Philippe Stempflé
email: philippe.stempfle@ens2m.fr

Toufik Djilali

Richard Kouitat Njiwa

Marthe Rousseau

Evelyne Lopez

Xavier Bourrat

Thermal -Induced Wear Mechanisms of Sheet Nacre in Dry Friction

Keywords: Sheet nacre, Thermal-induced wear mechanisms, Wear debris, AFM, Scanning thermal microscopy

Sheet nacre is a natural biocomposite with a multiscale structure including a mineral phase of calcium carbonate (97 wt.%) and two organic matrices (3 wt.%). The mineral phase is constituted by an arrangement of CaCO 3 biocrystal nanograins (ca 40 nm in size) drowned in an "intracrystalline" organic matrix (4 nm thick) in order to form a microsized flat organomineral aragonite platelet. These platelets are themselves surrounded by an "intercrystalline" organic matrix (40 nm thick) building up a very tough materials. This micro-architecture referred to as "bricks and mortar" nacre structure, is mainly studied for the creation of new organic/inorganic hybrid materials. Currently, little is known about the ncare mechanical behaviour under dynamical loading and more particularly under tribological conditions which involve shocks and thermal effects simultaneously. This paper brings out the thermal-induced damage mechanisms effect on the wear of sheet nacre by the assessment of the thermal component of the friction with a scanning thermal microscope. Results reveal that the mean contact pressure is the main driving force involved in the degradation of the organic constituents. For the lowest mean contact pressure (<0.4MPa), wear is rather weak because the friction-induced thermal component is not sufficient for degrading the organic matrices. In contrast, beyond 0.4 MPa, the friction-induced contact temperature rises up over the melting point of the organic matrices, and may even reach the temperature of the aragonite-calcite phase transformation increasing dramatically the wear of sheet nacre.

INTRODUCTION

Nacre (the pearly internal layer of molluscan shells) is an attractive nanocomposite displaying high mechanical properties, low density, a good biocompatibility and osteogenic properties for human bone regeneration [START_REF] Lopez | Demonstration of the capacity of nacre to induce bone formation by human osteoblasts maintained in vitro[END_REF][START_REF] Carlson | Biological materials in engineering mechanisms[END_REF]. It is currently studied for both the prosthesis design and the creation of new organic/inorganic bio-inspired hybrid materials [START_REF] Munch | Tough, bio-inspired hybrid materials[END_REF]. These exceptional properties are generally ascribed to its highly ordered layered "brick and mortar" micro-architecture and more particularly to the energy absorption ability of the mortar during crack propagation [START_REF] Okumura | Why is nacre strong? Elastic theory and fracture mechanics for biocomposites with stratified structures[END_REF]. In this micro-architecture (fig. 1a), the "bricks" (97 wt.%) refer to flat crystals of calcium carbonate in the crystalline form of aragonite (orthorhombic lattice) with a thickness of <500 nm. The "mortar" (3 wt.%) is an "intercrystalline" thin network (about 40 nm) of a biological organic adhesive mainly composed of silk-fibroin-like proteins and βchitin. As shown in fig 1b, each aragonite platelet is itself a nanograin-reinforced organic matrix composite consisting of nanosized crystals (mean size about 38 nm) of CaCO 3 surrounded by a water soluble "intracrystalline" organic phase (≅ 4 nm) organised as foam [START_REF] Rousseau | Multiscale structure of sheet nacre[END_REF]. Recently, friction and wear behaviour of sheet nacre were studied respectively in dry friction [START_REF] Stempfle´ | Friction-induced sheet nacre fracture: effects of nanoshocks on cracks location[END_REF][START_REF] Stempfle´ | Tribological behaviour of nacre-influence of the environment on the elementary wear processes[END_REF] and liquid medium [START_REF] Stempfle´ | Tribological behaviour of nacre-influence of the environment on the elementary wear processes[END_REF]. They have shown that:

• The environment strongly influences the wear mechanisms of nacre by means of various physicochemical interactions on the water-soluble "intracrystalline" organic phase; • the energy absorption ability of the mortar is drastically reduced in presence of nanoshocks generated during friction by the dynamic solicitations; and • unfortunately some friction-induced damage mechanisms involving thermal effects remain largely misunderstood.

The aim of the present paper is to bring out these thermal-induced damage mechanisms effects on nacre wear from the assessment of the thermal component of friction involved by the degradation of the organic matrices.

Figure 1: a) "Bricks and mortar" microarchitecture of sheet nacre revealing the "intercrystalline" organic phase: b) Each platelet is constituted by nanosized CaCO 3 grains surrounded by an "intracrystalline" organic phase, and c) Schematic cross section of the friction surface (α ≈ 8°)

EXPERIMENTAL

Samples

Samples are made of sheet nacre extracted from giant oyster Pinctada maxima [START_REF] Stempfle´ | Friction-induced sheet nacre fracture: effects of nanoshocks on cracks location[END_REF][START_REF] Stempfle´ | Tribological behaviour of nacre-influence of the environment on the elementary wear processes[END_REF]. They are polished more or less parallel to the aragonite platelets (size: 5µm, thickness: 400 nm, Ra: 14.5 ± 0.6 nm) (fig 1c). The average size of the nanograins assessed by AFM image analysis is 38 ± 21 nm. The thickness of the "intracrystalline" matrix is about 4 nm and its average volume fraction V m -evaluated for a covered area about 10 µm 2 -is about 12% in 2D corresponding to 4.2% in 3D. This value is close to the one obtained by chemical extractions [START_REF] Bourrat | Nacre biocrystal thermal behaviour[END_REF]. The Hardness H, the density ρ, the thermal conductivity K and the specific heat σ of samples are respectively 7.8 ± GPa [START_REF] Stempfle´ | Friction-induced sheet nacre fracture: effects of nanoshocks on cracks location[END_REF], 2830 kg.m 3 , 3 ± 2 W.m -1 K -1 and 1350 ± 150 J.kg -1 K -1 [9].

