Andrea Repaci

Alessandra Gambineri

Uberto Pagotto

M.D Renato Pasquali
email: renato.pasquali@unibo.it.

Ghrelin and reproductive disorders

Ghrelin is an important factor involved in most of the metabolic and hormonal signals which adapt the reproductive functions in conditions of altered energy balance. Moreover, the coordinated role of leptin and ghrelin appears in fact to have a specific role in the regulation of puberty. Systemic action of ghrelin on the reproductive axis involves the control of the hypothalamic-pituitary-gondal axis. In addition, it has been shown that ghrelin may directly act at a gonadal level in both females and males. Available data also demonstrate that sex steroid hormones and gonadotropins may in turn regulate the gonadal effect of ghrelin, as documented by studies performed in females with the polycystic ovary syndrome and in hypogonadal men. Notably, recent studies also confirm a potentially important role for ghrelin in fetal and neonatal energy balance, and specifically in allowing fetal adaptation to an adverse intrauterine environment.

A c c e p t e d M a n u s c r i p t

Introduction

The discovery of ghrelin was identified by reverse pharmacology in late 1999 [START_REF] Kojima | Ghrelin is a growth-hormone-releasing acylated peptide from stomach[END_REF] after the identification of its receptor GHSR-1a [START_REF] Howard | A receptor in pituitary and hypothalamus that functions in growth hormone release[END_REF]. Ghrelin is primarily synthesized as a pre-prohormone consisting of 117 amino acids. Cleavage of preproghrelin results in different forms of ghrelin, a 28 amino acid form (with C-terminal Arg) or a 27 amino acid form (with C-terminal Pro) generated byalternative splicing of the gene product. Ghrelin that is active at the GHSR-1a receptor is octanoylated on serine 3 [START_REF] Kojima | Ghrelin is a growth-hormone-releasing acylated peptide from stomach[END_REF]. Des-ghrelin, is a non-octanoylated form and does not bind to or activate the GHSR-1a [START_REF] Hosoda | Structural divergence of human ghrelin. Identification of multiple ghrelin-derived molecules produced by posttranslational processing[END_REF]. Ghrelin is highly conserved across several species and widely expressed in different tissues indicating its physiological importance [START_REF] Smith | Growth hormone releasing substances: types and their receptors[END_REF][START_REF] Van Der Lely | Biological, physiological, pathophysiological, and pharmacological aspects of ghrelin[END_REF]. The majority of circulating ghrelin is synthesized and secreted by X/A-like cells localized within the oxyntic glands of the mucosa of the gastric fundus [START_REF] Sakata | Ghrelin-producing cells exist as two types of cells, closed-and opened-type cells, in the rat gastrointestinal tract[END_REF]. Other sources of ghrelin are small intestine, pancreas, lymphocytes, placenta, kidney, lung, pituitary, brain and the gonads [START_REF] Ueberberg | Expression of ghrelin and its receptor in human tissues[END_REF], which directly implies that ghrelin may be involved in many functions of the organism. In essence, ghrelin has been found to have the following functions: (i) increased GH secretion without any efficacy on its synthesis [START_REF] Date | Central effects of a novel acylated peptide, ghrelin, on growth hormone release in rats[END_REF][START_REF] Takaya | Ghrelin strongly stimulates growth hormone release in humans[END_REF], (ii) stimulation of food intake and regulation of energy [START_REF] Castañeda | Ghrelin in the regulation of body weight and metabolism[END_REF][START_REF] Cowley | The distribution and mechanism of action of ghrelin in the CNS demonstrates a novel hypothalamic circuit regulating energy homeostasis[END_REF], (iii) stimulation of secretion of PRL and ACTH (Pecori [START_REF] Giraldi | Ghrelin stimulates adrenocorticotrophic hormone (ACTH) secretion by human ACTHsecreting pituitary adenomas in vitro[END_REF][START_REF] Schmid | Ghrelin stimulates appetite, imagination of food, GH, ACTH, and cortisol, but does not affect leptin in normal controls[END_REF][START_REF] Stevanović | The effect of centrally administered ghrelin on pituitary ACTH cells and circulating ACTH and corticosterone in rats[END_REF]), (iv) regulation of the secretion of insulin and blood glucose levels [START_REF] Gauna | Administration of acylated ghrelin reduces insulin sensitivity, whereas the combination of acylated plus unacylated ghrelin strongly improves insulin sensitivity[END_REF][START_REF] Gauna | Ghrelin stimulates whereas des-octanoyl ghrelin inhibits, glucose output by primary hepatocytes[END_REF], (v) increased learning, memory and modulation of synaptic plasticity [START_REF] Diano | Ghrelin controls hippocampal spine synapse density and memory performance[END_REF]Pinto et al., 2004), (vi) increased cardiac output in healthy humans and improvement of the cardiac performance in patients with chronic heart failure (Nagaya et al., 2001a;Nagaya et al., 2001b);(vii) inhibition of cardiomyocyte and endothelial cell apoptosis, which suggests cardiovascular A c c e p t e d M a n u s c r i p t 5 protection [START_REF] Baldanzi | Ghrelin and des-acyl ghrelin inhibit cell death in cardiomyocytes and endothelial cells through ERK1/2 and PI 3kinase/AKT[END_REF], (vii) activation of adipogenesis and inhibition of lipolysis in adipocytes [START_REF] Filigheddu | Ghrelin and des-acyl ghrelin promote differentiation and fusion of C2C12 skeletal muscle cells[END_REF][START_REF] Muccioli | Ghrelin and desacyl ghrelin both inhibit isoproterenol-induced lipolysis in rat adipocytes via a non-type 1a growth hormone secretagogue receptor[END_REF]), (ix) influence on bone metabolism [START_REF] Nikolopoulos | Ghrelin, another factor affecting bone metabolism[END_REF] and, finally (x) regulation of reproductive functions (Tena-Sempere 2008), pregnancy and lactation [START_REF] Fuglsang | Ghrelin in pregnancy and lactation[END_REF].

In this review we analyze the impact of ghrelin in reproduction and its relationship with energy balance and sex steroids (summarized in Figure 1).

Ghrelin: another link between energy balance and reproductive system

The reproductive capacity, defined by the ability to generate fertilizable gametes and to sustain pregnancy and lactation, critically depends on a concerted series of developmental events and the coordinated function of different endocrine elements which compose the HPG axis. The energy balance is defined like a perfect equilibrium between energetic entry and expense. The ability to maintain an equilibrium of the energy balance and the ability to reproduce are essential for survival and maintenance of the species. About 2 million years ago, our ancestors stood up for the first time, and probably at that time the uniform layer of subcutaneous fat in primates of both sexes became differentiated to eventually produce the specific human and sexual characteristics seen today [START_REF] Federman | The biology of human sex differences[END_REF]. Fat in women developed in the lower part of the body in relation to the upright posture, the mechanical condition of pregnancy and the need to have reserves for the newborn. Being probably less useful, body fat in man tended to be significantly reduced and predominantly deposited in the upper body, where it was less likely to hinder mobility and the aptitude for wrestling. It is thus possible that natural selection probably increased this differentiation [START_REF] Federman | The biology of human sex differences[END_REF]). In the prehistoric age, fertility was symbolized as a woman with large hips and breasts and the underlying fat energy stores were essential for reproduction (Federman to the formulation of the so-called critical (fat) mass hypothesis, which defined the need for a certain degree of adiposity (i.e. energy stores) in order to proceed to puberty and to maintain a proper reproductive function in adulthood [START_REF] Frisch | Height and weight at menarche and a hypothesis of critical body weights and adolescent events[END_REF][START_REF] Frisch | Menstrual cycles: fatness as a determinant of minimum weight for height necessary for their maintenance or onset[END_REF]. On the other hand, the link between energy balance and stores and reproductive functions, specifically the neuroendocrine and molecular bases responsible for this association, remained largely unknown. In the nineties, the cloning of leptin paved the way for the deciphering of signals and mechanisms responsible for the endocrine control of food intake and energy balance (Ahima et al., 2000, Casanueva and[START_REF] Casanueva | Neuroendocrine regulation and actions of leptin[END_REF][START_REF] Zhang | Positional cloning of the mouse obese gene and its human homologue[END_REF]. We now know that leptin is not only a molecular signal of adiposity, but also plays a pivotal role in the development of puberty and in the subsequent regulation of reproductive functions [START_REF] Chan | Differential regulation of metabolic, neuroendocrine, and immune function by leptin in humans[END_REF]. Interestingly, the mechanisms whereby leptin regulates fertility are multifaceted and likely involve actions at different levels of the HPG axis (Tena-Sempere and Barreiro, 2002a). The hypothalamic areas, the key site for the central control of food intake and neuroendocrine function, are also the primary target for the reproductive actions of leptin, where the peptide stimulating kiss-neurons favor activation of GnRH [START_REF] Smith | Kiss1 neurons in the forebrain as central processors for generating the preovulatory luteinizing hormone surge[END_REF]. Ghrelin has been hypothesized to functionally antagonize the effects of leptin on energy balance and, therefore, in the regulation of fat stores and body weight. In fact, shortly after its discovery, it was reported that ghrelin may promote food intake and weight gain and fat mass in experimental animals, independently of GH secretion [START_REF] Nakazato | A role for ghrelin in the central regulation of feeding[END_REF][START_REF] Strassburg | Long-term effects of ghrelin and ghrelin receptor agonists on energy balance in rats[END_REF][START_REF] Tschop | Ghrelin induces adiposity in rodents[END_REF][START_REF] Wortley | Absence of ghrelin protects against early-onset obesity[END_REF]. Unlike leptin, which increases with increasing BMI and adiposity (Woods and D"Alessio, 2008), ghrelin tends in fact to be inversely correlated with BMI, in both children and adults [START_REF] Reinehr | Obestatin and ghrelin levels in obese children and adolescents before and after reduction of overweight[END_REF]Tschop et al., 2001a;[START_REF] Vicennati | Circulating obestatin levels and the ghrelin/obestatin ratio in obese women[END_REF]. It has been suggested that the decreased levels of ghrelin in obesity may reflect a compensatory adaptation aimed at reducing food A c c e p t e d M a n u s c r i p t 7 intake (particularly hunger) (Tschop et al.2001a). The active role of ghrelin in the control of food intake is further emphasized by the findings that patients with the Prader-Willi syndrome are hyperphagic and have higher than normal circulating ghrelin levels (DelParigi et al. 2002), whereas in conditions of negative energy balance such as cachexia or anorexia high levels of ghrelin likely represent an effect to compensate for body wasting (Nagaya et al., 2001c;[START_REF] Otto | Weight gain decreases elevated plasma ghrelin concentrations of patients with anorexia nervosa[END_REF][START_REF] Shimizu | Increased plasma ghrelin level in lung cancer cachexia[END_REF][START_REF] Tacke | Ghrelin in chronic liver disease[END_REF][START_REF] Yoshimoto | Plasma ghrelin and desacyl ghrelin concentrations in renal failure[END_REF]. Accordingly, numerous studies have shown that ghrelin increases in obese individuals following dietary induced weight loss [START_REF] Cummings | Plasma ghrelin levels after diet-induced weight loss or gastric bypass surgery[END_REF][START_REF] Hansen | Weight loss increases circulating levels of ghrelin in human obesity[END_REF].

