Valérie Morineaux

Christelle Mazuet

Didier Hilaire

Julien Enche

Michel R Popoff

Characterization of botulinum neurotoxin type A subtypes by immunocapture enrichment and liquid chromatography-tandem mass spectrometry

Keywords: Botulinum neurotoxin, Clostridium botulinum, subtyping, mass spectrometry

INTRODUCTION

Botulinum neurotoxins (BoNTs) are the most potent toxins and are responsible for a severe paralytic disease, botulism, in man and animals. Most often, botulism occurs subsequently to the ingestion of food contaminated with Clostridium botulinum and containing preformed BoNT. The toxin is absorbed from the intestine, and reaches the neuromuscular junction via the blood or lymph circulation and the interstitial fluid. BoNTs act at the neuromuscular junction in inhibiting the evoked release of acetylcholine, thus leading to paralytic symptoms including blurred vision, ptosis, dry mouth, difficulty in swallowing, then descending flaccid paralysis of voluntary muscles and respiratory insufficiency [START_REF] Rossetto | Botulinum neurotoxins: genetic, structural and mechanistic insights[END_REF][START_REF] Simpson | Identification of the major steps in botulinum toxin action[END_REF][START_REF] Sobel | Botulism[END_REF].

BoNTs are divided into 7 toxinotypes (A to G) based on their immunological properties using the mouse biological test and specific neutralizing antisera [START_REF] Popoff | Botulism and Tetanus[END_REF][START_REF] Lindström | Laboratory diagnosis of botulism[END_REF]. A new subtype, called H, has been reported and waits for further characterization [START_REF] Dover | Molecular characterization of a novel botulinum neurotoxin type h gene[END_REF]. BoNT genes have been sequenced from a large number of strains and sequence comparison has permitted to identify sequence variations in each toxinotype. Thereby, botulinum toxinotypes are divided into subtypes [START_REF] Hill | Genetic diversity within Clostridium botulinum serotypes, botulinum neurotoxin gene clusters and toxin subtypes[END_REF]. Five BoNT/A subtypes (A1 -A5) have been identified and recently three additional subtypes (A6 to A8) are under characterization [START_REF] Mazuet | Le botulisme humain en France, 2010-2012[END_REF][START_REF] Mazuet | Toxin detection in patients' sera by mass spectrometry during two outbreaks of type A Botulism in France[END_REF] (GenBank ACW83608, JQ954969, KF667385, respectively). Signification of sequence diversity in each toxinotype is not yet well known, but could be important in diagnostic tests and development of therapeutic agents such as those based on immunotherapy. Indeed, BoNT/A1 and BoNT/A2, which differs by 10% at the amino acid sequence level, show large differences in monoclonal antibody-binding affinity. Among six monoclonal antibodies, which bind to BoNT/A1 with to BoNT/A2. Only combinations of monoclonal antibodies, which tightly bind to toxin subtype, potently neutralize the corresponding toxin in vivo. Association of the three monoclonal antibodies with high affinity binding to subtypes A1 and A2, completely neutralizes A1 or A2 toxin, while replacement of two from three monoclonal antibodies by two having a low binding affinity to BoNT/A2 induces a decrease in BoNT/A2 neutralization (50 fold less) [START_REF] Smith | Sequence variation within botulinum neurotoxin serotypes impacts antibody binding and neutralization[END_REF]. Sequence variation among subtypes might also impact the toxin activity and subsequently the course of the disease. The enzymatic site of BoNT/A3 and BoNT/A4 light (L) chain is conserved, but non-conservative mutations are observed in domains involved in substrate (SNAP-25) recognition [START_REF] Arndt | A structural perspective of the sequence variability within botulinum neurotoxin subtypes A1-A4[END_REF]. Therefore, L chains from subtypes A3 and A4 show different catalytic properties with the substrate SNAP25 compared to L chain from subtypes A1 and A2, which show the same catalytic activity, although all L chain isoforms bind SNAP25 with similar affinity. L chain from subtype A4 and to a lower extent from subtype A3, cleaves less efficiently SNAP25 than L chain subtype A1 (2 and 23 fold less, respectively) [START_REF] Henkel | Catalytic Properties of Botulinum Neurotoxin Subtypes A3 and A4[END_REF][START_REF] Ahmed | Enzymatic autocatalysis of botulinum A neurotoxin light chain[END_REF]. BoNT/A1 to A5 exhibit distinct in vitro catalytic activity as well as different biological activity in neuronal cell and mouse models [START_REF] Whitemarsh | Characterization of botulinum neurotoxin A subtypes 1 through 5 by investigation of activities in mice, in neuronal cell cultures, and in vitro[END_REF]. BoNT/A2 enters neuronal cells faster than BoNT/A1 and it is more potent [START_REF] Pier | Botulinum neurotoxin subtype A2 enters neuronal cells faster than subtype A1[END_REF]. In addition, BoNT/A2 is a more potent inhibitor of neurotransmission at the neuromuscular junction [START_REF] Torii | Comparison of effects of botulinum toxin subtype A1 and A2 using twitch tension assay and rat grip strength test[END_REF]. However, both toxins have comparable duration of action [START_REF] Mukai | Comparison between botulinum neurotoxin type A2 and type A1 by electrophysiological study in healthy individuals[END_REF].

Subtype identification is usually performed via PCR amplification of bont genes and subsequent DNA sequencing [START_REF] Hill | Genetic diversity within Clostridium botulinum serotypes, botulinum neurotoxin gene clusters and toxin subtypes[END_REF][START_REF] Hill | Genetic diversity among Botulinum Neurotoxin-producing clostridial strains[END_REF]. This method requires the presence of the toxigenic strain in the samples and optimally strain isolation and DNA extraction. However, certain samples might contain BoNT in the absence of the bacterium yielding impossible the use of traditional DNA-based methods. Mass spectrometry (MS) methods have been developed to detect active BoNTs through peptide identification from substrate cleavage (Endopep-MS) (review in [START_REF] Aberg | Mass spectrometric detection of protein-based toxins[END_REF]). Endopep-MS is a sensitive method to detect BoNT types, but it cannot identify the toxin subtypes, since all the subtypes of each type recognize the same cleavage site. Tryptic digestion of the toxin itself and analysis of tryptic peptides by MS might allow subtype determination. Thereby, BoNT/A1 and BoNT/A2 have been identified in spiked milk samples based on differential peptides between the two subtypes [START_REF] Kalb | Detection of botulinum neurotoxin A in a spiked milk sample with subtype identification through toxin proteomics[END_REF]. A similar approach has been described to differentiate the subtypes of BoNT/B [START_REF] Kalb | De novo subtype and strain identification of botulinum neurotoxin type B through toxin proteomics[END_REF]. A multiple enzyme and sequential ingel digestion approach (MESID) has been proposed for BoNT subtyping. The multiple proteolytic enzymes used in this method facilitate near-complete sequence coverage of all the seven BoNT toxinotypes [START_REF] Wang | Subtyping Botulinum Neurotoxins by Sequential Multiple Endoproteases In-Gel Digestion Coupled with Mass Spectrometry[END_REF].

EXPERIMENTAL

Safety considerations

BoNTs have been handled with strict respect to safety rules for the handling of toxic substances.

Materials and chemicals

C. botulinum strains used in this study are listed in Table 1. C. botulinum strains were grown in trypticase-glucose-yeast extract medium in anaerobic conditions for 4 days. Culture supernatants were stored at -80°C until use. The presence of toxin in the supernatant was first detected by immune-chromatographic test (BTA Gold Assay. NBC-Sys, France) and the toxin activity (MDL 100 .ml -1 ) was then tested by mousse bioassay as previously described [START_REF] Leveque | Direct biosensor detection of botulinum neurotoxin endopeptidase activity in sera from patients with type A botulism[END_REF]. All the peptides used were provided by Proteogenix (France) with purity greater than 95%. The lyophilized peptides were suspended in H 2 O/HPLC-grade acetonitrile (ACN) 50/50 at a concentration of 1 mg.ml -1 and stored at -20°C. A rabbit anti-peptides polyclonal antibody (anti-peptides PAb) was specifically generated by Proteogenix for the immune-magnetic separation. Two peptides: Q67-K84 (QVPVSYDSTYLSTYLSTDNEK) and D49-K66 (DTFTNPEEGDLNPPPEAK) from light chain (Lc) were selected for the immunization. The peptide Q67-K84 is common to the subtypes A1, A2, A3, A5, A6, A7 and A8. The peptide D49-K66 is present in all subtypes but shows one mutation in the A7 subtype (I50 to T) and in the A8 subtype (K55 to E). Despite these mutations, the two peptides were recognized by the anti-peptides PAb. The reactivity of the anti-peptides PAb with the BoNT/A1, /A2, /A3, /A5, /A7 and /A8 was checked by Elisa procedure (data not shown). The absence of crossreactivity against BoNT/A heavy chain (Hc), BoNT/B and BoNT/E was tested by Western-Blot (data not shown). Determination of mouse lethal dose (MLD 100 ) was performed as previously described [START_REF] Mazuet | Characterization of botulinum neurotoxin type A neutralizing monoclonal antibodies and influence of their half-lives on therapeutic activity[END_REF]. Briefly, 0.5 ml of serial 10-fold and then 2-fold dilutions of samples in phosphate buffer (50 mM, pH 6.3) containing 0.2% gelatin were injected intraperitoneally (3 mice per dilution).