Tribological Tests

The experimental device is constituted by a pin-on-disc tribotester manufactured by CSM Instruments (Switzerland) [START_REF] Stempfle´ | Friction-induced sheet nacre fracture: effects of nanoshocks on cracks location[END_REF][START_REF] Stempfle´ | Tribological behaviour of nacre-influence of the environment on the elementary wear processes[END_REF]. Tests are carried out at ambient air and room temperature in dry conditions by repeated friction of a 3.5 mm square shaped pin of nacre against the surface of a polished disc of nacre (∅ 44 mm).

The normal load (F n ) varies from 1N to 15N (corresponding to a mean contact pressure of 0.1 -1.2 MPa).

The sliding speed and length are respectively, 10 mm.s -1 and 100 m. The wear rate of pin and disc are determined after 100 m of sliding from the weight of the material lost during the test, with a precision of 10 -4 g. According to the previous mechanical [START_REF] Stempfle´ | Friction-induced sheet nacre fracture: effects of nanoshocks on cracks location[END_REF] and thermal properties of the samples [9], and the expected average real contact area computed from the experimental conditions [START_REF] Mate | Tribology on the Small Scale[END_REF], the value of the Peclet number Lintroduced as a criterion allowing the differentiation between various speed regimes [START_REF] Stachowiak | Engineering Tribology[END_REF]-is very weak (<0.18). Hence, the situation during the tribological tests closely approximates to steady state conduction.

Near Field Microscopy

Atomic Force Microscopy

Topography is assessed using an AFM Dimension 3000 connected to a Nanoscope IIIa electronic controller (Digital Instruments USA) [START_REF] Rousseau | Multiscale structure of sheet nacre[END_REF][START_REF] Stempfle´ | Tribological behaviour of nacre-influence of the environment on the elementary wear processes[END_REF]. Its spatial and vertical resolutions are lower than 1 nm and the field depth is in-between 100 nm and 100 µm. Maps were achieved at high resolution (512×512 pixels) using an intermittent contact mode (so-called TappingMode™). The silicon nitride probe displays a tip rounding lower than 10 nm. The work frequency, the stiffness and the cantilever amplitude are respectively: 270 kHz, 42 Nm -1 and 25 nm. Depending on the size of the images (between 0.25 µm 2 and 25 µm 2 ) the scanning rates varies from 1 µm.s -1 to 2.4 µm.s -1 .

Scanning Thermal Microscopy

The local thermal properties of the samples are assessed with a SThM (TA Instruments µTA 2990 with a TA Instruments controller TA 5300, New Castle, DE) which is an analytical system that combines the high resolution visualization and positioning methods of scanning probe microscopy with the technology of thermal analysis [START_REF] Pollock | Micro-thermal analysis: techniques and applications[END_REF][START_REF] Ha¨ßler | An introduction to lTA and its application to the study of interfaces[END_REF]. The standard AFM probe is replaced by a thermal probe made from a Wollaston wire (5µm diameter platinum-10% rhodium wire enclosed in a silver sheath) which allows the acquisition of the surface contact area temperature, and simultaneously acts as a highly localized heater [START_REF] Pollock | Micro-thermal analysis: techniques and applications[END_REF][START_REF] Ha¨ßler | An introduction to lTA and its application to the study of interfaces[END_REF][START_REF] Lta | Operator's Manual[END_REF]. The vertical deflection of the assembly is monitored by a light pointing technique. The spring constant is 10 N.m - 1 . The constant current setpoint and the z-setpoint are 1 mA and 50 V, respectively. The probe rate is 100 µm.s -1 . This latter is sufficiently weak so that the heat transfer regime stays in the steady state conduction as in the tribological tests [START_REF] Stachowiak | Engineering Tribology[END_REF][START_REF] Gome`s | scanning thermal microscopy: characterisation and interpretation of the measurement[END_REF]. The spatial resolution and the thermal sensitivity are, respectively, about 100 nm and 1°C [START_REF] Gome`s | scanning thermal microscopy: characterisation and interpretation of the measurement[END_REF]. Calibration of the SThM is made by using three reference polymeric samples [START_REF] Lta | Operator's Manual[END_REF]: PAI TORLON (T g = 285°C), PEI ULTEM1000 (T g = 215°C), PPS (T g = 94.4°C, T f = 281°C).

RESULTS AND DISCUSSION

Friction behaviour variation vs. sliding length

The dissipated power by friction is given by

v µF P n =
where µ is the friction coefficient, Fn the normal load and v the sliding velocity [START_REF] Sherge | An energetic approach to friction, wear and temperature[END_REF]. Figure 2 shows its variations in function of the sliding length for various normal loads. The curves are highly disturbed due to local nanoshocks induced by the natural structure of sheet nacre [START_REF] Stempfle´ | Friction-induced sheet nacre fracture: effects of nanoshocks on cracks location[END_REF]. After a run-in period, the deduced Coulomb's friction coefficient is about 0.44 ± 0.02 (Fig. 3).

Wear rate variation versus normal load

The plot of the wear rate (µg.m -1 ) of the pin and the disc versus the normal load are shown in Fig. 4.

• For the pin, the wear rate is very weak and rather insensitive to the normal load.

• For the disc, up to 5N, the wear rate steadily increases with values greater than that of the pin. Above a normal load of 5N (corresponding to a mean contact pressure of 0.4 MPa), the wear rate dramatically rises whereas, in the same time, the friction coefficient stays stable (Fig. 3); Such behaviour is often observed when a dissymmetry in temperature or in the exposure time to the external environment of contacting bodies occurred [START_REF] Stempfle´ | Tribological behaviour of nacre-influence of the environment on the elementary wear processes[END_REF]. Considering the heat transfer regime involved withing the contact (close to the steady state conduction), there is enough time for the contact temperature distribution to be established in the stationary bodyi.e the pin [START_REF] Stachowiak | Engineering Tribology[END_REF]. Hence, the pin contact temperature stays constant in contrast to the one of the disc which undergoes a thermal cycling. Thus, the difference between the two wear rates could be due to a thermal dissymmetry between the pin and the disc. In order to check this assumption we first have to analyse the damage of the friction track.

