Khizar Hayat
email: khizar.hayat@lirmm.fr

William Puech
email: william.puech@lirmm.fr

Gilles Gesquiere
email: gilles.gesquiere@lsis.org

A LOSSY JPEG2000-BASED DATA HIDING METHOD FOR SCALABLE 3D TERRAIN VISUALIZATION

The data needed for 3D terrain visualization consists, essentially, of a texture image and its corresponding digital elevation model (DEM). A blind data hiding method is proposed for the synchronous unification of this disparate data whereby the lossless discrete wavelet transformed (DWTed) DEM is embedded in the tier-1 coded quantized and DWTed Y component of the texture image from the lossy JPEG2000 pipeline. The multiresolution nature of wavelets provides us the scalability that can cater for the diversity of client capacities in terms of computing, memory and network resources in today's network environment. The results have been interesting and for a bitrate as low as 0.012 bit per pixel (bpp), a satisfactory visualization was realized. We compare the obtained results with those of a previous method that interrupt the lossless JPEG2000 codec immediately after the DWT step and embeds lossless DWTed DEM in the reversibly DWTed Y component of texture. The proposed method proved to be more effective in the sense that for the same bitrate one observed lesser quality loss for respective resolutions.

INTRODUCTION

Terrain visualization in three dimensions requires at least two files: texture images and a set of coefficients obtained by digitizing the elevation of terrain, called Digital Elevation Model (DEM). Each of the DEM coefficient represents the altitude of a particular square block of texture pixels and the process of visualization is the overlaying of texture over a regular triangle network [START_REF] Losasso | Geometry Clipmaps: Terrain Rendering Using Nested Regular Grids[END_REF] obtained from the DEM. With today's technology, the 3D visualization quality may be very high but the client/server environments are very diverse in terms of network, computation and memory resources. For catering each of the perspective client it is advisable to encode the data in a scalable way, unified into one standard format file. The JPEG2000 format [START_REF]Information technology, JPEG2000 image coding system, Part 1: Core cod-ing system. ISO Central Secretariat[END_REF] offers the scalability thanks to the multiresolution nature of its discrete wavelet transform (DWT). For the integration of all the data into one file one can rely on the technique of data hiding due to the smaller size of the DEM file as it can be embedded in the bulky texture image 1 . But this embedding must be carried out in such a way that the JPEG2000 file format is conserved and there is no need of any new format. In addition the embedding must not interfere with the scalability and for each of the possible resolutions, the corresponding texture and its DEM must be recoverable at the decoder. Keeping these requirements in mind we hereby propose a data hiding based strategy that would embed the DWTed DEM in the T1-coded DWTed Y component of the texture from a lossy JPEG2000 pipeline. The strategy is synchronous in the sense that the level of transform of both the carrier and the message is the same. For example, low energy subbands carry the lower subband coefficients of DWTed DEM. Hence from any available subset subbands one can recover the corresponding subset for DEM. The multiresolution nature of DWT fulfills our requirement of scalability.

Few of the previous work on wavelet-based data hiding are compatible with the JPEG2000 scheme. The data hiding methods for JPEG2000 images must process the code blocks independently [START_REF] Meerwald | A Survey of Wavelet-Domain Watermarking Algorithms[END_REF] which implies that methods like intersubband embedding [START_REF] Kundur | Improved Digital Watermarking Through Diversity and Attack Characterization[END_REF], hierarchical multi-resolution embedding [START_REF] Kundur | Digital Watermarking Using Multiresolution Wavelet Decomposition[END_REF] and correlation-based method [START_REF] Wang | An Integrated Approach to Embedded Image Coding and Watermarking[END_REF] do not serve the purpose. There are methods [START_REF] Kundur | A Robust Digital Image Watermarking Scheme Using the Wavelet-Based Fusion[END_REF] of embedding invisible watermarks by adding pseudo-random codes to large coefficients of the high and middle frequency bands of DWT but the methods have the disadvantage of being non-blind. The blind scheme proposed in [START_REF] Su | An Integrated Approach to Image Watermarking and JPEG-2000 Compression[END_REF] is to integrate data hiding with the "Embedded Block Coding with Optimized Truncation (EBCOT)" and embed data during the formation of compressed bit stream. The scheme is claimed to have robustness and good perceptual transparency. One particular technique [START_REF] Meerwald | Quantization watermarking in the JPEG2000 coding pipeline[END_REF] embed watermark in the JPEG2000 pipeline after the stages of quantization and region of interest (ROI) scaling but before the entropy coding. For reliability purposes the finest resolution subbands are avoided. A window sliding approach is adopted for embedding with the lowest frequencies having higher payload. Piva et al. have proposed an authentication scheme that embeds an image digest in a subset of the subbands from the DWT domain [START_REF] Piva | Self Recovery Authentication of Images in The DWT Domain[END_REF]. The image digest is derived from the DCT of the level 1 DWT LL subband of the image. The resultant DCT coefficients are scaled down by quantization and ordered from most to least significant through a zig-zag scan. A most significant subset, after discarding the DC coefficient, is quadruplicated for redundancy and then rescaled and scrambled by using two different keys. This gives the message which is substituted to the subbands selected from a set obtained by the further wavelet decomposition of the level 1 HL and LH subbands of the original image. One blind method [START_REF] Liu | A Robust Watermarking Scheme Using Self-Reference Image[END_REF] transforms the original image by one-level wavelet transform and sets the three higher subbands to zero before inverse transforming it to get the reference image. The difference values are used to ascertain the potential embedding locations of which a subset is selected randomly for embedding. While explaining their method of embedding biometric data in fingerprint images, Noore et al. [START_REF] Noore | Enhancing Security of Fingerprints through Contextual Biometric Watermarking[END_REF] argue against the modification of the lowest subband to avoid degradation of the reconstructed image as most of the energy is concentrated in this band. Instead they propose to redundantly embed information in all the higher frequency bands. Of the various practical efforts, to integrate the visualization data, are solutions like GeoJP2 [START_REF] Gerlek | The "GeoTIFF Box" Specification for JPEG 2000 Metadata -DRAFT version 0[END_REF] and GMLJP2 [START_REF] Lake | GML in JPEG 2000 for Geographic Imagery (GMLJP2) Implementation Specification[END_REF] but these serve the purpose partially since the data is not synchronized and there is an increase in the original size of the JPEG2000 file. We follow a different course, to have the advantage of synchronization without any change in the JPEG2000 file size, by applying a scalable data hiding algorithm.

The rest of the paper is arranged as follows. Our proposed method is explained in Section 2. We present and analyze results in Section 3 and Section 4 concludes this paper.

THE PROPOSED METHOD

In a typical lossy JPEG2000 pipeline the two key steps with potential loss of data are quantization and tier-1 (T1) coding. These two steps come after the the irreversible color and DWT (9/7) transforms. For the lossless case the quantization is reversible and that is why in the earlier version [START_REF] Hayat | An Efficient Data-Hiding Method Based on Lossless JPEG2000 for a Scalable and Synchronized Visualization of 3D Terrains[END_REF] the intervention came immediately after the DWT(5/3) step. For the lossy case we have changed the strategy since quantization is now inevitable. What we did is to interrupt the flow after the T1 coding as shown in Fig. 1.

Description of the Method

In T1 coding, which is the first of the two coding stages of JPEG2000, for each subband, the quantized coefficients are partitioned into rectangular code blocks. The nominal dimensions of a given code block should be dyadic and their product not exceed 4096. The partitioned code blocks are coded independently using the bit-plane coder thus generating a sequence of symbols with some or all of these may be entropy coded 2 . Due to this independent encoding of code blocks, the correspondence between the lossless DWTed DEM and lossy DWTed Y plane of texture is maintainable. The T1 coded symbols from a given block vary in energy and the low index symbols are more energetic than the higher index ones. What we do is to use the least energetic of these symbols, from the tail of the stream for each code block, for LSB embedding implying non-random allocation. There is, however one problem in that the T1 coded symbols have smaller word size resulting in smaller embedding capacity and higher rate of distortion in quality as a result of embedding. This policy is not, however, advised in the lossless case since word sizes of the coefficients are longer at the earlier steps thus leading to lesser distortions as result of embedding. Hence one can embed immediately after the DWT step at the earliest.

