François Chaumette

Seth Hutchinson

Visual Servo Control Part I: Basic Approaches

T his article is the first of a two-part series on the topic of visual servo control-using computer vision data in the servo loop to control the motion of a robot. In the present article, we describe the basic techniques that are by now well established in the field. We first give a general overview of the formulation of the visual servo control problem. We then describe the two archetypal visual servo control schemes: image-based and position-based visual servo control. Finally, we discuss performance and stability issues that pertain to these two schemes, motivating the second article in the series, in which we consider advanced techniques.

Introduction

Visual servo control refers to the use of computer vision data to control the motion of a robot. The vision data may be acquired from a camera that is mounted directly on a robot manipulator or on a mobile robot, in which case motion of the robot induces camera motion, or the camera can be fixed in the workspace so that it can observe the robot motion from a stationary configuration. Other configurations can be considered such as, for instance, several cameras mounted on pan-tilt heads observing the robot motion. The mathematical development of all these cases is similar, and in this tutorial we will focus primarily on the former, so-called eye-in-hand, case.

Visual servo control relies on techniques from image processing, computer vision, and control theory. Since it is not possible to cover all of these in depth in a single article, we will focus here primarily on issues related to control, and to those specific geometric aspects of computer vision that are uniquely relevant to the study of visual servo control. We will not specifically address issues related to feature tracking or three-dimensional (3-D) pose estimation, both of which are topics deserving of their own tutorials.

The Basic Components of Visual Servoing

The aim of all vision-based control schemes is to minimize an error e(t), which is typically defined by e(t) = s(m(t), a)s * .

(

This formulation is quite general, and it encompasses a wide variety of approaches, as we will see below. The parameters in [START_REF] Feddema | Vision-guided servoing with featurebased trajectory generation[END_REF] are defined as follows. The vector m(t) is a set of image measurements (e.g., the image coordinates of interest points or the image coordinates of the centroid of an object). These image measurements are used to compute a vector of k visual features, s(m(t), a), in which a is a set of parameters that represent potential additional knowledge about the system (e.g., coarse camera intrinsic parameters or 3-D models of objects).

The vector s * contains the desired values of the features.

In Part I of the tutorial (this article), we consider the case of a fixed goal pose and a motionless target, i.e., s * is constant, and changes in s depend only on camera motion. Further, we consider here the case of controlling the motion of a camera with six degrees of freedom (6 DOF); e.g., a camera attached to the end effector of a six degree-of-freedom arm. We will treat more general cases in Part II of the tutorial.

Visual servoing schemes mainly differ in the way that s is designed. In this article, we will see two very different approaches. First, we describe image-based visual servo control (IBVS), in which s consists of a set of features that are immediately available in the image data. Then, we describe position-based visual servo control (PBVS), in which s consists of a set of 3-D parameters, which must be estimated from image measurements.

Once s is selected, the design of the control scheme can be quite simple. Perhaps the most straightforward approach is to design a velocity controller. To do this, we require the relationship between the time variation of s and the camera velocity. Let the spatial velocity of the camera be denoted by

v c = (v c , ω ω ω c
), with v c the instantaneous linear velocity of the origin of the camera frame and ω ω ω c the instantaneous angular velocity of the camera frame The relationship between ṡ and v c is given by ṡ

= L s v c , ( 2)
in which L s ∈ R k×6 is named the interaction matrix related to s.

The term feature Jacobian is also used somewhat interchangeably in the visual servo literature. Using (1) and ( 2), we immediately obtain the relationship between camera velocity and the time variation of the error:

ė = L e v c , ( 3)
where L e = L s . Considering v c as the input to the robot controller, and if we would like for instance to try to ensure an exponential decoupled decrease of the error (i.e., ė = -λe), we obtain using (3):

v c = -λL + e e, ( 4)
where L + e ∈ R 6×k is chosen as the Moore-Penrose pseudoinverse of L e , that is L + e = (L e L e ) -1 L e when L e is of full rank 6. This choice allows ė -λL e L + e e and v c to be minimal. When k = 6, if det L e = 0 it it possible to invert L e , giving the control v c = -λL e -1 e. In real visual servo systems, it is impossible to know perfectly in practice either L e or L + e . So an approximation or an estimation of one of these two matrices must be realized. In the sequel, we denote both the pseudoinverse of the approximation of the interaction matrix and the approximation of the pseudoinverse of the interaction matrix by the symbol L + e . Using this notation, the control law is in fact:

v c = -λ L + e e. ( 5)
This is the basic design implemented by most visual servo controllers. All that remains is to fill in the details: How should s be chosen? What then is the form of L s ? How should we estimate L + e ? What are the performance characteristics of the resulting closed-loop system? These questions are addressed in the remainder of the article.

Classical Image-Based Visual Servo

Traditional image-based control schemes [START_REF] Feddema | Vision-guided servoing with featurebased trajectory generation[END_REF], [START_REF] Weiss | Dynamic sensor-based control of robots with visual feedback[END_REF] use the image-plane coordinates of a set of points (other choices are possible, but we defer discussion of these for Part II of the tutorial) to define the set s. The image measurements m are usually the pixel coordinates of the set of image points (but this is not the only possible choice), and the parameters a in the definition of s = s(m, a) in (1) are nothing but the camera intrinsic parameters to go from image measurements expressed in pixels to the features.

The Interaction Matrix

More precisely, for a 3-D point with coordinates X = (X , Y, Z ) in the camera frame, which projects in the image as a 2-D point with coordinates x = (x, y), we have:

x = X /Z = (u -c u )/ f α y = Y /Z = (v -c v )/ f, (6)
where m = (u, v) gives the coordinates of the image point expressed in pixel units, and a = (c u , c v , f, α) is the set of camera intrinsic parameters: c u and c v are the coordinates of the principal point, f is the focal length, and α is the ratio of the pixel dimensions. In this case, we take s = x = (x, y), the image plane coordinates of the point. The details of imaging geometry and perspective projection can be found in many computer vision texts, including [START_REF] Forsyth | Computer Vision: A Modern Approach[END_REF], [START_REF] Ma | An Invitation to 3-D Vision: From Images to Geometric Models[END_REF].

Taking the time derivative of the projection equations ( 6), we obtain

ẋ = Ẋ /Z -X Ż /Z 2 = ( Ẋ -x Ż )/Z ẏ = Ẏ /Z -Y Ż /Z 2 = ( Ẏ -y Ż )/Z . ( 7
)
We can relate the velocity of the 3-D point to the camera spatial velocity using the well-known equation

Ẋ = -v c -ω c × X ⇔ Ẋ = -v x -ω y Z + ω z Y Ẏ = -v y -ω z X + ω x Z Ż = -v z -ω x Y + ω y X . ( 8
)
Injecting ( 8) in [START_REF] Hutchinson | A tutorial on visual servo control[END_REF], and grouping terms we obtain

ẋ = -v x /Z + xv z /Z + xyω x -(1 + x 2 )ω y + yω z ẏ = -v y /Z + yv z /Z + (1 + y 2 )ω x -xyω y -xω z (9)
which can be written

ẋ = L x v c , ( 10
)
where the interaction matrix L x related to x is

L x = -1 Z 0 x Z xy -(1 + x 2 ) y 0 -1 Z y Z 1 + y 2 -xy -x
. [START_REF] Chaumette | Potential problems of stability and convergence in image-based and position-based visual servoing[END_REF] In the matrix L x , the value Z is the depth of the point relative to the camera frame. Therefore, any control scheme that uses this form of the interaction matrix must estimate or approximate the value of Z . Similarly, the camera intrinsic parameters are involved in the computation of x and y. Thus, L x cannot be directly used in [START_REF] Ma | An Invitation to 3-D Vision: From Images to Geometric Models[END_REF], and an estimation or an approximation L x must be used. We discuss this in more detail below.

To control the 6 DOF, at least three points are necessary (i.e., we require k ≥ 6). If we use the feature vector x = (x 1 ,x 2 ,x 3 ), by merely stacking interaction matrices for three points we obtain

L x = L x 1 L x 2 L x 3 .
In this case, there will exist some configurations for which L x is singular [START_REF] Michel | Singularities in the determination of the situation of a robot effector from the perspective view of three points[END_REF]. Furthermore, there exist four distinct camera poses for which e = 0, i.e., four global minima exist, and it is impossible to differentiate them [START_REF] Fischler | Random sample consensus: A paradigm for model fitting with applications to image analysis and automated cartography[END_REF]. For these reasons, more than three points are usually considered.

Approximating the Interaction Matrix

There are several choices available for constructing the estimate L + e to be used in the control law. One popular scheme is, of course, to choose L + e = L + e if L e = L x is known; that is, if the current depth Z of each point is available [START_REF] Hutchinson | A tutorial on visual servo control[END_REF]. In practice, these parameters must be estimated at each iteration of the control scheme. The basic methods presented in this article use classical pose estimation methods that will be briefly presented in the next section. Another popular approach is to choose L + e = L + e * , where L e * is the value of L e for the desired position e = e * = 0 [START_REF] Espiau | A new approach to visual servoing in robotics[END_REF]. In this case, L + e is constant, and only the desired depth of each point has to be set, which means no varying 3-D parameters have to be estimated during the visual servo. Finally, the choice L + e = 1/2(L e + L e * ) + has recently been proposed in [START_REF] Malis | Improving vision-based control using efficient second-order minimization techniques[END_REF]. Since L e is involved in this method, the current depth of each point must also be available.

We illustrate the behavior of these control schemes with an example. The goal is to position the camera so that it observes a square as a centered square in the image (see Figure 1). We define s to include the x and y coordinates of the four points forming the square. Note that the initial camera pose has been selected far away from the desired pose, particularly with regard to the rotational motions, which are known to be the most problematic for IBVS. In the simulations presented in the following, no noise or modeling errors have been introduced in order to allow comparison of different behaviors in perfect conditions.

