same summability condition holds for N x,x+ε , since the latter is dominated by N ε .

A priori estimates on the asymptotic behaviour of small and large bars

If f is a continuous function, the asymptotic behaviour of N ε is closely related to the regularity of f . For functions f : [0, t] → R, the correct notion of regularity to look at is the p-variation, of which we recall the definition. Definition 2.13. Let f : [0, t] → R be a function. The (true) p-variation of f is defined as

f p-var := sup P   t k ∈P |f (t k ) -f (t k-1 )| p   1/p (2.40)
where the supremum ranges over all finite partitions of [0, t].

The p-variation can be used to infer something about the asymptotic behaviour of N ε f , as shown by the following theorem.

Theorem 2.14 (Picard, §3 [START_REF] Picard | A tree approach to p-variation and to integration[END_REF]). Given a continuous function f : [0, 1] → R,

V(f ) = dim T f = lim sup ε→0 log N ε log(1/ε) ∨ 1 (2.41)
where dim denotes the upper-box dimension, a ∨ b = max{a, b},

V(f ) := inf{p ≥ 1 | f p-var < ∞} . (2.42) Remark 2.15.
A general version of this theorem, applicable on more general metric spaces exists [START_REF] Perez | On C 0 -persistent homology and trees[END_REF].

Corollary 2.16. For any deterministic function f : [0, 1] → R and for every δ > 0,

N ε f = O(ε -V(f )-δ ) as ε → 0 . (2.43)
Having characterized the behavious of N ε for small ε, we can characterize the behaviour of large bars (in expectation) using theorem 1.

Proof of corollary 1. Note p ε = P(R t ≥ ε). From theorem 1, we deduce,

p ε ≤ E[N ε ] ≤ p ε + p 2 ε 1 -p 2 ε =⇒ E[N ε ] ∼ p ε as ε → ∞ . (2.44)
3 Continuous semimartingales, local times and asymptotic behaviour of barcodes

In the previous section, we quantified the asymptotics of N x,x+ε an N ε solely based on the regularity of the functions considered. For stochastic processes on [0, t], we can refine this analysis by focusing on (continuous) semimartingales. Semimartingales constitute the largest class of processes with respect to which the Itô and Stratonovich integrals can be defined. In other words, they are a class of processes rich enough to be worthy of particular attention. For a comprehensive introduction to these objects and the probabilistic concepts included in this section, we kindly refer the reader to classical references on stochastic calculus [START_REF] Gall | Brownian Motion, Martingales, and Stochastic Calculus[END_REF][START_REF] Revuz | Continuous Martingales and Brownian Motion[END_REF]. Definition 3.1 (Local martingales and semimartingales). Let (Ω, F, P) be a filtered probability space and let F * := (F t ) t≥0 be the filtration of F. An F * -adapted process M : [0, ∞] × Ω → R is an F * -local martingale if there exists a sequence of stopping times τ k such that 1. The τ k are a.s. increasing, i.e. P(τ k < τ k+1 ) = 1; 2. The τ k are a.s. divergent, i.e. P(lim k→∞ τ k = ∞) = 1;

3. The process M t∧τ k is an F * -martingale, i.e. for all s < t,

E[M t∧τ k | F s ] = M s∧τ k .
(3.45)

A process (X t ) t≥0 is a continuous semimartingale if it can be written in the form

X t = M t + A t (3.46)
where A t is a process of finite variation and M t is a continuous local martingale.

Throughout this section, we will use two key concepts stemming from the theory of stochastic integration: the local time of a (continuous) semimartingale and the quadratic variation. The latter is the easiest to define, given our introduction of the true quadratic variation in the previous section.

Quadratic variation and a priori bounds

Definition 3.2 (Quadratic variation, Theorem 4.9 [START_REF] Gall | Brownian Motion, Martingales, and Stochastic Calculus[END_REF]). Suppose that (X t ) t is a R-valued stochastic process indexed by R + . The quadratic variation of X is the process defined as

[X] t := lim P →0 n k=1 (X t k -X t k-1 ) 2 , (3.47)
where P ranges over the set of finite partitions of the interval [0, t] and P the mesh of the partition P. If it exists, the limit is taken in the sense of convergence in probability. Whenever X is a continuous semimartingale, the quadratic variation always exists.