Ghrelin is secreted principally from the gastric mucosa in starving conditions or before the meal and decreases post-prandially, suggesting a link between the ultradian ghrelin secretion profile and individual ingestive behavior [START_REF] Bellone | Circulating ghrelin levels as function of gender, pubertal status and adiposity in childhood[END_REF][START_REF] Cummings | A preprandial rise in plasma ghrelin levels suggests a role in meal initiation in humans[END_REF]Tschop et al., 2001b). In addition, ghrelin has been found to be related to a "meal pattern learning" independent of the nutrient status [START_REF] Drazen | Effects of a fixed meal pattern on ghrelin secretion: evidence for a learned response independent of nutrient status[END_REF]). In fact ghrelin has been described to be relevant for food seeking behavior and meal initiation [START_REF] Cummings | Plasma ghrelin levels and hunger scores in humans initiating meals voluntarily without time-and food-related cues[END_REF][START_REF] Cummings | Ghrelin and the short-and long-term regulation of appetite and body weight[END_REF]. Very recent clinical studies utilizing magnetic resonance imaging have shown that ghrelin administration increases the neural response to pictures of food in the amygdala, orbitofrontal cortex, anterior insula, and striatum, which implies a role for ghrelin in hedonic and incentive responses to food-related cues [START_REF] Malik | Ghrelin modulates brain activity in areas that control appetitive behavior[END_REF].

Macronutrient composition may represent one regulatory factor, with all macronutrients being able to suppress ghrelin secretion, albeit to a different extent. Among other modulators, insulin is believed to have a negative impact on ghrelin secretion [START_REF] Cappiello | Circulating ghrelin levels in basal conditions and during glucose tolerance test in acromegalic patients[END_REF][START_REF] Eden Engstrom | Effects of growth hormone (GH) on ghrelin, leptin, and adiponectin in GH-deficient patients[END_REF][START_REF] Fick | Hypothalamic preproghrelin gene expression is repressed by insulin via both PI3-K/Akt and ERK1/2 MAPK pathways in immortalized, hypothalamic neurons[END_REF][START_REF] Hoybye | Peptides associated with hyperphagia in adults with Prader-Willi syndrome before and during GH treatment[END_REF][START_REF] Kempa | Not insulin but insulin sensitivity, leptin, and cortisol are major factors regulating serum acylated ghrelin level in healthy women[END_REF][START_REF] Kokkinos | Possible implications of leptin, adiponectin and ghrelin in the regulation of energy homeostasis by thyroid hormone[END_REF][START_REF] Lucidi | Ghrelin is not necessary for adequate hormonal counterregulation of insulin-induced hypoglycemia[END_REF][START_REF] Murdolo | Circulating ghrelin levels of visceral obese men are not modified by a short-term treatment with very low doses of GH replacement[END_REF][START_REF] Norrelund | Ghrelin immunoreactivity in human plasma is suppressed by somatostatin[END_REF][START_REF] Qi | Evidence that growth hormone exerts a feedback effect on stomach ghrelin production and secretion[END_REF][START_REF] Saad | Insulin regulates plasma ghrelin concentration[END_REF][START_REF] Schaller | Plasma ghrelin concentrations are not regulated by glucose or insulin: a doubleblind, placebo-controlled crossover clamp study[END_REF][START_REF] Toshinai | Upregulation of ghrelin expression in the stomach upon fasting, insulininduced hypoglycemia, and leptin administration[END_REF].

A c c e p t e d M a n u s c r i p t

How and to what extent circulating ghrelin binds its receptors in the brain remains partially unclear, and it has been suggested that this may occur via circumventricular organs such as the median eminence, or directly in the arcuate nucleus. Ghrelin may in fact cross the bloodbrain barrier via active transport or passive diffusion [START_REF] Banks | Extent and direction of ghrelin transport across the blood-brain barrier is determined by its unique primary structure[END_REF][START_REF] Banks | Effects of triglycerides, obesity, and starvation on ghrelin transport across the blood-brain barrier[END_REF].

In the dorsomedial hypothalamus, a region involved in the regulation of food intake [START_REF] Halem | Novel analogs of ghrelin: physiological and clinical implications[END_REF], both ghrelin and BIM-28163 (a receptor antagonist) may regulate neurons involved in the modulation of ghrelin action on weight gain [START_REF] Bluet-Pajot | Hypothalamic and hypophyseal regulation of growth hormone secretion[END_REF][START_REF] Halem | A novel growth hormone secretagogue-1a receptor antagonist that blocks ghrelin-induced growth hormone secretion but induces increased body weight gain[END_REF], by still undefined receptors [START_REF] Sun | Ghrelin stimulation of growth hormone release and appetite is mediated through the growth hormone secretagogue receptor[END_REF].

Ghrelin seems to activate at least two signal transduction pathways that regulate calcium, which in turn may differentially regulate food intake, GH secretion and vascular inflammation. These signals may include calcium release by the adenylate cyclase-protein kinase A (AC-PKA) pathway in NPY expressing cells of the rat arcuate nucleus (Kohno et al., 2003) and GH release through the phospholipase C protein kinase C PLC-PKC pathway [START_REF] Chen | Signal transduction systems employed by synthetic GHreleasing peptides in somatotrophs[END_REF], and may reflect two distinct components of ghrelin receptor signaling [START_REF] Cassoni | Identification, characterization, and biological activity of specific receptors for natural (ghrelin) and synthetic growth hormone secretagogues and analogs in human breast carcinomas and cell lines[END_REF]. Additionally, it has been shown that ghrelin increases food intake in relation to fasting through the activation of AMP-activated protein kinase (AMPK) and acetyl CoA carboxylase (ACC) and the inhibition of fatty acid synthase (FAS) in the ventral medial hypothalamus [START_REF] Lopez | Hypothalamic fatty acid metabolism mediates the orexigenic action of ghrelin[END_REF], an effect which appears to be mediated by increased mitochondrial uncoupling protein2 (UCP2) expression [START_REF] Andrews | UCP2 mediates ghrelin's action on NPY/AgRP neurons by lowering free radicals[END_REF].

Moreover, ghrelin and its receptor GSHR-1a are abundantly expressed in the arcuate nucleus of the hypothalamus, and particularly in neurons coexpressing the orexigenic peptides NPY and agouti related peptide (AGRP) [START_REF] Kamegai | Chronic central infusion of ghrelin increases hypothalamic neuropeptide Y and Agouti-related protein mRNA levels and body weight in rats[END_REF][START_REF] Nakazato | A role for ghrelin in the central regulation of feeding[END_REF], therefore favouring weight gain [START_REF] Andrews | UCP2 mediates ghrelin's action on NPY/AgRP neurons by lowering free radicals[END_REF][START_REF] Lopez | Hypothalamic fatty acid metabolism mediates the orexigenic action of ghrelin[END_REF]. The adipogenic actions of ghrelin have also been suggested to be mediated directly by the regulation of peroxisome proliferator activated receptor γ (PPAR-γ) activity (Barazzoni et [START_REF] Ehrmann | Polycystic ovary syndrome[END_REF][START_REF] Choi | The role of ghrelin and growth hormone secretagogues receptor on rat adipogenesis[END_REF][START_REF] Thompson | Ghrelin and des-octanoyl ghrelin promote adipogenesis directly in vivo by a mechanism independent of the type 1a growth hormone secretagogue receptor[END_REF], although it has been suggested that ghrelin may also indirectly regulate peripheral adiposity through the hypothalamic melanocortin receptors and the efferent sympathetic nervous system independent of food intake [START_REF] Nogueiras | The central melanocortin system directly controls peripheral lipid metabolism[END_REF][START_REF] Theander-Carrillo | Ghrelin action in the brain controls adipocyte metabolism[END_REF]. These observations led to the proposal that ghrelin operates as a peripheral signal for energy insufficiency, whose levels rise in conditions of negative energy balance in order to activate homeostatic responses to keep stable the whole body energy balance [START_REF] Tang-Christensen | Central administration of ghrelin and agouti-related protein (83-132) increases food intake and decreases spontaneous locomotor activity in rats[END_REF][START_REF] Zigman | From anorexia to obesity-The Yin and Yang of body[END_REF]).

Considering the prototypic example of leptin [START_REF] Chan | Differential regulation of metabolic, neuroendocrine, and immune function by leptin in humans[END_REF] and the emergent biological profile of ghrelin, it has been hypothesized that ghrelin might contribute, in conjunction with other metabolic signals, to the physiologic coupling of reproduction and energy reserves. This possibility has now been supported by a number of experimental observations, demonstrating biological actions of ghrelin at different levels of the HPG axis and the reproductive system.

Systemic action of ghrelin on the reproductive axis

Control of the hypothalamic-pituitary-gonadal axis: animal studies

The effects of ghrelin upon gonadotropins and PRL secretion have been explored in a limited number of models and animal species, including rats, primates and sheep [START_REF] Fernández-Fernández | Ghrelin effects on gonadotropin secretion in male and female rats[END_REF]Fernández-Fernández et al., 2005a;[START_REF] Furuta | Intracerebroventricular administration of ghrelin rapidly suppresses pulsatile luteinizing hormone secretion in ovariectomized rats[END_REF][START_REF] Harrison | Photoperiod influences the central effects of ghrelin on food intake, GH and LH secretion in sheep[END_REF][START_REF] Iqbal | Effects of central infusion of ghrelin on food intake and plasma levels of growth hormone, luteinizing hormone, prolactin, and cortisol secretion in sheep[END_REF][START_REF] Kluge | Ghrelin suppresses secretion of luteinizing hormone in humans[END_REF][START_REF] Lanfranco | Acylated ghrelin inhibits spontaneous luteinizing hormone pulsatility and responsiveness to naloxone but not that to gonadotropin-releasing hormone in young men: evidence for a central inhibitory action of ghrelin on the gonadal axis[END_REF][START_REF] Vulliémoz | Decrease in luteinizing hormone pulse frequency during a five-hour peripheral ghrelin infusion in the ovariectomized rhesus monkey[END_REF]. These studies showed that central administration of ghrelin suppressed pulsatile LH secretion in ovariectomized female rats [START_REF] Furuta | Intracerebroventricular administration of ghrelin rapidly suppresses pulsatile luteinizing hormone secretion in ovariectomized rats[END_REF].