The results obtained by using L + e = L + e * are given in Figure 2. Note that despite the large displacement that is required, the system converges. However, neither the behavior in the image nor the computed camera velocity components nor the 3-D trajectory of the camera present desirable properties far from the convergence (i.e., for the first 30 or so iterations). e is high at the start of the trajectory, and the camera trajectory is far from a straight line.

The choice L + e = 1/2(L e + L e * ) + provides good performance in practice. Indeed, as can be seen in Figure 4, the camera velocity components do not include large oscillations and provide a smooth trajectory both in the image and in 3-D.

A Geometrical Interpretation of IBVS

It is quite easy to provide a geometric interpretation of the behavior of the control schemes defined above. The example illustrated in Figure 5 corresponds to a pure rotation around the optical axis from the initial configuration (shown in blue) to the desired configuration of four coplanar points parallel to the image plane (shown in red). As explained above, using L + e in the control scheme attempts to ensure an exponential decrease of the error e. It means that when x and y image point coordinates compose this error, the points' trajectories in the image follow straight lines from their initial to their desired positions, when it is possible. This leads to the image motion plotted in green in the figure. The camera motion to realize this image motion can be easily deduced and is indeed composed of a rotational motion around the optical axis, but is combined with a retreating translational motion along the optical axis [START_REF] Corke | A new partitioned approach to imagebased visual servo control[END_REF]. This unexpected motion is due to the choice of the features and to the coupling between the third and sixth columns in the interaction matrix. If the rotation between the initial and desired configurations is very large, this phenomenon is amplified and leads to a particular case for a rotation of π rad where no rotational motion at all will be induced by the control scheme [START_REF] Chaumette | Potential problems of stability and convergence in image-based and position-based visual servoing[END_REF]. On the other hand, when the rotation is small, this phenomenon almost disappears. To conclude, the behavior is locally satisfactory (i.e., when the error is small), but it can be unsatisfactory when the error is large. As we will see in the last part of this article, these results are consistent with the local asymptotic stability results that can be obtained for IBVS.

If instead we use L + e * in the control scheme, the image motion generated can easily be shown to be the blue one plotted in Figure 5. Indeed, if we consider the same control scheme as before but starting from s * to reach s, we obtain:

v c = -λL + e * (s * -s),
which again induces straight-line trajectories from the red points to the blue ones, causing image motion plotted in brown. Going back to our problem, the control scheme computes a camera velocity that is exactly the opposite one:

v c = -λL + e * (s -s * )
and thus generates the image motion plotted in red at the red points. Transformed at the blue points, the camera velocity generates the blue image motion and corresponds once again to a rotational motion around the optical axis, combined now with an unexpected forward motion along the optical axis. The same analysis as before can be done, as for large or small errors. We can add that, as soon as the error decreases significantly, both control schemes get closer and tend to the same one (since L e = L e * when e = e * ) with a nice behavior characterized with the image motion plotted in black and a camera motion composed of only a rotation around the optical axis when the error tends towards zero.

If we instead use L + e = 1/2(L e + L e * ) + , it is intuitively clear that considering the mean of L e and L e * generates the image motion plotted in black, even when the error is large. In all cases but the rotation around π rad, the camera motion is now a pure rotation around the optical axis, without any unexpected translational motion.

IBVS with a Stereovision System

It is straightforward to extend the IBVS approach to a multicamera system. If a stereovision system is used, and a 3-D point is visible in both left and right images (see Figure 6), it is possible to use as visual features i.e., to represent the point by just stacking in s the x and y coordinates of the observed point in the left and right images [START_REF] Hager | Robot feedback control based on stereo vision: Towards calibration-free hand-eye coordination[END_REF]. However, care must be taken when constructing the corresponding interaction matrix since the form given in [START_REF] Corke | A new partitioned approach to imagebased visual servo control[END_REF] is expressed in either the left or right camera frame. More precisely, we have:

ẋl = L x l v l ẋr = L x r v r ,
where v l and v r are the spatial velocity of the left and right camera respectively, and where the analytical form of L x l and L x r are given by [START_REF] Chaumette | Potential problems of stability and convergence in image-based and position-based visual servoing[END_REF]. By choosing a sensor frame rigidly linked to the stereovision system, we obtain:

ẋs = ẋl ẋr = L x s v s ,
where the interaction matrix related to x s can be determined using the spatial motion transform matrix V to transform velocities expressed in the left or right cameras frames to the sensor frame. V is given by [13]

V = R [t] × R 0 R , ( 12)
where [t] × is the skew symmetric matrix associated to the vector t and where (R, t) ∈ SE (3) is the rigid body transformation from camera to sensor frame. The numerical values for these matrices are directly obtained from the calibration step of the stereovision system. Using this equation, we obtain

L x s = L x l l V s L x r r V s .
Note that L x s ∈ R 4×6 is always of rank 3 because of the epipolar constraint that links the perspective projection of a 3-D point in a stereovision system (see Figure 6). Another simple interpretation is that a 3-D point is represented by three independent parameters, making it impossible to find more than three independent parameters using any sensor observing that point.

To control the 6 DOF of the system, it is necessary to consider at least three points, the rank of the interaction matrix by considering only two points being equal to 5. Using a stereovision system, since the 3-D coordinates of any point observed in both images can be easily estimated by a simple triangulation process it is possible and quite natural to use these 3-D coordinates in the features set s. Such an approach would be, strictly speaking, a position-based approach, since it would require 3-D parameters in s.

Position-Based Visual Servo

Position-based control schemes (PBVS) [START_REF] Weiss | Dynamic sensor-based control of robots with visual feedback[END_REF], [START_REF] Wilson | Relative end-effector control using cartesian position based visual servoing[END_REF], [START_REF] Thuilot | Position based visual servoing: Keeping the object in the field of vision[END_REF] use the pose of the camera with respect to some reference coordinate frame to define s. Computing that pose from a set of measurements in one image necessitates the camera intrinsic parameters and the 3-D model of the object observed to be known. This classical computer vision problem is called the 3-D localization problem. While this problem is beyond the scope of the present tutorial, many solutions have been presented in the literature (see, e.g., [START_REF] Dementhon | Model-based object pose in 25 lines of code[END_REF] and [START_REF] Lowe | Three-dimensional object recognition from single twodimensional images[END_REF]).

It is then typical to define s in terms of the parameterization used to represent the camera pose. Note that the parameters a involved in the definition (1) of s are now the camera intrinsic parameters and the 3-D model of the object.

It is convenient to consider three coordinate frames: the current camera frame F c , the desired camera frame F c * , and a reference frame F o attached to the object. We adopt here the standard notation of using a leading superscript to denote the frame with respect to which a set of coordinates is defined. Thus, the coordinate vectors c t o and c * t o give the coordinates of the origin of the object frame expressed relative to the current camera frame and relative to the desired camera frame, respectively. Furthermore, let R = c * R c be the rotation matrix that gives the orientation of the current camera frame relative to the desired frame.

We can define s to be (t, θu), in which t is a translation vector, and θu gives the angle/axis parameterization for the rotation. We now discuss two choices for t and give the corresponding control laws.

If t is defined relative to the object frame F o , we obtain s = ( c t o , θu), s * = ( c * t o , 0), and e = ( c t o -c * t o , θu). In this case, the interaction matrix related to e is given by

L e = -I 3 [ c t o ] × 0 L θu , ( 13
)
in which I 3 is the 3 × 3 identity matrix and L θu is given by [START_REF] Malis | 2-1/2D visual servoing[END_REF]:

L θu = I 3 - θ 2 [u] × + 1 - sinc θ sinc 2 θ 2 [u] 2 × , ( 14
)
where sinc x is the sinus cardinal defined such that x sinc x = sin x and sinc 0 = 1. Following the developments presented at the beginning of the article, we obtain the control scheme

v c = -λ L -1 e e,
since the dimension k of s is 6, which is the number of camera degrees of freedom. By setting:

L -1 e = -I 3 [ c t o ] × L -1 θu 0 L -1 θu , ( 15
)
we obtain after simple developments:

v c = -λ(( c * t o -c t o ) + [ c t o ] × θu) ω ω ω c = -λθu, (16)
since L θu is such that L -1 θu θu = θu. This PBVS scheme causes the rotational motion to follow a geodesic with an exponential decreasing speed and so that the translational parameters involved in s decrease with the same speed. This explains the nice exponential decrease of the camera velocity components in Figure 7. Furthermore, the trajectory in the image of the origin of the object frame follows a pure straight line (here the center of the four points has been selected as this origin). On the other hand, the camera trajectory does not follow a straight line.

Another PBVS scheme can be designed by using s = ( c * t c , θu). In that case, we have s * = 0, e = s, and

L e = R 0 0 L θu . ( 17
)
Note the decoupling between translational and rotational motions, which allows us to obtain a simple control scheme:

v c = -λR c * t c ω ω ω c = -λ θu. ( 18
)
In this case, as can be seen in Figure 8, if the pose parameters involved in [START_REF] Malis | 2-1/2D visual servoing[END_REF] are perfectly estimated, the camera trajectory is a pure straight line, while the image trajectories are less satisfactory than before. Some particular configurations can even be found so that some points leave the camera field of view.

Stability Analysis

In this section, we consider the fundamental issues related to the stability of the controllers. To assess the stability of the closed-loop visual servo systems, we will use Lyapunov analysis. In particular, consider the candidate Lyapunov function defined by the squared error norm L = 1/2 e(t) 2 , whose derivative is given by

L = e ė = -λe L e L + e e.
The global asymptotic stability of the system is thus obtained when the following sufficient condition is ensured:

L e L + e > 0. ( 19)
Figure 7. The system behavior using s = ( c t 0 , θu). If the number of features is equal to the number of camera degrees of freedom (i.e., k = 6), and if the features are chosen and the control scheme designed so that L e and L + e are of full rank 6, then condition ( 19) is ensured if the approximations involved in L + e are not too coarse.