Remark 3.3. This definition is strictly weaker than the true 2-variation, which is defined as a supremum over the set of all finite partitions (cf. definition 2.13). In fact, for Brownian motion B, it is possible to show that [B] t = t, but on the interval [0, t], B 2-var = ∞ almost surely.

Understanding the quadratic variation is in some sense enough to understand local martingales, as the following theorem shows. Theorem 3.4 (Dambis-Dubins-Schwarz). Let M be a continuous local martingale vanishing at 0 such that [M ] ∞ = ∞, then there exists a Brownian motion B such that, a.s. for all t ≥ 0,

M t = B [M ]t . (3.48)
This theorem allows us to give a priori bounds on the small bar asymptotics of the barcode of a semimartingale. Since Brownian motion is a.s. ( 12 -δ)-Hölder continuous for every δ > 0, the p-variation of any semimartingale is almost surely finite as soon as p > 2 (since p-variation does not depend on parametrization). In particular we expect

N ε X = O(ε -2-δ ) as ε → 0 . (3.49)
for every δ > 0, by virtue of Picard's theorem. We may further refine this result by introducing the local time.

The local time and sharp asymptotics

The local time of a continuous semimartingale on an interval [0, t] can be informally understood as the "time spent" by the process X around a level x ∈ R, in an equation

L x X (t) = t 0 δ(x -X s ) d[X] s . (3.50)
The above equation is informal and ill-defined, but gives an intuitive insight on what the local time represents and how it behaves. Formally, we define the local time as follows.

Proposition 3.5 (Proposition 9.2 [START_REF] Gall | Brownian Motion, Martingales, and Stochastic Calculus[END_REF]). Let X be a continuous semimartingale and x ∈ R.

There exists an increasing process (L x X (t)) t≥0 such that the three following identities hold

|X t -x| = |X 0 -x| + t 0 sgn(X s -x) dX s + L x X (t) (X t -x) + = (X 0 -x) + + t 0 1 Xs>x dX s + 1 2 L x X (t) (X t -x) -= (X 0 -x) -- t 0 1 Xs≤x dX s + 1 2 L x X (t)
Definition 3.6. The increasing process (L x X (t)) t≥0 is called the local time of X at level x. Furthermore, for every stopping time T , the local time at x of the stopped process X at T ,

L x X T (t) = L x X (t ∧ T ).
The local time of a process is useful, as it allows us to exchange time and space in integrations. A first useful result in this direction, which we will later use, is the following proposition. Proposition 3.7 (Density occupation formula, Corollary 9.7 [START_REF] Gall | Brownian Motion, Martingales, and Stochastic Calculus[END_REF]). Almost surely, for every non-negative, measurable function φ on R,

t 0 φ(X s ) d[X] s = R φ(a)L a X (t) da . (3.51)
This result can be informally derived using the informal definition of the local time we gave earlier. For a rigorous proof, we refer the reader to the cited reference. From the informal description we gave about the local time as the time spent by the process around a level x, we could expect the local time to be related to N x,x+ε X for small ε. This turns out to be a well-known fact.

Proposition 3.8 (Approximation of the local time by downcrossings, §VI, Theorem 1.10 [START_REF] Revuz | Continuous Martingales and Brownian Motion[END_REF]). For every t ≥ 0 and s ≥ 1, if X = M + A is a continuous semimartingale on [0, t] defined on a probability space (Ω, F, P) and suppose that for s ≥ 1

E [M ] s/2 t + t 0 |dA| s s < ∞ . (3.52)
Then, then number of downcrossings from x + ε to x, D x,x+ε

X satisfies εD x,x+ε X L s ---→ ε→0 1 2 L x X (t) . (3.53) Moreover, in L s (Ω), D x,x+ε X ∼ L x X (t)) 2ε + O(1) as ε → 0 . (3.54)
Remark 3.9. An analogous statement can be proven for upcrossings.

With the above in mind, we proceed to prove theorem 2.