The mice were observed up to 4 days.

Preparation of anti-peptides PAb coated magnetic beads

Protein G-conjugated magnetic beads (Dynabeads Protein G, Novex) (250 µl) were transferred in a 2 ml Eppendorf low binding micro centrifuge tube and were washed three times with 500 µl of PBST (Phosphate Buffer Salt, 0.1 % Tween 20). After removing the final solution wash, the beads were suspended in 500 µl of PBST containing 100 µg. ml -1 antipeptides PAb. The mixture was incubated for 30 min with rotation at laboratory temperature.

The beads were washed three times with 1 ml of PBS containing 0.15 M NaCl. Antibodies were cross-linked to the beads by incubating, for 30 min with rotation at laboratory temperature, in 1250 µl of PBS containing 0.15 M NaCl and 5 mM BS 3 (crosslinking reagent). 65 µl of Tris/HCl 1 M pH 7.5 were added for quenching the cross-linking reaction.

After incubation for 15 min at laboratory temperature with rotation, the beads were washed three times with 1 ml of PBST and resuspended in 250 µl of PBST. They were stored at 4°C for as long as 3 weeks.

In-gel digestion

Each culture supernatant of distinct C. botulinum strains from BoNT subtype was precipitated with 60 % of ammonium sulfate. After precipitation, the pellet was dissolved in 50 mM sodium citrate buffer pH 5.5 and dialyzed overnight at 4°C against the same buffer.

The dialyzed sample was fractionated via molecular size chromatography [25] using an AKTÄ system and an S300 column (HiPrep 26/60 Sephacryl S-300 HR -GE Healthcare Bio-Sciences). For each subtype, the relevant fractions were pooled and considered as pre-purified complexes. The amount of proteins on pre-purified complexes was determined by the Bio-Rad protein assay with Bovine IgG as standard protein. 1 to 2 µg of each pre-purified complex for each BoNT subtype were run on a SDS-PAGE. After migration, gels were fixed and stained with Coomassie staining solution (Bio-Rad, Marnes la Coquette, France). Based on protein size, gel regions containing protein to identify were excised and cut into small pieces. Gel pieces were destained by washing cycles in water and acetonitrile for 10 min.

After destaining, gel pieces were dried by vacuum centrifugation and reduced with DTT

Immunocapture enrichment and trypsin digestion

Culture supernatants or samples, crude or diluted in PBS, in a volume of 500 µl were treated with beta-mercaptoethanol (35 µl of 14 M stock solution) for 10 min at 95 °C in a dry heating block. After cooling at room temperature, each sample was mixed with 100 µl of PAb-coated magnetic beads in an Eppendorf low binding microcentrifuge tube. The mixture was incubated for 120 min at laboratory temperature with rotation. The beads were then recovered using a magnetic particle concentrator and washed three times with 1 ml of Hepes buffer (pH 7.6, 50 mM). The beads were then suspended in 100 µl of 100 mM ammonium carbonate buffer (pH 8.5) and incubated for 10 min at 95°C. 15 µl of 100 µg.ml -1 aqueous trypsin solution (sequencing grade modified trypsin, Promega) was added and the enzymatic digestion was carried out at 38°C for 120 min. After digestion, the magnetic beads were removed and 2 µl of analytical grade formic acid (FA) was added. The solution was vacuumdried and resuspended in 50 µl of H 2 O/ ACN/FA 93/5/2 before the LC-QqQ-MS anlysis..

LC-ESI-MS/MS analysis

ESI-LC-MS/MS analysis was performed on an Esquire 6000 mass spectrometer (Bruker Daltonics, Bremen, Germany) connected with an Ultimate 3000 high performance liquid chromatograph (Dionex Corp., Sunnyvale, CA). The protein digest (10 µL) was injected on a 0.3 × 150 mm PepMap100 capillary column, particle size 5 µm, 100 Å pore size (LC Packings, Amsterdam, The Netherlands). Samples were eluted using a gradient starting with a linear increase from 5 to 10% acetonitrile over 4 min, followed by an increase from 10 to 80% acetonitrile over 42 min with 0.2% acid formic throughout as additives. The data acquisition was performed using the data-dependent mode where the three highest-intensity precursors in an MS1 survey scan were selected for collision-induced dissociation. The resulting MS/MS data were searched for protein candidates with a database search against NCBInr database using MASCOT software (Matrix version 2.2.07, Sciences, London, U.K.). The mass tolerance of precursor ions and fragment ions was 0.5 Da. Resulting peptides were filtered with a significance threshold of p < 0.05.

LC-QqQ-MS analysis

The HPLC system used for this analysis was an Ultimate 3000 RSLC equipped with a degasser, a binary pump, an auto-injector and a column oven (Thermo Scientific) coupled to a TSQ Quantiva electrospray ionization triple quadrupole mass spectrometer (Thermo Scientific). Chromatographic separations were performed on Zorbax SB-C18 2.1 × 150 mm, 3.5 µm, 80Å pore size (Agilent) using 0.2% (v/v) formic acid as eluent A and acetonitrile with 0.2% formic acid as eluent B with a flow rate of 200 µL/min at 25°C. Samples (10 µl) were analyzed in a gradient mode: 5% eluent B (0-2 min) and 50% B (30 min). The mass spectrometer ESI source was operated in positive ionization mode. The following conditions were applied: spray voltage, 4000 V; sheath gas, 50 Arb; aux gas, 10 Arb; sweep gas, 5 Arb; ion transfer tube temp, 325°C; vaporizer temp, 275°C; CID gas, argon, 2 mTorr.

Food and biological samples

Food and human serum samples were artificially spiked with culture supernatant of each C. botulinum A subtype, and 0.5 ml of each sample were treated as above described for the culture supernatants except that the serum samples were not heated. Serial 10 fold dilutions of each sample were tested by mouse bioassay and by immunocapture/ LC-QqQ-MS method.

RESULTS

Selection of specific peptides for botulinum toxin A subtypes detection

MS-based analysis can distinguish proteins on the basis of amino acid sequence.

BoNT/A1 to BoNT/A8 subtypes share 84.5 to 97.2 % identity at the amino acid level (Table 2). We first identified the trypsic cleavage sites on the sequences of the L chain (amino acids 1 to 449) of each BoNT/A subtype and we then analyzed all the subsequent peptides for their specificity versus the other BoNT/A subtypes by Blast. Thereby, 26 peptides of each BoNT/A subtypes were analyzed in silico. Two to 12 unique peptides for each BoNT/A subtype were synthesized and analyzed in MS (Table 3). For each subtype, two specific peptides yielding the highest MS signals were selected. One peptide was common to both BoNT/A2 and BoNT/A8, and two other to BoNT/A1 and BoNT/A6. Moreover, two additional peptides which were conserved in all BoNT/A subtypes were also selected (Table 4).

To validate the selection of these peptides for the identification of BoNT/A subtypes, BoNT preparations of each subtype (1 to 2 µg) were run on a SDS-PAGE and the bands containing the L chain were cut out of the gel. After in gel trypsin digestion, the peptides were extracted and analyzed with LC-ESI-MS/MS (data not shown). BoNT/A4 and BoNT/A6 were not included in this study due to the difficulty to obtain BoNT/A4 preparations containing sufficient amounts of toxin and to the fact that BoNT/A6 (strain CDC41370) was not available in our collection.

Identification of BoNT/A subtype in culture supernatants

To identify BoNT/A subtype in a complex environment like culture supernatant, we used an immunocapture step. For that purpose, magnetic beads were coated with antibodies raised against two synthetic peptides conserved in BoNT/A light chain subtypes as described in the Experimental part. Culture supernatant samples (500 µl) were reduced by addition of betamercaptoethanol to allow the separation of L and H chains and were then incubated with coated magnetic beads. After washing, the bound material was digested by trypsin in-situ, 5. The selected conserved peptides were detected in all the C. botulinum culture supernatants tested, whereas the selected specific subtype peptides were only identified in the corresponding C. botulinum subtype culture supernatants. However, the I376-K387 peptide was detected in both C. botulinum A2 and A8 subtype culture supernatants, in contrast to the D292-K299 peptide which was only found in C. botulinum A2 strains (Table 5).

Sensitivity

The limit of detection (LOD) of the LC-QqQ-MS method was estimated by using serial dilutions of C. botulinum culture supernatants. LOD corresponded to the highest dilution giving a signal with a signal-to-noise ratio of 3. The results with representative C. 6. The MS methodology could detect BoNT ranging from 20 to 140 MLD/0.5 ml according to the subtype.

Identification of BoNT/A subtype in different matrices

In order to validate the LC-QqQ-MS methodology with biological, food or environmental samples, LOD was determined in various representative matrices (tape water, orange juice, human serum) spiked with the distinct BoNT/A subtypes. As shown in Table 7, the BoNT/A subtypes A1 to A8 were successfully identified in all the different samples. The highest LOD values were obtained with tape water and orange juice and were comparable to those obtained with culture supernatants (Table 6), whereas the detection was slightly lower (4 to 10 fold less) in human serum.

