Caroline Salon

Béatrice Eymin

Olivier Micheau

Laurence Chaperot

Joël Plumas

Christian Brambilla

Elisabeth Brambilla

Sylvie Gazzeri

Beatrice Eymin
email: beatrice.eymin@ujf-grenoble.fr

Dr Beatrice Eymin

E2F1 induces apoptosis and sensitizes human lung adenocarcinoma cells to death-receptor-mediated apoptosis through specific downregulation of c-FLIP short Running title: E2F1 targets c-FLIP S to induce apoptosis

Keywords: Apoptosis, Death Receptor, E2F1, c-FLIP, Lung tumors APAF-1, Apoptosis Protease-Activating Factor 1, FADD, Fas-Associated Death Domain-containing protein, FasL, Fas Ligand, FLICE, Fas-associated death domain-Like Interleukin 1β-Converting Enzyme, DISC, Death-Inducing Signaling Complex, c-FLIP, FLICE Inhibitory Protein, RB, Retinoblastoma, TRAIL, Tumor necrosis Factor-Related Apoptosis-Inducing Ligand

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The E2F transcription factors family plays a major role in regulating a diverse array of cellular functions including proliferation, differentiation and apoptosis [START_REF] Degregori | The genetics of the E2F family of transcription factors: shared functions and unique roles[END_REF]. So far, seven distinct E2F proteins (E2F1 to 7) with different affinities for the pRB pocket family have been identified [START_REF] Dyson | The regulation of E2F by pRB-family proteins[END_REF][START_REF] Stefano | E2F7, a novel E2F featuring DP-independent repression of a subset of E2F-regulated genes[END_REF]. The interaction of E2Fs with the pRB members tightly controls their transcriptional as well as their repressive functions on target-genes mostly involved in G 1 to S phase transition [START_REF] Harbour | The Rb/E2F pathway: expanding roles and emerging paradigms[END_REF]. If individual E2F proteins demonstrate overlapping functions in the control of cell cycle progression, they also display distinct specificities [START_REF] Degregori | Distinct roles for E2F proteins in cell growth control and apoptosis[END_REF]. Actually, only E2F1, E2F2 and E2F3 are able to induce apoptosis in fibroblasts [START_REF] Degregori | Distinct roles for E2F proteins in cell growth control and apoptosis[END_REF][START_REF] Johnson | Expression of transcription factor E2F1 induces quiescent cells to enter S phase[END_REF][START_REF] Qin | Deregulated transcription factor E2F-1 expression leads to S-phase entry and p53-mediated apoptosis[END_REF][START_REF] Wu | p53 and E2F-1 cooperate to mediate apoptosis[END_REF][START_REF] Kowalik | E2F1-specific induction of apoptosis and p53 accumulation, which is blocked by Mdm2[END_REF]. In addition, E2F1deficient mice exhibit a defect in thymocyte apoptosis as well as in negative selection demonstrating the role of E2F1 during the physiological apoptotic processes [START_REF] Field | E2F-1 functions in mice to promote apoptosis and suppress proliferation[END_REF][START_REF] Garcia | A role for E2F1 in the induction of apoptosis during thymic negative selection[END_REF].

Importantly, as these mice also develop tumors [START_REF] Field | E2F-1 functions in mice to promote apoptosis and suppress proliferation[END_REF][START_REF] Yamasaki | Tumor induction and tissue atrophy in mice lacking E2F-1[END_REF], it has been proposed that E2F1mediated apoptosis could contribute to its tumor suppressive function. E2F1-induced apoptosis occurs via both p53-dependent and -independent pathways, and involves the transcriptional activation of numerous pro-apoptotic E2F1-target genes including p14 ARF /p19 ARF , p73, apaf1 and caspases [START_REF] Wu | p53 and E2F-1 cooperate to mediate apoptosis[END_REF][START_REF] Hiebert | E2F-1:DP-1 induces p53 and overrides survival factors to trigger apoptosis[END_REF][START_REF] Hsieh | E2F1-induced apoptosis requires DNA binding but not transactivation and is inhibited by the retinoblastoma protein through direct interaction[END_REF]. Moreover, alternative models suggest that E2F1 also inhibits anti-apoptotic signals such as NF-kB, or sensitizes cells to pro-apoptotic stimuli (for review, see [START_REF] Ginsberg | E2F1 pathways to apoptosis[END_REF]). Recently, a link between E2F1 and the extrinsic apoptotic pathway also called death receptor-related apoptosis has been established in murine primary T cells [START_REF] Cao | The E2F-1 transcription factor promotes caspase-8 and bid expression, and enhances Fas signaling in T cells[END_REF] and post-mitotic neurons [START_REF] Hou | Activation of the Rb/E2F1 pathway by the nonproliferative p38 MAPK during Fas (APO1/CD95)-mediated neuronal apoptosis[END_REF]. FAS (also CD95, APO-1) is a 45-kDa cell surface protein which belongs to the tumor necrosis factor (TNF) / nerve growth factor (NGF) receptors family [START_REF] Itoh | The polypeptide encoded by the cDNA for human cell surface antigen Fas can mediate apoptosis[END_REF]. Following stimulation by its cognate ligand (FasL) or by agonistic FAS antibodies, FAS oligomerizes and recruits several death-associated molecules, including the FADD adaptator (Fas-Associated Death Domain-containing protein, also MORT1) [START_REF] Boldin | A novel protein that interacts with the death domain of Fas/APO1 contains a sequence motif related to the death domain[END_REF][START_REF] Chinnaiyan | FADD, a novel death domaincontaining protein, interacts with the death domain of Fas and initiates apoptosis[END_REF] and the caspase-8 (also FLICE /MACH/Mch5) [START_REF] Boldin | Involvement of MACH, a novel MORT1/FADD-interacting protease, in Fas/APO-1-and TNF receptor-induced cell death[END_REF][START_REF] Srinivasula | Molecular ordering of the Fas-apoptotic pathway: the Fas/APO-1 protease Mch5 is a CrmA-inhibitable protease that activates multiple Ced-3/ICE-like cysteine proteases[END_REF][START_REF] Muzio | FLICE, a novel FADD-homologous ICE/CED-3-like protease, is recruited to the CD95 (Fas/APO-1) death--inducing signaling complex[END_REF], into a multimolecular signaling plateform named the Death-Inducing Signaling Complex (DISC; [START_REF] Kischkel | Cytotoxicity-dependent APO-1 (Fas/CD95)-associated proteins form a death-inducing signaling complex (DISC) with the receptor[END_REF]). Further activation of caspase-8 by autoproteolytic cleavage at the DISC level initiates the apoptotic signaling cascade [START_REF] Medema | FLICE is activated by association with the CD95 death-inducing signaling complex (DISC)[END_REF][START_REF] Hirata | Caspases are activated in a branched protease cascade and control distinct downstream processes in Fas-induced apoptosis[END_REF] which can either directly activate effector caspases or trigger the mitochondrial apoptosis loop amplification [START_REF] Scaffidi | Two CD95 (APO-1/Fas) signaling pathways[END_REF]. FAS-induced cell death is tightly controlled by proximal regulators, among which is c-FLIP (FLICE Inhibitory Protein), a procaspase-8-like protease deficient protein [START_REF] Goltsev | CASH, a novel caspase homologue with death effector domains[END_REF][START_REF] Han | MRIT, a novel death-effector domain-containing protein, interacts with caspases and BclXL and initiates cell death[END_REF][START_REF] Hu | I-FLICE, a novel inhibitor of tumor necrosis factor receptor-1-and CD-95-induced apoptosis[END_REF][START_REF] Inohara | CLARP, a death effector domaincontaining protein interacts with caspase-8 and regulates apoptosis[END_REF][START_REF] Irmler | Inhibition of death receptor signals by cellular FLIP[END_REF][START_REF] Shu | Casper is a FADD-and caspase-related inducer of apoptosis[END_REF][START_REF] Srinivasula | FLAME-1, a novel FADD-like anti-apoptotic molecule that regulates Fas/TNFR1-induced apoptosis[END_REF]. c-FLIP is mainly expressed as a long (c-FLIP L ) and a short (c-FLIP S ) spliced isoforms, which can be both recruited to the DISC. Similar to caspase-8, c-FLIP L consists of two amino-terminal death effector domains (DED) followed by an unfunctional caspase homology domain [START_REF] Krueger | Cellular FLICEinhibitory protein splice variants inhibit different steps of caspase-8 activation at the CD95 death-inducing signaling complex[END_REF]. To date, the role of c-FLIP L in apoptosis remains controversial. Indeed, pro-apoptotic, anti-apoptotic and proliferative functions have been reported [START_REF] Krueger | Cellular FLICEinhibitory protein splice variants inhibit different steps of caspase-8 activation at the CD95 death-inducing signaling complex[END_REF][START_REF] Chang | c-FLIP(L) is a dual function regulator for caspase-8 activation and CD95-mediated apoptosis[END_REF][START_REF] Micheau | The long form of FLIP is an activator of caspase-8 at the Fas death-inducing signaling complex[END_REF][START_REF] Boatright | Activation of caspases-8 and -10 by FLIP(L)[END_REF][START_REF] Mathas | c-FLIP mediates resistance of Hodgkin/Reed-Sternberg cells to death receptor-induced apoptosis[END_REF].

In contrast, only anti-apoptotic functions have been so far ascribed to c-FLIP S [START_REF] Krueger | Cellular FLICEinhibitory protein splice variants inhibit different steps of caspase-8 activation at the CD95 death-inducing signaling complex[END_REF].

We had previously shown that E2F1 expression is faintly detectable in human lung adenocarcinomas [START_REF] Eymin | Distinct pattern of E2F1 expression in human lung tumours: E2F1 is upregulated in small cell lung carcinoma[END_REF]. As E2F1-deficient mice develop pulmonary adenocarcinoma with a high incidence [START_REF] Field | E2F-1 functions in mice to promote apoptosis and suppress proliferation[END_REF], we had postulated that low levels of E2F1 contribute to the carcinogenesis of human lung adenocarcinomas by creating a defective response of tumor cells to apoptotic stimuli. Consistent with such hypothesis, we demonstrate that E2F1 induces apoptosis in various human lung adenocarcinoma cell lines by a mechanism involving a specific downregulation of the c-FLIPs protein, leading to the activation of caspase-8 at the DISC level. Importantly, we also provide evidence that downregulation of c-FLIPs by E2F1 restores tumor cells sensitivity to death-receptor-mediated apoptosis as well as to lymphocytes T-mediated cytotoxicity, indicating that E2F1 could regulate the cellular response to the immune system.