Proof of theorem 2. Since 0 ≤ N x,x+ε X -D x,x+ε X ≤ 1, the statement of proposition 3.8 is applicable to N x,x+ε X yielding the first result. It follows that in L s (Ω),

2ελ(T ε X ) - R L x X (t) dx = O(ε) . (3.55)
Note that while the integral carries over R, its support is contained within the compact interval [inf X, sup X]. We now use the density occupation formula for the local time where φ = 1, so

2ελ(T ε X ) = [X] t + O(ε) as ε → 0 in L s (Ω) (3.56)
We now use the fact that

λ(T ε X ) = ∞ ε N a X da . (3.57)
By monotonicity of N ε X , for every δ > 0, almost surely,

N ε(1+δ) X ≤ λ(T ε X ) -λ(T ε(1+δ) X ) δε = 1 δε ε(1+δ) ε N a X da ≤ N ε X . (3.58)
Thus, for δ > 0 small enough,

2ε δ [λ(T ε X ) -λ(T ε(1+δ) X )] ≤ 2ε 2 N ε ≤ 2ε δ [λ(T ε(1-δ) X ) -λ(T ε X )] (3.59) 1 δ [2ελ(T ε X ) - 2ε(1 + δ) 1 + δ λ(T ε(1+δ) X )] ≤ 2ε 2 N ε ≤ 1 δ [ 2ε(1 -δ) 1 -δ λ(T ε(1-δ) X ) -2ελ(T ε X )] (3.60)
It follows that in L s (Ω), for every δ > 0 small enough,

1 δ δ 1 + δ [X t ] + O(ε) ≤ 2ε 2 N ε ≤ 1 δ δ 1 -δ [X] t + O(ε) as ε → 0 (3.61) [X] t 1 + δ + O(ε/δ) ≤ 2ε 2 N ε X ≤ [X] t 1 -δ + O(ε/δ) as ε → 0 . (3.62)
Taking δ → 0 at a rate δ = O(ε 1/2 ), we obtain the desired result.

Limiting processes

An interesting point of view relative to these stability results and the results of this paper is to consider these irregular processes as almost sure C 0 -limits of smooth processes, which have traditionally been more difficult to study. In this way, we can make affirmations about the barcodes of smooth processes up to some (small) error. This way of thinking is inspired by the study of trees, ultralimits and asymptotic cones in geometric group theory [START_REF] Roe | Lectures on Coarse Geometry[END_REF].

Lemma 4.1. Let (M, d) be a compact Polish metric space and let X be an almost surely continuous stochastic process on M , defined on a probability space (Ω, F, P). Let (X n ) n∈N be any sequence of continuous stochastic processes defined on the same probability space and suppose

δ n := X -X n L ∞ (Ω,L ∞ (M,R)) ---→ n→∞ 0 . (4.63)
If for all ε > 0, E[N ε X ] < ∞ and is continuous in ε, then for any ε ≥ 2δ n ,

N ε Xn L 1 ---→ n→∞ N ε X , Morever, E N ε X -N ε Xn ≤ ω ε (δ n ) , (4.64)
where

ω ε (δ) := E N ε-δ X -N ε+δ X
. With analogous hypotheses, the same statement holds for

N x,x+ε X .
Proof. The L ∞ -stability of barcodes with respect to the L ∞ -distance tells us that δ n controls the bottleneck distance between the two barcodes [START_REF] Chazal | The Structure and Stability of Persistence Modules[END_REF][START_REF] Oudot | Persistence Theory -From Quiver Representations to Data Analysis[END_REF]. This implies that there exists a δ n -matching between the barcodes of X n and that of X, therefore:

• If α ∈ B(X) has length |α| ≥ 2δ n , then ∃! β ∈ B(X n
) such that (α, β) are matched and the difference ||α| -|β|| ≤ 2δ n ;

• If β ∈ B(X n ) has length |β| ≥ 2δ n , then ∃! α ∈ B(X) such that (α, β) are matched and the difference ||α| -|β|| ≤ 2δ n ; • If α ∈ B(X) or β ∈ B(X n ) in unmatched, then they have length ≤ 2δ n .
It follows that for ε ≥ 2δ n we have inequalities

N ε+2δn Xn ≤ N ε X N ε+2δn X ≤ N ε Xn ,
from which we obtain bounds on N

ε Xn N ε+2δn X ≤ N ε Xn ≤ N ε-2δn X . ( 4

.65)

These inequalities imply

N ε Xn -N ε X ≤ N ε+2δn X -N ε X ∨ N ε-2δn X -N ε X .
Taking expectations of both sides, we have