The Data Hiding Step

From a N ×N pixel texture image and the corresponding map of m 2 altitudes, we deduce the embedding factor E = m 2 /N 2 coefficients per pixel. The image of texture will, therefore, have to be divided into square blocks of size equal 2 http://www.ece.uvic.ca/∼mdadams/jasper/ Figure 1: Description of the method to ⌈1/E⌉ pixels and every such block would hide one altitude coefficient. In the first place, the T1-coded quantized level L DWTed Y component (say carrier C) of the texture image is extracted from the lossy JPEG2000 pipeline that employs the irreversible Daubechies (9/7) [START_REF] Daubechies | Factoring Wavelet Transforms into Lifting Steps[END_REF]. A discrete wavelet transformation (DWT) is separately applied to the DEM coefficients at the same level L to get the message M, as illustrated in Fig. 1. The implementation of the discrete wavelet transformation (DWT) of the DEM is based on the lifting method [START_REF] Mallat | A Wavelet Tour of Signal Processing[END_REF] that employs the JPEG2000 supported reversible Daubechies (5/3) [START_REF] Daubechies | Factoring Wavelet Transforms into Lifting Steps[END_REF]. It has been ensured that both M and C are at the same level of transformation and embedding is according to the correspondence of subbands, i.e. lower frequency subbands of cover carry the lower subband coefficients of message as illustrated in Fig. 1. One important point to mention is that in this work neither any copyright problem is solved nor is there any threat to the security of message. What we want is to carry out embedding without significant loss in the visual quality of the 3D rendering. At the same time, the hiding capacity is also important since day by day the resolution quality is improving at the expense of data size. Hence, of the traditional requirements of data hiding, we are more particular about perceptual transparency and payload which implies that robustness and tamper resistance are secondary in importance.

To ensure a spatial coherence between the altitudes and the texture, the cover C is partitioned into square blocks of ⌈1/E⌉ coefficients for data embedding and every such block would hide one transformed altitude coefficient of the message M. We thus achieve a synchronization in the embedding as far as the incremental levels of the wavelets are concerned, i.e. low resolution coefficients of the altitude map are embedded in the low resolution subbands of texture whereas high resolution coefficients of the altitude map are embedded in the high resolution subbands. In this way the transmission of the part concerned with the low resolution of the texture map enables us to directly access the corresponding low resolution part of the altitude map. For perceptual transparency, an embedding strategy based on least significant bit (LSB) substitution is proposed. The data embedding is carried out by modifying the LSB's of coefficients of the T1-coded lowest energy symbols resulting in C ′ . The final encoded image (.jp2) thus carries the DEM coefficients hidden in some T1coded symbols from the Y component data.

The Extraction/Reconstruction Step

The above coded image can be utilized like any other JPEG2000 image and sent across any communication channel. The blind decoding is the reverse of the above process. Just before the T1 stage of the JPEG2000 decoder the DEM can be blindly extracted using the above mentioned partitioning scheme. All the DEM bits are LSBs of the lowest energy symbols for each of the given code block from the T1-coded quantized DWTed Y component. One advantage of the method is in the fact that the DEM and texture can be reconstructed with even a small subset of the coefficients of the carrier. The resolution scalability of wavelets and the synchronized character of our method enable a 3D visualization even with fewer than original resolution layers as a result of partial or delayed data transfer. The method thus enables to effect visualization from a fraction of data in the form of the lowest subband, of a particular resolution level. It is always possible to stuff 0's for the higher bands. The idea is to have a 3D visualization utilizing 3L ′ + 1 parts out of the initial 3L + 1 parts (L ′ ≤ L), by stuffing the rest of L -L ′ parts with 0's.

THE SIMULATION RESULTS

We have applied our method to a 2048 × 2048 pixel example 3 texture image (Fig. 2.a) and its corresponding DEM of 64 × 64, 16 bit altitudes implying one altitude per 32 × 32 pixel texture block. By adding a suitable header to the DEM it is converted to a gray-scale image (Fig. We chose to subject the texture to lossy JPEG2000 encoding at L = 5. For the sake of comparison our refer- 3 provided by IGN France (http://www.ign.fr/) ence will be the lossless method reported in [START_REF] Hayat | An Efficient Data-Hiding Method Based on Lossless JPEG2000 for a Scalable and Synchronized Visualization of 3D Terrains[END_REF] wherein the level L transformed DEM coefficients were embedded in the corresponding Y plane texture coefficients. This step is done immediately after the level L DWT step of the lossless JPEG2000 pipeline using a pseudo-random number generator (PRNG) for allocation. The reason for not using the same point of intervention for lossless version has already been explained in Section 2. Level L coded embedded texture image can give L + 1 possible approximation images upon decoding that pertains to resolutions numbered 0, 1, . . . , L in descending order of quality. An L approximate image is constructed from data amounting to 100/4 L % of the total coefficients with the rest of coefficients (missing) being replaced by 0's before inverse DWT. This is true for all the components. Thus, a level 5 image of approximation is constructed only with 0.1% of the coefficients. Since the data hiding method is synchronous, the level of approximation of both the texture and DEM for a given chunk of available coefficients is the same. Fig. 3.a, c and e show the reconstruction of the images of texture by stuffing 0's for higher subbands of the level 1, 3 and 5 lowest subbands and inverse DWTing the result to get the images of approximation. From the corresponding textures, level 1, 3 and 5 respectively, we can extract the hidden data and recon-struct the DEM, as illustrated Fig. 3.b, d and f. One observes that, with a naked eye, degradation in the quality of DEM is more as compared to the texture. A quantitative comparison can be done in terms of the images of difference by observing the measures, like MSE or PSNR, as a function of compression rate. It must be noted, that irrespective of the method used, the results are the same as far as the quality of the reconstructed DEM is concerned. √ MSE against bits per coefficient due to the fact that rather than the whole JPEG2000 encoding only DWT has been applied to the DEM coefficients. Since DEM was losslessly DWTed, the resultant quality is the same irrespective of whether the cover Y texture transformed using lossy or lossless DWT before embedding. Fig. 4.b compares the texture quality with MSE for the proposed method with the previous method [START_REF] Hayat | An Efficient Data-Hiding Method Based on Lossless JPEG2000 for a Scalable and Synchronized Visualization of 3D Terrains[END_REF] in function of the bitrate (bpp). It is pertinent to note that for the same bitrate one gets a better quality texture image with the proposed method. For example, for level 1 extracted and reconstructed texture image, with the previous method [START_REF] Hayat | An Efficient Data-Hiding Method Based on Lossless JPEG2000 for a Scalable and Synchronized Visualization of 3D Terrains[END_REF] one got a PSNR of 31.3 dB and a compression ratio of 5.71. With the proposed method the results are much better because with a PSNR of 31.6 dB we get a compression ratio of 7.19. The 3D visualization with the two methods can be compared by observing Fig. 5. The corresponding 3D visualization images of the original example and the rest of the levels of approximation in case of the proposed method are given in Fig. 6. It can be seen that even with a very tiny fraction (for example 0.2 bpp for level 3) of data one can have a good visualization.