We now consider the particularization of this to the specific cases of IBVS and PBVS.

Stability Analysis of IBVS

As discussed previously, for most IBVS approaches we have k > 6. Therefore, condition [START_REF] Malis | Visual servoing invariant to changes in camera intrinsic parameters[END_REF] can never be ensured since L e L + e ∈ R k×k is at most of rank 6; thus, L e L + e has a nontrivial null space. In this case, configurations such that e ∈ Ker L + e correspond to local minima. Reaching such a local minimum is illustrated in Figure 9. As can be seen in Figure 9(d), each component of e has a nice exponential decrease with the same convergence speed, causing straight-line trajectories to be realized in where O ∈ R 6×6 is equal to 0 when e = 0, whatever the choice of L + e [START_REF] Malis | Visual servoing invariant to changes in camera intrinsic parameters[END_REF]. Using the control scheme (5), we obtain:

ė = -λ( L + e L e + O)e ,
which is known to be locally asymptotically stable in a neighborhood of e = e * = 0 if

L + e L e > 0, ( 20)
where L + e L e ∈ R 6×6 . Indeed, only the linearized system ė = -λ L + e L e e has to be considered if we are interested in the local asymptotic stability [START_REF] Isidori | Nonlinear Control Systems[END_REF].

Once again, if the features are chosen and the control scheme designed so that L e and L + e are of full rank 6, then condition [START_REF] Isidori | Nonlinear Control Systems[END_REF] is ensured if the approximations involved in L + e are not too coarse.

To end the demonstration of local asymptotic stability, we must show that there does not exist any configuration e = e * such that e ∈ Ker L + e in a small neighborhood of e * and in a small neighborhood of the corresponding pose p * . Such configurations correspond to local minima where v c = 0 and e = e * . If such a pose p would exist, it is possible to restrict the neighborhood around p * so that there exists a camera velocity v to reach p * from p. This camera velocity would imply a variation of the error ė = L e v. However, such a variation cannot belong to Ker L + e since L + e L e > 0. Therefore, we have v c = 0 if and only if ė = 0, i.e., e = e * , in a neighborhood of p * .

Even though local asymptotic stability can be ensured when k > 6, we cannot ensure global asymptotic stability. For instance, as illustrated in Figure 9, there may exist local minima corresponding to configurations where e ∈ Ker L + e , which are outside of the neighborhood considered above. Determining the size of the neighborhood where the stability and the convergence are ensured is still an open issue, even if this neighborhood is surprisingly quite large in practice.

Stability Analysis of PBVS

The stability properties of PBVS seem quite attractive. Since L θu given in ( 14) is nonsingular when θ = 2 kπ , we obtain from [START_REF] Malis | Visual servoing invariant to changes in camera intrinsic parameters[END_REF] the global asymptotic stability of the system since L e L -1 e = I 6 , under the strong hypothesis that all the pose parameters are perfect. This is true for both PBVS methods presented previously, since the interactions matrices given in ( 13) and ( 17) are full rank when L θu is nonsingular.

With regard to robustness, feedback is computed using estimated quantities that are a function of the image measurements and the system calibration parameters. For the first PBVS method (the analysis for the second method is analogous), the interaction matrix given in (13) corresponds to perfectly estimated pose parameters, while the real one is unknown since the estimated pose parameters may be biased due to calibration errors, or inaccurate and unstable due to noise [START_REF] Chaumette | Potential problems of stability and convergence in image-based and position-based visual servoing[END_REF]. The true positivity condition [START_REF] Malis | Visual servoing invariant to changes in camera intrinsic parameters[END_REF] should be in fact written:

where L -1 e is given by ( 15) but where L e is unknown and not given by [START_REF] Paul | Robot Manipulators: Mathematics, Programming and Control[END_REF]. Indeed, even small errors in computing the points position in the image can lead to pose errors that can impact significantly the accuracy and the stability of the system (see Figure 10).

Conclusions

At this point, one might wonder which of IBVS or PBVS is the superior control strategy. As with most engineering questions, there is no definitive answer-only a set of performance tradeoffs to consider.

As for stability issues, we have seen that no strategy provides perfect properties. As for the 3-D parameters involved, a correct estimation is important in IBVS, since they appear in L e and thus in the stability condition [START_REF] Isidori | Nonlinear Control Systems[END_REF]. Poor estimation can thus make the system unstable, but coarse estimations will only imply perturbations in the trajectory performed by the robot to reach its desired pose and will have no effect on the accuracy of the pose reached. On the other hand, a correct estimation of the pose is crucial in PBVS, since it appears both in the error e to be regulated to 0 and in L e . Coarse estimations will thus induce perturbations on the trajectory realized but will have also an effect on the accuracy of the pose reached after convergence.

In fact, in PBVS, the vision sensor is considered as a 3-D sensor. Since the control scheme imposes a behavior of s, which is here expressed in the Cartesian space, it allows the camera to follow theoretically an optimal trajectory in that space but generally not in the image space. When only one image is used, even small errors in the image measurements can lead to errors in the pose that can impact significantly the accuracy of the system. The main question with this approach is thus: Can a vision sensor be considered as a 3-D sensor?

On the other hand, in IBVS, the vision sensor is considered as a two-dimensional (2-D) sensor since the features are directly expressed in the image space. That is more realistic when a monocular camera is used, and this allows IBVS to be remarkably robust to errors in calibration and image noise. However, IBVS is not without its shortcomings. When the displacement to realize is large, the camera may reach a local minimum or may cross a singularity of the interaction matrix. Furthermore, the camera motion may follow unpredictable, often suboptimal Cartesian trajectories, such as those discussed previously.

Even if the two basic approaches presented and discussed in this article give in practice satisfactory results in most cases, their respective shortcomings have led to many works and improvements. Results in computer vision about 3-D reconstruction from two views have also been applied successfully, making the knowledge of the 3-D object model unnecessary. These different approaches will form one of the main points presented in Part II of this tutorial.

  The results obtained using L + e = L + e are given in Figure 3. In this case, the trajectories of the points in the image are almost straight lines, but the behavior induced in 3-D is even less satisfactory than for the case of L + e = L + e * The large camera velocities at the beginning of the servo indicate that the condition number of L +

Figure 2 .

 2 Figure 2. The system behavior using s = (x 1 , y 1 , . . . , x 4 , y 4 ) and L + e = L + e * : (a) image points trajectories including the trajectory of the center of the square ,which is not used in the control scheme, (b) v c components (cm/s and dg/s) computed at each iteration of the control scheme, and (c) 3-D trajectory of the camera optical center expressed in R c * (cm).

Figure 1 .

 1 Figure 1. An example of positioning task: (a) the desired camera pose with respect to a simple target, (b) the initial camera pose, and (c) the corresponding initial and desired image of the target.

Figure 3 .Figure 4 .s

 34 Figure 3. The system behavior using s = (x 1 , y 1 , . . . , x 4 , y 4 ) and L + e = L + e .

Figure 5 .Figure 6 .

 56 Figure 5. A geometrical interpretation of IBVS.

Figure 9 .

 9 Figure 9. Reaching a local minimum using s = (x 1 , y 1 , . . . , x 4 , y 4 ) and L + e = L + e : (a) initial configuration, (b) the desired one, (c) the configuration reached after the convergence of the control scheme, (d) the evolution of the error e at each iteration of the control scheme, and (f) the evolution of the six components of the camera velocity v c .

  Rennes vue exterieure IRISA/INRIA Rennes vue exterieure IRISA/INRIA Rennes vue exterieure

Figure 8 .

 8 Figure 8. The system behavior using s = ( c * t c , θu).

  the image, but the error reached is not exactly zero, and it is clear from Figure9(c) that the system has been attracted to a local minimum far away from the desired configuration. Thus, only local asymptotic stability can be obtained for IBVS.To study local asymptotic stability when k > 6, let us first define a new error e with e = L + e e. The time derivative of this error is given by ė = L + e ė + ˙ L + e e = ( L + e L e + O)v c ,

Figure 10 .

 10 Figure 10. Two different camera poses [(a) and (c)] that provide almost the same image of four coplanar points (b).

Address for Correspondence: François Chaumette, IRISA/INRIA Rennes, Campus de Beaulieu, 35 042 Rennes cedex, France. E-mail: Francois.Chaumette@irisa.fr.


Christophe Maudoux

Selma Boumerdassi

Alex Barcello

Eric Renault

Combined Forest: a New Supervised Approach for a Machine-Learning-based Botnets Detection

Keywords: botnets, anomalies detection, machine learning, supervised & meta algorithms, network, cybersecurity

Nowadays, botnet-based attacks are the most prevalent cyber-threats type. It is therefore essential to detect this kind of malware using efficient bots detection techniques. This paper presents our security anomalies detection system, based on a model that we named Combined Forest. Our approach consists of merging some pre-processed Decision Trees to highlight different kinds of botnet by detecting their intrinsic exchanges. Using a supervised data approach, each tree is built from a labelled dataset. In order to achieve this, we aggregate the IP-flows into Traffic-flows to extract key features and avoid over-fitting. Then, we tested different machine learning algorithms and selected the most suitable one. After that, many experiments have been done to determine the best parameters and design the most accurate, adaptative and efficient model.