Results

E2F1-induced apoptosis in lung adenocarcinoma cell lines requires caspase-8 activation and an intact E2F1 DNA-binding domain

We first tested the ability of E2F1 to trigger apoptosis in A549 and H1299 human lung adenocarcinoma cell lines using transient transfection with a vector encoding wild-type E2F1.

As compared to cells transfected with a control vector, enforced E2F1 expression strongly induced apoptosis in both cell lines (Figure 1a). In order to confirm the results of transient transfections, we then established stable E2F1 or E2F1(E132) DNA-binding defective mutant inducible clones in the H358 cell line derived from a human lung adenocarcinoma, using the doxycyclin-inducible expression system (Tet-On). Of note, E2F1 expression was undetectable in H358 cells (Figure 1b, upper panel). Several stable transfectant clones were obtained and were found to give similar results. Therefore, data presented with H358/Tet-On/E2F1 clone 6 and H358/Tet-On/E2F1(E132) clone 22 are representative of all clones tested. As shown in figure 1b (upper panel), expression of E2F1 and E2F1(E132) proteins was strongly induced after 48 hours of doxycyclin treatment and persisted even after 6 days of continuous induction. In H358/Tet-On/E2F1 cells, apoptosis was clearly detected after 72 hours of doxycyclin treatment and reached 20% of total cells after 6 days (Figure 1b, lower panel). In contrast, and consistent with previous studies [START_REF] Hsieh | E2F1-induced apoptosis requires DNA binding but not transactivation and is inhibited by the retinoblastoma protein through direct interaction[END_REF][START_REF] Phillips | Induction of DNA synthesis and apoptosis are separable functions of E2F-1[END_REF], apoptosis was never observed in H358/Tet-On/E2F1(E132) cells (Figure 1b, lower panel). Appearance of apoptotic cells upon E2F1 expression correlated with the cleavage of procaspases-8 and -3 in their p43/41 and p17 active fragments respectively, followed by the activation of procaspases-6 and -7 (Figure 1c).

Interestingly and consistent with previous data [START_REF] Nahle | Direct coupling of the cell cycle and cell death machinery by E2F[END_REF], E2F1 also increased procaspase-7 expression level. Of note, activation of this proteolytic cascade was never detected following E2F1(E132) overexpression (data not shown). In order to confirm the involvement of the caspase-8 initiator and the caspase-3 effector during E2F1-mediated apoptosis, we finally tested the effect of two specific caspases-8 and -3 inhibitors, namely z-IETD-fmk and z-VED-fmk respectively. As shown in Figure 1d, both inhibitors significantly reversed the ability of E2F1 to induce apoptosis. In contrast, a specific caspase-9 inhibitor (z-LEDH-fmk) had no significant effect and the cytochrome c was never released from mitochondria in response to E2F1 expression suggesting that the mitochondrial amplification loop was not involved in our model (data not shown). Overall, these results indicate that E2F1 requires an intact DNA-binding domain and caspases-8 and -3 activities to trigger apoptosis in adenocarcinoma cell lines.

E2F1 activates caspase-8 at the DISC level

Until now, two distinct cellular models of FAS signaling pathway activation have been described. In type I cells, the death signal is initiated by the accumulation of activated caspase-8 at the DISC level. In type II cells, procaspase-8 expression level is low and the caspase cascade requires further amplification through the mitochondrial loop [START_REF] Scaffidi | Two CD95 (APO-1/Fas) signaling pathways[END_REF]. The inhibition of E2F1-dependent apoptosis by the z-IETD-fmk caspase-8 inhibitor prompted us to analyze the DISC components. We first observed that E2F1 did not affect FAS, FasL or FADD protein expression, nor increased the amount of the FAS receptor at the membrane (data not shown). Caspase-8 activation at the DISC results mainly from the binding of FasL to the FAS receptor but can also occur in the absence of FasL triggering [START_REF] Fulda | Betulinic acid triggers CD95 (APO-1/Fas)-and p53-independent apoptosis via activation of caspases in neuroectodermal tumors[END_REF][START_REF] Aragane | Ultraviolet light induces apoptosis via direct activation of CD95 (Fas/APO-1) independently of its ligand CD95L[END_REF][START_REF] Cock | The anti-cancer drug etoposide can induce caspase-8 processing and apoptosis in the absence of CD95 receptor-ligand interaction[END_REF][START_REF] Micheau | Fas ligand-independent, FADD-mediated activation of the Fas death pathway by anticancer drugs[END_REF]. To determine whether E2F1-induced cell death involved an interaction between FAS and FasL, we used the antagonistic ZB4 anti-Fas antibody which inhibits FAS/FasL binding. Our data showed that treating cells with increasing concentrations of ZB4 did not modulate the ability of E2F1 to induce apoptosis as detected by Hoechst staining (Figure 2a, left panel) or caspase-3 activation (Figure 2a, right panel). These results suggested that a FAS/FasL interaction did not play a central role in E2F1-induced apoptosis. In keeping with these data, we did not detect any FasL secretion into the culture medium, nor a modulation of FasL expression on the membrane in response to E2F1 (data not shown). In order to analyze the DISC, FAS coimmunoprecipitation experiments were performed in H358/Tet-On/E2F1 clones. E2F1 induction led to the recruitment of FADD, caspase-8 and caspase-10 at the FAS DISC (Figure 2b). Importantly, the procaspase-8 was activated as reflected by the appearance of its p43/41 active fragments in FAS co-immunoprecipitates (Figure 2b). In addition, FAS and FADD were found to co-immunoprecipitate with caspase-8 in E2F1-expressing cells when immunoprecipitation experiments were performed using an antibody against caspase-8 (data not shown). In this context, we were unable to detect FasL at the DISC that was consistent with FasL binding being not essential for FAS activation in response to E2F1. Finally, as DISC formation and caspase-8 activation stimulate the clustering of the FAS receptor at the cell surface (47), we used confocal laser scanning microscopy to further analyze the FAS receptor subcellular distribution in our cells. As expected from our co-immunoprecipitation experiments, E2F1 induced the clustering of FAS whereas E2F1(E132) did not (Figure 2c).

Overall, these results demonstrate that E2F1 activates the DISC of the FAS receptor.

E2F1 downregulates c-FLIPS protein expression to induce apoptosis

As our results indicated that E2F1 triggered cell death by affecting downstream effectors of the FAS signaling pathway, we then focused on the proximal regulators of procaspase-8 activation at the DISC level. c-FLIP (cellular FLICE-inhibitory protein) is a specific endogenous caspase-8 inhibitor [START_REF] Irmler | Inhibition of death receptor signals by cellular FLIP[END_REF]. Both c-FLIP long (c-FLIP L ) and c-FLIP short (c-FLIP S ) isoforms can be incorporated into the DISC and inhibit specific steps of caspase-8 activation [START_REF] Krueger | Cellular FLICEinhibitory protein splice variants inhibit different steps of caspase-8 activation at the CD95 death-inducing signaling complex[END_REF]. Consequently, elevated levels of c-FLIP protein protect cells from death receptor-mediated apoptosis. Interestingly, E2F1 but not E2F1(E132) induction was associated with a modest increase and a strong decrease of c-FLIP L and c-FLIPs protein levels respectively (Figure 3a). These effects correlated with the appearance of apoptosis 72 hours post-induction and persisted even after 6 days of doxycyclin treatment. Of note, E2F1 expression also stimulated the cleavage of c-FLIP L into its p43 fragment. In the context where E2F1-induced apoptosis requires the specific downregulation of c-FLIP S as suggested by our results, we postulated that ectopic expression of c-FLIP S could block E2F1-mediated programmed cell death. To test this hypothesis, H358/Tet-On/E2F1 cells were stably infected with a VSV-FLIPshort (FLIP S ) expression vector or a control mock vector. As compared to mock-infected cells, c-FLIP S -overexpressing cells were significantly more resistant to apoptosis induced by E2F1 (Figure 3b). In contrast, silencing of c-FLIPs using RNA interference in H358/Tet-On/E2F1 cells enabled a 3-fold increase in the percentage of apoptotic cells upon E2F1 expression (Figure 3c). Interestingly, this was detected after 48 hours of E2F1 induction. Taken together, these results demonstrate that c-FLIP S is a potent inhibitor of E2F1-induced apoptosis. Importantly, c-FLIPS protein expression was also specifically increased in E2F1-deficient MEFs as compared to wild-type MEFs while c-FLIP L status was not affected (Figure 3d). These results indicate that c-FLIP S is also an E2F1-target in primary cells.

Downregulation of c-flip s mRNA by E2F1 requires protein synthesis

We further investigated the molecular mechanisms involved in E2F1-mediated c-FLIP S downregulation. To this end, we used RT-PCR to analyze the effect of E2F1 on c-flip l and c-flip s mRNA levels. As shown in figure 4a, expression of E2F1 induced a specific decrease in c-flip s mRNA level which was detected upon 72 hours of doxycyclin treatment, whereas c-flip l mRNA level remained unaffected. In the same conditions, E2F1(E132) expression did not affect mRNA level of both c-flip s and c-flip l , confirming the requirement of the E2F1 DNA-binding domain to regulate c-FLIPs. Importantly, E2F1 was not able anymore to downregulate c-flip s mRNA level in the presence of cycloheximide, a protein synthesis inhibitor, indicating that de-novo protein synthesis is required for E2F1 to regulate c-flip s (Figure 4b). Of note, E2F1 expression level was not affected by the cycloheximide treatment in our conditions (data not shown).

E2F1 sensitizes NSCLC cells to death receptor mediated apoptosis

Our data demonstrated that E2F1 overexpression was sufficient to activate the FAS signaling pathway by affecting c-FLIP S expression, even in the absence of death receptor ligands. As the role of endogenous c-FLIP proteins, and more specifically of c-FLIPS, in resistance to FAS-related apoptosis had been established [START_REF] Irmler | Inhibition of death receptor signals by cellular FLIP[END_REF], we tested whether E2F1 could affect the response of lung adenocarcinoma cells to death receptor stimuli. Using transient transfections, we first demonstrated that E2F1 overexpression sensitized A549 and H1299 cells to apoptosis induced by the agonistic FAS CH11mAb as compared to control-transfected cells (Figure 5a). Same results were observed in H358/Tet-On/E2F1 clones which became sensitive to CH11 treatment in the presence of E2F1 (Figure 5b, upper). In contrast, E2F1(E132)-expressing cells remained highly resistant (Figure 5b, upper panel). Furthermore, E2F1-expressing cells were also more sensitive to FasL and TRAIL treatments as compared to uninduced or E2F1(E132)-expressing cells (Figure 5b, lower panel). Interestingly, E2F1 did not increase the cytotoxic effects of etoposide or paclitaxel (Figure 5c) indicating that E2F1 specifically sensitized H358 cells to death receptor stimuli. Importantly, these effects were not restricted to lung adenocarcinoma cell lines. Indeed, we demonstrated that E2F1-/-MEF were more resistant to FasL or TRAIL treatment than wild-type MEF (Figure 5d), although they expressed the same level of FAS and DR5 at the membrane (data not shown).