Observation of the Friction Track Damage

Figure 5 shows a typical AFM view of the friction track after 100 m of sliding. The worn surface is strongly degraded by parallel cracks aligned across the structure of sheet nacre. It is clear that fracture occurs within the platelets itself and involves the fracturing of the "intracrystalline" organic matrix. In a recent work, we have demonstrated that this damage is a kind of crumbling of the aragonite platelets due to friction-induced nanoshocks [START_REF] Stempfle´ | Friction-induced sheet nacre fracture: effects of nanoshocks on cracks location[END_REF]. For low loads (<5 N), this wear mechanism rationalises the formation of wear nanodebris having an average size of 44 nm very close to the one of the biocrystal nanograins [START_REF] Stempfle´ | Tribological behaviour of nacre-influence of the environment on the elementary wear processes[END_REF]. However, this wear mechanism does not explain the abrupt rise of the wear rate when the load is increased beyond 5 N (fig. 4). If nanoshocks phenomena are likely always involved at highest pressures (as supposed with the dashed line on the Fig. 4), another mechanism is probably superimposed for increasing the slope of the wear rate.

Wear debris

Wear debris generated under various normal loads are then observed with X-Ray diffraction and compared to the original spectrum of aragonite [START_REF] Balmain | FTIR and X-ray diffraction analyses of mineral and organic matrix during heating of mother of pearl (Nacre) from the shell of the mollusc Pinctada maxima[END_REF]. As shown in the Fig. 6, the intensity of the calcite peak (expected at 34.28°)i.e the other crystallographic form of CaCO 3 -gradually increases when the normal load increases from 5 N to 15 N. This result is also confirmed by observations of the wear debris using cathodoluminescence (Fig. 7). This technique is particularly sensitive to any modification of the lattice. Thus, for the calcium carbonate, the aragonite structure (orthorhombic lattice) emits in the blue/green whereas the calcite (rhombohedric lattice) emits in the yellow. As shown in Fig 7, the most coarse debris present a transition between the aragonite and the calcite (green grains with yellow spots) whereas the smallest grains appear in yellow because they are completely transformed into calcite. In addition, cathodoluminescence investigations carried out on the friction track reveal that the discontinuous tribo-layers -generated for the highest loads-are mainly constituted by the calcite form of CaCO 3 . According to our previously work [START_REF] Stempfle´ | Tribological behaviour of nacre-influence of the environment on the elementary wear processes[END_REF], in dry friction the pin is almost entirely covered by a strongly bonded tribolayer. Hence, the weak wear rate of the pin -as observed in Fig. 4-could be simply explained by the protective effect of this strongly adhesive calcite tribolayer vovering the pin. Anyway, these results prove that the mineral component of the wear debris can undergo a phase transformation within the contact.

As shown in the Fig 8 and in [START_REF] Bourrat | Nacre biocrystal thermal behaviour[END_REF], the irreversible transformation of calcium carbonate from aragonite to calcite generally occurs when the temperature reaches 470°C. However, these high temperatures can be briefly reached at the level of the microscopic asperities within the contact. This is because the real contact pressure can reach several GPa [START_REF] Stachowiak | Engineering Tribology[END_REF]18]. In our case, the real contact area is about a thousandth of the apparent area (3.5 × 3.5 mm2) [START_REF] Mate | Tribology on the Small Scale[END_REF][START_REF] Stempfle´ | Thermal Contact Conductance[END_REF]. Referring to [START_REF] Stachowiak | Engineering Tribology[END_REF]18,20], the contact temperature is mainly controlled by the normal load when the sliding speed is constant. Since thermal-induced structural changes of the mineral phase are observed during high load tribological tests, the temperatures which drive the melting of the organic matrices should be reached for the lower normal loads -somewhere in-between 2 N to 15 N.

Power Dissipated by Thermal Assessment

Since 98% of the power dissipated by friction is lost by the thermal way [START_REF] Stachowiak | Engineering Tribology[END_REF]18], SThM can be used to link the contact temperature with the thermal power dissipated at the level of the micro-asperity. Indeed, the probe of the SThM properly simulates the thermal dissipation of the local micro-asperity. During the imaging process, the tip is in direct contact with the surface. Changes in thermal conductivity across the surface result in a different heat flow between the tip and sample. Hence, changes in this property can be acquired by measuring the power level which is necessary to maintain the tip-temperature at a constant value. Thus, contrast in topography, in thermal conductivity (e.g. Fig. 10) and/or diffusivity across the surface of the sample are simultaneously acquired [START_REF] Pollock | Micro-thermal analysis: techniques and applications[END_REF][START_REF] Ha¨ßler | An introduction to lTA and its application to the study of interfaces[END_REF][START_REF] Lta | Operator's Manual[END_REF][START_REF] Gome`s | scanning thermal microscopy: characterisation and interpretation of the measurement[END_REF]. Figure 9a, b shows, respectively, the results of 15 experimental tests:

• The µDTA curve (Fig. 9a) displays the power level necessary to keep the heating rate constant. The power is measured relatively to a reference probe. Hence, this curve reveals the relation between the contact temperature and the dissipated power;

• The µTMA curve (Fig. 9b) simultaneously displays the change of the vertical displacement of the cantilever as a function of the contact temperature. The continuous rise of the sensor with the contact temperature corresponds to the thermal expansion of the nacre sample. However, beyond 200°C, sensor jumps are also observed with amplitude a high as 250 to 500 nm.