CONCLUSION

In this paper we presented a new method for a scalable 3D terrain visualization through reversible JPEG2000-based blind data hiding. This paper is focused on the topic of data synchronization and scalability. The results reveal that the proposed method offers at least three advantages. First is the synchronized integration of a regular grid of elevations into one whole by the application of data hiding. The second advantage is the scalability in 3D visualization through the utilization of JPEG2000 supported DWT. Last, but not the least, is the integrability of the method with the JPEG2000 encoders to result in a monolithic standalone JPEG2000 format file that eliminates the need to develop any additional technology or data format, thus implying portability and conformance which is asked by our industrial constraints. In addition the approach is cost effective in terms of memory and bandwidths. The results shown in the case of our examples are witness to this fact since even with a tiny number of coefficients a comparatively better 3D visualization was effected. The resolution scalability of wavelets enables this 3D visualization to improve incrementally with the reception of higher subbands. Besides, this property is helpful in realtime environment when quicker transfer of data is required. The results of 3D visualization simulation give a useful insight to the effectiveness of our method in various network conditions.

In the continuation of this work it would be worthwhile to address the fact that loss in quality is not as well marked in the case of texture than in the DEM. Using a desynchronized algorithm, i.e using a subset rather than all of the subbands of Y texture for embedding and lesser DWT decomposition of DEM, would be a good way and should be taken into consideration in the near future. It will be important to explore some other embedding strategies, like the spread spectrum embedding, in order to keep DEM quality high for the reconstruction. As far as triangulation is concerned, there is also every likelihood of using a non-uniform grid on various levels of details, thus allowing a considerable reduction in the number of triangles necessary for a good representation of the terrain.

Figure 2 :

 2 Figure 2: Original data: a) Texture image, b) Corresponding DEM of the texture image.

Figure 3 :

 3 Figure 3: For level 1, 3 and 5 respectively: a), c), e) Reconstruction of the approximation image of texture, b), d), f) From the corresponding texture: extraction of the data and reconstruction of DEM.

Figure 5 :

 5 Figure 5: 3D Visualization based on level 1 approximation images from: a) The proposed method, b) Previous method [3].

Figure 6 :

 6 Figure 6: 3D Visualization based on level L ′ approximation images when level 5 DWTed DEM is embedded in level 5 DWTed texture

In our industrial project, DEM corresponds to a distance of 50 meters between two points.

ACKNOWLEDGMENT

This work was supported in part by the Higher Education Commission (HEC) of Pakistan.


Vincent Velay
email: vincent.velay@enstimac.fr

Thierry Cutard
email: thierry.cutard@enstimac.fr

Nicolas Guegan
email: nicolas.guegan@airbus.com

THERMAL BEHAVIOUR MODELLING OF SUPERPLASTIC FORMING TOOLS

Keywords: Forming tools, thermal behaviour, Finite Element simulation, Experiments

High-temperature operational conditions of super plastic forming (SPF) tools induce very complex thermomechanical loadings responsible to their failure. Various materials can be used to manufacture forming tools: ceramic, refractory castable or heat resistant steel. In this paper, an experimental and numerical analysis is performed in order to characterise the environmental loadings undergone by the tool whatever the considered material. This investigation allows to lead a thermal calculation. It is a preliminary and essential stage to perform the complete thermo-mechanical calculation in order to assess accurate stress levels, or plastic strain occurring during the forming process.

INTRODUCTION

Heat resistant cast steels or ceramic materials are currently used to manufacture SPF tools [START_REF] Branza | Fatigue Damage and Weld Repair of Heat Resistant Cast Steel SPF Dies[END_REF][START_REF] Nazaret | Mechanical Behaviour of Ceramic Materials for SPF Toolings[END_REF]. They allow to form superplastically titanium based sheets. The environmental conditions are severe as the superplastic forming process is carried out at a maximal temperature close to 900°C (inside the heating press) and at a minimal temperature depending on the location at the surface of the die close to 200°C when the mould is pulled out from the heating press to replace the formed component by a new sheet [START_REF] Baleix | Oxidation and oxide spallation of heat resistant cast steels for superplastic forming dies[END_REF]. These thermal cyclic conditions are repeated as many times as necessary to produce the required number of parts to be manufactured during one campaign. They induce mechanical stresses and cyclic plasticity that lead to the failure of the die. These mechanisms are very difficult to evaluate from an experimental point of view. Numerical simulation seems to be an accurate way to reach such information in order to optimise the tool design [START_REF] Gao | Thermomechanical stress analysis of superplastic forming tools[END_REF] and to improve its lifetime [START_REF] Luckey | Design and experimental validation of a two-stage superplastic forming die[END_REF]. So, constitutive models can be developed to reproduce the mechanical behaviour of tools depending on the material used to manufacture the mould [START_REF] Luckey | Design and experimental validation of a two-stage superplastic forming die[END_REF][START_REF] Nazaret | Influence of the mechanical behaviour specificities of damaged refractory castables on the Young's modulus determination[END_REF]. However, the temperature fields have to be first determined precisely during the whole forming process. Indeed, an accurate mechanical behaviour model will not be useful if the thermal gradients within the tool are not well assessed. In this investigation, the thermal environment and behaviour of SPF tools are investigated for both materials commonly used to manufacture SPF dies: a heat resistant steel and a ceramic material. Two geometries combining shapes close to those considered on industrial SPF tools are investigated. The first one considers a heat resistant cast steel whereas the second one is manufactured with a fused silica based ceramic material. For both geometries, temperature measurements are performed on the one hand on an industrial SPF press furnace and on the other hand on a pilot heating facility dedicated to reproduce the cooling-heating operations occurring in the SPF process and developed at the Research Centre on Tools, Materials and Processes (CROMeP). Moreover, thermal simulations of SPF tools are performed and are then compared with the temperature measurements provided both by the industrial press and the pilot heating facility.

EXPERIMENTAL INVESTIGATION

MATERIALS AND TOOLS

Materials investigated are widely used to manufacture SPF tools: a heat resistant cast steel and a fused silica based ceramic are examined. Thermal properties of both materials are presented in tables 1 and 2. The density are not temperature dependant, ρ = 8200 Kg/m 3 for steel and ρ = 1940 Kg/m 3 for the brittle monolithic ceramic. The tool shapes investigated consider severe geometric singularities (hole, humps, ramps …) in order to reproduce the thermal gradients induced in the industrial dies.

THERMAL CYCLES

Thermal cycles typical of the SPF process have been measured on both tools. In situ monitoring of the temperature at the surface of the tool was performed using Kthermocouples as presented in figure 1b. Twenty thermocouples were considered for the heat resistant tool and fifteen for the ceramic one. All of them were welded (steel die) or glued (silica die) at the surface of the tools. One of them was located at bottom surface in contact with the heating platen in order to control the temperature ramp during the heating operations. Different test campaigns were performed on an industrial SPF press (located in AIRBYS St-Eloi plant) and also on the CROMeP pilot facility. Thermal cycles investigated are representative to the industrial ones with a cooling time between 2 and 10 minutes. Several phases can define a test campaign (see figure 2). The first stage consists in a slow increase of the temperature till 900°C. The stage n° 2 includes a temperature stabilisation (FT) followed by the heating press opening to allow the tool pull out and implies a cooling of the part (C + HT). Finally, the die is pushed into the furnace again that induces an increase of the tool surface temperature (H). The stage 2 is repeated as many time as necessary to produce the required number of components. Last, the stage 3 considers the end of the campaign with a slow decrease of the temperature towards the room temperature. The thermal cycles defined in the stage 2 consider a heating time around two hours in order to ensure a thermal stabilisation after the furnace charging. This stage is repeated eleven times on the industrial SPF press and twice on the CROMeP heating facility both for the heat resistant steel and for the ceramic mould.