Subsequently it was shown that intracerebroventricular administration of ghrelin ( 3A c c e p t e d M a n u s c r i p t 10 nmol/rat) evoked a significant inhibition of LH secretion in cyclic female rats throughout the estrous cycle, as well as in ovariectomized females (Fernández-Fernández et al., 2006).

Likewise, GnRH secretion by hypothalamic fragments from ovariectomized females has been found to be significantly inhibited by ghrelin (Fernández-Fernández et al., 2006). In contrast, other studies have shown that ghrelin stimulated, in a dose-dependent way, basal LH and FSH secretion by pituitary tissue in vitro, which was dependent on the phase of the estrous cycle, as it was neither detected at estrus nor observed after ovariectomy (Fernández-Fernández et al., 2006). Conversely, GnRH-stimulated LH secretion in vitro was persistently inhibited by ghrelin regardless of the stage of the cycle, whereas stimulated FSH secretion was only inhibited by ghrelin at estrus (Fernández-Fernández et al., 2006). Overall these data illustrate a complex mode of action of ghrelin upon the HPG axis, with predominant inhibitory effects at central (hypothalamic) levels and upon GnRH-induced gonadotropin secretion, and a direct stimulatory action on basal LH and FSH secretion. Interestingly, the inhibitory effects of ghrelin on LH secretion are mimicked by the unacylated form of the molecule (des-ghrelin) in different experimental paradigms [START_REF] Martini | Comparative analysis of the effects of ghrelin and unacylated ghrelin upon luteinizing hormone secretion in male rats[END_REF], suggesting acontribution of mechanisms independent of the classical GHSR-1a. In addition, it has been demonstrated that ghrelin decreases GnRH release by hypothalamic explants ex vivo (Fernández-Fernández et al., 2005a), reinforcing the contention of a major central (hypothalamic) site of action for its inhibitory effects on the pituitary axis. This agrees with the proposed role of ghrelin as a signal of energy insufficiency which frequently occurs together with suppressed gonadotropin levels (Fernández-Fernández et al., 2006).

Control of the hypothalamic-pituitary axes: human studies

Studies in humans are very sparse and all have shown that ghrelin infusion partially inhibited spontaneous pulsatile secretion of LH. [START_REF] Kluge | Ghrelin suppresses secretion of luteinizing hormone in humans[END_REF][START_REF] Lanfranco | Acylated ghrelin inhibits spontaneous luteinizing hormone pulsatility and responsiveness to naloxone but not that to gonadotropin-releasing hormone in young men: evidence for a central inhibitory action of ghrelin on the gonadal axis[END_REF][START_REF] Lanfranco | Ghrelin and anterior pituitary function[END_REF]. The possibility that ghrelin may directly act at the gonadal level was conceivable with the documented effects of other peripheral regulators of energy balance such as leptin, particularly on the male gonads (Tena-Sempere and Barreiro, 2002a). [START_REF] Tanaka | Testis-specific and developmentally induced expression of a ghrelin gene-derived transcript that encodes a novel polypeptide in the mouse[END_REF] identified a testis-specific ghrelin gene derived transcript in the mouse. This shows that ghrelin gene expression is ubiquitous and in this case this alternatively spliced variant could play a role in local control of spermatogenesis and in the synthesis of testosterone. Others detected ghrelin in rat Leydig cells at advanced stages of maturation, regardless of their fetal or adult origin [START_REF] Barreiro | Cellular location and hormonal regulation of ghrelin expression in rat testis[END_REF]. Moreover, further data supported the concept that ghrelin expression in the testis is not apparently modulated by FSH, GH, iodothyronines or glucocorticoids; conversely it appears to be under the specific control of pituitary LH [START_REF] Barreiro | Cellular location and hormonal regulation of ghrelin expression in rat testis[END_REF], which is in good agreement with the fact that testicular LH receptors are solely expressed in Leydig cells [START_REF] Huhtaniemi | Gonadotrophin actions on the testis genotypes and phenotypes of gonadotrophin and gonadotrophin receptor mutations[END_REF]. Subsequently, expression of the putative ghrelin receptor was demonstrated by a combination of semiquantitative reverse transcription polymerase chain reaction (RT-PCR) and in situ hibrization in rat testis [START_REF] Barreiro | Developmental, stage-specific, and hormonally regulated expression of growth hormone secretagogue receptor messenger RNA in rat testis[END_REF]Tena-Sempere et al. 2002b) and that the expression of the GHSR-1a receptor increases after puberty and reaches peak values in adulthood [START_REF] Barreiro | Developmental, stage-specific, and hormonally regulated expression of growth hormone secretagogue receptor messenger RNA in rat testis[END_REF]. This suggests that during pubertal development a shift in the pattern of splicing of the GHSR gene takes place in rat testis, thereby favoring the expression of the biologically active GSHR-1a, which might imply considerable changes in net ghrelin sensitivity with sexual maturation. Location analyses in the rat testis also revealed a scattered pattern of distribution of GHSR-1a, with specific expression in somatic Sertoli and Leydig cells, and eventually in germ cells [START_REF] Barreiro | Developmental, stage-specific, and hormonally regulated expression of growth hormone secretagogue receptor messenger RNA in rat testis[END_REF]. As for leptin, testicular expression of the GHSR gene appeared under hormonal regulation, specifically by pituitary FSH, other than by ghrelin itself. Thus, not only ghrelin expression, but also testicular sensitivity to ghrelin A c c e p t e d M a n u s c r i p t is likely regulated by hormonal (homologous and heterologous) signals, which is highly suggestive of a finely tuned, direct action of ghrelin in the control of testicular function. In the testis ghrelin was proven to significantly inhibit in a dose-dependent manner both LH-or human Chorionic Gonadotropin (hCG)-stimulated testosterone secretion, by reducing cAMP formation and reducing levels of mRNAs encoding several key factors in the steroidogenic pathway (Tena-Sempere et al., 2002b). The fact that ghrelin may reduce LH-stimulated testosterone secretion seems to contradict the idea that LH by itself is a regulator of testicular ghrelin expression, so it is likely that ghrelin operates as a local regulator in the fine-tuning of the steroidogenic actions of LH, thereby participating in the autolimitation of the testicular testosterone response to gonadotropic stimulation [START_REF] Barreiro | Cellular location and hormonal regulation of ghrelin expression in rat testis[END_REF].

Alternatively, such an inhibitory effect upon testosterone secretion could reflect the activity of the systemic, gut-derived ghrelin, whose circulating levels are inversely correlated with BMI [START_REF] Huhtaniemi | Gonadotrophin actions on the testis genotypes and phenotypes of gonadotrophin and gonadotrophin receptor mutations[END_REF]. Therefore, it is conceivable that elevated ghrelin levels (like those observed in energy insufficiency) might contribute to the suppression of male reproductive axis in situations of negative energy balance.

In addition to its steroidogenic effects, ghrelin might also directly regulate seminiferous tubule functions because the expression of GHSR-1a has been demonstrated in the tubular compartment of the testis [START_REF] Barreiro | Developmental, stage-specific, and hormonally regulated expression of growth hormone secretagogue receptor messenger RNA in rat testis[END_REF]. In fact, it has been shown that ghrelin is able to inhibit the expression of the gene encoding stem cell factor, both after intra-testicular injection in vivo as well as following challenge of staged seminiferous tubule fragments in culture [START_REF] Barreiro | Ghrelin inhibits the proliferative activity of immature Leydig cells in vivo and regulates stem cell factor messenger ribonucleic acid expression in rat testis[END_REF]. Notably, stem cell factor is a Sertoli cell product that has been identified as the major paracrine stimulator of germ cell development, acting as a survival factor for spermatogonia, spermatocytes and spermatids in the adult rat seminiferous epithelium [START_REF] Hakovirta | Function of stem cell factor as a survival factor of spermatogonia and localization of messenger ribonucleic acid in the rat seminiferous epithelium[END_REF]Yan et al. 2000a). In addition, testicular stem cell factor has also been involved in Leydig cell development and survival (Yan et al. 2000b). Thus, A c c e p t e d M a n u s c r i p t 13 the actions of ghrelin upon tubular stem cell factor mRNA expression might have implications not only in the control of spermatogenesis but also upon Leydig cell proliferation. This is in agreement with the finding that ghrelin is able to inhibit the proliferative rate of immature Leydig cells both during puberty development and after selective ablation of pre-existing mature Leydig cells by administration of ethylene dimethane sulfonate (EDS) [START_REF] Barreiro | Ghrelin inhibits the proliferative activity of immature Leydig cells in vivo and regulates stem cell factor messenger ribonucleic acid expression in rat testis[END_REF].

Testis derives from the under-differentiated gonad, so expression of ghrelin and its receptor in adult ovary is probable. [START_REF] Caminos | Expression of ghrelin in the cyclic and pregnant rat ovary[END_REF] found for the first time that ghrelin mRNA levels significantly varied depending on the phase of the cycle, with the lowest expression levels in proestrus and maximum values in the diestrous (day 1) phase. Such a cyclic profile of expression, with peak levels in the luteal stages, is highly suggestive of predominant expression of ghrelin in the corpora lutea of the current cycle. Thus, ghrelin mRNA levels reached their highest value when the corpora lutea entered into the functional phase and remained lower during corpora luteal formation and regression. This contention was further substantiated by immunohistochemical analyses, which showed intense and specific ghrelin immunoreactivity in the cytoplasm of steroidogenic luteal cells [START_REF] Caminos | Expression of ghrelin in the cyclic and pregnant rat ovary[END_REF]. The profile of ghrelin expression in the corpora lutea was roughly coincidental with its peak in functional activity and paralleled the pattern of progesterone secretion [START_REF] Caminos | Expression of ghrelin in the cyclic and pregnant rat ovary[END_REF][START_REF] Duggal | Expression of the long (Ob-RB) and the short (Ob-RA) forms of leptin receptor throughout the oestrous cycle in the mature rat ovary[END_REF], which is suggestive of a potential functional role of ghrelin in the regulation of luteal development and/or function in the rat. Treatment with GnRH antagonists, which block the preovulatory surge of gonadotropin and subsequent ovulation, has been shown to be associated with lower levels of ghrelin, and further studies have shown that in the proestrous stage, levels of ghrelin depend on formation of corpora lutea [START_REF] Caminos | Expression of ghrelin in the cyclic and pregnant rat ovary[END_REF][START_REF] Nekola | Direct and indirect inhibition of ovulation in rats by an antagonist of luteinizing hormone-releasing hormone[END_REF]. The expression of ghrelin and/or GHSR-1a has been reported in the gonads of several mammalian [START_REF] Zhang | Expression of ghrelin in the porcine hypothalamopituitary-ovary axis during the estrous cycle[END_REF] and nonmammalian A c c e p t e d M a n u s c r i p t species [START_REF] Manning | Ontogenetic and tissue-specific expression of preproghrelin in the Atlantic halibut, Hippoglossus hippoglossus[END_REF][START_REF] Sirotkin | Novel expression and functional role of ghrelin in chicken ovary[END_REF] Ghrelin, testis and ovaries: human studies.