According to the work of Bourrat et al [START_REF] Bourrat | Nacre biocrystal thermal behaviour[END_REF], thermal expansion of sheet nacre in the slot of temperature 200°C to 350°C can be attributed to the melting of the organic matrices (see Fig. 8 curve 2). Thus, these thermalinduced jumps show that the platelets can come unstuck when the organic phase is degraded. Since the organic matrices ccontain mainly proteins and chitin the term "degraded" is probably much more suitable than the term "melted" because the degradation of the organic matrices does not imply a reversible process in contrast to the melting. In addition, µDTA plot (Fig. 9a) reveals that the minimum power for degrading the organic phase is about 20 mW. In order to check this assumption, Fig. 10a, b shows the typical SThM views of the same area observed at 200°C, respectively, before (Fig. 10a) and after heating at 350°C (Fig. 10b). After heating at 350°C (corresponding to a power about 35 mW), the organic matrix clearly vanished. In addition, the power level necessary to keep the temperature at 200°C is reduced of about 2 mW due to the disappearance of the organic phase's additional thermal resistance.

Friction-induced thermal behaviour

In order to link the previous observations with the tribological ones, the average contact temperature at the level of the micro-asperities within the tribological contact can be estimated -for each normal load -by comparing the respective power level given by the µDTA graph (Fig 9a ) with the thermal power dissipated by friction during the tribological tests. This latter is assumed to be 98% of the friction power displayed in the fig. 2. Consequently, the multi-asperity contact temperature can be determined in function of the contact pressurei.e the normal load. These results show that:

• For the low contact pressures (<0.4 MPa corresponding to 5 N), the friction-induced thermal component is not sufficient for melting the organic matrices (17 mW, T c < 210°C). According to Madhusudana [20], the greater part of the thermal power is lost in the gas gap because the contact pressure is lower than 10 -4 H (with H the hardness of the sample). Hence, in this case, the wear is mainly controlled by the presence of nanoshocks [START_REF] Stempfle´ | Friction-induced sheet nacre fracture: effects of nanoshocks on cracks location[END_REF];

• When the contact pressures are greater than 0.4 MPa (i.e normal load higher than 6 N), the frictioninduced contact temperature rises up to the melting point of the organic matrices (e.g., for 6N, 24.5mW, T c ≅ 282°C). In this case, the greater part of the thermal power is lost by conduction across the gas filling the voids between the actual contact spots and across the spots [START_REF] Gome`s | scanning thermal microscopy: characterisation and interpretation of the measurement[END_REF][START_REF] Stempfle´ | Thermal Contact Conductance[END_REF]20] ;

• The aragonite-calcite phase transformation is observed within the contact when the contact pressure is higher than 1 MPa (i.e., normal load higher than 11N). Extrapolation of the curve gives: 49 mW and T c ≅ 508°C ; Thus, in these two latter cases, wear becomes a combination of nanoshocks and thermal effects -combining degradation of the organic matrices, and friction-induced phase transformation of the mineral phase. This combination explains both the abrupt change in the wear rate with the contact pressure beyond 0.4 MPa and also the dissymmetry between the wear rate of the pin and the one of the disc.

CONCLUSION

The aim of this paper was to bring out the effect of the thermal-induced damage mechanisms on the wear of nacre by using the assessment of the thermal component of the friction which is involved in the degradation of the organic matrices. For this purpose, the SThM is used for controlling the thermal power really injected within the sample. The latter is then compared with the power dissipated by friction during the tribological tests. Results reveal that:

• When the mean contact pressure is lower than 0.4MPa, the friction-induced thermal component is not sufficient for degrading the organic matrices. Wear is mainly controlled by the presence of shocks.

• When the mean contact pressure is increased beyond 0.4 MPa, the friction-induced contact temperature rises up, over the degradation point of the organic matrices, and may even reach the temperature of the aragonite-calcite phase transformation: the wear is dramatically increased.

• The weak wear rate of the pin can be attributed to a protective effect of the strongly adhesive calcite tribolayer covering the pin.

ACKNOWLEDGEMENTS

Philippe Penhoud (Orleans University) and Vincent Barbin (Reims University) are acknowledged for X-ray and cathodoluminescence analyses, respectively. The authors thank Tahiti Perles Company and its Chairman Robert Wan for having supplied them with the best nacre quality.

Figure 2 :Figure 3 :

 23 Figure 2: Variation of the dissipated power by friction versus sliding length for various normal loads

Figure 4 :

 4 Figure 4: Variation of the wear rate with the normal load.

Figure 5 :

 5 Figure 5: Typical AFM view of the friction track revealing the crumbling of the aragonite platelets by the presence of nanoshocks

Figure 6 :Figure 7 :Figure 8 :

 678 Figure 6: X-ray diffraction spectra of wear debris generated under various normal loads

Figure 9 Figure 10 :

 910 Figure 9 a) µDTA plot: dissipated power versus contact temperature and b) µTMA cantilever displacement versus contact temperature


Rishikesh Sahay
email: rishikesh.sahay@telecom-sudparis.eu

SAMOVAR Gregory Blanc
email: gregory.blanc@telecom-sudparis.eu

Zonghua Zhang
email: zonghua.zhang@imt-lille-douai.fr

Khalifa Toumi
email: khalifa.toumi@telecom-sudparis.eu

Hervé Debar
email: herve.debar@telecom-sudparis.eu

Adaptive Policy-driven Attack Mitigation in SDN

Keywords: Security policy, Policy management, SDN CCS Concepts, Networks → Programmable networks, Network management, • Security and privacy → Denialof-service attacks

This paper presents a dynamic policy enforcement mechanism that allows ISPs to specify security policies to mitigate the impact of network attacks by taking into account the specific requirements of their customers. The proposed policybased management framework leverages the central network view provided by the Software-Defined Networking (SDN) paradigm. One of the major objectives of such a framework is to achieve fine-grained and automated attack mitigation in the ISP network, ultimately reducing the impact of attack and collateral damage to the customer networks. To evaluate the feasibility and effectiveness of framework, we develop a prototype that serves for one ISP and three customers. The experimental results demonstrate that our framework can successfully reduce the collateral damage on a customer network caused by the attack traffic targeting another customer network. More interestingly, the framework can provide rapid response and mitigate the attack in a very short time.