These results supported the idea that endogenous E2F1 affects the FAS death pathway downstream of the receptor level.

Neutralization of c-FLIP S restores the sensitivity of tumor cells and primary E2F1-/-

MEFs to death receptor-mediated apoptosis

Finally, we asked whether downregulation of c-FLIPs was sufficient to restore cells sensitivity to apoptosis triggered by death receptors stimuli. As shown in Figure 6a, c-flip s transfected E2F1-/-MEFs became sensitive to FasL-and TRAIL-mediated apoptosis as compared to mismatch transfected cells. These results indicated that overexpression of c-FLIPs in E2F1-deficient cells contributes to their resistance to death receptor stimuli. In the same way, neutralization of c-flip s by siRNA highly sensitized H358/Tet-On/E2F1 clones to CH11 or TRAIL treatment when compared to cells transfected with mismatch siRNA (Figure 6b). Interestingly, concomittant E2F1 induction in the same cells did not significantly potentiate the effect of c-flip s neutralization. These results indicate that E2F1 sensitizes these tumor cells to death receptor mediated apoptosis mainly through c-FLIP S downregulation.

E2F1 enhances tumor cell sensitivity to lymphocytes T-mediated cytotoxicity

FAS/FasL interactions and perforin/granzyme B pathways are the two main lytic mechanims used by cytotoxic T cells [START_REF] Kagi | Fas and perforin pathways as major mechanisms of T cell-mediated cytotoxicity[END_REF][START_REF] Lowin | Cytolytic T-cell cytotoxicity is mediated through perforin and Fas lytic pathways[END_REF]. Recent data provided evidence that an immune response might occur in NSCLCs and especially that effector T cells might contribute to tumor regression [START_REF] Mami-Chouaib | Antitumor cytotoxic T-lymphocyte response in human lung carcinoma: identification of a tumorassociated antigen[END_REF]. In addition, it was demonstrated that c-FLIP protein expression enabled tumor cells to escape from T cell immunity "in vivo" [START_REF] Djerbi | The inhibitor of death receptor signaling, FLICE-inhibitory protein defines a new class of tumor progression factors[END_REF][START_REF] Medema | Immune escape of tumors in vivo by expression of cellular FLICE-inhibitory protein[END_REF]. Since we established that E2F1 regulated the cellular response to death receptor stimuli by downregulating c-FLIP S , we next tested its ability to sensitize H358 cancer cells to cytolytic T cells. To do so, a lymphocytes T-mediated cytotoxic assay was set up in the presence of EGTA which blocks the perforin pathway. In this context, the cellular lysis is strictly dependent on a functional FAS/FasL interaction. The Jurkat T cells expressing high levels of the FAS receptor were used as positive control of effective lysis by activated T lymphocytes (Figure 7). When H358/Tet-On/E2F1 cells cultured for 72 hours in the presence or in the absence of doxycyclin were used as targets, the lysis mediated by cytotoxic T cells was significantly increased in E2F1-expressing cells as compared to uninduced cells (Figure 7). Therefore, we concluded from these data that E2F1 also enhances the response of tumor cells to the lymphocytes Tdependent cytotoxicity.

c-FLIPS is overexpressed in human lung adenocarcinomas

Finally, we investigated whether the c-FLIP S isoform is deregulated in human lung adenocarcinomas which display undetectable E2F1 protein expression [START_REF] Eymin | Distinct pattern of E2F1 expression in human lung tumours: E2F1 is upregulated in small cell lung carcinoma[END_REF]. To this end, we analyzed E2F1 and c-FLIP protein expression by western blotting on 12 tumor samples and 5 matched normal lung tissues. Representative results from 5 normal/tumor couples are presented in Figure 8 but same data were obtained in the 7 remaining tumor samples.

Consistent with our previous study [START_REF] Eymin | Distinct pattern of E2F1 expression in human lung tumours: E2F1 is upregulated in small cell lung carcinoma[END_REF], E2F1 protein expression was hardly detectable in the tumor samples. Interestingly, c-FLIP S protein expression was strongly enhanced in these samples as compared to normal lung tissues whereas c-FLIP L protein expression was not altered (Figure 8). Overall, these results show that c-FLIP S is specifically overexpressed in lung adenocarcinomas. Moreover, they provide evidence that both c-FLIP protein isoforms can be differentially expressed. Of note, as normal lung tissues do not overexpress c-FLIP S despite a low level of E2F1 expression, it is likely that additional signals cooperate with E2F1 loss to induce c-FLIP S overexpression in lung adenocarcinomas.

Discussion

A large body of evidence has established that apoptosis can occur through both intrinsic (caspase-9 mediated) and extrinsic (caspase-8 mediated) death pathways. The ability of E2F1 to promote apoptosis by activating the intrinsic pathway has been well documented, notably through transcriptional activation of apaf-1 or caspase-9 genes (for review, see [START_REF] Ginsberg | E2F1 pathways to apoptosis[END_REF]).

In contrast, the relationships between E2F1 and the extrinsic pathway have been less studied.

Here, we demonstrate that E2F1 triggers apoptosis in various human lung adenocarcinoma cell lines by a mechanism involving the transcriptional inhibition of c-flip s thus leading to the activation of caspase-8 at the DISC level. Importantly, we find that c-FLIP S protein is specifically overexpressed in lung adenocarcinoma which display a low level of E2F1 expression, and provide evidence that E2F1 restores tumor cells sensitivity to death-receptor stimuli, by downregulating c-FLIP S expression. Overall, our data identify a new mechanistic link between E2F1 and the death-receptor signaling pathway and suggest that downregulation of E2F1 expression level contributes to the immune escape of lung adenocarcinoma tumor cells.

E2F1 can induce apoptosis via several p53-dependent or -independent mechanisms, either through direct transactivation of proapoptotic genes such as p73 [START_REF] Irwin | Role for the p53 homologue p73 in E2F-1-induced apoptosis[END_REF][START_REF] Stiewe | Role of the p53-homologue p73 in E2F1-induced apoptosis[END_REF], apaf-1 (apoptosis protease-activating factor 1) [START_REF] Moroni | Apaf-1 is a transcriptional target for E2F and p53[END_REF][START_REF] Furukawa | Apaf-1 is a mediator of E2F-1-induced apoptosis[END_REF] and caspases [START_REF] Nahle | Direct coupling of the cell cycle and cell death machinery by E2F[END_REF]or transcriptional repression [START_REF] Hsieh | E2F1-induced apoptosis requires DNA binding but not transactivation and is inhibited by the retinoblastoma protein through direct interaction[END_REF][START_REF] Phillips | Induction of DNA synthesis and apoptosis are separable functions of E2F-1[END_REF]. Here, we show that E2F1 is able to induce a p53-independent apoptosis through the downregulation of the c-FLIP S anti-apoptotic protein. So far, a few studies have reported a link between E2F1 and the death-receptor signaling machinery [START_REF] Cao | The E2F-1 transcription factor promotes caspase-8 and bid expression, and enhances Fas signaling in T cells[END_REF][START_REF] Hou | Activation of the Rb/E2F1 pathway by the nonproliferative p38 MAPK during Fas (APO1/CD95)-mediated neuronal apoptosis[END_REF][START_REF] Phillips | E2F-1 potentiates cell death by blocking antiapoptotic signaling pathways[END_REF][START_REF] Wang | Regulation of Rb and E2F by signal transduction cascades: divergent effects of JNK1 and p38 kinases[END_REF][START_REF] Bi | Cleavage of E2F-1-regulating proteins and activation of E2F-1 during CD95-induced death of thymocytes[END_REF]. In this work, we found that E2F1 activates the proteolytic cleavage of caspase-8 at the DISC and induces the clustering of the FAS receptor. We also found that ZB4, an antagonistic antibody which blocks FAS/FasL interaction, does not inhibit E2F1-induced apoptosis. In addition, we were unable to detect FasL at the DISC in our co-immunoprecipitation experiments. These results suggest that FasL binding is not required for FAS activation in response to E2F1. Such model in which death receptors are activated without the need of their respective death ligand has been previously reported in a context of UVB exposure [START_REF] Aragane | Ultraviolet light induces apoptosis via direct activation of CD95 (Fas/APO-1) independently of its ligand CD95L[END_REF]. However, as E2F1-induced apoptosis was a progressive process in our model with 20% of apoptotic cells at the time of immunoprecipitation, we cannot exclude that only a small fraction of FAS molecules are clustered and activated at each time making difficult FasL detection in coimmunoprecipitation studies. More importantly, we showed that caspase-8 activation by E2F1 is specifically associated with the downregulation of c-FLIP S . Originally, c-FLIP proteins were solely considered as inhibitors of death receptor-induced apoptosis, functioning as procaspase-8 competitors for binding to FADD at the activated DISC [START_REF] Tschopp | Inhibition of fas death signals by FLIPs[END_REF][START_REF] Jiang | Induction of tumor suppression and glandular differentiation of A549 lung carcinoma cells by dominant-negative IGF-I receptor[END_REF][START_REF] Fulda | Metabolic inhibitors sensitize for CD95 (APO-1/Fas)induced apoptosis by down-regulating Fas-associated death domain-like interleukin 1converting enzyme inhibitory protein expression[END_REF]. In this context, c-FLIP S appeared to be more efficient than c-FLIP L [START_REF] Inohara | CLARP, a death effector domaincontaining protein interacts with caspase-8 and regulates apoptosis[END_REF][START_REF] Shu | Casper is a FADD-and caspase-related inducer of apoptosis[END_REF][START_REF] Thome | Viral FLICE-inhibitory proteins (FLIPs) prevent apoptosis induced by death receptors[END_REF][START_REF] Bin | The short splice form of Casper/c-FLIP is a major cellular inhibitor of TRAIL-induced apoptosis[END_REF][START_REF] Kirchhoff | TCR-mediated upregulation of c-FLIPshort correlates with resistance toward CD95-mediated apoptosis by blocking death-inducing signaling complex activity[END_REF]. Interestingly, recent works showed that recruitement of c-FLIP L to the DISC could also promote caspase-8 activation [START_REF] Chang | c-FLIP(L) is a dual function regulator for caspase-8 activation and CD95-mediated apoptosis[END_REF][START_REF] Micheau | The long form of FLIP is an activator of caspase-8 at the Fas death-inducing signaling complex[END_REF][START_REF] Boatright | Activation of caspases-8 and -10 by FLIP(L)[END_REF]. In our cells, we never detected the presence of c-FLIP L at the DISC level. Thus, it is tempting to speculate that E2F1, by altering the stoechiometry of c-FLIP S and c-FLIP L molecules, enables activation of caspase-8 at the DISC and triggers programmed cell death. However, as c-FLIP S neutralization does not induce apoptosis on its own in our cells, E2F1 probably activates other collateral signals which collaborate with the downregulation of c-FLIP S to trigger caspase-8 activation and cell death. Interestingly, it was recently shown that loss of Rb-E2F repression resulted in caspase-8 mediated apoptosis through inactivation of focal adhesion kinase [START_REF] Lieman | Loss of Rb-E2F repression results in caspase-8 mediated apoptosis through inactivation of focal adhesion kinase[END_REF].