DISCUSSION

Detection of BoNT in biological samples and food is critical for early diagnosis of botulism and to apply an efficient treatment of the disease. Investigation of BoNT in food or environmental samples is also essential for identifying the source of contamination and preventing outbreak extension of botulism. Typing and subtyping are important to estimate the severity of the disease and to adapt the appropriate treatment notably the specificity of the antisera. MS is a rapid and powerful method to identify proteins. Here, we show that a LC-QqQ-MS method coupled to an immunopurification step allows identification of BoNT/A type and subtypes from complex samples. The method based on L chain peptides specific of BoNT/A subtypes A1 to A8 yielded unambiguous identification of the subtypes. A previous MS approach has been designed to differentiate BoNT/A1 and BoNT/A2 [START_REF] Kalb | Detection of botulinum neurotoxin A in a spiked milk sample with subtype identification through toxin proteomics[END_REF]. Identification of BoNT types A1 to G was achieved by using multiple enzyme digestion in gel and subsequent LC-QqQ-MS analysis. This method is predicted to identify the subtypes but has not yet been validated [START_REF] Wang | Subtyping Botulinum Neurotoxins by Sequential Multiple Endoproteases In-Gel Digestion Coupled with Mass Spectrometry[END_REF]. Our procedure efficiently discriminated the distinct BoNT/A subtypes. One important advantage is that complex samples can be used. Subtyping was efficiently performed with crude culture supernatants. An additional advantage is that this method of subtyping is performed in one step without the need of further techniques or reagents to address the subtyping. However, this method would be tested with complex and naturally contaminated samples like food or stools. LOD of the proposed method (20 to 140 equivalents MLD in 0.5 ml) is in the range of the minimal toxin concentrations found in food.

The sensitivity of the method could be increased by using a greater sample volume. Using artificially spiked samples representative of food, environmental and biological samples, the LC-QqQ-MS method allowed the identification of all the BoNT/A subtypes tested. LOD varied with the matrix, with the lowest values in serum samples. Albeit the proposed method is not sensitive enough to detect limited BoNT amounts, it is appropriate for contaminated environmental or food samples which usually contain significant BoNT concentrations (100 MLD/g and more). The advantage of the LC-QqQ-MS approach is to allow subtype identification in the absence of viable neurotoxin producing bacteria or available DNA in samples to perform a genetic subtyping. Further developments are still required for application with biological samples. It is noteworthy that this methodology might be updated to identify new subtypes that will be evidenced, by selecting additional specific peptides on light and/or heavy chains. (LYGIAINPNR peptide) from BoNT/A1 (strain Hall), BoNT/A2 (strain 9336), BoNT/A3 (strain Loch Maree), BoNT/A5 (strain 126.07), BoNT/A7 (strain 148.08), and BoNT/A8 (strain 217.12) supernatants. Clostridium sporogenes (strain 261.05) supernatant was used as negative control. The expected retention time is 15.7 min.

  three show a marked decrease in binding affinity (500 to more than 1000 fold)

  report a liquid chromatography/triple quadrupole tandem mass spectrometry with multiple reaction monitoring method (LC-QqQ-MS) for subtyping BoNT/A in culture supernatants or biological and food samples.

  The food and environmental samples were from local source (local tape water), local grocery (orange juice), and French Defense Health Service (human serum).Animals and ethics statementApproval of Ethic Committee of DGA Maîtrise NRBC was obtained. BALB/C mice (female, 4 weeks old) were purchased from Charles River. The animals were fed with water ad libidum. The mice severely injured were euthanized.

  mM ammonium carbonate buffer and alkylated with iodoacetamide 55mM in 50 mM ammonium carbonate buffer. Gel pieces were washed again with 50 mM ammonium carbonate buffer and dehydrated in 100% acetonitrile (ACN) before trypsin digestion (15 µg.ml -1 ) at 4°C during 45 min and 2 hours at 37°C. Tryptic peptides were extracted from the gel in three successive steps (15 min each), using 2 cycles of 5% formic acid, and then 100% ACN extraction solutions. After drying by vacuum centrifugation, tryptic peptides were resuspended in 20 µl of 1% TFA before LC-ESI-MS/MS analysis.

Fig. 1 .

 1 Fig. 1. Clostridium sporogenes which is closely related to C. botulinum A strains showed no detectable peptide corresponding to L chain fragment. Fig. 2 shows identification of BoNT/A2 through detection of the specific subtype peptide (DVASTLNK) detection by LC-MS/MS in C. botulinum culture supernatants. The global results of peptide detection in C. botulinum culture supernatants are listed in Table5. The selected conserved peptides were

9 botulinum

 9 culture supernatant subtypes and expressed in equivalent MLD100 which have been determined by the mouse bioassay, are shown in Table

Figure 1 .

 1 Figure 1. Example of detection of a conserved peptide in culture supernatants from representative C. botulinum A subtypes. Ion chromatograms of SRM transition 565.8/684.4

Figure 2 .

 2 Figure 2. Example of detection BoNT/A2 in culture supernatants from representative C. botulinum A subtypes. Ion chromatograms of SRM transition 424.2/215.1 (DVASTLNK

  Example of detection of a conserved peptide in culture supernatants from representative C. botulinum A subtypes. Ion chromatograms of SRM transition 565.8/684.4 (LYGIAINPNR peptide) from BoNT/A1 (strain Hall), BoNT/A2 (strain 9336), BoNT/A3 (strain Loch Maree), BoNT/A5 (strain 126.07), BoNT/A7 (strain 148.08), and BoNT/A8 (strain 217.12) supernatants. Clostridium sporogenes (strain 261.05) supernatant was used as negative control. The expected retention time is 15.7 min. 529x764mm (72 x 72 DPI) Example of detection BoNT/A2 in culture supernatants from representative C. botulinum A subtypes. Ion chromatograms of SRM transition 424.2/215.1 (DVASTLNK peptide) from BoNT/A1 (strain Hall), BoNT/A2 (strain 9336), BoNT/A3 (strain Loch Maree), BoNT/A5 (strain 126.07), BoNT/A7 (strain 148.08), and BoNT/A8 (strain 217.12) supernatants. Clostridium sporogenes (strain 261.05) supernatant was used as negative control. The expected retention time is 10.1 min. 529x764mm (72 x 72 DPI)

Table 1 .

 1 Clostridium sporogenes (strain 261.05) supernatant was used as negative control. The expected retention time is 10.1 min. List of C. botulinum strains used in this study, their neurotoxin gene cluster, and mouse lethal activity of culture supernatant as tested with mouse bioassay.

	1 (DVASTLNK

Table 2 .

 2 Amino acid sequence identity (%) of BoNT/A subtypes. Amino acid sequences from

	representative strains are: BoNT/A1 from strain Hall (YP_001386738.1); BoNT/A2 from
	strain Kyoto (CAA51824.1); BoNT/A3 from strain Loch Maree (YP_0017157303.1);
	BoNT/A4 from strain BA857 (YP_002860313.1); BoNT/A5 from strain IBCA94-0216
	(ACT33194.1); BoNT/A6 from strain CDC 41370 (ACW83608.1); BoNT/A7 from strain
	148.08 (AFV13854.1); BoNT/A8 from strain 217.12 (AHA83316.1).

Table 4 .

 4 MS analysis of BoNT/A light chain peptides. Results of MS analysis of synthetic peptides specific of each BoNT/A subtype. 3 transitions for each analysis, n=3.

	F o r P e e r R e v i e w

Table 6 .

 6 Estimated limit of detection (LOD). LOD is expressed in equivalent MLD 100 /0.5 ml.Signal to noise ratio of 3. Results are mean values ± SD. n=3.

							22
	Matrices	Hall (A1)	9336 (A2)	Loch Maree (A3)	126.07 (A5)	148.08 (A7)	271.12 (A8)
	Tape Water	70	20	50	15	110	50
	Orange juice	110	50	70	20	150	60
	Human serum	300	200	250	100	500	300
		F o
		r
		P
			e e r
				R e v i e w

Table 7 .

 7 Estimated limit of detection (LOD expressed in equivalent MLD 100 /0.5 ml) in various samples. Signal to noise ratio of 3. n=3.

Analytical & Bioanalytical Chemistry

Acknowledgements

We thank the toxicology department of DGA Maîtrise NRBC for its help on animal experimentations. This research was supported by grants from Direction Générale de l'Armement.

L232-R241

( conserved)

G114-K128

(conserved)

S167-R177

(BoNT/A1)

V382-R393

(BoNT/A1)

D292-K299

(BoNT/A2)

I376-K387

(BoNT/A2-/A8)

S167-R177

(BoNT/A3)

G348-K359

(BoNT/A3)

I98-R105

(BoNT/A5)

I376-R393

(BoNT/A5)

E292-K299

(BoNT/A7)

M376-R393

(BoNT/A7)

E56-K66

(BoNT/A8)


Mouna Rekik
email: mouna.rekik@ifsttar.fr

Zied Chtourou
email: ziedchtourou@gmail.com

Christophe Gransart
email: christophe.gransart@ifsttar.fr

A Cyber-Physical Threat Analysis for Microgrids

Keywords: Microgrid, cyber-physical security, vulnerability, threat landscape, risk

MicroGrids (MGS) are foreseen as a building block of the smart grid. They allow for the integration of distributed energy resources and storage within the conventional grid. This is partly possible through deployment of Information and Communication Technologies (ICTS) within these structures. Therefore cyber security is a major concern for MGS. This paper investigates cyber-physical security aspects of the MG, including vulnerabilities and threat landscape. A cyber-physical security risk assessment is presented for evaluating impacts of exploiting existing vulnerabilities by potential threats on MG operations.