E N ε Xn -N ε X ≤ E N ε+2δn X -N ε X ∨ N ε-2δn X -N ε X ≤ E N ε+2δn X -N ε X + E N ε-2δn X -N ε X = E N ε X -N ε+2δn X + E N ε-2δn X -N ε X ≤ ω ε (2δ n )
by monotonicity of N ε X . The right hand side of the inequality tends to 0 as n → ∞ by continuity of

E[N ε X ], so N ε Xn L 1 ---→ n→∞ N ε X .
Remark 4.2. The condition of uniform convergence over Ω can be quite restrictive, but covers some cases of distributions with compact supports in C 0 (X, R). Moreover, it covers the case of processes derived from random point clouds P (the filtration function is given by d(-, P )) stemming from a distribution with compact support on any Polish metric space M .

We can adapt the proof of the above proposition to a setting relaxing the L ∞ (Ω, L ∞ (M, R)) convergence condition.

Proof of theorem 4. Notice lemma 4.1 shows the result for p = ∞. The rest of the proof goes as that of lemma 4.1 with a few exceptions. To obtain the probable bound on X -X n L ∞ (M,R) , we apply the Markov inequality. Doing so yields

P( X n -X L ∞ (M,R) ≥ aδ n ) ≤ 1 a p .
(4.66)

The rest of the proof follows by first noticing that

P(A) = P(A ∩ B) + P(A ∩ B c ) ≤ P(A ∩ B) + P(B c ) (4.67)
and taking the events A and B to be 5 Applications

A = { N ε Xn -N ε X ≥ k } and B = { X n -X L ∞ (M,R) ≤ aδ n } respectively, since P(A ∩ B) = P(A | B)P(B) ≤ P(A | B) ≤ E X -X n L ∞ (M,R) B k . ( 4

Brownian motion and local martingales with deterministic strictly increasing quadratic variation

For Brownian motion, it is possible to compute our quantities of interest exactly.

Theorem 5.1 (Perez, Proposition 4.4 [START_REF] Perez | ζ-functions and the topology of superlevel sets of stochastic processes[END_REF]). For Brownian motion B on [0, t], E[N ε B ] admits the following series representations which converge quickly for large and small ε respectively Proof. We start by writing

E[N ε B ] = 4 k≥1 (2k -1) erfc (2k -1)ε √ 2t -k erfc 2kε √ 2t (5.69) = t 2ε 2 + 2 3 + 2 k≥1 (2(-1) k -1) e -π 2 k 2 t/2ε 2 t ε 2 1 + ε 2 π 2 k 2 t . ( 5
E[N ε B ] = ∞ k=1 P(N ε B ≥ k) = P(R t ≥ ε) + ∞ k=2 P(S ε k-1 ≤ t) (5.71)
Using the scale invariance of Brownian motion,

E[N ε B ] = P(R 1 ≥ t -1 2 ε) + ∞ k=2 P(S 1 k-1 ≤ t/ε 2 ) (5.72)
We now notice that the stopping times

S ε k-1 = k-1 i=1 (S ε i -T ε i ) + (T ε i -S ε i-1 ) (5.73)
and that the increments (S ε i -T ε i ) and (T ε i -S ε i-1 ) are independent and identically distributed. Moreover, in distribution, sup We now take the Laplace transform with respect to the time variable (which we will denote

[0,t] B -B t = |B t | , ( 5
L t ) of E[N ε B ] L t (E[N ε B ])(λ) = sech 2 (ε λ 2 ) λ + 1 λ ∞ k=2 E e -λε 2 S 1 k-1 = sech 2 (ε λ 2 ) λ + 1 λ ∞ k=2 E e -λε 2 H 1 2(k-1)
,

where the last equality holds by virtue of i.i.d. character of the increments (S ε i -T ε i ) and (T ε i -S ε i-1 ). Replacing the value of E e λH ε ,

L t (E[N ε B ])(λ) = sech 2 (ε λ 2 ) + csch 2 (ε √ 2λ) λ
The result is obtained by taking the inverse Laplace transform.

Proof of theorem 3. Persistent homology is invariant under reparametrization. In particular if λ : [0, t] → [0, λ(t)] is an increasing bijection, N ε f •λ as calculated on [0, λ(t)] is exactly equal to N ε f as calculated on [0, t]. Invoking the Dambis-Dubins-Schwarz theorem (theorem 3.4), for every continuous local martingale M (such that M 0 = 0) with deterministic and strictly increasing quadratic variation [M ] t , almost surely, ∂ k ∂t k ϕ(x, t) ε 2k+1 as ε → 0 , where ϕ(x, t) is the density of a centered Gaussian random variable of variance t and ζ denotes the Riemann zeta function.