Both c-FLIP isoforms arise from alternative splicing and until now, the molecular mechanisms controlling their relative expression remain largely unknown. It has been demonstrated that the level of cellular FLIP is regulated both at transcriptional and posttraductional levels, the latter involving the ubiquitin-proteasome pathway [START_REF] Fukazawa | Accelerated degradation of cellular FLIP protein through the ubiquitin-proteasome pathway in p53-mediated apoptosis of human cancer cells[END_REF][START_REF] Kim | An inducible pathway for degradation of FLIP protein sensitizes tumor cells to TRAIL-induced apoptosis[END_REF]. In this study, we demonstrated that E2F1 differentially affects the expression of c-FLIP S and c-FLIP L proteins in human cell lines. Furthermore, we also showed the existence of a distinct expression pattern of the two isoforms in a few samples of human lung adenocarcinoma.

Altogether, these results are consistent with the notion that c-FLIP S and c-FLIP L are differentially regulated and exhibit distinct functions. The FLIP gene was previously reported to be up-regulated by E2F1 [START_REF] Stanelle | Gene expression changes in response to E2F1 activation[END_REF]. In contrast, we found that E2F1 induces a specific decrease of c-flip s mRNA level by a mechanism requiring its DNA-binding domain indicating that E2F1 is able to regulate the expression of c-FLIP proteins in various way depending on the cellular context. As both c-FLIP S and c-FLIP L are expressed from the same promoter, our data are not consistent with a model in which E2F1 binds to the FLIP promoter and downregulates specifically c-flip s mRNA without affecting c-flip L mRNA. However, it remains possible that E2F1 binds to the FLIP promoter and recruits some specific co-factors to differentially regulate the alternative splicing of both isoforms, or affects the expression level of proteins controlling the alternative splicing of c-flip s . Alternatively, E2F1 could also specifically decrease the stability of c-flip s mRNA. We are currently testing these hypotheses. Of note, we observed that pre-treatment of cells with proteasome inhibitors did not prevent the ability of E2F1 to downregulate c-FLIP S (data not shown), indicating that additional c-FLIP S control at the protein level is not involved in our model.

We provided evidence that E2F1 sensitized primary and tumor cells to FasL-or TRAIL-mediated apoptosis. Such enhanced resistance to Fas-triggered apoptosis has been already described in E2F1-/-cerebellar granule neurons [START_REF] Hou | Activation of the Rb/E2F1 pathway by the nonproliferative p38 MAPK during Fas (APO1/CD95)-mediated neuronal apoptosis[END_REF], thymocytes (59) and lymphocytes [START_REF] Cao | The E2F-1 transcription factor promotes caspase-8 and bid expression, and enhances Fas signaling in T cells[END_REF]. Altogether, these data are consistent with E2F1 being a critical determinant of the cellular response to death-receptor activation, at least in some cellular types. In addition, this is to our knowledge the first study demonstrating the involvement of E2F1 in the cellular response to TRAIL. High c-FLIP expression has been found in many tumor cells and was correlated with resistance to CD95-and TRAIL-induced apoptosis [START_REF] Tschopp | Inhibition of fas death signals by FLIPs[END_REF]. Recently, a genetic screen identified that the c-FLIP S isoform confered resistance to TRAIL in sensitive cells [START_REF] Burns | Identification of inhibitors of TRAIL-induced death (ITIDs) in the TRAIL-sensitive colon carcinoma cell line SW480 using a genetic approach[END_REF]. Furthermore, c-FLIP S was reported to be more efficient than c-FLIP L in the inhibition of CD95-mediated apoptosis in T cells [START_REF] Schmitz | Resistance of short term activated T cells to CD95-mediated apoptosis correlates with de novo protein synthesis of c-FLIP(short)[END_REF]. Interestingly, E2F1-deficient mice accumulate mature T cells due to a defect in thymocyte apoptosis and negative selection [START_REF] Garcia | A role for E2F1 in the induction of apoptosis during thymic negative selection[END_REF][START_REF] Yamasaki | Tumor induction and tissue atrophy in mice lacking E2F-1[END_REF], a process functioning mainly through death-promoting ligands. Whether c-FLIP S is overexpressed in E2F1-/-thymocytes remains to be determined. In our model, selective neutralization of c-FLIP S by siRNA was sufficient to restore tumor cells sensitivity to both Fas-and TRAIL-mediated apoptosis and concomittant induction of E2F1 in these cells did not lead to an additive effect. Therefore, these data are in favor of E2F1 sensitizing these tumor cells to death-receptor mediated apoptosis mostly through c-FLIP S downregulation. In this setting, sensitization is likely to be mediated by a facilitated caspase-8 activation in the absence of c-FLIP S . In addition, as we demonstrate that c-flip s neutralization in E2F1-/-MEF is sufficient to restore their sensitivity to FasL and TRAIL, our results extend to non transformed cells the role of E2F1 as a determinant of cellular response to death receptormediated apoptosis through c-FLIP S regulation. The death receptor pathway represents one of the mechanisms by which immune cells kill target tumor cells. In this context, we also provided evidence that E2F1 enhanced tumor cell sensitivity to lymphocytes T-mediated cytotoxicity. Interestingly, c-FLIP expression was associated with tumor escape from T-cell immunity and enhanced tumor progression in "in vivo" experimental studies pointing to a role of FLIP as a tumor progression factor [START_REF] Djerbi | The inhibitor of death receptor signaling, FLICE-inhibitory protein defines a new class of tumor progression factors[END_REF][START_REF] Medema | Immune escape of tumors in vivo by expression of cellular FLICE-inhibitory protein[END_REF][START_REF] French | Defective death receptor signaling as a cause of tumor immune escape[END_REF].

Many tumors are resistant to Fas-and TRAIL-induced cell death. Production of decoy receptors [START_REF] Roth | Soluble decoy receptor 3 is expressed by malignant gliomas and suppresses CD95 ligand-induced apoptosis and chemotaxis[END_REF], expression of FasL to perform the so-called tumor counterattack [START_REF] Hahne | Melanoma cell expression of Fas(Apo-1/CD95) ligand: implications for tumor immune escape[END_REF], and upregulation of apoptosis inhibitors expression [START_REF] French | Defective death receptor signaling as a cause of tumor immune escape[END_REF][START_REF] Mitsiades | Activation of NF-kappaB and upregulation of intracellular anti-apoptotic proteins via the IGF-1/Akt signaling in human multiple myeloma cells: therapeutic implications[END_REF] are among the molecular mechanisms involved in this process. We previously reported the frequent decrease of FAS expression in NSCLC [START_REF] Viard-Leveugle | Frequent loss of Fas expression and function in human lung tumours with overexpression of FasL in small cell lung carcinoma[END_REF]. Importantly, it has been shown than escape from T cell-mediated immunity "in vivo" by c-FLIP overexpression was not limited to tumors with high FAS surface expression [START_REF] Medema | Immune escape of tumors in vivo by expression of cellular FLICE-inhibitory protein[END_REF]. In the light of these data, the low level of E2F1 protein expression in NSCLC with reduced FAS expression could be another way to block FAS-triggered cell death, therefore contributing to the immune escape of tumor cells. In this setting, E2F1 restoration might represent a key step in therapeutic strategies to reconstitute the ability of tumor cells to undergo apoptosis.

Materials and methods

Cell lines, expression vectors and transfection

H358, A549 and H1299 human lung carcinoma cell lines as well as Jurkat T cells were cultured in RPMI-1640 medium (GibcoBRL, Life Technologies, Cergy Pontoise, France), supplemented with 10% (v/v) heat-inactivated fetal calf serum (GibcoBRL), 2mM Lglutamine and 100U/ml penicillin/streptomycin, in 5% CO 2 at 37°C. Primary murine embryonic fibroblasts (MEF) derived from wild-type and E2F1 -/-mice (kindly gift from Dr.

Nevins), 293-FasL embryonic kidney cells stably expressing human Fas ligand and HT29 colon cancer cells were maintained in DMEM (GibcoBRL) supplemented with 10% (v/v) heat-inactivated fetal calf serum and 2mM L-glutamine. To ensure exponential growth, cells were resuspended in fresh medium 24 hours before transfection or treatment. Stable inducible E2F1 (wild-type) or E2F1(132) (DNA-binding defective mutant) clones derived from H358 cells were obtained using a modified tetracyclin-regulated inducible expression system (Tet-On System, Clontech, Ozyme, Saint Quentin en Yvelines, France) as previously described [START_REF] Eymin | p14ARF induces G2 arrest and apoptosis independently of p53 leading to regression of tumours established in nude mice[END_REF]. E2F1 expression was induced upon 1µg/ml doxycyclin treatment. Inducible clones stably infected with either VSV-FLIP S expression vector or with a mock vector were provided by O. Micheau (INSERM U517, Dijon, France). Transient transfections of A549 and H1299 cells with either control pcDNA3.1/GFP or pcDNA3.1/E2F1 expression vectors were carried out using JetPEI™ (Polyplus Transfection, Illkirch, France) according to the manufacturer's protocol. In some experiments, geniticin (800 µg/ml) was added to the culture medium 48 hours after transfection and selection was performed during 3 additional days before analysis.