I -INTRODUCTION

The most serious threat against networks and a major challenging topic within cybersecurity nowadays are bot proliferation and botnet detection [START_REF] Guirakhoo | FBI IC3 2019: Cybercrime Results in over $3.5 Billion in Reported Losses -Digital Shadows[END_REF]. Botnets are an unusually large collection of devices compromised by malware and under the control of a remote attacker. Unlike other more conventional malware such as viruses, trojans or worms, bots exchange data with each other or with an attacker through an open communication channel using protocols such as IRC, HTTP or Peer-to-Peer (P2P). Some Supervised and Unsupervised approaches have been developed to detect anomalies by using flow-based network traffic analysis like [START_REF] Stevanovic | An Efficient Flow-Based Botnet Detection Using Supervised Machine Learning[END_REF][START_REF] Vilaça | Botnet Traffic Detection Using RPCA and Mahalanobis Distance[END_REF]. The first supervised approach requires extracting thirty-nine different statistical features for every traffic flow defined by source and destination IP/port and protocol knowing that the source port can evolve and the system needs to analyse each payload. The second study based on the Principal Component Analysis unsupervised algorithm uses the CTU13 dataset described in section V. Each scenario here is split into two parts for training and testing purpose that can introduce a bias. Furthermore, difficulty here is to tag each obtained clusters as normal or malicious depending on statistical analysis that can lead to misclassification. In this paper, we focus on supervised Machine Learning Algorithms (MLAs) and we propose a new approach based-on a boosted forest built by combining several pre-processed Decision Trees.

The article is organized as follows. First, we introduce the supervised MLAs employed for our research. After explaining botnets and their architectures, we detail the CTU13 dataset that we employed for training and testing our Anomalies Detection System (ADS). Then, we present our Combined Forest approach and evaluate the solution in terms of accuracy and computing time. Future works consist in transposing our detection system to mobile network.

II -MACHINE LEARNING ALGORITHMS

MLAs are programs that can learn from data and improve from experience. Learning tasks may include defining the best function that maps input to output, finding out the hidden structure of unlabelled data or grouping samples such that objects within the same cluster are more similar to each other than to the objects from another cluster [START_REF] Brownlee | Master Machine Learning Algorithms: Discover How They Work and Implement Them[END_REF].

The most common type of machine learning process is to learn the mapping function: Y = f (X) + e to make predictions of Y for new X with an irreducible error e based on the lack of attributes to sufficiently characterize the best mapping. This is called predictive modelling. The goal here is to make the most accurate possible predictions, irrespective of the function form.

Different MLAs make different assumptions about the shape and structure of the function. Assumptions can greatly simplify the learning process, but can also limit what can be learned. This is why it is very important to try out different algorithms on a machine learning problem.

Decision Tree (DT) or CART

Classification and Regression Trees (CART) is a supervised algorithm that can be used for classification or regression predictive modelling problems but are better at solving classification ones. DTs are composed of two nodes: Decision and Leaf nodes. It is a tree-structured classifier, where internal nodes represent the features of a dataset, branches are the decision rules and each leaf node represents the outcome. Decision nodes are used to make choice and have multiple branches, whereas Leaf nodes are the output of those decisions and do not contain any further branches. Decisions are performed on the basis of features from the given dataset. It is a graphical representation for getting all possible solutions to a problem based on given conditions. It is called a DT because, similar to a tree, it starts with the root node, which expands on further branches and constructs a tree-like structure depicted by figure 1.

Random Forest (RF)

This model is based on a multitude of DTs as shown in figure 2. It is one of the most popular and powerful MLAs. They select which variable to split on using a greedy algorithm that minimizes error. The DT can have a lot of structural similarities and in turn result in high correlation of their predictions. Combining predictions from multiple models in ensembles works better if the predictions from the sub-models are uncorrelated or weakly correlated. With Random Forest, the learning algorithm is limited to a random sample of features on which to search. The number of features that can be searched at each split point must be specified as a parameter to the algorithm.

III -WHAT IS A BOTNET?

Cybersecurity is a major issue today. Over the last ten years, botnets represent the latest growing threat. They are becoming the preferred media for launching various attacks. During the 2000's, botnets evolved to become more and more sophisticated and malicious like Zeus, Stuxnet, Emotet, Retadup, . . .

Botnet topology is essentially built on four components: (i) the compromised machines also known as the Bots or Zombies (ii) the BotMaster who controls the botnet, developed (iii) the bot code (iv) and the Command and Control server (C&C server) used for leading the botnet. A generic botnet topology is illustrated by figure 3. Fig. 3. Botnet topology Control architecture is the key aspect of any botnets. Bots interact with the BotMaster to receive commands or send logs, to each other or to exchange data over a network using legitimate communication channels, in order to become part of a wider network of infected devices [START_REF] Kumar | French Police Remotely Removed RE-TADUP Malware from 850,000 Infected PCs[END_REF].

Botnet resilience and also its efficiency lies in the structure of its Command and Control architecture. The C&C channel is the main weak point and without it, a botnet is just a collection of useless infected devices.

IV -DETECTION PROCESS

Many researches have been done by monitoring network traffic, analysing messages or parsing their payload contents with induced privacy issues [START_REF] Stevanovic | An Efficient Flow-Based Botnet Detection Using Supervised Machine Learning[END_REF][START_REF] Vilaça | Botnet Traffic Detection Using RPCA and Mahalanobis Distance[END_REF]. In this paper, we will focus on machine learning techniques used for extracting patterns and detecting anomalous behaviours that could point out an existing C&C channel between malware and consecutively a botnet.

The main assumption of machine learning based ADS is that botnets generate specific traffic patterns that could be efficiently detected by MLAs. This approach affords a flexible detection method that does not require any prior knowledge of botnet traffic characteristics. It is independent and isolated from communication technologies and resilience strategies employed by botnets. Different kinds of MLAs have been developed and implemented in several detection schemas [START_REF] García | An Empirical Comparison of Botnet Detection Methods[END_REF][START_REF] Abraham | A Comparison of Machine Learning Approaches to Detect Botnet Traffic[END_REF].

Three main steps are required to achieve a good anomaly detection rate by using machine learning. First, all IP-flows must be aggregated into Traffic-flows. During the second step, specific features are extracted from aggregated flows to be used for computing main characteristics and modelling decisions. Finally, an MLA is trained and implemented to differentiate malicious activities from benign traffic.

Traffic Flow Aggregation

Huge amount of data can be collected during a network dump process. To decrease the data volume for analysis and be able to highlight exchange patterns, IP-flows are merged into a Traffic-flow corresponding to an exchange transaction between a source and a destination. This communication is mainly defined by source and destination IP address or port.

Features Selection & Patterns

Many features are available and can be extracted to define patterns. The main ones are; transaction duration, source or destination port, IP address, direction flow, number of transmitted packets, packet size, payload content, connection state, and protocol.

By using these characteristics, it is possible to define and detect patterns. The aim is to reduce key information to extract and analyse but keep the ability to detect new or unknown malicious behaviours and therefore not miss attacks. Selecting the right set of features for data modelling improve the performance learning process and reduce computational costs such as training time or required resource.

Training & Classification

Supervised MLAs training is based-on previously defined patterns and by providing a labelled dataset. A dataset can be created by capturing and tagging legitimate traffic from a well-known network then merging it with generated malicious traffic. In other hand, some open source labelled datasets are publicly available. For our researches, we chose to experiment the CTU13 dataset.

V -CTU13 DATASET

Czech Technical University 13 is a commonly applied dataset for research like [START_REF] Vilaça | Botnet Traffic Detection Using RPCA and Mahalanobis Distance[END_REF][START_REF] Blaise | BotFP: FingerPrints Clustering for Bot Detection[END_REF] provided by Malware Capture Facility Project of Czech Technical University [START_REF]A Labeled Dataset with Botnet, Normal and Background Traffic[END_REF]. It was captured in 2011 and consists of thirteen different botnet activity captures called scenarios listed in table 1.

A scenario is a specific botnet traffic sample generated and labelled as malicious data. Each malware uses several protocols and performed different actions. Traffic from known and controlled network endpoints like a router or switch is tagged as normal. Training process requires specific and labelled data to be able to learn some botnet features and define a signature based on intrinsic behaviour. Therefore, we chose the scenarios marked with '*' to train different MLAs and leave out the other ones. Each training scenarios contains just one bot activity and only one infected host with IP address 147.32.84.165.

Other scenarios have been used for testing the forest built by combining the DTs learned from the six training scenarios.

VI -COMBINED FOREST

We adopt a nonconformist approach to botnets and their C&C channel detection which is not based on conventional tools like C and Python/Jupiter. To construct our model and reach our aim, we went through the following points. (i) Very large IP 'binetflow' files provided by the CTU13 dataset have been aggregated into smaller Traffic-flows files by our advanced Perl parser to be processed by Weka. (ii) Several supervised MLAs have been tested to determine the most suitable one and four Decision Trees have been extracted from training scenarios using J48 and a Confidence Factor (CF) of '0.35'. Increasing the CF involved a more accurate resulting tree but with more nodes and leaves. These deeper DTs are offset by the next step. (iii) Each pre-processed DT has been improved with the AdaBoost meta-classifier. (iv) All boosted trees have been combined to build our forest with the Stacking method.

Typically, meta classifiers have been developed to boost nominal classifiers like AdaBoost or ClassifierOptimizer. We have implemented the AdaBoost method [START_REF] Freund | Experiments with a New Boosting Algorithm[END_REF]. This metaalgorithm can be used in conjunction with other MLAs to improve performance. Output of the other 'weak learners' is combined into a weighted sum that represents the final output of the boosted classifier. AdaBoost is adaptive in the sense that subsequent weak learners are tweaked in favour of those instances misclassified by previous classifiers. Bagging meta-algorithm did not increase performances and Voting could not be used here because the result was always false. For each testing scenario, only one tree is able to detect botnet activity! Pre-built models must be wrapped to be loaded into Weka before using. To do so, a generic connector named Serializer is required. This classifier loads a serialized model and calls it to make predictions.

VII -TOOLS & METRICS

Workbench for Machine Learning

We conducted our studies with the Weka Toolbox1 to (i) find out which is the best algorithm able to detect security anomalies, (ii) determine the most suitable tuning parameter values to improve performances and (iii) validate our proposed ADS.

Waikato Environment for Knowledge Analysis is a freely available open source software developed at the University of Waikato in New Zealand. Overall, data must be converted into an ARFF (Attribute-Relation File Format) file. This is an ASCII text file that describes a list of instances sharing a set of attributes.