Initial screening analyses of ghrelin mRNA expression in human tissues provided evidence of expression of the ghrelin gene in the testis [START_REF] Gaytan | Expression of ghrelin and its functional receptor, the type 1a growth hormone secretagogue receptor, in normal human testis and testicular tumors[END_REF]Gnanapavan et al., 2002).

Similar to the rat ghrelin peptide, expression of this peptide has been shown in interstitial mature human Leydig cells [START_REF] Gaytan | Expression of ghrelin and its functional receptor, the type 1a growth hormone secretagogue receptor, in normal human testis and testicular tumors[END_REF] and, to a lower extent, in the Sertoli cells [START_REF] Barreiro | Developmental, stage-specific, and hormonally regulated expression of growth hormone secretagogue receptor messenger RNA in rat testis[END_REF]. Accordingly, further studies have shown that GHS-R1a is present not only in the mature somatic Sertoli and Leydig cells but also in the germ cells, mainly in the pachytene spermatocytes [START_REF] Gaytan | Expression of ghrelin and its functional receptor, the type 1a growth hormone secretagogue receptor, in normal human testis and testicular tumors[END_REF].

The GHSR-1a has also been detected in human ovaries, particularly in the hilus interstitial cells and in mature corpora lutea and follicular cells, and throughout the ovarian surface epithelium [START_REF] Gaytan | Immunolocalization of ghrelin and its functional receptor, the type 1a growth hormone secretagogue receptor, in the cyclic human ovary[END_REF]. Additionally, the same receptor has been shown to be strongly expressed in ciliated cells within the fallopian epithelium and, by contrast, no expression has been found in the endometrium and the endocervix [START_REF] Gaytan | Expression of growth hormone secretagogue receptor type 1a, the functional ghrelin receptor, in human ovarian surface epithelium, mullerian duct A c c e p t e d M a n u s c r i p t 30 derivatives, and ovarian tumors[END_REF].

Recently, the expression of the GHSR-1a and 1b isoforms has been demonstrated in human granulosa-luteal cells [START_REF] Viani | Ghrelin inhibits steroid biosynthesis by cultured granulosalutein cells[END_REF], and in an in vitro model, it has been reported that, through this receptor, ghrelin significantly inhibited, in a dose-dependent manner, estradiol and progesterone secretion by granulosa-luteal cells. Intriguingly, it could therefore be suggested that such an effect may contribute to suppression of the reproductive axis at times of food deprivation, when limited resources are allocated to major physiological processes.

Hypothetically, such an altered balance between the two GHSR isoforms might, under certain conditions, represent a novel mechanism for the regulation of ghrelin sensitivity in the gonads.

A c c e p t e d M a n u s c r i p t 15

In addition, progesterone secretion by human luteal cells in vitro is also inhibited by ghrelin [START_REF] Tropea | Ghrelin affects the release of luteolytic and luteotropic factors in human luteal cells[END_REF], suggesting that ghrelin may affect the release of luteolytic and luteotropic factors by human luteal cells, as it decreases the release of luteotropic factors and stimulates the secretion of luteolytic factors, thereby participating in the negative control of human luteal function [START_REF] Tropea | Ghrelin affects the release of luteolytic and luteotropic factors in human luteal cells[END_REF].

Ghrelin, pregnancy and placental physiology

Recent studies have shown that ghrelin may be involved in embryo preimplantantion and development. Both ghrelin and GHSR mRNAs have been detected in the morula and in more advanced stages of embryo development [START_REF] Kawamura | Ghrelin inhibits the development of mouse preimplantation embryos in vitro[END_REF]. In addition, ghrelin protein is produced and secreted by the reproductive tract into uterine fluid [START_REF] Kawamura | Ghrelin inhibits the development of mouse preimplantation embryos in vitro[END_REF] where its expression increases during fasting, as occurs in plasma [START_REF] Gualillo | Effect of food restriction on ghrelin in normal-cycling female rats and in pregnancy[END_REF]. Ghrelin also negatively regulates cell viability and proliferation [START_REF] Cassoni | 26 Specific binding sites for synthetic growth hormone secretagogues in non-tumoral and neoplastic human thyroid tissue[END_REF][START_REF] Cassoni | Identification, characterization, and biological activity of specific receptors for natural (ghrelin) and synthetic growth hormone secretagogues and analogs in human breast carcinomas and cell lines[END_REF][START_REF] Ghe | The antiproliferative effect of synthetic peptidyl GH secretagogues in human CALU-1 lung carcinoma cells[END_REF]. Taken together, these findings suggest that during fasting ghrelin may act as a peripheral factor, pre-empting the increased metabolic demand induced by pregnancy and lactation, by inhibiting the development of preimplantation mouse embryos through its specific receptor [START_REF] Kawamura | Ghrelin inhibits the development of mouse preimplantation embryos in vitro[END_REF]. The involvement of ghrelin in embryo implantation has been demonstrated by its spatial-temporal expression (like that of its receptors) around the time of implantation [START_REF] Tanaka | Ghrelin is involved in the decidualization of human endometrial stromal cells[END_REF]. While GHSR-1a mRNA is detected in endometrium throughout the normal menstrual cycle (Edwards 1995a;Edwards 1995b), ghrelin expression is observed in the secretory endometrium, particularly in the luminal and glandular epithelial cells. Since specific products secreted by these cells play an important role in embryo implantation (Edwards 1995a;Edwards 1995b), these data point to a potential role for ghrelin as a A c c e p t e d M a n u s c r i p t paracrine/autocrine regulator of human endometrial receptivity [START_REF] Tawadros | Facilitation of decidualization by locally produced ghrelin in the human endometrium[END_REF]. [START_REF] Tanaka | Ghrelin is involved in the decidualization of human endometrial stromal cells[END_REF] have also documented strong ghrelin expression in human placenta during the first trimester, especially in extravillous trophoblasts on the tips of chorionic villi, whereas at term the hormone levels are undetectable. It has been hypothesized that, because of its pregnancy-related expression and localization in extravillous trophoblasts cells, which are responsible for the invasion of maternal uterus [START_REF] Malassine | Hormones and human trophoblast differentiation: a review[END_REF], ghrelin may also play some important role during embryo implantation and placental development.

Additionally, GHSR-1a mRNA has been found in the decidua, and in vitro studies have shown that ghrelin was able to enhance human endometrial stromal cell decidualization induced by 8-Br-cAMP [START_REF] Tanaka | Ghrelin is involved in the decidualization of human endometrial stromal cells[END_REF]. These findings support the hypothesis that ghrelin, together with other messengers (including cytokines, interleukins, sex steroids and prostaglandins, which are released by the invading chorionic tissue), may be a chemical mediator (in a paracrine and autocrine manner) of the regulation of endometrial stromal cell differentiation, which is essential for embryo implantation and the maintenance of pregnancy [START_REF] Brar | Progesteronedependent decidualization of the human endometrium is mediated by cAMP[END_REF][START_REF] Feinman | 8-Bromo-30,50-adenosine monophosphate stimulates the endocrine activity of human cytotrophoblasts in culture[END_REF][START_REF] Pansini | Sex steroid hormones influence the cAMP content in human endometrium during the menstrual cycle[END_REF]). In addition, reduced ghrelin levels have been demonstrated in third trimester maternal plasma [START_REF] Fuglsang | Ghrelin and its relationship to growth hormones during normal pregnancy[END_REF][START_REF] Makino | Alteration of plasma ghrelin levels associated with the blood pressure in pregnancy[END_REF], in response to the marked change in maternal energy intake, which further suggests that reduced ghrelin levels could not only reflect maternal energy intake, but also prepare the uterus for parturition, since ghrelin possesses a relaxant effect on the uterus [START_REF] Hehir | Uterorelaxant effect of ghrelin on human myometrial contractility[END_REF].

Ghrelin can cross the feto-placental barrier [START_REF] Nakahara | Maternal ghrelin plays an important role in rat fetal development during pregnancy[END_REF], therefore a role in fetal development has been hypothesized. This has been confirmed by the finding that fetuses from mothers receiving chronic ghrelin treatment had significantly higher birthweight compared to newborns from saline-treated mothers, and that their growth was significantly favored even in conditions of restricted maternal food intake [START_REF] Nakahara | Maternal ghrelin plays an important role in rat fetal development during pregnancy[END_REF]. This is A c c e p t e d M a n u s c r i p t 17 consistent with the concept that maternal ghrelin affects fetal development by mechanisms which are relatively independent of increased maternal nutritional state [START_REF] Nakahara | Maternal ghrelin plays an important role in rat fetal development during pregnancy[END_REF]. This effect has been related to the capacity of ghrelin to favor fetal growth through stimulation of cell proliferation [START_REF] Nakahara | Maternal ghrelin plays an important role in rat fetal development during pregnancy[END_REF]. However, the ghrelin amounts in the fetus are not totally of maternal origin, since it can also be produced in the human fetus [START_REF] Cortelazzi | Circulating levels of ghrelin in human fetuses[END_REF]. In fact, increased ghrelin levels have been found in fetuses with intrauterine growth restriction [START_REF] Cortelazzi | Circulating levels of ghrelin in human fetuses[END_REF], and recent studies have shown that ghrelin levels in cord blood of full-term neonates are negatively correlated with birthweight [START_REF] Chanoine | Immunoreactive ghrelin in human cord blood: relation to anthropometry, leptin, and growth hormone[END_REF]. The hypothesis that high ghrelin levels in intrauterine growth restriction fetuses may represent a ""hunger signal"" is further supported by the finding of higher umbilical cord ghrelin plasma concentrations in small for gestational age (SGA) neonates, compared with appropriate for gestational age (AGA) and large for gestational age (LGA) neonates [START_REF] Farquhar | Elevated umbilical cord ghrelin concentrations in small for gestational age neonates[END_REF]. These data confirm a potential important role for ghrelin in the fetal and neonatal energy balance, and in allowing fetal adaptation to an adverse intrauterine environment [START_REF] Farquhar | Elevated umbilical cord ghrelin concentrations in small for gestational age neonates[END_REF].