Tissue samples

Tissue samples taken at surgical resection of lung tumors were immediately frozen and kept at -80°C until use. They consisted of 12 adenocarcinoma according to the 1999 WHO international histological classification of lung tumors and 5 matched normal lung samples.

Reagents and antibodies

Agonistic anti-human Fas monoclonal antibody (clone CH-11) and caspase inhibitors z-IETD-fmk, z-DEVD-fmk and Z-LEDH-fmk were obtained from MBL (MBL, France Biochem, Meudon). For each experiment, caspase inhibitors (2 µM) were added to the culture medium 2 hours prior addition of doxycyclin (1µg/ml). Treatment with CH-11 mAb (250ng/ml) was carried out for 48 hours. Soluble Fas ligand was collected from 293-FasL supernatant. Recombinant soluble human FLAG-tagged FasL, Flag-tagged TRAIL and their enhancer were purchased from Alexis (San Diego, CA, USA). Etoposide (VP16), paclitaxel (Taxol™) and cycloheximide were obtained from Sigma (Saint Quentin Fallavier, France).

Cycloheximide was used at 10µg/ml for 12 hours.

Monoclonal antibodies used included anti-procaspase-8 (5F7), anti-procaspase-10 (4C1) and anti-Fas (ZB4) (MBL), anti-FADD (1F7), anti-FasL (G247-4), anti-procaspase-6 and anti-E2F1(KH95) (Pharmingen BD, San Diego, CA, USA), anti-HSP 70 (Affinity Bioreagents, Golden, CO, USA), anti-actin (Santa Cruz, CA, USA), anti-E2F1(Ab4; Neomarkers, CA, USA), anti-Fas (APO-1 and 3D5) and anti-FLIP (NF6) (Alexis). To block FasL/Fas interaction, anti-Fas (ZB4) was used at concentrations ranging from 2 to 30 µg/ml.

Polyclonal antibodies used included anti-mouse TRAIL-R2 (R&D Systems), anti-procaspase-3 and anti-active caspase 3 (Pharmingen BD), anti-procaspase-7 (Cell Signaling, Beverly, MA, USA), anti-procaspase-8 (C-20, Santa Cruz), anti-procaspase-10 (Sigma), anti-E2F1 (Santa Cruz Biotechnology) and anti-FLIP (H-202, Santa Cruz Biotechnology).

Cell viability, apoptotic and cytotoxic assays

Apoptosis was evaluated by scoring the percentage of apoptotic cells on 500 cells after Hoescht 33342 staining. Cytotoxic experiments were performed using the methylene blue colorimetric assay. Briefly, stable inducible clones were seeded at 10 4 cells/well into a 96wells plate and were co-treated for 96 hours with increasing concentrations of cytotoxic drugs in the presence or absence of doxycyclin. Cells were then fixed in 100% ethanol, stained with 1% methylene blue in 0.01M borate buffer pH 8.5 for 15 min and optical density was measured at 630nm after elution in 0.1N HCl. Absorbance values were expressed as a percentage of untreated controls. Allogenic T cells cytotoxic assays against tumor target cells were measured in standard 24 hours 51 Cr-release assays as previously described [START_REF] Plumas | induces apoptosis in lung adenocarcinoma cells through a caspase-8-and DNA-binding domain-dependent mechanism. (a) A549 and H1299 cell lines were transfected either with a control pcDNA3.1/GFP (open bars) or a pcDNA3.1/E2F1[END_REF]. Briefly, 104 51 Cr-labeled target cells were mixed with the effector cells at different E/T ratios (25/1 to1/1) with E=effector cells and T=target cells. The radioactivity in supernatants was counted after 24 hours incubation at 37°C in 5% CO2. The percentage of specific lysis was calculated according to the following formula :% lysis = 100X (ER -SR)/(MR -SR), where ER, SR and MR represent experimental, spontaneous, and maximum 51 Cr-release, respectively. All expressed values were derived from average quadruplicate determinations. Effector allogenic T cells were obtained from unidirectional mixed lymphocyte reaction (MLR) as previously described. To induce FasL expression at the cell surface, effector cells were preincubated for 2 hours with a mixture of 5ng/ml phorbol 12-myristate 13-acetate (PMA, Sigma) and 1.5µg/ml Ca2+ ionophore ionomycin (Sigma). Cytotoxic tests were performed on E2F1 stable inducible clones which were pretreated or not with doxycyclin for 72 hours, then used as target cells in complete medium supplemented with 15% human A serum in the presence or absence of 3mM EGTA/4mM Mg 2+ . Jurkat T cells treated in the same conditions were used as positive control target cells.

Western Blot and immunoprecipitation analyses

For immunoblotting, cells washed three times in PBS or frozen tissue samples were lysed in RIPA buffer (150mM NaCl, 50mM Tris HCl pH 8, 0.1% SDS, 1% Nonidet P40, 0.5% Na deoxycholate, 0.1mM PMSF, 2.5µg/ml pepstatin, 10µg/ml aprotinin, 5µg/ml leupeptin, 0.2mM Na 3 VO 4 ) for 30 min on ice and pelleted. Protein concentration was determined using the Biorad Dc protein assay. Proteins (40µg-80µg) were then separated in 10-12% SDS-PAGE gels and electroblotted onto PVDF membranes. Membranes were incubated overnight at +4°C with primary antibodies and proteins were detected using horseradish peroxidase-conjugated goat anti-mouse or anti-rabbit antibodies (Jackson Immunoresearch Laboratories, West Grove, PA, USA). After washing, the blots were revealed using the ECL chemiluminescence method (Amersham, Les Ulis, France), according to the manufacturer's protocol.

For DISC immunoprecipitation, 50x10 6 cells were lysed in lysis buffer (20mM Tris-HCl pH 7.4, 150mM NaCl, 1% NP40, 2mM sodium vanadate, 1mM AEBSF and 10µg/ml aprotinin) for 15 min on ice and supernatants were collected by centrifugation at 12000 rpm for 15 min. Supernatants were precleared with Sepharose 6B (Sigma) for 1 hour at +4°C and immunoprecipitation of the FAS receptor was further performed overnight at +4°C on precleared lysates in presence of protein G sepharose and 2µg of FLAG-tagged-Fc-FasL (provided by Olivier Micheau). Protein G sepharose beads were spun down, washed 4 times with lysis buffer, resuspended in SDS gel sample buffer and boiled at 95°C for 4 min.

Immunoprecipitates were separated in 12% SDS/PAGE gel and immunoblotted with either anti-Fas (C-20, Santa-Cruz), anti-FADD (1F7, mouse IgG1, Immunotech), anti-caspase-8 (5F7, mouse IgG2b, Immunotech) or anti-caspase-10 (4C1, mouse IgG1, MBL) antibodies.

Secondary antibodies used were anti-mouse HRP-IgG1 (Southern Biotechnology) to detect FADD and caspase-10, anti-mouse HRP-IgG2b (Southern Biotechnology) to detect caspase-8 or anti-rabbit HRP to detect Fas (C-20).

Indirect immunofluorescence and Fas clustering studies

Transfected A549 and H1299 cells were fixed in -20°C acetone for 5 min. After extended washes, non specific binding sites were saturated for 45 min at RT in 2% BSA, 10% normal goat serum, 1X PBS and incubation with anti-E2F1 mAb (Ab4, 1/2000) was carried out for 2 hours at RT in PBS, 2% BSA. After three PBS washes, Alexa TM 568 goat antimouse IgG (H+L) conjugate (2mg/ml, 1/1000, Interchim Montluçon, France) was added and cells were further incubated for 30 min in dark at 37°C. Cells were then washed three times in PBS, counterstained with Hoescht 33342 and observed using an Olympus microscope. For Fas clustering analysis, 10 4 H358 stable inducible cells were seeded onto immunofluorescence slides and cultured in the presence or in the absence of doxycyclin for 6 days. Cells were then fixed in 3% paraformaldehyde/PBS for 10 min, washed twice with PBS for 10 min, preincubated with 1% BSA for 15 min, and incubated for 2 hours at RT with anti-Fas mAb (Zb4) in 1% BSA, PBS. Samples were washed twice in PBS and stained using the Alexa TM 568 goat anti-mouse IgG(H+L) conjugate. Cells were visualized using a confocal laser (Spectra Physics) microscope (Zeiss, LSM510). For all experiments, a nonrelevant isotype matching antibody was used as a negative control (data not shown). HT29 colon cancer cells treated with 25 ng/ml soluble FasL (Alexis Biochemical) were used as a positive control of FAS clustering.

Transfection of siRNA oligonucleotides

The siRNA oligonucleotides were synthesized by Eurogentec and resuspended according to the manufactuter's protocol (Eurogentec, Seraing, Belgium). The sequence designed to target specifically human flip short mRNA was as follow:

3 '

 3 5'-CACCCUAUGCCCAUUGUCCTT-3'. The sequence designed to target specifically the mouse flip short mRNA was as follow: 5-CCAGUGUAUGGAGUACCAGTT-3for mouse cells. For siRNA transfection, stable E2F1inducibles clones or E2F1-/-MEFs were seeded into a 6-well plate at 5x10 5 or 2x105 cells/well respectively. On the next day, the cells were transfected with siRNA oligonucleotides duplex using Oligofectamine™ (Invitrogen, Cergy Pontoise, France) according to the manufacturer's instructions. Briefly, 10µl of siRNA duplex (at 20µM) were mixed with 185µl of serum-free RPMI/DMEM medium. 3µl of Oligofectamine ™ was added to 12µl of RPMI/DMEM serum-free medium, vortexed, incubated at RT for 10 min and gently mixed with the siRNA duplex solution. Mixture was incubated for 20 min at RT and added to each well. 10% fetal calf serum was added 4 hours after transfection. Doxycyclin was added or not in culture medium 24 hours after transfection and cells were cultured additionally for 48 hours before analysis. In some experiments, stable inducible clones were transfected for 43 hours, then treated during 5 additional hours with either 500ng/ml anti-Fas agonistic CH11 mAb or 100ng/ml TRAIL before analysis. E2F1-/-MEFs were transfected for 50 hours with c-flip s or mismatch siRNA then treated for 20 additional hours with either 25ng/ml FasL in the presence of 1µg/ml enhancer or 40ng/ml KillerTRAIL TM (Alexis Biochemical).Reverse transcription-polymerase chain reaction (RT-PCR)Total cellular RNAs were isolated using Trizol reagent (Invitrogen). One µg of total RNA was subjected to RT in a 20 µl reaction volume using oligo(dT) primer and M-MLV reverse transcriptase (Invitrogen) according to the manufacturer's protocol. Three µl of the RT reaction was then amplified by PCR for 30 cycles using the following conditions: 94°C for 30 sec ; 58°C for 1 min and 72°C for 2 min. The primers used were: flip short forward (sense): 5'-CGAGGCAAGATAAGCAAGGA-3'; flip short reverse (antisense): 5. Amplification of a fragment of the cDNA of G3PDH (Invitrogen) was performed in the same PCR reaction as internal control. PCR products were run on a 2% agarose gel and visualized by ethidium bromide staining.Statistical analysesQuantitative experiments were analysed by the use of Student's paired t test (* p<0.05; ** p<0.01; *** p<0.001). three independent experiments. (c) Western blot analysis of caspases in H358/Tet-On/E2F1 cells cultured in the presence (Dox +) or in the absence (Dox -) of doxycyclin for indicated times. HSP 70 was used as a loading control. (d) H358/Tet-On/E2F1 cells were pre-treated or not for two hours with 2 µM of either z-VED-fmk or z-IETD-fmk, then 1 µg/ml doxycyclin was added (Dox +) or not (Dox -) in the culture medium and cells were further cultured for 6 days. Percentage of apoptotic cells was scored on 500 cells after Hoescht staining. Results are the mean ± SD. of three independent experiments. *: p<0.05; *** p<0.001 by Student's t test.