Basic Features

Algorithm performances can be evaluated by using multiple metrics defined and explained below. We can define the following four basic features:

True Positives (TP) correctly predicted to be true.

True Negatives (TN) correctly predicted to be false.

False Positives (FP) predicted to be true, but incorrect.

False Negatives (FN) predicted to be false, but incorrect.

Performance Metrics

Therefore, main performance metrics are calculated based-on the previous basic features: Sensitivity and Specificity are inversely proportional to each other. So when we increase sensitivity, specificity decreases and vice versa.

VIII -EXPERIMENTS AND RESULTS

Feature Extraction

IP-flows must be aggregated into Traffic-flows to extract specific patterns and detect malicious activities. To highlight this important step, we experimented with two opposite approaches: (i) a basic parsing tool to directly analyse IP-flows and (ii) a parser to aggregate IP-flows, both written in Perl.

Basic Parser

A first naive approach could just consist in transposing 'binetflow' files provided by the CTU13 dataset into ARFF files without any modifications2 .

We tested this basic parsing with S42 scenario and the J48 algorithm [START_REF] Bhargava | Decision Tree Analysis on J48 Algorithm for Data Mining[END_REF]. First results exposed by table 2 seem very impressive with TPR, Recall, Precision and F-Measure = 1 and FPR = 0. These very good performances can be explained by the fact that J48 algorithm over-fits the data. Leaves are based on source port and bot IP address (147.32.84.165).

Advanced Parser

Our advanced approach aims to aggregate some IP-flows into Traffic-flows defined by a 4-tuple primary key. Client-Server exchanges are identified by source and destination IP address and port (socket), where the source port is versatile and can evolve. We chose to build the Aggregation Key (AgK) with the transport protocol [START_REF]Stratosphere Testing Framework. en-US[END_REF][START_REF]Example of Using STF for Detecting C&C Channels[END_REF].

The 4-tuple aggregation key is set like this: AgK = Sr-cAddr DstAddr Dport Protocol by using our advanced parser 3 . Results obtained with the same J48 algorithm from the S42 scenario pre-processed with our advanced parser are detailed by table 3. DT learned from aggregated data is composed of '18' leaves with a size equal to '35'. Model metrics are very good with TPR and Recall = 0.935, FPR = 0, Precision = 0.959, F-Measure and MCC = 0.947.

Most important feature here is that the advanced model does not refer to any IP address or source port. Table 4 summarizes total number of flows after basic or advanced parsing and relative number of flows marked as malicious with corresponding ratios.

Experiments

Algorithm Selection

Weka provides many MLAs. We chose to test one Neural Network i.e. Multilayer Perception (MLP), the Naive Bayes (NB) algorithm and some DTs. Available DT algorithms are J48 and some derived: J48Consolidate, DTGraft and BFTree. From tables 5 to 7, we can deduce that (i) the J48 algorithm provides the best MCC with the minimum time testing and the maximum specificity (see section 7.3) (ii) S47 and S48 can not be used for building a DT because these scenarios do not provide enough malicious data with only 4 (0.034 ) and 13 (0.32 ) botnet Traffic-flows respectively. A first model implementation with the boosting algorithm just after the stacking one did not increase the performances significantly. Therefore, the boosting phase must occur after the DT modelling as depicted by figure 4.

Our model is able to highlight a botnet family's C&C channel if, of course, a corresponding DT has been extracted and combined. Tables 11 and12 show that botnet activities in S53 have not been detected by our Combined Forest because no relative training scenario has been provided.

We plan to transpose our ADS to mobile network and test our Combined Forest model with Android malware or mobile botnets. This will require to define a new aggregation key and an adaptation of the parser to extract useful features.

X -CONCLUSION

Botnets must be effectively detected to be defeated. This article explores and describes how network flow analysis and machine learning can be employed to provide an efficient ADS. We developed and exposed a new botnet detection system that relies on Traffic-flows aggregation and supervised MLAs for extracting patterns and modelling botnets C&C channel. Our system is able to accurately highlight botnet activity using network flow features and multi Decision Trees merged into a Combined Forest. This approach that consists in detecting C&C exchanges is more efficient because of pointing out attack activities is often too late and more difficult! Additionally, our ADS can be easily improved to detect new botnet families by appending some corresponding previously learned DTs without building all the model again.

We can deduce from our researches that this selected approach provides high precision of traffic classification by analysing a few key features, and it will also be suitable for real-time application. We are planning further studies to test and adapt this approach to implement a real-time system able to detect mobile botnet activities.

Fig. 1 .

 1 Fig. 1. CART diagram

Fig. 2 .

 2 Fig. 2. Simplified RF

Fig. 4 .

 4 Fig. 4. Our Combined-Forest model

  P ⇒ expresses what fraction of predictions as a positive class were actually positive. True-Positive Rate (TPR) or Recall or Sensitivity T P T P +F N ⇒ fraction of all positive correctly predicted. True-Negative Rate (TNR) or Specificity T N T N +F P ⇒ fraction of negative cases correctly predicted. False-Positive Rate (FPR) F P T N +F P = 1 -TNR False-Negative Rate (FNR) F N T P +F N = 1 -TPR F-Measure (FM) or F1 Score 2 Recall.Precision Precision+Recall ⇒ is the harmonic mean of Precision and Recall. Matthews Correlation Coefficient (MCC) T P.T N -F P.F N √ (T P + F P )(T P + F N )(T N + F P )(T N + F N )

Fig. 5 .

 5 Fig. 5. Neris and Rbot activities (plotted with jitter)

TABLE 1

 1 CTU13 Scenarios

	Nmr/Id	Dur (hrs)	Bots	Bot	Size (GB)
	42/1*	6.15	1	Neris	52
	43/2	4.21	1	Neris	60
	44/3*	66.85	1	Rbot	121
	45/4	4.21	1	Rbot	53
	46/5*	11.63	1	Virut	37.6
	47/6*	2.18	1	Menti	30
	48/7*	0.38	1	Sogou	5.8
	49/8*	19.5	1	Murlo	123
	50/9	5.18	10	Neris	94
	51/10	4.75	10	Rbot	73
	52/11	0.26	3	Rbot	5.2
	53/12	1.21	3	NSIS.ay	8.3
	54/13	16.36	1	Virut	34
	*Scenarios used for training

TABLE 2

 2 Basic-parsing Confusion Matrix

	Classified as True	False
	True	28,122	4
	False	2	2,584,844
	99.9998% Correctly classified instances!!!

TABLE 3

 3 Advanced-parsing Confusion Matrix

	Classified as True	False
	True	2,154	150
	False	91	694,143
	99.9654% Correctly classified instances

TABLE 4

 4 Total IP & Traffic-flows

	Scenario	IP-flows (Ratio )	Traffic-flows (Ratio )
	S42	2,612,972/28,126 (10.65)	695,538/2,305 (3.3)
	S44	4,156,939/2,556 (0.61)	684,175/2,464 (3.6)
	S46	121,994/749 (6.1)	43,116/65 (1.5)
	S47	520,225/230 (0.442)	119,375/4 (0.034)
	S48	106,298/59 (0.555)	40,725/13 (0.32)
	S49	2,762,306/1,414 (0.512)	462,824/63 (0.14)
	Total flows/Labelled as bot (Malicious/Total ratio)

TABLE 5

 5 Algorithms TPR/TNR/MCC

	Scenario	J48	NB	MLP
	S42	0.93/1.00/0.95	0.99/0.89/0.16	0.54/1.00/0.79
	S44	1.00/1.00/0.99	1.00/0.96/0.33	0.00/1.00/X
	S46	0.30/1.00/0.58	0.11/0.98/0.03	0.00/1.00/X
	S48	0.00/1.00/X	0.68/0.95/?	0.00/1.00/X
	S49	0.52/1.00/0.68	0.93/0.80.02/?	0.00/1.00/X

TABLE 6

 6 Algorithms Elapsed Time Training/Testing Confidence Factor equal to '0.35'.Table 10 exposes results reached after using the J48 algorithm boosted with AdaBoost which improves the MCC compared to table 9. Finally, tables 11 and 12 summarize the overall efficiency. Our Combined Forest model performances are interesting and encouraging with the following Mean/Standard Deviation values computed from table 12: TPR = 0.374/0.123, Precision = 0.976/0.054, FM = 0.528/0.121 and MCC = 0.595/0.089. These results could be improved by providing scenarios with higher Botnet/Total Traffic-flow ratio.