Introduction

In today's Internet, traffic engineering is mainly performed by the Internet Service Providers (ISP), while the customers are usually passive. As we know, one of the major objectives of traffic engineering is to mitigate traffic congestion, which can be caused, among others, by attacks. The lack of collabo-Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and /or a fee. Request permissions from permissions@acm.org. XDOM0'17 April 23, 2017, Belgrade, Serbia c 2017 ACM. ISBN 978-1-4503-4937-6/17/04. . . $15.00 DOI: http://dx.doi.org/10. 1145/3071064.3071068 ration between an ISP and its customers may eventually lead to dissatisfaction among its customers, as legitimate traffic may get dropped. For example, when defending against Distributed Denial of Service (DDoS) attacks that attempt to deplete an ISP's bandwidth, simply prioritizing legitimate traffic or redirecting suspicious traffic for one customer may impact other customers of the same ISP, considering the fact that the same path can be shared between different customers in an ISP network.

As a matter of fact, without collaboration with their ISPs, customers do not have much control over the incoming traffic, apart from blocking the attack traffic at their border router. Therefore, it is in the interest of both the victim network and its ISP to collaborate for traffic engineering to mitigate the effect of congestion. In this case, the customer can express finer requirements that can be addressed as differentiated services by the ISP. Despite a large number of solutions [START_REF] Bum | CoDef: Collaborative Defense Against Large-scale Link-flooding Attacks[END_REF][START_REF] Mahimkar | dFence: Transparent Network-based Denial of Service Mitigation[END_REF]) proposed for traffic engineering, they have not been considered for widespread deployment, chiefly due to the complexity involved in the network management task, such as configuring switches and routers for policy enforcement. According to a report from Juniper (Open Networking Foundation 2008), human error is the cause for 80% of the total network downtime. Additionally, manual configuration hinders the dynamic deployment of network services, further downgrading the Quality of Service (QoS) level for the customers of an ISP.

Another fact is that service providers statically provision security devices with the dedicated network devices, and define the ordering constraints that must be applied to the packets [START_REF] Nadeau | Problem Statement for Service Function Chaining[END_REF]. These security and network devices are generally distributed in the network through separate VLANs, while network policy is usually applied per VLAN. This essentially leads to static service chaining with the deployment of static policies for steering network traffic to the security and network devices. This topological dependency with the deployment of middleboxes makes ISPs reluctant to deploy new security functions in their networks for providing security services to their customers. Furthermore, all the traffic, whether it needs to be processed through the security devices or not, eventually traverse these devices, which causes them processing overhead. Therefore, a dynamic and automated policy management system is required to overcome these issues.

Software-Defined Networking (SDN) recently emerges as a novel networking paradigm that can simplify network administration and management by centralizing the decision-making process (Open Networking Foundation 2013). It also provides the administrator with a global view of the network and enables programmability in the data plane. By leveraging the features of SDN, we develop an automated policy management system in which the ISP can express high-level policies that can be enforced dynamically as the network environment changes. Specifically, our policy management system provides collaborative and user-centric automated response for mitigating the attack traffic and providing the QoS service to the customers of the ISP. Customers can express their requirements, from which the ISP decides on the policies to deploy. Our policy management system leverages the global view of the network to assess the impact of a policy deployed for one customer, in order to minimize the impact on the other customers.

In this paper, we implement our proposed framework for a specific use case, where the ISP and their customers collaborate with each other to mitigate the effect of congestion caused by DDoS attack. We also experimentally demonstrate that the framework can help an ISP to provide good QoS to legitimate traffic, while reducing the impact on other customers' traffic.

The remainder of this paper is organized as follows: Section 2 provides some insights on related work. Section 3 describes our policy framework, its workflow and functional components. Section 4 reports our experiments and results. Section 5 concludes the paper.

Related work

To the best of our knowledge, there is a number of works dealing with policy-based network management leveraging the SDN paradigm [START_REF] Bari | PolicyCop: An Autonomic QoS Policy Enforcement Framework for Software Defined Networks[END_REF][START_REF] Ben-Itzhak | EnforSDN: Network policies enforcement with SDN[END_REF][START_REF] Machado | Policy authoring for software-defined networking management[END_REF][START_REF] Lara | OpenSec: Policy-based security using software-defined networking[END_REF]. They usually exploit key features such as data plane programmability and network visibility to ease the network management process. In this section, we will discuss existing policybased frameworks, the policy languages that inspired them, and earlier proposals in traffic steering.

Traffic steering is an exemplary instance of how to take advantage of SDN switches to enforce routing policies in an efficient manner for middlebox-specific networks. One such effort, SIMPLE [START_REF] Zafar | SIMPLE-fying Middlebox Policy Enforcement Using SDN[END_REF], alleviates manual operation from administrators by allowing them to specify a logical routing policy and translates it into forwarding rules, in compliance with physical resource constraints. Additionally, FlowTags [START_REF] Kaveh Fayazbakhsh | FlowTags: Enforcing Network-wide Policies in the Presence of Dynamic Middlebox Actions[END_REF]) provide a technique to enforce network-wide policies in spite of packet modifications imposed by middleboxes.

At a higher level, policy languages have been proposed to specifically program software-defined networks. Languages, such as Frenetic [START_REF] Foster | Frenetic: A Network Programming Language[END_REF], free programmers from reasoning with low-level details of the switches and allow them to describe high-level packet forwarding policies on top of the control plane. Another example, Procera [START_REF] Voellmy | Procera: A Language for High-level Reactive Network Control[END_REF], extends policy design into event-driven network control, which is not permitted by configuration languages exposed by controllers. These languages usually offer the ability to specify routing policies, in terms that are close to network operations, while we are interested in specifying higher-level policies to enforce security or quality of service operations.