Ghrelin and puberty

As shown for leptin, there are arguments supporting a role of ghrelin in the regulation of puberty onset. Puberty is exquisitely sensitive to the state of energy reserves, therefore ghrelin might represent a metabolic signal of energy insufficiency [START_REF] Zigman | From anorexia to obesity-The Yin and Yang of body[END_REF]. It has been reported that repeated injections of ghrelin in male rats, at two different dose regimens, during the pubertal transition, significantly decreased serum LH and testosterone levels and partially delayed balano-preputial separation (an external signal of puberty) (Fernandez-Fernandez et al. 2005a;[START_REF] Martini | Comparative analysis of the effects of ghrelin and unacylated ghrelin upon luteinizing hormone secretion in male rats[END_REF] ). This suggests that elevated ghrelin levels (a signal of energy insufficiency) not only inhibit LH secretion but might also delay the normal timing of puberty. Moreover, studies in rats have shown that female puberty is less sensitive than male puberty to the effects of ghrelin. In fact, repeated injections of ghrelin at low doses to peripubertal females did not induce major changes in serum levels of gonadotropin or estradiol nor did they significantly alter the timing of puberty, as estimated by ages of vaginal opening and first estrus (Fernandez-Fernandez et al., 2005b). In contrast, however, a twice daily injection of 1 nmol ghrelin for 10 days was sufficient to delay vaginal opening and ovarian follicular development and ovulation in pubertal female rats. Taken together, these data suggest that while both male and female rats are sensitive to the modulatory (inhibitory) actions of elevated levels of ghrelin on puberty onset, males appear to be more sensitive than females. This is in contrast to what was reported previously for leptin, as females are more sensitive than males to its regulatory (permissive) effects on puberty onset (Fernandez-Fernandez et al., 2006). This inhibitory effect of ghrelin on LH secretion is elicited not only by acylated ghrelin but also des-ghrelin, which is able to inhibit LH secretion in puberty of male rats via a GHSR-1a independent mechanism [START_REF] Martini | Comparative analysis of the effects of ghrelin and unacylated ghrelin upon luteinizing hormone secretion in male rats[END_REF].

The mechanisms whereby ghrelin exerts these modulatory actions on puberty onset remain however to be fully characterized. It is possible that ghrelin is able to inhibit hypothalamic GnRH secretion and pulse frequency, as demonstrated in vitro and ex vivo (Fernandez-Fernandez et al. 2005a;[START_REF] Lebrethon | Effects of in vivo and in vitro administration of ghrelin, leptin and neuropeptide mediators on pulsatile gonadotrophin-releasing hormone secretion from male rat hypothalamus before and after puberty[END_REF]. To date it is still unknown whether ghrelin exerts this effect directly on GnRH neurons or through indirect regulatory pathways.

Circumstantial evidence, however, suggests an indirect mode of action, as ghrelin effects on LH secretion were inhibited by a non-selective antagonist of corticotrophin releasing hormone (CRH) [START_REF] Vulliemoz | Astressin B, a nonselective corticotropin-releasing hormone receptor antagonist, prevents the inhibitory effect of ghrelin on luteinizing hormone pulse frequency in the ovariectomized rhesus monkey[END_REF], and ghrelin was able to inhibit the effect of central elicitors of GnRH/gonadotropin release, such as kisspeptin [START_REF] Martini | Comparative analysis of the effects of ghrelin and unacylated ghrelin upon luteinizing hormone secretion in male rats[END_REF]. Very A c c e p t e d M a n u s c r i p t 19 recent evidence suggests that ghrelin is able to suppress Kiss1 gene expression at discrete hypothalamic sites [START_REF] Forbes | Effects of ghrelin on Kisspeptin mRNA expression in the hypothalamic medial preoptic area and pulsatile luteinizing hormone secretion in the female rat[END_REF], thus providing, at least in part, the neuroendocrine basis for its inhibitory effects on puberty onset and gonadotropin secretion.

In humans the role of ghrelin on puberty regulation has not been directly investigated, although a progressive decline in circulating ghrelin levels as puberty progresses has been reported [START_REF] Soriano-Guillén | Ghrelin levels from fetal life through early adulthood: relationship with endocrine and metabolic and anthropometric measures[END_REF]). The decrease in plasma ghrelin levels during puberty progression has been interpreted as a permissive signal of HPG axis maturation, because of a favorable metabolic condition.

Ghrelin and the polycystic ovary syndrome

Polycystic ovarian syndrome (PCOS) is one of the most common causes of female infertility and affects approximately 6-7% of reproductive-age women [START_REF] Azziz | The prevalence and features of the polycystic ovary syndrome in an unselected population[END_REF]. In its classic form, it is characterized by the coexistence of hyperandrogenism, chronic anovulation, and polycystic ovarian morphology. Insulin resistance is very common in women with PCOS, particularly in the presence of obesity, and there is strong evidence this metabolic disorder, often associated with compensatory hyperinsulinemia, may play a triggering role in the pathophysiology of ovarian and adrenal hyperandrogenism, through different mechanisms described in detail elsewhere [START_REF] Ehrmann | Polycystic ovary syndrome[END_REF]. Hyperandrogenism, in turn, may contribute to the generation of insulin resistance through the stimulation of lipolysis, and therefore the increased blood availability of FFA, and specific changes in muscle morphology, by increasing less insulin sensitive type 2 muscle fibers and decreasing the density of capillaries and glycogen content [START_REF] Cortón | Differential gene expression profile in omental adipose tissue in women with polycystic ovary syndrome[END_REF]. In addition, androgen excess may favor the enlargement of the visceral adipose tissue, which directly worsens insulin sensitivity. As reported above, it is well known that ghrelin levels are negatively associated with obesity and positively with the insulin resistance state [START_REF] Cortón | Differential gene expression profile in omental adipose tissue in women with polycystic ovary syndrome[END_REF][START_REF] Shiiya | Plasma ghrelin levels in lean and obese humans and the effect of glucose on ghrelin secretion[END_REF].

Several studies have shown that ghrelin levels in obese PCOS were lower than in weightmatched control subjects without PCOS, and an inverse correlation between androgen (particularly androstenedione) blood levels has been found [START_REF] Barber | Ghrelin levels are suppressed and show a blunted response to oral glucose in women with polycystic ovary syndrome[END_REF][START_REF] Bideci | Serum ghrelin, leptin and resistin levels in adolescent girls with polycystic ovary syndrome[END_REF][START_REF] Glintborg | Evaluation of metabolic risk markers in polycystic ovary syndrome (PCOS). Adiponectin, ghrelin, leptin and body composition in hirsute PCOS patients and controls[END_REF][START_REF] Moran | Ghrelin and measures of satiety are altered in polycystic ovary syndrome but not differentially affected by diet composition[END_REF][START_REF] Pagotto | Plasma ghrelin, obesity, and the polycystic ovary syndrome: correlation with insulin resistance and androgen levels[END_REF][START_REF] Panidis | Comparative study of plasma ghrelin levels in women with polycystic ovary syndrome, in hyperandrogenic women and in normal controls[END_REF][START_REF] Panidis | Decreased active, total and altered active to total ghrelin ratio in normal weight women with the more severe form of polycystic ovary syndrome[END_REF][START_REF] Sağsöz | The effects of oral contraceptives including low-dose estrogen and drospirenone on the concentration of leptin and ghrelin in polycystic ovary syndrome[END_REF][START_REF] Schöfl | Circulating ghrelin levels in patients with polycystic ovary syndrome[END_REF]Zwirska-Korczala et al., 2008), although some studies could not confirm these findings [START_REF] Orio | Circulating gherlin concentrations in the polycystic ovary syndrome[END_REF][START_REF] Wasko | Elevated ghrelin plasma levels in patients with polycystic ovary syndrome[END_REF]. In one study, an inverse correlation has been reported between the hirsutism score and ghrelin concentrations [START_REF] Panidis | Decreased active, total and altered active to total ghrelin ratio in normal weight women with the more severe form of polycystic ovary syndrome[END_REF]. Interestingly, other studies reported that treatment with flutamide, a pure antiandrogen compound, or with oral contraceptives containing ethinylestradiol plus drospirenone, were able to increase ghrelin levels [START_REF] Gambineri | Anti-androgen treatment increases circulating ghrelin levels in obese women with polycystic ovary syndrome[END_REF][START_REF] Sağsöz | The effects of oral contraceptives including low-dose estrogen and drospirenone on the concentration of leptin and ghrelin in polycystic ovary syndrome[END_REF]. Overall, these data support the concept that androgens are modulators of ghrelin concentration, independent of the presence of obesity.

It is however possible that reduced levels of ghrelin in PCOS may depend on a coordinate effect of androgen excess and hyperinsulinemia. It could be speculated that lowered ghrelin in PCOS could act at hypothalamic and pituitary levels promoting LH hypersecretion, favoring in turn increased ovarian androgen production also facilitated by the loss of the inhibitory effect on steroidogenesis.

Ghrelin expression has been demonstrated in the ovaries of women with PCOS [START_REF] Komarowska | Ghrelin ovarian cell expression in patients with polycystic ovary syndrome: an immunohistochemical evaluation[END_REF], therefore the possibility that androgens may play an autocrine role in favoring increased ovarian steroidogenesis cannot be excluded. Although the available data are still sparse, the paradigm of PCOS suggests a potential capacity of sex hormones in the modulation of the ghrelin system. The effects of sex hormones on gastric secretion of ghrelin is controversial. In one study, ovariectomy or orchiectomy in female and A c c e p t e d M a n u s c r i p t 21 male adult rats, respectively, did not affect gastric ghrelin mRNA expression [START_REF] Gualillo | Gender and gonadal influences on ghrelin mRNA levels in rat stomach[END_REF]. By contrast, others found that estradiol produced locally in the stomach was able to stimulate ghrelin gene expression even after gonadectomy [START_REF] Sakata | Gastric estrogen directly induces ghrelin expression and production in the rat stomach[END_REF]. Another study reported suppressive effects of ovarian estradiol on stomach ghrelin gene expression as well as on the plasma ghrelin concentration [START_REF] Matsubara | Estrogen modulates ghrelin expression in the female rat stomach[END_REF]). An additional recent study found that estradiol supplementation was followed by increased synthesis and/or acylation of the ghrelin peptide without any effect on its metabolic clearance rate in premenopausal women [START_REF] Paulo | Estrogen elevates the peak overnight production rate of acylated ghrelin[END_REF], although another study did not confirm these data [START_REF] Dafopoulos | The effect of estrogens on plasma ghrelin concentrations in women[END_REF]. Moreover, it has been reported that estrogen administration to a culture system of rat gastric tissue explants, induced a significant decrease in ghrelin secretion, but did not affect either mRNA or protein levels, and that testosterone treatment in orchidectomized rats did not affect gastric ghrelin secretion [START_REF] Al-Massadi | Age, sex, and lactating status regulate ghrelin secretion and GOAT mRNA levels from isolated rat stomach[END_REF]. These conflicting data suggest that sex steroids may affect the ghrelin system not only in the stomach (where estrogen receptors have been described at the level of ghrelin producing cells) [START_REF] Campbell-Thompson | Immunolocalization of estrogen receptor alpha and beta in gastric epithelium and enteric neurons[END_REF][START_REF] Matsubara | Estrogen modulates ghrelin expression in the female rat stomach[END_REF]) but also at the peripheral level, however the precise mechanisms still remain largely unknown.