		Scenario		J48	NB		MLP
		S42	34.8/0.04	2.5/?		?/?
		S44	20.2/0.05	2.5/0.36	708.6/0.12
		S46	0.5/0.00	0.1/0.02	44.8/0.01
		S47	2.0/0.01	0.3/0.06	127.6/0.02
		S48	0.2/0.00	0.1/0.02	43.9/0.01
		S49	13.8/0.02	1.9/0.19	500.5/0.09
				TABLE 7
		Weka DT Algorithms TPR/MCC
	Scen.	BF		J48	Consolidate	Graft
	S42	0.89/0.93	0.93/0.95	0.97/0.73	0.93/0.94
	S44	1.00/0.99	1.00/0.99	1.00/0.95	0.99/0.99
	S46	0.04/0.48	0.31/0.72	0.68/0.19	0.26/0.52
	S49	?		0.52/0.68	0.65/0.47	0.50/0.69
		All DTs reach a TNR equal to '1'
	Algorithm Optimisation
	CF is used for pruning. Smaller values incur more pruning and
	MCC variations (table 8). The tree is created according to the
	implemented algorithm. The additional pruning process looks
	at what nodes can be removed without affecting performance.
	This step reduces the risk of over-fitting the training data. To
	over-fit means that the model is able to classify the training
	data perfectly, but nothing else because instead of learning the
	underlying concept, the model learned intrinsic and specific
	properties of the training data, making it worthless for
	data.
				TABLE 8
		MCC Depending on CF Parameter
	Scen.	0.20	0.23	0.25	0.28	0.30	0.35	0.38
	S42	0.95	0.95	0.95	0.95		0.95	0.95	0.94
	S44	0.99	0.99	0.99	0.99		0.99	0.99	0.99
	S46	0.57	0.57	0.57	0.55		0.55	0.56	0.55
	S49	0.68	0.70	0.70	0.70		0.70	0.72	0.70
		Confidence Factor modulation from 0.20 to 0.38
	8.3 Results
	The first step was to build our DT models from each training
	scenario. From the previous experiments we can conclude that
	the best results, presented in table 9, are obtained with the J48
	algorithm and a

TABLE 9

 9 Base-models

	Scen.	Size*	TPR	FM	MCC	ETT (s)	Root
	S42	35/18	0.932	0.945	0.945	36.5	Dport53
	S44	25/13	0.997	0.993	0.993	17.6	Dport22
	S46	33/17	0.308	0.455	0.517	0.5	Dport6774
	S49	17/9	0.532	0.673	0.698	13.9	TotBytes
		*Nodes/Leaves -J48 algorithm with CF = 0.35

TABLE 10

 10

			Boosted-models
	Scen.	TPR	FM	MCC	Precision	ETT (s)
	S42	0.931	0.947	0.947	0.962	625
	S44	0.991	0.991	0.991	0.992	329
	S46	0.385	0.543	0.596	0.926	22
	S49	0.597	0.747	0.772	1.00	188
	J48 with CF = 0.35 and AdaBoost -ETT = Elapsed Time Training

TABLE 11

 11 Combined Forest Results without AdaBoost

	Scen.	TPR	Precision	FM	MCC	Bot/Total flows
	S43	0.356	0.965	0.520	0.586	309/427,810
	S45	0.133	0.667	0.222	0.298	15/201,329
	S50	0.471	0.979	0.636	0.678	3,303/436,460
	S51	0.395	0.941	0.557	0.610	81/236,082
	S52	0.333	1.0	0.5	0.577	9/43,330
	S53	?	?	?	?	977/92,482
	S54	0.414	0.954	0.577	0.628	302/370,614

TABLE 12

 12

		Boosted Combined-Forest Results
	Scen.	TPR	Precision	FM	MCC	ETT (s)
	S43	0.324	1.00	0.489	0.569	5
	S45	0.200	1.00	0.333	0.447	2.5
	S50	0.558	0.866	0.678	0.693	5
	S51	0.457	1.00	0.627	0.676	3
	S52	0.333	1.0	0.5	0.577	0.5
	S53	?	?	?	?	2
	S54	0.374	0.991	0.54	0.609	5
		ETT = Elapsed Time Testing
	IX -DISCUSSION & FURTHER WORKS
	Aggregate IP-flows into Traffic-flows by creating a 4-tuple pri-
	mary key constructed of; source and destination IP, destination
	port and protocol allowed the highlighting of the botnet C&C
	channel as exposed in section 4.1. The last column of table 9
	named 'Root' specifies the first node of each model extracted

from the training data. With figure

5

, It highlights the fact that Neris (S42) exchanges over TCP/6667 or UDP/53 (DNS) and Rbot's (S44) C&C channel is based on ssh (TCP/22). We can suppose that Neris and Rbot obfuscate or mix their exchanges with ssh or DNS traffic to by-pass firewalls and also prevent C&C channel detection. Same graphics also show that Virut exchanges by using TCP on ports 80, 443 and 6667 -a well-known backdoor -or UDP on port 53. It required more digging and analysing bot code to confirm this.

http://www.cs.waikato.ac.nz/ml/weka

https://bitbucket.org/cmaudoux/parsers/src/master/basic.pl

https://bitbucket.org/cmaudoux/parsers/src/master/advanced.pl


Christophe Maudoux

Selma Boumerdassi

Smart & Sustainable Agriculture Machine Learning behind this (R)evolution

Keywords: Smart and Sustainable Agriculture, Machine Learning, Datasets, Supervised and Unsupervised Algorithms, Practical applications

Last decade has seen the emerging concept of Smart and Sustainable Agriculture that makes farming more efficient by minimizing environmental impacts. Behind this evolution, we find the scientific concept of Machine Learning. Nowadays, machine learning is everywhere throughout the whole growing and harvesting cycle.

Many algorithms are used for predicting when seeds must be planted. Then, data analyses are conducted to prepare soils and determine seeds breeding and how much water is required. Finally, fully automated harvest is planned and performed by robots or unmanned vehicles with the help of computer vision. To reach these amazing results, many algorithms have been developed and implemented.

This paper presents how machine learning helps farmers to increase performances, reduce costs and limit environmental impacts of human activities. Then, we describe basic concepts and the algorithms that compose the underlying engine of machine learning techniques. In the last parts we explore datasets and tools used in researches to provide cutting-edge solutions.

Crop Quality

The accurate detection and classification of crops can increase gain and reduce waste. ML can analyse interconnections to highlight new features biasing crops quality [START_REF] Kumar | IOT-Based Drone for Improvement of Crop Quality in Agricultural Field[END_REF].

Disease Detection

To control diseases, farmers spread pesticides over the cropping areas. To be effective, this method requires significant amounts. ML can be used here for limiting financial costs and environmental impacts [START_REF] Sambasivam | A Predictive Machine Learning Application in Agriculture: Cassava Disease Detection and Classification with Imbalanced Dataset Using Convolutional Neural Networks[END_REF].

Weed Fighting

Weeds are harmful for crop production and it can be a boring and difficult task to get rid of this threat. Main problem in weed fighting is that they are difficult to highlight and discriminate from crops. MLAs can overcome these difficulties by minimizing cost and side effects [START_REF] Sabzi | Using Video Processing to Classify Potato Plant and Three Types of Weed Using Hybrid of Artificial Neural Network and Partincle Swarm Algorithm[END_REF].

Species Management

Species Breeding

Species selection is a tedious process. It requires identifying and selecting specific genes that determine adaptation to climate change, protect plants against diseases, provide a better taste, and so on . . . . MLAs take huge amount of data to analyse crops performance and build a model to determine which genes will increase a specific feature to a plant [START_REF] Thudi | Genomic Resources in Plant Breeding for Sustainable Agriculture[END_REF].

Species Classification

Classical approach consists in comparing colour and leaves shape. ML can provide more accurate and faster results by analysing the leaf vein morphology which expresses more information [START_REF] Weiss | Plant Species Classification Using a 3D LIDAR Sensor and Machine Learning[END_REF].

Species Reproduction

Pollination is the process in which pollen is taken from one plant to another so that it can reproduce. This task is essentially done by bees and insects. Problem is that bee number is dramatically decreasing. ML can help to detect the most fertile plants or select the most suitable time period when fertilization can happen and deploy drones to help in reproduction process [START_REF] Van Goethem | An IoT Solution for Measuring Bee Pollination Efficacy[END_REF].

Fields Management

Water Management

Water management in agriculture impacts environment balance. ML-based applications are connected with weather forecasting and evaporation estimations for a more effective use of irrigation systems [START_REF] Cardoso | Improve Irrigation Timing Decision for Agriculture Using Real Time Data and Machine Learning[END_REF].

Soil Management

Soil is a complex resource with many outside interactions. MLAs study evaporation processes, soil moisture and temperature to understand the dynamics of ecosystems and consequences [START_REF] Jain | Maximising Value of Frugal Soil Moisture Sensors for Precision Agriculture Applications[END_REF].

Livestock Management

Livestock Production

ML predicts outcome or evolution to optimize economic efficiency of livestock production allowing farmers to modify feeding or life conditions [START_REF] Nayeri | A Review of Traditional and Machine Learning Methods Applied to Animal Breeding[END_REF].

Animal Welfare

Diseases, promiscuity, boredom can lead to lethal consequences for cattle. ML classifiers can detect behaviour changes to determine stress, unhappiness or weariness and alert that a problem could occur [START_REF] Salzer | Towards On-Site Automatic Detection of Noxious Events in Dairy Cows[END_REF].

III -MAIN CONCEPTS

All applications presented above are based on ML. This part introduces underlying concepts and describes algorithms mainly deployed in agriculture.

Definitions

MLAs are programs that can learn from data and improve from experience. Learning tasks may include defining the best function that maps input to output, finding out the hidden structure of unlabelled data or grouping samples such that objects within the same cluster are more similar to each other than to the objects from another cluster.

The most common type of machine learning process is to learn the mapping function: Y = f (X) + e to make predictions of Y for new X with an irreducible error e based on the lack of attributes to sufficiently characterize the best mapping. This is called predictive modelling. The goal here is to make the most accurate possible predictions, irrespective of the function form.

Assumptions

MLAs make different assumptions about the shape and structure of the function and how best to optimize a representation to approximate it. Due to this reason, it is very important to try out different algorithms on a machine learning problem.

Assumptions are used for optimizing learning process, but can restrict what can be learned. Algorithms using strong assumptions are named parametric MLAs. Algorithms with weak assumptions about the mapping function form are classified as non-parametric MLAs. By not making assumptions, they can learn any functional shape from the training data. Decision Trees, Naive Bayes or Neural Networks are non-parametric MLAs.

To summarize, parametric methods make large assumptions about the mapping function and are faster to train, require less data but may not be as powerful. Non-parametric methods make few or no assumptions about the target function and in turn require a lot more data, are slower to train and have a higher model complexity, but can result in more powerful models [START_REF] Brownlee | Master Machine Learning Algorithms: Discover How They Work and Implement Them[END_REF][START_REF] Bonnardot | 8 Machine Learning Algorithms Explained in Human Language[END_REF].