Policy management frameworks would often rely on the above-mentioned technological building blocks to satisfy user-centric requirements. EnforSDN [START_REF] Ben-Itzhak | EnforSDN: Network policies enforcement with SDN[END_REF] proposes to simplify network service management by decoupling policy resolution (computing concrete rules) from policy enforcement (pushing low-level rules) by remarking that the former deals with flows, e.g., security policies, while the latter forwards packets at the data plane. It tackles middlebox-induced problems but fails to accommodate other contexts than the network. PolicyCop [START_REF] Bari | PolicyCop: An Autonomic QoS Policy Enforcement Framework for Software Defined Networks[END_REF]) is such a QoS policy enforcement framework that provides an autonomic management of user-centric policies by monitoring and enforcing the users' Service-Level Agreements (SLAs). It relies on common data plane interfaces exposed by OpenFlow (OF) forwarding devices for statistics collection and flow information retrieval, and includes a number of controller applications to support policy monitoring and enforcement. Our work is interested in extending the inputs to the policy engine with security events. Additionally, the computation of policy routes do not take into account the availability of security services. Business-level goals are also taken into account in a policy authoring framework proposed by [START_REF] Machado | Policy authoring for software-defined networking management[END_REF]. Their framework matches these requirements with the capacities provided by the network infrastructure in order to decide on an appropriate policy, through abductive reasoning. It is however unclear how network elements are requested and configured beyond the policy path computation (referred to as Analysis Phase in their work). OpenSec [START_REF] Lara | OpenSec: Policy-based security using software-defined networking[END_REF] is close to our proposal in that this framework provides a language that blends security services within the autonomic reaction process. However, it seems to focus the deployment on edge switches, while we are interested in distributing the policies across the controller's network domain.

Our work aims at accommodating multiple customer services sharing a network service provider, who doubles as a security service provider. Going beyond routing and QoS

Policy Management and Enforcement System

Our previous analysis indicates that most of existing policy management frameworks can not support real-time collaborations between ISPs and customers, thereby leading to heavy latency on attack detection and response. To tackle the issue, the ISP should consider multiple factors, e.g., the current network status and service-level agreements with its customers. Also, it should be adaptive to the requests of particular customers, so that traffic engineering performed for one customer will not impact the traffic going to other customers. Our purpose is therefore to develop a policy management and enforcement framework which can dynamically and automatically configure and enforce security policies in the ISP network, allowing the administrator to simply specify policies at a high level.

Design Overview

The design overview of our framework is shown in Fig. 1, consisting of several functional components: a Monitoring Component (MC), a Policy DataBase (PDB), a Policy Decision Point (PDP), and a Policy Orchestrator and Implementer (POI). As most of the operations are carried out within the ISP domain, the customer network is not shown here. The operational workflow is given as follows:

1. an event is triggered at the ISP controller when a notification, which can be a security alert sent from a customer controller or a network status update raised by the ISP controller, is received by the MC. We assume that the customer uses some detection mechanism to flag whether it is under attack or not [START_REF] Mahimkar | dFence: Transparent Network-based Denial of Service Mitigation[END_REF])1 .

2. The MC module analyzes the notification and extract the information of concern, such as the flow information, its impact severity, its security class and the attack type. The extracted information is then sent to the PDP.

3. The PDP selects the high-level action from the policy database based on the event and its corresponding conditions. The high-level action, bandwidth request, and flow information are then forwarded to the POI.

4. Based on the high-level action, the POI identifies the Policy Enforcement Points (PEPs) and computes the paths.

5. The resulting path(s) is then deployed via POI by translating the chosen actions into a set of OF rules, which can be enforced by the OF switches along the path.

Design Components

The functional components of the policy management system are discussed as follows.

Monitoring Component (MC) handles the security alerts and notifications from different customers. Specifically, it parses them and extract the information of concern for the PDP, including flow information (source and destination IP addresses, protocol ), the security class (suspicious, malicious, legitimate), the type of attack, and the impact severity of suspicious traffic detected at the customer network. On the other hand, MC monitors the status of the switches and paths in the ISP network and assesses the network status (congested, normal ) for the PDP. To monitor the ISP network, a tool like OpenNetMon (van Adrichem et al. 2014) can be used as it allows to maintain the traffic matrix for different paths and switches in the network.

Policy Decision Point (PDP) is in charge of the global policy decisions. It firstly activates the context2 based on the status of the networks and/or the received alerts. Then based on the activated context, the extracted information from the alert and the policy database (PDB), PDP decides which actions to take (e.g, redirect, drop, forward ). The resulting actions, together with the flow information, are finally sent to the POI module to be enforced.

Policy Database (PDB) is essentially a repository containing the high-level security policies specified by the network administrator, without detailing the specific deployment strategy.

Listing 1. Syntax of high-level security policy Specifically, security policies are structured using the Event-Condition-Action (ECA) model which we believe is suitable for dynamic policy management. In particular, each Event refers to a specific attack or incident and is associated with a set of rules. The rules are described as a set of Conditions that match the context in which the attack or incident occurs. At last, the Action, is essentially a high-level action to be applied to the identified flows.

Formally, we provide a syntax about DDoS mitigation, as shown in Listing 1, in which an Event may indicate one of several types of DDoS attacks or QoS requests, a Condition set includes the security class -Malicious labels the flows certain to be from attacker; Legitimate represents the flows that are benign in nature; and Suspicious denotes the mixture of malicious and legitimate traffic -as well as the impact severity, of the attack traffic on the customer network (low, medium or high ) and the status of the ISP network status (i.e., either normal or congested). Action may be either of the three following: redirection, blocking, and forwarding.

To illustrate the specification of the policy according to the given syntax, a sample policy addressing UDP flood attack is given in Listing 2, which shows that the flows identified as UDP flood are labeled with a suspicious security class, resulting in a medium impact on the customer network. If the ISP network is in a normal status, the flows will redirected elsewhere in the network.