I. INTRODUCTION

The MGS group Distributed Energy Resources (DERS), energy storage devices and loads within restricted geographic area and present them as a single controllable entity to the utility grid. They can operate connected or islanded to/from the main grid whenever required by physical or economic conditions. This concept allows effective integration of DERS at distribution level. In fact, individual DERS are too small to be granted access to the energy market. Likewise power utilities are unable to effectively control and manage small DERS. Moreover, MGS have the potential to integrate large quantities of renewable generation through highly localized optimization of distributed generation output, demand flexibility and storage assets. These control and automation systems are supported by massive integration of ICT within the MG and to the utility grid. This comes with new challenges especially for cybersecurity. In fact, all these features act to increase the entry points to the system and thus its exposure to cyber-threats.

The work presented in this paper investigates cyberphysical security aspects of the MG. The remainder of this paper is structured as follows. Section II describes the conecpt of MG as a cyber-physical system. Then, in section III, we discuss MG threat landscape through a vulnerabilities, threats and threat agents analysis. In section IV, we present a detailed analysis of potential attacks and thier impacts on MG operations and we review some good practices to be used in order to minimize risks. Finally, section V concludes the paper.

II. SYSTEM IDENTIFICATION

A cyber-physical system is co-engineered interacting networks of physical and computational components [START_REF]Cyber-physical systems[END_REF]. The main task of the system is accomplished by its physical part, whereas the cyber part is the enabler for smarter services to maximize the system efficiency. The MG can be identified as a cyber-physical system. The physical system is the power infrastructure, while the cyber system is composed of the control, automation and communication infrastructure. In the following, we describe MG subsystems. From physical perspectives, a MG is a distributed electric power system. It is formed by the aggregation of geographically localized distributed energy resources that are controlled to provide end-users with predefined load profiles and power quality and reliability. These resources could be renewable or non-renewable power sources, storage, electric vehicles, loads, etc. There are no conceptual restrictions on interconnections between components within the MG and any technically feasible connections between sources loads and storage are allowed. MGS could be built to operate in either islanded, grid-connected or both modes. For the connected MG, the number of connection points to the utility grid varies although a common connection point is commonly used. Remains that the whole system is presented to the main grid as a single controlled entity. Figure 1 shows the basic structure of a MG.

B. Microgrid Cyber system

MGS should provide reliable electric service when connected to the main power grid, when operating in islanded mode, and during the transition between these two modes [START_REF] Hatziargyriou | Microgrids: architectures and control[END_REF]. This is accomplished using efficient control, automation and communication that are realized by the its cyber-system. Figure 2 presents a layered architecture of the MG highlighting its cyber-physical aspect. Components of MG physical system, presented at the component layer, are locally controlled by control and automation devices, sensors and actuators presented at the local control layer (e.g. Smart Meter (SM), Building Management System (BMS), Load Controller (LC), Electric Vehicle Supply Equipment (EVSE), etc. . . ) [START_REF] Bidram | Hierarchical structure of microgrids control system[END_REF]. The control Layer comprises a HMI (Human Machine Interface), a server and a historian. The HMI provides an interface to monitor MG operations. The historian is a database used to store information and collected data for the functioning of MG. The server comprises Supervisory Control And Data Acquisition (SCADA) and Energy Management System (EMS). The control center is interconnected to MG components by a communication layer through the intermediary of local controllers. The communication network may be heterogeneous using several technologies ranging from wired such as fiberoptics, cables to wireless technologies [START_REF] Bani-Ahmed | Microgrid communications: State of the art and future trends[END_REF], [START_REF] Monteiro | Review on microgrid communications solutions: a named data networking-fog approach[END_REF]. In addition to the insider communication, MG control center should be connected to utility grid, others adjacent MGS and internet to accomplish optimal operations. For that, firewalls should be used to protect the control center external communications.

III. MICROGRID THREAT LANDSCAPE

A threat landscape defines the list of potential threats and threat agents against a considered system. A threat can result in attacks whenever it exploits system vulnerabilities. As such, in this section, we study the MG vulnerabilities, then we identify potential threats and threat agents against MGS.

A. Microgrid Vulnerabilities

Although the integration of cyber systems into critical physical infrastructures brings benefits, it introduces also a new set of vulnerabilities that may expose the system to a variety of threats. The exploitation of such cyber-vulnerabilities can lead to physical consequences. MG, being a cyber-physical system, inherits of their common cyber-vulnerabilities added to vulnerabilities brought from the specificity of distributed power systems. These vulnerabilities are created by: • The use of Wireless communications. Although such communication technologies bring several advantages to the system, they introduce typical vulnerabilities because communications take place "through the air" using radio frequencies and thus it is difficult to prevent physical access to them, especially in open and accessible areas like public power infrastructure. Risk of attacks such as interception and intrusion is greater than with wired networks.

• The use of heterogeneous communication technologies. Modern power systems are supposed to be handled by communication networks using a variety of technologies. The coexistence of different technologies either wired or wireless will complicate the implementation of a robust and uniform cybersecure policy to protect the communication infrastructure.

• Increasing exposure to external networks. A MG should continuously exchange data with the main grid operators and other MGS at the aim to improve the overall performance of the main grid and ensure the safety of its operations. Such communications with other external networks exposes the system to additional external threats.

• Exposure to Internet. Exchanging data with Internet is essential for MG ancillary services such as weather forecast data, fuel prices, etc, which exposes the MG to numerous attacks conducted through Internet.

• Increasing system automation. Usually, automation control is intended to improve flexibility and effectiveness of a system operations by removing possibility of human error. However, it introduces new vulnerabilities since more access points for the system are available and therefore risk of attacks increases.

• Increasing use of distributed control and automation devices. The sophisticated distributed control of flexible assets and demand within a MG provide the promise of resilience; however, the increased penetration of monitoring and control capabilities open up the possibilities for breaches of security. The digital era will extend and stretch MGs boundaries.

• Cohabitation between legacy and new systems. Since power distribution grid is a shared common infrastructure used by different distribution operators, MG controller is expected to be continuously in contact with these operators in order to improve the overall grid operations, the use of legacy equipment and infrastructures introduces new vulnerabilities.

• Multiple independent systems. Power systems and in particular MGs are composed of diverse systems such as sensors, actuators, computers, payment systems, emergency systems, etc. It is crucial, but difficult, to ensure smooth interfacing, communication and securing between such independent and heterogeneous systems. This increases vulnerabilities. As presented above, the nature of MG makes it severly vulnerable. A vulnerability is considered as a weakness that can be exploited by one or more threats [START_REF]Information technology -Security techniques -IT network security : Part :1 Network security management. International standard, ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission)[END_REF]. Thus MGs are increasingly exposed to cyber-physical threats. In the next section, we identify potential threats for MGs.

B. Potential threats against Microgrid

In order to identify potential threats against MGS, we choose to use the threat model of European Union Agency for Network and Information Security (ENISA) [START_REF] Marinos | Enisa threat taxonomy: A tool for structuring threat information[END_REF]. This model covers mainly cyber-security threats; which are threats directly applied to ICT assets and thus affecting the system operations. It also includes non-IT threats to cover threats to a system physical assets that are necessary for main operations. Based on this model, we identified a set of potential threats that can endanger MGS. These threats can be classified into the following categories:

• Physical attacks caused by intentional offensive actions aiming to achieve maximum distraction, disruption, destruction, theft or unauthorized access to MGS assets. This category is not considered in the current analysis.

• Eavesdropping/Interception/Hijacking. This contains cyber-attacks and intentional malicious activities or abuse targeting digital assets of a system. Threats from this category consist of altering communication between two parties without installing additional tools/software on victim's site .

• Nefarious Activities. This category also contains cyberattacks and intentional malicious activities or abuse targeting digital assets of a system. However, these attacks usually require the use of tools by the attacker. As such, the threat is accomplished through the installation of additional tools/software or performing additional steps on the victim's IT infrastructure/software.

C. Potential threat agents against Microgrid

Determination of the agent behind the attack may help to identify the criticality of the attack. We distinguish 8 types of threat agents: • Corporations, organizations or enterprises that are engaged in offensive tactics. In this context, they are considered as hostile threat agents and their motivation is to build competitive advantage over competitors. Depending on their size and sector, corporations usually possess significant capabilities, ranging from technology up to human engineering intelligence, especially in their area of expertise.

• Cyber-criminals. Threat agents from this category are hostile by nature. Moreover, their motivation is usually financial gain and their skill level is, nowadays, quite high. Cyber-criminals can be organized on a local, national or even international level.

• Insider threat agents including employees and third party. Employees refers to the staff, contractors, operational staff or security guards working for the MG operator. Utilities rely on vendors, system integrators, and other third party service and product providers in order to operate their power facilities. These threat agents can have insider access to private facilities and resources of the MG, they also possess a significant amount of knowledge that allows them to place effective attacks against sensitive assets of the system.

• Hacktivists. This kind of threat agents are politically and socially motivated individuals that use computer systems in order to protest and promote their cause. Moreover, they are usually targeting high profile websites, corporations, intelligence agencies and military institutions.