Figure 2 :

 2 Figure 2: E2F1 activates caspase-8 at the DISC level

Figure 3 :

 3 Figure 3: The short isoform of c-FLIP is a downstream target of E2F1

Figure 4 :

 4 Figure 4: E2F1 specifically downregulates c-flip s mRNA

Figure 5 :

 5 Figure 5: E2F1 sensitizes NSCLC cells to death receptor-mediated apoptosis

Figure 6 :

 6 Figure 6: Downregulation of c-FLIP S is sufficient to restore tumor cells and primary

Figure 7 :

 7 Figure 7: E2F1 enhances tumor cells sensitivity to lymphocyte T-dependent cytotoxicityT cell-dependent cytotoxicity was measured in the presence of EGTA using a 24 hours51 Cr-

Figure 8 :

 8 Figure 8: Western blot analysis of E2F1 and c-FLIP expression in human lung

Acknowledgements

We thank Dr. K. Helin and Dr. J. Nevins for providing plasmids and cells. We also thank Dr. Alicia Lajmanovitch (INSERM, EMI353) for hepful discussions. This work was supported by a grant to E.B. from La Ligue Nationale Contre le Cancer as an «équipe labellisée» and by the Region Rhône Alpes (Thématique prioritaire cancer and Canceropole 2003: Oncocell, Epimed and INACancer). C.S. was supported by a "poste accueil" INSERM. We thank Celine Lampreia and Pascal Perron for technical assistance.


Laurent Evrard
email: laurent.evrard@unamur.be

Jérôme Franc
email: jerome.francois@inria.fr

Jean-Noël Colin
email: jean-noel.colin@unamur.be

Attacker Behavior-Based Metric for Security Monitoring Applied to Darknet Analysis

Network traffic monitoring is primordial for network operations and management for many purposes such as Quality-of-Service or security. One major difficulty when dealing with network traffic data (packets, flows...) is the poor semantic of individual attributes (number of bytes, packets, IP addresses, protocol, TCP/UDP port number...). Many attributes can be represented as numerical values but cannot be mapped to a meaningful metric space. Most notably are application port numbers. They are numerical but comparing them as integers is meaningless. In this paper, we propose a fine grained attacker behavior-based network port similarity metric allowing traffic analysis to take into account semantic relations between port numbers. The behavior of attackers is derived from passive observation of a Darknet or telescope, aggregated in a graph model, from which a semantic dissimilarity function is defined. We demonstrate the veracity of this function with real world network data in order to pro-actively block 99% of TCP scans.

I. INTRODUCTION TCP and UDP are major transport protocols in Internet.

Port numbers allow the end-hosts to de-multiplex flows and forward them to the right sockets and so services. Being encoded in 16 bits, there are 65,536 possible ports for each TCP and UDP. There are different segments: system or wellknown ports (0-1023), reserved ports for specific applications or vendors (1024-49151) and dynamic ports (49152-65535). Although the dynamic ports are mainly used as ephemeral ports, such as source ports when establishing a connection, other ports are associated to a special use, i.e. service. Their numbering is managed by the Internet Assigned Numbers Authority (IANA). Even if this does not prevent any user to use a registered port for any usage, using assigned port numbers eases access to the service. In addition, some ports are often diverted from their normal usage, such as 443 originally reserved for HTTPS but often used by VPN services to avoid filtering.

Therefore, port numbers are representative of the provided services. They are valuable source of information for managing and operating a network as for instance to perform traffic engineering for QoS purposes or to detect anomalies [START_REF] Kim | A flow-based method for abnormal network traffic detection[END_REF]. In many cases, in particular for security purposes, packets or flows need to be compared for supporting machine learning or data-ming algorithms. For example, Netflow records can be analyzed to detect anomalies [START_REF] Sheikhan | Flow-based anomaly detection in high-speed links using modified gsa-optimized neural network[END_REF] but all data to handle cannot be represented in a metric space to be easily compared. While using longest common prefixes can partially solve the problem with IP addresses [START_REF] Dolberg | Efficient Multidimensional Aggregation for Large Scale Monitoring[END_REF], it remains for port numbers. Considering only the three possible ranges is an option [START_REF] Coull | On measuring the similarity of network hosts: Pitfalls, new metrics, and empirical analyses[END_REF] but results in a too large granularity.

In this paper, we propose an automated fine-grained approach to catch simultaneously two types of similarities between port numbers:

• Service-semantic similarity: this represents port numbers supporting services being considered of the same type.

For instance, TCP ports 80 and 443 are semantically close to each other (Web). However, TCP ports 443 and 22 are also close semantically because they provide a secure connection.

• Context-semantic similarity: this abstracts the relations between ports which are often present together (on the same machine or more generally in a close vicinity, e.g. same subnetwork). As an example, an medium-scale enterprise network often provides a web and email server.

It is worth to mention that two ports can be similar on both perspective, e.g. 443 and 80, both for web services and usually co-located on the same server. In a preamble of an attack, port scanning is often performed to find open ports. In order to remain undetected, attackers may prefer to target particular ports than using massive scans. The selection of these ports is not random and follows a certain logic. Actually this logic can be guided by the same semantics. Some attackers may look for a particular service type. In another case, an attacker finding the port 80 open may try the 443 as many web services supports both HTTP and HTTPS. As a result, observing the port scan strategies performed by the attackers is helpful to derive the semantic between port numbers. It can then be used than for further analysis, such as traffic classification or network security monitoring. Three contributions are presented in this paper. Firstly, major trends on port scanning are highlighted from a 40 weeks long darknet network dataset. It results in the clear observations of relationships among targeted ports. Secondly, this motivates and guides the definition of a metric that is defined in order to catch both types of similarities (service-and context-semantic) in a single value. Using graph-based formalism proposed in a previous work [START_REF] Lagraa | Knowledge discovery of port scans from darknet[END_REF], we propose and evaluate a definition of the metric. Finally, our third contribution leverages our metric to preventively block an attacker scanning ports by predicting the next targeted ports.

The remaining of the paper is structured as follows : Section II presents related works. Section III introduces our attacker-based semantic port similarity. Section IV details observations from our darknet. Our proposed metric is then evaluated in Section V and to real world internet traffic use case in Section VI. Section VII finally gives the conclusion with possible future work.

II. RELATED WORK

TCP/UDP ports used by applications is a very accessible information when performing traffic monitoring. It is worth noting that some researchers like in [START_REF] Nguyen | A survey of techniques for internet traffic classification using machine learning[END_REF] question the use of the latter in machine learning methods because of the versatility of this information. In 2005, the authors already show that 70% can be properly classified based on official port numbering [START_REF] Moore | Toward the accurate identification of network applications[END_REF]. Nowadays, traffic classification is even facing new challenges with encrypted traffic [START_REF] Velan | A survey of methods for encrypted traffic classification and analysis[END_REF]. However, in many cases, port numbers brings valuable information about type of potential services use or targeted by attackers. We have shown that there are particular relationships between sequences of scanned ports [START_REF] Lagraa | Knowledge discovery of port scans from darknet[END_REF]. Actually, the weakness of using port numbers with advanced methods such as machine learning algorithms is the lack of a proper metric to apprehend the similarity or dissimilarity between them since they are not embedded in a metric space. Many traffic analysis techniques rely thus on other features [START_REF] Michael | Network traffic classification via neural networks[END_REF] or simply consider if port numbers are equal or not [START_REF] Donato | Traffic identification engine: an open platform for traffic classification[END_REF], [START_REF] Zhang | Robust network traffic classification[END_REF]. Few efforts have been achieved to enhance port numbers comparison [START_REF] Coull | On measuring the similarity of network hosts: Pitfalls, new metrics, and empirical analyses[END_REF], [START_REF] Grimaudo | Select: Selflearning classifier for internet traffic[END_REF]. In [START_REF] Grimaudo | Select: Selflearning classifier for internet traffic[END_REF], the aim is to group TCP flows in order to identify a dominant port per group if it exists. In [START_REF] Coull | On measuring the similarity of network hosts: Pitfalls, new metrics, and empirical analyses[END_REF], port numbers are compared accordingly to the ranges they belong to (registered, well-known or dynamic). We propose to go further by deriving a single distance returning a result for any couple of TCP ports.

Our similarity measure relies on knowledge indirectly embedded in attacker activities, especially TCP scans. Some surveys like [START_REF] Bhuyan | Surveying port scans and their detection methodologies[END_REF], [START_REF] Lee | Detection and characterization of port scan attacks[END_REF] show that big scanning campaigns become more frequent and can be based on very efficient tools like ZMAP [START_REF] Durumeric | Zmap: Fast internetwide scanning and its security applications[END_REF]. Collecting scanning activities is thus a rich source information but necessitates a mining approach to extract synthetic knowledge like our proposed similarity measure. Darknets have been proved to be efficient to monitor large scale attacker activities such as scans or DDoS (Distributed Denial-of-Service) attacks [START_REF] Coudriau | Topological Analysis and Visualisation of Network Monitoring Data: Darknet case study[END_REF]. Many of existing works focus on analyzing and describing observations made through the darknet [START_REF] Fachkha | Darknet as a source of cyber intelligence: Survey, taxonomy, and characterization[END_REF], [START_REF] Balkanli | Supervised learning to detect ddos attacks[END_REF]. This paper proposes to build a similarity function based on those observations to be applied for real time security monitoring in another environnement. In particular, we show the viability of our technique to proactively block future TCP scans. It is complementary to many existing techniques dealing with reactive detection of scans [START_REF] Mell | Limitations to threshold random walk scan detection and mitigating enhancements[END_REF]- [START_REF]Fast portscan detection using sequential hypothesis testing[END_REF].