Ghrelin in the hypogonadic men

The secretion and the regulation of several hormones is sexually dimorphic, and differences between females and males have been demonstrated for leptin [START_REF] Ostlund | Relation between plasma leptin concentration and body fat, gender, diet, age, and metabolic covariates[END_REF]. The same seems to be true for ghrelin which, similarly to leptin, tends to be higher in women than in men [START_REF] Greenman | Testosterone is a strong correlate of ghrelin levels in men and postmenopausal women[END_REF]. In men, a significant correlation between ghrelin and testosterone (total or bioavailable) has been reported. In fact, lower ghrelin levels have been shown in hypogonadal men compared with weight-matched eugonadal men or normal [START_REF] Duran | Plasma ghrelin levels in males with idiopathic hypogonadotropic hypogonadism[END_REF][START_REF] Naharci | The relationship between ghrelin levels and insulin resistance in men with idiopathic hypogonadotrophic hypogonadism at diagnosis and after therapy[END_REF][START_REF] Pagotto | Testosterone replacement therapy restores normal ghrelin in hypogonadal men[END_REF], and a negative correlation between ghrelin and insulin resistance has been found [START_REF] Pagotto | Testosterone replacement therapy restores normal ghrelin in hypogonadal men[END_REF]. In addition, treatment with testosterone in hypogonadal men tends to restore ghrelin levels to normal [START_REF] Pagotto | Testosterone replacement therapy restores normal ghrelin in hypogonadal men[END_REF]. These findings support the concept that androgens may act directly on both peptide expression and synthesis, or indirectly through regulation of FFA metabolism [START_REF] Broglio | Effects of glucose, free fatty acids or arginine load on the GH-releasing activity of ghrelin in humans[END_REF], although this latter mechanism is controversial [START_REF] Mohlig | Euglycemic hyperinsulinemia, but not lipid infusion, decreases circulating ghrelin levels in humans[END_REF].

Ghrelin may also regulate spermatogenesis, since detectable ghrelin concentrations have been reported in the seminal plasma of men with normospermia and dyspermia. Notably, sperm ghrelin levels are lower than plasma ghrelin levels [START_REF] Panidis | Serum and seminal plasma ghrelin levels in men with normospermia and dyspermia[END_REF]. However, the potential role of ghrelin in the regulation of spermatogenesis and spermatozoa vitality is still largely unknown. Much more research should be performed on this topic, due to the potential impact of ghrelin dysregulation on male infertility.

Conclusions and future directions

Ghrelin, like leptin, seems to be a key factor linking energy balance and reproductive function in males and females. This important role is supported by the finding of ghrelin and its active receptor in tissues involved in the control of metabolism and in the reproductive system of males and females. Recently, ghrelin has also been found in placenta and in uterus, where it seems to be involved in embryo implantation and pregnancy development, and in decidualization of endometrium. In addition, studies in normal subjects and in hyperandrogenic or hypogonadic disorders demonstrate that ghrelin, sex steroids and gonadotropins strongly influence each other. Although more studies are needed to clarify the complex network between ghrelin and reproduction, these findings have potential clinical implications for the regulation of fertility

  AbbreviationsCyclic Adenosine Monophosphate = cAMP Body mass index = BMI des-Gln14-ghrelin or des-acyl-ghrelin = des-ghrelin Follicle Stimulating Hormone = FSH Free Fatty Acid = FFA Gonadotropin Releasing Hormone = GnRH Growth Hormone Secretagogue Receptor type 1a = GHSR-1a Growth Hormone = GH Hypothalamic-Pituitary-Gonadal axis = HPG axis Luteinizing Hormone = LH Neuropeptide Y = NPY Polycystic Ovary Syndrome = PCOS Prolactin = PRL

  A list of experimental and epidemiological studies conducted in the 1960s-1970s led

  A c c e p t e d M a n u s c r i p t 11 Ghrelin, testis and ovaries: animal studies.

Zwirska-Korczala, K., Sodowski, K., Konturek, S.J., Kuka, D., Kukla, M., Brzozowski, T., Cnota, W., Woźniak-Grygiel, E., Jaworek, J., Bułdak, R., Rybus-Kalinowska, B., Fryczowski, M. 2008


Ivan Studnia
email: studnia@laas.fr

Vincent Nicomette
email: nicomett@laas.fr

Mohamed Kaâniche
email: kaaniche@laas.fr

Eric Alata
email: ealata@laas.fr

A distributed platform of high interaction honeypots and experimental results (Extended Version)

The increase of various malicious activities spreading on the Internet network are today a crucial problem. In order to understand the motivations and operating modes of the attackers, it is necessary to collect data characterising these malicious activities. Their analysis enables to better face these attacks, anticipate new threats and better adpat the corresponding protection mechanisms. This paper proposes a distributed platform oh high interaction honeypots deployed for that purpose. The paper describes 1) the design and implementation of this platform, 2) the methodology used to collect and record data characterising the malicious activities and 3) the first analyses carried out on this data.

I. INTRODUCTION

The Internet fast paced development (about two billion users in 2010 according to the Internet World Stats1 ) permitted the emergence of many online services and many communities of Internet users. This network is now so important that rules and even laws have been created in order to ensure its right behavior. Indeed, some people, through exploits of hardware or software vulnerabilities, misuse computers for malicious purposes, e.g. to obtain private information, take over computers or spread some malware (worms, trojans. . . ). Therefore, countermeasures have been designed in attempts to fix these weaknesses and block the attacks, continuously forcing the hackers to find new vulnerabilites and new ways of using them. Thus, attackers and security experts are in a never-ending attack-defense race [START_REF] Mccarty | The honeynet arms race[END_REF].

Today, it is crucial to know the strategies currently used by the attackers in order to efficiently counter incoming attacks and to design new, adapted protection mechanisms. To do so, one should collect the most recently available information about hackers. There are currently different ways used to do so. For example:

1) Collection and processing of the information issued by networking and security devices like routers or firewalls 23 . 2) Setting up of "decoys" [START_REF] Cheswick | An evening with berferd in which a cracker is lured, endured, and studied[END_REF], in order to trap and monitor attackers' activities. In this paper, we focus on the automation of the latter, through the concept of honeypots. The common definition was given by L. Spitzner [START_REF] Spitzner | Honeypots: Tracking Hackers[END_REF]: A honeypot is an information system resource whose value lies in unauthorized or illicit use of that resource. Here, this term refers to a computing system, connected to the Internet, deliberately designed to be vulnerable in order to be an attractive target for attacks so that we can analyze their characteristics (protocols being used, exploited weaknesses, executed programs. . . ). There are many different ways to design a honeypot [START_REF] Maggi | WOMBAT Project Worldwide Observatory of Malicious Behaviors and Attack Threats[END_REF], [START_REF] Noah | Do1.1: Survey on the state of the art[END_REF]. They are usually grouped within two categories: high (for example [START_REF] Balas | Know your enemy : Sebek[END_REF]) or low (as in [START_REF] Provos | A virtual honeypot framework[END_REF]) interaction, depending on the possibilities given to an attacker, although new trends are appearing (like in [START_REF] Leita | Scriptgen: an automated script generation tool for honeyd[END_REF], [START_REF] Wagener | Self adaptive high interaction honeypots driven by game theory[END_REF] or [START_REF] Baecher | The nepenthes platform: An efficient approach to collect malware[END_REF]). We propose in this paper the description of a data collection platform using various high interaction honeypots set in different locations, along with our first analyses of this data. This deployment follows a previous experiment conducted with the same honeypot that was deployed at a single location (cf. [START_REF] Nicomette | Set-up and Deployment of a High Iinterfaction Hhoneypot: Experiment and Lessons Learned[END_REF]). The objective is to check if the results of our first experiment can be generalized.

This paper is arranged as follows. Section II presents an overview of the high interaction honeypot that we conceived and implemented within these experiments. Then the collected data and the way it is stored and sorted are described in section III. Section IV details the architecture of the distributed honeypot platform and explains how it works. deployed for this experiment. Section V presents the results of the first analyses performed on the collected data. Finally, section VI will conclude this work.

II. HIGH INTERACTION HONEYPOT

The design and implementation of our high interaction honeypot is not the main contribution of this paper. As a consequence, we only present its main characteristics in this section. More detailed information can be found in [START_REF] Nicomette | Set-up and Deployment of a High Iinterfaction Hhoneypot: Experiment and Lessons Learned[END_REF].

Our high-interaction honeypot is especially designed to record malicious activities carried out by human beings. However it is also able to record activites carried out by automatic tools. For that purpose, we included vulnerabilities that can be easily exploited by human beings. Our choice was to use the GNU/Linux operating system and create user accounts with weak passwords, accessible through the ssh service.

So as to obtain the highest interaction level possible, several hosts can be accessed by the attackers. As "real" systems are costly and complex to manage, we used virtual hosts. The information recorded to analyse attack scenarios, is:

• The pairs (login/passowrd) tested by the intruder.

• The keystrokes typed by the intruder as well as the text displayed on his/her terminal. These characters allow us to reconstruct the commands entered by the intruder.

• The system calls generated by the activity of the attackers.

This can be useful if the capture of the keystrokes entered by the intruder is not sufficient to identify the commands executed by the attacker (use of shortcuts, or program that calls other programs). The kernel of each virtual machine is patched at two places. We instrumented: 1) the functions of the tty driver that allow us to record all the keystrokes and characters typed by the intruder while he/she has successfully penetrated the system and uses an interactive shell, and 2) the exec system call that allows us to intercept each system call executed by the intruder.

Additionally, in order to capture the usernames and the passwords tested by the attackers, we created a new system call in the kernel and modified the SSH server accordingly to use this new system call. All this information is logged on a dedicated area of the virtual host kernel memory. This choice is motivated by the fact that most of the patched code runs in privileged mode (ring 0) and has direct access to kernel memory space. This collected information is then periodically copied into the real host: the content of the virtual host memory is directly accessible from the real host. The main advantage of this backup strategy is that it is difficult to identify by the attacker. It is a simple copy of data from a memory region to the hard disk of the real host and it is carried out only once a day at a fixed date (this operation lasts less than one second). Finally, the collected information is transferred to a database server where the analyses can be performed.

Figure 1 presents the architecture of the honeypot. Data recorded by the honeypots is stored in a database and sorted to ease future accesses and subsequent analyses.