RESULTS

For all campaigns, the heating platens were fixed to a temperature of 900°C. The heating time was calculated in order to obtain a temperature gap between the minimal temperature (at the surface of the mould) and the maximal temperature (at the bottom) not exceeding 10°C. The figure 3 illustrates typical thermal cycles undergone by the cast steel die for different cooling times between 2 and 10 minutes. Two thermocouple locations are examined. The first one considers the temperature field monitored in a hole and the second one monitored in a hump. In this last case, a minimal temperature around 550°C is reached for a cooling time of 10 min whereas a minimal temperature around 700°C is provided by the thermocouple welded in the hole. Figure 3 concerns thermal tests performed on the industrial SPF press. Several cycles were performed, a cyclic stabilisation was observed. Moreover, the same experimental campaign was conducted twice and a good repeatability was obtained whatever the considered tool. These tests were also conducted on the CROMeP heating facility. Figure 4 shows a comparison of the thermal cycles provided by the two devices set up at the same location, for the ceramic mould and two cooling times (2 and 10 min). A good correlation between the two cycles can be noticed for the cooling operation. However, some differences were observed during the heating phase with a temperature rate provided by the CROMeP heating facility more important as illustrated in figure 4. Indeed, the thermal environment is not exactly the same for both devices, so that the thermal gradient induced into the tool is less important in the case of the industrial press. Whatever the locations investigated at the surface of the metallic or ceramic tools, the same conclusions can be formulated. These experimental thermal cycles allow to characterize the thermal environment of SPF dies and to validate a Finite Element model able to assess the cyclic thermal gradients induced in the moulds and responsible for the tool damage.

THERMAL CALCULATION

MODELLING

Both geometries were meshed with linear tetrahedron element types. As the global size of the metallic tool is twice as important, Finite Element models generated consider about 102000 degrees of freedom (dof) for the metallic mould and 75000 dof for the ceramic die. Figure 5 shows the Finite Element meshes of the metallic and ceramic tools. The heat transfer analysis is performed with ABAQUS  software. It combines conduction, convection and radiation to describe the different stages of the SPF process. Equation 1 is considered to perform an uncoupled heat transfer analysis:

(1)

where ρ, λ and C p are the thermal material properties presented in the previous section. T is the temperature field, V is the volume of the tool and r is the heat supplied externally into the body per unit volume. Several thermal boundary conditions have to be considered. First, in order to reproduce the heating operation, prescribed temperature T is specified on the surface of the tool in contact with the lower heating platen whose value is provided by thermocouple welded at this location. Second, prescribed surface heat flux allows to consider surface convection and to take into account the cooling of the part, it can be described by equation 2:

(2) where h is the film coefficient and T ∝ the sink temperature. Last, surface radiation was taken into account by equation 3 in order to describe the heat losses during the cooling phase and the temperature increase during the heating phase:

(3) where A the constant radiation (emissivity times the Stefan-Boltzmann constant) and T Z is the absolute zero. An initial temperature equals to 900°C was considered for all the simulations. So only stationary calculation is considered and thermal cycles are assumed to be stabilized. Moreover, the first temperature increase at the beginning of the SPF campaign the last decrease at the end were not investigated.

RESULTS

Emissivity of metallic material was considered as equal to 0.82 and to 0.5 for the ceramic one. The sink temperature was selected to be 25°C corresponding to the ambient temperature during the cooling stage and 900°C during the heating stage corresponding to the hearth temperature. Moreover, experimental thermal cycles allow to determine an uniform film coefficient at the surface of the tools close to h = 5W/m 2 /K. For the radiation conditions, a sink temperature of 25°C is considered for the cooling phase and 900°C for the heating stage. Last, temperature evolution monitored by the thermocouple welded on the surface in contact with the bottom was applied to simulate the thermal loading/unloading. Figure 6 illustrates a comparison between experimental and calculated thermal cycles at different locations at the surface of the metallic mould. agreements between experimental and numerical responses are obtained for the other locations at the surface of the tool. Moreover, the same investigation conducted on the ceramic mould leads to the same conclusions (figure 7). Figure 8 presents the temperature maps for both forming tools at the end of the cooling (10 min). It is obvious that the maximal temperature is obtained at the lower surface of the mould, surface in contact with the heating platen, whereas the minimal temperature occurs at the upper surface specifically in the corners of the die and on the hump. A maximal temperature change of 225°C between the hottest and coldest conditions is calculated. Same observations can be formulated for the ceramic tool, but the maximal temperature change increases up to 550°C. Repeated thermal loadings induce a cyclic plasticity (metallic mould) and high stress levels (ceramic mould) responsible for the tool damage. In order to reproduce the thermo-mechanical loading of SPF dies, it is quite necessary to well assess the thermal gradient induced into the tools during the forming process. Otherwise the thermo-mechanical calculation will not be efficient to obtain accurate strain and stress levels even if the mechanical model used to describe the material behaviour (metallic or ceramic) is relevant. This was the main objective of this study. Hence, the next part proposes an example of thermo-mechanical calculation that intends to reproduce the complete super plastic forming cycle.

THERMOMECHANICAL ANALYSIS

In this part, only the heat resistant cast steel is investigated. The mechanical approach used to reproduce the material behaviour was investigated in the PhD work of Martinier [START_REF] Martinier | Durée de vie des aciers réfractaires pour outillages SPF : essais et simulations[END_REF]. A viscoplastic model is used. It is able to take into account strain rate and dwell time effects that becomes very important at high temperature. This model was implemented in ABAQUS  software using Z-mat library [START_REF]reference manual[END_REF]. An uncoupled Finite Element simulation is considered, it consists in reading the temperature map provided by the pure thermal simulation. Thus, an example of a complete Super Plastic Forming cycle can be simulated. First, an initial temperature of 900°C is considered into the tool (isothermal steady state). Moreover, the floor that supports the die is considered to be a rigid surface. Then, the calculation can be divided into 5 different stages:

-stage 1 (4s): a pressure of 2 MPa is applied on the edges of the upper surface, it reproduces the clamping pressure of the sheet -stage 2 (3600s): the forming pressure is applied on the whole upper surface to simulate the sheet forming -stage3 (4s): all pressures are released -stage 4: the mould is pulled out from the heating press, it corresponds to the cooling phase -stage 5: the mould is pushed into the press again to form a new component.

Stages 1 to 5 illustrate a complete SPF cycle. The simulation of the first forming cycle was performed, it allows to conclude that a slight plasticity occurs during the clamping pressure application (Stages 1 to 3). But the maximal plasticity and stress concentrations occur at the end of the cooling phase. So, stage 4 seems to be the most damaging step of the forming process cycle. Figure 9 illustrates the von Mises stress and equivalent plastic strain maps at the end of the cooling stage (2 min). Then, the critical locations where the tool could be preferentially cracked can be determined. This methodology can be applied to perform design optimisation of industrial dies. It would consist in modifying the shape in order to reduce the cyclic plasticity and the stress concentrations in the tool and consequently would allow to increase the lifetime.

CONCLUSION

A methodology to describe the thermal behaviour of SPF dies was developed. It considers two materials used to manufacture SPF tools. It includes a complete experimental investigation providing in-situ temperature measurements at different locations on the surface of the moulds. Two main experimental campaigns were conducted, on an industrial press and on a laboratory heating facility. It allows to validate the different parameters required by the numerical simulation (film coefficient, sink temperatures, emissivity …). This work is an important preliminary stage before performing the thermomechanical calculation of a complete Super Plastic Forming cycle. One example is given for a heat resistant cast steel mould. A mechanical model developed in non isothermal conditions [START_REF] Martinier | Durée de vie des aciers réfractaires pour outillages SPF : essais et simulations[END_REF] was used to run the Finite Element simulation. So, the critical locations can be assessed in terms of cyclic plasticity or stress concentration. This approach can constitute an efficient numerical way to optimise the mould design in order to increase its lifetime.