Policy Orchestrator and Implementer (POI) is mainly used for path computation and distributing the rules to the switches along the computed path. It also considers the security middleboxes to traverse, in order to steer the flows in the network. For instance, the suspicious traffic may be redi-rected to a firewall and then a NAT device. Flow information (source IP, destination IP), policy action, and requested bandwidth are taken as inputs from the PDP for path computation, as detailed in Algorithm 1, which is essentially a policy-aware shortest path algorithm [START_REF] Cao | Traffic Steering in Software Defined Networks: Planning and Online Routing[END_REF]. As a result of path computation, POI distributes the rules in the switches along the computed path and inserts a Network Service Header (NSH) [START_REF] Quinn | Network Service Header[END_REF] in the packets for processing. In particular, NSH helps to steer the flows in the core network with only labels, so the core switches do not need to check the whole packet header for forwarding. It also significantly reduces the number of flow entries in the core switches. No path is available

Experiment

The purpose of our experiments is to demonstrate, in a multicustomer scenario, the effectiveness of our proposed policy engine on mitigating traffic congestion and collateral damage in the presence of DDoS attacks.

Settings

The policy enforcement framework is implemented in Python and run as an OF application on the Ryu SDN controller. The experiments were carried out in Mininet, which provides a simulated OF switching environment. The experimental scenario is shown in Fig. 2, in which we assume the ISP network contains 14 OF switches and 6 paths, and the bandwidth and link loss probability of different paths are assumed to be as in Table 1. Also, the security alerts received by the ISP are represented in the IDMEF format [START_REF] Feinstein | The Intrusion Detection Message Exchange Format (IDMEF)[END_REF].

Results and Discussions

We use throughput and network jitter, two well accepted QoS metrics, to evaluate the effectiveness of our approach.

Throughput of legitimate traffic. Throughput was measured in the presence of DDoS attacks. As shown in Figure 2, we used H 2 to generate DDoS attack traffic, and observed the impact on the legitimate traffic going to the customers C 1 , C 2 and C 3 . As we can see in Figure 3, the throughput of all the legitimate traffic dropped sharply as soon as H 2 started to attack. As a result, the SDN controller of customer C 3 sends an alert, which contains the FlowID (source IP, destination IP) and security class (legitimate), to MC at the ISP controller, making PDP decide on redirecting the flow. Subsequently, POI computes the best path, i.e., P 3 , and inserts the NSH in the packets to redirect them. Finally, the corresponding OF rules are loaded to PEPs, namely the OF switches. As shown in Figure 3, the legitimate traffic heading to C 3 was thus able to quickly return to its normal level.

Similarly, the traffic flow going to C 2 was redirected through path P 2 upon the request of customer C 2 , in order to restore its throughput to the normal level. Afterwards, the alert of customer C 1 reached the ISP controller, which interestingly redirected the traffic originating from host H 1 (which has the higher throughput) to path P 2 as well, pushing the throughput of the traffic (originating from host H 3 ) to customer C 2 down to zero, as shown in Figure 3. This indicates that, due to the limited availability of high QoS paths in the ISP network, ensuring the QoS for one customer may incur negative impact on other customers.

QoS provisioning for legitimate traffic. Following the previous experiment, we examine how the QoS of legiti- mate traffic can be provisioned if all the paths with high bandwidth are congested. In this experiment, we assume that customer C 1 requests for getting better QoS of the traffic sent from H 1 . As shown in Figure 4, since the legitimate traffic going towards customer C 2 and C 3 were protected from collateral damage, the traffic from H 1 was redirected to the lower bandwidth path P 4 , ensuring that the QoS was not heavily impacted despite the congestion of the legitimate path LP 1 .

Network Jitter of legitimate traffic. Finally, we test how the network jitter of legitimate traffic varies in the presence of congestion. As Fig. 5 shows, the network jitter of legitimate traffic going towards customers C 1 , C 2 , and C 3 started to increase when the attack traffic from H 2 congested the network. However, all of them immediately decreased when the ISP controller redirected the traffic flows upon receiving the mitigation requests from the customers. Despite the similar changing pattern, the network jitter of the traffic going to C 3 decreased earlier compared to those of C 2 and C 1 . This is simply because customer C 3 sent alert earlier than customers C 2 and C 1 did.

Conclusion

This paper proposed an automated and dynamic policy enforcement mechanism for mitigating DDoS attacks in a scenario where a single ISP is serving multiple customers. One of the major advantages of the mechanism is that it allows high-level security policies to be dynamically instantiated based on the security alerts sent from the customers, and adapted upon network changes. The policies are then enforced at OF switches with an objective to achieve dynamic security service chaining, which is enabled by the network service header, positioned in the packets by the SDN controller. Our future work will be focused on resolving the conflicts of reaction policies due to simultaneous enforcements for different customers. We will also enrich the policy attributes and survey the associated complexity.

Figure 1 .

 1 Figure 1. Workflow of the Policy Management System

  1 E v e n t = { UDP Flood | TCP SYN | ICMP Flood | D N S A m p l i f i c a t i o n | Q o S r e q u e s t } 2 C o n d i t i o n = { S e c u r i t y C l a s s | I m p a c t S e v e r i t y | I S P N e t w o r k S t a t u s } 3 S e c u r i t y C l a s s = { S u s p i c i o u s | M a l i c i o u s | L e g i t i m a t e } 4 I m p a c t S e v e r i t y = {Low | Medium | High } 5 I S P N e t w o r k S t a t u s = { Normal | C o n g e s t e d } 6 A c t i o n = { R e d i r e c t | B l o c k | F o r w a r d } Listing 2. A Sample Policy for suspicious traffic redirection 1 <P o l i c y PolicyName = " S e c u r i t y p o l i c y "> 2 <E v e n t e v e n t ="UDP-F l o o d "> 3 </ Event> 4 <C o n d i t i o n > 5 < s e c u r i t y c l a s s = " s u s p i c i o u s " /> 6 <I m p a c t s e v e r i t y = " medium " /> 7 <I S P N e t w o r k S t a t u s s t a t u s = " n o r m a l " /> 8 </ C o n d i t i o n > 9 <A c t i o n a c t i o n =" r e d i r e c t " /> 10 </ A c t i o n > 11 </ P o l i c y >

Algorithm 1 for

 1 Path Computation 1: procedure PATH COMPUTE(flow,bw req,action,step,Max rate) Flow F and each path p do 5: p ← compute Bandwidth(max(all links)) //-Takes the maximum bandwidth in the path 6: d ← Hop Count(step[i] + step[i + 1]) 7: hop count ← hop + d // Computes the hop count in the -bw req) ≥ M ax rate then //New flow should not impact other flows traversing the link.