IV -SUPERVISED ALGORITHMS

Input and output variables are available and an algorithm is used to learn the mapping function from the input to the output. It is called supervised learning because the learning process is based on a training dataset where the correct answers are already known. The algorithm iteratively makes predictions on the training data and is corrected by the "teacher". Learning stops when the algorithm achieves an acceptable level of performance. Supervised learning tasks can be used for resolving classification (output variable is a real value) or regression (value is a category) problems. The aims of supervised algorithm are make machines learn explicitly, predict outcomes or direct feedback.

K-Nearest Neighbour

KNN does not require to pre-process the training dataset. KNN predicts new data by searching into all the data for the K most similar means named neighbours and summarizing the output variable for those instances. For regression the mean output variable is used, in classification it is the most common class value. A distance measurement, commonly the Euclidean one, is computed to define which of the K instances in the training dataset are most similar to a new entry.

EuclideanDistance(a, b) = ⌜ ⃓ ⃓ ⎷ n ∑ i=1 (ai -bi) 2 (1)
Other distance measures are existing like Mahalanobis, Hamming, . . . . The best distance metric to use depends on data properties. Euclidean suits if input data are close. Prefer the Manhattan one if not. The computational complexity of KNN increases with the amount of the training dataset. For huge dataset, KNN can be optimized by using stochastic approach. A snippet is cut out from the training dataset and the K-most similar instances are computed from it. For regression problems, the prediction is based on the median value. For classification, it is the highest frequency class from the K-most similar instances.

Linear Discriminant Analysis

LDA is a dimensionality reduction algorithm used for multi-class classification. It aims to split the samples in a training dataset by their class value. The algorithm try to find out a linear combination of input variables that achieves the maximum separation for means between classes d 2 and the minimum variation of means within each class, the scatter s 2 . LDA creates an axis and projects the data onto this axis in a way to maximize the separation of categories.

Naive Bayes

NB is based on eponymic theorem equation ( 2) that provides a way to calculate the probability of a hypothesis given prior knowledge:

P (h|d) = P (d|h) P (h) P (d) (2)
Where P (h|d) is the probability of hypothesis h given the data d (posterior probability), P (d|h) the probability of data d given that the hypothesis h was true, P (h) the probability of hypothesis h being true regardless of the data (prior probability of h) and P (d) the probability of the data, regardless of the hypothesis. After calculating the posterior probability for a number of different hypotheses, the one with the highest probability is selected: the Maximum A Posteriori (MAP).

MAP(h) = max[P (h|d)] (3)
⇔ MAP(h) = max ⎛ ⎜ ⎜ ⎜ ⎝ P (d|h) P (h) P (d) ⏞ ⏟⏟ ⏞ Bayes theorem 2 ⎞ ⎟ ⎟ ⎟ ⎠ (4) ⇔ MAP(h) = max[P (d|h)] (5)
Equation ( 4) is obtained by substituting in equation (3) the equation (2) result. Then we find equation ( 5) after removing constants P (d) and P (h) in equation ( 4) because we are interested in the most probable hypothesis. Furthermore, we have an even number of instances in each class also the probability of each class will be the same.

It is named Naive Bayes because probabilities computation for each hypothesis are simplified and assumed to be conditionally independent. It requires a rigid independence assumption between input variables. Therefore, it is more proper to call "Simple Bayes" or "Independence Bayes". Rather than attempting to calculate the values of each attribute value P (d1, d2, d3|h), they are separately calculated like this: P (d1|h) P (d2|h). Figure 3

Support Vector Machines

SVM is the most popular algorithm. The numeric input variables consist in an n-dimensional space that can be split by a hyperplane. In SVM, this hyperplane is selected to best separate the points in the input variable space by their class. In a two-dimensional space, input data can be completely separated by a line matching this equation: B0 + (B1X1) + (B2X2) = 0.

Where B1 and B2 determine the slope of the line and B0 the intercept are found by the learning algorithm with X1 and X2 are the two input variables. The distance between the line and the closest data points is referred to as the margin. The optimal separation line is the one with the largest margin named the Maximal-Margin hyperplane. The margin is defined as the perpendicular distance from the line to only the closest points. Only these points are used for defining the line and building the classifier. These points are called the support vectors and defined the hyperplane figure 4.

The hyperplane is learned from training data using an optimization procedure that maximizes the margin. Learning of the hyperplane in linear SVM is done by transforming the problem using some linear algebra. If the groups can not be easily split, values are transformed by a function to be able to separate them figure 5. Leaf nodes are the output of those decisions and do not contain any further branches. Decisions are extracted from the given dataset and depend on its intrinsic features. A CART is a graphical representation for getting all possible solutions to a problem based on given conditions. It is called a DT because, similar to a tree, it starts with the root node, which expands on further branches and constructs a tree-like structure depicted by figure 6.

A decision tree simply asks a question, and based on the answer, it further splits the tree into subtrees. The representation is a binary tree as shown by figure 6. Each node represents a single input variable and a split point on that variable assuming it is numeric. The leaf nodes of the tree contain an output variable which is used to make a prediction. With the binary tree representation of the CART, making predictions is relatively straightforward. Given a new input, the tree is gone through by evaluating the specific input started at the root node of the tree.

Random Forest

RF is based on a multitude of DTs as shown in figure 7. It is one of the most popular and powerful MLAs. The problem with DTs is that they are greedy by nature. The variable which will be used to split the dataset is selected by using a greedy algorithm that minimizes error. Built DTs can have many structural similarities and so the same forecasting. By combining predictions from multiple models in ensembles works better if the forecasting from each sub-models are uncorrelated or weakly correlated. Random Forest changes the way the sub-trees are learned. With Decision Trees, when selecting a split point, the learning algorithm looks through all variables and all variable values in order to select the most optimal split-point. With Random Forest, the learning algorithm is limited to a random sample of features on which to search. Searched features at each decision node have to be passed to the algorithm.

Artificial Neural Network

ANN is very often used in agriculture. It represents the structure of a human brain. It consists of neurons and synapses organized into layers (figure 8). ANN can have a huge number of neurons connected together, which makes it extremely efficient at analysing and memorizing various information.

There are different types of ANN but always composed of the same components: neurons, synapses, biases, weights and functions.

Neuron or node (figure 9) is the elementary component that receives information, performs basic computation task, and sends it to the next ones.(i) Input neurons receive information (ii) Hidden neurons process that information (iii) Output neurons perform result.

In large NN, neurons are stacked into layers: (i) An input layer to receive information (ii) Some hidden layers to compute intermediate calculation (iii) An output layer that provides valuable results.

Every neuron performs transformation on the input information. Neurons only operate numbers in the range [0,1] or [-1,1]. In order to transpose data into something that a neuron can handle, a normalization function like Sigmoïd is required. Neurons communicate each other through synapses.

Synapses are links that connect each neuron. Every synapse has a weight. The weights also add to the changes in the input information. The results of the neuron with the higher weight will be dominant in the next neuron, while low important information will not be passed over. The initialization phase consists in randomly assign weights which will be optimized later.

Bias allows more variations of weights to be stored. Biases append more behaviours about the input space to the model's weights. In the case of neural networks, a bias neuron is added to every layer. It plays an important role by making it possible to tune the activation function.

Process aims for each neuron to extract a feature from input data. Each of the neurons has its own weights used for tuning the features. During the training phase, the "teacher" needs to select a weight for each of the neurons in order that the output provided by the whole network would be correct.

To perform transformations and get an output, every neuron has an activation function. This combination of functions performs a transformation described by a mapping function.

There are many types of Neural Networks. Main architectures are Perceptron, Feed Forward, Multilayer Perceptron (MLP), Convolutional or Radial Basis Function to name a few. They are trained like any other algorithm. The weights of the ANN are repeatedly optimized until the difference between data and output is zero or close to it. Then the model is correctly able to predict an accurate output.

V -UNSUPERVISED ALGORITHMS

Only input data are available and there is none corresponding output variables. The aim here is to model the underlying structure or distribution in the data in order to learn more about the data. This type of algorithms is called unsupervised learning because unlike supervised described above, there is no correct answers and no more "teacher".

Algorithms find out themselves and present the interesting structure in the data. Unsupervised learning problems can be split into clustering problems if you just want to group data and association problems if you try to define rules that describe large amount of data. Unsupervised algorithms can not be used for predicting results but are useful to identify patterns or structures.

Principle Component Analysis

PCA is a technique to build relevant features through linear or non-linear (kernel) combinations of the original variables. Relevant features are highlighted by linearly transforming correlated variables into a smaller number of uncorrelated variables. To do this, original data are projected into the reduced PCA space using the eigenvectors of the covariance matrix also known as the Principal Components (PCs). The resulting projected data are essentially linear combinations of the original data capturing most of the variance in the data. PCA can be defined as an orthogonal transformation of the data into a series of uncorrelated data.

Goals of PCA is to find linearly independent dimensions which can represent the data points and should allow to predict the original dimensions.

K-Means

Even if we do not know how the clusters will be constituted, the K-Means algorithm imposes to provide the expected number of clusters K. Some techniques exist to find the optimal K. Algorithm begins by randomly positioning center points named the starter means. Then it associates with the same clusters observations closest to these means. Next it calculates the average of the observations from each cluster and move corresponding means to computed position. After, the algorithm re-assign the observations to the nearest means and so on. To ensure the stability of found groups, the starter means selection is repeated several times because some initial draws may give a different configuration from the huge majority of cases.

Gathering the objects into well separated clusters K is performed by K-Means in such way that objects within each cluster are as close as possible to each other but as far as possible from objects in other clusters. Each cluster is characterized by its centre point named centroid which is the point whose coordinates are the average of the coordinates of points assigned to the clusters. In a dataset, K-Means algorithm tries to find the specified K number of clusters and their k centroids.