  Figure1: a: Silica based ceramic die; b: cast steel die

Figure 2 :

 2 Figure 2: Description of the different stages of a SuperPlastic Forming campaign

Figure 3 :

 3 Figure 3: Thermal cycles at different locations at the surface of the tool for several cooling times

Figure 4 :

 4 Figure 4: Comparison of the thermal cycles provided by the industrial SPF press (dot lines) and those obtained with the CROMeP heating facility (continuous lines) in the case of the ceramic die)

Figure 5 :

 5 Figure 5: Finite Element meshes of the metallic (a) and (b) tools

Figure 6 :

 6 Figure 6: Comparison of experimental and calculated thermal cycles for two different at the surface of the metallic mould (hole and hump)

Figure 7 :

 7 Figure 7: Comparison of experimental and calculated thermal cycles for two different at the surface of the ceramic mould (hole and hump)

Figure 8 :

 8 Figure 8: Calculated temperature fields at the end of the cooling operation: (a) steel and (b) ceramic moulds

Figure 9 :

 9 Figure 9: Calculated von Mises stress and equivalent plastic strain maps at the end of the cooling phase.

Table 1 :

 1 Thermal properties of heat resistant cast steel

	Temperature [°C]	20	100	200	300	400	500	600	700	800	900	1000
	Specific
	Heat Cp	415	442	464	481	498	520	561	571	581	595	610
	[J/kg/K]
	Thermal
	Conductivity λ [W/m/K ]	9	11	13	14	16	18	21	23	24	26	28
	Table2: Thermal properties of fused silica based ceramic
	Temperature [°C]	20		100		200		500		600		900
	Specific Heat Cp [J/kg/K]	737	856		1002	1240		1340		1650
	Thermal
	Conductivity λ [W/m/K ]	0.91	1.05		1.14		1.45		1.54		1.87

ACKNOWLEDGEMENTS

Authors gratefully acknowledge E. Jourdain and B. Mottet for their contribution in the experimental and numerical thermal investigations.


Romain Brisse

Simon Boche

Frédéric Majorczyk

Jean-Francois Lalande

KRAKEN: A Knowledge-Based Recommender system for Analysts, to Kick Exploration up a Notch

Keywords: Attacks and Defences, Intrusion detection and prevention system, Digital Forensics

During a computer security investigation, a security analyst has to explore the logs available to understand what happened in the compromised system. For such tasks, visual analysis tools have been developed to help with log exploration. They provide visualisations of aggregated logs, and help navigate data efficiently. However, even using visualisation tools, the task can still be difficult and tiresome. The amount and the numerous dimensions of the logs to analyse, the potential stealthiness and complexity of the attack may end with the analyst missing some parts of an attack. We offer to help the analyst finding the logs where her expertise is needed rapidly and efficiently. We design a recommender system called KRAKEN that links knowledge coming from advanced attack descriptions into a visual analysis tool to suggest exploration paths. KRAKEN confronts real world adversary knowledge with the investigated logs to dynamically provide relevant parts of the dataset to explore. To evaluate KRAKEN we conducted a user study with seven security analysts. Using our system, they investigated a dataset from the DARPA containing different Advanced Persistent Threat attacks. The results and comments of the security analysts show the usability and usefulness of the recommender system.

Introduction

IT systems are the target of an ever-growing number of attacks. Their complexity ranges from simple attacks like brute-force or DDoS, to complex APT. To defend those systems, IT organizations implement CSOC (Computer Security Operation Center) [START_REF] Zimmerman | The strategies of a world-class cybersecurity operations center[END_REF] where security analysts try to understand what happens in the monitored systems and to react accordingly. Among popular inputs there are security alerts raised from IDS (Intrusion Detection Systems) [START_REF] Denning | An intrusion-detection model[END_REF][START_REF] Roesch | Snort: Lightweight intrusion detection for networks[END_REF][START_REF] Paxson | Bro intrusion detection system[END_REF]. Their goal is to detect suspicious activities that are symptoms of an intrusion. Then, a security analyst is in charge of investigating if alerts are related to a real attack.

To complement IDSs, visualisation tools [START_REF] Foresti | Visalert: From idea to product[END_REF][START_REF] Theron | Network-wide intrusion detection supported by multivariate analysis and interactive visualization[END_REF][START_REF] Fischer | NStreamAware: real-time visual analytics for data streams to enhance situational awareness[END_REF][START_REF] Cappers | Snaps: Semantic network traffic analysis through projection and selection[END_REF][START_REF] Ulmer | Netcapvis: Web-based progressive visual analytics for network packet captures[END_REF][START_REF] Beran | Exploratory analysis of file system metadata for rapid investigation of security incidents[END_REF] have been developped to identify attacks in the data. Among those tools, some have focused on log visualisation [START_REF] Humphries | Elvis: Extensible log visualization[END_REF][START_REF] Humphries | CORGI: Combination, organization and reconstruction through graphical interactions[END_REF]. Because of the complexity of monitored systems, the quantity of events logged and their complexity, the necessary time to investigate is too long [START_REF] Cremilleux | VEGAS: Visualizing, exploring and grouping alerts[END_REF]. Visualisation systems also require extensive field knowledge to be used efficiently [START_REF] Bertin | Semiology of Graphics: Diagrams, Networks, Maps[END_REF]; as a consequence, users have to learn their usage.

Recommender systems have been proposed as a complementary approach to visualisation tools to address these issues. They are mostly designed to help the user choose a better representation of the data [START_REF] Mackinlay | Show me: Automatic presentation for visual analysis[END_REF][START_REF] Vartak | Seedb: automatically generating query visualizations[END_REF][START_REF] Wongsuphasawat | Voyager: Exploratory analysis via faceted browsing of visualization recommendations[END_REF][START_REF] Wongsuphasawat | Voyager 2: Augmenting visual analysis with partial view specifications[END_REF][START_REF] Hu | VizML: A Machine Learning Approach to Visualization Recommendation[END_REF]. These approaches are not specific to security investigations and require advanced knowledge and practice in terms of visualisation. Visualisation recommendation [START_REF] Nunnally | NAVSEC : a recommender system for 3d network security visualizations[END_REF] has also been studied for security purposes. In [START_REF] Nunnally | NAVSEC : a recommender system for 3d network security visualizations[END_REF], the authors focus on designing a visualisation tool that can better guide analysts during their work. However, these solutions have their shortcomings such as the lack of reliable data to make recommendations, the heterogeneity and quantity of data to explore. They also suffer from specific issues, such as the cold start problem [START_REF] Park | Pairwise preference regression for cold-start recommendation[END_REF], where the recommender system has not gathered enough data to make relevant decisions yet.

In this paper we present a recommender system that helps the analyst in her visual investigation by suggesting exploration options, either to test a hypothesis on the incident, or to analyse another part of the logs that has not been explored yet. The proposed recommender system does not require any input from past usage of the visual tools it is based on. It uses a knowledge base of adversary tactics and techniques extracted from real-world observations: the MITRE ATT&CK matrix 4 . Finally, we present an evaluation of our recommender system based on a campaign of investigations conducted with seven security experts.

The rest of the paper is organised as follows. Related work is discussed in Section 2. Context about visualisation and investigations in security is explained in Section 3. Section 5 details the dataset used for the evaluation, the user interviews and then discusses results. Finally, in Section 6, we conclude the article and discuss future work.

Related work

To help analysts during security investigations, many visualisation tools have been proposed by the research community to analyse various event data such as network logs [START_REF] Ulmer | Netcapvis: Web-based progressive visual analytics for network packet captures[END_REF][START_REF] Cappers | Snaps: Semantic network traffic analysis through projection and selection[END_REF], DNS logs [START_REF] Romero-Gomez | Towards designing effective visualizations for DNS-based network threat analysis[END_REF], system logs [START_REF] Humphries | Elvis: Extensible log visualization[END_REF][START_REF] Humphries | CORGI: Combination, organization and reconstruction through graphical interactions[END_REF] or file system metadata [START_REF] Beran | Exploratory analysis of file system metadata for rapid investigation of security incidents[END_REF]. These methods allow a faster and easier investigation giving the analyst the possibility to query and visualise large amount of complex data. They however require significant expertise in both security and visualisation techniques. Recommender systems are starting to be used used to tackle that issue.