Figure 2 .

 2 Figure 2. Experimental scenario: one ISP with three customers.

Figure 3 .Figure 4 .

 34 Figure 3. Throughput of legitimate traffic going towards customer network after redirection.

Figure 5 .

 5 Figure 5. Network jitter of legitimate traffic.

Table 1 .

 1 Traffic paths in terms of bandwidth and link loss probability.

	Paths Bandwidth Link Loss Percentage
	P1	400 Mbps	0
	P2	400 Mbps	0
	P3	400 Mbps	0
	P4	200 Mbps	3
	P5	100 Mbps	5
	P6	50 Mbps	7

A detection mechanism is out of scope of this paper.

The context allows to fine-tune the policy that should be enforced, so as to minimize the side effects of policy enforcement.

Acknowledgments

This research has been partially supported by the European Union's Horizon 2020 Research and Innovation Programme under grant agreement No. 643964 (SUPERCLOUD). The authors would also like to thank the anonymous referees for their valuable comments and helpful suggestions.


Brayan Roulier

Inbal Rush

Leticia Lazinski

Basile Pérès

Hamza Olleik

Guy Royal

Ayelet Fishman

Marc Maresca

Romain Haudecoeur

Resorcinol-based hemiindigoid derivatives as human tyrosinase inhibitors and melanogenesis suppressors in human melanoma cells

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.


Khadija Hadj

Khadija Hadj Salem
email: khadija.hadjsalem@emse.fr

Arthur Kramer
email: arthur.kramer@emse.fr

Alexis Robbes
email: alexis.robbes@lip6.fr

An arc-flow model for the job sequencing and tool switching problem with non-identical parallel machines

Keywords: Job sequencing and tool switching problem, parallel machines, arc-flow model

come

An arc-flow model for the job sequencing and tool switching problem with non-identical parallel machines

Problem description

In this paper, we consider the Job Sequencing and Tool Switching Problem with Non-identical Parallel Machines (SSP-NPM), which arises in a flexible manufacturing context. The SSP-NPM is a generalization of the classical Job Sequencing and Tool Switching Problem, first presented by [START_REF] Bard | A heuristic for minimizing the number of tool switches on a flexible machine[END_REF] and [START_REF] Tang | Models arising from a flexible manufacturing machine, part i: minimization of the number of tool switches[END_REF], and proven to be NP-hard by [START_REF] Crama | Minimizing the number of tool switches on a flexible machine[END_REF].The SSP-NPM was first tackled by [START_REF] Calmels | Heuristics for solving the job sequencing and tool switching problem with non-identical parallel machines[END_REF] throughout several constructive heuristics. After that, three different mixed integer linear programs (precedence-based, position-based and time index-based), with the aim of minimizing the objective functions related to job execution times (e.g., makespan, total flow time) and/or the number of tool switches, are proposed in [START_REF] Calmels | A comparison of different mathematical models for the job sequencing and tool switching problem with non-identical parallel machines[END_REF].

Formally, the SSP-NPM can be defined as follows. Let us consider a set of jobs J that has to be scheduled in a manufacturing environment with a set of non-identical parallel machines M, specified by machine-dependent processing and tool switching times. We will refer to p jm the processing time of a job j on machine m characterized by a magazine capacity C m . A job j can be processed on a machine m only if all of its required tools t ∈ T j ⊆ T are loaded in m during its processing. Since job requirements may be different, and the magazine capacities are limited, tool switches are needed to fully process all jobs. Let sw m denote the time to switch one tool t on a machine m. Note also that the initial loading does not count as a tool switch, and the tool switching cannot happen while a job is processing. Then, the SSP-NPM requires to schedule the jobs to the unrelated parallel machine with limited capacity, so that the makespan is minimized.

An example of the SSP-NPM is given in Figure 1, where We model the SSP-NPM as an arc-flow (AF) model by using flows, that are associated with schedules, on a capacitated network. Our proposed model is composed by a continuous variable to represent the makespan and three sets of binary variables to represent job processing, tool loading and setup (tool switching) operations. Then, flow conservation constraints are used to impose that at most one job and C m tools are considered at the same time per machine m ∈ M. The remaining constraints are: (i) all jobs must be processed and (ii) can be processed on a machine only if all of its required tools are loaded at the same time on the same machine; (iii) a setup time between the loading of two different and consecutive tools is required; (iv) the number of tools available per machine is limited (one copy per machine).

An optimal solution of the example in Figure 1, obtained by applying the proposed AF model, is presented in Figure 2. An AF optimal solution (makespan = 15) of example in Figure 1:

Preliminary experiments and further research

We benchmark the proposed AF against the mathematical formulations presented in [START_REF] Calmels | A comparison of different mathematical models for the job sequencing and tool switching problem with non-identical parallel machines[END_REF] on benchmark instances from the literature. Preliminary experiments show that the AF is able to successfully solve small-sized instances at optimality. Further research focuses on improving the AF model by proposing valid inequalities and preprocessing procedures to reduce the AF size and developing matheuristics/exact/decomposition methods to efficiently solve the SPP-NPM.

  m

  |J | = 6 jobs, |T | = 9 tools and 2 machines with different capacities C 1 = 4, C 2 = 3, and switching times sw 1 = 1 and sw 2 = 2.

				job 6 job 6 job 6 job 6 job 6 job 6				j	1	2	3	4	5	6
										T 1 T 2 T 3 T 4 T 5 T 6
	Tools: 1	2	3	4	5	6	7	8	9	1	1	2	1	3	1
										4	3	6	5	5	2
										8	5	7	7	8	4
	C 1								C 2	9		8	9
									p j1 1	3	4	5	6	1
		Machine 1			Machine 2	p j2		4			3	1
				(a)								(b)

FIG.

1:

A schematic layout example of the problem environment.