• Nation states (NS) that have offensive cyber capabilities and use them against an adversary. Nation states have recently become a prominent threat agent due to the deployment of sophisticated attacks that are considered as cyber weapons. From the sophistication of these malware it can be confirmed that nation states have a plethora of resources and they have a high level of skills and expertise.

• Terrorists have expanded their activities and engage also in cyber-attacks. Their motivation can be political or religious and their capability varies from low to high. Preferred targets of cyber terrorists are mostly critical infrastructures (e.g. public health, energy production, telecommunication etc.), as their failures causes severe impact in society and government.

• Cyber-fighters. This type of threat agents presents an emerging phenomenon, the profile consists of patriotic motivated groups of citizens with the potential to launch cyber-attacks. Such groups might have strong feelings when their political, national or religious values seem to be threatened by another group and are capable of launching cyber-attacks. Having said that, one can argue that such groups are special cases (maybe an evolution or yet another instance) of hacktivism. To an extent, such groups may be supporters of totalitarian regimes and, rightly or wrongly, act on behalf of their supporting parties (i.e. governments) by contributing to national activities in the cyber-space. Their activities may include conflicts with other groups (i.e. hacktivists).

IV. CYBER-PHYSICAL THREAT ASSESSMENT

In this section, we perform a detailed threat analysis at the aim to identify their impact on MG operations. We also provide a first level of recovery, mitigation and good practices to protect the system.

A. Physical threats

In this category of threats, the attacker aims to disturb the cyber-system (including communication and control system) through damaging or destroying physical assets of the system, which lead to a partial or global dis-functioning of the system. We describe in table I, the physical attacks that may be performed against a MG control system and communication assets. An attacker could access to facilities that he is not allowed to. E.g. he can access the setpoints in a power or voltage controller and attempt to violate the limitation of safety thresholds and thus damage equipment. He can also access the energy manager and send malicious commands to MG components which may lead to several dysfunctions such as consuming resources, or damaging components.

Employees Hacktivists Terrorists

Central control system

Physical attacks may result in damaging physical assets of the control system of a MG including central control and monitoring system, local control and monitoring equipment and the communication infrastructure. Impacts severity of such attacks varies depending on the degree of the damage and the criticality of the assets damaged. In order to mitigate physical attacks facing MGS, a physical security program should be set up. A physical security program is a combination of physical and procedural measures designed with the aim to deter attackers, detect an occurring (or occurred) unauthorized physical activity, delay an occurring attack by impeding the adversary during and slowing his progress. This allows to respond before attacked assets are compromised and take the right measures once an attack or event has occurred in order to prevent, resist or mitigate the attack and recover from the incident and restore normal operations (as soon as possible). The first protection technique comes from employees maintaining a high level of security awareness. As such, employees must be well formed about physical security policies and procedures such as: types of threats to which the system is exposed, degree of security of each asset, security responsibilities in each work area and location, measures to take to protect the system for each threat and attacker type, requirements to report security issues or incidents in work areas, etc. Another mandatory aspect to protect from physical threats is access and physical entry control. In fact, access should be controlled and/or restricted to system facilities for both information and physical assets, especially for control center facilities (server room, data-center, backup repositories and storage area). This can be achieved through a mixture of physical security measures such as monitored alarm systems, closed circuit television (CCTV), access control systems, locks and keying, guards and patrols, etc.

B. Unintentional data damage

This category covers mainly threats created by unintentional staff members errors. According to [8], although data damage incidents caused by errors has decreased ( from 32% in 2015 to 17.5% in 2016) it is still the highest cause of data damage incidents. We detail in Table II potential unintentional employees errors that may threaten the functioning of a MG. Unintentional threats may lead to sharing sensitive information which results in loss of information confidentiality. They may also endanger system integrity since they introduce softwarebased vulnerabilities to the system. The best practice to decrease the occurrence of unintentional data damage incidents resulted by unintentional employees errors is engaging in staff training to increase the awareness about security issues facing the system. Additional set of techniques should be implemented in order to reduce the exposure of the system to such threats, such as employing identity management systems and advanced authentication techniques (to request additional Identification, authentication and authorization techniques when modifying or discarding data), employing alarms to protect digital assets (to setup additional alerting notifications and alarms when modifying or discarding data), establishing recovery processes and maintain backups of the recorded data, employing encryption for recorded data in order to limit the impact of sharing it with unauthorized entities.

C. Eavesdropping, Interception, Hijacking

Eavesdropping attacks are insidious, because it's difficult to know they are occurring. Indeed, wireless communication are insecure by nature due to the use of radio transmissions which can be intercepted by anyone with an antenna, especially for the case of MG since the network is deployed in public. As such, a combination of techniques are needed to protect against and limit the impact of eavesdropping attacks. These techniques comprise :-engage in staff training to rise awareness and to learn about good practices concerning such attacks,employ encryption in order to protect data. In case of eavesdropping attack, using strong encryption makes an attacker's mission far more difficult since he can not decode data intercepted,network segmentation by limiting access to critical parts of the network,the use of probes when designing the network in order to detect such events,physical security is usually based on "keep the bad guys away" philosophy. For that, even if parts of MG communication network entities are placed in public, limiting access to them may reduce some types of eavesdropping attacks.

D. Nefarious Activities

The main target of attacks from this category is usually the control and monitoring components. This can be done using insecure exposure to the internet or the external network. Attackers may uses vulnerabilities in all assets in order to penetrate to the control center devices and as such he takes control of the whole system. Such attacks may result in catastrophic impacts on MG operations, but can also impact other connected MGs or even the main grid. Using a highly secure system by design is critical to defending against threats listed in table IV. This is achieved by applying a set of security techniques and policies including (but not limited to):the use of advanced authentication capabilities, e.g. multifactor authentication, professional password-generating program,the establishment of a well-defined privilege rights management system, restricting employees' access to certain information and allowing them to only perform specific functions,the implementation of a robust patch management program that identifies vulnerable software applications and regularly updates the software security to ensure ongoing protection from known threats,-the implementation of a holistic approach to data security and use preventative measures to ensure the network security,the use of firewalls and anti-virus software to help identify and block potentially risky web pages,the use of anti-malware solutions,the use of strategies for botnet detection involve analyzing patterns of data sent over the network, and monitoring computer resources usage and external connections,setting a configuration management policy for connecting any hardware to the network. The policy should specify security mechanisms and procedures for various types of hardware, including computers, printers, and networking devices,implementing a Network Access Control solution to enforce configuration policy requirements (e.g., by automatically preventing network access to the devices that do not comply with the network security policies),implementing a strict mobile device usage policy (data encryption, user authentication, anti-malware solutions, etc). All these techniques and policies should be coupled with up-to-date periodic staff training in order to maximize the effectiveness of the security solutions. As such, employees should be aware about threats risking the system, especially those resulting from their on-line bad habits. They should be forbidden from accessing to social media websites while using the system resources and equipment, they should learn about the security threats generated by visiting these sites. In addition to that, employees should be aware about social engineering threats and educated on how to avoid being manipulated. And Comm most important, they should learn about how to maintain the security of their passwords. Other feature putting data at risk and undermining the effectiveness of its IT operations is the insufficiency or lack of a robust data backup and recovery solution. As such, it is mandatory to establish a specified policy defining procedures for data backup, storage, and retrieval. In fact, data and system recovery capabilities allow to reduce the risk of damage associated with a data breach. Thus, it is essential to conduct routine backups of critical data and store backup media in a safe and secure manner.

V. CONCLUSION AND NEXT STEPS

This paper presented an analysis of cyber-physical aspects of MGS. In this analysis, we conducted a vulnerabilities assessment, and we studied MG threat landscape by identifying potential threats and threat agents that could endanger MGS. Then, we performed a detailed cyber-physical threat assessment at the aim of identifying their impacts on MGS. In the future, we will continue exploring cyber-physical security aspects of MGS, we intend to detail cyber-physical attack scenarios and carry out simulations to quantify the impacts of specific attacks on MG operations.