Historically, recommender systems [START_REF] Jannach | Recommender systems: an introduction[END_REF][START_REF] Ricci | Introduction to recommender systems handbook[END_REF] have been used by commercial websites to present a user with a set of relevant options such as new books to read or new TV shows to watch. Recommender systems can base their recommendations on similarities between user profiles, item metadata, or even domain knowledge [START_REF] Adomavicius | Toward the next generation of recommender systems: a survey of the state-of-the-art and possible extensions[END_REF][START_REF] Burke | Knowledge-based recommender systems[END_REF]. However, some kind data, such as user profiles of item values often cannot be used in the security field because it cannot be allowed to be retained due to its sensitivity. The recommender system has to rank the different options extracted from the data, generally by computing a score for each option and by presenting a subset of the options to the end user: recommendation candidates. Their goal is to help users make better and faster decisions by presenting them with relevant options.

Outside cybersecurity, previous work combines recommendations with visualisation [START_REF] Wongsuphasawat | Voyager: Exploratory analysis via faceted browsing of visualization recommendations[END_REF][START_REF] Wongsuphasawat | Voyager 2: Augmenting visual analysis with partial view specifications[END_REF][START_REF] Cui | Datasite: Proactive visual data exploration with computation of insight-based recommendations[END_REF][START_REF] Vartak | Seedb: automatically generating query visualizations[END_REF][START_REF] Hu | VizML: A Machine Learning Approach to Visualization Recommendation[END_REF]. When a recommender system is used with a visualisation system, the recommendations are mainly used to offer to the analyst the more useful representations. This can be seen as an extension of work about automatic representation [START_REF] Mackinlay | Automating the design of graphical presentations of relational information[END_REF][START_REF] Mackinlay | Show me: Automatic presentation for visual analysis[END_REF]. The recommendations can be computed using statistical and perceptual measures [START_REF] Wongsuphasawat | Voyager: Exploratory analysis via faceted browsing of visualization recommendations[END_REF][START_REF] Wongsuphasawat | Voyager 2: Augmenting visual analysis with partial view specifications[END_REF] or using machine learning [START_REF] Hu | VizML: A Machine Learning Approach to Visualization Recommendation[END_REF]. As a consequence multiple visualisation options are offered to a user, which has to decide which one is the best suitable to her needs. We believe that the required level of expertise is too high to be usable in real use cases. Therefore, this paper introduces a recommender system that helps to make the best use of a security visualisation tool instead of recommending the best possible representations of security data.

Only few works are related to the visualisation of security data enhanced by a recommender system [START_REF] Nunnally | NAVSEC : a recommender system for 3d network security visualizations[END_REF][START_REF] Zhong | A cyber security data triage operation retrieval system[END_REF]. Li et al. focus on security risk analysis and offer defensive measures recommendations [START_REF] Li | What data should i protect?: recommender and planning support for data security analysts[END_REF]. Zhong et al. [START_REF] Zhong | A cyber security data triage operation retrieval system[END_REF] present a recommender system aiming to help tier 1 analysts in CSOC with data triage, based on the experience of senior analysts. These two contributions need reliable data and have to face the cold start problem. The closest work to ours is NAVSEC [START_REF] Nunnally | NAVSEC : a recommender system for 3d network security visualizations[END_REF], a recommender system integrated with a 3D visualisation tool [START_REF] Nunnally | P3d: A parallel 3d coordinate visualization for advanced network scans[END_REF] for network data. During the investigation, NAVSEC will regularly offer to the security analyst a set of interactions with the 3D visualisation tool so as to discover a possible intrusion. The best interactions are selected by a nearest-neighbor approach based on a database of previous investigations conducted by an expert security analyst. NAVSEC is a collaborative recommender system; it does not consider the user's need or query in the recommendations and does not benefit from the accumulated knowledge on attacks. The nearest-neighbor approach also relies on data from past investigations, which makes this recommender system suffer from the cold start problem [START_REF] Park | Pairwise preference regression for cold-start recommendation[END_REF] as well.

Visualising and investigating

In this section we discuss the nature of logs and summarise the principles of an investigation. Then, we briefly describe ZeroKit, a visualisation tool that an analyst can use to explore logs. ZeroKit is the technological base of our recommender system presented in Section 4.

Log investigation

Log files contain a list of events generated by a monitoring tool such as an ids or any program that records events, such as a smtp or a web server. Each event is composed of multiple different fields. A field has a data type and a value. To efficiently describe log data, we use data types as defined by Elastic Common Schema (ECS) 5 . Typically, in security investigations we use from a dozen up to 50 data types, such as ip or action.

Investigating consists in finding potential threats, risky behaviours, or security flaws by analysing the provided logs. During those investigations, analysts explore multiple log sources; some have common data types: pivot types. Pivot types are common data types that allow the user to navigate between log files when they study interesting values. Navigating in the data is more convenient when a visualisation tool offers an understandable frontend. In the following section, we present the tool used in this paper to perform the investigations.

ZeroKit

ZeroKit is a collaborative log analysis and incident response tool, aiming to put data visualisation at an analyst's disposal. An analyst can explore logs through interactive and reactive data visualisation. The three main actions she can do in ZeroKit are visualising the distribution of values of a data type, filter by a value or filter using time. Each action operated by the analyst refreshes the visualisation panes. Thus, a sequence of actions constitutes a path of exploration, and the user can navigate along this path by doing new actions or going back by undoing some. Additionally, to mark an item of interest, an analyst can flag an item such as an ip address and add context by choosing a severity: safe, suspect or danger. It shows the discovery of an attack artifact, or on the contrary, the absence of findings. The decision about severities will be the starting point of the recommendation, and is discussed later.

The following example illustrates some steps of an investigation of the VAST 2012 dataset6 using ZeroKit. It is composed of the logs from an IDS monitoring the network of a small enterprise and the logs from the border router. Analysing the logs from the router, the analyst observes many connections to the TCP port 6667. That port is related to IRC, which is not a commonly used protocol in an enterprise environment. Those connections are thus suspicious and the analyst flags this value as suspect. She needs now to confirm that the activity related to this destination port is linked to an attack or not. At that point of the investigation, there are still 43 thousand events related to that destination port and the whole process can take hours.

Recommendation

Our goal is to enhance ZeroKit by offering recommendations about the next step the analyst should take to confirm or deny her hypotheses. Offering a potentially relevant path for exploration can save a significant amount of time to analysts during an investigation. Using security knowledge as the base for making recommendations, KRAKEN can rapidly help the analyst confirming or denying that she found an attack by using real expertise, without the issue of collecting the data first. It also provides assistance in the investigation without requiring non-security expertise such as complex visualisation processes.

Recommender system

We built KRAKEN as a knowledge-based recommender system [START_REF] Burke | Knowledge-based recommender systems[END_REF]. As knowledgebased recommender systems take the user's query and domain knowledge as inputs, they do not suffer from cold start. Similarly to other recommender systems [START_REF] Ricci | Introduction to recommender systems handbook[END_REF], KRAKEN tries to ensure three properties:

-R1: Enhance user efficiency and rapidity in their tasks.

-R2: Offering recommendations at a relevant time, without any disturbance.

-R3: Making sure to avoid overlooking important information.

Recommendation process

Figure 1a shows the recommendation process of KRAKEN. First, when an analyst flags a value as safe, suspect or danger, KRAKEN triggers the recommendation process. Recommendations use a Similarity scoring process to compute recommendations. Recommendation are also computed using Multi-Attribute Decision-Making (MADM) in one case, as discussed in Section 4.4. Both those methods use the knowledge base as input. Finally, the three best candidates are displayed to the analyst.