The database structure is summed up in figure 2. We will only describe here the most important tables used for our analyses. Table op_sshd_auth_password contains the data concerning every connection attempt. The meaning of each field is described hereafter:

• ip_address is the attacker's source IP address.

• user is the attempted login.

• password is the attempted password.

• is_auth shows whether the connection succeeded or not.

• end_id represents, in case of a successful connection, the id of the latest recorded action during the corresponding attack.

Table op_sshd_new_session is updated whenever there is a successful connection. Quite similar to op_sshd_auth_password, it only contains information about the attacks during which a terminal has been opened. Column tty_name shows which terminal was assigned to the attacker. This information is used to link the data given by the patched tty driver to the one given by the ssh server.

Table op_tty_read_write contains all the information recorded by the tty driver. Each line includes the content of the tty buffer and the name of the terminal to which it belongs. When the data contains input typed by an attacker, the buffer will only contain one character at a time. However, if the input has been copied and pasted, the buffer will contain several characters. It is therefore easy to make a first observation about the attacker's behaviour.

Table op_exec contains data related to the programs executed by the host during an intrusion. Each line contains the name of the executed program, the parameters it received and the terminal in which it was run.

Once the database is filled, tables called sessions can be created and updated. These tables store data resulting from the grouping of ssh connections into attack sessions. Data is regrouped as follows : close in time ssh connections from the same IP are gathered into sessions 4 . in order to recreate an attacker's activities. We can distinguish three categories :

• The attacker succesfully logged in and commands have been issued. These are called intrusions. • No commands were issued, but a large amount of (login/password) where tried in a short period of time. These are called dictionnary attacks. • All other cases fall into the others category. They probably correspond to misconfigurations of accidental errors.

sessions tables then consists of:

• beginning and end which are the ids of the starting and ending events of a session. • session_type which indicates whether the attack is an intrusion, a dictionary attack or none of these. • is_auth which is set to 1 if at least one connection attempt succeeded during the session and which is set to 0 otherwise. • ip_address which is the attack source IP.

• country which is the country this IP is from. A graphical user interface for managing the base was developped in order to ease the processing and the analyses of the data recorded in this database.

IV. HONEYPOTS DISTRIBUTED PLATFORM

Our goal is to deploy honeypots into several places over the world in order to compare the behaviours of different attackers. Our aim is to check if some global trends emerge or if activities are instead related to the location of the targeted honeypot. For this experiment, we have had access to four machines, each one with its own public IP address, located in three different places: one in Toulouse, France, another one in Rennes, France, another one in College Park, Maryland and the last one at LAAS. This section presents the architecture of our honeypot platform.

A. Architecture

We had two different alternatives to deploy the high interaction honeypot on the different locations. A first possibility is to replicate the architecture of the honeypots used during our previous experiment and to install it on a computer located in those different locations. However, this idea has three major drawbacks. First, deploying a high interaction honeypot remains a risky operation, because it lets an attacker actually operate on the real system and possibly make damages on this system. Therefore, deploying several honepots in different remote sites imposes a lot of security constraints and administration overhead, all the more as we do not control the remorte network where the honeupots will be installed and configured. Secondly, each honeypot must be deployed under identical conditions because different parameters could bias the comparative analyses. This is important and must be taken into account when designing the platform. Finally, we do not want the networks hosting our honeypots to be infected. This means that we do not allow an attacker to execute his commands on computers that are not under our control. Our system have to make an attacker believe he is connected on a computer located in Toulouse, Rennes or College Park whereas he actually interacts with one machine at LAAS. Thus, we chose an approach in which an attacker's connections will be rerouted towards virtual machines installed on one particular computer located at LAAS. This way we can keep control on the honeypots, guaranteeing a sufficient amount of security and more efficient ways to react to possible threats. Moreover, this allows us to minimize the influence of the hardware and the networks at the different locations by using these remote machines only as relays to our local setup.

Figure 3 provides an overview of the deployed architecture. We have three machines located into remote networks and one set up at LAAS, each one with a public IP address. All act as relays to our virtual machines, named VM1 to VM4. These are installed on the same host which also simulates a local network for each of those virtual machines. GRE (Generic Routing Encapsulation, as described in RFC 2784 5 ) tunnels are created between each relay and the host, which links each virtual machine to its corresponding tunnel. We must however ensure that the replies sent to the attackers by our virtual machines will follow the same route that the requests they recieved (that is, going back through the tunnels and the relay), otherwise they could be blocked by some firewalls. Finally, routing rules on the host and the relays enable some selected part of the traffic targeting the relays public IPs to be rerouted to the virtual machines.

B. Traffic management

Connections are monitored by the relays and the host at LAAS. Monitoring is done with iptables, allowing us to write rules to filter incoming and outgoing packets of a Linux system. The security policy enforced by the relays is as follows:

• Incoming connections on port 22 are allowed. It is the default port for ssh, and thus enables the attackers to connect to this service.

• Outgoing connections through ports 53 (dns) and 123 (ntp) are allowed, so our virtual machines can use these services. • An extra port plaas is opened only for machines with LAAS owned IPs, for remote administration purposes. • GRE protocol is allowed in both directions.

• Every other connection attempts are dropped. The security policy concerning the machine at LAAS hosting the virtual machines is as follows : La politique de sécurité au niveau de l'hôte des machines virtuelles est la suivante :

• GRE protocol is allowed in both directions.

• ssh connections on port plaas are allowed from LAAS, for administration purposes. • ssh connections on port 22 are allowed from the tunnels to the virtual machines. • dns and ntp are allowed from the virtual machines to the tunnels.

V. EXPERIMENT AND DATA ANALYSIS

Our experiments were carried out in two steps. First, we deployed our honeypots for a month without any account created. This first step lasted from June 1 st to June 30 th . Analyses of the data collected during this month gave an overview of the login/password pairs tried by the attackers, as well as their frequency. These results have been used to create a list of accounts we knew to be often tried. The next step started with the creation of the aforementioned accounts on every honeypot. Thanks to these accounts, we hoped to quickly observe some intrusions. This second step started on July 1 st . In this section, we first give an overview of the results obtained during these two steps, distinguishing them if required. Then, we present some detailed analyses on this data. We consider the data recorded up to December 1 st .

A. Observed activities

In this part, we analyze the results of the observations made on the honeypots before any processing of the data. These analyses concern both steps of our experiment.

1) ssh connections: a) Overview: Table I shows how the observed connections are distributed between our honeypots on December 1 st . Each one of these connections corresponds to a login/password request sent to a ssh server.

The number of distinct addresses we get by considering all the honeypots together (1207) being smaller than the sum of the values obtained for each machine (1390), it appears that some IPs connected on more than one machine. Therefore, we will have to take these intersections into account during our analyses.

Table II shows which pairs were the most tried on each honeypot. Unsurprisingly, the root account (which is the administrator account on Linux) is the favorite target of the attacks, no matter which honeypot we consider. For the rest, we can see that the most tried pairs are quite simple, with a password often identical to the login. This confirms the observations made four years ago in [START_REF] Nicomette | Set-up and Deployment of a High Iinterfaction Hhoneypot: Experiment and Lessons Learned[END_REF]. We may then suppose that it is still common practice to use such logins/passwords (an attacker would have no interest in trying such combinations if they were very unusual). Moreover, there seems to be an interest for logins corresponding to default accounts usually created for the needs of some programs (oracle, mysql, postgres, nagios, etc.). Corresponding passwords are those initially created during the installation of such applications. It would be interesting to know if these programs are targeted only because they are widespread or if the interest lies in obtaining the files and the data they can use.

When we compare the results obtained on each honeypot, we can see some variations between the rankings, although some pairs appear in the first positions of every honeypot.

b) Calibration: At the end of the first phase, we identified the most tried combinations on each honeypot. Using this data (excluding root), we established a list of login/password pairs which has been used on all four honeypots. The pairs in this list were chosen according to the following criteria :

• Pairs being among the most tried ones on one honeypot but not on the others. • Pairs often tried on every honeypot.

• Pairs in which the login differs from the password.

• Pairs in which the login is identical to the password.

• Pairs for which the login is related to software that could be installed on the computer (apache, mysql, etc.). Using these criteria, we created the accounts shown in table III on every honeypot. c) First connections: Let us call τ 1 the duration between the creation of an account and the first successful connection attempt to this account, and τ 2 the time spent since this attempt until the first connection on the same account where commands were entered. Values of τ 1 and τ 2 for every account created on our honeypots are given in table IV. In two cases, an attacker logged in with one of the 11 accounts succesfully managed to obtain root privileges through exploiting a system vulnerability. When this happened, we also give the time spent between the account creation and this event.

The table shows much higher values for τ 1 on the College Park honeypot. There are several possible explanations for this. First, the activity on this honeypot since the accounts creation has been less intense than on the three other ones. This could be due to the network configuration, which may implement some form of rate limiting, during a dictionary attack for example. Various tests indicate that this is not the case here, as it was later confirmed by the sysadmin of the corresponding site. We can also assume that the few seconds delay resulting from the rerouting of the requests from the United States to France was big enough to discourage part of the attackers. Finally, we can not rule out the hypothesis of an attacker being able to unveil the honeypot, putting its IP address on a "blacklist" of machines to be ignored.

We can see on this table that every account that has been found was not necessarily attacked afterwards. This may be due to several causes. First, as we deliberately chose to use frequently tried combinations, several of them may be found in one attack session (10 valid pairs were found during one single dictionary attack targetting the honeypot located in Toulouse). It happened that the attacker logged in with just one account then changed the password of the other ones from there, preventing other attackers from connecting afterwards. For example, we observed an attacker who changed 6 passwords in a row. Moreover, we had two cases where an attacker was able to acquire root privileges. From there, he changed the password of any account he could find on the machine. As root, he possessed every privilege on the attacked machine, thus he did not even need to know the original passwords in order to change them. After that, the new passwords being quite sophisticated, they were not found during later dictionary attacks. This kind of specific behaviours will be described in section V-C2.

The analyses of our results show that the discovery of our accounts happened quickly (except in College Park and for account C4), as expected, since in one week all but one logins and passwords were found. However, the time before a first intrusion on these accounts ranges from one hour to more than two weeks.

2) Geographical distribution:

The recorded connections came from 1207 distinct IPs, originating from 78 countries.

TABLE V ORIGIN OF THE MOST OBSERVED ATTACKS ON EACH HONEYPOT

China and the United States are the two top ranked countries on the four honeypots. Concerning the rest of the rankings, at this scale, the differences are not important enough to allow us to conclude.

Moreover, by comparing the IPs recorded by these four honeypots with those recorded by the honeypot previously installed at LAAS [START_REF] Nicomette | Set-up and Deployment of a High Iinterfaction Hhoneypot: Experiment and Lessons Learned[END_REF] (3230 distinct addresses recorded between January 2006 and August 2010), only four of them were seen during both experiments, and only on the honeypots located in France. This emphasizes a first interesting conclusion: it seems that the IP addresses used for these attacks have a limited lifespan.