Fig. 1 :

 1 Fig. 1: Basic structure of a microgrid

Fig. 2 :

 2 Fig. 2: Microgrid Layered architecture

TABLE I :

 I Physical Threats

	Threat	Attack senarios	Threat agents	Assets
	Sabotage	These threats may result of several attack sce-	Corporations	Central
	Vandalism	narios aiming to disturb the MG operations by	Cybercriminals	control
		destroying, damaging or obstructing physical	Hacktivists	system
		equipment from components, communication	NS	Local
		and control layers.	Employees	control
			Terrorists	Comm
	Theft	Theft of devices/hardware	Corporations	Central
			Employees	control
			NS	system
			Terrorists	Local
				control
				Comm
	Information	Confidential information about the MG oper-	Corporations	Central
	leakage	ations or state can be shared with unautho-	Cybercriminals	control
		rized entities due to intentional human actions	Hacktivists	system
		(mainly by employees that have access to	NS	Local
		restricted facilities)	Employees	control
			Terrorists
	Unauthorized
	phys-
	ical
	access
	Unauthorized
	entry to
	premises

TABLE II :

 II Unintentional data damage

	Threat		Attack scenarios	Threat agents	Assets
	Erroneous		Confidential private or sensitive data can	Employees	All assets
	information	be distributed or shared with unautho-
	leakage		rized entities due to human errors, using
			applications for mobile devices, web ap-
			plication or by insecure network traffic
	Erroneous		Such threat may lead to errors in main-	Employees	All assets
	use or ad-	tenance process, errors in configuration
	ministration	and/or installation, technological obso-
	of devices,	lescence, unpatched software and in-
	systems		creasing recovery time.
	Usage	of	This may lead to bad decision in control	Employees	Central
	information	process, especially in critical situations,		control
	from		based on unreliable sources of informa-		system
	unreliable		tion or unchecked information.		Local
	source				control
	Unintentional	Loss of information integrity due to hu-	Employees	All assets
	alteration of	man error
	data
	Inadequate		Threats caused by improperly IT As-	Employees	All assets
	design,		sets or business processes design (in-
	planning,		adequate specifications of IT products,
	adaptation		inadequate usability, insecure interfaces,
			policy/procedure flows, design errors)

TABLE III :

 III Evesdropping/Interception/Hijacking , locating and possible exploitation of connection to wireless networks. The motivation of such attack varies from performing it as a hobby, or to steal data and/or perform malicious activities, as such the criticality of this threat depends of the type of threat agent performing the attack Threat in which valid data transmission is maliciously or fraudulently repeated or delayed. For example, an attacker may manipulate the incoming DR signals, they can be delayed or repeated, DR adherents may receive these signal not in the right moment and response to the false event, which may cause instability of the grid in addition to the financial impacts on both customers and (utility). This type of attacks is a form of active eavesdropping in which an attacker makes independent connections with the victims and relay or alters of communication between them. The attacker makes the victims thinking that they are talking directly to each other over a private connection while he is controlling and manipulating the whole communication process.

	Threat	Attack Scenarios	Threat agents	Assets
	Wardriving	Threat of searchingcomm
	Intercepting compro-	Threat of disclosure transmitted information using interception and analysis of compromising emission	Corporations, Cybercriminals,	Comm
	mising emissions		Hacktivists, NS, Employees,
			Terrorists
	Interception of infor-	Threat of interception of information improperly secured in transmission or improperly actions of staff.	Corporations, Cybercriminals,	Comm
	mation	Corporate espionage and unsecure Wi-Fi and rogue access point are examples of interception of information	Hacktivists, NS, Employees,
		attacks	Terrorists
	Interfering radiation	Threat of failure of IT hardware or transmission connection due to electromagnetic induction or electromag-	Corporations, NS, Terrorists	Comm
		netic radiation emitted from an another source
	Replay of messages		Cybercriminals, Employees,	Comm
			Terrorists
	Network reconnais-	Threat of collecting information about network to identify security weaknesses	Corporations, Cybercriminals,	Comm
	sance and informa-		Hacktivists, NS, Employees,
	tion gathering		Terrorists
	Man in the middle/		Corporations, Cybercriminals,	Comm
	session hijacking		Hacktivists, NS, Employees,
			Terrorists
	Repudiation of ac-	People, including public authorities, may modify data (such as AMI data) and thus refuse to acknowledge	Corporations, Cybercriminals,
	tions	an action that took place	Hacktivists, NS, Employees,
			Terrorists

Identity theft attacks by exploiting existing vulnerabilities, or using Trojans over private PCs. Once an attacker steals identity of an employee or administrator, he gains high privileges in the system and access to privileged data. As a result, he may take control of the system as such disturb the global functioning of the MG. He may also change configuration or sensitive data to perform more sophisticated attack, for example, he can leverage implementation weaknesses or lenient access control lists to elevate his privilege level and abuse the new access rights gained as a result.

Corporations, Cybercriminals, Hacktivists, NS, Employees, Terrorists

All assets

Receive of unsolicited E-mail This can affect information security and efficiency of work (SPAM, unsolicited infected e-mails) Cybercriminals Central control system Denial of service (DoS) Threat of deny of service type attacks at information systems/services. In a DoS attack, a perpetrator uses a single source connected to the network (or from the internet) to either exploit a software vulnerability or flood a target with fake requestsusually in an attempt to exhaust system resources ( mainly the communication network and the server). This type of attack can also be launched from multiple connected devices that are distributed across the network (or from the internet), it is then called a distributed DoS (DDoS). This disturb the communication network and probably makes it unavailable, as such it leads to prevention of authorized access to multiple system resources or the delaying of system operations and functions. A of DoS attack on network layer may, for example, result in blocking the incoming broadcast DR signals. A example of DoS attack on application layer may consist of flooding the server at the control center with fake requests leading to blocking the control system.

Cybercriminals Hacktivists

Central control system communication

Malicious code/ software/ activity Threat of malicious code or software execution including search Engine Poisoning, exploitation of fake trust of social media, worms/ Trojans, mobile malware, alternation of software, infected trusted mobile apps, elevation of privileges, phishing attacks, web injection attacks (Code injection: SQL, XSS), exploit Kits. Using such type of attacks, an attacker can gain complete control of the system.

Corporations, Cybercriminals, Hacktivists, NS, Employees, Terrorists Central control system, Local control system, Social engineering attacks involve some form of psychological manipulation, fooling otherwise unsuspecting users or employees into handing over confidential or sensitive data. Commonly, social engineering involves email or other communication that invokes urgency, fear, or similar emotions in the victim, leading the victim to promptly reveal sensitive information, click a malicious link, or open a malicious file. Because social engineering involves a human element, preventing these attacks can be tricky for enterprises. Such attacks are performed using malicious software such as : Rogue security software like Rogueware (a malicious software pretending to detect and fix problems on victim's computer, and uses this pretense to convince the victim to provide money or install more malware), Scareware (a malicious software meant to raise uncertainty or to scare a victim, its purpose is to make the victims feel threatened of imminent (unreal) danger and to make them pay to eliminate it), Ransomware (a malicious software used by a hackers to take control of a computer system and block access to it until a ransom is paid) Cybercriminals Hacktivists

Central control system

Abuse of information leakage

Leakage affecting mobile privacy and mobile applications, leakage affecting web privacy and web applications, leakage affecting network traffic Corporations, Cybercriminals, Hacktivists, NS, Employees

Central control system Generation and use of rogue certificates

Loss of (integrity of) sensitive information, man in the middle/ Session hijacking, Social Engineering / signed malware (e.g. install fake trust OS updates) Corporations, Cybercriminals, Hacktivists, NS, Employees

Central control system

Manipulation of hardware and software Threat of unauthorized manipulation of hardware and software such as anonymous proxies, abuse of 0day vulnerabilities (0-day vulnerabilities are vulnerabilities that are not publicly reported or announced before becoming active. Such attacks consists of exploiting a software vulnerability before the software owner becomes aware of it and before the vulnerability becomes widely known to the internet security community, this makes these attacks are among the hardest to mitigate and leave computer systems and networks extremely vulnerable), access of web sites through chains of HTTP Proxies (Obfuscation), access to device software, alternation of software, rogue hardware Corporations Cybercriminals Hacktivists NS Employees

All assets

Manipulation of information

Threat of intentional data manipulation to mislead information systems or somebody or to cover other nefarious activities (loss of integrity of information), falsification of records


David Coeurjolly
email: david.coeurjolly@univ-lyon2.fr

Visibility in Discrete Geometry: an application to discrete geodesic paths

In this article, we present a discrete definition of the classical visibility in computational geometry. We present algorithms to compute the set of pixels in a non-convex domain that are visible from a source pixel. Based on these definitions, we define discrete geodesic paths in discrete domain with obstacles. This allows us to introduce a new geodesic metric in discrete geometry.

Introduction

In discrete geometry, many Euclidean geometric tools are redefined to take into account specificities of the discrete grid. In this article, we propose a definition of the classical Euclidean visibility based on discrete objects. The interest is double: on one hand we extend the discrete geometry with a new tool and on the other hand, since this visibility allows us to define discrete geodesic paths and discrete shortest paths, we have a practical tool needed by many applications in medical imaging or image analysis to estimate geodesic distance in non-convex domains.

The visibility definition we propose is based on classical Discrete Straight Lines (DSL for short). Many algorithms exist for the DSL recognition problem. Some of these approaches are based on chain code analysis [START_REF] Wu | On the chain code of a line[END_REF], on links between the chain code and arithmetical properties of DSL [START_REF] Debled-Rennesson | Etude et reconnaissance des droites et plans discrets[END_REF][START_REF] Debled-Rennesson | A linear algorithm for segmentation of digital curves[END_REF], on links between the chain code and the feasible region in the dual -or parameter-space [START_REF] Dorst | Decomposition of discrete curves into piecewise straight segments in linear time[END_REF][START_REF] Lindenbaum | On recursive, o(n) partitioning of a digitized curve into digital straigth segments[END_REF][START_REF] Vittone | Recognition of digital naive planes and polyhedization[END_REF] and others on linear programming tools such that Fourier-Motzkin's algorithm [START_REF] Franon | Recognizing arithmetic straight lines and planes[END_REF]. All these algorithms present a solution either to decide if a given set of pixels is a discrete straight segment (DSS for short) or to segment a discrete curve into DSS, or both. In our case, the problem is quite different, we want to decide if there exits a DSS between two pixels in a non-convex domain.