In following example, we suppose that dataset contains two variables and we expect to get two clusters:

K-Medoids

This algorithm is a clustering process related to K-Means and medoidshift algorithms. K-Means tries to reduce the total squared error, while k-medoids minimizes the sum of dissimilarities between points labelled to be in the same cluster and a point designated as the centre of that cluster. In contrast to K-Means, it chooses means as centres also known as medoids. A medoid is a data point of a dataset with the lowest average dissimilarity. It can be defined as the most centrally located dot in the dataset. K-Medoids algorithm is less sensitive to noise and outliers than K-Means (section 5.2) because it minimizes a sum of general pairwise dissimilarities instead of a sum of squared Euclidean distances. Choice of dissimilarity function is very wide. Main weak-point of the K-means algorithm is its sensitivity to outliers, because a mean can be easily biased by out-range values. To avoid this drawback, K-Medoids algorithm uses an actual point in the cluster to represent the centre of a cluster instead of the mean point. A medoid is the most centrally located object of the cluster, with minimum sum of distances to other points.

Figure 12: Mean versus Medoid

The group of points forms a cluster, while the rightmost point is an outlier. As mean can be biased, It could not represent the right cluster center. In the other hand, a medoid is robust to outliers and so correctly represents the cluster centre.

The most common implementation of K-Medoid clustering is the Partitioning Around Medoids algorithm. First, it randomly selects k of the n data points as the medoids. Secondly, the assignment step consists of associate each data point to the closest medoid. Then, for each medoid m and each data point o associated to m, it swaps m and o. Endlessly, the algorithm computes the total cost of the average dissimilarity of o to all the data points associated to m and select the medoid o with the lowest cost of the dissimilarity function. Steps 2 and 3 are repeated until there is no change in the assignments.

Mean Shift

It assigns the data points to the clusters iteratively by shifting points towards the highest density of data points in the region. Unlike K-Means (section 5.2) clustering algorithm, Mean Shift does not require specifying the number of clusters in advance because it is determined by the algorithm with respect to the data. Main drawback to Mean Shift is its expensive computation time.

Mean Shift clustering algorithm required that data are mathematically represented because it is based on Kernel Density Estimation. KDE is a probability function used for estimating the underlying distribution by placing a kernel on each point in the data set. A kernel is a weighting function. Many types of kernels are existing but the most popular is the Gaussian one. Adding up all the individual kernels generates a probability surface example density function. The resultant density function will be different depending on the kernel bandwidth parameter. The key idea here is that for each point of a cluster, the neighbourhood of a given radius eps has to contain at least a minimum number of points named MinPts.

Partitioning methods like K-Means (section 5.2) and hierarchical clustering are useful for finding compact and well-separated clusters with spherical or convex shapes. But, real datasets contain arbitrary shape or noise. DBSCAN algorithm suits this kind of clusters better.

VI -DATASETS

Provide a dataset is the main difficulty to deploy ML. Furthermore, labelled datasets are required to implement supervised approaches. Some smart agriculture data can be found but the majority of them are not on digital format. To perform researches, universities or scientists have built and provided a few datasets. This part describes a few ones that can be freely used.

Rice Leaf Diseases

This dataset is provided by UC Irvine Machine Learning Repository, and it is used for detecting and classifying rice plant diseases [START_REF] Harshadkumar | Detection and Classification of Rice Plant Diseases[END_REF]. It has been created by manually separating infected leaves into different disease classes. There are three categories of disease: bacterial leaf blight, brown spot, and Leaf smut. Each one is composed of 40 jpg images. They were captured with a white background, in direct sunlight.

PlantVillage

PlantVillage is a not-for-profit project created by Penn State University in the USA and EPFL in Switzerland [START_REF] Hughes | An Open Access Repository of Images on Plant Health to Enable the Development of Mobile Disease Diagnostics[END_REF]. 10,000 images of diseased and healthy crops have been collected. The aim is to develop algorithms than can accurately diagnose a disease based on an image. The dataset is offering 38 classes and 54,305 images of 14 different plant species in total, 12 of which are healthy, 26 of which are diseased. The dataset also has one more class identifying 1143 background. Thus, total number of images is up to 55,000.

DeepWeeds

It is a multi-class weed species image dataset for deep learning [START_REF] Olsen | AlexOlsen/DeepWeeds[END_REF]. It consists of 17,509 images capturing eight different weed species native to Australia with neighbouring plants.

PlantDoc

PlantDoc is a dataset for visual plant disease detection released by researchers at Indian Institute of Technology in 2019 [START_REF] Kayal | Pratikkayal/PlantDoc-Dataset[END_REF].

Early detection of plant diseases is difficult due to the lack availability of sufficiently large-scale dataset. This dataset can be used for benchmarking classification models. It contains 2,598 data points in total across 13 plant species and up to 17 classes of diseases extracted from annotated internet images. Unlike similar dataset like CropDeep, this dataset is freely available to download for machine or deep learning.

CropDeep

It is a species classification and detection dataset, consisting of 31,147 images with over 49,000 annotated instances from 31 different classes. In contrast to existing vision datasets, images were collected with different cameras and equipment in greenhouses, captured in a wide variety of situations. It features visually similar species and periodic changes with more representative annotations, which have supported a stronger benchmark for deep-learning-based classification and detection.

VII -TOOLS & METRICS

Machine learning implementation

Many tools and framework are existing to implement MLAs. We can cite four main tools: (i) Python with Jupyter is an interpreted high-level general-purpose programming language with many ML libraries. (ii) R with TensorFlow is a programming language provided with a free software environment named RStudio for statistical computing and graphics. The R language is widely used among statisticians and data miners. (iii) MatLab is a licenced proprietary multi-paradigm programming language and numeric computing environment developed by MathWorks. (iv) Weka a free, open-source and multiplatform collection of visualization tools and algorithms for ML.

The workbench for machine learning

Waikato Environment for Knowledge Analysis is a freely available and commonly used open source software developed at the University of Waikato in New Zealand. The Weka Toolbox1 is written using object-oriented language Java. It provides implementation of state-of-the-art data mining or MLAs [START_REF] Witten | Data Mining: Practical Machine Learning Tools and Techniques[END_REF]. It affords many functionalities as association, filtering, classification, clustering, visualization, regression, and so on.

Overall, data must be converted into an ARFF (Attribute-Relation File Format) file. This is an ASCII text file that describes a list of instances sharing a set of attributes. ARFF files have two distinct sections: (i) the Header which contains the name of the relation, a list of the attributes and their types, (ii) the Data: % Comment @RELATION iris @ATTRIBUTE sepallength NUMERIC @ATTRIBUTE sepalwidth NUMERIC @ATTRIBUTE petallength NUMERIC @ATTRIBUTE petalwidth NUMERIC @ATTRIBUTE class {Iris-setosa,Iris-virginica} @DATA 1,5,4,5,Iris-setosa 4,3,1,4,Iris-setosa 4,3,1,6,Iris-setosa

Basic features

Algorithm performances can be evaluated by using multiple metrics defined and explained below. We can define the following four basic features:

True Positives (TP) correctly predicted to be true positives ⇒ correctly classified as malware

True Negatives (TN) correctly predicted to be false and really negatives ⇒ correctly classified as benign False Positives (FP) predicted to be true, but was incorrect, it was actually false ⇒ incorrectly classified as malware False Negatives (FN) predicted to be false, but was incorrect., it was actually true ⇒ incorrectly classified as benign

Performance metrics

Therefore, main performance metrics are calculated based-on the previous basic features: Sensitivity and Specificity are inversely proportional to each other. So when we increase Sensitivity, Specificity decreases and vice versa.

VIII -CONCLUSION

Agriculture is more and more connected or automated. A huge amount of data is generated by all these smart and communicating devices. Collect then analyse them by machine learning techniques is probably the most suitable solution to evolve from a smart to a sustainable agriculture.

To provide and perform efficient answers to practical problems like weeds fighting, animals well-fare or diseases prevention, accurate algorithms must be developed. But to reach this goal, real or freely materials are required to be able to test proposed approaches or experiment new applications.

Help farmers to digitalize existing data could be a win-win solution to fill this data lake. Another way is to assist them in every way to deploy smart agriculture and in other hand, compile and broadcast collected information.

A smart and sustainable agriculture is the key to reach a better environment and provide the best one to our descent.

Figure 1 :

 1 Figure 1: KNN example

Figure 2 :

 2 Figure 2: LDA example

  depicts a NB classification.

Figure 3 :

 3 Figure 3: NB example

Figure 4 :

 4 Figure 4: SVM example

Figure 6 :

 6 Figure 6: CART diagram Figure 7: Simplified RF

Figure 8 :

 8 Figure 8: ANN structure Figure 9: Neuron example

Figure 10 :

 10 Figure 10: PCA example

Figure 11 :

 11 Figure 11: K-Means example

Figure 13 :

 13 Figure 13: Mean Shift principle Figure 14: Density example

Figure 15 :

 15 Figure 15: Well-separated clusters Figure 16: Arbitrary shapes and noise example

AccuracyT P

 P +T N T P +F N +F P +T N ⇒ gives the overall accuracy of the model, meaning the fraction of the total samples that were correctly classified Misclassification rate or Classification Error F P +F N T P +F N +F P +T N ⇒ tells what fraction of predictions were incorrect. Precision T P T P +F P ⇒ expresses what fraction of predictions as a positive class were actually positive. True-Positive Rate (TPR) or Recall or Sensitivity T P T P +F N ⇒ fraction of all positive correctly predicted as positive True-Negative Rate (TNR) or Specificity T N T N +F P ⇒ fraction of negative cases correctly predicted as negative False-Positive Rate (FPR) F P T N +F P = 1 -TNR False-Negative Rate (FNR) F N T P +F N = 1 -TPR F-Measure (FM) or F1 Score 2 Recall.Precision Precision+Recall ⇒ is the harmonic mean of Precision and Recall (where 1 is 'good' and 0 is 'bad'). Matthews Correlation Coefficient (MCC) T P.T N -F P.F N √ (T P + F P )(T P + F N )(T N + F P )(T N + F N )

http://www.cs.waikato.ac.nz/ml/weka