N ε M [0, t] = N ε B [0, [M ] t ] . ( 5
Remark 5.4. In the appropriate limits, we retrieve the results established for semimartingales. By virtue of the Dambis-Dubins-Schwarz theorem and by the invariance under reparametrization of persistent homology, we may also immediately extend the results and formulae of [START_REF] Perez | ζ-functions and the topology of superlevel sets of stochastic processes[END_REF] to local martingales with deterministic and strictly increasing quadratic variation by replacing t → [M ] t .

Itô processes

Definition 5.5. An Itô process is the solution to a stochastic differential equation of the form dX t = µ t dt + σ t dB t (5.78)

where µ t and σ t are adapted processes.

Every Itô process of this form has the strong Markov property and moreover, it is a semimartingale. We deduce that N ε X ∼

[X] t 2ε 2 + O(ε -1 ) as ε → 0 , (5.79) and an analogous expression for N x,x+ε X in terms of the local time of X. In expectation, we may always say something about N x,x+ε X by virtue of the following proposition. Proposition 5.6. Let X be an Itô process with deterministic quadratic variation, then

E[L x X (t)] = t 0 ϕ X (x, s) d[X] s , (5.80)
where ϕ X (-, s) is the density function of the random variable X s (which itself is a solution of the Fokker-Planck PDE associated to the SDE).

Proof. We take the expectation of both sides of the occupation density formula with φ(a) = e -iλa . The result follows from taking the inverse Fourier transform (with respect to λ) of both sides. where ϕ X (-, s) is the density function of the random variable X s .

As a Markov processes, Itô processes also satisfy

E[N ε X ] ∼ P(R t ≥ ε) as ε → ∞ .
(5.83)

Finally, when µ t = 0 and σ t > 0 for all t > 0 and is deterministic, an Itô process is a local martingale with quadratic variation

[X] t = t 0 σ 2 s ds , (5.84) and, in particular, its barcode is then known completely.

Introduction 2 1 . 1 3 3 . 1 1

 113311 State of the art . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.2 Our contribution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Some generalities about H 0 homology and trees 6 2.1 Persistent homology of processes on [0, t] . . . . . . . . . . . . . . . . . . . . . . . 9 2.2 A priori estimates on the asymptotic behaviour of small and large bars . . . . . 11 Continuous semimartingales, local times and asymptotic behaviour of barcodes 12 Quadratic variation and a priori bounds . . . . . . . . . . . . . . . . . . . . . . . 12 3.2 The local time and sharp asymptotics . . . . . . . . . . . . . . . . . . . . . . . Brownian motion and local martingales with deterministic strictly increasing quadratic variation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 5.2 Itô processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 5.3 Limiting processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1 Introduction 1.

Figure 1 :Figure 2 :

 12 Figure 1: Numerical simulation of E[N ε B ] using Rademacher walks.

.

  .34) If x ≥ 0, and f (0) = 0, N x,x+ε f = U x,x+ε f Proof. Each bar alive at x + ε persisting until x (seen as a branch of T f ) admits a left and right preimage (which can be sometimes equal), this shows N x,x+ε ≥ U x,x+ε f ∨ D x,x+ε f . Conversely, every downcrossing (resp. upcrossing) generates a distinct homology class alive at x+ε persisting until x, which shows U x,x+ε f ∨ D x,x+ε f ≥ N x,x+ε . The last inequality is a consequence of the fact that, by definition U x,x+ε f -D x,x+ε f ≤ 1. Finally, if x ≥ 0, and f (0) = 0, by continuity of f , there is a bijective correspondence between upcrossings and the bars alive at x + ε persisting until x.

.70) Remark 5 . 2 .

 52 In particular, E[N ε B ] is analytic in ε on an open wedge around the positive real axis in the complex plane, and so in particular C ∞ in ε, thereby confirming and extending Divol and Chazal's results.