We present definitions and algorithms to compute the set of pixels which are visible from a source. Then, we define a notion of discrete geodesic path and a metric associated to such path based on this visibility definition. We also proposed an efficient implementation of the geodesic distance labelling from a source pixel.

Notions and definitions

Let us denote D a discrete domain, that is a n-connected set of pixels. We denote D the complement of D, we call this set indifferently the background or the set of obstacles. In the following, we consider D a 8-connected domain.

In this domain, we define the discrete visibility by analogy to the continuous definition.

Definition 1 (Discrete Visibility) Let s and t be two pixels in D, we define the discrete visibility as a binary relationship v : D → D such that we have v(s, t) if and only if there exists a 8-connected discrete straight segment from s to t whose pixels belong to D Before introducing the visibility problem in non-convex domain, we recall classical parameter space characterizations of DSL [START_REF] Lindenbaum | On recursive, o(n) partitioning of a digitized curve into digital straigth segments[END_REF][START_REF] Mcilroy | A note on discrete representation of lines[END_REF][START_REF] Vittone | Recognition of digital naive planes and polyhedization[END_REF]. If we consider an Euclidean straight line y = αx + β, the digitization of this line using the Grid Intersect Quantization (see [START_REF] Jonas | Digital representation schemes for 3d curves[END_REF] for a survey on digitization scheme) is the set of discrete points such that:

∆(α, β) = {(x, y) ∈ Z 2 | - 1 2 ≤ αx + β -y < 1 2 }
Note that all classical digitization schemes (GIQ, Object Boundary Quantization or Background Boundary Quantization) can be used and such a choice will not interfere in our algorithms. We choose the GIQ scheme because of its symmetry properties.

In the parameter space of the previous definition, we can describe the set of Euclidean straight lines whose the digitization contains a pixel p(x, y):

S p = {(α, β) ∈ R 2 | - 1 2 + y ≤ αx + β < 1 2 + y}
A pixel in D defines a strip in the (α, β)-space delimited by two lines L 1 : αx + βy ≥ - 1 2 and L 2 : αx + βy < 1 2 . If we want to know if a set of pixels belongs to a DSL, a classical way is to compute the intersection in the (α, β)-space of strips associated to each pixel. If the feasible domain is not empty, it describes all DSL containing the pixels (cf figure 1 for an example). In the following, we define the domain S(s, t) associated to pixels s and t the, intersection S s ∩ S t .

In order to compute the visibility in non-convex domains, the main idea is to check in the dual space if domains associated to obstacle pixels do not hide the current pixel t from the source s.

Visibility domain

Let o denote an obstacle pixel. If we want to describe the set of Euclidean straight lines whose digitizations do not contain o, we also introduce a strip in Fig. 1. An example of S(s, t) domain with pixels (0,0) and [START_REF] Coeurjolly | Segmentation and length estimation of 3d discrete curves[END_REF][START_REF] Braquelaire | Error free construction of generalized euclidean distance maps and generalized discrete voronoï diagrams[END_REF], the S(s, t) domain in the parameter space defined by inequations :

{β < 1/2, β ≥ -1/2, β < -3α + 5/2, β ≥ -3α + 3/2}.
the parameter space such that the inequations are reversed. Hence, an obstacle o is associated to constraints L1 (o) : αx+β-y < -1/2 and L2 (o) : αx+β-y ≥ 1/2. If we want to know if this obstacle blocks the visibility from s to t, we just have to compute in the (α,

β)-space L 1 (s) ∩ L 2 (s) ∩ L 1 (t) ∩ L 2 (t) ∩ L1 (o) ∩ L2 (o). If this intersection is empty then t is not visible from s.
More generally, if we consider a non-convex domain D and a set of obstacle pixels O = {o i } i=1..n that is a restriction of D such that all point abscissas are between the abscissa of s and the abscissa of t (all other points can be omitted for the visibility problem). We have the lemma: Lemma 1 Let s be the source and t a pixel in D, t is visible from s in D if and only if:

S(s, t) ∩ i=1..n L1 (o i ) ∩ L2 (o i ) = ∅
The proof of this lemma can be deduced by the visibility definition and by construction of S.

Obviously, we do not have to consider all obstacle pixels. We first define:

Definition 2 A pixel o in O is called "blocking pixel" for the visibility problem v(s, t) if: S(s, t) ∩ L1 (o) ∩ L2 (o) = S(s, t)
and the abscissa of o is between the abscissa of s and t.

These blocking pixels are those which interfere in the visibility problem. Nonblocking pixels in O can be removed from the v(s, t) test. We can characterize the shape of the domain when a blocking pixel modifies it:

Lemma 2 If o is a blocking pixel for the v(s, t) problem, either the domain S(s, t) ∩ L1 (o) ∩ L2 (o)

is empty or it has only one connected component.

Proof: we consider the domain S(s, t) and a blocking pixel o such that o, s and t are not collinear (in that case, the domain is empty). We show that either L1 (o) or L2 (o) crosses the domain. We have different cases (cf figure 2-a) that induce two components but the left and the middle cases are excluded because they imply that the abscissa of o denoted x o is not between x s and x t and thus, o is not a blocking pixel according to definition 2. As the matter of fact, if x o is between x s and x t , then the slope of L1 (o) is between the slope of L 1 (s) and the slope of L 1 (t). By construction of the strips, the vertical distance between L 1 and L 2 is equal to 1. Hence, in figure 2-b, the intersection in a ′ of L1 with the vertical line going through b implies that b ′ must be outside the interval [a, b] on the vertical line. Since the slope of L2 is greater than the slope of the edge cb, L2 cannot cross the domain. Same idea can be applied when L2 crosses the domain. Hence, all cases of the figure 2 According to this lemma, if a straight line L1 (resp. L2 ) of an obstacle crosses the domain, the other constraint L2 (resp. L1 ) can be removed for the visibility problem. Geometrically, an obstacle such that L1 crosses the domain is above the Euclidean segment [s, t] and an obstacle such that L2 crosses the S(s, t) domain is beneath the segment [s, t] (cf figure 3 for an example). We denote U(s, t) the set of blocking pixels above [s, t] and L(s, t) the set of blocking pixels beneath the segment [s, t].

Visibility algorithm

In this section, we present algorithms that compute the equivalence class associated to the visibility binary relationship of a source s.

We propose two algorithms, the first one computes the equivalence class with the visibility definition given above, and the second one introduces a new visibility definition that is a restriction of the previous one but the associated algorithm complexity justifies this new version of the visibility.

The first algorithm we propose is a really straightforward computation of the visibility. Indeed, we can use classical linear programming tools to solve the linear inequation system given by obstacle constraints. Such tools are for example the Fourier-Motzkin [START_REF] Franon | Recognizing arithmetic straight lines and planes[END_REF] system simplification algorithm, the Simplex algorithm or the Megiddo's algorithm [START_REF] Megiddo | Linear programming in linear time when the dimension is fixed[END_REF]. Note that the complexity of the Megiddo's algorithm is linear in the number of inequations but the problem comes with the dimension of the system. In our case, the constraint system is in dimension 2 and thus the implementation of the Megiddo's algorithm is tractable with a complexity bounded by 4n where n is the number of inequations.

We consider a source s, a domain D. We label all pixels in D using a breadthfirst tracking of the domain using for example the 8-adjacency. During the propagation process, if we meet an obstacle we store its coordinates in a list O. At each pixel visited in the breadth-first tracking, we extract from O the set of blocking pixels and we solve the visibility problem using the Megiddo's algorithm. If we denote n the number of pixels in D and m the number of obstacles in O, each step in the while loop has got a complexity bounded by O(m). Hence, the global cost of this algorithm is O(nm).

Due to the difficulties to provide an efficient data structure to propagate blocking points from a point to its neighbors, this algorithm has a quite important complexity and is not efficient for the geodesic computation. Thus, we propose a new definition of the discrete visibility which is a weak version of the definition presented above but that leads to an efficient algorithm for the visibility computation and the discrete geodesic problem.

Definition 3 (Weak Discrete Visibility) Let s and t two pixels in D, we define the weak discrete visibility as a binary relationship v * : D → D such that we have v * (s, t) if and only if there exists an Euclidean straight line going through s and whose digitization contains t and no pixels in D between s and t.

Instead of considering the inequation associated to s, we constraint the set of Euclidean lines to go through s. This new definition restricts the previous one and make the visibility not be a symmetric binary relationship. However, this definition allows an efficient data structure for the visibility test. We suppose that all obstacle pixels are sorted by polar angles using s as the origin. Using this data structure and the above definition, we have the following property.

Proposition 1 Given a set of obstacles sorted by polar angles of center s and a point t, we denote u the minimum of U(s, t) and l the maximum of L(s, t). We have:

v * (s, t) ⇔ S * (s, t) ∩ L1 (u) ∩ L2 (l) = ∅
where S * denotes the new domain associated to the weak visibility which is now a segment in the parameter space.

Hence, instead of considering all blocking pixels, we just have to test two characteristic pixels given by a polar sort. The proof of this property is a straightforward application of the visibility definition. Note that the polar sort can be done with integer arithmetic.