Recommendation triggers

In general, guessing the true intent of the user in a visual tool is complex. Too many actions are possible and depending on the context the same action can have a different intent. In our work, we focus on the action of flagging a value with a severity, because it is the closest action related to a security decision we can find from an user. It allows us to make hypotheses about his opinion as an expert. We trigger a recommendation when the user puts a flag that represents a specific intent (R2):

1. A suspect flag means that the analyst needs more information before deciding whether the value is linked to malicious activity or not. 2. A danger flag means that a threat artifact has been found and, as such, ends this part of the investigation. The analyst wants to direct his attention somewhere else. 3. A safe flag means that the threat has not been found yet, or that there is none. The analyst wants to take a look at the situation from another angle.

Knowledge base

ATT&CK's goal consists in recording detailed, real and observed adversarial techniques and to categorise them in tactics. It is used to characterise security threats, and as a common and shared vocabulary with all cybersecurity actors. Each specified adversarial technique includes many usable attributes, and notably sources of logs where they can be observed. We mapped these sources to the data types defined by ECS 7 . The resulting knowledge base allows us to gather data types useful to observe attacks within logs.

To illustrate the use of the ATT&CK matrix for spawning recommendations, we show in Figure 1b an extract of the knowledge base that corresponds to the use case of Section 3.2. That extract shows that the port data type is associated with the "Packet Capture" source, in turn associated with the technique "nonapplication layer protocol". From there, we can select all the data sources linked to the technique ("Network Intrusion Detection System" in the example) and all data types linked to them: "Severity" and "Category". The analyst was analysing suspect traffic coming from IRC, and upon flagging the port as suspect, she is given the recommendation containing the "Severity" and "Category" data types. By following these recommendations the analyst finds alerts raised by the NIDS about attempted information leaks and corporate policy violations. The scored data types return three best candidates from Dt best

Decision-making

To compute the recommendations, we implemented a decision-making algorithm that uses as input the knowledge base presented in the previous section and the severity of the flag. In the case of a safe or danger flag, we only used a Similarity scoring method, whereas for a suspect flag we implemented MADM, on top of the similarity score. We did so because we needed to score techniques from the knowledge base, and their attributes are far more complex and less comparable than those of data types.

Algorithm 1 shows how recommendations are generated. The decision-making process is developed in further sections hereafter. All functions that appear in this algorithm represent queries to the knowledge base. Data types categorised as irrelevant in function FilterIrrelevantDataTypes() are those that are not present in the investigation, those who only have one value through the dataset and the flagged data type itself.

MADM Due to their complex attributes, technique objects from ATT&CK8 are difficult to rank. We choose an additive Analytical Hierarchy Process (AHP) [START_REF] Afshari | Simple additive weighting approach to personnel selection problem[END_REF][START_REF] Ishizaka | Influence of aggregation and measurement scale on ranking a compromise alternative in ahp[END_REF] to do so: the Simple Additive Weighting (SAW).

Simple Additive Weighting is a decision-making process that relies on partial orders determined by our security knowledge, to compute a score. We use the attributes associated to a technique as a list of criteria (i.e. platforms, permissions, network requirements, frequency, mitigation and data sources). The process is divided into two phases: the creation of a consistent Pairwise Comparison Matrix (PCM) [START_REF] Kou | Pairwise comparison matrix in multiple criteria decision making[END_REF] and the computation of candidate scores, which is executed each Fig. 2: A flowchart of the scoring process using similarity time a recommendation is needed. After verifying that it is indeed consistent, this matrix is used to compute an overall weight for each criterion. From there we can score candidate techniques. Each of these steps are described in more detail in the appendices.

Similarity Figure 2 shows how a data type's attributes are scored using our Similarity scoring process. The reference data type is the data type of the value that was flagged by the analyst. All attributes are scored separately. A final score is computed using a weighted sum of all previously obtained sub-scores. For example, the prefix score is computed using the Jaccard similarity between the prefixes set present in the candidate date type and the prefixes set present in the reference data type. Prefixes are all the values that can precise a data type, such a "source" or "event". Common sources refer to the ATT&CK data sources and are scored in the same manner as prefixes. The presence and pivot attributes check if the data type is already present in the investigation and if it can be used as a pivot between already available log files in the investigation. The interestingness is a ratio of data sources where this data type can be recorded over all possible data sources. It is essentially an inverse rarity. Once we have all subscores, we evaluated their relative importance and determined weights, which we apply to them to compute the final score. If the final score between two data types approaches zero, the data types are similar, and dissimilar if the score approaches one.

Evaluation

We conducted an evaluation to gather feedback on how well KRAKEN met the requirements R1, R2 and R3. In security it is difficult to find enough experts to get a strong statistical result. Consequently, the evaluation is mostly qualitative. Table 1: APTs present in the TC3 dataset

Datasets

For the evaluation we use a subset of the tc3 (Transparent Computing exercise 3) dataset 9 . tc3 has been released by the darpa as part of their "Transparent Computing" program. The subset of tc3 that we used was captured in identical conditions, but at a much smaller scale in order to limit the number of threats to find during the evaluation. This subset contains 19.5 million system call events, from one machine, targeted by the APTs. The data types that can be found in this subset are grouped in different object types: file, memory, network, unnamed pipes, and sinks. The subset contains two APT described in Table 1. The two Firefox exploits aim to gain access to the machine, while SSH is used for network discovery. Wget is used to exfiltrate data. Pine is an old text-based email client here used to provide a backdoor into the machine and spread a malware: tcexec.

Experimental setup

After a short presentation of our work on recommender systems, we asked the participants about their experience in cybersecurity. We also asked if they had some previous experience in csoc or with a siem, in order to classify them in three categories: low, medium and high experienced analysts. Then, we did a rapid presentation of the subset of tc3 used for the investigation. Next, we demonstrated the key features of ZeroKit. After their investigations, we collected their feedback through a qualitative interview.

Qualitative interview

The discussion was informal, yet we guided the participants to obtain answers to specific questions, each trying to assess a different aspect of KRAKEN. They are enumerated thereafter:

Q1. Usefulness (R1): were the recommendations useful to your investigation? Q2. Efficiency (R2): did KRAKEN help you gain efficiency in your search? Q3. Relevance (R2): did KRAKEN offer you relevant recommendations? Q4. Tool future: in the future would you use KRAKEN during investigations? Q5. Clarity (R3): did you find the recommendations clear and easy to grasp? Fig. 3: Answers of evaluation participants to the questionnaire

Quantitative measures During all the investigations, we collected traces of user actions. The main variables we recorded and used to analyse the investigations are: number of flags, recommendations, followed recommendations and the proportion of threats discovered during the 25-minutes investigation. Each step has a discovery threshold, and the threat coverage is computed from the number of attack steps found by each participant. These measures help us quantify the usefulness of the recommendations. Table 1 shows the statistical importance we gave to each attack step in regards to the overall threat coverage.

User feedback

Figure 3 shows the answers of the participants to the questionnaire from Section 5.2. The white dot shows a positive answer, the black a negative one and the black and white a mitigated answer. The majority of participants affirms that KRAKEN was useful to them and accelerated them during this investigation. They found the recommendations useful as they helped them progress in their investigations. In terms of efficiency, their feedback is consistent with the fact that they were all able to find parts or all of the APTs in only 25 minutes. The answers given by participant seven can be explained by his low experience as an analyst. During his investigation, he had little idea of how to proceed so he could not make use of the tool properly.

The results show that all the participants were enthusiast about the future of the tool. They all saw the benefits in terms of efficiency during an investigation that this research suggests (R3). They agreed to say that this tool helped them get better coverage of the dataset and guided them in the right direction.

The sore spot of the evaluation was the clarity of recommendations. All users felt that they were not highlighted enough in the interface (R3). However, once familiar with the investigation interface, they were all able to use KRAKEN properly and even said it did not cause unwanted distractions during their work. Table 2: Recommendation relevance according to its associated severity distinct data types concerned by those recommendations, the ratios of relevant recommendations and the ratios of recommendations followed by the analyst over the total number. All recommendations triggered by a suspect flag were relevant (R2). The results for the danger and safe severity are less categorical. The recommendations triggered by a safe flag seems to have mostly provided the participants with relevant recommendation according to our hypotheses. On the other hand, the recommendations triggered by a danger flag were less relevant.