  .77)We can perform a similar calculation for N x,x+ε B when x > 0, Proposition 5.3 (Perez, Proposition 4.7[START_REF] Perez | ζ-functions and the topology of superlevel sets of stochastic processes[END_REF]). For Brownian motion on [0, t] and x > 0, , s) ds+ k≥0 4(-2) k 2 2k+1 -1 ζ(2k + 2) π 2k+2

t 0 E

 0 e -iλXs d[X] s = R e -iλa E[L a X (t)] da (5.81)

Proposition 5 . 7 (ϕ

 57 Asymptotics of barcodes of Itô processes). Let X be an Itô process with deterministic quadratic variation on [0, t], then, X (x, s) d[X] s + O(1) as ε → 0 .(5.82)

  .68) Remark 4.3. By an application of the Borel-Cantelli lemma, if X n tends to X in L

	X n	L ∞ ---→

p (Ω, L ∞ (M, R)) for p > 1 at a rate O(r(n)) (where r is a function tending to 0 at infinity), then almost surely n→∞ X at a rate O(r(n)) as well.

  ) are distributed like the first hitting time of ε by |B t |. It is a classical result [4, p.641] that this hitting time H ε satisfies E e λH ε = sech(ε

			.74)
	so that the (S ε i -T ε i ) and (T ε i -S ε i-1 √
		2λ) .	(5.75)
	Similarly, it is also well-known that the range of Brownian motion satisfies
	L t (P(R t ≥ ε))(λ) =	sech 2 (ε λ 2 ) λ	(5.76)

Acknowledgements 20 6 Acknowledgements

The author would like to thank Pierre Pansu and Claude Viterbo, without whom this work would not have been possible. Many thanks are owed to Jean-François Le Gall and Nicolas Curien, for numerous fruitful discussions relevant to this work as well to the reviewers of this paper for their helpful comments.

Limiting processes

The Karhunen-Loève theorem [START_REF] Karhunen | Über lineare Methoden in der Wahrscheinlichkeitsrechnung[END_REF][START_REF] Loève | Probability Theory II[END_REF] shows that many well-known C 0 -processes can be seen as limits of smooth processes and that the logic of studying smooth objects with their more irregular C 0 limits is a logic which can also be applicable in higher dimensions. Brownian motion itself can be seen as such a limit [START_REF] Gall | Brownian Motion, Martingales, and Stochastic Calculus[END_REF][START_REF] Mörters | Brownian Motion[END_REF]. Indeed, Paul Lévy showed that if (ξ k ) k∈N is a sequence of i.i.d. standard normal variables, the series

almost surely uniformly converges to the standard Brownian motion on [0, 1]. Noting

it can be shown (for instance using [13, Chapter 15, Theorem 4]) that for p ≥ 1 there exists a finite constant C p such that

(5.87)

Applying the results of theorem 4 and optimizing in a, we have

(5.88)

In particular, we know that through this approximation yields a curve on the log-chart which doesn't stray far away from the Brownian motion's for ε (n -1 log(n))

1 2 . Brownian motion can also be approximated by random walks. The Komlós-Major-Tusnády (KMT) theorem provides a sharp estimate of the rate of convergence of these empirical processes to the Brownian bridge (which we will denote W t ). Definition 5.8. Let (X n ) n∈N * be a sequence of (reduced, centered) i.i.d random variables. The empirical process defined by X is the process

(5.89) Theorem 5.9 (KMT Theorem, [START_REF] Komlós | An approximation of partial sums of independent RVs, and the sample DF[END_REF][START_REF] Komlós | An approximation of partial sums of independent RVs, and the sample DF[END_REF]). Let (U n ) n∈N * be an i.i.d. sequence of uniform random variables on [0, 1]. Then, there exists a Brownian bridge (W t ) 1≥t≥0 such that for all n ∈ N * and all x > 0

for some universal positive constants C, L and λ which are explicitly known [START_REF] Bretagnolle | Hungarian constructions from the nonasymptotic viewpoint[END_REF].

The process W is a semimartingale with quadratic variation [W ] t = t on [0, 1], as it can be obtained as the solution to the SDE

(5.91)

We deduce that N ε W ∼ 1 2ε 2 as ε → 0. The KMT theorem and the same reasoning behind theorem 4 imply

(5.92)

In particular, this approximation yields the curve N ε α U n on the log-chart which doesn't stray far away from N ε W 's for ε n -1 2 log(n).