B. Dictionary attacks 1) Overview:

We call dictionary attacks a session during which at least 9 ssh connection attempts happened. This allows us to rule out quite safely the cases where the observed attempts actually correspond to connection mistakes. We obtained a total of 1479 dictionary attacks. These originated from 825 distinct addresses, from 71 different countries.

2) Vocabularies: a) Definition: We call vocabulary of a session the set of login/password pairs used during this session. Each pair forms a word of this vocabulary. We call dictionary a set of vocabularies possessing common characteristics.

b) Observations: We created a global dictionary for each honeypot, which is actually the union of all the vocabularies observed on this honeypot. Thus, we call D1, D2, D3 and D4 the global dictionaries from the honeypots respectively located in Toulouse, Rennes, College Park and at LAAS. We call D1 ′ , D2 ′ , D3 ′ and D4 ′ the dictionaries created from D1, D2, D3 and D4 and containing the words appearing only in these dictionaries :

Di ′ = {m ∈ Di/∀j = i, m / ∈ Dj}
These are called the exclusive parts of those dictionaries.

Table VI shows the amount of words those dictionaries have in common. Despite the big differences of size between the different dictionaries, we can make some observations. First, one can notice that a large enough basis of common pairs exists, even if it changes within each honeypot. Indeed, the exclusive parts of the dictionaries D1, D2, D3 and D4 consist in 57%, 62%, 14% and 44% of their respective sizes.

Dictionary

Number Dictionary Nomber of words of words

D1 127226 D1 ∩ D2 ∩ D3 3732 D2 142956 D1 ∩ D2 ∩ D4 29277 D3 5953 D1 ∩ D3 ∩ D4 3172 D4 76102 D2 ∩ D3 ∩ D4 3224 D1 ∩ D2 46893 D1 ∩ D2 ∩ D3 ∩ D4 3025 D1 ∩ D3 4218 D1 ′ 72598 D1 ∩ D4 36673 D2 ′ 89463 D2 ∩ D3 4546 D3 ′ 825 D2 ∩ D4 35262 D4 ′ 33348 D3 ∩ D4 3467

TABLE VI INTERSECTIONS OF THE FOUR GLOBAL DICTIONARIES

In a similar way, let us call D0 the dictionary containing every pair tried during the experiment described in [START_REF] Nicomette | Set-up and Deployment of a High Iinterfaction Hhoneypot: Experiment and Lessons Learned[END_REF], and D0 ′ , its exclusive part regarding D1, D2, D3 and D4. Table VII gives us an overview of the evolution of current vocabularies compared to those observed during the previous experiment. We note that about 40% of the content from the recently observed dictionaries (except for D3, for which a higher proportion, around 80%, was observed) is also in D0. Considering the largest dictionaries, it seems that the content of the vocabularies tends to evolve through time. Nevertheless, it is early to generalize this conclusion due to the relatively short duration of the second experiment.

Dictionary

Number of words

D0 253287 D0 ∩ D1 56333 (44% D1) D0 ∩ D2 51219 (36% D2) D0 ∩ D3 4653 (78% D3) D0 ∩ D4 33675 (44% D4) D0 ∩ D1 ∩ D2 ∩ D3 ∩ D4 2720 D0 ′ 172708

TABLE VII COMPARISONS BETWEEN OLD AND NEW DICTIONARIES

3) Geographical distribution: Table VIII counts the IP addresses having performed dictionary attacks on several machines. We note that only two addresses have attacked all four honeypots. However, there is an important number of addresses which attacked at least two honeypots in France whereas a very few IPs were seen both in France and in the United States. It should be noted that the IPs corresponding to the French honeypots are quite close to one another but farther from the College Park address. Moreover, the lists of login/password pairs tried by a single address on several of our honeypots are very similar, and sometimes identical. It seems that machines dedicated to these attacks are given a range of IPs to target instead of scanning the whole spectrum. They then keep trying the same sequence of pairs on each machine before proceeding to the next one, or even restarting at the beginning of the range, as we witnessed several times.

C. Intrusions

This section is dedicated to the analysis of the successful connections that included the execution of some commands on the honeypot : the intrusions.

1) Identifying the attackers: We noted that almost half of the 131 intrusions we recorded came from the same European country P1 (62 intrusions). These results confirm what had been noticed during the previous experiment [START_REF] Nicomette | Set-up and Deployment of a High Iinterfaction Hhoneypot: Experiment and Lessons Learned[END_REF]. However, some of these addresses may actually be relays used by an attacker to hide himself behind. Nevertheless, analysis of the information given by the terminals used during the attacks showed that those attackers often tried to download programs on websites hosted in the same country. Besides, among the programs that were actually executed, several diplayed some text in the language from P1.

Moreover, we have seen in section V-A1a that some IP addresses were seen on several honeypots. The results of the analyses of the overlapping IPs presented in table IX show us that intrusions on different locations are rarely carried out from the same addresses. Indeed, only five IPs involved in intrusions were seen on several honeypots, more specifically on the French ones. Looking more in detail at what happened during these intrusions, we noted that for four of them, that targeted both the honeypots deployed in Toulouse and in Rennes, the altered password used during the account takeover (cf V-C2a) was always the same (the fifth address did not change the password of the attacked account). We can conclude from this observation that these four addresses therefore belong to the same individual or group of individuals. Furthermore, the number of distinct addresses is quite close to the number of detected intrusions but much higher than the number of attacked accounts, which means that most of the attackers do not connect twice with the same address on an account. In the case of accounts having been visited by several addresses, two hypothesis (that do not exclude each other) can be considered :

• The attacker changed his address on each connection to hide his activities. • There is actually a community of attackers sharing information about the machines they attacked, which for example allows them to relay if one of them cannot take over a machine due to a lack of technical skills. • Concern for discretion: the attacker checks if he is currently alone on the machine and often deletes the history files. • Exploring the machine: the attacker tries to obtain information about the attacked machine : name and version of the OS, processor characteristics, etc. • Account takeover: during the first connection to an account, the attacker always changes his password for a more sophisticated one in order to get control over the account, but takes the risk of being detected in case the legitimate user wants to use his machine. • IP scan: the attacker installs an IP range scanning program in order to find which remote hosts can be accessed through ssh from the attacked computer. • IRC client setup: this messenging protocol client is used to receive and execute instructions sent by an attacker from a remote server. The goal here seems to connect the infected machine to a botnet, the server thus sending its instructions to hundreds of compromised machines at the same time. • Attempts to acquire administrator privileges: some attackers try to obtain administrator privileges in order to have a complete control over the compromised machine. To do so, they try to exploit security vulnerabilities thanks to various dedicated programs like rootkits. b) Analysis of the "root" intrusions: We observed that two attackers successfully gained root access to the honeypot. We present in this section a description of the operations they ran once they obtained the root access.

Once the administrator privileges obtained, both the attackers immediately changed the root pasword. Then they installed customized software in order to get information about the "legitimate" users of the computer and also to open a new port so that they would be able to communicate with the machine even if they happened to lose the access through port 22 (a so called backdoor).

The first attacker thus installed the rootkit SHV4 6 . This software installs an ssh server if there is not one already, alters the ssh client executable to record the logins and passwords tried during connections to other hosts and installs several altered system executables which would normally permit to detect its presence, allowing it to stay undetected. This attacker likely wanted to easily find targets for his future attacks. However, he also changed the passwords of every account he had found on the machine thanks to his previous dictionary attack, but also by listing the folders located in the /home directory (but did not read the list of existing accounts, located for example in /etc/passwd). It seems odd that the attacker wanted to cover his activity and to collect the passwords typed by the legitimate users while also preventing the greatest possible amount of users from accessing their accounts.

The second attacker also replaced the ssh client binary by another version but we could not identify the changes actually implemented in the modified version. He however did not change the passwords of other existing accounts but created a new one, named "backup" and possessing administrator privileges. He then accessed again this account but did not alter anything else yet. However, he kept using the "user" account to install new IRC clients, probably because he could not establish a link with those he previously installed due to our network security policies.

VI. CONCLUSION

We have presented in this paper a distributed plateform for deploying high interaction honeypots as well as our first results regarding the analysis of the collected data.

These first results confirm, for most of them, the conclusions we had drawn from a previous experiment carried out with only one honeypot. These confirmed conclusions are: 1) the specialisation of the IP addresses used by the attackers, either used for dictionary attacks, or used for intrusions, but never for both activities; 2) the main activities and goals of the attackers when they interact with the honeypots and 3) the main country which is at the origin of the intrusions. We have also drawn new conclusions from this experiment: 1) the IP addresses that are used by the intruders are almost all renewed (only four IP addresses have been "seen" both during this experiment and during this previous experiment we carried out) and 2) the dictionaries used for the dictionary attacks seem to evolve, from the previous experiment to this new experiment. Of course, these analyses are still preliminary and need to be confirmed by other sets of data that we go on to collect.

Fig. 1 .

 1 Fig. 1. Honeypot architecture III. DATA COLLECTION AND STORAGE

Fig. 2 .

 2 Fig. 2. Schema of the database corresponding to one honeypot

Fig. 3 .

 3 Fig. 3. Honeypots distributed platform architecture

TABLE I DISTRIBUTION

 I OF THE ssh CONNECTIONS OBSERVED ON THE HONEYPOTS.

TABLE IV τ

 IV 1 AND τ 2 DURATIONS FOR EACH ACCOUNT AND EACH HONEYPOT

  Table V shows the 5 countries from which we have seen the highest number of distinct IPs on each honeypot.

	Rank	Toulouse	Rennes	College Park	LAAS
	1	China 83	China 80	China 40	China 98
	2	USA 50	USA 56	USA 39	USA 60
	3	Germany 18	South Korea 37	Brazil 12	Romania 34
	4	France 18	Germany 14	Japan 7	Russia 16
	5	Netherlands 18	UK 13	UK 7	Germany 14
	Nb. distinct
	IPs	385	387	197	421

TABLE VIII DISTRIBUTION

 VIII OF THE IPS INVOLVED IN DICTIONARY ATTACKS

www.internetworldstats.com/stats.htm

www.dshield.org

www.symantec.com/about/profile/universityresearch/sharing.jsp

This grouping is done according to a threshold for which we set the value at 20s, after analyses we will not detail here (see[START_REF] Studnia | Observation et Aanalyse d'Attaques sur Internet[END_REF])

www.ietf.org/rfc/rfc2784.txt.

http://web.fhnw.ch/plattformen/ns/vorlesungsunterlagen-1/networkanalysis-tools/shv4-analysis