Recommendation relevance

Most suspect flag recommendations were followed, showing that not only we were able to provide relevant recommendations, we were also able to convey them to the analyst properly. Safe flag recommendations were also followed 60% of the time, meaning that we have mostly well interpreted the analyst's intent for it. However, the danger flag recommendations are only followed 12.5% of the time. We noticed that analysts would often flag as danger and then start back from that point to find other threats, possibly linked to the one already found.

Providing assistance to investigations

Figure 4 is a scatter plot of the overall threat coverage in function of the proportion of recommendations followed for each analyst. The analyst's experience is also represented by a colour.

Figure 4 shows that participant seven, who had little to no experience found few attacks in the dataset and did not use the recommendation, as discussed previously. However, the rightmost point shows that by selecting a majority of recommendations, the experienced analyst achieved very satisfying results (R2).

Figure 4 also shows that, in the case of mid-level experts, the recommendations do not help the analysts discover more than 50% of the threats. While 50% of threat coverage is a good result in 25 minutes, even if our prototype offers relevant recommendations, interpreting them still requires expert skill.

Conclusion

During the last few years, new tools have been designed to help security analysts in their investigations using visualisations recommendation. However, analysing security incidents is still a tiresome task. Exploration recommendations using expert knowledge can significantly help analysts.

In this paper, we presented a recommender system aiming to help the security analyst in her investigation. KRAKEN suggests new paths to explore within log Fig. 4: Overall threat coverage discovered by each analyst correlated with the proportion of followed recommendations data. It is composed of a knowledge base linking techniques, tactics, data sources and data types, two scoring processes and several recommendation triggers.

We evaluated KRAKEN with seven cybersecurity experts, whose experience as analysts were various. Our evaluation shows that recommendations are relevant most of the time, and when followed help security analysts during incident response. Participants to the evaluation also noted that the recommender system did not distract them during their investigations while providing insight.

Following the feedback from the evaluation, we implemented some features enhancing user experience such as a history of recommendations and a better explanation of the recommendations. This lays the groundwork for a future evaluation on a larger scale, with non security specialists. The results of such a study will help us reach a better understanding of all possible use cases for KRAKEN. Since we saw that the user intent associated with a severity is more complex than we thought, a larger pool of participants could better frame user intents.

In the near future we aim to work on some technical issues that we identified during the development and the evaluation of KRAKEN as well as larger issues. For example, the SAW decision-making model is known to overrate objects that have extreme values. Later on, we would also like to hybridise [START_REF] Burke | Hybrid web recommender systems[END_REF][START_REF] Burke | Hybrid recommender systems: Survey and experiments[END_REF] other types of recommender systems with KRAKEN. For example, a collaborative filtering recommender system would allow to include user actions from past investigations. With that hybridisation, recommendations would be based on user habits, expertise and commonly relevant investigation paths as well as expert knowledge, and so could be more useful to analysts.

2. Find the maximum inconsistency by taking the maximum possible eigenvalue. 3. Calculate the consistency index:

CI = (λ m ax -n)/(n -1)
where n is the matrix size. 4. Finally, compute the Consistency Rate (CR): CR = CI/RI with RI the Random Index for consistency, or, in other words, the average consistency obtained when filling the PCM at random. If CR is inferior or equal to 0.1, then the matrix is considered consistent. This operation is only necessary once. From the moment a PCM is determined to be consistent, it can be used in the decision-making process.

We computed different PCMs using our own security expertise and checked their consistency. We found that trying to generally rank the criteria gave back large inconsistencies in our matrices. So, we focused on more specific security goals when deciding the importance of a criteria, such as detection difficulty and accessibility. Table 4 shows one of the resulting (and consistent) matrices we built. Table 4: Designing a consistent PCM using our own knowledge

Compute scores Reaching this step, scores are computed every time a recommendation is requested, using the PCM that was previously determined to be consistent.

1. For each scored attribute of each candidate s, apply the following formula (for positive scores only) within the n * m matrix composed of m candidates and n criteria: s ij = r ij /r * j with i = 1, ..., m, j = 1, ..., n, and r * j being the maximum value of r in column j.

2. The total score is the sum of each attribute's score, multiplied by its previously computed weight.

Relative and absolute scoring The scores use the maximum recorded value among the candidates for each criterion, and not the maximum possible value. This is to avoid cases where we would obtain bad scores for every candidate.

  Fig. 1: KRAKEN

  Algorithm 1 Our recommendation algorithm AllT echniquesLinkedT o(Ds0) if severity is suspect then for all techniques in T all do perform MADM scoring. T best ← scored technique T best ← OrderByScore(T all ) The best scored techniques Ds0 ← Ds0 + AllDataSourcesLinkedT oBestT echniques(T best ) Dt all ← AllDataT ypesLinkedT o(Ds0) Dt f iltered ← F ilterIrrelevantDataT ypes(Dt all ) for all data types in Dt f iltered do perform Similarity scoring. Dt best ← scored datatype Dt best ← OrderByScore(Dt best )

	procedure Recommendation(dt0)	With dt0: flagged data type
	Ds0 ← AllDataSourcesLinkedT o(dt0)
	T all ←

Table 2

 2 shows measures about recommendations aggregated by flag severity: the total number of recommendations made during all investigations, the number of

	Flag Severity Recommendations Distinct data types Relevant Followed
	Safe	5	2	80%	60%
	Suspect	13	5	100%	84.6%
	Danger	8	3	50%	12.5%

https://attack.mitre.org/

https://www.elastic.co/guid

http://www.vacommunity.org/VAST+Challenge+2012

https://www.elastic.co/guid

https://attack.mitre.org/

https://github.com/darpa-i2o/Transparent-Computing/blob/master/ README-E3.md

We thank the participants to our evaluation, and all the members of Malizen for their help and support. This work was supported by a CIFRE-Defense grant from Agence Innovation Defense (AID).

Appendix

MADM scoring method

Designing the Pairwise Comparison Matrix While PCM are an effective and widely used solution, they have to respect a rule of consistency, depending on the scale used: ratio scales, geometric scales and logarithmic scale. The simplicity of the ratio scales method presented by Saaty et al. [START_REF] Saaty | A scaling method for priorities in hierarchical structures[END_REF] and how we use the final score in KRAKEN make the ratio scale a good fit for our decision making process. Two guidelines are proposed by Saaty et al. to build a PCM with a high level of consistency:

-Using an adapted scale depending on the number of criteria (presented in Table 3) to clearly differentiate answers. -Keeping pairwise consistency: a ij = 1/a ji , is a necessary but not sufficient condition. Although Saaty et al. specify that "improving consistency does not mean getting an answer closer the real life solution", a balance is to be found between perfect mathematical consistency and reality for the scoring to be relevant. Table 3: A measure of inconsistency between the PCM's order and the scale used [START_REF] Saaty | A scaling method for priorities in hierarchical structures[END_REF] Computing normalised weights Using the PCM, we compute normalised weights to obtain values bounded between 0 and 1. The weight or the i th criteria corresponds to the sum of the i th row divided by the total sum of the matrix. They are obtained by the following formula:

with n the number of criteria and T the total sum of the PCM.

Convert data to numerical values Some of our criteria are not numerical values, like the set of platforms and the permissions required. Using our expertise, we ranked and weighed the possible values of each attribute and computed a ratio for each of them.

Check Consistency Rate Before using it, the consistency of the PCM must be checked. The process is the following, as explained in [START_REF] Afshari | Simple additive weighting approach to personnel selection problem[END_REF]:

1. Find all eigenvectors and eigenvalues for the matrix.