III. ATTACKER BEHAVIOR-BASED INTER-PORT MEASURE

A. Rationale

When performing an attack, the first stage usually consists in identifying the potential target. Discovering accessible machines and services often relies on IP sweeping and/or scanning TCP and UDP ports [START_REF] Chen | A study on advanced persistent threats[END_REF]. Naive approach testing all ports numbers and all IP addresses of a targeted subnetwork Fig. 1: Methodology overview is time-consuming and has a large footprint, which can be easily detected. However, smarter attackers would look for specific ports to search for particular services with potential vulnerabilities. For example, if she looks for web servers, TCP/443, TCP/80, TCP/8080 will be targeted in priority and can reveal a service-semantic similarity. Similarly, attackers may target a particular type of environment with various services close from a context-semantic point of view. For example, a web service relies usually on a web server and on database. So both of them are regularly co-located in a close network vicinity, even in the same host. In that sense, we provide some observations in a previous work [START_REF] Lagraa | Knowledge discovery of port scans from darknet[END_REF], which confirms this intuition.

We propose to aggregate, from the massive observation of a darknet, such a knowledge into a single similarity metric designed to catch both behaviors: the attackers looking for a particular type of service (service-semantic) and the attackers looking for services which are usually co-located together (context-semantic). We so assume the co-existence of these behaviors in scanning strategies of the attackers. Whereas this could be intuitively admitted, the detailed measurement results provided in section IV confirms it.

B. Methodology

Our rationale is to extract similarities between port numbers by observing attacker behaviors, i.e. ports targeted by the same attacker in vantage points. More especially, we use a darknet or network telescope that silently collects unsolicited traffic including TCP scans on a non active subnetwork. Indeed, an entire and never used IPv4 subnetwork acts as a black hole collecting all incoming packets, including some related to scans. It is possible to derive a similarity from the distance between two ports targeted in a sequence by an attacker but this does not lead to good results in preliminary experiments. Intuitively, a set of semantically close port numbers (either by context or by services) may not have been massively observed integrally (in a single sequence) but rather through multiple overlapping sequences.

All sequences must be aggregated together in a unique representation. In addition, even ports that are supposed to be similar are not targeted in the same order each time by the different attackers. No global order should be constructed. We thus transform successively probed ports (sequences) by attackers into a unique graph.

Figure 1 illustrates the whole process to infer the similarity between port numbers: 1) Multiple attacker behaviors, e.g. scanned ports, are collected. In order to avoid a bias, it is required to collect such behavior in a massive scale. In our case, we use a darknet or telescope (see section IV). 2) Scan extraction: since collected data can embed some noise, filtering is necessary and directly dependent on the collecting process. For example, big vertical scans running on all ports do not contain a valuable semantic and should then be discarded. 3) Graph building: the graph of scans is created from the filtered data. The nodes represent port numbers and the directed edge between two ports means that they have been probed sequentially at least once. 4) Similarity: a similarity measure between two port numbers is derived from the shortest path between them.

WHile this method can be applied for both TCP and UDP, the remaining of the paper is focused on TCP ports. The main difference would be the scan extraction.

C. Extraction of network scans

Massive scan can happen on a very wide range of ports (sometimes all) that are not especially semantically connected (vertical scans). The same applies for horizontal scan targeting the same port (or a few of them) on numerous hosts.

Such scans are out of our interest to catch a supposed strategy in selecting ports by attackers. Our dataset is precisely described in section IV but Figure 2 represents the cumulative distribution of IP addresses per number of scanned TCP ports within a week. Our analysis is restricted to TCP SYN scans since they can be easily isolated. This figure highlights that most IP addresses (72%) are scanned with a limited number (less than 30) selected port numbers during a week and the cumulative sum is then more stable. The long tail of the curve, here limited up to 75 (99.5%), represents so the vertical scan. A very wide number of IP addresses have less than 3 ports Therefore, data is filtered according to these observations by discarding network traffic related to vertical (same IP address probed with more than 30 ports) and horizontal scans (an IP addressed probed with less than 3 ports).

D. Graph-based port sequence model

The graph model is built from the method described in [START_REF] Lagraa | Knowledge discovery of port scans from darknet[END_REF], that has highlighted semantic relationships between port numbers. This graph representation allows us to represent a very large dataset of scans thanks to a well defined an summarized structure. A scan graph is a directed weighted graph G = (N, E, ω) with: N The set of nodes of the graph. Each of them represents a unique TCP port.

E

The set of edges of the graph. The existence of an edge e i,j from port p i to p j shows that port p j has been probed just after p i on the same destination IP address and from the the same source IP address (representing the source of the scan). ω is a weight function for edges defined as ω(e i,j ), the number of times that p j has followed p i in all scan sequences.

E. Shortest path based inter-port similarity

The defined graph intuitively contains the desired semantic. If two ports are connected by an edge with a high weight, they have been probed a lot of time successively. By generalization, the graph also contains ports that are near each other by transitivity. For example, if scans go repeatedly from 80 to 443 and from 443 to 3306 (MySQL), the graph contains a transitive link between ports 80 and 3306 and reveals thus a semantic similarity between these ports, but lower than between 80 and 443 (connected by a direct edge).

The intuition of this semantic is to swap (or invert) the weight of edges in the graph to reduce the shortest path length between ports which are regularly scanned in a same sequence (i.e. those connected together with heavy weights). Then, Fig. 3: Edges weights boxplot shortest paths sp(n i , n j ) between pair of nodes n i and n j (port numbers) are computed. sp(n i , n j ) is the smallest sequence of edges from source n i to destination n j according to the inverted weights. The length l(sp(n i , n j )) of this shortest path is then used as a dissimilarity measure between the two ports, i and j, represented by the nodes n i and n j respectively. It is denoted as d sp :

d sp (i, j) = l(s) = ∀ei,j ∈s ω (e i,j ), s = sp(n i , n j ) (1)
Finding shortest paths in a graph is a common problem. Methods, like the Dijkstra algorithm, are well defined. The main challenge resides in defining a correct rescaling and swapping method for edge weight, i.e. deriving ω (e i,j ) from ω(e i,j ) to make closer nodes linked with heavy weighted edges. In the original graph, the weight of an edge represents the number of times a transition occurs between two ports. For the sake of clarity, we will simplify ω(e i,j ) weights notation to ω i,j .

The distribution of edges weight, θ, in the graph is given in Figure 3 based on our dataset described in section IV. In this figure, we can observe an unbalanced distribution with most of the values concentrated between Q 1 = 299 and Q 3 = 4082 (θ inter-quartiles range -IQR). Therefore, data needs to be rescaled. Due to the occurrence of outliers, we have chosen to use the IQR as a basis for rescaling as follows:

ω iqr i,j = ω i,j -Q 1 (θ) Q 3 (θ) -Q 1 (θ) , θ = {ω i,j ∀i, j}
Actually, the IQR-based rescaling method relies on data distribution instead of values and allows spread the most represented values on a larger range. Becasue rescaled values originally below Q 1 become negative, we shift rescaled data to positive values by deducing the minimal value, ω iqr i,j -λ with λ = min i,j ({ω iqr i,j }). Finally, weights can be swapped regarding the maximum value (which is also shifted):

ω i,j = (max i,j ({ω iqr i,j }) -λ) -(ω iqr i,j -λ)
This data-driven scaling and swapping technique avoids to use arbitrary factor when inverting the edges weights.

IV. DARKNET OVERVIEW

A darknet also known network telescope or Internet blackhole is an entire reachable subnetwork collecting all incoming traffic with no active hosts and so neither sending any packets nor services being responsive to any request. It has been proved to contain valuable information to understand major security threats like DDoS attacks and scanning activities [START_REF] Fachkha | Darknet as a source of cyber intelligence: Survey, taxonomy, and characterization[END_REF]. A. Datasets and pre-processing

Two darknets are used in this paper over 40 weeks of observations. The first one (FR), in France with a dedicated /20 subnetwork. The second one (JP) is a /20 subnetwork in Japan. Using both datasets will strengthen our evaluation, especially to assess if there are dependencies between locations. General statistics are provided in Table I. It shows that Japanese darknet attracts more traffic than French one but from less attackers meaning that people attacking Japanese darknet use significantly more packets in their scan probes.

In next sections, detailed statistics about observed port scans are provided to understand the behavior of attackers during scan campaigns. Except when mentioned, all statistics given in the next sections are presented over a joint dataset by merging the JP and FR scans.

B. Number of scans

Assuming the number of observed scans, Figure 4 shows no explicit correlation between the day of the week and the number of scans. However, we can notice that the number of scans a day is always between around 9 million and 17 million. Moreover, on Saturday, less variations are observed.

In Figure 5, we evaluate the number of times an attacker (identified by the source IP address) targets the same port on the same destination IP address within the same day. Such a value is actually very high. Once a scan detected, an efficient preemptive blocking technique should always block the associated port as it will be undoubtedly targeted again by the attacker.

C. Number of distinct targeted ports in scans

Our datasets reveal that all TCP ports are targeted within a week. In fact, even a single vertical scans can lead to such a situation. With a more fine-grained focus, in Figure 6, the curve entitled distinct destination ports depicts the average number of targeted ports per destination IP address of the darknet.

This number is around 350 that is relatively low compared to the to the 65.536 available TCP ports. More precisely, 90% of IP addresses are scanned on less than 900 ports a week (with a mean around 400 ports) as highlighted in the same figure. Hence, scans target selected ports and the probing strategy is not random, that validates our main assumption for our work. Moreover, Figure 6 also presents the average number of new ports scanned per destination IP address each week. Compared to the previous curve, the dynamic is the same with a very similar shift along the weeks. There is so a similar number of new port numbers targeted every week. Intuitively, the targets of attacks may be motivated by the apparition of newly discovered vulnerabilities in devices and services. Our observation confirms this intuition and quantifies it. Besides, modeling the attacker behavior has to be done over long periods and need to be reassessed regularly in order to update the graph model that serves as inferring the similarity metric between ports. This would avoid to only catch ephemeral behaviors.