We can present the algorithm associated to this definition:

Weak visibility algorithm Input: a domain D and a source s Output: the set of pixels which satisfy v(s, t)

Let Q be a FIFO queue Let O be the obstacle list sorted in a polar trigonometric order of center s Append last(s,Q)

While Q is not empty t:=remove first(Q) For each 8-neighbor n of t not labelled closed or visible If n is an obstacle then Append sort(n,O) else Let (u, l) be the localization of n in the sorted set O If S * (s, t) ∩ L1(u) ∩ L2(l) = ∅ then Label n as visible Append last(n,Q) else
Label n as closed //n is not visible and the point is closed endFor endWhile

The visibility test has got a constant time cost and according to the data structure, both localization and obstacle insertion have a cost in O(log(m)). Thus, the global cost of this algorithm is O(nlog(m)). Moreover, the cone (s, u, l) associated to a point t can be propagated for both localization and insertion to reduce the expected complexity of the algorithm that makes this labelling very efficient.

Discrete shortest path and discrete geodesic metric

Based on these definitions of the visibility, we can define discrete shortest paths and discrete geodesic paths.

Definition and previous works

We first remind some classical facts on discrete metrics that approximate the Euclidean one. All discrete metrics are based on:

either a mask approach where elementary steps in the neighborhood graph are weighted in order to approximate the Euclidean distance of these steps. For example, elementary steps of the Manhattan distance (or d 4 ) are horizontal or vertical moves weighted to 1, the chess-board distance (or d 8 ) also considers diagonal moves weighted to 1. More generally, chamfer metrics first list elementary moves and then associate weights to each move (see [START_REF] Borgefors | Distance transformations in digital images[END_REF][START_REF] Verwer | Local distances for distance transformations in two and three dimensions[END_REF] for initial works) ; -or a vector approach that leads to exact Euclidean metric where displacement vector (dx, dy) is stored and then the distance can be exactly computed d = dx 2 + dy 2 but the main goal is to design distance map algorithm that only deal with the integer displacements [START_REF] Danielsson | Euclidean distance mapping[END_REF][START_REF] Ragnemalm | Contour processing distance transforms[END_REF][START_REF] Cuisenaire | Distrance Transformations : Fast Algorithms and Applications to Medical Image Processing[END_REF].

For the discrete geodesic problem, the mask based approach leads to efficient algorithms because a weighted graph can be computed from the metric and the adjacency graph of the domain D and thus, classical shortest path algorithms can be applied such as the Dijkstra's graph search algorithm [START_REF] Piper | Computing distance transformations in convex and nonconvex domains[END_REF].

In the following, we use the data structure and the implementation of the geodesic mask given by Verwer et al. [START_REF] Verwer | An efficient uniform cost algorithm applied to distance transforms[END_REF]. The authors describe an bucket sorting implementation of the Dijkstra's graph search algorithm which leads to a uniform cost algorithm.

In [START_REF] Cuisenaire | Distrance Transformations : Fast Algorithms and Applications to Medical Image Processing[END_REF], Cuisenaire proposes a region growing Euclidean distance transform using the same structures but the bucket are indexed by the square distance dx 2 + dy 2 . For all the visible pixels from the source, this algorithm provides a good estimation of the Euclidean distance metric. This algorithm is not error-free but we will discuss this point later.

In [START_REF] Moreau | Modélisation et génération de dégradés dans le plan discret[END_REF][START_REF] Braquelaire | Error free construction of generalized euclidean distance maps and generalized discrete voronoï diagrams[END_REF], Moreau presents an algorithm for the geodesic metric problem based on a discrete arc chain code propagation scheme but some operations to maintain the data structure are expensive. In our case, we use a uniform cost data structure from which we can extract arc chain code but the visibility property is propagated instead of iso-metric points.

Algorithm

The main idea of our discrete geodesic algorithm is the following: for all pixels which are visible from the source, we do not have any problem to compute their distance because it exists a discrete straight line between the source and these points and thus, we can compute the displacement vector and return dx 2 + dy 2 . If a pixel p is not visible, we start a new visibility computation such that p is a new source and each pixel t such that v(p, t) will be labelled by the distance from p to the source plus the distance between p and t.

More formally, we have the following purely discrete definition of a geodesic path in D: Definition 4 (Discrete Geodesic Path) A discrete geodesic path between a point t and a source s is a sequence of pixels in D denoted {p i } i=0..n+1 with p 0 = s and p n+1 = t such that:

v(p i , p i+k ) iff k = {-1, 0, 1} with i = 1..n
And such that the geodesic distance d geodes (s, t) is minimal. The geodesic distance is defined by: The discrete geodesic path is thus a 8-connected curve that is segmented into DSS by construction. The metric we associate to this curve have been intensively studied and both the stability and multigrid convergence have been proved [START_REF] Kovalevsky | Theoritical and experimental analysis of the accuracy of perimeter estimates[END_REF][START_REF] Klette | Convergence of calculated features in image analysis[END_REF][START_REF] Coeurjolly | Segmentation and length estimation of 3d discrete curves[END_REF].

In order to design an efficient algorithm based on the Verwer's bucket structure [START_REF] Verwer | An efficient uniform cost algorithm applied to distance transforms[END_REF], we consider rounded geodesic distance to index the buckets: a pixel p belongs to the bucket d if and only if:

⌈d geodes (s, p)⌉ = d
This estimated metric is still consistent for the Verwer's algorithm (A *algorithm) because it satisfies the triangular inequality [START_REF] Moreau | Modélisation et génération de dégradés dans le plan discret[END_REF][START_REF] Braquelaire | Error free construction of generalized euclidean distance maps and generalized discrete voronoï diagrams[END_REF]:

for a, b, c ∈ R a + b ≥ c ⇒ ⌈a⌉ + ⌈b⌉ ≥ ⌈c⌉
For a computational efficiency of the algorithm, we implement the v * -visibility. Hence, at each pixel p in the buckets d, we associate a data structure that contains: its coordinates, the current source pixel p i such that v(p i , p) and the distance d geodes (s, p i ).

We also have an obstacle data structure associated to each new source. Each obstacle list contains the set of obstacles sorted by polar angles met during the visibility propagation associated to each source.

We can know present the discrete geodesic algorithm. Note that some steps of this pseudo-code are not detailed for sake of clarity.

  -a are impossible and thus, S(s, t)) ∩ L1 (o) ∩ L2 (o) has only one connected component.

Fig. 2 .

 2 Fig. 2. a) Different cases that induce two connected components, the left case and the middle case are impossible by definition of blocking points. The third case must be taken into account b) illustratcfion of the proof of lemma 2.

Fig. 3 .

 3 Fig. 3. Visiblity domain associated to a set of blocking pixels. The black feasible region in the parameter space is the visibility domain associated to grey pixels constrained with the black blocking pixels.

d

  geodes (s, t) = n i=0 d euc (p i , p i+1 ) where d euc (a, b) denotes the Euclidean distance between pixels a and b.

Discrete Geodesic Algorithm

Input: a domain D, a source s and a goal g Output: the geodesic distance for each pixel of D Let Bucket[i] be an array of FIFO

Experiments and discussions

In our experiments, we compute the geodesic distance labelling of a binary image according to the coordinates of a source. In figure 4, we present the distance labelling with three metrics: d 4 , d 8 and d geodes in various domains. Geodesic distances are represented using a circular gray scale map in order to check the wave front propagations. In figures 5, instead of labelling the pixels according to their distance, pixels with the same color belong to the same equivalence class for the visibility problem. An illustration of these figures can be the minimum number of guards needed to control a room and the visibility associated to each guard (the first guard is given here).

In figure 6, we present discrete geodesic metric on a blood vessel network. The domain is computed using a segmented angiography image.

Using this geodesic distance algorithm, we naturally would like to apply this algorithm to compute the discrete Voronoi diagram or the Euclidean distance Fig. 4. From the left column to the right column: the discrete domains and the source point (isolated white pixels), the geodesic labelling using d8, the geodesic labelling using d4, the geodesic labelling using d geodes . transform just considering multiple sources. Since this algorithm use a local propagation scheme (as the Cuisenaire's algorithm [START_REF] Cuisenaire | Distrance Transformations : Fast Algorithms and Applications to Medical Image Processing[END_REF]), the classical Danielsson's algorithm errors are not solved in this approach. Hence, this algorithm presents a solution to this problem but errors may occur.

Conclusion

In this article, we have presented a discrete definition of the visibility in classical computational geometry. This definition is based on well known discrete objects (DSS) and is computed only with integers. Based on this definition, we have presented several algorithms to solve several problems: if we want to decide if there exist DSS between two pixels, we have a cost linear in the number of obstacle pixels O(m) ; if we want to label all pixels in a domain visible from a source, we have an algorithm in O(nm). Using the weak visibility definition, we reduce the complexity of both algorithms respectively to O(log(m)) and O(nlog(m)). We also have presented a definition of discrete geodesic paths and an algorithm that compute the geodesic distance of each point in the domain according to a source. This article also introduces open problems: is it possible to find an efficient data structure for the straightforward visibility algorithm ? How to generalize this approach for 3D domains and for discrete surfaces ? For this last problem, solutions exist in mask based approaches [START_REF] Kiryati | Estimating shortest paths and minimal distances on digitized three-dimension surfaces[END_REF][START_REF] Di Baja | Detecting centres of maximal discs[END_REF] but for the proposed method, discrete straight lines in 3D are well studied [START_REF] Coeurjolly | Segmentation and length estimation of 3d discrete curves[END_REF] and thus similar visibility algorithm is expected.