D. Inter-scan time

Another question regarding the scanning behavior is the vivacity of a TCP port scan denoted as the inter-scan time. It is the average elapsed time between consecutive probed ports in the darknet. This gives an insight revealing if attackers prefer to use long stealthy or short scans. It also helps to fine-tune our proactive scan blocking technique (in Section VI in regards to the period of time an IP address should be filtered.

In Figure 7, we compute the inter-scan time over the FR and JP dataset on a weekly basis. The median is around 10ms, so Fig. 8: IQR distribution for pairwise (source and destination IP address) inter-scan time the darknet receives an average of 100 scans probes by seconds but the frequency of probing packet tends to increase over the weeks. Proactive blocking is helpful to reduce the footprint of network scans and also by nature blocks the attacker in gathering information for crafting future attacks.

The inter-scan is computed considering both source and destination IP addresses (pair-wise) before being averaged in Figure 8. The goal is to isolate the behavior of a single scan. In this case, median time is around 100 seconds between scans.

In a nutshell, we conclude that scans are constantly observed with an increasing frequency over the months as we expected. Furthermore, in many cases, a single source IP address targets few ports with some delays in probes in order to evade detection techniques.

V. EVALUATION

In order to assess the veracity of our proposed similarity and because no grountruth actually exists, we first extract the smallest dissimilarities, which are thus representative of the most semantically-linked port numbers. We only represent the 60 smallest values as annotated edges between ports in Figure 9. We clearly distinguish the smallest dissimilarities (in bold), and so higher similarity, between HTTP-related ports: 80 (HTTP), 443 (HTTPS) and 8080 (Alternative HTTP). Moreover, these ports are also connected to email services ports. This is also relevant as an email server is frequently used by web services for instance (to send notifications). FTP port is also very close to web ports. Indeed, FTP was largely used in the past for updating web pages (especially personal home pages). Other connections like between ports 22 and 3389 are logic because they are related to standard services (SSH and remote desktop) to open session on remote computers. This shows an ability of this semantic similarity to extract and represent several type of semantics between network ports.

VI. PREVENTIVE PORT BLOCKING

In this section, we present an application of the attacker behavior-based similarity to demonstrate its validity in a realistic scenario.

Assuming a probed port is detected with a regular method such as those deployed in intrusion detection system (e.g. based on the number or ratio of TCP connection requests to closed ports), our preventive port blocking aims to predict next port numbers that will be probed to discard the traffic accordingly in advance. It may be thus part of an Intrusion Prevention System (IPS). It is worth to note that existing detection methods are able to detect scans after 4 or 5 attemps [START_REF]Fast portscan detection using sequential hypothesis testing[END_REF].

A very restrictive technique could fully blacklist an IP address performing a scan but our approach is more finegrained by blacklisting selected ports only. This avoids collateral effects when an IP address is shared by multiple users, for instance with NAT or virtual machines on the same host.

Because probing or scanning is an initial step to discover reachable hosts and services, defeating it reduce the attacker visibility and so limits her ability to craft a very tailored attack.

Assuming an IP address detected as performing a scan towards a given port number, our method proactively block the ingoing traffic from this IP address towards the K nearest ports for a user-defined period of time. For instance, when a scan happens on port 80 (HTTP) our method will filter traffic towards 443 and 8080 assuming K = 2 (as well as the initial port). The method is voluntary simple (compared to sophisticated methods with advanced modeling or techniques like machine learning) in order to focus our evaluation on the veracity of our new inter-port similarity. The advantage is also to limit the overhead because the similarities are computed beforehand.

A. Evaluation methodology

The similarity between ports are derived using the overall dataset (combining both the JP and FR darknet) between January and June 2015 while the period from 1st to 7th July 2015 is used for testing. We define two performance metrics:

1) Blocking ratio: The percentage of probed ports proactively blocked (%blocked). 2) Usefulness: The percentage of blocked ports which are effectively probed afterwards (%usefulness).

In fact, quantifying the number of false positives is impossible because darknet data does not contain mix traffic with attack and legitimate traffic. Our usefulness metric is thus more drastic by only considering as valid, only blocked ports observed then in the next scans. However, in section VI-D, a real dataset with mix traffic is used in order to evaluate the number of false positives. In order to assess the benefit of our metric, two baseline scenarios are considered:

• MySelf : this consists in simply blocking the current probed port number since our observations in section IV shows that an attacker usually targets the same ports multiple times. • Euclidian: this algorithm blocks the K nearest ports using an euclidean in addition to the initially probed port. If the scanned port is 80, and K = 2, the set of ports to block will be 80, 81 and 82 (when equality, the highest port number is selected in priority, e.g. 81 with K = 1) We also vary the blocking time in Figures 10(a) and 10(b). The MySelf strategy leads to block between 5 and 25% of scans with a usefulness always lower than 18%.

In Figure 10(a), more scans are pro-actively blocked with Euclidean distance algorithm though the usefulness, in Figure 10(b), is lowered and so potential false positives could increase in a real case of mixed traffic.

Regarding the parameters, increasing K leads to to increase the number of ports blocked including both those which are effectively probed afterwards and those which are not aimed by the attacker. As a result, the blocking ratio logically increases. However, as highlighted by the decreasing the usefulness, new ports blocked when increasing K have a higher probability to not be targeted in the future. Hence, increasing K is not a good strategy to improve the efficiency of the baseline Euclidianbased technique.

A higher blocking time also contribute to block more ports. It tends to enhance the usefulness until an upper-bound around 20000 seconds (5h30). Therefore, the port blocking is efficient with this time horizon.

C. Results

In this section, we assess the benefit of the proactive blocking using our defined similarity compared to the baseline scenarios while evaluating the impact of two main parameters: (1) the number of ports to be blocked (K) and (2) the time the ports (for the considered IP address) are blocked. We compare results assuming JP or FR datasets, in Figure 11(c There is a significant improvement in both blocking percentage and usefulness compared to baseline scenarios. Up to 40% and 30% of scans are blocked for the FR and JP dataset respectively in Figure 10. Globally, the blocking ratio can reach around 70% in Figure 11(a) (∼ ×3 improvement). Besides, the percentage of usefulness is about 15% for FR and near 12.5% for JP giving a maximum global usefulness of 30% whereas in the baseline scenarios is 18%.

Regarding the impact of parameter values, the usefulness increases when the blocking period of time increases until around 5h30 with the overall dataset. Unlike baseline scenarios, increasing K may be beneficial for the two performance metric. Actually, a good tradeoff between blocking ratio and usefulness is K = 3 in order to block around 50% of all scans with a usefulness of 25% assuming an optimal blocking time of 20000 seconds.

D. Test with real traffic

Based on similarities learnt on the darknet data (both JP and FR) and the best tuning of parameters highlighted in the previous section, the proactive blocking technique is applied on real data from the MAWI Labs dataset [23]. Instead of exclusive abnormal as from the darknet, it contains real, and so also benign, traffic captured from an oceanic backbone between United States and Japan. Therefore, the false positive rate (FPR) can be calculated in order to check if the preventive blocking (using our new inter-port dissimilarity metric) does not impact benign traffic by discarding ports which are used by the latter.

Having a low usefulness (always lower than 30% in our previous experiments) may not be a problem if the not scanned predicted ports are not used by legitimated communication either. In that case, a port is blocked but without discarding any traffic, the FPR remains low. However, if the automatically blocked port affects benign traffic, the FPR increases. We consider the period from 2 to 9 September 2015 (except the 5th and 7th of September because of dataset unavailability) with a total of 590,173,645 IP packets with a mean of 98,362,274 packets a day. Each day is composed of 15 minutes.

Because only 15 minutes of data per day are labeled, a 5h30 our blocking time is not relevant and is so set to 15 seconds.

As shown in Table II, 99.9% of scans are effectively blocked in a proactive manner. It is due to lower variety of the targeted ports compared to a dedicated security sensor such as the darknets. The usefulness presents also higher values but the most interesting is the low FPR largely under 0.01% decreasing to near 0%. These results prove that the proposed semantic port similarity derived from the knowledge generated by observed attacks, can cleverly block network ports before an attack or a network scan occur. Furthermore, this experiment has shown that knwoledge inferred from our Darknet is not biased by a particular context or location as we used in another environnement.

VII. CONCLUSION

In this paper, a new attacker behavior-based inter-port measure is introduced to catch automatically two types of natural semantics: the service-and context-semantic. The metric we introduced extracts attackers' port semantic knowledge from real scanning activities. Observations done with the darknet over a long time period highlights scanning behaviors and motivate the definition of this new measure between port numbers. In order to assess its viability in an extensive manner, a proactive blocking technique has been defined and tested. Using real world data, we showed that more than 99% of scans can be blocked in advance with less than 0.1% of legitimate traffic blocked. The latter proves that knowledge extracted from our darknet observations contains rich information to derive a inter-port similarity measure which is robust enough to be applied in another context (in a different network).

Future work will refine or extend our proposed metric by including other sources of information (such as RFCs) to determine inter-port similarities.

Fig. 2 :

 2 Fig. 2: Cumulative sum of number of ports scanned per destination IP address per week (in a 4-weeks period)

Fig. 4 :Fig. 6 :Fig. 7 :

 467 Fig. 4: Average number of rescan Fig. 5: Number of re-scan in a day by week. Fig. 6: Average number of ports scanned by IP address

Fig. 9 :

 9 Fig. 9: Network ports graph linked with the 60 smallest shortest-path-based similarity

Fig. 10 :

 10 Fig. 10: Port blocking -baseline scenarios

  ) and Figure 11(b) respectively, or both together in Figure 11(a) (similarly to the baseline scenarios).

Fig. 11 :

 11 Fig. 11: Blocking statistics for K Nearest ports algorithm with the attacker behavior-based

TABLE I :

 I General darknet statistics (attackers are identified by unique source IP addresses)

		France	Japan
	Begin date	1st January 2015	1st January 2015
	End date	30th September 2015 30th September 2015
	Total # of attackers	3,771,092	3,712,209
	Average # of attack-	19,776.66	19,621.43
	ers per day
	Total # of packets	399,344,813	415,642,444
	Average # of packets	1,426,231.47	1,484,437.3
	per day

TABLE II :

 II Preventive port blocking in real network with K=3